Schneier on Security

Clive Robinson • February 21, 2021 1:32 PM

@ lurker, Robin, ALL,

Last week a prominent Australian NGO leader was asked on ABC radio point blank if Facebook had no moral compass.

Of course Facebook has no moral compass the people running it are clearly sociopaths (as the FaceMash and other early prototypes for Facebook clearly indicate).

But then nearly all large corporates are run by sociopaths, News International being just one of many where this is obviously so. Such leaders have no moral compass, and simply follow any methodology that assists in their aims and objectives. They care not a jot for morality or legality, other than minimizing the problems ignoring them might give rise to, which could in turn inhibit progression to the objective.

I could give you reasons why so many large organisations are run by sociopaths with the ability to charm, but you can go and do a couple of courses that teach you not only how to spot sociopaths with a high degree of accuracy, but also how to deal with them.

Clive Robinson • February 21, 2021 11:44 PM

@ lurker,

First off I have no idea why they have,

multi-thousand dollar home power bills

You’ld have to say what the domestic kWh price and connection tariffs are. Is it just a local supplier or regional issue or do they burn through many tens of kWh/day.

In the UK the price differential between electricity kWh and natural gas kWh is large enough that for 900-1500sqft domestic users running a 2-4kW portable generator converted to run of natural or liquid gas makes economic sense[1]. Especially if it’s a well designed CHP system.

What many do not realise is that often the biggest use of energy in a home is that of moving heat around. Your fridge and freezer especially “uprights” are fairly power hungry, and because peoples feet are cold due to the way normal convection heating works they have the heating up way to high. With the top of the room more than 10C hotter than at the floor level (under floor heating is the norm in quite a few parts of the world because of this).

But most of that is not relavent to the events in Texas this past week. Basically Texas burns gas etc to generate electricity and they do it in the wrong places thus has high transmission costs with I^2R losses way higher than they should be on generation output. But more importantly, the generation is also in the wrong place for the supplies of gas… Thus a second set of transmission losses. Now the real problem that happened is that those on the gas transmission side have been cheap skates, and put in equipment of the wrong type. A decade ago a report was issued detailing what needed to be done in Texas to secure energy supplies against climate change effects (ie greater extreams of hot and cold weather). In typical Texas Political thinking that was “Federal interferance stealing profit from the self entitleds pockets”… Well they’ve had their “ten year” storm and the system colapsed and people have needlessly died and many many others suffered needless harm…

But to add insult to injury those on the inside decided it was a good time to “make a little extra” via that well known effect of “Disaster capitalism”. They knew demand was going to rise so they upped the price in various ways (I’ll let @SpaceLifeForm fill in the details).

But it suddenly became “bonus time” then… The lack of preparation in the natural gas industry gave rise to ewuipment freezing up… Gas stopped, electricity dropped, water stopped and other gas pumps that ran on the now non available electricity stopped, thus more power generation went of line and so on… Such things are called “Cascade failures” and they are fairly disasterous when they effect just one utility. When the utilities are too interdependent as they appear to be in Texas, unwinding what has gone wrong is most definately not a simple matter.

But no problem for some, Disaster Capitalism will fill their boots even more. Because as their costs rise they have to maintain “proffits on turnover” to keep certain people happy. There is only one place the money not just for the increased expenditure but the extra profit they have to make on top of it can come from… Yup the consumers. But with larger consumers such as industry on long term negotiated agreements their lawyers will be straping on the 45’s, chaps and spurs and riding out looking for damages, so more turnover thus more profit has to be made. Which means the little domestic consumer is going to get very disproportionately hit over the next two to three years… Such are the joys of certain types on monopolistic capitalism.

[1] I know some one in a sunnier area who has a lot of solar capacity both therm and voltaic, they have a natural/propane gas backup system that generates both electricity and hot water. They disconnected from the electrical grid some years ago when the price they were getting for feeding excess back into the grid did not cover the standing charges[2]

[2] One of the tricks used in some places to make an electricity supplier look less expensive is to significantly increase the standing charges to reduce the unit prices. If you are an above average user it could be a good deal but if you are a below average user you can get baddly bitten…

Clive Robinson • February 23, 2021 3:17 AM

@ Winter,

Remembe, bike thieves do not have time machines…

So,

Whenever I am up against the NSA/FSB/GRU/PLA/MOSSAD/MOIS, I will reconsider. Until then, Tor will suffice.

