Schneier on Security

Clive Robinson • January 12, 2018 2:29 AM

@ Impossibly Stupid, Celos,

I’m not sure there is mathematically any good way to reference the original and still ensure you’ve stripped out all the secrets identifiers.

If you consider a document consits of information layers, from the bit level upwards then you would have to look at each layer seperatly and in combination. It helps however to think of each layer as an extended Shannon Channel[1] when analysing things. Importantly Shannon’s work tells us what the limits are in any layer for a covert channel. However when considering multiple layers you have to move to the MIMO models.

If you folks are old enough to have been through the Digital Watermarking[2] (DWM) War back in the late 1990’s into the early 2000’s, that worked in layeres each getting added by defenders as attackers found ways around them. However the problem the defenders ran into was that in a file format the channel parameters are in effect frozen, whilst the information content could be varied without it being perceptable to humans. Thus DWN failed to work against certain attacks.

In putting caneries in documents the defenders have the ability not just to use the spare channel capacity for a covert channel they can also modify the information input.

One such change would be the use of a thesaurus for word substitution another is the writing style. Such as “that is” “that that” and “that which” can be used in an interchangable way. And it is in this stylistic level where the defender gains an extra advantage.

If a whistle blower takes a document and deleates or removes the non printing canary layers, then when putting the original and copy documents side by side gives to a human reader an identical document, that the originator of the document would have no deniability on. However as they work through with a thesaurus or change the style, they change the visable doccument thus giving the originator not just deniability but an alert of a whistleblower when a journalist trys to get verification.

It is susspected that some lawyers have used such deniability already with corporate clients.

Thus journalistic integrity has two sides that of protecting the source and that of verifying authenticity. It’s a situation that favours the originator not the whistleblower.

Thus the whistleblower needs to in effect frame a colleague to protect themselves. It’s something the originators like the NSA and a well known film company have exploited ruthlessly.

It was a point that was not lost on Edward Snowden, which he first “used colleagues” then realised what that ment so “outed” himself. However even so we have good reason to believe that those colleagues he did use did not go free from sanctions by the vengeful senior hierarchy.

Which is in line with “Uncle Sam Policy” of “throwing under the bus” any nation, corporation, company citizen or other person innocent or otherwise “as an example” to others. Unless of course they have certain traits, then they become almost untouchable for any crime from over due parking fines to genocide. Which is why the US has that bit of legislation about sending in the troops to rescue any such US person from a valid Human Rights abuse trial…

The problem with this mentality is “blowback” or “what goes around comes around” 9/11 showed that the idea of Exceptionalism by Issolationism protection nolonger works. The NSA apparently has not just recruitment but staff moral issues… The list no doubt goes on and will get worse.

Oh and Whistleblowers will wise up to who they give their documents to. Many foreign journalists acutely aware of espionage issues with the US will not attempt to verify in the same way as would US journalists, thus will asses veracity via different methods prior to publishing, thus the story will break without the originator being fore warned.

Which is why the Intercept and the journalist who sent a copy of the source document back to the US originator still stuns me.

Yes I know the Intercept have to be cautious about US entities running false flag / discredit opperations against them, but there are other ways to get verification.

[1] Claude Shannon came up with a model for a communications channel to work out efective information rates in the presence of noise. In essence you have three components to consider, the channel capcity normally given as Bandwidth the level of the desired signal at the receiver input and likwise the noise. Importantly in a practical system there is usually a large margin between the theoretical limit of a channel and that used to convey information. This excess capacity can be used to provide Forward Error Detection and Correction or as a covert channel. Shannon expanded the basic channel ideas and others have done likewise to account for new issues such as various types of jamming that can be analyzed as multiple parallel channels with bleed or cross channel symbol interferance.

[2] In essence DWN exploited redundancy in an image and added faux noise to it. It used similar techniques as Low Probability of Intercept (LPI) radio Direct Sequence Spread Spectrum systems.

[3] You can read about some methods of attacking DSSS LPI systems in this 2005 thesis https://etd.lib.metu.edu.tr/upload/2/12606906/index.pdf obviously things have moved on in a decade which is why MIMO systems are replacing DSSS, FHSS and hybrid systems for certain covert communications techniques.

Clive Robinson • January 19, 2018 1:49 AM

@ Wael, Ratio,

See what the file looks like where my comment is.

Back in times past prior to “I An Not French” leaving here for places unknown we had a little spat about hiding in plain sight using pairs of HTML tags.

