Schneier on Security

Clive Robinson • November 24, 2017 10:53 PM

@ more on antibiotic problems,

fecal transplants

From records about half a decade old, about 1/3 of the 90,000 fatalities due to “Hospital Acquired Infections” (HAI) in the US annually were due to Clostridium difficile (c.diff / c.difficile) infections[1][2].

From the same data around half a million HAI Clostridium difficile infections occured, all of which have significant issues and significantly delay hospital discharges. It also appears to fall disproportionately on women suggesting that in the US there are socio economic factors involved.

The most frequent cause of c.diff susceptibility is the use of antibiotics or drugs to reduce stomach acid production (proton pump inhibitors). Both of which cause gastric problems which encourage colonization by Clostridium difficile. So even if the c.diff symptoms clear up an individual remains an infection vector and more susceptible to further oubreaks of symptoms.

Whilst the use of the strongest antibiotics only work in less than one third of Clostridium difficile infections “fecal transplants” are known to have a much higher success rate without the serious side effects of the vancomycin etc antibiotics. As indicated by the study the implanting of doner fecal matter by colonoscopy is both the most effective and least unsettling for the recipient of the transplant. However colonoscopy is it’s self not without risk though the figures are improving[4].

Potentially then fecal transplants, if administered in a timely fashion, will cut 25-30 thousand needless deaths anually in the US alone. As well as saving between $1.5-2billion in direct costs.

But of more interest to others are the secondary effects. It will free up around 3.5million days of critical care resources and reduce the usage of our most precious antibiotics thus reduce in part the chance of drug resistance increasing. But there are further savings in that the transplants unlike antibiotic treatment reduce the numbers colonized thus reduce the numbers of infection vectors in the community.

However fecal transplants and phage treatments are not going to make the Drugs or health insurance companies money, thus research in these treatments in the US has not received the funding they should have done. Which might account for why this overdue systamatic review of studies was not from the US but the UK, even though the actual studies reviwed were not carried out in the UK.

As noted by the report the effectivness of stoping a c.diff infection is over 90% wilst some studies show that reinfection or colonization figures are also reduced unlike the use of strong antibiotics which only stop aroind 30% of infections and have much less effect on reinfection or colonization.

Thus it’s definitly time to atleast carry out further studies to see if there are other things we should be aware of with fecal transplants.

[1] It’s been claimed that improved cleaning techniques such as Terminal Room Clening have reduced HAI but there is insufficient data to say by how much[3]. And HAI is not something you want to run double blind tials on for obvious reasons.

[2] To put the number of HAI C.diff fatalities in perspective thats a similar number to those who die in another quite preventable mannar of road deaths by inapropriate driving.

[3] HAI is on the rise world wide for various reasons including Socio Economic decline and the resulting clusters of illness in socio economically depressed communities giving “Sick City Syndrome”. The problem with such communities is they carry illnesses into the rest of the community and end up increasing illness and fatalities even in the wealthiest of communities. In the US it’s been of concern for some time and it was one of the things Obama Care was originally designed to reduce if not eliminate. That was before it got decimated by various political interest groups. With the result that as some have put it “Health Insurance Stocks have been on a bonanza time”…

[4] The simplest explanation for this is that the number of colonoscopies are on the rise due to reduction in equipment costs and more trained practitioners. Thus those given them as a patient cohort are generally healthier.

Clive Robinson • November 25, 2017 10:24 AM

@ Wael,

He’s busy with a new position he took and a new place he moved to.

Hopefully he’ll settle in soon, but untill then let him know several of us said Hi.

Likewise Mike the Goat and RobertT.

@ Figureitout,

If you are reading along as you study, hopefully your course etc is going well.

Clive Robinson • November 25, 2017 12:47 PM

@ Rachel,

It has a Football connection yes?

Err no… The nearest the first Puritin Seperatist settlers –Pilgrims– got to any modern game was probably “Darts”[1]. Basically there was a game played amoungst troops using broken or cut down arrows with weights that were hand thrown at targets mainly for sport to pass the time. Which supposedly taught them some simple hunting skills for small game, bearing in mind most soldiers back then had to source their own food (which is why camp followers were rather more, than modern school history classes make them out to be).

