Schneier on Security

Clive Robinson • February 26, 2017 4:12 PM

@ Muttering and Flublishing,

100 lies and counting

There was me thinking he’d scored his first century before crossing into the major leagues, and was going for a 1000 average this year.

Clive Robinson • February 26, 2017 4:39 PM

For those requiring light relief

https://m.theregister.co.uk/2017/02/24/bofh_2016_episode_2/

Clive Robinson • February 26, 2017 5:20 PM

@ Bruce and the usual suspects,

Those Israeli students do it again…

https://m.theregister.co.uk/2017/02/23/hard_drive_light_used_to_exfiltrate_data/

What they have done is used the hard drive LED as a serial data transmitter. Although the bandwidth is low, it’s worth depends on what secret you can leak via it.

This type of attack is so old it’s beard rivals Gandalf’s. Back in tje 1980’s there was streambased cipher kit that had a “Health Indicator” connected to the output of the stream generator. Which at 2400b/s was readable via a photo diode some distance away. Further in the 1990’s we were warning banks and other organisations not to put comms and server racks in “glass rooms” for the same reason. This time it was modems with “health indicators” LEDs on the serial data lines on “private wire” comms lines. A group of “security experts” had shown that renting office space in an adjacent building overlooking a server room, could with a telescope and photo detector could read the line traffic off of the front pannel indicator.

I’ve kind of mentioned this problem before as have students at the UK Cambridge Uni Computer Labs.

I guess that like many old attacks they get depreciated by newer more sexy attacks, so the grey beards don’t tell the youngsters –or they don’t listen– so the wheel turns and what was old and dull becomes bright shiny and new, just like flared jeans, tie dye etc in the fashion industry 😉

Clive Robinson • February 27, 2017 1:15 AM

@ Bruce and the usual suspects,

This appeal against conviction for a single felony count of “intentionally causing damage without authorization, to a protected computer” might be worth keeping an eye on. If nothing else if it succeeds then a whole new market could open up overnight,

https://m.theregister.co.uk/2017/02/23/michael_thomas_appeals_conviction/

Clive Robinson • March 1, 2017 4:47 PM

@ Gordo,

Will Democracy Survive Big Data and Artificial Intelligence?

As I’ve said many times before, we do not live in a democracy, we live in a representational democracy, where representatives can be bought. So the question is moot.

Perhaps we should ask “Will Society Survive…” and if so in what form…

Clive Robinson • March 2, 2017 8:21 AM

@ My Info,

Sonic boom or Russian ICBM?

The energy signiture and residials in the atmosphere will be sufficiently different to know the difference.

The problem, finding someone sufficiently independent that you can trust their measurments, results and analysis…

Otherwise you have to start figuring probabilities backwards from effect to cause, and that is rarely considered good science, more often it’s considered “guess work, based on assumptions”, which is a long long way away from what many would consider a rational process (see the history of forensics to see why).

Clive Robinson • March 2, 2017 5:13 PM

@ JG4,

I think that I’ve suggested in the past an open-source collaborative system for capturing and correlating sounds at neighborhood scale.

You are not the only one, Matt Blaze for instance is actively interested in it.

The first people I heard talking about it were back in the 1980’s and they were from entirely different but not unrelated backgrounds. The first group were historians, the second the police. The historians were concerned that whilst we had and do have photographs –selfies being just a modern version– the written word and similar, there are few if any recordings of sound, unless attached to media worthy events such as news and sports items, none of which are representative of normal sound.

Back in 1979 I worked for a while in the BBC engineering Dept in Chiswick London, and was involved with the testing of a new style of microphone. In essence it was four cardiod microphones aranged at 120 degrees to rach other in a pyramid. The four sources were then recorded onto a high quality four track recorder or a pair of the microphones onto an eight track. After the recording it was possible to phase and delay the four channels from a microphone to in effect not just stear it to a particular sound source but also adjust the beam width. In essence it was a little like a phased array antenna used in radar systems. Back then DSP systems were still in their infancy, modern digital systems for both recording and phasing would be quite cheap and low powered. Two or more such microphones could in turn be used like a Very Long Baseline Telescope etc.

