Schneier on Security

Clive Robinson • February 18, 2017 10:33 AM

@ re,

What’s bothering me, amid all these quotes in the last couple weeks I am seeing major spelling errors and word-substitution as if things are being written via swype on Android keyboards for major news outlets.

It’s not just that it’s the abrupt changes in tense in mid sentence etc, suggesting that the sentences have been “cut-n-pasted” together via poor editing.

You can also see similar incorrect use of tense by some of the more radical posters that have sprung up “as though from dragons teeth” since the start of the change from one US executive to the current executive.

Which begs the question as to if there is a link between them or not…

Clive Robinson • February 18, 2017 10:51 AM

This might be of interest to those using camera phones etc to record US police activity,

http://www.ca5.uscourts.gov/opinions/pub/16/16-10312-CV0.pdf

Clive Robinson • February 18, 2017 7:34 PM

How big are your digital feet?

Most Internet users are like children in the snow, they run around having fun, leaving nearly every footprint clear to the eye of those that care to look.

Well Internet users are now realising in the last 18-36months that they have to grow up and become adults.

One reason is the interesting comment that there have been more credit card details compromised in the US in the last 48months than there are individuals in the US that hold credit cards… And most of those compromises that make it into the news headlines are about “Internet Hackers take XXX million Customer details…”. This has been backed up by people being sent letters about the fact that their CC or other details have been stolen and as part of the remediation package they get a years free credit checking etc.

This need to grow up has been exacerbated by “Digital Stalking” and “Abusive Ex” stories about how easy it was for some low life with an apparently even lower IQ to track down and do harm to their victims.

The problem for most is that unlike the snowy footprints of children at play, digital footprints do not melt away in the cold light of day.

There have been one or two MSM press articles but they invariably offer a mish mash of advice often conflicting and often fanciful. Even advice from experts is often seen by other experts as not advice they would give[1].

That’s not to say experts are wrong but their Point of View is their point of view and is thus singular to them, not you.

Back in Charles Dickens’ time, it was considered “important to be widely read”, something that is now nolonger possible due to the shear quantity of reading available. Thus the trick these days is to be selectively read in as broader manner as is possible in the time you have.

Thus the key to reducing the load being the selection process. To that end people might want to give this a read,

https://tisiphone.net/2017/02/08/is-digital-privacy-a-privilege-of-the-wealthy/

[1] I’m noted for comments like “Paper Paper NEVER DATA”, “Energy Gapping”, “With cash they can only take what’s in your pocket”, “Never leave ammunition for the enemy”, “Needless Trust is death in waiting”, etc. Which used to be considered extream even for high risk individuals I’d advise… but of more recent times many are wishing they had practiced ten or twenty years ago. Times change and as the old saying says “Makes fools of us all”, for instance even cash is getting traceable these days…

Clive Robinson • February 19, 2017 7:06 AM

@ My Info,

LOL! the cleaning lady took your privacy out with the trash.

Nagh it was the instalation engineer on the warranty card on the Smeg fridge he just put in…

Most people would be supprised at just how much warranty information on high end goods gets turned into sales leads. Likewise spend more than 20USD on a single bottle of red wine and some sales droid will salivate to get the rest of your details, especially if you do it more than once a week.

I know people that have some quite expensive professional services, whereby they insulate their more discreet clients from such problems, even to the point they do not appear on “official” paperwork.

As far as I’m aware it’s all legal and above board –though legislation changes–, and much of it you could do yourself if you know how to set up companies with head offices in off shore jurisdictions and know tricks about domicility and work rules[1]. The problem for US citizens is US exceptionalism about taxation and where you are domiciled but there are I’m told by those with an indepth knowledge of US legislation ways around that as well.

