Schneier on Security

Clive Robinson • March 26, 2021 6:10 PM

@ SpaceLifeForm,

This is hard to understand.

Not realy, it’s about time the IC and SigInt agencies had a good kick up the backside for their bovine scat “We are the good guys” nonsense.

They are commiting criminal acts, as they are fond of pointing out to other countries by issuing indictments. I said such politically inspired nonsense would “back fire” and now it has, they have been hoist by their own petard.

That as they say is “how the cookie crumbles”.

Google did the right thing, both legaly and morally the opposite of those they pulled the plug on.

This waily waily hair pulling and gnashing of teath is just doubling down on the stupidity.

The claim is as always “major terrorist” or “major drugs” or “major XXX” in one of the is it now 47 “Wars on XXX” the US is running to ensure it’s position.

Look at it another way US politicals for their own purposes outed a CIA operative which is a major crime, they outed a UK boots on the ground operative thus killing him off as an operational asset, they outed a European IC agency by revealing that they had hacked into the webcams on laptops in Russia killing that off as a method, and several more.

This “major XXX” is a knee jerk response more often than not closely followed by the “endangering of US lives” in a “think of the children” FUD campaign.

But whenever their claims have been contested and checked the facts appear not to be aligned with the rhetoric.

But flip it the other way, eleven zero days got fixed, we do not know as nobody has said yet if they realy were zero days. So as was alleged about Russia and China using the same exploits if correct suggests zero days get used by anyone who finds or sees them.

How much harm could be done by these eleven zero days, well we kind of know, when alegadly the Russian affiliates used a US IC zero day as fake ransomware…

So if we are going to have this sort of bull scat flung out by unamed US Gov representatives, perhaps people should issue counter balancing arguments about the harms the “We are the good guys” and “might is right” nonsense is causing.

As far as I’m concerned Google did the right thing ethically, morally, and legally.

So from that point of view not that hard to understand.

But is there a back story on this that is the implication being hung in the back ground. That is are Google “pushing back” against the USG for some reason? If it was Facebook I would not be surprised to see people raise it as a flag in the foreground.

History indicates that the NSA tapped many of Googles intersite back haul cables and that Google were upset about the illegal activity.

So I will reserve judgment on if this is “pay back” or not, but in a way Google has broken a dam the question is will others follow and reveal the truth of what US Agencies are upto, in the same way the US DoJ has done with it’s politically inspired indictments and much flapping of it’s gums.

We all know that with very high probability it was the US Agencies that started spying on other Nations via the Internet, the fact that sovereign nations have seen fit to retaliate in kind and the USG got all sniffy about it does not change the fact that if you throw stones at people they will throw some back as hard if not harder. There is that oft quoted line of “Do unto others as you woud have them do unto you”…

Clive Robinson • March 26, 2021 6:53 PM

@ vas pup, MK, ALL,

Israeli 5-Minute Battery Charging to Revolutionize Electric Cars

As @MK has noted being around a 1MW charging unit is not going to be fun, especially in high humidity or rain.

But also the usual hype gets in the way of a little reality. Back in the 1930’s there were electric vehicles running of large lead acid accumulators. Even back then they knew that the supply of lead was not just finite but quite restricted in availability especially as it was used for many other things including roofing and water pipes.

Move forward nearly a century later and it’s lithium we are looking at. That to is finite but also restricted in supply. Realistically we do not have enough to make anything close to the number of batteries required to switch over from gasoline to electric.

But also we’ve known how to charge a battery in 5-Minutes or less for decades. The process is little different to putting gasoline in a fuel tank.

Just two methods of several that can used are,

Firstly, adding ethonal to a fuel tank to be used by fuel cells.

Secondly, by swapping the electrolite liquid in a battery that does not undergo chemical change to the electrodes.

The second is intetesting because the electrodes do not undergo chemical / physical change thus will last many thousands of charge cycles unlike more mainstream batteries. Esentially the charge station consists of two tanks, the first contains the depleated electrolyte from bateries. This electrolyte passes through a charging cell and goes to a second tank and holds the recharged electrolyte to put back in batteries.

The downside is that the energy density is low and the electrolite chemicals are realy quite unpleasent not just to humans but the entire environment.