It’s known that this game was played by the First English settlers in 1607 onwards in James town but… All good things come to an end as they say and the Pilgrim and Puritans obviously felt that such pass times were not the work of God, nor were many other things.

Hence with the arival of Sir Thomas Dale in 1611 as High Marshal –Governor– he brought about significant changes[2]. Amongst which was the banning of all games amongst the troups (which would have included the early form of darts).

It is believed that a variation of this early darts game was played on many ships of the time to keep crew and passangers amused during what were very long journies. Various historians have reason to believe it would have been played on the Mayflower. Which arived in America nearly a decade later and anchored initiakly at Provincetown Harbor on November 11, 1620. Due to various factors they then moved to what was known as “New Plymouth” on charts and due to the lateness of the year effectively “over wintered on board”. Thanksgiving is supposadly in remembrence of a meal the Puritain Pilgrims sat down and ate as the equivalent of a harvest festival –but without the three days of revelry– the following year (which would have been near the time Canada celebrates Thanksgiving).

However by this time there would have been little for the colonist to be thankfull for. Nearly half the Puritan Seperatist settlers had died and only two women of child baring age survived. The collony would have known beyond doubt that they were doomed if not resupplied with both supplies and people.

Around july of 1623 such a ship arived and this realy would have been the first Pilgrim Thanksgiving” (referring to solemn ceremony of praise and thanks to God for a congregation’s good fortune). It probably would have consisted of a full day of prayer and worship by both the existing colonists and the new arivals.

The fact that the colony became established in the first place was more by luck than judgment. There had been an epidemic in the indigenous population (hence Indian Americans) thus land that they had cleared and farmed was available. Further atleast two of the local tribes members spoke English and one of them welcomed the colonists, thus a peace treaty of mutual support was drawn up.

Other adventurers fared less well if you study the history of Scottland you will read about the disasterous attempt to set up the colony of Calidonia in the 1690’s (The Darien scheme[3]) in the mosquitoes infested swamps of what is now a nearly unused part of modern Panama. The scheme effectively bankrupted Scottland and gave rise to the 1701 union and “The Equivalent” a sum negotiated at £398,000 that ended Scotish economic independence. Although much of the money went to compensate political cronies that had lost significant sums in the Darien Scheme. The man behind the disaster that was the Darien Scheme went on to set up the English South Sea company that likewise turned into another disaster known as “The South Sea Bubble” I mentioned a couple of days ago.

[1] http://www.encyclopedia.com/humanities/encyclopedias-almanacs-transcripts-and-maps/darts

[2] See pages 96 onwards. http://www.americanantiquarian.org/proceedings/44525063.pdf

[3] https://en.m.wikipedia.org/wiki/Darien_scheme

Clive Robinson • November 26, 2017 12:07 AM

@ Wael,

[Baby Face Nelson, I] Have no clue who that is

Lester Joseph Gillis. Born 6th Dec 1908 in Chicago, his parents are thought to have been Belgium immigrants. Known as a boy with a temper he started getting into trouble at an early age. He was known to have turned to crime by the time he was 13years old.

Because he had a very young look and was not that tall even for the times he ws nicknamed “Baby Face” by fellow street thugs. He married young to a girl four years younger than himself and they soon had two children. His wife continued to call herself Helen Gillis, long after “Baby Face” had started using the name “Nelson”. He died of wounds received –in a gun fight the previous day– 28th Nov 1934 aged just 25 years. He had been shot 17times during the gun fight but had killed two FBI agents and escaped with his wife and a fellow criminal. His wife now barely an adult was later arrested and sent to jail for a year for parol violations (Harbouring a criminal).

In his short life Nelson had became a prolific bank robber and thought little of killing those who stood in his way. His notoriety led to him being declared “Public Enemy Number 1” by J.Edgar Hoover shortly after the death of John Dillinger.

