Schneier on Security

Clive Robinson • December 12, 2020 3:08 AM

@ SpaceLifeForm,

If I read this correctly,

“By luck, we discovered that (Zodiac) split it into three pieces and rearranged the message in a predictable diagonal pattern in the first two pieces.” “

It’s, firstly “Russian coupling” followed by secondly a “routing cipher”.

Which makes it sound simple which it is to encrypt, but even with computer assistance takes a long long time and can be quite daunting to perform cryptanalysis on unless the method is known.

You can make a cryptographers life a further missery by using a grille and nulls and make the routes cross over each other and do things like share vowels thus changing message statistics.

The reason you can do the latter steps is because these are “show piece ciphers” thus each encryption method can be unique to the message. So a cryptanalysist does not have “messages in depth” to provide method statistics over and above message content statistics for them to work on. You can also make such systems have two or more solutions thus alowing you to claim guilt or innocence as you chose or throw confusion into a situation.

So think of the message almost as a type of “hash” that the criminal can prove who they are but the investigators and their cryptographers can not reverse or do so easily.

[1] Russian Coupling is a “term of art” that appears to have gone out of fashion (as has Museum Search). It was a method first used to hide “message indicators” or other structure or common usage (think HH or Heil Hitler salutation in enigma messages). It was for some reason lost to history associated whith Russian “Nihilist” anti-tsarist movment from the late 19th century and it’s a quite simple process. In essence all you do is split a message into parts and swap them around in a prearanged order. Thus stylistic message parts move from the begining and end of the text into the middle. Such splitting can be done befor or after encipherment. In the case of hiding message indicators after message encipherment, but could be before or after “super encryption”. For what is a simple manual process it could throw up quite a road block to cryptanalysis.

Clive Robinson • December 13, 2020 9:22 AM

@ Goat,

No attention is being paid to the ongoing enviromental degradation that would inevitably lead to many more pandemics.

It’s not just the degradation it’s the deliberate driving of people into “virgin areas” where all sorts of nasties lurk and zoonotic where new infection creation is most probable.

But there is another area that concernces my rather more in the short term. Which is SARS-CoV-2 varients forming disease reservoirs in various places. Where like ebola and more common infections COVID-X will just transfer back to humans again.

Have a look at COVID and mink to see what could happen. Once that bottle is open we will be stuck with COVID despiye a vaccination program.

Clive Robinson • December 14, 2020 12:14 AM

@ MarkH, FA, Winter,

that is an amazingly elegant way to train the patient’s immune system.

It uses part of the normal “budding” or asexual reproduction mechanism…

The active genetic part of the virus be it RNA or DNA is usually quite susceptable to it’s environment outside of a cell cytoplasm. Thus it usually needs protection which can be a protein capsid –where the protein forms flat sheets which fold up along vertices just like various polyhedra– which can also be covered with a lipid coating that forms the “viral envelope” through which various protiens push.

The active genetic part of the virus often tries to be efficient –see retroviruses– thus minimize it’s size by limiting what it carries around information wise. So it does not always carry the information to code up the protective coat, it just steals it from the cell as it is expressed.

That is simplified it buds outwards pushing out some proteins and rips away parts of the cell outer lipid layer as it’s coat in the process. Often damaging the cell beyond repair thus releasing other chemical messengers such as interferons that attract the bodies defence mechanism.

Think of it if you want a realy oversimplified view like a young child dragging their finger through the cream layer on top of a sweet pie or cake, or pushing their fingers up through a layer of bubbles on the top of their bath water. Some of it sticks to the fingers due to nuclear forces that give us the various forms of physical attraction amenable to mathmatical modeling, thus analysis.

So the “amazingly elegant way” is in effect a standard chemical way not just of viral pathogens but many many other processes not all of them to do with living organisms (think about the chemical layer between air and water for bubbles which can cause droplets of water to sit on top of large volumes of water).

Amazing as it might look it’s just a result of the same processes that give us surface tension from atraction and repulsion ultimately down through chemistry into physics and nuclear forces.

That’s the short version and yes there’s lots of detail left out you can pick at to your hearts content.

But if you actually want to know it in more depth then “go look it up” there are lots of Wikipedia and similar pages you can trawl through but ultimatly you get down to what we currently understand about those nuclear forces, and you might conclude that isn’t much. But it’s the sort of thing that breadth across many arts gives you that oddly as it drills right down often gets left out of depth in a an art explanations because it’s just seen a side track from more important things to do with your time.

Which kinda flies in the face of less than thoughtful assertions such as,

“… all breadth and no depth – this makes any debate completely useless.”

