Schneier on Security

Clive Robinson • November 4, 2018 1:14 PM

@ All iPhones users runing 12.1 OS,

It would appear that Apple have left an inadvertant back door in one of the apps that can be used to bypass the passcode…

https://www.hackread.com/ios-12-1-passcode-bypass-hack-discovered/

In other news there is an Ex-Cop still in jail having not being charged with anything, because he has declined to hand over his password that authorities believe on the word of his sister contains evidence and that he can remember his password. A judge has ruled –unwisely– that he should remain in jail indefinitely for contempt on what is realisticaly a nuisance. So I guess we will have to see if it makes it’s way up to SCOTUS and what they decide to do.

https://www.hackread.com/ex-cop-child-porn-suspect-in-jail-until-he-decrypts-drives/

What is not clear is the prosecution claim that their forensic investication shows that the contents of the drives have check sums that corespond to indecent images. Im not sure that they can make that assertion if the files are encrypted and if they could then why have they not charged him…

The problem of course is that the nature of the alleged contents of the hard drives is clouding the legal issue which the prosecution are no doubt using to push to get a ruling that they would not otherwise get, that they can then use in any future cases irrespective of what the files may hold.

Clive Robinson • November 5, 2018 5:20 AM

@ Wesley Parish, Reader,

Old School ‘Sniffing’ Attacks Can Still Reveal Your Browsing History

And even a decade and half ago the idea behind the attacks was far from new.

As I point out from time to time,

We repeatedly make the same old mistakes, thus appear to be not learning from our history. Which in most cases is well within living memory

Too much “code cutting” not enough “engineering”, or even thought as we build our “Castles in the air”?

Put simply this is another example of a “timing channel” attack, which is quite deliberatly “self inflicted”. It’s what I’ve been warning about with,

“Security -v- Efficiency”

for so long now it’s got a longer beard than Gandalf.

What the attackers are looking for is a difference in time it takes your browser to respond to each link in a bunch of links they send. If you’ve visted the link before the browser responds with a different time than to one it has not visited before. As long as the time difference is measurable and it often is on modern networks then they have enumerated you over the subset of links they use.

The time difference is most often caused by “short circuiting” needless computation, and compilers build simple versions of it into executables as optimisations (think how OR “||” and AND “&&” operators work in C for instance since the late 1960’s and thus all languages written in C since as well as nearly all the applications written in those languages…)

Look on it with a simple thought experiment, say you have a large file refrenced in a URL there are three places the client software can get the file from,

1, The server in the URL.
2, A cache in the network.
3, The local client cache.

It’s fairly easy to see that the times to obtain the file is slowest in the top and fastest at the bottom. Likewise efficiency wise the worst is the top and the best is the bottom. It’s one of the reasons people design caches into nearly all protocols where they can. It’s why for instance DNS works the way it does which has been around since BIND in the early 1980’s which is longer than web browsing has by a long way. And yes the timing in DNS even when traffic is encrypted leaks information about which sites have been visited.

As I said this “Security -v- Efficiency” is a long known issue and every little while we see a variation of it being used as an attack vector. It works across the entire “computer stack” from attacking security in the CPU with Meltdown / Spector all the way up through the presentation layer and into user and above behaviour…

Each time such a security fault occurs it is “self inflicted” because the system designers go for either “speed” or “efficiency” or both, and with them they open gaping time based side channels that haemorrhage information to not just active but also passive attackers.

Whilst you can in theory see active attackers if you know what to look for, because of the way the Internet is designed you can not see passive attackers. Worse as only content gets encrypted but routing port and traffic type meta data does not a passive attacker sitting at or beyond the next upstream node from either end gets quite a lot of information without being seen. It’s why the passive approach is favoured by the likes of the Five-Eyes SigInt entities in their “collect it all” quest.

We’ve known about this timing channel issue since the 1960’s and arguably since the early 1940’s (traffic analysis), and in recent years varients come up several times a year, yet we appear to be incapable of learning from it…

Clive Robinson • November 5, 2018 4:21 PM

@ bttb,

Noam Chomsky Condemns Trump for Pulling Out of Landmark Nuclear Arms Treaty

Actually whilst it makes a good sound bite it actually makes sense when you analyze the issue.

The treat is the one for Intermediate Range Balistic Missile (IRBM) limitations.

It has in effect two signatories Russia and the US. The principls behind it is MAD / runnaway build up. At the time of signing it made a great deal of sense for both Russia and the US. Now there are other players that have not signed it disadvantages both the US and Russia. The big problem is China whose main stratigic defence is nearly all IRBM pointing at Russia and the non nuclear nations around the South China Seas, that the US has via other treaties signed it’s self up to protect.