1920’s America was just coming to terms with the preasures created by an influx of immigrants turning what were large towns twenty years earlier into over crowded cities with what are best described as ethnic ghettos[1]. Landlords put up shoddy tenement accommodation quickly and rapidly filled them beyond overflowing. Kids effectively lived on the street as there was no room at home to do much more than eat and sleep. Even washing and personal hygiene were done in shared or public facilities. There was also a surplus of guns and ammunition “left over” from WWI production etc that were readily available. Further the inability of returning soldiers to find any let alone decent jobs gave rise to more sophisticated and violent crime for children to all to quickly grow into.

Two events happened in the year of Baby Face’s birth that would seriously effect his and other street kids all to short childhood and even shorter adulthood. These were the first of the Ford Model-T cars and later utility vehicles and the founding of the FBI.

Due to the rapid rise of the car –15 million Model T Fords were made– people had easy access from State to State. Which due to the way the laws and law enforcment worked at the time provided hardened criminals with the easy respite of crossing a state line. It was this problem with interstate law enforcment and criminals in politics, the police and industry that gave rise to many new “federal crimes” and thus the FBI to act where corrupt local cops and politicians would not. Unfortunately as even the FBI historians admit the FBI was not very effective for the first fifteen years and got it’s self mired in the “Teapot Dome” scandle. Thus a new broom was brought in to clean house, one of his first acts was to sack the three female agents, women did not return untill he died in 1972. Unfortunately he also became as we now know the most corrupt politician and cop of record in the US, he was J.Edgar Hoover.

[1] I’m using the word ghetto in what would be the terms of today. Where US Cities like Chicago are still described as having “ghetto environments” where street crime is rife. For many little has changed in a century and Chicago PD still has a very bad reputation including the likes of illegal detention centers and rumours of “disappearing” people and using tourture.

Clive Robinson • November 26, 2017 1:04 AM

@ Willow,

SomeGuy cancels rocket launch to prove Earth is flat when BLM seeks permits

A “steam powered” rocket no less[1] how quaint.

Mind you by the look of the photos it will not realy fly, just blast up and either fall apart, or get ripped appart by air flow. Pop rivets are not the way you want to go…

[1] Whilst “steam powered” sounds very Victorian, it was what the WWII German Messerschmitt Me 163A prototype rocket plane used, though the production planes used a sloghtly different system[2]. Basically you use very concentrated hydrogen peroxide (T-Stoff) and a catalyst (Z-Stoff).The highly exothermic reaction heats the “water” part of the hydrogen peroxide to uncompressble steam which vents along with other catalitic products out of the combustion chamber throat to generate thrust via a venturi effect.

[2] later versions of the plane 163B used T-Stoff and simply added it to a fuel (C-Stoff) such as hydrazine to form a hypergolic mixture[3]. Such hypergolic liquid engines have advantages over cryo-liquid systems and also solid fuel systems and form a middle ground. All three types of engine were used with the space shuttle.

[2] https://en.m.wikipedia.org/wiki/Hypergolic_fuel

Clive Robinson • November 26, 2017 11:12 AM

@ Clipper, Who?, and others,

You might want to read this,

https://www.alchemistowl.org/arrigo/ArrigoTriulzi-Troopers15-Shardan.pdf

As well as a few of his other papers about illicitly getting Microcode onto PCs.

Clive Robinson • November 27, 2017 3:52 AM

@ Arclight,

Having a non-removable management node ship with every endpoint is a key piece of that strategy.

Which if you or I’d have said that a decade ago or even half a decade ago, would have earned us the epithet “cranks” in most peoples heads. Including most of the readers here.

The idea is slowly seeping into peoples heads, even if some think it’s accident not design they are beginning to understand the danger.

As Intel AMD and ARM appear to have no interest in removing these “We own the platform not the purchaser” technologies even more people will start to wake up, but I doubt many consumers will.

The only thing that is known to work is when the “big boys” turn on each other via the law courts.

An example of this is MicroSofts UEFI policy for bulk purchase discounts. MS wanted “no choice”, “no freedom” not just on Intel/AMD but ARM as well and that was how it started out.

Then they got the preasure put on them by other big players and many many others, with the promise of seriously damaging litigation if they did. So whilst MS loosened up on Intel/AMD in their bulk purchasing agreement, ARM is still the original “locked up tight” because of the kick they could apply to Google and those implementing Android and similar “walled gardens”.