Clive Robinson • March 27, 2021 3:49 AM

@ SpaceLifeForm,

That said, I am very curious to discern what op was burned.

We may never get to know the reality of the situation, because the IC agencies do not like being embarrassed in any way for various political reasons.

If as indicated eleven zero days were being used, then that is quite profligate usage indicating one of three things,

1, They have zero days to burn.
2, They think the zero days have no shelf life.
3, The target was sophisticated in it’s defence.

Whilst they agency might have zero days to burn, the reporting was that the zero days were all related to one code base. Thus they might have been a “find one find them all” single root cause that slipped through automated test of the code. I guess we will get to know more on that in the near future. It might also be that some other AV/malware organisation had already reported one or more of the zero days so the count down clock was already ticking.

But lets consider the implication of a sophisticated target. That is one that takes a serious approach to defending their ICT assets, thus might need that number of zero days to get past their defences.

The fact that they are overly cautious in defence when compared to others does not in any way make them a threat short term or long term. That is they may be a company doing research into security or other communications etc and a SigInt agency want’s in on things early for various reasons. Before others claim “Good guys don’t do that” or similar mantra, we know that is far from being true, the Five-Eyes do it routienly and they’ve be caught at it in the past.

The one that comes immediately to mind is the attacks against cryptographers and similar that occured through BelgaCom[1]. What we would actually call “industrial espionage” plain and simple, and something I know from experience GCHQ has no qualms what so ever about doing. As well as handing over the information gained to “favoured manufacturers” to build equipment for them[2].

Then there are “alied governments” there is a long history of the NSA using the likes of the Olympics to get inside of the security perimiters of host nation telecoms agencies to spy on their leaders phone calls. We have good reason to believe that the US sees the EU as a significant threat to it’s economic position and has for decades been spying on the EU and it’s leaders in various ways, including back-doored crypto kit via a certain company in Zug Switzerland, and using attacks against EU leaders mobile phones[3].

But ask yourself a more important question,

“What evidence is there that “terrorists” might have the level of sophistication to need eleven zero days?”

The answer is of course “none that we are aware of”. Because we know that they do not trust networked electronic communications, ever since a missile landed on a person using a satellite phone. Which got further reinforced by drone strikes. That is they learned quickly and appart from doing reverse attacks to cause drone strikes on civilians thus bad publicity for US and other troops they tend to do their high level security some what differently. That is using trade craft methods of physical communications that smugglers have used for centuries that are well tried and known to work and are very resource intensive to get into and any intercepts become obvious.

Hopefully that will give you an indicator on what operations have been effected, and they are not the ones the article quotes would lead most to believe.

[1] https://www.pcworld.com/article/2093700/prominent-cryptographer-victim-of-malware-attack-related-to-belgacom-breach.html

[2] Duncan Campbell knows about it as “UK Security Services” stole his designs for detecting telephone taps like the “infinity decice” where an RF carrier of near MW frequencies was used to jump the small capacitance of the “hook switch” in the phone. The Security Services then got Marconi to make similar units for the Security Services and other Political, Diplomatic and Military services to use.

[3] https://www.rt.com/news/272491-wikileaks-germany-tapped-chancellor/

Clive Robinson • March 27, 2021 6:13 AM

@ MatkH, SpaceLifeForm, ALL,

Thanks for the link to the FT article on hydrodynamics and the Suez accident.

I did nor read the FT article for “pay wall” reasons.

However I suspect it was about the “Bank Effect” part of which is similar in effect to two ships moving close together then getting “sucked together” by the “working fluid” and fun things like the Venturi effect.

The thing is as the vessel aproached the port side bank the water would have speeded up at first and the preasure would drop, sucking the stern of the vessel closer to the bank. As the gap closed the water at the side of the vessel would become to constrained thus getting funneled under the esentially flat bottom, which would suck the stern down. You can actually see this effect in large vessels as they enter shallow shipping channels. But due to the shape of the bows more and more water gets pushed in beyween the bank and the vessel and a very fast nonlinear change happens. The suction at the bows gets suddenly reversed flipping it away from the bank, whilst the stern sees increased suction. The vessel “spins on a dime” but inertia still keeps the center of mass moving in the last direction. This causes the vessel to roll to the leewards side away from the bank forcing the bows downwards and in effect sucking the vessel down into the water.