I used to know a senior company director that had the use of a “caretaker flat” on the top floor of a quite expensive office block. Whilst quite small it directly adjoined the “walnut corridor” facilities of the private company which had an executive dining room, gym, etc etc…

The point is if you have good accountants and the like the function of a room is what you claim it to be and providing you are discreet stick within certain rules that is ultimately what the Taxman accepts. And unless you are upto something realy naughty, most Governments accept what their taxmen accept, as the primary business of Government is to raise taxes to pay for everything else…

[1] It often suprises people to know that “it’s where you are paid” more than where you actually work or live that counts. That is as an employee of a company in country X you can be temporarily asigned to work in an office in country W or Z for quite long periods of time providing it meets some almost arbitary definition of “temporary”. Usually the higher you are in a companies ranking the more arbitary temporary becomes. Thus as used to be the case you could “live in Monaco” but due to “travel days” be in the UK working upto three days a week, as long as you or your company could pay the travel costs.

Clive Robinson • February 19, 2017 7:56 AM

@ r,

All your data belong US, but hey! To a point it’s a defensive measure and as stated en-response to @Clive the evidence of it’s existence is proof of it’s lack of perfection or the quality of the sieve.

Actually it’s a bit more than that.

There is as I’ve indicated in the past a question of resources and their utilization. Technology currently has the effect of making things tommorow considerably cheaper than they are today. That is you devote todays resources to the problems that show the greatest return. If you commit a crime today however it will still be a crime tomorrow, the day after and several years hence. But it gets cheaper to prosecute with time… So the fact you think you get away with something today does not mean that you have, just that for resource reasons you have not been prosecuted today.

But as I’ve noted before, the primary purpose of Government is to raise income to pay for votes etc. The traditional method is by taxation but it’s clear to anyone who can think that taxation is not keeping pace. Thus another way of raising revenue is by fines and confiscation of the proceeds of crime.

This is where you also have to consider the mode of operation of a gardner or farmer. They have limited resources thus they do not do things as efficiently as they might. For instance, the easiest way to deal with weeds is to not alow them to grow, but it takes quite a large effort in resources to track down each and every seed etc and pick it out, it’s less resource intensive to let them grow a while, and take a hoe to them when they are most vulnerable. Likewise the crops, you chose which to pull early as they are not growing as fast as others etc, but generally you let crops grow to a point where you get a good yield but not the best yield due to uncertainties it’s a judgment call.

There are advantages in letting criminal activity go on, if nothing else it makes the divertion of resources to the LEAs politicaly easier. But also it can be like farming, you weed out those that are low resource to remove or are going to cause serious problems. The others you treat more like a crop, you let them grow to the point where the cost of harvesting them is more than covered by the fines or asset forfeiture, thus in effect make a useful profit by doing so…

Thus many crimes apparently go unpunished for financial reasons.

Thus to be a successful criminal you need to work out not just how to get away with todays crime today but still be able to get away with todays crime in ten, twenty, fifty or a hundred years from now. Not doing so will put you in line for being dealt with at some point. Thus it’s better to never get put in the line rather than wait to get to the head of the line…

At the end of the day it’s an individuals choice as to if they commit a crime or not. The only question that arises if they do, is have they avoided being put in the line now or in the future. The simple answer is if the crime is sufficiently recorded then as a criminal you have probably failed and it is just a question of the time/resource curve to sweep you up into line.

As I’ve pointed out in the past “collect it all” is about building a time machine to apply future technology to todays data to give usefull answers in the future. That is with collect it all your activities get swept up, at some future point the resource cost drops on the getting answers questions. If you are long gone, it does not matter to you but, if you were a bit of a tearaway youth now making good in life, do you want the tap on the shoulder, the quiet word in the ear, the embarrassment or worse?

Clive Robinson • February 19, 2017 10:54 AM

@ Keiner,

Ahh you mean “sweden just around the corner from Alaska”, Donald appears to know his geography as well as Sahara Palin, and quite a few others[1] it’s not just a faux republican thing. All jokes about the knowledge a lot of Americans do not appear to have about world geography can be said of many other nations.

However the recent attacks in Pakistan of which Sehwan in Sindh province is just one and possibly what Donald Trump misheared/remembered is a reminder of the legacy of the problems in the ME to do with fundemental religion out of Saudi and petro dollars.

