Schneier on Security

Clive Robinson • February 14, 2021 5:26 AM

@ Bruce,

I know that the DoD believes this threat is real and is giving away R&D funding for security solutions.

Yes they DoD amongst others have been getting their panties in a very tight wad over it for most of this century. Especially as they have more than good reason to think that China is actually ahead of the US technically[1] and Russia way ahead on natural resources.

If you look back on this blog you will find @Nick P actually found and raised the original “open” invitations to tender(ITT) and the subject got discussed in some depth then and later.

However over the years as @Nick P noted the “open” went to “closed” to “secret” and who knows where after that, and as happens with that sort of progression nobody realy knows what is going on any longer just that money goes out via various less than obvious or distinctly obfuscated if not hidden off of budget sheet ways.

In essence the DoD know that US,Corps are probably their number one enemy when it comes to the loss of this sort of “secret information” and thus does what it can to keep information out of their hands or in as tiny and well segregated ways as it can with “cover stories” (Which if the Bloomberg Journalist did not dress up and in effect fabricate, is what the unnamed Airforce Person(s) did to Mr Quinn).

Those with a little more domain knowledge can rip through the Bloomberg artical showing up the nonsense contained within.

Thus a problem arises, every one thinks wolves are dangerous, and as the fable has it “the boy cried wolf once to often” and nobody believed him, thus the wolf got to be fed…

Well think of these Bloomberg articles as “crying wolf” and follow the logic.

Which brings us to,

So I have more than the Bloomberg reporting to go on.

You are far from the only one, which is why we take the issue of supply chain adulteration seriously. What we need is reporting that is calm, collected, factual and above all else evidenced based.

I think many would think the Bloomberg article is in many ways the opposite. So much so you have to have in the back of your mind the “Why?” question followed by the “Who?” and “What?” do they get out of it questions…

That is “Who gains from Bloomberg crying wolf, and what does that mean for us?”.

That’s the nub question, and the one we should dig into. Because “Actions have consequences” and Bloomberg’s actions are already having consequences we realy do not need.

Oh and one last point to note, those named in the Bloomberg article like Mr Quinn, ever heard of them before? They are not exactly industry wide recognised leading lights… Which could be a sure indicator that they are being used by the Bloomberg journalist to get the sort of answers they want to spin up their story.

There used to be an expression “yellow journalism” that covered this sort of behaviours. The modern version of “Tabloid journalism” has sort of watered down the meaning so lets just say Bloomberg has a “yellow streak” a mile or so wide and it’s getting wider.

The important thing is not to follow Bloomberg’s line of conflating a very real risk with sensationalism that is in the main disprovable “Hog Wash”. In other words “We do not want to throw the baby out with the bath water”…

[1] Due to the stupidities of various political view points that insisted on COST and killed much high end research, “And you shall reep as you have sown” is somewhat apt. The point being some things can not and most definately should not “be left to the market”, for a number of reasons. Firstly at best “the market” in the US only has interest in short term gain thus research has to pay off quickly within a couple of years or three at the most on average. Likewise it has little interest in colabaration other than by aquisition which gives rise to a distinct lack of plurality in the accompanying research domain. These things others and myself have warned about, I won’t go into what has been going on in academic research, but with many US Universities effectively turning themselves into “Hedge Funds” it’s not hard to work out. But the next stage is also problematic the Corps that drive “The Market” are run in a certain way that encorages certain very reckless if not down right idiotic behaviours. As I’ve continuously warned out sourcing across jurisdictional boundries is a very idiotic thing to do as not just IP theft happens, you are legaly barred from doing anything about it, and even raw materials, tools and finished goods you thought you owned you now don’t, and you might even become a criminal as well. You would think those that “manage” in “the market” would realise this, and who knows they might but their short term behaviour and mantras blind them and destroys the entities they work for in at best the medium term, taking with it not just jobs, skill sets and domain knowledge. Further with such losses there is no incentive to rebuild, build, train or retain knowledge in the domestic economy which then tanks… I could go on, but unless the US changes it’s very short term managment behaviours the downward trend will continue, and it’s grip on technology will wane even further.

Clive Robinson • February 14, 2021 5:49 PM

@ JonKnowsNothing,

The catalog describes the implants, technology, and usage. It including the size of the devices available

Those are what you might call “tier one” or “entry level” devices, if you go back on this blog you will find I could describe the technical functioning of them because I’d actually designed manufactured not just equivalent, but better devices.

In short in the main the sort of kit that gets sold to law enforcment from a different catalog in name and supplier as “high end surveillance” and carries a 10,000% mark up on BOM price atleast…

When you can get a small ceramic board made that has three surface mount transistors and a handfull of passives and have a middle ceramic plate with holes to accomadate them and a third as a cover plate and have bonded out terminals, you would be surprised just what some people will pay…

You can get second hand equipment which you can use to make “flip chip” circuits with unencapsulated CPU, synth and RF chips and again put in a custom ceramic package for about the same price… Or if you want on an ultra thin mylar substrate flexible PCB.

