Schneier on Security

Clive Robinson • December 17, 2016 5:30 AM

@ r,

Squid would be an upgrade for what I normally get.

If you must hang out with “scatty”[1] women, then you will always be “manche le merde”

[1] A word that has had a number of meanings over the years one would be now https://en.wiktionary.org/wiki/scatophilia

Clive Robinson • December 17, 2016 11:39 PM

@ John,

How do I verify this, I do not have access to X-ray equipment ?

That is just an “Oh So Sixties” soloution… And realy only works against metallic technology, which is such a “US thing” since the U2 fell to earth…

Putin and Co don’t like that sort of technology except for toys, they like the “human touch” with X-Ray undetectable ceramics and plastics etc. So you are going to need a portable nuclear reactor or bucket of Californium-252 to use neutrons instead. But you will probably have to drag them across the hot coals, or watetboard them [1] to get them just right techniques the KGB would approve of 😉

Apparently due to the many and grevious failings of TSA and similar brown/black shirt staff to “spot the obvious” the DHS is looking to use epithermal neutrons to make the obvious, well “more bleed’n obvious”[2]… Thankfully so far nobody has come up with a viable commercial solution…

[1] For imaging you generaly need to slow the neutrons down in various ways, this can be done with water, polythen, or the use of carbon as graphite. The resulting “thermal neutrons” may be not quite right, therefor the graphite may be heated to get a different profile of thermal neutrons termed epithermal neutrons.

[2] That less than subtle and immensely costly bureaucratic insanity that Einstein so neatly described…

Clive Robinson • December 18, 2016 6:03 AM

@ Nick P,

Spent the last few days mostly focused on an incrementally-verified bootstrap.

Been there, done that, got the tee shirt and tasted the dog food 🙁

Good luck on it, I started by writing my own assembler in BASIC on an Apple][ first, then later reworked it for an IBM PC. I had access to Whitesmiths C[1] using it to get the Tiny C Compiler up and running with my assembler…

You will find both the Plauger books and Dragon book to be essential reads (and still available).

https://en.m.wikipedia.org/wiki/Whitesmiths

Clive Robinson • December 18, 2016 6:41 AM

@ r,

… but it [AV] quickly got to the point where only things like tripwire could give you a fighting chance in hell.

I realised that AV was “the wrong way” back in the days of Dr Solomon before people had heard of the Internet, or for that matter seen Local Area Networks outside of Universities (anyone else remember the Cambridge Ring, or Newcastle Connection?).

I had realised that as in all “who dunnits” the serious threat was the “trusted insider” like the Buttler who “guarded the door”. Which is all the original AV was…

But the likes of “tripewire” were a longtime in the future back then, I started taking an interest in what we now call “gapping” and “strongly mandated interfaces” and the more interesting EmSec issues not just TEMPEST.

By the time Kim and Spafford brought “tripewire” into the world in 92 and made it a stable product I had realised it likewise was in effect just another “Buttler” and that the problem was not if they abused the trust or not, “they were inside”…

That is the malware had got into the system and the damage was probably done… Back then “Bastion Hosts” and “application wrapper firewalls” were starting to get going and were going somewhere interesting. Unfortunatly the industry “wanted single box appliances” with just a power switch or software application they could “install and forget”. That’s what they payed for good or bad, and that’s what we have got and withit the hamster wheel of sys admin pain.

Like AV before it tripewire is nolonger upto the job by it’s self and people seriously need to think where they are going to be alowed to go by the powers that be. Because we left it to late and now we are nolonger masters of our own homes let alone destiny, and must pay tribute to “The Man” or get smited by law, be it civil or criminal, as the man is now corporate as he is federal.

Clive Robinson • December 18, 2016 7:25 AM

@ r,

Ab, and Nick are pushing the solutions – but without being able to reach into the hardware it’s moot.

Which is a point I made some time ago on this blog… Have a look for the very many Castle -v- Prison or C-v-P discissions our host was kind enough to alow to happen.

Put simply, after some thought you will realise you can not trust anything below your chosen point in the computing stack including all the way down at the device physics layers.

So you are trying to build your castle –as every man’s home is– on shifting sands. Which has always been “a fools errand” as it can not be reliably done, and you end up forever mitigating problems in your design and not where you should be devoting your effort to. It’s the old “Drain the swamp” problem where you are to busy fighting the crocs to actually drain the swap to solve the croc problem once and for all as by removing the water where they hide.