Which begs the question as to why Saudi is not on the Trump List…

[1] http://m.motherjones.com/mixed-media/2013/09/fake-world-map-geography-mistakes-politicians

Clive Robinson • February 20, 2017 9:06 AM

@ Fly on the Wall, r,

Buy devices when you get there, load it up with an SD card or via the cloud.

Unfortunatly you’ve not followed the logic through… It’s something that Nick P and myself went further with several years ago now, but it’s in this blog somewhere 😉

Briefly, the SD card is just another electronic device, if you can use it then it can be found on –or in– you when you cross the border. If you are “hiding it” or are presumed to be hiding it then you are in a world of hurt. Lying to a Federal Officer is the least of your worries as the presumption is then that you have reason to be hiding it, which is not where you want to be going.

But following on with the SD card, unless you encrypt the data when it is found then the data is lost anyway and all you’ve done is earned yourself whatever punishment they decide to throw at you, not for your “crime” but as an object lesson to others, so expect the bidding to start at 30years and go upwards from there…

With regards using the Internet in some way to get around the physical border, similar logic can apply with regards lying to federal officers / false declarations and all sorts of other nonsense. However the point is you would have the data encrypted somehow.

The problem with encrypted data in both regards is the key. You may not be aware but various countries have quite stiff penelties for nothanding over encryption keys on demand. As the legislation is written your only real defence is showing you do not have the key in your possession in the past or currently, and that it is not possible for you to get the key now or in the future within the jurisdiction you are being held in.

It’s this last point you need to think about carefully because get that right and the rest is fairly meaningless within the limits of the law…

As I said have a hunt back through this blog and you will find various methods discussed.

Clive Robinson • February 20, 2017 12:30 PM

AI race car crashes in first race

Those old enough to remember motor racing when it was dangerous, cars crashed and drivers and spectators got injured/killed, modern F1 etc appears tame in comparison.

Even though crashes still happen, they are nowhere near as frequently, spectators are usually quite safe and drivers usually walk away from crashes these days.

Well one area that is new is “driverless” racing. The cars are not remote controled but AI controled. The first competative race between two AI race cars has ended up with one crashing, and the other successfully avoiding a dog that got onto the track,

http://www.bbc.com/news/technology-39027477

Of course this leaves the real question of are there going to be more crashes thus drama, or less thus making it almost clinicaly dull. Time will tell but the first few races atleast should be entertaining.

Clive Robinson • February 21, 2017 5:18 PM

@ Slime Mould…,

Question: The GRU must have been aware they been spotted in 2014. Why didn’t they use/develop a different tool set?

That “why didn’t they” question was the main reason I argued against the original report as little more than nonsense. Further it was to coincidental with the “Reds Under The Beds” drum beat that had moved from “China APT” to “Russia Inside”.

I thus concluded that no “real” investigation had been carried out. Further it smelt strongly of “being led by the nose” in that they were shown what they wanted to see, thus did not look any further than their pre-assumptions.

Which led me to ask where the “contradictory evidence” was, which led to the realisation there was no actuall evidence being presented.

Thus I can not say it was not the Russian’s but likewise the same goes for any capable IC or security organisation, any one of whom could pick up the APT28 etc information and reproduce the attacks thus creating a faux impression to cover their own activities.

The whole investigation as publicaly reported was a “I see no ships” event where you “don’t look for what you don’t want to see”, thus you don’t see it and can carry on sailing in the direction you want to go rather than the one correct examination of the facts would suggest would be more prudent.

I guess we are unlikely to find out the real motives behind the investigation and I’ll let others make their own deductions about the timing by the investigating agency. It will suffice it to say that, that particular “fog of war” could have been caused by any number of smoldering fires all over the place, and thus many motives for “stoking them up” existed…

One thing history shows over and over again is you can win battles but loose wars, thus sometimes the right people win others the wrong and we can only judge which by the facts we have and our points of view. Thus with no facts, any point of view can be held to be true axiomatically, which is why we have the CIA invented “Conspiracy Theories”.