You may not be able to, as “Collect it all” alows them to go back in time with ease.

But the other thing you have to consider is the MO of LEA’s and many IC organisations these days is not to find proof of guilt… Just some circumstantial evidence of potential collusion, being near, or off your normal pattern… Collect it all gives them that back longer than modt can remember…

Yes Tor is nowhere near as good as it could be, and yes we could do better ourselves.

But doing so is circumstantial evidence, or as others put it “Painting a target on your back”.

LEAs and the IC will thus “find a convenient target” on which to take aim, it’s how they do the “investigatory” things.

As it’s a semi target rich environment your odds become probablistic and get worse with usage time. But then stopping using such systems is you being “off pattern” which is as I said suspiciois to some people.

So you end up with the old quandary,

“Damed if you Do, Damed if you Don’t!”

It’s why I keep a deep seperation between Personal and Professional, and “Ne’er the twain shall meet”.

Clive Robinson • February 23, 2021 4:58 AM

@ SpaceLifeForm,

If you can afford, I recommend two routers. I don’t believe this attack will get around two routers and likely prevents related attack scenarios.

If you look back on this blog for “Garden Path” you will see that I actually mrntioned the use of two routers with an IDS inbetween.

As I keep getting people telling me I should not publish the reasons behind such ideas on this blog (where they might do some good) and having had posts deleated because of them, I did not talk about things like punching holes through to the outside via java, javascript and similar.

Mind you, you would have thought it would have been obvious to people who had heard about how the FBI “allegedly” paid a University a lot of money to have a system to “de-cloak” Tor users…

Also why on earth do people think I keep talking about not alowing any javascript or any other code downloaded from outside the security cordon to be executed on internal machines, as some might say “Jease Louise”.

This attack method “class” is by no means new, as I and nodoubt several others can atest to, having a couple of attack “instances” around might wake people up, but…

As you’ve been discousing about patches, the wrong thing almost certainly will be done to fix this problem.

@ ALL,

Oh and for people that want to have something to think about,

“Compare HTML 5 with say HTML 3.2 and ask how those extensions are going to make your life a whole lot less secure…”

Because I asure you theu will.

Clive Robinson • February 23, 2021 8:11 AM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter, ALL,

In Scotland they have been comparing the Pfizer -v- Oxfard vacines at the “four week period”

Of those vaccinated,

6% of Oxford jab recipients went on to get COVID.

16% of Pfizer jab recipients went on to get COVID.

The Oxford vaccine apparently has lesser at the time side effects especially in those that have had COVID. The Pfizer jab on the other hand appears to hit people a lot harder, especially if they have had COVID.

Either way both vaccines show virtually no protection in the first week and a bit and maybe 50% efficacy vy week two. Weak three sees the imunity come up quickly and it’s mostly there by week four.

The moral is if and when you get your jab stay in hermit mode for a month.

But if you do have the misfortune to get COVID in or after week two it will hit you less than it would have done otherwise.

And lets face it which would you rather face, a week of fealing bad, four weeks in hospital, or eternity of being dead…

Still not sure what the EU MDA or US FDA are doing but it does not appear to be “helping the citizens in the short term”.

Still waiting for pre-print or peer-reviewed on the Russian and Chinese vaccines phase III or equivalent stage. From the little said both appear to be more broad range than the mRNA and Oxford jabs.

Clive Robinson • February 23, 2021 2:11 PM

@ Spring is coming,

The question with any virus shedding is if it’s actually contagious.

Not for the person who is having the disease run riot in their system…

As to if the shed virus is contagious that depends on two things,

1, If it is viable or not at the time to a potential new host.

2, If the viral load is sufficient to overcome a potential new hosts defences.

The human bodies abtibody immune system only comes into effect after earlier defences have failed.

If the virus does get as far as entering a living cell, then the cell it’s self has a mechanism that informs adjacent cells to effectively shut down such that any new virus from the now dead cell has difficulty infecting those adjacent cells. The whole defence system is in many many layers and so it may not get to the point that the body becomes infectious to others.