With the fun these days of realy tiny MEMS sensors (just keep the cheap ones from helium or hydrogen).

So yes these things can be done, by just about anybody with some technical skills and a back room or basment they can keep dry and clean to work quietly in.

The problem is not in making such devices, heck have a look on alibaba and you will find USB connectors with GSM phone sets in them. The problems are three fold,

1, Getting in the supply chain.
2, Getting at the equipment
3, Having it remain undetected.

As I noted in “round one” of these Bloomberg stories, the easiest way to get in the delivery supply chain is at the beging and just before the end. However some supply chains have multiple delivery chains within them. The big problem is ensuring the modified kit ends up with the right people, not the wrong people.

Again as I noted before the easiest place to actually get at the equipment is before it gets “cased up” then put in packaging with security seals added.

The real hard part is “going undetected” I mentioned one way above, where chips are used that have the desired functionality built in as standard, but not enabled except in the more expensive product line.

I can think up many ways to do what is claimed by Bloomberg, the fact that the backdooring can be done is not the issue. The issue is Bloomberg appears to be in the land of the fairys yet again with what is basically a manufactured story not abything even approaching the truth.

Whilst I care not a jot for “Bloomberg’s good reputation”, I do care about how it effects others.

Thus the second such “shooting down” of Bloomberg “Make Believe” is that it will convince people that such attacks in general are not true… Which is simply not the case.

Thus if Bloomberg’s story is to make people aware of such a threat, then most likely it will have the opposit effect…

Clive Robinson • February 15, 2021 11:13 AM

@ JonKnowsNothing,

In another post about fixing multiple vulnerabilities, imagine the fix it ticket that was entered

As a hardware engineer that had responsability for the education and development of other engineers, I used to emphasize certain trade craft.

The most important of which without doubt was “testing techniques and methodology” with a very large emphasis on hands on practice…

I was known to make engineers sweat in the face of their peers by springing other engineers problems on them at meetings. The main usefull side effect was they talked to each other not about the match but problems they were running up against.

The reason they accepted it was because I would take my turn at putting my hand in the hat and pulling out somebody elses problem… It is called “life long learning” after all…

If a tech support or thirdline support person gave me that sort of ticket closing report they would find me not at all friendly and they would find themselves on my bench with the offending item untill the root cause had been found.

Clive Robinson • February 15, 2021 6:02 PM

@ JonKnowsNothing,

They rest of the group was stunned. They quickly shuffled up and down the stack and looked at him and said “THAT’S IT! That’s the place with the problem!”

Many years ago BBC Radio 4 had a program where people of note but not fame were interviewed.

On was an early Female Design Engineer, which was quite a shock for the times.

She recounted a similar story about being “young single and pretty” and fresh faced holder of a first class honours degree in engineering, dressed to impresss. But to find her self facing a bunch of died in the wool flat cap wearing pipe smoking engineers who’s grandfathers had probably been born with both an engineers jacket, collarless shirt, dark blue bib-n-bracez and boots on their feet, in a cold and drafty nissen hut.

She to had the blue print problem, and decided the best plan was to say nothing just nod murmer and ask to see the actual system. Well after a stoney hawk eyed observation by the “men” they showed her along to the machine and she asked for the inspection pannels to be opened and she had a look around and just knew the was well out of her depth… So in desperation she asked to see the machine in operation and so they started it up. In desperation she had backed up against the case and was in effect leaning on it when she noted that for some strange reason the temprature was rising way to quickly. So she asked where the sensor was located they muttered something about it being on the tank so she asked them to show her exactly where. Low and behold it was not connected to the tank but the external casework she had been leaning on… The men looked suitably impressed and she scarpered as quickly as politness would alow, just thankfull that somewhere there must be a godess of engineers that had chosen to smile on her.

And to be honest if there is a godess of engineering she has smiled on me on more than on occasion…

Back in the 1980’s I was given a job interview by a small company that had a large customer (BT) who wanted a system of Torch Computers installed. However they had some technical qurstions and I got asked if I knew of an answer. Thinking it was still part of the interview process I gave a very precise answer with calculations and suggested equipment… Turns out the men from BT were impressed so I got the job.

But before disapearing up to Wales to do the instalation and commisioning, I got called in on another job. And it had a very funny problem in that biphase signalling across twisted pairs were used. One end box that used thr equivalent of a high speed op-amp to convert the bi-phase back to an NRZ clock signal was not working. Whilst I could see a nice clean set of input waves, there was no output wave. Turning it off and running the multimeter around showed there was no apparent circuit issues. I was stumped… So I went and sat on the loo, and stared at the back of the cubical door. And enlightenment came down from above.