The problem is that for personal use computing ARM is without doubt the way people have gone with Smart phones, pads, tablets, net books and light weight laptops. The use of Intel/AMD is thus declining in that sector, with just businesses pushing their way with laptops, desktops and servers.

Thus it will probably not be long before Microsoft make a serious splot between business and personal computing. Their entry level OS’s will stop being “everthing in a bucket” and clear repackaging going on. Thus for arguments sake Entertainment software will get put in the personal OS but be a paid for extra in business and similar will apply the other way. In time about the only thing that will remain working as is on both OS types will be the “suck them in” software like Office. Which will be given away at administrative cost to students etc, to “Bring them up the MS-Way”. Which will be not unexpected when you see how Google are pushing “To OWN your Children” via their cloud services given away to schools collages and universities with all sorts of tasty extras. Because for Google it’s data that’s the key, whilst for MS it was selling applications etc on a never ending upgrade scheme. But now MS want user data as well which with their “telemetry and cloud” being forced down peoples throats should be ringing bells in peoples heads louder than fire alarms, but it’s not…

What has changed is a few people are now asking not “how do we stop the juggernaut, but how do we get out of it’s way?”. The answer is not what they want to here, which is you can not unless you are prepared to radically alter the way you do things…

The first step obviously is to mitigate the Intel/AMD and ARM lock in. The second is to put your security end point beyond the communications end point. Both can be currently done in a number of ways, but the easiest (use older hardware/OSs/Apps) is not going to last much longer…

Thus people who are required to be confidential such as Drs, Lawyers, Clergymen, Engineers and scientists are going to have to change the way they work. Hopefully others will follow suit whilst they still can…

Clive Robinson • November 27, 2017 8:56 AM

@ hmm,

One time pads (of paper) and sharp #2’s.

DON’T forget, one sheet at a time, on a glass surface and an ash tray and matches[1] then pound the ash. Otherwise your Crypto-OpSec will all be for nothing against the HumInt-OpSec fail. Where a black bag opertive comes in and does an esder attack on the other sheets or soft surfaces, or just does a little bin diving…

[1] Another way is a liquidiser with a little cheap spirit alcohol in it. The resulting mush burns fast and hot enough not to smoke that much.

Clive Robinson • November 27, 2017 9:15 AM

@ echo,

Steve Ballmer is on record as saying that the corporate customer was the client and the home user was essentially freeloading and lucky to have access to a Microsoft OS.

Steve Ballmer was never the smartest IoT on the block 😉

I suspect that somebody sat him down abd explained “feeder theory” to him, and then he shut up.

In essence one of the reasons *nix was popular was that students in training for the work place were taught with it. They did not want to work with MicroS4it “Major Fail Ckusterf**k” (MFC) for many reasons.

Google grok this hence their push into education at all levels. Thus they will own the workforce in another five years, whilst MicroSoft will not unless they push back hard now.

It’s the market leverage factor you just can not get any other way.

If I was Nicrosoft I would give every child from five years old free access to all their tools untill they left education. Employers woukd have little choice but to buy Microsoft no matter the cost because the cost of re-education would be a lot lot higher. In essence thatcis what “Feeder Theory” is, if you control the supply of the Feedstock into any value added process you own that process lock stock and barrel. It’s something the Chinese with their longer term prospectus thinking that know this hence their “one Road” etc policy in many countries to in effect get control of the raw resource feedstock that drives industry. Likewise religion knows this which is why they push hard on mothers and their children, that way they own the next generation of income providers…

Clive Robinson • November 28, 2017 8:00 AM

@ All,

El Reg has made some choice comments on the idiocy contained in W3C API specs which are in effect of no real use to browser users but are real security side channels and vectors, that at best benifit the data thieves and attackers. It’s based on this paper,

https://arxiv.org/abs/1708.08510

And I’ve made further comnent here,

https://www.schneier.com/blog/archives/2017/11/mozillas_guide_.html#c6765082

Clive Robinson • November 28, 2017 1:32 PM

@ Bruce, abd the usual suspects,

A couple for the “facial recognition” file from El Reg,

First up a group has come up with a “face generator” for photographs. Importantly the result is that facial recognition software does not recognise the face, but it’s sufficiently close to the actual person that humans can recognise them,

https://www.theregister.co.uk/2017/11/28/boffins_craft_perfect_head_generator_to_beat_ai_facial_recognition/