Whilst there is a lot of noise about Russia cheating, it’s realy only an excuse. Why Both Russia and the US did not terminate it by mutual consent is realy a matter of “gulling the US and other Western civilians.

The fact that both Russia and the US can now develop IRBMs and cruise missiles to balance China and site them close to it’s boarders brings back the MAD balance which in turn will hopefully bring China to the treaty table, or atleast dissuade it from any kind of first strike activity.

Bad as it might sound on balance it probably will give more stability to the world than we currently have…

Clive Robinson • November 5, 2018 9:26 PM

@ bttb,

Finally, I am curious why nukes might be considered “practically useless”. For example, nuclear winter?

First of nearly all WMD outside of conventional kinetic munitions[1] are “practically useless”. Either they don’t work as expected, to slowly, or there is no workable delivery mechanism.

Stratigic nukes are usually “hydrogen bombs” or fusion devices, very large, very heavy, inordinatly expensive, and very unreliable devices. The delivery systems are consequently very large, very heavy, inordinately expensive, very unreliable devices, that are realy not mobile and also very slow to deploy…

Various reports for US weapons have put the odds of a strategic nuke actually getting on target and detonating as quite low, some as low as 10% and some even less. To save embarrassment they usually quote physics package reliability and delivery system reliability in entirely seperate documents that get seen by different people… Where the % reliability for each part looks a lot better… It’s actually quite hard to find an assesment of how many would be lost to a first strike attack from Russia or China, but it could be very high.

What we do know is Russian nuclear weapons in general are considered markedly more reliable. The reason being they don’t have the six or more fail safes that US nukes have…

But the important point to note is the mass of a stratigic device is not linear with it’s yield you double the yield and the mass goes up by a volumetric (^3) measure. The largest device ever tested was the Tzar bomb that was 50mega tonnes and for it’s yield the cleanest nuke ever fall out wise. Whilst it’s yield sounds a lot, it’s thoroughly impractical as a device. It’s so heavy 27tonnes and so large 28ft by 7ft putting it on a missile of any kind is not realy practical and the extra rub, if dropped by a plane it needs a massive parachute that weighs just under a tonne to give the aircraft sufficient time to get away when it has drifted down to it’s optimum altitude.

Modern anti aircraft and anti missile systems would find the very slowly descending bomb an easy target to shoot out of the sky. A small tactical fission nuke like the US Davy Crockett ways in at under 60Kg and it would not be difficult to make them smaller and lighter such that they could be put on moderatly sized missiles used for anti-ship weapons. Exploding such a device near the descending stratigic bomb would probably be more than sufficient to “disrupt it” to the point where even the primary (fission) stage would not go off. Such a small device can also be designed to produce minimum fallout. What is left of the disrupted stratigic weapon realy does not pose that much of a threat either.

But the problem with stratigic nukes is they are not kinnetic weapons but EM energy weapons, the damage they do is not as great as simplistic calculations would suggest. In the case of the Tsar bomb it was dropped from 8Km up to exoload at 4Km up. Due to various effects the fast shockwave bounces off the ground and reflect much of the energy back up… To do wide spread damage an energy weapon needs to pick up debrise from the ground and send it out sidewase at relatively low angles (10-15 degrees) with the fast blastwave bouncing energy back up, the coupling to debris is comparatively low. Thus higher yield stratigic nukes are in effect “self defeating”… Further the nuclear winter effect is actually due to debrise getting thrown up at very high angles thus with the bounce effect no where near as much debrise ends up at sufficient altitude even though the mushroom cloud might be between 50-70Km, which puts it well above the stratosphear effectively wasting a very significan proportion of the energy. That said it was destroyin wooden houses and ripping the roofs of of stone and concreate buildings out to 250Km and breaking windows out to a 1000Km as the shockwave bounced and was ducted in the atmosphere and went atleast three times around the world.

The most effective use for such a device would actually be to explode it in space at an altitude where the EMP pulse exceeded 1000V/m over most of the US which would be around 450Km or a little under the hight of the International Space Station. It would do very little physical damage but communications in the US would cease, power would cease, thus gas, water, and sewerage would also cease. Food deliveries would also cease and the US would probably become “disease central” within three to seven days and there would be insufficient medical supplies to stop it. The upside is there would not be a nuclear winter as such, and there would be colourful glowing skys for quite a while. But it’s not just the US that would be effected many satellites would as well, this might be of interest,

http://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA531197&Location=U2&doc=GetTRDoc.pdf

Tactical nukes which IRBM and cruise missiles are designed to carry are a very different story. The flight time of an IRBM is measured in just a few minutes which makes them near impossible to respond to. Cruise missiles can using “ground hugging” more or less evade detection except from AWACS and some satellite systems due to their manoverability and the limitations of AWACS and satellite systems the “salvo” flying of 20 or 30 cruise misiles will mean that around 50% will get through. As they can be targeted to explode in a particular wide area pattern in a coordinated way their overall effect would be considerably greater than from a single stratigic nuke with the same yield as the total of the cruise missiles.