Which brings me back to the police interest, they wanted to detect/locate the discharge of firearms in a city. They used simple omnidirectional microphones mounted at hight connected back to Sun Workstations. However it became clear that the system could do other things including track aircraft from their sound (something “stealth technology” has apparently not taken into consideration). Likewise vehicles with characteristic noises. As so often happens when interesting research gets to a certain point it disappears from the public view. As it has not realy reapeared as a commercial product it only leaves two basic possibilities…

More modern research has produced other systems that are even more curious in that you can use sound to make three dimensional images by the reflections etc. Simplistically it uses the same basic principles that these “WiFi imaging” sustems you hear about from time to time use. And can thus can and have been used for other things, amongst which are burglar alarms that can detect doors and windows etc opening/closing/breaking. But can also detect and characterize the ordinary occupants such as the house holders and their pets sufficiently to tell them appart, and thus not trigger if the cat climbs through the cat flap or open window, but will do if say a child or adult does.

One trick I have been shown more recently is detecting “sound holes”. That is an object that absorbs but is not reflective or transmissive of sound. Which as you will appreciate is problematical for stealth systems, which generally work by “making like a hole in space” by absorption or by deflecting, not reflecting back to an energy source…

BAE Systems were looking at one time to a multiple dispersed series of emmiters with offset receivers to overcome radar stealth systems. Sound being “naturaly produced” or “cheaply emmitted” would be much more effective than radar sources in that you have thousands of randomly placed sound sources available to use…

Clive Robinson • March 2, 2017 7:12 PM

@ My Info,

How often do Tunguska-scale meteors strike?

Lumps of matter of the same mass hit the earths atmosphere rather more often than many people realise. Oddly though proportionate to size the moon apparently gets struck rather more frequently, which has led some researchers in the past to say it acts as a partial shield to the earth. Whilst the argument about how many hit the moon was thought to have been settled recent evidence suggests it was too low by a significant amount,

https://www.newscientist.com/article/2108929-the-moon-has-hundreds-more-craters-than-we-thought/

Which suggests that also more hit the earth than was previously thought as well…

Part of the reason people think that the earth gets hit by lumps of matter a lot less than actually happens is to do with the composition and another to the angle they hit at. Thus they can burn up, air burst or bury themselves in the oceans or land.

Another important aspect is just how little of the earths surface is actually occupied by mankind and how little people used to communicate. An example of which is the puzzle over 1908 Tunguska event, although it’s shockwaves were felt as far away as England, and there was masive devastation at Tunguska, there are no records of human deaths or injuries relating to it. It also remains a bit of a mystery, some Italian researchers indicated that it could have been two lumps of matter, one hitting the ground forming a lake the other “air bursting”. Other researchers and investigators say it might have been a comet not a meteorite…

But the assumed answer is still that it was a meteorite and that it obliterated entirely in the aerial explosion of an oblique trajectory air burst. Which is what happened during the 2013 Chelyabinsk meteor event, which thanks to dashboard cams and cellphones and modern media was both well recorded and reported. So I would expect the number of reports to start rising, especially when you find out just what lumps of meteorite fetch at auction.

Clive Robinson • March 4, 2017 4:24 AM

@ tyr,

I’d be willing to bet Aldous never missed a meal out of need in his life.

From memory, yes he did have a privileged background one of his relatives was a Nobel Prize winner, his grandfather a researcher known as “Darwin’s Bulldog”. His father was a biographer and school master, his mother set up a private boarding school and died whilst he was still quite young. His two brothers went on to get knighthoods for their scientific work (Aldous declined his without giving a reason). He was born in Godlming Surrey UK, just around the corner from where some of my relatives later lived and his family features prominently in the local history. His family was friendly with the likes of Lewis Carroll, W. B. Yeats, George Bernard Shaw and W.B.Yeats and many other artists and scientists most of whom Aldous would have known well.

However in other respects his life was virtually over before it got started, at an early point in life he suffered an illness that left him near blind and quite reliant on others. In short his life choices were few and only because he was well educated could he become a teacher and later a writer. He also got lucky to be in the right place at the right time and became a highly paid scriptwriter in the US.

When he was a teacher on of his pupils later took on the pen name of George Orwell, who later accused Aldous of plagiarism of the thems in Brave New World.

So life was both bad and good to him…