Schneier on Security

1&1~=Umm • February 22, 2019 3:22 PM

@tazer2000: John Doe:

“But I think if we take it a little further and ask what is a country?”

Perhaps it would be better to ask ‘What is between countries and what law applies?’.

Even where there are land borders between countries, historically due to “uncertainty” there is usually a “gap”. The classic movie trope of this was ‘German border posts’ where there was 30-50yards between the ‘gates’ for either country.

Oddly perhaps in general ‘Maritime Law’ tends to be in force or the guiding principle if there are no specific treaties. Because of this there is the landing rules. That is it is not sufficient for your vessel to be in a countries claimed waters to fall under their jurisdiction it remains under it’s ‘flag jurisdiction’ for most things whilst underway. In other words there has to be more, technically even mooring does not bring a vessel under a countries jurisdiction either thus a vessel can be hove to, anchored, or even adrift as long as it is ‘maned’ (otherwise salvage rules etc come into play, one reason for this was the use of ‘fire ships’ as weapons of war).

The same is true for aircraft in many respects where even landing on a runway does not bring them under a countries jurisdiction. It’s part of the reason why you have ‘airside and landside’ at an international airport similarly with ports that take international shipping.

You get to see such oddities when crew change vessels, whilst their feet are very much on a countries soil, in theory they are not in the country. This is important in certain countries where there is no right to bare arms or have in your possession certain types of firearm. It all gets a little complicated and there are several forms that have to be filled in and other rules. A general rule is all fire arms should either be locked up or parts of their firing mechanism should be locked up on board. This also includes things like flare guns, and all ammunition such as flares, rockets, fireworks and even smudge/smoke pots along with more conventional ammunition. Oddly though the rules on explosives tends to be laxer in many places…

How does a country decide how far it’s waters extend? Well a long time ago it was decided by the sensible definition of the range of a cannon shot. If you were outside that range then you were in effect in what we now call international waters, though Nelson did muck things up when he developed a reliable way for cannon shot to bounce/skip across the surface of the sea.

These days it’s much more of a political decision as can be seen with China and the South China Seas. Oh and in some places having passed through ‘immigration’ and having had your passport stamped etc does not actually mean that you have enteted the country. For convenience of both countries the immigration for country A can actually be in country B and the other way around… You see this with the likes of ferry ports and even tunnels and some airports.

But there are other points one being some countries claim rights they actually don’t have, and they get away with it because there is little or nothing you can do legaly to get redress… They literally are behaving like ‘pirates’ or ‘privateers’ which has other implications (like the rights pertaining to the use of leathal force to repell them).

Oh and mad as it sounds maritime law is also assumed to apply on the moon and all other rocks of any size in the solar system…

All because the process of legislation and treaties os oh so slow and can take many decades. It’s easier to just take an already agteed set of rules and say ‘These now apply here as well’.

1&1~=Umm • February 23, 2019 4:06 AM

@tazer2000:

“… many factors, most of which likely are complicated or at worst based on irrational notions?”

Complicated, dofficult to agree but generally not irrational at that point in history.

For instance one of the reasons for the size of “gaps” at border crossings is the length of vehicles… It sounds odd till you consider it means that a vehicle can not be in two countries at the same time. Then you realise at some point somebody tried to get an advantage by having a vehicle in two countries and you have the chance to research it’s history. So things get implemented for reasonable reasons at the time, thus become ‘accepted custom and practice’ eventually to the point that most people have forgotten or never been told the reason.

Obviously the comming of steam and thus trains crossing borders a couple of hundred years ago started to make things rather more complicated, because they had different gages or quickly became just to long to carry on making the gaps wider. Even today border crossings and trains are still causing problems[1].

But the history of the gaps also includes a safety factor. Many don’t realise it untill they think about it but woods and forests change size and shape, rivers move, even rocks crumble and we now know that continents move. Thus how do you decide where a border realy is in a way that will last for even a thousand years and might be ten thousand years the way humanity clings to ‘conventions of the past’.

Even with our own back yards we get very bitter sometimes violent neighbour disputes where one person takes an inch or two away from someone else by replacing a fence or wall. I leave it to others imaginations as to what could happen if one country stole an inch or two from another, as they say ‘Wars have been fought over lesser things’.