Secondly the London’s Met Police are up to their old tricks still with crowd facial recognition trials that apparently never end. I missed it back at the end of august but as they say “some things never change”…

https://www.theregister.co.uk/2017/08/24/biometrics_commissioner_breaks_cover/

Clive Robinson • November 29, 2017 8:12 AM

@ Gordo,

With regards Dan and Andrews article, and,

United States, which might best be characterized as a “collect data first, ask questions later” approach.

Is being very optimistic about it even for a US centric viewpoint. I with a more realistic view point would have said of the US approach,

“steal data first, don’t answer questions later bribe a congress critter instead, and if that don’t work fight it out for ever in court”

It’s why the new EU regulations appear so draconian with the high levels of fines and low levels of proof required. And I still think it’s to lenient in that some joker in the US will “off shore” the gathering / storing process to some shell within a shell company in a tax haven which has no legal tieups with either the EU or US…

It’s abundantly clear that neither the situation or legislation will change in the US as long as US politicians hold their hand out (just as politicos do in many countries).

As others have noted in the past slam the CEO etc of one of the big five in jail for 5-10 and things might change especially if you add compulsory fines of 20% of assumed total earnings and holdings. If they try to hide via various means treat them the same way the US does to those they lable as “terrorists” etc, by sequestration of all available company assets and those of those related to officers of the company and share holders, oh and those held by other US entities including those who run the country[1].

Sometimes you have to play a lot more seriously than “hard ball” to get peoples attention. Or as has been noted before “Raise the pain threshold” to “a little less than lethal”.

I would however draw the line at sending in drones and hit teams as Obama and predecessors are know to have not only done but glorified in.

[1] That is anything and everything the USG has used against others and the countries they live in. Kind of what goes around comes around policy.

Clive Robinson • November 30, 2017 10:02 AM

@ The hazards of releasing…,

This is the sort of feature/bug you’d expect from MS Windows, but it comes to us from Apple, instead

Ahhh reminds me of Win95 and even Win ME. Most never saw WinME or it’s appaling… Well everything, it was thus as popular as a cape porcupine stuck in a toilet cubicle…

@ Rachel,

Clive, you are the Light of the Web. England needs a statue of you.

You know my ears change colour at the slightest cause… thus to be life like the statue would need bright neon lights on either side to spread the happiness in bright pink. It would thus be a little “70’s”, a time I had to live through and some how survive (and still have shirts from, in the back of the closset, where they live a life of their own 😉

@ gordo,

Regardless, the NSA’s time-machine downstreaming, to other TLA’s, will remain relatively unhindered.

Yup, and the way that can be abused to get other warrants by chaining etc is a nightmare even for mindless zombies with no social contacts…

Clive Robinson • November 30, 2017 1:15 PM

How to end up with Uber via a snack bag

Apparently an Australian engineer has been sacked for puting his work related PDA in the bags you get chip/crisps in, even though his employers knew he was doing it for quite some time and said nothing,

https://arstechnica.com/information-technology/2017/11/australian-man-uses-snack-bags-as-faraday-cage-to-block-tracking-by-employer/

Apparently the mylar bags have a very small amount of aluminium in them, so in theory could be a Faraday Shield, but I personaly would not bet on it in any way shape or form. If eight or nine layers of baking foil wrapped tightly around a mobile phone still let it ring, you can see why I’m skeptical. UK “crisp packets” I’ve tested certainly don’t pass the mobile phone test so, unless theres something special about these Aussie bags, be it upon your own head if you end up working for Uber on minimum -30% wages.

Clive Robinson • December 1, 2017 3:13 AM

Speaking of crypto currency, this story about stealing Bitcoin poped up on pastebin,

https://pastebin.com/jCDFcESz

I’ve no idea it’s true or not, but it’s about a poor algorithm for converting passphrases into keys.