But what happens to the body when the virus has started infecting adjacent cells? Well those cells are going to die one way or another. Thus the hosts body enters a state where it is loosing cells that it needs to survive, at some point it has to have the cells replaced, which is an energy intensive process as is fighting the infection. So the longer a person is “shedding virus” the worse off they become and thus more vulnarable to orher opportunistic pathogens, that want to feed of the hosts body. One of the worst offenders in this is pneumonia which is often what actually kills people via septic shock[1].

So issolation of infected people is as much for their sake as it is for others. Thus whilst a mask might not stop the virus getting through, it can significantly reduce the viral load. But more inportantly a mask has a much greater stopping power on some secondary bacterial pathogens. Similarly washing hands, not touching your face and keeping rooms etc well ventilated to dilute any viral load significantly.

One of the problems with modern energy efficient homes and offices is that they are in effect “sealed” so the viral load builds up rather than gets diluted…

It’s why any engineering is hard, because often in solving one problem you create another that could be far worse.

The now classic example as has been just recently discussed on this blog is “Software Patches” but it also applies to “Software Upgrades” were new not originaly expected features are bolted on to existing code. Rarely are patches and upgrades tested properly or as fully as in the original code base design and build. Thus stress cracks open and nasties get in.

[1] Having had both pneumonia and bacterial sepsis at different times I can tell you neither is fun and they can both kill you quite unpleasently. Worse that your odds of surviving especially with sepsis can be both very short and very dependent on time treatment starts, with as little as a half hour delay in treatment changing those odds down from little to none.

Clive Robinson • February 23, 2021 3:48 PM

@ SpaceLifeForm,

From the Twitter thread you link to,

“Everything about this aligned to a threat actor who is my opinion was more concerned about operational security than mission accomplished…”

Somebody atleast is making a valid observation.

One I wish many many more people would think about.

Especially when the SolarWinds product is used in most if not all first world Governments, quite a few second world, and even some third world governments including most nations the US routienly commits espionage against…

Thus the question of attribution is one that is going to prove interesting.

Look at it this way if as argued in the statment the attackers were “more concerned about operational security than mission accomplished” then almost certainly one major step they would have taken woulb be to ensure that if the exploit was found it would lead away from them to another entity.

Which means that attribution is going to be as hard if not harder than the skills of the attacker.

So far the only people we know who have tools to do such misdirection is the US IC one of whom was daft enough to loose them in a public space.

Whilst we can assume that all members of the extended Five-Eyes have such false attribution tools, the level of evidence we have is low.

Likewise I would expect any Level III attacker be they State Funded or Corporate/Privately Funded to have such false attribution tools in their toolkit as standard. As we know from Palantir’s activities and the Facebook / Cambridge Analytica tie up, such things are done by politically active hedgefund owners and others with very deep pockets. Arguably leaving false atribution trails on money through Russia and other nation states is almost “routine” for some people.

Remembering just how much scruitiny is placed on money trails, arguably laundering large sums of money is harder than laying down a false trail in cyberspace (hence Encrochat attack).

So yes as so often pops up hear on this blog,

Attribution is Hard.

Clive Robinson • February 24, 2021 3:00 PM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter, ALL

Vaccine efficacy on large cohort at 4 week point

There is a report from Scotland,

https://www.bmj.com/content/372/bmj.n523

On 1.14 million people given either Pfizer or Oxford Astra Zenica jabs as part as “Maximize first shot policy”. About twice the number of people have recieved the Pfizer injection to the Oxford.

As several other reports show there is concern about “vaccine take up” in various communities. It is known that the Pfizer jab can hit people hard for a couple of days[1], especially if the person has had COVID (it’s actually probably a good sign that you feel realy crap). But people talk and spread their stories by social media…

However the Oxfard AZ vaccine has had less reports of such effects, which some have indicated might have changed many Australians views (the initial groups will get Pfizer whilst Auz gets it’s own Oxford vaccine production up and running).

The report from scotland has many cautions but the main “headline catcher” will probably be,

In a large cohort 1.14 million Scots who have been vaccinated a “4 week efficacy” study was carried out. The result is the Oxford efficacy is 94% therefore 6% risk, Pfizer on the other hand has 85% efficacy thus 15% risk. So the Pfizer single innoculation has 2.6 times the risk of the Oxford vaccine single at the 4 week point.

