Schneier on Security

Clive Robinson • November 22, 2019 11:47 PM

@ Sherman Jay,

At times, all these assaults on all of us makes me want to line my hat with foil and move to a fully isolated off-grid cabin with a well, a big garden greenhouse, photovoltaic panels and batteries. AAAAUUUUGGGHHH!

You are not the first to feel that way, and you almost certainly won’t be the last.

Some believe rightly or wrongly that we are on the edge of the colapse of society as we currently know it. Thus if a person felt that way it would not be surprising if they started taking measures to mitigate the effect such a colapse will have on them.

The peoblem is, there are very distinct security issues involved, thus the saying,

No man is an island.

That is you can never ever be truly independent of the world around you. There are many things that are hard for one person but much easier for two or more. Look up things like a Mennonite or Amish community “barn raising” to see what all of our ancestors did in one way or another. The only way mankind can progress is by utilising spare capacity, many think the Egyption Pyramids were raised by slave labour, well more modern historians think not. The reason was due to the nature of the Nile delta and it’s seasons much of the Egyptian work force had time on it’s hands for part of the year. Thus Pyramid building much like the later building of Christian Churches and their contents was a way for people to be “employed and out of trouble” along with fulfilling a basic human need to be part of something greater than themselves. It also importantly alowed for people to specialize in one “craft or trade” thus advance that domain. In time they would form master and apprentice relationships to pass along those skills. This specializing became more obvious with population density, which alowed groups of likeminded specialists to form Guilds that set standards and formalized both education and regulation as part of “reputation”.

There is the proverb of,

It takes a village to raise a child

In essence this captures the purpose of community to be not just greater than any individual but for otherwise disparate people to gain an identity and common outlook to form a society where there is mutual trust and mores, and importantly spare capacity in labour.

Many of those currently seeking to prepare for societal colapse don’t appear to be cognizant of this, thus unless they learn it their future should there be a colapse will most probably be unpleasant, brutish, painfull, and short lived.

As you may have heard there is a current national security scare going on in China. Two people came to the densely populated Beijing and having become noticably very ill were diagnosed in hospital with “The Plague”. Unlike the “black death” of medieval times that decimated Europe and brought about significant social change. What has presented is not Bubonic Plague but it’s rather more infectious Pneumonic plague,

https://www.theguardian.com/world/2019/nov/13/two-people-diagnosed-with-pneumonic-plague-in-china

With modern medicine from a complex society pneumonic plague is more of a nuisance than an existential threat as it is fairly easily treated with modern antibiotics if diagnosed early. Thus the problem is the initial diagnosis as many respiratory illness present in very similar ways.

However as Madagascar found a couple of years ago, if not caught early it can get out of hand quickly,

https://www.nytimes.com/2017/10/06/health/madagascar-plague.html

But importantly Madagascar has a known problem hiding away, which is an “Anti-biotic resistant Y-Pestis strain” that can be easily spread by aerosol from coughs and sneezes or by simple contact.

Thus like Avian Bird Flu virus, the mutation of the Y-Pestis bacteria is seen as the potential start point of a pandemic that could spread the way the 1918 flu did which killed many millions of people.

Small societies do not have the spare capacity of labour to create modern medicines thus as with the bubonic plagues of the medieval and later times 60-100% of such a population will die from what is in most cases a treatable illness.

Thus there is a basic conflict, as the size of a society grows, a certain point is reached and a pandemic occuress and the society gets either wiped out or critically changed. As various studies have shown the society size is ~40,000. The only places larger population sizes occured were Japan and The UK, the reason for this we now know was that tea drinking was prevalent if not the norm there and it has certain antimicrobial properties.

Clive Robinson • November 23, 2019 8:04 AM

@ Ismar,

Baron-Cohen attacks Facebook’s policy on political advertising with Hitler comparison

Always always use the full name or first name as Sacha has several siblings and cousins who are equally as famous for other reasons. One is his elder brother Simon,

https://en.wikipedia.org/wiki/Simon_Baron-Cohen

Clive Robinson • November 23, 2019 12:35 PM

@ Michael, ALL,

Signal users in China have a side-channel app installed 70% of the time, and Western journalists recruiting sources aren’t being clear about the risk.

The side-channel app concerned is an IME or “Input Method Editor” or software keyboard, that has an online spell checker or equivalent which is the side-channel that leaks the key strokes.

Software keyboards especially those with built in spell checkers are a known “End Run Attack Vector”. That is some actually talk not to a spell check file on your device, but as with “Google’s search input box with javascript enabled” it uses an online spell checker that can be used to “finger print” you via not just any spelling mistakes you make but also your typing cadence/tempo as well as specific key to key timings.

