Schneier on Security

Clive Robinson • May 26, 2018 2:45 AM

@ Wesley Parish, Thoth,

With regards,

http://www.theregister.co.uk/2018/05/25/amd_epyc_sev_vm_encryption_bypass/

Possibly nobody has mentioned it because the SEVere attack developers descriprion given is a little difficult to get your head around on first read.

However reading it I think that put simply the error is that the developers have worked out a way to use the SoC as an Oracle just by memory address (I will mull it over for a while).

However the bit at the bottom about using existing “Secure enclaves” made me smile as, Intel, ARM and AMD have had problems in their implementations and that little “Xmas gift that keeps giving” of Spector and Meltdown.

As I noted back then I fully expect more “hardware” issues to be found over the next half decade or so, as academia and young researchers start digging, through what are in reality a compleatly hopeless cludge of “go faster” incompatibilities, that were thought out individually rather than as a coherent whole.

This is one of those “new” attacks around MMUs that will in all likelyhood develop into it’s own class of attacks…

Clive Robinson • May 27, 2018 5:17 AM

@ 65535,

Probably the most accurate indications of damage to USA corporations that collect and track users will be in the stock market.

The problem with looking at the stock price is it’s rapidly reactive and has a very short term memory. It also uses “positive feedback” mechanisms that gives inherent instability and the rise to oscillitory behaviour at the best of times. The legal side of things is sometimes glacialy slow to react and the results are usually of an existential or almost existential nature for the target. It’s feedback mechanism is somewhat interesting, in that it causes a damped ringing effect. There is an initial overshoot due to the reporting in the media etc, then things die down to a steady state, to await the fate of the next target.

Thus the initial spike from the conclusion of stages in the legal proceadings causes significant change in the stockmarket, but only after the event has happened. Worse usually the reaction is significantly biased towards the negative. That is the announcment of the start of legal proceadings causes significant negative reaction, that is almost never reversed even if the target is fully exonerated at a later date. In effect “5h1t sticks” and raises a bad smell for a long period of time, it also splatters and sticks to others in near proximity.

Thus legal proceadings are almost always a disaster, one way or another. Which raises the question of can they be avoided or mittigated?

There is a saying about “The three sign posts to disaster”. In essence the first sign post only becomes visable long after the disaster as it is much like the beat of a butterflies wings. The second signpost is visable to those who are both looking and have sufficient wisdom to see where it is heading. The third is obvious to all who care to look but importantly not those who don’t.

Finally you have the disaster but interestingly as we saw with say SCO those on the inside keep up with the pretence for various reasons, thus the disaster hit’s much harder than it otherwise should, and recovery is thus made impossible way more often than not and then the vultures move in to strip the bones.

Stockmarket prices tend to be based on a mixture of the last signpost and behaviour of those inside, thus only give a short term warning which can be used to get out with more than your shirt. However as we know “the market” more or less mindless to consequences has now moved to “High Frequency Trading”. Where the time it takes light to travel is a critical factor… Thus you do not have time to read the stock market ticker before disaster has arrived…

With a little further thought you realise that if you can control the legal process in some way then yes you can mitigate the effects. Thus if you are sufficiently knowledgable to have the equivalent of forsight then you can in effect spot likely first signposts and mittigate them by controling the legislators. In effect that is what the financial industry has done and continues to do. Even though we had Banking Crisis one and two, it’s still the same game, with a few near meaningless fines being thrown around from time to time.

Thus it can be seen that the way to win with the stockmarket is to rig the came in your favour by controling the legislators. Thus if you are not in the position to rig the system, you are in effect a loser to those who are…

With regards,

I believe Neill is essentially correct. Putting any sensitive data on the so called “cloud” or various server farms is not advisable.

I’ve been saying for so long that the Cloud is a disaster in the making, that I’ve got an almost “chicken little” reputation with some. The simple fact is as with privacy, if you let others get access to your information then you’ve lost control of it forever.

Thus you have the three basic things you can do with information,

1, Communicate it.
2, Store it.
3, Process it.

Whilst the likes of encryption might give you a degree of extended control with the first two, it currently can not help you with the third.

But is that degree of extended control worth it when it comes to storing your information somewhere not under your direct control? The answer appears to be “no” in all but the short term. And the trouble with “short term” is once it’s out there under somebody elses control it’s realy become “long term”…

Thus if your information is truely short term in that it will be made fully public in say two months, then there might be some benifit. The reality is though that information that falls into this type is quite rare, and usually of small size. Thus the associated costs of setting up Cloud Storage for it are probably greater than keeping it “in house”.

Thus the “use cases” for the Cloud and sensitive / proprietary information are realy very small indead if you take a realistic security view point…

But as we know “short sighted” is the hallmark of Western behaviour especially from one quarter to the next at corporate and Governmental size. Thus security rarely gets to see the table let alone get a seat on it. As for setting the agenda, well I think we all know the answer to that.

Put simply the Cloud might look nice to a corporate bean counter for the next quaters figures. But it’s a pact with the devil and you are almost certainly not the piper[1]… Thus it’s best avoided if you want a future.

