Clive Robinson • September 21, 2019 7:48 AM

@ Wesley Parish,

Supply chain actors agree that everyone’s a security risk – except themselves, of course

They are right, at the end of the day we hope others will not betray our trust now or in the future. But as we know with “short term thinking” fourty pieces of silver looks good today…

If we don’t trust we have no economy or science and engineering, thus early and painfull deaths for us all. So not trusting is not an option.

The only way to stop betrayal is to make the consequrnces so drastic that nobody will do it.

As we know setting up a system with those sorts of consequences causes others to behave in a way that is betrayal (NSA, CIA, etc etc etc).

That in turn can so offend others morality that they will despite the consequences make public those dirty little secrets the agencies hoped to keep hidden that have hurt us all.

It appears what ever we have tried betrayal or breach of trust is a certainty when there is reason for it to happen.

It’s why some argue transparancy is the only option. But a hundred thousand years or more of supposed “survival of the fittest” has taught us keeping secrets is the real way to survive. So much so it’s built into our “monkey brains” in a very fundemental way.

Clive Robinson • September 21, 2019 9:24 AM

@ JF,

There are three underlying economic factors as to why this is happening, that are important but rarely make it into security analysis…

In the article you will see,

rhodium and palladium, with gangs stripping the parts and selling them overseas. Rhodium is trading at double its price at the start of the year and more than eight times its 2016 value.

These the first problem is the excessive rise in fiscal value.

Thihs brings up the second problem of single supply. These are “Rare Earth Metals” which are generally only available from China for quite a number of reasons. Thus China tightening control on them for their own economic benifit has created shortages which have been worsened by US trade policy that in effect demands only the US treasury benifit[1].

Thirdly the lack of replacment parts is happening in the UK due to an economic balance adjusting deadline (Brexit) where there are now artificial shortages due to the imposed excessive conomic uncertainty[2].

Having got those out of the way it brings us onto the part technology plays, which is barely mentioned in the article and comes from within a Police Tweet,

… was taken by relay attack.

Which brings us on to the way the crimes are fascilitated in being committed by RF techbology. Which is what you highlight in your comment of,

A kind of man-in-the-middle attack on car locks has gone big in the UK

The “RF Relay” method used in that attack has actually been known for over a decade, and the ideas behind it were first used during WWII. But for most of that decade or so economics was still in play as it was nowhere near being the “lowest hanging fruit”. This fourth economic factor is also generaly missed in security analyses…

However changes in technology have had two significantly further effects.

Firstly it’s very much reduced the cost and very much eased the ability to mount such attacks due to SoC’s for the likes of IoT, digital TV and radio, and childrens toys etc[3] becoming not just very inexpensive –tens of cents– but eaily and effectivelt anonymously available.

Secondly whilst the vehical manufacturers –like the hospitality industry– care way more about consumer convenience than security of their products because “conveniance” sells whilst “security” does not, have as a result made such crimes very more convenient.

So with the six causal effects I’ve mentioned we have in practice a “100year storm” effect, and consumers are left with a great deal of inconvenience…

All of which will, we hope, cause vehical manufactures to re think things so that this attack nolonger works.

That said however finding “distance limiting technology” that actually works at very low cost is kind of one of those “Holy Grail” quests currently. And it has been for around a quater of a century with no real end in sight yet.

Whilst their are “cross field” and “MIMO” systems that will do the range limiting they are very far from inexpensive, but also they are not sufficiently reliable to be convenient… This may well change quite quickly in a similar way to the integration of signalling that alowed DSL techbology to develop to the point it still make short runs of copper pair POTS land lines viable effectively decimating analog modems after they had been through a similar technological spurt.

[1] It’s a similar issue to that of oil and OPEC. The diference being the US and other nations Treasuries doubly exploit to their benifit. That is they tax the consumer heavily making the pump price excessively high using the broken idea that price will drive down demand (it does not). They also know that their outgoing petro dollars flow back in via export of the likes of high tech the OPEC nations can not manufacture. Thus the likes of the arms trade not only brings the petro dollars back it cross subsidies the cost of their own weapons procurement. Which is why they put up with OPEC but are railing against China as exports to China don’t realy cross subsidise things that certain interests require.

[2] That is UK suppliers are trying to import as much stock as they can prior to the expected Brexit at the end of october, and as normal they are trying to do it on credit. Overseas suppliers think the UK economy will tank after Brexit thus the GBP will significantly devalue. Some believe it will devalue against any potential profit, so they are holding back on supply which means according to basic economic theory the price should go up significantly, but due to “tied pricing” it won’t for a year or so.

