Schneier on Security

Clive Robinson • January 22, 2018 9:13 AM

@ jbmartin6,

This phrasing threw me for a loop for a second

At first sight the statment,

fake secure messaging clients like Signal and WhatsApp

Does look a little odd / contrived. But from a certain view point it is accurate.

The two apps broadly use the same Moxie Marlinspike “Communications Security” but they do not offer any “Device Security”.

Thus as I have pointed out on the odd occassion if an attacker can get access to those applications “plaintext user interface” an attacker goes after that and entirely ignores the “Communications security”, with an “End Run Attack”. These attacks work on “communications end point devices” like PC’s, Smart Phones, Tablets, Pads etc because of the very poor security design of all of these systems. Put simply the appications protective security ends in the App, whilst the lack of device security means that other communications paths can be used to access the plaintext that gets sent from the keyboard and sent to the screen simply by putting a “Tee Shim” or simillar in the path between the app and the user.

Likewise FDE for logs, recordings and other data files is only of use for “data at rest” but is fully accecible via the UI in it’s plaintext form when the device is in use.

This is nothing new but people from the very bottom of security to the very top of security including many Gurus, appear not to be cognizant of this. Or for other reasons are sort of ignoring the issue to atleast get people to improve one part of security –ie the comms link– against NSA “collect it all attacks” and the likes of the FBI with NSL’s and Third Party Record work arounds.

Whilst this is laudable for several reasons, and does improve security against “hovering it up” attacks, it does little or nothing to improve device security, which is where “targeted attacks” are focussed.

This series of APT attacks are clearly targeted and thus were successful.

One of the problems we have is the assumption that targeted attacks are “against bad guys” it’s a myth the likes of the FBI and DoJ are desperatly pushing into the public minds.

As see in this case the people targeted were very probably “bad guys” by any definition most in the West would use.

It’s why we realy need to turn the spotlight realy hard on the nonsense from the FBI / DoJ and device manufactures. Device security is not their and should not be there to protect their vested interests such as NOBUS “frontdoors” “Golden Keys” or “walled gardens”. The idea of NOBUS is rediculously stupid even in physical security, it’s a compleate nonsence in information security.

There is a great deal of value not just in IP but peoples lives and well being in information security. Having weak device security makes those pushing it at best compliant “only following orders” types, through criminal conspiracy through being knowingly part of treason and murder.

Device security matters rather more than comms security because of it’s broader scope to compromise information. As Winston Churchill used to scribble on documents “Action this day”.