Thus as I said at the time you could use say the “i” italics flag with the “ul” list tag in four diferent ways thus giving you the equivalent of two bits of hidden data. The only problem was finding and using a web server that did not mung whitespace etc.

So without looking my first thought if it was not a symantic or “shared knowledge” piece of stego it would be by use of HTML tags as that’s easy for a “hand edit” in notepad etc without needing to remember unicode character listings etc. Also your hint suggests that a look at a simple listing would work, thus HTML flags would be visable.

Any way it’s Friday morning on a cold day in London Town where even the “flying rat” pigeons are looking hung down and brung down. I fully expect one of them to curl a wing tip and cough cough into it like some aged smoker puffing their day away.

Clive Robinson • January 19, 2018 10:43 PM

@ JG4,

I recall reading where they collapsed a major roof with many tons of chicken bones from the nearby dump

Yeah Seagulls are actually taking over from pigeons, more flying dogs than rats. Like Canadian Geese they are not something that you would eat out of choice. I’ve actually had a full on fight with a seagull that was attacking a child and frightening her mother. They are not just vicious they are bold as well and this one had drawn blood. However once I had a firm grip on it’s wind pipe it quietend down sufficient to get it away from the high street and spectators. Personally I’d have quite happily wrung it’s neck but people get all squeamish about that sort of thing, saying it was not doing any harm when it had just nearly bitten a childs finger off…

In the UK we used to have weekly refuse collections but the Government decided that once every two weeks was OK, which it is not… Since then the levels of ordinary vermin such as flies, mice and rats has shot up, but also second tier vermin such as foxes, seagulls, squirrels and feral pets coming into direct contact with humans even in their homes. Often it’s young children getting attacked you hear about because the over populating vermin see them as a fresh food source… It’s also encoraged an increase in “fly tipping” and other anti-social behaviour such as setting bins on fire…

Clive Robinson • October 11, 2018 5:02 AM

@ Wael,

Apparently something changed on https://aesencryption.net .

Yes, did you look through their first code snipit and find it’s “hard coded” IV?

Clive Robinson • October 12, 2018 5:19 AM

@ BSPMBS,

So you actually ate a goddamn crow?

Yes, I have an intetest in “industrial history” or more precisely how people did things in times past. They are rarely if ever written down so you have to take what clues you can and experiment yoir way through.

What we ate in times past in terms of basic ingredients is known, sometimes you get a list but they were written as aids to memory not a guide to process them.

Even today we hide such information for instance seeing the base list of ingredients in the Chorly Wood bread making process will not give you a light fluffy loaf. Because what do you do with the chicken feathers or animal hair?

Likewise various sauces, the Romans used “rotted fish sauce” but most would be squeamish to try it, yet are quite happy to eat oriental food that uses “fish sauce”, or “anchovy essence” in steak pie, or just Worcestershire sauce on cheese on toast. What about “rotted bean and grain sauce”? Well you might know that as Soy Sauce, but the secret to making it is in the process not the base ingredients.

So yes when you find purchasing records for the kitchin of a large house / palace etc and you come across “rooks” but know they are “crows” and a game bird pie ingredient list that uses amongst other things “withered grapes” you need to get creative…

And yes you can make young crow’s caught by rooking edible even pleasent by modern standards, but it’s a lot of work. You can not make crows that have flighted for a while taste nice. Because the taste of what they eat taints their flesh…

It’s why we don’t eat seagulls for instance, and why we hang some game so “flavour can rot in”.

Many of our modern taste likes such as cheese, pickles, breads, and alcoholic beverages only happen due to a controled “rotting” process. Others such as smoked or salted meats fishes and cheeses by trying to stop a rotting process, sometimes by encoraging a different rotting process to happen first…

Arguably we learnt to cook from scavenging animals and seeds left after forest or similar fires. Likewise preserving from trying to hide meat under water and hiding fruit in caves and holes in the ground.

In short “fresh food” is actually quite dull to taste and unexciting, we need it to rot a bit or add small amounts of poisonous plants (herbs and spices” to make it taste interesting.

Clive Robinson • October 12, 2018 7:05 PM

@ Wael,

At least what people call me.

Having once had the “top line” spell checker on an android phone change your name, it occurs to me I have actually never tried to prononce your name out loud.

I’ve kind of assumed in my head it’s Wait and heel so Way-eel. But in honesty I’ve not a clue.