[1] To some extent all vehicles and vessels cause problems at borders especially when crossing them. Europe which has lots of old Sovereign States had a long history of trade disputes and protectionism, hence we have lots of quite deliberate technical differences. Not just obvious things like which side of the road you drive on effecting cars and busses but the less obvious ‘communications’ technologies such as signalling systems,

https://www.railway-technology.com/features/feature116419/

No doubt one of the fall outs of the current trade war between the US and China will be another failed attempt at protectionism by technical means at the border. The fracas over 5G is shaping up nicely along these lines. But like all previous attempts it’s doomed to fail fairly quickly for a whole variety of reasons, not least of which is technology evolves faster than legislation, because it is proactive, whilst legislation is often at best reactive.

1&1~=Umm • February 23, 2019 5:05 AM

@Rach El:

“In France we have a name for people like this”

Similar in other countries but often it’s not printable 😉

@Wo:

“I am concerned about Nakasone’s mention of the antivirus community when talking of forging partnerships in the private sector.”

You would be wise to be worried. There is growing evidence that there is already to much influance on AV companies by the ‘Cyber-agencies’ of various governments.

In fact it is likely that ‘cooperation’ has been ‘purchased’ one way or another, and when that has failed as we have seen more blunt edged methods are used.

When you consider just how invasive some AV company products can be on a system, you quickly realise they are all but malware in name.

So it is probably fair to conclude that no AV companies products can be trusted.

Which gives rise to a question of ‘How do we connect to the Internet safely?’ to which the answer is ‘we can not’.

As others have noted the option of ‘Get off the grid entirely’ is not one that many can take. However society has the notion of ‘Private and Public’ spaces and faces. Such a divide can be applied as a mitigation for computer usage, thus a computer for private activities and a computer for public activities. But that alone is insufficient, you also need to practice good seperation of private and public activities.

Thus you need to ask questions about your online activities. Such as ‘Do I have to do Online banking?’ well the answer is clearly no, just a decade or so ago nobody did. Likewise ‘Do I have to do Online shopping?’ again clearly not, but there are real advantages to being able to do so. Which in turn gives rise to the question of ‘How do I do it safely?’ to which the current answer is you can not do so without some difficulty. But if you put in the work you can, much to the annoyance of card issuers, banks and clearing houses who realy do not want you to do things safely, because that means extra cost to them, hence the difficulties they quite deliberatly put up.

You can find with a little initial effort that you can make changes to the way you do things, that will keep your private and public computing faces seperate. Just as the majority learn to do for social existance it’s initially hard then natural behaviour.

But there is a down side, which effects those who can not afford to effectively seperate their computing faces. It’s not just financial pressure but more frequently employment presssure and even that of social services. As has been seen with the US Revenue system their cost saving by effectively forcing people to go ‘OnLine’ to use their services has caused a massive rise in fraud. But are the US Revenue going to sort this out? Not realy they show little sign they are going to go back to safer ways, or do more than hand wave over the security failings of their OnLine systems.

1&1~=Umm • February 25, 2019 9:31 AM

@Wesley Parish:

“And we don’t know if the US had targeted North Korea before”

When you look at the accepted history of the US-v-NK you will find the US did attack NK with stuxnet it’s self. It was known at the time of the original stuxnet attack[1]. Back in 2015 the US finally admitted they had tried it and it had failed some years later,

https://www.theguardian.com/world/2015/may/29/us-stuxnet-cyber-attack-north-korea-failure

Both Iran and the apptly called ‘Hermit Kingdom’ of North Korea were developing not just the centrifuge technology independently but in a technology swap deal with each other. The US saw this as the only “route in” to the “Hermit Kingdom” right into the heart of the NK nuclear program. Where the US had no other real hope of getting, so they took it.

But importantly the US Intel on NK was apparently out of date by the time stuxnet was ready to be deployed. As NK had apparently moved on from a particular European manufactured Industrial Control System (ICS) and A.Q.Khan code, or their computer security was well above that of the US not just the Iranians. Which as stuxnet infections showed up around the Far East suggests either the US were also trying other routes or that stuxnet had somehow escaped in that area.

Thus shortly after stuxnet hit the news and became US MSM Prime Time, NK called the US for the weak hand it had played. NK very supprisingly called in the UN Inspectors to show them previously unknown halls of gleaming new centrifuges all working away, but would not let the UN inspectors anywhere near the control systems, as they knew how the US had got the malware into Iran (via UN inspectors thumb drives).