As it works on the “User Interface” side of the Signal app it matters not a jot how secure Signal is or is not or what fancy tricks it might use. I mentioned this issue with smart device keyboards with spell checkers on this blog quite a while ago as an idea. I then did some prototyping to confirm that the idea was valid (and it is).

Also because of the way it works anyone on the Internet who is at an upstream node of you can also see these spell check packets. Without the need of having to MITM attack your comms channel, or be on the server in some way. That is purely passive monitoring as in “collect it all” is more than sufficient. That is even though encryption is used the result is due to the timings effectively a “Simple substitution cipher”…

To be honest I’ve been waiting for graduate students to “pick up on this” and see how long it was before they experimented and an academic paper appeared out of the likes of the UK Cambridge labs or the Technion-Israel Institute of Technology and Tel Aviv University. Unless I’ve missed it, it’s not yet happened…

That said I’ve been waving a red flag about this danger with end run attacks and ALL secure messaging apps for longer than Signal has been around. I’ve also indicated how you solve the problem (move the secure end points beyond the communications end points).

But as per usuall people get “Fanboi techno-junkie goggle-eyes that blinker their security vision”. So badly they do not want to see their security is actually “non-existant”. Which whilst it is tough for them it is much much worse for people who mistake the Fanboi “gushing nonsense” as valid security advice, which fairly obviously it is not. The result is I would be fairly sure is the Fanboi nonsense has been responsible for the deaths of people in represive and vindictive regimes…

Ad I keep pointing out,

If your communications end point is beyond your security end point you don’t have any security and are subject to easy end run attacks.

So peoples “Get wise or die” in lifes jungle, it’s called evolution or “survival of the fittest”, and Fanbois are a “prey species” fit only to be bitten upon savagely by those who hunt to kill, financially or for real.

Clive Robinson • November 24, 2019 6:23 PM

@ JG4,

With regards “crypto-currencies”,

First Duck and Cover!

Before I say… They are at best a “Tulip market” or more likely a “South Sea” style securities fraud, the nature of which has been predictable for something like three centuries,

https://www.library.hbs.edu/hc/ssb/crimeandlaw/fraudsecurities.html

But oddly perhaps is,

Pennsylvania To Spend $3M To Study Possible Link Between Fracking And Spike In Childhood Cancer

It might link indirectly with the China GPS “grop circles” story.

What theu both have in common is “silica”. That is with regards the China crop circles there is an assumption that it is the “Sand Mafia” and sand is a form of silica. But less well known and of considerable environmental and health concern is that many types of “Fracking” use a form of silica. The silica used has health warnings because if inhaled or injested it can cause problems due to the almost indestructable nature of the silica and the fact it is both hard and sharp (think microscopic shards of glass as an analogy).

Whilst it is known silica is involved with some biological processes scientists and doctors know next to nothing about what it’s effects are. This is due to the difficulty of running control trials as silica is one of the more abundant chemicals in our environment and it’s close to impossible to screen it out currently.

The other thing to note is Pennsylvania has a problem, it was a coal and uranium state. Two parts of the mining industry that have declined and thus created unemployment issues. Thus the state government has been looking at Fracking as a way to somewhat alleviate the economic depression. But…

https://www.desmogblog.com/2019/11/22/coal-pennsylvania-beaver-county-natural-gas-shell-plastics

We need to think carefully what our priorities are with regards economic security, shutting a CO2 belching Coal Fired power plant for a gas to plastic feed stock plant that belches out three times as much CO2 is not just bad environmentaly it’s also shortsighted. Because that CO2 does damage not just to the environment but people as well, and at some point that damage will need to be sorted out and that could be extreamly costly in quite a number of ways, probably more so than the plastic feedstock plant will ever bring to the area.

Clive Robinson • November 25, 2019 3:30 PM

@ vpt, SpaceLifeForm,

From the article,

Initially, we located the Linux instance in a Romanian-hosted server. Unfortunately, we do not have further insights regarding the delivery vector used to deploy the Linux variant.

Which is becoming more the case day by day. Which is why I,

1, Have my private neywork “energy gapped”.

2, Have both cookies and javascript turned off in the browsers I do use.

3, Do not put any PII or financial information or other “private” information on any machine that can be connected directly or indirectly to a communications system (even bluetooth, NFC, ZigBee, and the like).

@ ALL,

As some of the “usuall suspects” will confirm I’ve been saying this for several years, this is the absolute minimum you should consider if you want even a small modicum of privacy.

This sort of attack is just going to get worse with time not better, regardless of what commodity OS you use (Apple’s offerings included).