The soloution to the shifting sand and croc problem is don’t bother, mitigate instead. If you can not trust what is below, build your castle like a battle ship so it rises to any occasion and the perfidity of what is below nolonger endlessly occupies your time.

There is a very old game about truth, lies, and two guarded doors behind which certain death hides behind one and freedom the other. Appart from this all you know is one guard always lies, the other always tells the truth, and you are alowed but one question before you chose a door to walk through to your fate.

The trick is to ask a question that in effect goes through both guards and you then know the answer will be false because of the lying guard. So you ask either guard “If I was to ask the other guard the way to freedom which door would he point to?”.

It is the story behind this ages old riddle and how it gave rise to the idea of electronic voting protocols in the New York Telephone company then NASA that gives rise to how you mitigate the trust issue.

I’ve talked about it a bit more depth in the past on this blog,

https://www.schneier.com/blog/archives/2014/01/souffletrough_n.html#c3604056

When others have asked for the impossible of a “Trusted Computer”.

Clive Robinson • December 18, 2016 2:56 PM

@ Nick P,

But some that oppose it for beginners still say it’s good to read after you get the topic.

It’s funny thay should say that, but I’ve always liked it, in fact the 1988 reprint is sitting at my right elbow as I type this as I was refering to it this afternoon for something I’m typing up.

I had the Holub book, but I made the mistake of loaning it to someone, and it did not come back 🙁 before they scarpered to Australia… (I know I can get annoying about getting my books back, but to scuttle half way around the world, I ask you 😉

I also had a book on small C but that was nicked from my desk at a place I was working at many years ago, as was my original K&R book… It just goes to show some work colleagues have less honour than some criminals no wonder Scott Adams calls them “Cow orkers”

As for compiler books becoming “out of date” it Depends on your view point. They obviously worked for the compilers of their day, and thus will still help you get a compiler up and running. Are they uptodate on the latest tricks, no but then for what you aim to do those tricks may well be a bad idea. The KISS principle applies at all times as does the old *nix advice of “First understand, second prototype, third get it to run reliably, then quit whilst you are ahead of the game”.

Optimisation rarely gives useful benift other than for your CV, C is a fairly poor excuse for an optimising language any way as it’s totally lacking in ways that realy make it the lowest common denominator of the worst machine code languages ever invented. Just ask anyone who has tried to write a serious maths package using it (don’t be suprised if they fling garlic and holy water at you whilst trying to stake you out 😉

Much as I like it and it’s deficiencies C is like the old joke about asking a farmer for directions and getting the advice of “If I was you I would not start from here”.

My advice to anyone who has to optimise for speed or memory is “Not in C”, go direct to machine code and save yourself a lot of pain. Likewise if you are embedding an app “loose the C standard library” you realy don’t need that load of old… Likewise “cast pointers to void” and for gods sake do your own memory managment especially garbage collection. If you can not do all of that then time to consider a non embedded future. Oh one other thing with embedded, OS less, work with more modern CPUs with memory caches, learn how to use that memory as “extended registers” or as stack can give you both speed and power saving.

Clive Robinson • December 18, 2016 11:51 PM

@ AlanS,

But that was Hayek’s point: that all planning was futile and that politics had to be replaced by the market.

Hayek had two problems in life, the first was he did not grok what engineers understand, the second he lost control of his own words to the point they became meaningless in the hands of others.

Most engineers get to understand that in real life only three numbers make any real kind of sense, zero, one and approaching infinity, and any other number has to be “held in place”.

That is in one view there can be nothing of something, something unique and any number of things, depending on how and why you measure. Importantly they all sit on a line and time takes things to zero whilst gain takes things to infinity, thus any other value changes continuously unless it is measured and feedback applied.

What those who worship at their temple of Hayek appear to have understood incorrectly is that feedback is neither perfect or for that matter single source. Any engineer who has started a large DC Motor “off load” or likewise a diesel motor understands what a runaway process is, any engineer who has tried to build an autonomous control system or regulator for them understands why you can not control by prediction only by continuous measurment and comparison. Further that engineer quickly finds that the gain of such regulation has to be right as well, otherwise things are to sluggish or dangerously fast, hence you have to “criticaly damp” your control loop dynamicaly otherwise the likes of inertia and load change will cause significant problems.