What hapens next very much depends on the shape of the hull, but it’s known from barges that are relatively wide and flat that a lot of energy gets transfered into the water which like a spring gives it back. This either lifts the vessel or propelles it in a vectored direction very rapidly.

Years ago I saw a demonstration of this at the UK admirality Research center next to the National Physics Laboratory in Teddington South West London a little over a third of a century ago. They were trying to develop a “3D” imaging system using cohearant ultra sonic sources and were having problems (in effect lack of computing power, and lack of recording ability).

There is some mathmatics that has been developed but you get “cusps” around which chaos plays thus the models are way to sensitive to the inputs to be of use in real time predictions.

Clive Robinson • March 28, 2021 4:54 AM

@ MarkH, SpaceLifeForm, ALL,

The dig goes on …

There’s a tune for that…

But today and tomorrow are the spring tide…

If they are going to use tidal assistance the high tides of these next couple of days are the time to do it.

If they miss the high spring tides, and if they need them, then it’s a couple of weeks till the next opportunity.

Clive Robinson • March 29, 2021 2:04 AM

@ SpaceLifeForm,

There may be a Gold Man trying to chase a Bear near a Canal.

All driven by the braying of an ass behind a hedge, that thinks it’s a tiger…

https://www.zerohedge.com/markets/archegos-fallout-nomura-crashes-after-reporting-record-2bn-loss-transactions-us-client

https://www.bloomberg.com/news/articles/2021-03-29/goldman-sachs-is-said-to-see-immaterial-losses-from-archegos

It’s going to prove intetesting this morning in Frankfurt, London and later New York. Apparently US Media and Chinese Tec stocks have been dumped into the market to cover a series of trades gone bad, and the Asia markets were runing red yesterday as things plummeted.

https://www.bloomberg.com/news/articles/2021-03-28/traders-are-glued-to-their-screens-and-set-for-volatile-open

Hold onto your hat and watch what might just be the “destruction derby” to “open the season” get rolling.

Put simply there is a problem production in the West has been well down for more than a year now. However the stock markets went on a rise, backed by not a lot… Thus many are expecting the laws,of financial gravity to start to play as what goes up spectacularly tends to blow like an exploding bubble or crash down like a meteorite digging a hole in the ground.

I guess we are going to have to wait and see…

Clive Robinson • March 29, 2021 4:19 AM

@ name.withheld…,

Synder interesting states something relative to speech that I find compelling, “The collection of profitable utterances have lead us to the big lie.”

Synder appears a little slow on the uptake over this.

I’ve mentioned before the the three basic typrs of “ist” and their “isims”.

They are,

1, Those who blaim / attack due to their own inherant failings.

2, Those who have been harmed by individuals who they see as part of a larger group thus blaim any member of a group.

These are basic “tribalism” effects that appear to be built in by “nature” but certainly bloom under “nurture”.

Which leaves,

3, Those who profit by playing up “isums”. That is they can see money / power / status in dispute and thus encorage dispute in some way or another.

The thing is where someone sees and seeks profit, others come along to make their own profit in turn. You have a successfull business in some places and some one will come along demanding protection in some form or another…

Clive Robinson • March 29, 2021 6:27 PM

@ Umm,

It’s fairly clear you have not a clue what you are talking about.

The point @JonKnowsNothing is making is that you have way way way more to worry about not taking any one of the jabs than you do taking one hardly anti-vax.

In fact the odds of death currently from any of the vaccines is so low even if contra indicated your risks are about 3500 times more likely to die of COVID if hospitals are not saturated and many tens if not hundreds of thousands if hospitals do become saturated.

Your risk of death from COVID-19 being exponential with age, with the original viral strain. New strains being more infectious, are now starting to move the curve downwards so even the young are now much more at risk than they were[1].