It needs to be noted that these figures will change with both time and when the second injection is given. But, the vaccines have not been around long enough to get to know anything other than the short term results in a large population.

Whilst 2.6 times sounds bad, it’s not because the overall efficacy is low, the actuall efficacy is way better than expected of both the vaccines.

But what is more important is the medium and longterm results, which we do not have yet, for obvious reasons.

There is also the question as to how specific these vacines are, and if the virus will out mutate them. Nobody knows the answer to that.

But we do know is that the rapidity of mutation is directly related to the “prevelance” or those currently infected. Thus the faster people are injected the lower the prevelance thus the less likely mutations are going to happen.

However there is one mutation method we realy can not predict and that is hybrid-mutation. Overly simply if you have two infections in a cell at the same time, the RNA of both viruses can get mixed up. Beta Corona Viruses of which SARs-CoV-2 is one, are known for higher rates of hybrid-mutation thsn other viruses. What we know from other hybrid-mutations, is the results are more likely to be less infective, less virulent and of less viability outside of a host.

But that does not stop the odd one being a nasty. In fact quite a few experts in the subject think that SARS-CoV-2 was more likely the result of natural hybrid-mutation rather than any other way by quite a large margin.

So getting jabs in arms as fast as we can is desirable to a high degree[2].

But do not expect miracles, the UK has done over a quater of the population and is heading to a third of the population in the very near future[3] but we still have community spread.

[1] The “Pfizer Pain” has been suggested by some to have put people off getting a vaccination, as part of faux news including one claiming “Microsoft is chipping you” or “5G Burn” etc…

[2] But seriously if you get an offer for either vaccine then “bite the hand off” to get it as fast as possible. It’s the flip side of “Individual Rights -v- Social Responsability” looking after No1 does a good turn for society as well as you so “win-win”.

[3] Yes my “number” has come up as a “group four person” with an “uplift” and I was offered a choice of Pfizer or Oxford. I’ve elected for the Oxford as I’ve said I would, as I’ve followed the evidence as best I can. So this Sat is “Ouch Day” and if people are interested then yes I will report back if any bits drop off, turn green, or I get the urge to suck the life out of garlic etc (actually the garlic sounds good so maybe “Pressed chicken with fourty cloves of garlic”[4] for Sat night dinner 😉

[4] One simple recipe,

https://barefootcontessa.com/recipes/chicken-with-forty-cloves-of-garlic

Mine uses the two chickens “dead frog” spatchcocked and when it comes to the sauce, I use “onion marmalade” which is kind of “fried onions made in taste heaven”.

Clive Robinson • February 24, 2021 11:23 PM

@ JonKnowsNothing,

Things are as chaotic as ever in Sunny California

I’m sorry to hear the woes of what would be considered a prosperous “Nation State” in Europe or many other First/Second World regions.

If you remember back a year ago I assumed that due to “social policy” in some parts of California, the state would become a COVID hotspot and near disaster zone. Thus was pleased to be wrong when it did not play out that way.

However from what you’ve said over the past few months and what has been broadcast by various MSM outlets, it looks like my predictions were just delayed not wrong.

I can not help feeling that the delay was “An opportunity lost”, that is so much more could reasonably have been done, but did not happen for one reason or another (and being in a major election cycle will not have helped).

Mind you the “lighter side” artical you included that had the raisin story did make me smile. Even though there could be a little “promotion” there 😉 I still see those little red boxes of “California Maid” around supermarkets in the UK and in my sons case even when he was barely able to stand, one box was “never enough” and he was partial to them with humus and carrot sticks. Though I rarely see him eat raisins these days unless they are in something like “black bun” he still likes “Carrots with everything”, so much so you would think he would not just be able to “see in the dark” but have furry ears and a toothy grin as well…

Clive Robinson • February 25, 2021 5:05 AM

@ SpaceLifeForm,

Not sure where you make the connection but lets run with it.

Firstly there has been a lot of noise about protestors being identified by semi unique featutes.

There was the woman with the limited edition tee shirt, and others.

They turn up to events wearing such items but orherwise do not leave forensic evidence that identifies them.

There is a saying about once is odd, twice is coincidence three times is enemy action.

