Schneier on Security

Clive Robinson • June 13, 2020 8:37 AM

@ David Rudling,

Article from Wired about an apparently fairly simple twist on a basically old technique.

From the article,

“Researchers from Israeli’s Ben-Gurion University of the Negev and the Weizmann Institute of Science”

It’s the usual suspects for “reboiling cabbage” 😉

As for how old the idea is…

Basically what is happening is that sound is getting superimposed onto a light source by some cross modulation method. Think about an Aldis Lamp or heliograph[1]for sending morse code between military units and ships at sea, which is good for upto 15 nautical miles (~27km or 17miles) at sea and further from hill tops on land.

Or if you want to go even further back waving of tourches several millennia ago that gave rise to what many call a Polybius square[2].

Any way as for the telescope for picking up light, if you have a look on the UK Cambridge Compuyer Labs Lightbluetouchpaper.org web site you will find that quite some time ago they used that and a photomultiplier to read the changes of light intensiry off of a wall caused by the “flying spot” of a Cathode Ray Tube (CRT) computer screen as a modified type of Van Eck Phreeking.

So most of the idea is “borrowed” as normall for this group of researchers from others.

As for the “novel” part if you can call it that. From the article they talk about “hanging lamps” without mentioning shades or reflectors, but go on to say,

“LED bulbs also offer a signal-to-noise ratio that’s about 6.3 times that of an incandescent bulb and 70 times a fluorescent one.”

This suggests that it’s not the vibration of the glass, but the vibration of the light source such as the filament, and thus it’s actually the entire bulb moving. Which brings into the consideration the mass of the bulb. Because as with a pendulum the mass on the end of the link from the pivot effects the frequency response especially anything near resonance or a multiple where the swinging will in effect increasingly store energy…

Anyway, yes it’s new in “academic papers” but actually it’s just a variation on Optical TEMPEST techniques, which is a small subset of passive EmSec techniques going back to the 1980’s or earlier one way or another.

It’s reasonably certain that GCHQ and the NSA were aware of it at least as far back as the 1980’s from the release of “redacted documents” under FOI etc. Most things were not redacted thus confirming what was well known at the time about electrical energy. However there was not mention of items relating to “mechanical vibration” conduction and radiation such as acoustics and seismology and their spin offs. Thus we might find out that those redacted areas were about various forms of mechanical energy.

However if nothing else this paper reinforces the point I make about “energy gaps” rather than “air gaps” because this is most definitely an “air gap” crossing technique that transports information impressed on mechanical vibrations over a considerable “air gap” and very probably works around corners and even from down corridors.

[1] http://www.telegraph-office.com/pages/Black-Watch-Signal-Unit.html

[2] The Polybius square is actually a simple device that was invented by “Cleoxenus and Democleitus” who were a couple of Ancient Greeks for military signalling. As with other ciphers (playfair) the name that became attached to it was the name of the person who publicized it not who invented it. In this case the famous Ancient Greek scholar Polybius.

Clive Robinson • June 15, 2020 4:09 PM

@ JG4, MarkH,

I’d love to have the energy that I did 30 years ago.

I guess that might change when you understand the potential price…

Put simply your genetics have “counters” that alow cells to reproduce a certain number of times then they stop and some time after that your body is heading for the “K-Wave” that kills off the rest of your body.

So the blood transfusion you get from that supposadly healthy teenager actually gives you a marginal increase in life for what is probably a significant reduction in the healthy teens life expectancy…

This “Vampire treatment” is actually being carried out currently and I’ve had a posting or two with @MarkH about it.

In essence if you are a COVID survivor your “white blood serum” contains IgI and IgM antibodies to the COVID-19 antigen SARS-CoV-2. Which means that injecting someone elses tissue typed serum into you when you are actively sick with a SARS-CoV-2 infection will improve your chances of survival. If the antibodies can be synthesized in a bio-reactor etc, then a short term vacine could result for those most in need.