If the new Brazilian VoCs that are the successors of the P1 VoCs etc[1] that devastated Manus get you and hospitals are saturated, then your odds are not good at all. As reported,

“60% of all ICU patients in São Paulo, Brazil are now between the ages of 30-50 years”

Yes read that twice 30-50 year olds are 60% of the patients fighting for their lives in Intensive Care Units, with a low probability of making it…

[1] https://www.webmd.com/lung/news/20210324/variants-of-variants-seen-in-covid-ravaged-brazil

Clive Robinson • March 30, 2021 1:15 AM

@ Weather,

Sterling engines are abit like thermoelectric modules, simple but not high efficiency based on the low temperature they operate at.

Actually when you do the maths on practical systems Stirling engines work where the supposedly more efficient Internal Combustion Engines(ICE) can not. But more importantly unlike ICE that require very very expensive fuel that has been endlessly refined very inefficiently, very expensively, and expensively transported, Sterling engines will work on “rubbish” fuels effectively, thus over all as a system way more efficiently.

People need to stop discussing how to make individual sub components of a system the most efficient they can and look at how to make the entire system from sunlight through to usefull “work” more efficient.

Stirling engines will work in places where energy would otherwise just be lost to the atmosphere[1] for instance the exhaust of an ICE contains enough energy to drive a Sterling engine to get sufficient work to run a water pump in a water system to get hot water via a heat exchanger in the system to heat a well designed dwelling and supply other domestic needs.

[1] The ultimate form of polution is “waste energy” from “inefficient systems”, something that many people for some reason have a hard time getting their heads around the implication of. In part because “knowledge gets siloed” into “research domains” thus they optomize their part with little or no regard for the whole process or system.

Clive Robinson • March 30, 2021 4:27 AM

@ JonKnowsNothing, ALL,

At this point, 1 year into the pandemic, it is hard to believe a MD / RN cannot fit PPE correctly

They probably did fit it correctly…

Most PPE is at best an “impediment to movment” of pathogens. That is, it is a probabilistic barrier system with hole size many many times that of individual virus capsids. So all they realy do is lower the viral load, not remove it or render it unviable.

If you remember a year ago almost to the day a friend died in an unfortunate accident.

He and I had been looking into the design of a full face mask and an air filtration unit to remove dust etc prior to going into a very light weight plastic cylinder the size of a 3ltr soft drinks bottle, that would have battery powered UV-C leds to actually damage the Organic material of both viral and bacterial pathogens to render them non viable.

The reason for the design was because we both knew that PPE is only so-so effective as it has no “anti-pathogen” function just limited effectiveness filtering.

Sadly his untimely death put an end to further product development.

Clive Robinson • March 30, 2021 10:20 PM

@ SpaceLifeForm,

The vessel is en route to the port of Rotterdam, sailing at a speed of 0.1 knots and expected to arrive there on Mar 31, 02:00.

Yes it does look odd untill you realise that neither the speed or ETA are accurate…

0.1 knots is about 180m/hour or 5cm/Sec…

That is the vessel is not underway under it’s own power, it would not be able to maintain any course at that speed. So is either drifting or being towed (the latter being more likely).

Secondly the destination and arival time is very probably based on it’s original logged itinerary.

Nobody realy expects computers to spot even the obvious unless programmed to do so. After all they have either eyes, nor ears so can not see the data is just “garbage in” thus it must be “Garbage out”.

Clive Robinson • March 31, 2021 4:32 AM

@ Nik, lurker, Weather, Winter,

This is exactly what I need, living where it is cold most of the year and having strong sunlight. It does strike me as odd that there are no systems a consumer can buy.

You could try “Sun Power Ohio” they have certainly made Stirling engines for various out in the middle of nowhere places for over half a century.

However these days their product line up suggests they appear to be selling mainly product that uses the stirling cycle in reverse as “cryo-coolers”.

https://www.sunpowerinc.com/our-technologies/stirling-engines

Clive Robinson • April 1, 2021 7:34 PM

@ SpaceLifeForm, ALL,

It may be pure smoke. Seems like they are more concerned about foreign animals than their own human population.

An animal vaccine against SARS-CoV-2 is a necessity if we are ever going to stop disease reservoirs in domesticated and livestock animalls.