Clive Robinson • February 22, 2017 2:41 AM

@ Bruce and the usuall suspects,

out a year ago there was an article about the Dutch Police experimenting with birds of prey to bring down small drones.

Well the WashPo now has another story only this time it’s about the French Military,

https://www.washingtonpost.com/news/worldviews/wp/2017/02/21/terrorists-are-building-drones-france-is-destroying-them-with-eagles/

I have no idea if the story is true or not, but the link to SkyTV News in the article makes me uneasy… Anyway it’s worth a quick read.

Clive Robinson • February 23, 2017 5:56 AM

@ Wael,

You might find this of interest,

http://nautil.us/issue/45/power/this-man-is-about-to-blow-up-mathematics

Ignore the sensationalist headline, it’s rather more subtal than that. Becaise “incompleteness” has led to certain assumptions being taken as read when infact they may well not be.

For instance think about what we consider as determanistic and nondetermanistic sequences. And how we can make a determanistic sequence which by the observation of such a sequence even though determanistic can neither be shown to be determanistiv or more importantly –from the practical point of security– be predictable.

Imagine what would happen if it could be shown that there was no such thing as the random oracle or common random string models?

It would have quite an effect on the Cryptographic “Standard Model” and the security proofs that arise from it…

https://en.m.wikipedia.org/wiki/Standard_model_(cryptography)

Clive Robinson • February 23, 2017 7:14 AM

@ Bruce,

Another “sporting cheat” caught by technology story for you to add to your collection,

http://www.marathoninvestigation.com/2017/02/runner-disqualified-after-claiming-2nd.html

Clive Robinson • February 23, 2017 11:24 AM

$200 or less gets you feature rich phone Spyware

The price of spyware software you can put on a phone is going down, and is now well within the budget of any stalker / Ex / etc. The software can have what some would regard as high end features.

Motherboard decided to see what they could get for the price of a cheap night out,

https://motherboard.vice.com/en_us/article/i-tracked-myself-with-dollar170-smartphone-spyware-that-anyone-can-buy

Clive Robinson • February 24, 2017 3:20 AM

@ Thoth, r,

Re Kim Dotcom and,

Since Big Bro wants to “flex his muscles” and have already done so by the illegal raid on Kim’s house, might as well follow through and haul him on the prison plane

The original US power idiom was “Speak quietly and carry a big stick”, not “Banshi scream and smash the place down”.

The first way is that of a wiser man, who uses his opponents fear against themselves, the second is the way of the berserker, mad and uncontrollable and only fit to be put down with maximum prejudice as an object lesson to others. Unfortunatly the US did an anti-widishans turn around Gulf War I time and tried to make berserker behaviour rational as “Shock and Awe”. Suffice it to say, that during WWII the Axis powers used that tactic to gain large amounts of territory, only latter to get put down very hard by the rest of the world…

Further the US economy to it’s currancy value is one of the most misalined of all western nations. The US only get away with it because of the effective seniorage they get from being the world trading currancy. If they got “cute for corporate interests” rather than –alleged– terrorism without appropriate treaty backstop –which is what TTP was about– then countries might decide to use another currancy. One of the reasons Iraq got the chop via Gulf War II was given by Paul Wolfowitz as,

we had virtually no economic options with Iraq because the country floats on a sea of oil.

Most people don’t get the full implication of this, however UK PM “Tony Blair” let the cat out of the bag. What had happened was US sanctions were killing people in Iraq quite literally. Sadam had sent feelers out to EU “euro” countries that it they helped lift/break the sanctions then he would only sell oil in euros. The result of this would have sent the US and thus the UK economies down to third world type conditions. Thus the only option to protect the US and UK was to take control of Iraq oil and how it was sold. The fact this also gave a big leaver over OPEC was also of significant benefit.

Thus the US is very fragile to it’s currancy status, which is another reason it’s borrowed heavily from the likes of China and encoragef Chinese investment. The value of the USD becomes entwined with China’s economy, thus attacking the US or USD would be counter productive for the Chinese…

I suspect @Anura will have a few things to say on this, but hopefully I’ve got the point of the “Wise man confidence trick with carrying but not using the big stick” over.