Five minutes later I had confirmed the hunch… What had happened was there was a physical break inside the moulded right angle connector. When I had buzzed things out I had done it on the inside of the case from the back not the face of the connector. And that nice waveform I had seen whist being there to the scope probe was not there in reality due to the odd way the grounds had been set up with a transformer…

So chalk that up to a success I demonstrated the problem to both the customer and the supplier who was thankfully local and had a new unit a couple of hours later…

I’ve had a few other “pull the rabbit out the hat” moments in my time, one of the funniest was when I was wearing the green. I’d been dicked with showing a bunch of other technicians how to fault find and repair a load of HF radio man packs. There was about thirty, and the regular techs had marked most of them to be returned to the manufacturer for repair. Which is a long slow and expensive process so the pile had grown untill things were dire and various people with crowns on their shoulders were huffing and puffing and dropping veiled threats… So to my horror when I’d just started showing the technicians how to open the cases without mucking up the seals in walked not just one of the majors but the regimental colonel… I thought I’m doomed but in more squadie like verbiage.

So I just dug in and it was just one of those days, I would describe how to walk the signal path and touched various components as I went. So thirty seconds into the first set the 2N3866 under gental preasure from my finger revealed an intermitent fault. So I got the first tech to start swapping it out. The next set and my finger revealed a cracked trace on the PCB. And so it went on ten minuites later and I’d found all the faults on all the sets and the techs were busy fixing them. The colonel looked at me and enquired who I was, so I explained I was not a regular but from the TA tech unit with HQ Squadron in London and my day job was working in the oil industry. The colonel looked at the major and said “Maybe you should get him up here more often”… The following week I turned up at HQ and got shouted at by the RSM for being improperly dressed… Which was a bit of a surprise, and he chucked me an arm band with another stripe on it, and said “I hear you’ve done good” then “So sort yourself out you look like a sack of 5h1t tied up loosely in the middle”… What god giveth with one hand, he taketh with the other…

Clive Robinson • February 17, 2021 6:59 PM

@ Grima Squeakersen,

I think you may have missed what to me is another obvious possibility – that it serves some alternative…

There may well be other reasons as well, but lets go through what I said in reply to @Bruce,

Yes they DoD amongst others have been getting their panties in a very tight wad over it for most of this century.

Due to various politicians on the hill, the US Federal Government, State Dept military and intelligence agencies were told to stop developing and using there own systems around the work of US orgsnisations that could be trusted (the I in MIC) and instead use “Consumer Of The Shelf”(COTS) equipment. The excuse was “cost saving” but on reality was thr leading edge of outsourcing government to other organisations that were giving kick backs through lobbyists to those politicians.

The result of this is that the manufacturing of the majority of the components used in these COTS machines were made in the Fat East. For various reasons manufacturing of the higher end components a lot of the DoD frontline and command staff systems ceased to hapen in the US. With further time and for other reasons I’ve warned about before on this blog, the tecunology became under China’s control. Some accused IP theft, but the reality was short term managment thinking gave the Chinese the IP gratis, plain and simple. China unlike the US decided to do as other Far Eastern nations such as Taiwan, Japan, and South Korea had done which is the state invested in building up it’s industry over several decades. Not as the US was doing, giving the work to the Far East in return for a handfull of dollars extra profit in the next quater or two.

There is no doubt about it in quite a few areas of technology China is well in advance of the US especially in communications technology and the semiconductor development involved with it. Which is what the 5G argument is actually all about. The US under the previous administration decided that it had to get back the technology under it’s control. Thus the many lies and half truths to kill off first ZTE and then try to kill off Huawei. The reality is every thing the US accused both Chinese companies of, can be said as equally by China for twenty or thirty US companies. The simple fact is China did tell the US to clean up it’s act, the US refused, China brought in legislation to make the use of equipment by those twenty or thirty US companies. The US executive got upset made bad choice aftervbad choice, and the US economy has suffered badly under the US-China trade War, whilst China has taken some knocks it’s expanded other markets, whilst the US has stagnated…

The DoD however were well aware of the issue of “foreign supply” and how it could be attacked. They were not the only ones, various commenters on this blog had been talking about it for quite some time, because there are examples of things like Apple products being tampered with in the supply chain suchvas Windoes malware on Apple audio players. Also attacks on Epos systems for the Sainsbury’s supermarket chain where plastic cases that had bern welded shut were some how opened and cellphone and Credit Card reading hardware technology added…

Thus the DoD put out “Invitations To Tender”(ITTs) for researchets to come up with ways to spot supply chain poisoning reliably, preferably without requiring destructive testing. The problem is that now semiconductor features are so small they can not be seen by optical or other microscopy… Thus that did tender have kind of “disappeared” which probably means some were successful and others opened newer longer term research.

As for Russia, it’s not realy a secret that they are “Cash poor but resource rich”

Which kind of covers the other parts of my reply to @Bruce ot,

Especially as they have more than good reason to think that China is actually ahead of the US technically[1] and Russia way ahead on natural resources.

As I’ve said you can check that is true in it’s own right.

Thus your point that there may be others, I don’t disagree on we just don’t have sufficient evidence to say, where as we do for what I’ve pointed out.

Thus we need to gather more evidence, even if it does look not even circumstantial.