Whilst we know swine do not get COVID for some reason, we know they do get several variations on Swine Fever that absolutly devistate high intensity raised live stock and critically effect protein supplies to the world. Have a look at the figures for African Swine Fever in China and Europe and Bird Flu in chickens, ducks, geese, turkeys all of which are again low cost intensively reared protein.

You will see what could happen if more livestock species than just mink get infected by some variant of SARS-CoV-2, the cremating piles would be burning 24×7 for weeks and food prices would sky rocket even vegitarian/vegan foods would be hit hard.

But there is also the issue of “endangered species” our mark on the world and the resulting stain on humanity is the number of species we have driven to extinction or very close to it in the past couple of centuries. Morally, ethically and for our own survival we need as large a diversity in creatures as possible, mono-cultures are a sure recipe for disaster (look up what the likes of honey bees do for us and other wild creatures). So we need to ensure endangered species survive as well otherwise we die out for other reasons that could be prevented.

Clive Robinson • April 1, 2021 10:21 PM

@ SpaceLifeForm,

You might want to read through this,

https://www.wsj.com/articles/suez-canal-insurance-claims-loom-as-ever-given-blocks-shipping-11616837401

Basically the owner has insurance and commensurate “deep pockets”, so the world and his dog are going to try to make a claim, even if they never bothered to insure against “delay”.

Without seeing the actual court papers that will probably say very little currently it’s a “Keep of our grass – armed response” type action. In essence what ever you claim they will claim back pluss lots and lots of legal fees (hence induring and filing in the UK). The net result is to force any claims from the owners of the vessel to those opperatongbit at the time.

I would expect another court case to arise over “act-of-god” or similar, and in the end as I mentioned before, ultimately the vessel was under the pilotage of the Canal/Port authorities which are owned by the Egyption Government who are now probably the “insurers of last resort” and would have bern even if they did not own the canal…

In essence upwards of 10billion in court costs and settlements are going to rest on the word of one or two “Expert Witnesses” as to if what happened was,

1, Reasonably predictable,
2, Reasonably preventable,
3, Who was on authority.

The scary thing to watch out for is “re-insurance” and how it was shared out.

The theory is that re-insurance takes a very large risk with comensuratly large fees and spreads them thinly across as many insurance syndicates as possible.

However a few decades ago LLoyds of London was brought to it’s knees and hundreds of “new names” lost their homes and other assets with some committing suicide after having been dealt with by Mary Archer, –the wife of disgraced Tory peer and perjurer Lord Archer– who headed up the “Lloyds Hardship Committee” and very clearly understood she was in effect protecting fraudsters from their victims they had created by taking away any asset the could use to start legal proceedings.

This all started because of something that’s been called the fradulant LMX spiral where re-insurance was actually sold round and round in a circle under a different name at each step[1]. The result was a massive fraud set up by one or two senior members of LLoyds who were “old names” to divest themselves of known liabilities that were arising (asbestos risk from the 1930’s etc) onto the sacrificial “new names”.

I was shortly before it all blew up, being “courted” as a “new name”. Which on the face of it was a very attractive propersition[2]. It got to the point where I had done my paper work and I asked somebody I knew who was in the same regiment as I who actually worked as a broker on LLoyds floor to check my paper work over. They asked a few questions and made two statments,

1, Your paper work is in order.
2, The syndicates paperwork is questionable.

A couple of further questions gave rise to the term “dustbin syndicate” which was basically a tar pit for “new names” to be foisted off with all the risks and fees of reinsurance whilst the “old names” carried no risk and got the plumb business at the highest rates and also gathered the windfall of new name fees.

Needless to say when it came time for me to sign on the dotted line, I asked a couple of searching questions. The looks I got told me all I needed to know so, I did not sign. Unfortunately a couple of friends had signed, and they were not so lucky and basically got hurt. One of them named opd names to the media including effectively stating one senior member of Lloyds had less morals than an ally cat, something a Judge picked up on and used in their summing up…

[1] https://ehsthelongrun.net/2019/05/14/delusions-of-competence-the-near-death-of-lloyds-of-london-1980-2002/

[2] In essence you could get 7% return on your underwriting, which was limited to twice your provable assets so in reality 14%, then there were all sorts of other tax breaks and incentives. So in todays terms with about 300k in “cash assets” and 1.2million in “property assets” which is what a midle aged mid to upper middle class family would have would get you 210,000 as an annual return…

Clive Robinson • April 2, 2021 7:06 AM

@ SpaceLifeForm,

Someone was dismayed at the results. To me, works exactly as expected.