We already know that IoT devices are more often thsn not some form of Trojan Horse, as are many low end network devices such as home routers etc.

Many people now Grock “no glove no love” as an anology to using ICT systems, however most “ICT gloves” have more holes than a cheese grater.

Thus your only safe way with this game is as was said back in 83 “not to play”.

Whilst it used to sound like paranoia a decade or more ago, incrrasing numbers of people are realising, it’s just “sensible behaviour” these days.

For those that think they might be smarter than a cracker, you might be right, but how about the tens of thousands of crackers world wide? The short answer is “no way” the numbers are against you.

Clive Robinson • November 26, 2019 6:29 AM

@ Anders,

How do you do banking without PII & being online?

Well in London there are sufficient bank branches that you can still go to a counter and talk to a real person during working hours.

The question of PII can be side steped in a number of ways. Under EU law you will see the expression “Any person legal or natural” you as an individual come under “natural” any company, partnership or trust including “Limited Liability Partnerships” (LLPs) and “bearer bond companies” and a few others come under “legal”.

These “legal” entities are assumed to be managed by other “persons” and at the distant end of the owbership chain a “natural” person with a “directing mind” will be found. Such chains/nets at the leaf ends are often called “shell companies”. As with all technologies their use is “agnostic” that is they can be good or bad. Further the anonymity they can convey is not “criminal” though many would like to tell you it is especially the IRS etc. One “good use” is to prevent “harassment of owners”, this came to a head in the UK some years ago with some “animal rights activists” harassing and terrorising people legaly going about their jobs simoly working at companies (see Huntigdon Life Sciences, that led to changes in law with regards access to company information and personnel details kept on public registers).

Clive Robinson • November 26, 2019 2:11 PM

@ Anders,

OK, but what’s the price difference between making transfer via real teller and making the same transfer via internet banking?

To be honest I don’t know, I personally try not to make transfers by the bank and the last one I made had no fee attached.

I try to be a strictly “cash only” shopper on the principle of “if you don’t use it you loose it”

Thus you could say the cost I pay is not getting the likes of Amazon discounted pricing (but as the only time I tried to use Amazon they defrauded me, that was not a discount but a cost…).

But the real cost the majority of people in the UK make is not getting paid any kind of interest on the sums of money they pay into bank accounts. Even when interest is paid there is often some catch like you are not allowed to make withdrawals and the higher rate interest (slightly less than 2% rather than less than 0.01%) is only paid for a year. Then there were “Bank Charges” at ridiculously large rates (think 1000%) which caused even the UK Gov to be embarrassed and put some kind of cap on it.

But business banking in the UK is even more of a minefield and it’s not been unknown for certain well known banks to drive small companies into bankruptcy then asset strip them via their own “receivers / administrators” making very large unwarranted fees in the process.

Thus in the UK, banks appear to work on the “push them into debt then fine them untill dead” model.

Then there are “credit cards” and “loyalty cards” with their own hidden profit mechanisms, which you might not see directly, but via merchants putting up their prices to cover.

Clive Robinson • November 28, 2019 5:44 AM

@ JG4,

Sorry to hear about your head injury.

Thanks, it’s not been easy in various ways.

Sadly though these things are on the rise (stabing last night in Greenwich London where I lived for a while, apparent the attack was for no reason[1], at least the victim is alive).

I guess it’s a sign of the times and it does not bode well for all types of security the average citizen is interested in. All that gets put in place is at best “recording” (CCTV etc) not even reactive or proactive security.

Put simply as far as the purse string holders are concerned ignoring recordings, or reactively “hosing the blood down” whan it cannot be ignored is considerably cheaper than putting boots on the ground to make deterrent effective.

As long as the purse string holders and their loved ones are not effected they care not how many “workers, children or similar” get injured, maimed or killed.

Exactly the same attitude is seen in our industry ICTsec, after all, why spend money stopping other peoples details being stolen, theres no deterent being handed down to the “controling minds” so the ROI says “don’t bother” even minimally “externalising the risk”…

It’s why I pay cash where ever I can and I don’t fill in warranty cards and the like. As for “cashback” offers that’s just another way to commoditize people and not just reduced but destroy their privacy.

[1] http://news.met.police.uk/news/appeal-for-information-following-greenwich-stabbing-388415

Clive Robinson • November 28, 2019 5:35 PM

For those that feel the need for a more substantial and serious read I offer,

https://eprint.iacr.org/2019/1336.pdf

It’s authored by Neal Koblitz and Alfred Menezes, and is titled,

Critical Perspectives on Provable Security: Fifteen Years of “Another Look” Papers.

Although 47 pages long, 13 of those are the refrences and it’s an interesting read.