It kind of indicates that the originator of the assertion has a limited outlook on well, quite a lot really.

As yellow cab drivers in New York are oft want to say “You all have a nice day”.

@ MarkH,

A few places for you to start to find answers to “fill in the gaps”,

h ttps://en.m.wikipedia.org/wiki/Budding#Virology

h
ttps://en.m.wikipedia.org/wiki/Viral_envelope

h
ttps://en.wikipedia.org/wiki/Polyhedron

h
ttps://en.m.wikipedia.org/wiki/Adenoviridae

Clive Robinson • December 14, 2020 1:39 AM

@ SpaceLifeForm,

SolarWinds

Yeah when I was reading the article from your original post,

‘March and June of this year may have been subverted by what it described as a “highly-sophisticated, targeted and manual supply chain attack by a nation state.'”

Did catch my eye… It brought forth the thought of a “black hatted pointy chined” “Spy-v-Spy” agent using sophisticated social engineering techniques to get a job, in the mail room where they could swap the disks by hand in the outbound “updates”… But then those times of busy mail rooms and real letters and mail are long long gone.

And that in essence is the problem. In a 1980’s company you had an office block and mail room that was issolated from the world by the physical limits of building security. If you wanted to see what people were saying you had to get into the building and in effect cause massive disruption if you eanted to see in every letter. Which made such attacks mostly impossible.

But zoom through a third of a century or so, “people don’t do paper” any more… They just dash out a quick email reply. So much so that they nolonger think about what it is they type, thus they say more way more than is perhaps wise. Which makes the Email a way more attractive target, especially as getting at everyones Email boxes is as easy as getting at just one, and best of all you don’t have to “go get a job” as a mailboy…

Thus we come to the crux of the issues of “Efficiency-v-Security” email is in theory more “efficient” but in “practice” it has no security to talk of…

Yes it’s a recurent theme in almost all security vulnerabilities the push for “efficiency” is the enabler. And yes I keep mentioning it in the vain hope people will think about it.

But it’s not the only thing I mention from time to time. Some years ago on this blog before Stuxnet poped it’s head up I had a chat with @Nick P about the failings of “code signing” and why it actually ment next to nothing as a security measure.

As your later posting shows some one has demonstrated the point yet again, so whilst a surprise for some who are young, old’uns have seen it before. Again pointing out something else I mention from time to time “ICTsec does not teach it’s history” thus gets condemed to relive it over and over…

But trying to hide out of the lime light is Microsoft and it’s “Software as a Service”(SaaS) 365 that many governments run especially the elected and executive parts for “efficiency” that is realy “penny pinching”. We know this is a bad idea and have said as much for decades. But even when the then head of GCHQ under scrutiny in a UK Parliment enquiry told them that, because GCHQ was “collecting it all” as it went by… nobody appeared to listen the faux efficiency of “trim the fat” through the muscle and “to the bone” and other demented neo-con mantras held sway, and security lay there crushed and bleeding under foot of the “self entitled”, “filling their boot” and enriching themselves at others expense and the “common good”.

So whilst this is “shock horror” to some, it’s “just the same old same old” to others.

But one point to note, whilst one of the four US “Cyber-existential-threat nations” on the “US list” is being blaimed as usual, in the very Orwellian way the US has made it’s very own, there are many tens of nations that not only could have done it but are currently doing it one way or another…

Just another thought every one should take onboard…

Clive Robinson • December 14, 2020 5:18 AM

@ Winter,

From all the candidates Moscow is both the most likely (Bayes) and the very best for publicity. No one cares when it was Bhutan doing it.

Thank you for reinforcing my point.

The US policy of just pointing Orwellian style[1] to a single attacker “far far away” from just a list of four[2] causes people not to think critically or correctly when making judgments. It’s as bad as saying “Muslim Terrorists”, “black street criminals”, and other stupidities like “It’s t’butler wot did it Gov” of a “Penny dredful”.

Appart from showing that the US hierarchy is treating US citizens as though they are six years old, it more importantly gives other nations and actors a “free pass” when they are attacking the US or it’s corporation’s for IP etc.

Worse even minimal camouflage by the attacker causes supposed independent computer security investigation companies to fall in line with the US executive list of “Cyber-existential-threats” or current one in the Orwellian Barrel[2].

Which makes any “False Flag” operations much more easily hidden behind what is self made false attribution. If people do not think the likes of the Dutch, French, Israeli, Swedish, and other supposed “alied and friendly” nations are not fairly intently treating US Entities to this sort of APT type activities, then they need to think again. Those countries know without doubt the US is doing APT etc to them, so they will treat the US to the same “courtesy” as equalls should.