But… People are talking about “COVID Passports” that is those who have had the disease are in theory not going to get it again (for a while). Because their body is producing anti-bodies, the only way to certify someone for the passport is to check that they have the antibodies in their blood serum.

All well and good untill you realise that the injection of someones serum with the antibodies will cause a positive on the test.

I suspect if such passports become a reality some people who have not had COVID-19 will pay good money for an injection of antibodies so they can get a passport to go back to work.

So such “Vampire treatment” will become quite profitable and thus appear on the black market. Where like the “back street abortions” of old little real medical input will happen and thus people will almost certainly die…

Clive Robinson • June 16, 2020 2:25 PM

@ Trudi Fenster-Klotz, SpaceLifeForm, MarkH,

A randomized controlled trial supports a readily available treatment for COVID-19

The drug “Dexamethasone” is a steroid which is generaly considered unwise to give to people with sever infection because like most antipyretics they bring temprature down by reducing the effectiveness of the immune system.

What this drug is most likely doing is interfereing with the “cytokine storm” that the most severe cases of COVID-19 get.

Thus it would be either harmful or of no use to those who have not got a prevelance to cytokine storms (ie the majority). What is needed is to test those who have had success with Dexamethasone for the genetic markers that indicate a susceptability for cytokine storms, to look for correlation that might be used as a predictor thus alow the drug to be targeted.

Clive Robinson • June 18, 2020 12:50 PM

@ name.withheld…, JonKnowsNothing,

Other should be aware that infiltration was a big component of the counter-protest efforts lead by LEA’s.

This is as finally came out the UK’s Metropolitan Police’s method, unfortunatly the level of control over the infiltrators was to be blunt lax, thus several needless criminal offences got “covered up” as “Not in the public interest” as well as a whole bunch of civil offences including fathering children and not paying the maintainence they were legaly required to do. The latter was what crow barred the lid of the very nasty can of worms it had become.

It is almost without doubt safe to say that the UK’s Metropolitan Police under it’s current commander Ms Dick[1] is still using infiltration and infiltrators of various types. Because even though they have turned out to be a liability on a number of occasions, they add “intrigue” which people such as not the brightest of politicians love.

So expect more disasters and more cover ups followed by more exposes as time goes by.

From experience I know that the best method of infiltration is to use highly experienced “contractors” who not only provide arms length deniability but as they are not “tied to the pay role” or other tracable renumeration system are easier to conceal. They also tend to be a whole lot brighter than those “from the regular ranks” and certainly more OpSec aware as they are effectively NOC[2]. They also tend to bring some highly specialised skills with them.

[1] Dame Cressida Rose Dick DBE QPM, first came to public attention a decade and a half ago –and got mentioned even on this blog at the time– as “Gold Commander” of the unlawfull fatal shooting of Brazilian Electrician Jean Charles de Menezes on a London Underground train, by a bunch of police officers who were just not upto the surveillance job and were far to gun happy to get “first blooded”.

https://en.m.wikipedia.org/wiki/Cressida_Dick

[2] NOC stands for “No Official Cover” and is a term borrowed from the actual Intelligence Services. In essence it means you have no legality, support or backup. Also it’s often upto the contractor to “build a legend”[3] or supportable history that will pass more than a cursory examination.

[3] Due to the Internet it’s becoming harder and harder to “build a legend” that will stand up to even minor examination. So much so it can be nearly a full time job and it’s all to easy to make mistakes. This is not getting any easier with the likes of Google getting at childrens school work and communications from a very early age. I’m of a generation where it’s still plausable not to have a multitude of “Social Networking” accounts and similar, however if you are under 40 and don’t have a significant presence then suspicion is raised even with low wage border guards.

Clive Robinson • June 19, 2020 3:42 AM

@ Wesley Parish,

With regards,

“Chrome extensions are ‘the new rootkit'”

Not exactly unexpected, what feels like forever ago I had a chat on this blog with @Nick P about “Chrome” when it first saw the light of day.