[3] If you think about a baby monitor it is actually just a relay for digital audio through an RF link. It takes only a few seconds of thought to realise you can turn them around to make an RF detector with digital output that can then be sent to the other unit to be retransmitted on an entirely different radio frequency. With two such units you have you radio or RF relay for a very small amount of outlay and a little bit of specialised effort and a fair amount of specialised knowledge. It’not just baby monitors that you can use, those devices that relay your IR TV remote control into another room can be made into such a relay. But if you realy know what you are doing you can take a satellite TV Low Noise Block (LNB) and by turning the two devices in it around make an receiving X-Band to low UHF band transverter into a low UHF band to X-Band transmitting transvert thus make an easy “Microwave Link” that will go several Km line of sight. If you want to go further you can fairly easily get an X-Band doplar radar unit that are used in traffic lights and the like. These are easy to convert to an X-Band transmitter which when used with the satellite TV dish, LNB and UHF receiver will make either an audio or digital link good for 30Km or more line of sight. And if you replace the low power Gunn Diode in the doplar radar with a high power one you can get atleast a 100Km (which I’ve done in the past).

Clive Robinson • September 22, 2019 10:13 AM

@ Patriot

And the perpetrators had such excellent operations security that the U.S. cannot put its finger on who did it.

You are trying to draw a conclusion of “excellent operations security” on your assumption of “U.S. cannot put its finger on who did it”.

Even if it might be true your assumption does not support your conclusion.

The fact that drugs and people get smuggled on a daily basis across the Mexico-U.S. border should make you wary of making such statments of “excellent operations security” unless you wish to extend it to simple immigrants on foot?

Similar comment can be made about the much more heavily fortified Israely borders which also use U.S. technology amongst others. But still get breached regularly if the statments of the IDF and Israli Government are to be believed.

You also need to rule out the distinct possability that the U.S. looked the other way or similar for a number of reasons.

This is the part that really should get everyone’s attention.

The fact that the U.S. Might not have identified with any certainty who might have been behind the reported incident does not in the least supprise me. There is after all a reason for the oft touted phrase “the fog of war”. Also as has been known for atleast eight decades or more, small groups of combatants highly trained or otherwise can cause major damage and significant impact entirely disproportionate to their numbers in and behind active war zones.

There are also the deliberate machinations of other nations to consider as well. After all for a large part of your life time the U.S. and the old Soviet block either started or supplied much smaller nations to have proxie wars, so as not to give rise to a nuclear war.

It’s a matter of historic record that prior to the Soviet block getting effective nuclear deterant U.S. Military leaders did ask for and had every intention of using nuclear weapons against a nation where they had already killed something like a third of it’s civilian population with conventional and unconventional munitions and chrmical agents, and despite that were still loosing. What stopped the use of nuclear weapons was U.S. politicians, but what finally brought the U.S. and it’s alies to a halt and uneasy cease fire was that another Communist nation that had had the war dumped in their lap pointed out the logic behind why the U.S. could not win.

As for those who carried out the reported attack on the petrochemical fascilities and infrastructure you ask the question,

If they can do that, then what else can they do?

I assume that is to create a sense of the dramatic. Becaude you have already noted that those behind the reported attack have not been publicly identified, nor have you indicated any reason why anyone reading your comment should have any more information than the little you have presented. Thus why else would you ask a question that logically you know they can not answer?

You then go on with,

whoever did it learned a lot from Mr. Snowden, and that is a fact ladies and gentlemen.

No that at best is your conjecture or presupposition, and it is not in any way supported by the preceding part of your comment or any other verifiable source as far as I am aware.

To make such a comment be a “fact” you would have to supply quite a lot of supporting evidence you have indicated is not available. Further it would have to be supporting evidence that could be tested thus verified not assertions or assumptions. And I suspect that is something neither you nor anyone outside of the attackers can do, otherwise you or others would have done so by now.

Whilst making limited suppositions can under certain circumstances be a valid part of trying to assess a situation with limited resources. To present one or more suppositions as fact or even a hypothesis is not valid. It’s why we have the expression “spinning castles in the air”.

The fact the US has effectively done this a number of times and either failed to present evidence or have had to recant does not excuse others from making the same mistake.