[1] US law has a generaly not accepted else where definition of WMD. Basically any device –except a 2nd Amendment gun– that can kill more than one person is a WMD under US legal reasoning. It’s what might politely be called “over reach”. Thus if you were to let off a large firework that goes into a persons house then you’ve used a WMD, thus the question arises of intent or accident…

Clive Robinson • November 6, 2018 7:13 AM

@ MarkH,

Some failures are difficult to anticipate, or to prevent … this was not one of them.

One of the problems with being a design engineer is managing not just complexity but failures.

We can think up all sorts of realistic failure modes quantify them and thus have probabilities for them.

But because of the complexity issues, we further try to group failure modes into classes. Because the effect of mitigating a class of failures is much more efficient and considerably less complex than mitigating individual instances of failure modes.

This can have an apparently perverse effect on design priorities. That is you can have a very large group of low probability instances, that as a probability class has a much larger probability than a single high probability instance. As an engineer which do you chose to mitigate?

Further you can not mitigate even a fraction of the realistic failure modes. Inn part because some are contradictory[1] but in the main the required sensors rapidly take complexity to the point where sensor failure becomes the more probable failure mode…

Long trains have a speed issue due to inertia and curves. It is fairly easy to see that as a train enters a curve a pulling engine will quite quickly be tangental to the point where it would pull the more distant part of the train off of the rails. Likewise a pushing engine would push and buckle the train off of the track. The trick is to approach the curve at a safe speed and maintain the pull or push just sufficiently to overcome losses such that each carriage effectively coasts around the curve at a safe speed. A train due to how the load mass is distributed can have a very complex speed profile for any curve, the loading rule of thumb being keep the mass even or if not possible the largest mass carriages close to the engine. This obviously becomes very complex very quickly when you have both pull and push engines that are needed to get the train actually moving (loose coupling take up effect means you only have to deal with the innertia of one carriage or a few carriages at a time). Because of this an engine can and often does move at a different speed to the carriages a long distance away. That is the train can be viewed similarly to a spring or multiple pendulum dynamic energy storage system, which means you are back in the world of resonance and nonlinear load effects especially when push engines are involved. It is known that the dynamics of the system are too complex to model and you could not have sufficient sensors to do it anyway. Back in the 1940’s through 60’s this “POGO oscillation” problem was the main reason liquid fuel rockets blew up in the change of acceleration phases. Likewise why gin turrets and other weapons mounts were slow to avoid “hunting” and other oscillitory “chase your tail” effects.

The solution for trains and ships back in the 1980’s was “fuzzy logic” a more modern method would be a dynamic learning system. Effectively low level fuzzy logic under an adaptive AI system, which works but we have no real understanding as to how… and worse we know there is insufficient time in the universe to test for every condition let alone the life time of the product. Thus as engineers we just grimace, cross our fingers, throw the dice and look the other way…

[1] People glibly talk of “fail safe” systems but most do not realise that many things can not be designed to be fail safe. Because if you fail in one direction you create a danger of a different nature, fail in a different direction and you create a danger in a different direction. Thus there is no linear non complex line from active to stopped… A typical class of such contradictory systems are “mid-range regulators” for preasure, speed etc. Think about a long drive shaft it has speeds at which it is resonant and if not carefully controled through each resonance the shaft will flex in various modes creating massive loads not just on the bearings but the shaft. How you get such a shaft through a resonance is dependent on not just rotation speed but it’s direction with respect to the resonance frequency, which unfortunatly also changes with load and the loads energy storage capacity –flywheel effect– and the shafts energy storage (think torsion spring as well). You end up with a quite complex dynamic map with numerous moving no go zones –which move depending on not just where the system is currently at, but also on where it was some time prior–, that you have to navigate. In times past you tried to “stay in a safe corner” below all resonance frequencies. However this suffered from the “artisanal effect” which you see with Victorian beam engines, massively over engineered, very slow and very inefficient. However modern systems can take the shaft up past several resonance frequency domains but require multiple distributed sensors. If you are up in the high speeds and something goes wrong such as load failure from balanced to unbalanced you can design the shaft drive control system to work with no sensor failures or at most two sensor failures after that you are probably in cascade fail territory where bits start to fly as there is no fail-safe run-down curve… You get similar problems with gas pipe lines where you have to know what is happening not just localy at the pump but along the line and at the far end…

Clive Robinson • November 8, 2018 10:20 PM

@ Timothy, ALL,

… breaking campaign finance laws and raising concerns about Chinese meddling.