Back then I pointed out that it was atleast taking security more seriously than all the other browsers –at the time– did, especially Microsoft IE (which was trying to make IE the desktop at the time).

The problem I’d noted was that “the App was replacing the OS” and doing it badly very badly. In essence people were “working in the browser” and having multiple windows –tabs these days– open to different services, much as an earlier generation would have multiple terminals open. However where as the OS had strong issolation between the terminals because they ran as seperate processes in their own process spaces, the browsers rather than use this strong segregation idea just shoved everything in one process space with at the very best very weak segregation… I pointed out not only did the browser have access to everything but that individual windows would have access to other windows memory and communications, thus a malicious site would be able to see other sites through the browser, which would cause new types of malware to be produced, which @Nick P gave an example of what advantage doing so might give. Any way with a little time such attacks and malware did indeed happened and has now become quite common.

Some time later I also pointed out that this bad browser design and the increasing use of browsers to work through had significant impact on users in a less obvious –to the developers– way. Because each user has multiple often segregated roles in life, where as browsers written by software developers who had to little social contact wrote browsers such that having segregated roles was near impossible. After all even though they might relate via a purchase, you as a customer of a merchant is a different role to you as an account holder at a bank role. Which for obvious reasons you would want to have the merchant and bank issolated as much as possible especially as you would have next to zero trust in a merchant.

These security issues are still present in most browsers so it’s easier to get access via the incredibly poor browser security design than it is through the OS which used to have better security design (this unfortunately is changing as commercial OS’s not only get less secure, they also steal private information via “Telemetry” and much more.

With regards,

For some strange reason I’ve never felt secure with the thought of overloading my browser with extensions.

That’s a viewpoint I can understand as my above indicates browser security is not good, and OS security less so daily, thus any extention on a browser will almost by default get the same access as the browser which in some commercial OS’s is not just high but effectively beyond the users control (smart devices, IoT devices etc).

It’s the same logic that makes me have both cookies and javascript off in browsers… Something I used to regularly get told was “not good for the browsing experience” or some other tosh[1], even though people were obviously getting attacked via their use of them. I guess that’s why a decade later I’m hearing less people telling me in effect ‘I’m Paranoid'[2] for having them turned off even though there is now an advantage in doing so[1].

Which brings us to the important point,

Not when I know I can do the work without them anyway.

Whilst you, I, and several others can do this, we are not encoraged to do so in oh so many ways. Thus the majority of people are being “led by the nose” into a world where they have no control, not even the choice of not participating. You can see this happening in education where institutional email servers etc are being replaced by the likes of Googles online services that are “data mined” not just for use today in advertising, but use tommorow against the individual in oh so many ways we can not even think of them all.

[1] The funny thing is having both cookies and javascript off rarely effects the actual viewing experience, and can in many cases give you a faster less fussy experience. Because it tends to get you around “Web Developers” limited thinking thus you don’t get adds or popups that tell you you have to click on ‘TOS accept’ etc.

[2] Not quite true, I get it curently because I won’t use “Secure Messaging Apps” on my phone[3]. For what is basically the same problems with browser security, that is it is to easy for an attacker to do an “endrun attack” around the security of the applications and users get “gulled” into a false sense of security. I guess in this comming decade people will call me paranoid for not doing some other new silly security fad that actually gives little security what so ever[4].

[3] It’s not just apps, I’ve had it as well over the fact I don’t do “social networking” via Vampire Corps etc, nor do I have personal email and the fact I insist on 7bit ASCII and no attachments for other communications.

[4] I just wish people would realise that having the “Human Computer Interface” (HCI/UI) on the same device as the “Communications End Point” (CEP) is a built in security failure. Because it puts the “Security End Point” (SEP) which is in the application in a position where an attacker can perform an “End Run Attack” around it either at the OS level or if the app is a browser extension then in the browser. Further that both OS and Browser security is being deliberatly weakened as time goes on under preasure from third party interests, be they commercial data aggregators or Governmental Guard labour entities such as the many various, military, security, law enforcment, and intelligence agencies.