For quite some time now I’ve made the point here and in other places that “attribution is hard”, I’ve even given reasons as to why that is so for Cyber-Attacks, including why such intelligence would not be admissable in court as evidence. But without going through it all again, put simply, gathering what might be called evidence is at best extreamly difficult using ElInt and SigInt methods in network only environments. What is actually needed is HumInt of various forms of reliability preferably “triply independently verified sources” which are considered about the best you can expect. However much less reliable HumInt such as real world surveillance footage is still considered usefull as it alowes other verification. Both the Israeli and Dutch SigInt organisations had developed ways to get some approximation to HumInt without “putting boots on the ground” that is “surveilance across the wire” to the cameras and microphones inside consumer computers apparently in use during attacks. We know of this because U.S. leaders for what are basically political reasons made it public and in effect “burned” those methods entirely.

The fact that the U.S. has a recent history of burning allied nations “methods and sources” has not just raised eyebrows, to some it’s been of more use than the partial Ed Snowden revelations that had come via Mr Greenwald. Who arguably might have stopped because of what most have seen done by the U.S. not just to Ed Snowden but Ms Manning and a fellow electronic journalist and non U.S. citizen Julian Asange).

Clive Robinson • September 22, 2019 10:36 AM

@ MarkH,

Maybe they’ll catch up to Crown Sterling …

+1 🙂

As for believing it when you see it, personally I don’t think I’ll live that long[1]…

But the trouble with bleeding edge inovation is sometimes a tiny piece drops into place in a very timely fashion and we get one of those “Quantum Changes” or “existential threats” that some journalists like to breathlessly wax lyrical about…

[1] But you never know medical science might surprise me. I think that more likely though 😉

Clive Robinson • September 22, 2019 11:28 PM

@ SpaceLifeForm,

Yes there is something odd there. Not sure why I’ve given up trying to understand the workings of some of the minds over there.

@ All,

For those that want more info on Cryptovirology and keleptography you could try looking at Adam Young and Moti Yung’s website on the subject,

https://www.cryptovirology.com

Clive Robinson • October 2, 2019 5:15 PM

@ tds,

…and poking around Clive’s link above I found,

It’s a long read but towards the end there is this paragraph from Moti Yung,

There’s something about threats: always look for new possibilities of attacks. It’s very easy to come after the attack and say: “Ah, there was an attack.” The idea is to predict attacks 10 years before they occur and respond to them before they occur; not just be reactive. 0-day attacks – be ready for them if you can, if somebody told you. In everything around us: system, Internet and so on – attackers are getting more sophisticated, we need to be proactive.

Which fairly nicely reflects my thoughts for the better part of the past four decades.

Although some of us here have raised the subject on this blog many times in the past, and have had some discussions few others were even remotely interested in predicting future directions that attackers might take…

On another security blog from academics, they did not seem to be able to follow the simple logic of moneterizing “fire and forget” malware like ransomware… In fact many experts in the domain used to take the “If you mention the devil’s name he’s sure to appear” attitude to vulnerabilities, and in some cases will later blaim you when someone does get around to doing what you predicted what might happen….

The two things that got me quite annoyed in this respect were,

1, Lenovo abusing a BIOS mechanism from the 1970’s that Microsoft and other Commercial OS vendors actively support. Thus Lenovo was selling consumer computers with built in malware that could not be removed by normal computer techs and most security experts. Having designed IO cards for Apple ][ computers that originated the design flaw, that then ended up being duplicated by IBM for the PC-bus and AT-Bus that I also designed IO cards for, I was only to aware of just how big a hole this BIOS cludge was in security.

Likewise BadBIOS and high frequency sound both myself and @RobertT accurately described what was a likely mechanism in quite some depth on this blog. We could do this because back in the 1980’s before Ethernet was “cost viable” for most people we had both done professional development of low bandwidth data networking with near ultrasonic sound.

Just about everybody was saying BadBIOS was all impossible, for all sorts of quite irrelevant reasons. So I dug out some old IO cards I had lying around hacked some code together (also using the BIOS hole Lenovo used) to prove it could be done over a few hours in the weekend…

Well it was shortly after “impossible” had been debunked, accademic researches started doing their own follow up experiments and then publishing them… It was shortly after that, that the marketing malware developers realised the was great potential on near ultrasound…

So all stuff from the late 1970’s to do with building software drivers for IO cards that got put on a ROM on the IO card. That as the driver had to work not just at “boot time” but also carry on working during and after the OS was loaded. Which was an obvious and major security issue was still being a vulnerability in the second decade of this century nearly four decades later…

Oh and if you have the appropriate books on the PC BIOS from the 1980’s and 1990’s you will find there are still some other nice BIOS vulnerabilities still there waiting to be used for malware or the like…

It appears a major failing of the commercial computer security industry is “5years to amnesia”… That is it takes the industry about 5years minimum before it forgets something that is a major vulnerability, and stays so untill somebody makes a big noise over exploiting it two to four decades later…

As many have said before,

Go figer that out…