I think “The US Cyber Existential threat country” is about to change, from Russia to China.

Ad I’ve noted in the past the US had an Orwellian approach to “Existential threat actors” countries. That is they have a list of four China, Iran, North Korea, and Russia. But only ever have one of them at any one time being the “Existential Threat” which obviously defies logic. But is directly out of the George Orwell 1984 play book…

As of late there has been nothing realy new about Russia (though Mr Sessions falling on his sword might be considered that way). But we are starting to see an upswing on Chinese stories of almost exactly the same type as we had with Russia…

Hence my small bet is the US is about to chang from Russia to China as well see more “Pump Priming” stories about China enter the MSM…

However there is still the “Missing In Action” story about Cambridge Analytica and American billionaires money with atleast one of whom is alleged to be “close to Trump”. There was interesting stuff coming out of the UK police investigation with respect to them and money going to amongst other places Russia, to come back in various ways. When suddenly and without good reason the investigation got killed, allegedly by direct intervention of UK Prime Minister Mrs May… What ever the truth is like the Salisbury Poisoning suspect story it’s gone MIA… Which has kind of spoiled “the thrill of the chase” with “The fox gone to ground”.

Clive Robinson • November 9, 2018 12:56 AM

@ ALL,

As our host @Bruce has noted over on the “iOS 12.1 Vulnerability” thread,

This is really just to point out that computer security is really hard:

It would appear from this article that “price” has little influance on that observation,

https://arstechnica.com/information-technology/2018/11/police-decrypt-258000-messages-after-breaking-pricey-ironchat-crypto-app/

What it further reenforces is the point I make from time to time, that “secure apps” on communications devices are not secure for various reasons.

Which is why I still recommend that you use communications devices only for communications and not for any kind of security benifit that might be advertised for them.

If you need “secure” communications then the security end points must be beyond the communications end points, “no if’s, no doubt’s, no maybe’s”

Break that rule then the chances are you are going to regret it, if you have good reason to need “secure” communications.

What you need is some “secure device”[1] that is atleast “air gapped” from the communications device. Where the user reads an incoming message off of the communications device and then enters it into the secure device to get the plain text message. To reply the user types the message into the secure device, reads the ciphertext out of it and enters it into the communications device.

Such an “air gap” will prevent any “end run attacks” in the communications device. However if the secure device is mechanical, electrical, or electronic it will need to be designed such that it can not leak any information that the communications device might be configured to detect. Such leakages can be by acoustic, mechanical, electrical, electronic, RF, light, and even gravity channels.

Which means that even with a pencil and paper secure device the noise from the pencil on the pad, the operator muttering under their breath, or their finger tracing across a lookup table will leak some information. Likewise the table or writing board across the operators knees can couple not just the mechanical equivalent of the acoustic channels, it can additionaly send “tip and tilt” or other movment into the gravity sensors in the communications device. But there is often a pair of cameras in modern “smart devices” that get used for communications. Even if it cannot see the paper you are writing on it could ses hand movment or reflections and shadows arising from hand movment.

Thus you have to consider “energy gapping” where you do not allow any kind of energy to form.a channel between the communications device and the secure device.

Thus for pencil and paper, writing down the cipher text from the communications display is OK. But you should then take the piece of paper into another room to the communications device and shut the doors befor doing the decrypt. Likewise for the encrypt you do it in a seperate room and only bring the ciphertext into the room with the communications device in it.

It sounds not just laborious, but easy to get wrong, and it is in both cases. It’s why I also say that Operational Security (OpSec) is hard to not just get right but to always get right.

If you break the rules even once then you can open a crack in your security that a patient and capable adversary will exploit to their best advantage, not yours. Which is why you need to practice other forms of OpSec such as “duress codes” and much more besides.

Nobody who knows anything about security has ever said that it is easy, which is why adverts for “secure apps” and “secure devices” are mostly “Snake Oil”.

[1] The “secure device” could be as simple as a secure pencil and paper cipher system such as the One Time Pad through to a bespoke MIL/DIP encryption system that has a keypad and display and secure “Crypto Ignition Keys”. The important point is that it should be “secure” to the level “deemed necessary” for the use to which it is to be put.