Secondly did you take a look at the pipe bombs, what do you see?

They were supposadly placed the night before, and be absolutly genuine yet neither went off…

Whilst a 22year old might know how to make a pipe bomb from the occasional pictures that surface would they know how to make the detonator so it functioned as a bomb?

As a general rule there is one of two ways you get the knowledge,

1, Somebody who knows shows / trains you.
2, You aquire the information by experimentation.

However the old style “household” parts to make a detonator are becoming quite scarce as new more efficient lower cost technology has all but replaced them, as railway modelers have had to rework things know.

There is something very distinctly odd about the way it’s all been put together.

It kind of reminds me of the FBI associated “agent provocateur” activities a decade or so back, when the FBI were trying to make terrorists out of angry idiots who were at worst only a danger to themselves, and so incompetent they had to be led from place to place by the “agent provocateur”.

I guess we will have to wait and see what further “evidence” turns up.

As for the salute photos, they are kind of odd in a different way, the first thing I’d ask is where were they actually taken, when and by whom. The implication is it’s her home, but no evidence to that is given it could have been the boyfriends or other home. The dress is what you might call a “summer dress” yet the time stamp suggests it was taken 11/10/20 at 03:53 which might mean it’s been worn as a party dress. There is nothing designer about it it’s “off the rack” or “catalogue” so there are probably several thousand floating around.

As for the “distinctive sun glasses” how do I put it, the “Hammer” does not come across as anything other than a reseller, and it’s therefore likely that style of glasses are from Ali-Baba or similar right out of The Far East.

Likewise I’ve been seeing the “skull” type masks all over the place on the Internet when looking for a COVID mask. They are a mass produced item that was around before COVID, for “hip-n-trendy” cyclists, and have been in shops in the UK for years, often worn by cyclist dispatch riders with, guess what very similar sun glasses. Also untill atleast 2018 skulls were an ordinary fashion motief some called “Goth lite” in the UK with what you might at first glance think was “polka dot” actually being little skulls of the skull and cross bones variety. They were quite popular with 20-somethings who were most definately not right wing in their outlook.

When you look at the mask that’s being worn in the salute photo, it’s ill fitting and too large and very noticably different than ones seen in other photos… Look at the bear chair one see the difference?

As for the “blue lamp glow” in a reflection, I’ve got a blue LED lamp or two that go with the blue glass I have, part of which is two oil lamps you can use on a table instead of candles which at certain angles give out a very similar blue glow, they are not as uncommon or as unusuall as is implied.

So at best a trail of very circumstantial things linked together to push a story line.

I’m by no means saying they are not right, but the pictures are not telling the same story for reasons not explained.

Oh not sure what the “leg cutting” is all about, but you get the fealing she thinks her legs are her best feature and the salute picture does not show any sign of scaring

The other thing is the throat covered. When you look at the “bear chair” photo you see the dress has a matching neck piece with long ends, this is not there in the salute photo.

So lets see what other “evidence” comes up.

Clive Robinson • February 25, 2021 11:26 PM

@ name.withheld…,

How does this work?

Long answer short “It can not”.

History shows that the place with most corruption is the place with most influence. Which in hierarchies is ususual at the top of the heap.

Thus how do you stop the leader going rouge?

Well now ancient sayings such as “Who watches the watchers” how hard a problem it has been down through the millennia.

As William Shakespeare wrote, sometimes the only way is for the layer beneath to pull the leader down. Thus “Et tu, Brute?”[1] but what follows is almost always nasty, such is the nature of “power vacuums”. But even when there is a clear untainted replacment, the inertia built up that necessitated the eventual act of assassination or regicide moves on.

When the inertia does not run down safely but “hits the buffers” is when it gets realy messy and as observed by Thomas Jefferson’s infamous exhortation,

“The tree of liberty must be refreshed from time to time with the blood of patriots & tyrants. It is it’s natural manure.”

You get to a point where it appears inevitable, thus necessary, hence Jefferson’s nightmare it would not happen for at least another generation,

“God forbid we should ever be 20 years without such a rebellion,”

The act of taking a life unlawfully is perhaps societies strongest prohibition, more so today in our soft almost coddled lives, than in previous more short lived and brutal times where surviving to fourty five was considered old aged.