Our economy is the result of not one simple machine that maths finds hard to describe, but millions many of which fight each other in complex ways. Engineers know from experience with power grids and the like how you can deal with such a bag of snakes, and they know it can never be optimal or even close to efficient, you can get lucky once in a while, just the same as you can get very unlucky, it’s the nature of probability.

The problem is people want to be winners not loosers and they want to win big. Politicians know they are only as good as their last win, business executives only as good as their last quater. The only way you can keep wining big is by cheating the process, and eventually the process stretched beyond norms either breaks or snaps back suddenly. When this happens with society the results are not nice.

But the politicians do not want to listen to engineers, no they listen to the shysters, shucksters, pan handlers and cheaters, who trade luck as skill by illusion.

Sadly those who do not know the art of the con and the laws of probability buy into this creating further instability in the system.

But we see others calling themselves engineers trying the same game. How many times have you heard the expression “Best Practice”, remember every time you hear it it’s because somebody is either deluding themselves or gulling somebody else…

Economists are not scientists by definition, likewise they are not engineers, as for being mathematicians, ask a real one what he thinks of economists.

Economists do well because they are “useful idiots” like court jesters they are there to make the hand that feeds them feel better about it’s self, and likewise make others like the hand thus do the hands bidding.

As long as people either do not know that, forget it or ignore it they become food for the hand to be used abused and sacrificed.

As for communism well that was just another way of playing the same game of gulling the masses for the benifit of the few. Only they made a mistake, they did not appeal to the masses self delusion of greed the “land of milk and honey” idyll described as “streets paved with gold” that gives the “Great American Dream”.

One big clue to what goes on is “The protestant work ethic” it is seductive sounding but contains a trap for those who do not realise it is there. The more productive you are the less your labour is worth. That is in general it is those who do most get the least, it’s those that use smart words who profit from such labours by others.

I could go on but there are nodoubt libiterians thinking I’m of their ilk but will shout I’m a “Communist” or worse, to protect their own world view…

One last word though, beware those who demand solutions but care not the means by which they are reached. It’s why we have the snoopers charter which will spread like a cancer through the body of society. If we are lucky when it falls it will be peacefully like East Germany, but history and probability suggests otherwise.

Clive Robinson • December 19, 2016 12:03 PM

@ CallMeLateForSupper,

Back a couple of weeks ago, you mentioned you were once the owner of a pinto,

https://www.schneier.com/blog/archives/2016/12/www_malware_hid.html#c6740061

And that you had put it behind you.

Out of curiosity, did you know that somebody tried to make it “fly like a bird” or atleast a Cesner?

https://en.m.wikipedia.org/wiki/AVE_Mizar

Sadly he crashed and burned, which is why a model was used in the James Bond film, apparently you can nolonger say Oh Oh (6+1) as it’s copyrighted to the nines 😉

Clive Robinson • December 19, 2016 4:31 PM

@ Ouch,

Tor blocked in Turkey as government cracks down on VPN use

Whilst it is news, it’s not a surprise in the slightest. The current political leadership has done a number of things in recent times that we would normaly condemn.

But despite their blind eye to IS oil etc, they are currently “A friend of the West” so whilst we do not condone we do not condemn, and so the wheel turns. As human rights get thrown to the winds and the sense of revenge it engenders will give rise to more radicalism, but then that’s a given, and a problem for future politicians etc to exploit.

But of course “blocking Tor” was not part of the consideration in it’s specification. Even if you moved ports and addresses the traffic remains conspicuous, and thus traceable…

Clive Robinson • December 19, 2016 5:36 PM

Is Deep Learning for you?

To many “Deep Learning” is the next instantiation of the “Big Data” hard sell by hardware suppliers and numaratie consultants.

Whilst this view can be forgiven as even gurus in the domain pander to it, it’s not what is reality.

This article starts as a bit of a polemic but then gets interesting,

http://www.fast.ai/2016/11/17/not-all-the-same/

Importantly it makes some valid points in the last few paragraphs.

Such as,

It[‘s] generally far better to take a domain expert within your organization and teach them deep learning, than it is to take a deep learning expert and throw them into your organization. Deep learning PhD graduates are very unlikely to have the wide range of relevent experiences that you value in your most effective employees…

And

in these days of the false “deep learning exclusivity” meme, it means searching for those unicorn deep learning experts, often including paying vastly inflated sums for failing deep learning startups.

Which means there is a scarcity of people with domain knowledge, that currently high price consultants are filling “badly”. Which begs the question of what do you need to know, and how do you get the training.