The fundemental idea the Cloud is supposadly based on is “sharing” to reduce cost. But as people should know from various health advisories, “sharing is taking avoidable risk that could kill you”.

Sadly the “marketing dream” has raised the supposed up side to giddy hights, but the down side very real and significant risk is ignored[2]. The result is the all to frequent “XXX million user records stolen” or similar. But that hides the real losses of Intellectual Property that is both hard won and costly to lose. This tends to be kept hidden but Industrial Espionage is both very real and very costly. The likes of the “Internet at every desk” and “Cloud Services” are Industrial Espionage enablers…

[1] Unless of course you have real leverage, thus the US Gov via various techniques have real leverage and maybe one or two other superpower governments do as well but the rest of us no, we don’t. Thus like charity, security “should start at home”[2]

[2] A question everybody should ask is “What does the Internet give me?” and the bad should take preference over the good in any list. In most enterties there is actually little or no good in having Internet connectivity and internal systems mixed, when you consider the bad. I know it’s not a popular view point, but it’s something “due diligence” is bringing to a tipping point.

Clive Robinson • May 27, 2018 3:26 PM

@ MarkH,

Only an IDIOT would believe that the country that is militarily occupying and making war against Ukraine could be behind such an attack.

Well you could ask “What idiot did nothing about the long term vulnerability?”.

The real question is did the vulnerability get in those routers “By accidemlnt or design?”. On the off chance it was “accident” then the next question is “When did the likes of the Wests SigInt agencies become aware of the vulnerability?”. Which naturaly leads into “Why did they not do anything about the vulnerability?”

There is the age old question about the apple store suffering from pilfering, of “Who’s to blaim for the pilfered apples when there is no lock on the door?”.

The modern equivalent is who is to blaim when known vulnerabilities get exploited by cyber criminals? You often hear of unpatched systems getting exploited and their administrators getting the blaim. You also hear of major software houses getting the blaim for taking to long to fix vulnerabilities. You also hear the crooks getting blaimed. But how often do you hear of the SigInt agencies getting blaimed for not just sitting on these vulnerabilities but actively building attack malware to exploit the vulnerability?

What many appear to forget is that to have a worthwhile attack strategy, you must first have a strong defence strategy. Something the West’s IC establishments tend to ignore for their own short term strategy…

Clive Robinson • May 29, 2018 5:40 PM

@ Ratio, echo,

I’m far from surprised, to be honest.

Two things you need to consider. Firstly “the age of marriage”, most of the non western nations don’t have what we would call sensible “ages of consent” if they even have one. Likewise sensible minimum ages for marriage, again if any.

I’m sure you are aware of which ethnic / religious grouping gives Sharia Law presidence over secular law, and even try to do so when in secular nations. They further believe they have rights of ownership where ever they place their feet on land that is not already “owned” by their sect of their faith.

Well in total they represent a quite small part of the population in the UK. But the young men represent a significant fraction of the prison population and have disproportionately high levels of convictions and similar. But only come from one or two sects of the religion. Frequently these young men have been caught being involved quite seriously in drugs, prostitution, people trafficing and various forms of thugsh behaviour, intolerance to others and making threats etc. The sort of crimes you would expect from “junior mobsters”

Whilst it might be argued they are being victimized, the percentages and evidence given tends to suggest otherwise.

As people in other Western Nations are well aware these young men have a “sense of entitlement” and when they run into people who belive they should fit in with the secular behaviour of the nation they can and do get quite angry / violent. Unsuprisingly such a mental outlook makes them easy picking for radicalization. But many “self radicalise” and do so compleatly ineptly, thus become “known to authorities” who generaly do not have the reaources to adequately keep an eye on them. The result as I’m sure you are aware have been attacks on the civilian population of a number of European Nations.

Speaking of which, you might want to check the calander with respect to one such atrocity,

https://en.m.wikipedia.org/wiki/Manchester_Arena_bombing

It is why people are currently asking questions as to “Why do we tolerate such people?” and “Why do we let them in?” drummed up by various media concerns. Further why things such as “sex discrimination” carried out not just in religious venues but also state funded schools is getting questioned but not prosecuted. There are also other queations about “dress” and similar. You may be aware that France banned various items of clothing.

What you may not be aware of however is that the British Law Society guidence on Sharia law matters, actively discriminates against women. Which was quite a shock when I found out about it.

Shocking as it is, as has been noted, these issues arise from one or two sects. With the others being largely more law abiding than other minority groups in the UK.

It’s a complex subject with even more complex solutions being discussed and thankfully being rejected.

Clive Robinson • May 31, 2018 8:25 AM

@ bttb,

With regards your “What about Trump?” question on net neutrality.

It is becoming clear that one major Trump Policy decision is to “undo Obama”. That is to in effect take action to do the opposit of what Obama did as President to effectively wipe out any legacy[1].

Thus as the named commenters in the piece you quoted appear not consider this, it puts the validity of their decisions in question.

[1] This policy choice appears in line with Donald Trumbs objections to the Opama Presidency from the get go, and his active support of the birther agenda etc.