Clive Robinson • February 24, 2017 4:40 AM

@ Nick P, Thoth, r,

The solutions typical for 2-4 is to have a clean device or VM on it that shows nothing serious. Deniability. The real data is downloaded off the Internet once in the country, used until about to leave, put back on the net, device cleaned, and then back through border.

There are two problems, firstly US CBP and the Israeli equivalent amongst many others are known to “assume” a clean phone is “justifiable suspicion” as is not having “social media” etc.

Secondly, getting a “clean device” is only easy one way, which is to “buy a new” phone / computer etc.

Which also brings up the “out of sight” or “evil maid” attacks. That is the CBP having the backing of the US SigInt agency could easily drop a hidden spyware trojan in the firmware as you cross the border on entry.

Thus buying a phone / computer once across the border might be a better option in some countries. Thus go across with the cheapest phone / computer you can and if it goes out of sight or gets connected to by CBP etc, “dump it” in the bin or pawn brokers etc landside and walk away from it fast.

The other issue to remember about the US is the fact they have increased the border zone to cover nearly the whole of the populated US…

Which brings us back to “Old School OpSec” and the multiple jurisdiction shared key system you and I have discussed in the past.

With the update to the “What you know” factor with “A location you know” at “A time you know” for getting the “key shares” to build the file decryption key for your Internet download.

There is still “wriggle room” in the noose of anti-security legislation but that rope loop is getting drawn tighter and tighter as we pause to take breath…

From a business perspective, companies etc will need to look at sending not individuals but time and location spaced multiple representatives, to play the numbers against the CBP etc. That is if you send two people on different days the CBP only hsve a 1 in 4 chance of randomly getting both, with three that’s nearly 89% chance you will get one representative through “free and clear” of “evil maid” problems.

This may only need to be done the once, if you can use the old school OpSec idea of an “in country” secure drop location where equipment can be safely stored between visits.

Clive Robinson • February 24, 2017 6:48 AM

@ Jen,

@ Clive you will relate although you don’t do you tube.

As it’s short, I’ll see if I can “sneek in” somewhere harmless and have a looksee, not sure when though.

Clive Robinson • February 24, 2017 8:08 AM

@ r,

A serial port is a hen’s best friend if they’re flying the coup…

If you think back a couple of months or so I had this very conversation with @Figureitout over his optical data diode.

https://www.schneier.com/blog/archives/2016/12/friday_squid_bl_556.html#c6740551

I pointed out that the best thing to do would be to use USB to TOS-Link devices or even shield boards for the Raspbery Pi etc and “patch up the diode” as required. The thing about AES3 AES/EBU S/PDIF EAJ Optical TOSLINK is it’s quite ubiquitous in the “audio world” where it’s heavily used in studio equipment etc to give good “galvanic isolation” etc.

Importantly it would give your serial optical data diode not just cheap easily available parts, but an existing major market to sell into. Thus giving the product a high level of deniability.

You will find TOSLINK connectors on the back of semi-pro audio equipment like Sony Mini-Disk audio recorders that are not much thicker than a mobile phone. I’ve got what looks like a “studio mic” four channel 24bit audio recorder that has TOSLINK connectors and it was less than 100USD and used by quite a few “home artists”. I’ve got it setup to use TOSLNK to a “desktop” computer with a number of other TOSLNK galvanicaly issolated audio units and then that acts as a head end to a standard ethernet network. This is part of a “Studio in a box” system I designed for use by the cost sensitive end of the Broadcast Industry. It’s used in all sorts of places world wide with low cost 250W-2.5KW FM broadcast systems. Several of which have been deployed to use “solar power”…

The main point being TOSLINK is very deniable, you can build a unit with an FTD-232 and micro controler on a matchbox sized PCB which is then using epoxy solidly encapsulated into a mini-brick with just a USB conector hole at one end and one or more TOSLINK connectors at the other with a few LEDs showing at the top with an aluminised sticky back lable with product info and socket ID etc info.