Clive Robinson • October 15, 2018 3:30 AM

@ Wael,

A mechanism that achieves both Perfect stealthiness and Perfect Confidentiality must necessarily involve Security through Obscurity.

You owe me “Brekfast at Milliways”.

First of you do not define “Security through Obscurity” which ordinarily might be described as, something that is kept obscure to keep it secure. Where obscure in general would mean “hiden from view” in some manner. Thus it is,

Hiding in plain sight

Which is what I will work with.

Now lets examine your first premise,

1: Perfect confidentiality — Cryptography

Where you define “Cryptography” as,

the art of hiding the meaning of the message.

By which I think you mean the “contents of a message” should be kept confidential whilst knowledge that a message has been sent or received is not (ie lets rule out traffic analysis).

Your second premise,

2: Perfect stealthiness — Steganography

Where you define “Steganography” as,

the art of hiding the existence of the message.

By which I think you mean the message or knowledge of the message should be confidential even though a third party is aware of a communications. That is the communications contains a non confidential message and a confidential message.

Thus by combining the two you end up with,

1, An obvious communication.
2, With an obvious message.
3, With obvious contents.

But also,

4, A concealed message.
5, Where the contents are further concealed.

Thus 2-3 describe a “plain sight” message, and 4&5 describe a secret message “hiding within plain sight” within the communication 1.

Happy?

Clive Robinson • October 16, 2018 5:29 AM

@ Wael,

Not a necessary restriction. An observer knows there is communication taking place, but is unable to understand the content of the message. What’s the effect of Meta-Data on both mechanisms?

That’s where you fall into a reasoning trap.

If an observer “is unable to understand the content of the message” then how they view it will change.

Thus you have,

1, Comms with non secret message.
2, Comms with a secret message.

The same difference between a postcard and a letter.

This substantialy changes the meta data in a third parties eyes.

So back over to you and an improved breakfast offer… Tiffany’s is looking good 😉

Clive Robinson • October 24, 2018 11:37 AM

@ Wael,

I didn’t know you knew of the Hamlet… Last time I ate in there was when I was doing some work for London Greek Radio (LGR), that a friend helped set up on the engineering side when it was a Pirate Radio Station back in the early 80’s.

LGR got their licence with quite a bit of help from somebody called Georgios Panayiotou who was an East Finchly lad who put in a lot of work behind the sceens to get them a licence in the late 80’s. Georgios was a quite popular and influential lad at the time but most people knew him as the front man of the duo Wham or George Michael.

Back in the 80’s I also used to work in the Seven Sisters road kind of around the corner, and the then owner of the Hamlet was related somehow to the owner of the company I worked for. If I remember correctly the Hamlet was also one of LGR’s first advertisers.

However there was another restaurant on the opposite side of the road to where I worked which we used to only half jokingly call “the staff canteen”. They were happy times, working during the day socialising in the evening either with my co-workers or some of the LGR bods, neither aware of the other as I fairly strictly compartmentalised my life for various reasons.

One funny incident that happened, some one I worked with lived in a block of flats, which he had no idear LGR were using the roof for the transmitter and antennas. I was their very early one morning with tools and cables in hand to help sort out a problem for LGR when around the corner walked my work colleague on his way home to go to bed. He nodded and said hi before going in. I breathed a sigh of relief thinking I’d got away without answering any questions, however Monday morning he asked infront of the boss… Let’s just say it was an interesting conversation…

But the same co-work like myself only just avoided getting entangled in the supposed “Hacking of Prince Philip’s Prestel Email account” in 1985 where Robert Schifreen and Steve Gold ended up getting dragged through the whole UK Court system untill where the Court of Appeal found them innocent and the House of Lord’s declined the Crown’s request to revisit the case.

I had been involved with the development of “bulk upload software” for Prestel which I was building on an Apple][. Prestel was owned by British Telecom (BT) who also owned “BT Gold” which also had it’s woes. Due to an embarrassing incident on the BBC Micro Live show where the then co-founder of Acorn Computing Machines (ARM) Hermann Hauser had his account (ACN001) “hacked” by “Oz and Yug” which got lied about by BT spokes person’s that the main stream press published the following day.

After discussions with others in the scene about the easily disprovable lies, I wrote a story correcting the facts that got put up in the editors space of Prestel’s “Micronet 800” which was the hobby pages area BT hoped would make Prestel earn money.