This happens due to the order you do things in, which is not always left to right (C is notorious for this issue being entirely undefined in argument passing and often bites people trying to do fancy tricks with the likes of printf() and friends)

I wonder what would have happened if the year had been 1999?

(that is though 2000 was divisable by four, which would be a leap year, it was also divisable by 400 which makes it not a leap year…)

Clive Robinson • April 2, 2021 12:05 PM

@ Winter,

As the laws of physics allow quite a lot, the question should be changed.

That rather depends on which hat you are wearing.

Also remember only about 1/7th the world have ever seen/touched a Personal or Work computer, even less of the population uses one on a regular basis. Something like 2/3rds and rising fairly rapidly of Internet connected people use a “Smart Device” they do not realy “own” as that privilege is retained by one or more of,

1, OS Developer (walled garden)
2, Hardware developer (unremovable apps)
3, Service Provider (Over The Air control and unrenovable apps, drivers, etc).

Thus they are at best “tied in cutomers” more often “PII striped product”. Either way open to all sorts of attack beyond their control.

So,

So, instead of asking “how can we avoid leaving a trail?” we should ask, “How can we balance privacy and security with a meaningful life?”.

Is a bit of a moot point.

Not only can by far the majority of Internet conected individuals NOT stop being “owned”, the changes in legislation by lobbying from both Government and Corporate entities, ensures absolutly unless you take control that you can not in any way have a choice other than that expressed in the 1983 film WarGames, when the computer says,

“A strange game. The only way to win is not to play.”

The other way to win is to not play by their rules, and “Say NO and mean NO” and be a right royal pain about how you say NO.

Untill everyone understands that and does that then they will either “sleepwalk into” or be “bit by bit herded into” the trap laid out which you list with,

We cannot buy, pay taxes, educate, join any type of social gathering, complain at the police, work, rent or buy a house or car without leaving an eternally persistent trail.

The funny thing is last century and for all recorded time before that we did all of those things without leaving a digital trail, thus just over a couple of decades ago your comment of,

We must admit that we cannot meaningfully participate in social life nowadays without leaving a digital trail.

Would have been laughable if not considered compleatly insane.

Thus there is absolutly no reason why we should not lead a life without computers, smart devices, mobile phones, credit cards, payment cards or any other of the near usless junk and services that actually make our lives oh so way more complicated and steal our privacy.

Living off the “digital grid” does not in any way mean leaving society to live in a hole in the ground in some remote place wiping your backside with stinging nettles because there are no amenities or the real comforts of life. I pay cash in shops and use checks with utilities. And I stubbornly refuse to be “data raped” by those entities and corespond on paper with anyone I do not have a fairly close personal relationship with.

Do I lose out, no not realy, do I gain anything, yes actually quite a lot. As I point out to people if they want to do business with me, they do it on my terms, not theirs. If they chose not to do so there are other people queuing up who will, such is the nature of a competative economy.

Clive Robinson • April 2, 2021 3:15 PM

@ Winter,

I was differentiating between PC personal/work computers which were and in theory are still not “locked in” thus the user has “ownership control” and “Smart Device” users who are “locked in” where the user does not have ownership control.

The advantage the PC group has is freedom to run what ever software the chose or more importantly develop themselves free of censorship and control.

Smart device users usually have to go through “walled gardens” for their applications which gives them not just limited choice even if they do develop their own apps in effect they can be “censored out of the market” Apple for instance have routienly not alowed apps in that are seen to be better or more open than Apples own apps.

With mobile / smart devices the figure I last read was around 63% (~2/3rds) had Internet capability. Your figures give 60% (3/5ths) which is not exactly a lot different. Either figure will do the point is the trend is “locked in” censored and controled beyond most peoples abilities to change smart devices are connecting to the Internet at a vastly increasing rate compared to “not locked in” Personal computers including laptops.

That is people through fad or ignorance are giving up their liberties for no acceptable reason.