Well according to the authors,

We are currently in the middle of teaching 100 students deep learning from scratch, with the only prerequisite being one year of programming experience. This will be turned into a MOOC shortly after the in-person class finishes. We’re in the 4th week of the course, and already the students are building world-class image recognition models in Python.

It might well be worth getting onto the MOOC, because even if your love is security, Deep Learning is going to hit all aspects of security with quite a large thump of money on the table…

Clive Robinson • December 19, 2016 8:34 PM

@ r and others,

With respect to Deep Learning, you might find this of interest,

https://blog.acolyer.org/2016/04/18/deep-learning-in-neural-networks-an-overview/

Clive Robinson • December 20, 2016 2:45 AM

@ Figureitout,

I need more KB’s to do interesting things mostly

Careful your beging to sound dangerously like a M$ developer with their “just a few more GByte lament” 😉

As a general rule I don’t directly read status inputs from real world switches etc due to contact bounce. I generally get a time based interupt to do key debounce. Though it would appear initialy more dificult and waste memory space and CPU cycles it generaly saves memory space as you don’t need to put the code endlessly in your program logic loops and the CPU cycles comes down if it’s part of a more general timer interupt doing your clock, tone, serial bit banging etc.

The downside is of course you end up writing your own “mini BIOS”, but it’s very reusable code and once you get it right just a matter of a day or so to rebuild for a new device if you have a good data sheet (which is getting less and less the case these days). It also makes your program logic code easier and likewise more reusable. So in the long run does save you quite a lot of time and effort. It also helps you get your thinking sorted out so although the actuall machine code may not be transferable to a new CPU ISA the actual logic etc is, which again saves time.

As I’ve mentioned before my coding style is write it for clarity first using minimal instruction types common to most CPUs (thus ADD not MAD, use byte reads and bit masks not bit test instructions). Then tighten up the code where required using device/family specific instructions. Only going into tricks like page zero RAM jump tables if absolutly required. It makes the code maintainable not just for others but myself as well, and ups the reusability factor.

Clive Robinson • December 20, 2016 4:12 AM

@ Wesley Parish,

If the Establishment wished to prevent such attacks, perhaps they should’ve sent the Pound after the executives of 20th Century Fox …

Remember what happened to SPE and what came out… I suspect the same if not worse of 20th Century Fox… So they probably need a good dose of public shaming all the way up to the very top…

But actually speaking of the Entertainment, there was also a Plane into US Gov story in one of Tom Clancy’s “Jack Ryan” books.

And if you go back further you have a Robert Redford film about a small part of the CIA reading books for usable plot lines, then all but him getting assassinated as one of the plots is to close to a hidden group within the CIA…

Oh and even further out, certain SciFi writers acting as advisors to “Ronnie Ray-Gun” and claiming it was their ideas that brought down the iron curtain…

You could say that art is not a mirror of life, but two mirrors infinitely reflecting life to art and back again. The hard part being to seperate art and life, to know what is real and what not…

Clive Robinson • December 20, 2016 11:47 AM

@ IanashA_Titoclh,

Might an “untampered” live cd or live dvd be of service to minimize persistent malware?

It’s funny you should mention Live CD / DVD as I mentioned them a few days ago on this very blog.

To restate it, not so long ago many computing Magazines carried Live CDs on their front covers. For various reasons these were not likely to be tampered with by State Level Attackers because the risk of it getting picked up would be way way to high. Thus you could just randomly go somewhere walk into a newsagent and get a “good copy” of a live CD, with little or no effort or apparent “evasive fildcraft” being involved.

Likewise you used to get full blown distributions both in Live CD and in “full source code” in many books in bookshops.

This however is nolonger the case and getting a live CD means doing a “download” in most cases… As we know nearly a decade ago the NSA, GCHQ and probably other SigInt agencies had tricks where they just got a packet to your computer faster than the web site you were trying to download from. This means they can get to the next upstream node from you and control everything you receive across the wire… As long as you stick with home or workplace download they can own you by substituting what they want… But downloading elsewhere is not as easy by a long way as just buying a magazine from a random cornor shop etc. You need to find an Internet cafe that will alow you to do the nasty with their bandwidth, which means they are likely only to alow you to do it when it’s quiet. Which means drop in ask, go away and come back at a later time. Which gives the SigInt agencies a considerable window of opportunity to get their act in gear.