Word quickly got back to BT Gold managers by a thoroughly unpleasent person by the name of Dave Babski who was supposadly Micronet 800’s editor in charge. Thus BT demanded that I go and give them a demonstration of what I had said in my story…

Having been quite detailed in what I wrote and being involved with other work for BT, my “sixth sense” kicked in and I asked myself why they needed it demonstrated by me… I became deeply suspicious and said through intermediaries “No need to demo”. BT in turn got more pushy so I got even more suspicious and told the intermediaries that if BT could not follow what I had written, that had already been confirmed by others that knew the Prime OS well, then a demonstration was not going to be of any use so I said “No Way jose”. More pushback came so after chatting with my work colleague’s girlfriend who was Dave Babski’s “secretary” about the legal side of things she had told me there was “something iffy going on” and suggested that not only I asked about significant payment for my time as a consultant but importantly with a contract absolving me of any legal risk. When this got mentioned through the intermediaries the BT push back stopped abruptly… It was only later after what happed next that dots got joined together[1]…

Thus when the problem that happened with Prestel[2] came up I and others suggested to Robert and Steve that taking the problem they had found to Dave Babski was probably not a good idea and I told them and several others they were asking for trouble, having been through similar and becoming deeply suspicious of BT’s motives (justafiably as it later turned out).

So even having been warned Robert and Steve went… they showed, they went home, Margaret Thatcher went balistic, they got arrested, they got found guilty of fraud. They then managed to appeal on the technicality that UK law did not cover what they had supposadly done and were thus successful. But… “The Crown” pushed back because of significant political interferance by “Mad Maggie and Co”. But thankfully the House of Lord’s kicked it back at the politicians saying if there is no law then as legislators do your job… The eventual result was the 1990 Computer Misuse Act. Which is a significantly flawed piece of legislation, that has led to other subsequent wrongfull convictions.

Steve died a couple of years back and Robert was working at Brighton Uni as a computer admin last time I checked.

Of all the stories up on the Internet and in books about the incident the one which has the least number of inaccuracies I’ve seen is,

https://www.theregister.co.uk/2015/03/26/prestel_hack_anniversary_prince_philip_computer_misuse/

Where the journalists atleast talked to some of those involved[3]…

Aside from “Maggie’s War” down near the south pole the 1980’s were fun times with new and exciting technology and plenty of “Paper and pen” computer journalists who were barely old enough to shave let alone drink getting their scoops from people likewise barely old enough to drink. I was seen by some as being “a little old for the scene” being in my very early 20’s… Most of the journalists faded away into other careers as the glut of comp mags died away but some did other writterly things. One I chatted with quite often on the semi-social side as we were “old boys” on the scene started doing “comics” and later books, I’m told he’s doing OK as an author. You might have read some of his stuff he goes by the name of Neil Gaiman.

People comming into computers now a third of a century later, see a several trillion dollar industry, with crazy entry requirments. They just don’t realise just how small and humble it’s beginings were and usually don’t believe you even if you tell them. For a lucky few back then you could have a knowledgeable finger in every pie not just a fraction of one. Some like Steve who was a nurse came in from entirely unrelated proffessions and by being friendly informal and basically just likable to all got on and moved up as respected individuals.

[1] At the time BT was still in “public ownership” and was considered by the then PM Margaret thatcher and her cronies as the jewel in the crown of assets to be liquidated for truck loads of cash to fill the Treasury coffers and significantly enrich a favoured few… Thus the tyranical edict “Heads will roll if anything threatens the sell off” came out of No 10. Apparently marking BT managment look like the incompetent asses they were was now the equivalent of a capital crime… I had made them look like idiots even though my story had not been put up publically most computer journalists new all about it through other Micronet 800 editors. Which thankfully the traditional journalists did not. As I was friends with many computer journalists I managed to avoid that side of things. Also as I had not submitted the story from my home phone or a work phone and the intermediates had not given BT my number, they did not know who’s phone to tap (something they did to both Robert and Steve that came out in the trial). What ever the actual cause I’d managed to evade the wrath of “Mad Maggie” who apparently did not learn from it or other trials that later blew up in her face and made her look a poor judge who was significantly out of touch with reality, which eventually got her knee capped by her own party (it’s rumoured that Mad Maggie’s legal failures were what made Tony Blair wreck a thousand years of jurisprudence and throw way to much power in the direction of the state).