So yes without any doubt the US had cyber-attacked North Korea, and North Korea made it very clear to the US that they knew it, and importantly had repelled it. What is less clear is that this apparently goaded the US into a whole series of other attacks that went through China as well that likewise failed. This came back to haunt the CIA as Iran and China worked out the CIA supposadly covert agent communications system and used it against CIA ‘methods’ and more importantly ‘sources’ now presumed executed.

As for what North Korea may or may not have done in return by way of cyber-attack there is little that they could have done from their home soil. Because there were only two Internet paths into NK one of which was through China and it’s safe to assume not just China but the Five Eyes SigInt entities were all over these two paths. Whilst that largely kept the US out of NK it also acted like a bottle neck keeping NK based cyber security personnel activities in NK. Thus the argument that NK have 7000 personnel in NK directly attacking the West etc is a little unlikely[3].

It smacks of good old US ‘Cold War’ appropriations tactics of claiming the Soviet front line forces were immense compared to those of the West by counting all Soviet personnel as ‘front line’ whilst only counting a few of the Wests armed forces as ‘front line’. Brown University and the Naval War College in Newport, Rhode Island have an expert on the subject[2] from the Soviet perspective as the engineering trained Prof Dr Sergei Khrushchev’s father was the Soviet premier he took Sergei around as a technical advisor to much that was secret development and also intelligence related.

The US has been shown to make either unsubstantiated or probably suspect if not false claims in the more recent past. Which should have become clear to all when those US IC ‘False Flag’ tools got revealed.

Back in Ronald Reagan’s time and before when the US made a major diplomatic accusation it was backed by the evidence from the US IC entities also being shown. During the Obama terms accusations became common but they were not backed by evidence from the US ICs in any way. What we got was supposition from various supposadly independent computer security companies, that used each others suppositions untested to make further claims. Thus the whole claims were in effect a ‘card house’ with no reliable foundations at best. With a distinct probability the foundations were a compleate fabrication by use of the ‘false flag’ tools.

So we have little or no actuall evidence[4] that North Korea has done what the US and it’s MSM claims. But we have the US actually confirming some small part of the attacks it has made against North Korea… Which if you think about it is a very odd situation to be in, which is why I guess some people have difficulty coming to terms with it.

But your suggestion of,

“we know they’ll react if we poke them so we poke them to get a reaction so we can poke them again ”

Is actually not new, the US war hawks have been trying to provoke North Korea with live fire war games, permanent occupation by US troops and technology in South Korea and various other seamingly wild accusations (GPS take over of SK aircraft, attacking SK banking systems and much more). All since the Korean War Cease Fire getting on for seven decades ago. Oh and remember during the Korean War when the US were pushed back virtually into the sea the commander in the field demanded nukes for use against the northern forces…

[1] Much of this is actually given in some detail on this blog at the time of the stuxnet attack becoming public.

[2] https://en.m.wikipedia.org/wiki/Sergei_Khrushchev

[3] Whilst it is possible NK has cyber-attack agents tucked away in other countries it would actually be very few not even a hundred let alone 7000 due to the support issues involved. Also you would have expected defections. Such attack skills would be highly valuable thus such agents are assured not just of a warm welcome from Western IC agencies for defecting, they would also have good job prospects as well. We would have got to hear about any such defections that the US war hawks or politicians became aware of as they have proved they just can not stop their gums flapping in public and burning assets is no problem for them.

[4] Not that you would realy expect anything other than vaguely indicative information from a technical only ‘method’ as it’s so easy to fabricate. After all if you can break into a computer system to get evidence then anyone at or above your skill level can break in and plant that evidence, so it’s value is actually minimal. What you realy need is HumInt ‘sources’ or similar. Often this needs ‘boots on the ground’ but there are other ways if your targets security is lax. Due to the US Politicos flapping their gums we know that both the Dutch and Israeli SigInt agencies were using the lax security to get, key strokes, audio and video from the computers that were being used to carry out various suspect activities. The fact that the laxness that allowed this HumInt to be gathered is very easily avoided is now known to the world so the US has ‘burnt’ those methods. Which is also interesting because it suggests that the US SigInt agencies were not using them otherwise they would not alow them to be burned…