What do you do with a geriatric determined to retain power at seamingly any cost? Perhaps pulling their teeth is the best solution, but will that second tier vote to lock and bar the door behind a deposed leader?

Some would say “party lines apply” but others “He embarrassed them all, and they want their pound of flesh”. Eother way without doubt, he was an “outsider” who “stole the ball” from “the players” and that may never be forgiven or forgotton. Because in their view Politics is a private club with rules, it is for the players, their managers and their sponsors, outsiders are not to be tollerated no matter what the rable may want.

[1] From Act 3 Scene 1 of William Shakespeare’s play “Julius Caesar”, where they all “put the knife in” including Caesar’s trusted friend Brutus plunges in a dager. The literal translation of the Latin “Et tu, Brute?” is “and you, Brutus?” and so more puzzled and perplexed, Julius dies. Then like all murderers the assassins find the murderous act is easier than dealing with the consequences.

Clive Robinson • February 26, 2021 6:22 PM

@ SpaceLifeForm,

Yes. End caps do not match. I have not found any real clear pictures.

That lack of clarity is also a hinderance, because you don’t get a clear enough view of the timers. But the only timers I’ve seen that look like those in the UK are the old mechanical timers for “kitchens” so maybe an hour at most countdown timer… And they both appeared to be at the zero position…

Now if you look up the use of such timers they are generally closed contact / connected at the zero position “as they count down not up”. Thus they can be dangerous to use as they are the equivalent of “firing at rest” thus you need a seperate arming procedure.

The proceadure to use them is,

1, Check at zero and you have closed contacts, and the arming switch is open.

2, Wind the timer around to the delay time.

3, Check it’s now open circuit.

4, connect the battery or switch the timer into the detonation circuit (ie arm it).

Step three is to stop you laminating your self to the scenery.

Now, lets have a think through.

You would not want the bombs going off before the rally as that would have the rally canceled and stop any Capitol Storming plans (which the voice recording more than suggests she had well in advance, as the comment about gloves demonstrates).

So why place them the night befor, especially if arming them would cause them to go off that night well before the rally.

It could be argued that they were placed to be later armed, but that realy does not make sense. Because if you armed them in situ it would be suspicious to anyone who saw you do it. That is,

1, You go upto an unowend bag.
2, You open it and spend thirty seconds to a minute minimum with both hands inside “fiddling”.
3, You then close the bag up again and walk away…
4, You do this whilst dressed like a street criminal.

What’s the odds an observer is going to think you are a thief and call you out or report you to the police, who will then find the bomb…

As I said it looks distinctly odd.

Also the video shows that either somebody knew where the cameras were and deliberatly walked in a route to give “full image” or they had not done even a primative recon in daylight looking for things to avoid. But look agsin at the way the person walked, it was like they knew exactly where they were going, which suggests they had walked that route atleast once before or were quite familiar with the area.

Just another oddity to add to the list.

Normally I’d not be looking for oddities, but as you’ve noted I get deeply suspicious when a certain group gets involved. They’ve effectively been caught out a couple of times before with probably faked images, so I get to look with my “is it hinky” eyes in, and a hand checking the short hairs on the back of my neck.

The result is I’m getting a vibe, not a strong one, but definately one that says there are things here that need more evidence / explaining / insight.

Clive Robinson • February 27, 2021 7:34 AM

@ SpaceLifeForm,

Many of the pages contained instructions for making explosive devices out of simple household products.

Ahh the “Anarchist Cookbook”, better known as “How to blow yourself up at home”…

You can get PDFs online with little difficulty and it’s technically out of copyright.

BUT, you will also find on line a big long list of things that are wrong with it.

On that allways amuses me is distilling hydrogen peroxide using a couple of beer bottles…

Now I do not know what passes for common sense these days but trying to boil a liquid in two beer bottles taped together you would thing would give people pause for thought…

But much of the stuff is pre 1970’s technology and you just can not get hold of it any longer without raising an eyebrow or two.

Have a think about the last time you saw those old screw in light bulbs for bicycle lamps for sale anywhere, it’s all high intensity “White / Clear Water LEDs” these days. Even getting hold of old style “non safety” matches is realy not that easy either.

I would say having a copy of the book is almost a “Confession of Stupidity” not any prowes at “infernal device” making.