[2] Put simply BT managment were incompetent and being driven by political imperative by the then Prime Minister to paint rosey pictures not reality. Thus no money was being spent on computer security which included not fixing glaring security failures. BT wanted teenagers to build and supply the tools that BT could not. As part of this they set up a test server known in the sceen as Pandora that teenagers writing bulk upload software and games etc could test their stuff on. What BT did was take “live backup tapes” and put them on Pandora then put the administrator password up for all to see… The other thing that admins could see was the plain text passwords of all of Prestel’s users that included that of HRH Prince Philip… Opps major security blunder that everybody on the scene was laughing about. Robert being a journalist for “Acorn User” felt it was his duty not just to inform BT but also put preasure on them when they were ignoring the massive security hole they had created. Hence the meeting with Dave Babski that they had been repeatedly warned against even by Dave Babski’s “secretary” that led to Robert and Steve’s arrest…

[3] You would be supprised by just how many don’t including researchers. Like the Head of the Business School at Kingston University, who just about a decade after the two events obviously decided reading a few Internet articles was sufficient research befor publishing it in a book[4]… What usually happens is that the “BT Gold” and “BT Prestel” events get conflated into one… Which I guess shows just how few people actually do “Primary Source” research…

[4] He later stood to become a Member of Parliment, the voters in that constituency obviously saw him coming and decided he was either useless or in it for himself or both, and said NO. I can not remember if he lost his deposit or not, but others tell me he did…

Clive Robinson • October 25, 2018 3:06 AM

@ Wael,

No 10? I think I asked you before and forgot what your answer was.

Does this refresh your memory?

https://www.schneier.com/blog/archives/2017/11/friday_squid_bl_599.html#c6764025

With regards,

Good heavens, man! This is Indian movie material 😉

Whilst Bollywood has more viewers than Hollywood by a big old margin, I suspect the real plot would be to OTT (Over The Top) even for them.

The 80’s computer scene in London and other parts had two major factions,

Firstly the “Big Iron” types of ICL etc hanging of the UK Goverment teat just like the current MIC does in the US. The price they payed for this welfare was “Spook-Works Invasion” that is just as BT had a multitude of Secret Squirrels running around ensuring International Standards got “finessed” and MI5 got unlimited land line access to place “surveillance equipment” as and where they wanted. Which in turn gave GCHQ and thus SiS/MI6 and even parts of the Met Police and US IC similar privileges…

But also as Ferranti found with it’s F100-L and later F200 CPU’s the Spook-Works teat was a faustian bargin. Ferranti was a leading edge British design company at the time and almost a household name it was in the MSM news that much. They realised back long before US companies that 8 bit CPU was not going to give the power that was going to be needed on the desktop so set about designing a 16bit CPU which they did and it was in effect a “British First” in many ways in 1976. Unfortunately the Government Mil/spook bods decided that the British Military should also use it thus have “first call”… Thus it in effect got both the “Mil-Hardening” and “classified” treatment and by the time that got sorted out it was to little to late, the market had moved on. Just last year I was “old times” chatting with one of the lead designers and he is of the view that the F100-L was “killed off” by the US via the “spook-works” Five-Eyes “Special Relationship” as so much British Innovation had been prior to Mad Maggie Thatcher getting rid of one of the US Political holds over the UK. You can read some of what is left of the “official” story at,

https://revaldinho.github.io/f100l

Few remember it today but the UK had a “Brain Drain” issue due to the “Special Relationship” killing leading edge design in the UK, causing the tallent to leave the UK and work mainly in the US. Which is what the US Government wanted. In a way it’s not much different to what China is doing to the US with their current monopoly hold on rare earth metals forcing US innovation, production and jobs to China, which I’ve been warning about for years here and other places.

But getting back to the 80’s scene, the second faction were the “Mavericks”. These were nearly all below the age of thirty and some were even still at school… They designed the “Home Computers” that kick started the 8bit Home Computer Revolution, they also designed the software and they appeared as an unstoppable uncontrolable force to the old school “Big Iron” and Government, which caused no end to infighting amongst Government departments. For a few years it was a wild ride, but the Home Market died off and although the UK was the leading edge of the Personal Digital Assistant (PDA) development the UK Government in various ways killed off the innovation there to. At the end of the day the only company that made it big was Acorn Research Machines (ARM) which again supprise supprise the UK Government has pushed out the door into Chinese hands thanks to the previous Chinese fawning UK Chancellor George “gidiot / white lines” Osbourne which even his own party used to publicly talk about his coke habit, one even bringing it up in a parlimentry question via the “cut the sugar in soft drinks” campaign. Thus with his two predlictions it’s hardly supprising he got called by some “China White”.

As the old saying has it “You couldn’t make it up…”