Yes there are a few other details to do with code signing but Stuxnet told us these are not a problem for the SigInt agencies to deal with via placed insider or black bag job…

So if you were a person of sufficient interest they could get at your download, and there is little most non technical people can do about it.

But there is another issue, that of logic errors or bugs that can be used as attack vectors. A decade and a half ago Flash ROM was only just starting to be put in SoC IO chips etc. Which ment that when you turned the power off on the machine you use the Live CD in, it was reasonably certain any malware was flushed. Not so now it can be hidden in the many many Flash ROMs in a modern PC such as the Optical drive or hard drive chip set, the actual BIOS (remember what Lenovo did with their low end laptops) and even the charge control chip in the battery pack…

It’s why I talk about real physical seperation using two or more computers via guards, slucies, pumps and data diodes these days. As well as using good quality paper and pencil codes and ciphers. So that “plaintext” is never on any of your computers.

Yes there are other issues about end run attacks, which I have mentioned before, but won’t this time… It suffices to say that technology is rapidly pushing in the direction that favours State Level Activities as they are “early adopters” these days. As Bruce has noted PhD level today script level attacks the week after next by ad agencies etc (see rapid development of audio attacks from BadBIOS to your smart phone and ads).

Clive Robinson • December 20, 2016 11:49 PM

@ Figureitout,

I said KB, not GB

I know, but it’s not what you said but the way it came across, so I pulled your leg a little 0:)

With regards,

You say use byte reads and bit masks (what do you do w/ masked bits then?).

Well you might do the following, Move the port byte value into the Accumulator then AND with the “and bit mask” of 00000100b / 04h.

If the bit value is zero then the whole byte result is zero and the “zero flag” will be set. If the bit is set then the “zero flag” will be clear. Either way you can then use “BRanch on Zero” (BRZ) or “Branch on Not Zero” (BNZ), depending on what you want to do. If you think in terms of branching not skipping then if you would “branch on zero” to use in a PIC you would “skip on Not zero” followed by a jump to where you would have branched to.

In some PIC chips you have an instruction that alows you to test a bit in a byte of RAM and “Skip/Branch” without effecting the contents of the Accumulator or other data registers which is not only a lot faster, it saves quite a bit of ROM space as well as you don’t have to shuffle data bytes into other registers or RAM used as scratch/temp memory.

AND masks are also known as “setting masks” whilst OR masks are the logical inversion of AND masks and also known as “clearing masks”.

That is for reading in data AND masks have the “bit of interest” set and all others clear whilst OR masks have the “bit of interest” clear and all other bits set. Thus to confuse you more if you OR with the AND mask it sets the “bit of intetest” for writing out and if you AND with the OR mask it clears the bit for writing out…

Whilst it is long winded to think of using bit masks, it applies to nearly all CPUs and is a “generic” “lowest common denominator”, where as “specific” bit tests don’t and aren’t. Therefor translating the long form from “generic” to “specific” is relatively painless where as moving a specific CPU bit test to another CPU is far less simple and has other side effects (such as requiring other temp memory and changing the program logic flow etc). Thus the designers of C went the generic lowest common denominator route for easy portability for good reason.

Interestingly hand coding using CPU specific bit test and similar instructions can often make upto a 50% reduction in code space, which as it also eliminates tempory storage thus external bus cycles can give a speed advantage of four or more times…

But I still say “code for simplicity” with the “generic way” then only recode to “specific” where necessary to not hit resource limits. That way your code stays maintainable and mainly generic thus portable.

Clive Robinson • December 21, 2016 3:12 PM

@ AlanS,

You beat me to the punch on the ECJ rulling (it’s reasoning is actually quite sensible).

However the old buzzards feathers have been ruffled –the snoopers charter was her totaly mindless idea to start with– and thus she is going to appeal. Which is almost as stupid as her charter in the first place. I hope they get it done and dusted befor March due to Article 50 concerns, as that will then open the door to people to lodge cases against the UK Government, that will still be binding long after Brexit.

On another note,

@ Bruce,

In Kingston high security Crown Court South West London today, four men were found guilty of stealing from ATMs at petrol stations and the like. They got what appear to be fairly stiff sentences of 10-11 years each.

Stiff untill you find out how they got the cash safes open… Put simply they pumped in flamable gas into the ATM then using an electrical igniter blew the ATM up almost compleatly. Bearing in mind ATMs are in public places on major pedestrian walk ways, it’s amazing that nobody was hurt by flying glass and metal etc. It is this rather than the theft they got the stiff sentences for.