Which is another aspect many do not think about. The thing about Cyber-Attacks is that the actually require very little investment to deploy, because you are using other peoples systems against them. As the ability to develop the attack tools is actually quite minimal as well, it can be done in a “home office” or room above a shop. Which also means you can do it well out of sight of others just put “Smith & Co Accountant” on the door that will keep most away. You do not have physical components to manufacture which could raise suspicion nor do you have large energy usage which can be seen in space, as you do with conventional weapons production. Importantly you do not need tens of thousands of personnel to be trained to operate them. Which is why you can have a very effective “Army of One” or two in Cyber-Space. Thus your “Equals” may not be who you think they are and the old joke about the 400lb teenager sitting in the back bedroom starting Armageddon does not quite have the same funny ring to it any longer.

The cyber-skills required today are not to far from those of a sniper/intel role in the military. They have to get in and observe the lay of the land, target habits etc and plan how to get in, lay the trap and as importantly out again without being caught or even trailed or identified in any way. Such activities require a certain type of mind set one of which is the ability to work alone in effective issolation being self sufficient for extended periods of time. Such people tend not to stand out except to a trained eye, because they are not invisable, hidden, or grey, just so normal as to be not rememberable as a person though they might have a rememberable dog or other item to draw your attention away from them.

[1] George Orwell pointed out a stratagem in his book “1984” which gave rise to the notion of a common enemy for all to unite against. That is rather than admit the realities of life to it’s population and thus appear impotent, a Nations Executive blaims just a single enemy at a time. Also it only changes the current enemy for a new one for political reasons. Thus slogans and other propaganda unite much of the unthinking or authoritarian following population against remote peoples they can not meet nor in effect harm. In the process it distracts the populations gaze away from those that are realy harming them the Nation’s Executive. Thus both protecting the Executive and giving the people a scape goat for the Executives gross failings.

[2] The US Orwelian list, of “Cyber-existential-threats” appears to contain just these four countries currently –
China, Iran, North Korea and Russia. A quick look at US political history and foreign policy and which of these nations “is in the barrel” being given the “tar and feather” treatment shows an intetesting correlation too great to be even remotely coincidental.

Clive Robinson • December 14, 2020 7:33 AM

@ Winter,

I still think Moscow is the most likely culprit

I’d certainly be thinking in terms of a Super Power, or a nation with a “keep off our Grass” type nuclear deterant. Though which one well who the heck knows in this game of “smoke and mirrors”.

At the end of the day it’s HumInt that’s actually needed, looking at code or even routed packets is not going to give real evidence you can use, especially as getting into routers and computers,in other countries is a criminal act in of it’s self which in the US atleast makes any evidence collected “fruit of the poisoned vine”.

What I’ve been hoping for for some time is that people stop treating cyber-crime as cyber-warfare, because of two reasons,

1, The chances of it going wrong and kinetic conflict start are way higher than any sensible person would like.

2, The military are not the way people should be solving crime, that’s a Police and Courts task.

If more effort was put into dealing with all cyber-attacks as criminal, then International Law has a chance of being put in place, which hopefully would ease tensions.

If we can clear out cyber-crime to a better degree than we are failing to do currently, then cyber-espionage has less places to hide in… Which might indicate why people are not talking just posturing.

Clive Robinson • December 15, 2020 6:57 AM

@ JonKnowsNothing, ALL,

The UK has a new COVID variant.

https://www.bbc.co.uk/news/health-55308211

Another one to add to the list, it’s being blaimed for the new increases in LockDown measures in a large part of South East England and all of London.

But… They are saying it’s no different to the other strains…

So apply a little logic,

1, It’s no more infectious.
2, It’s to blaim for infection rises.

At first glance would appear to be at odds, hence people getting skittish about it. But
whilst it is entirely possible due to human agency via an increase in gregarious behaviour or people “comming in doors due to less clement weather, you would expect other indicators to show up, which apparently have not, which may be due to the “drag effect”.

So I guess we are just going to have to wait and see what changes happen over the next month or two which unfortunatly is going to have a big problem in it in the UK. We have a relaxation for “the winter solstice celebrations” which whilst it is pragmatic is probably not a good idea.

And before people ask, I’ve decided not to partake, not because of COVID –though it is a good excuse– but I just don’t like it I’m not the Yo Ho Ho or Let’s be jolly and play lots of party games type. In the past if I could not find well paid overtime / contract work I used to go off solo camping, which now at my age and health is not as much fun and the Dr gives you one of those “It’s ill advised” looks. So for me it’s going to be just another “average 2020 day” well not quite I think something a little more exiting than opening a can of corned beef is in order 😉