Schneier on Security

Clive Robinson • December 6, 2021 8:23 PM

@ Ted, ALL,

hi friends.

Though less used of late “the usuall suspects” was a way to refere to the more regular posters and readers of this blog.

If you are wondering where the term comes from watch the film Casablanca.

Where the French Police Inspector tells a subordinate to “Round up the usuall suspects”.

Clive Robinson • December 7, 2021 7:28 AM

@ Bruce, ALL,

Is it now time to mention that it is not only Apple that make such tags?

Apple in effect was a late entrant into this “MESH Network”[1] remote location game, as are Amazon (Sidewalk), Google and Samsung (SmarTag).

The crowd funded Startup “Tile” has been doing what some call “Smart-tag 2.0” since around 2013 nearly a decade ago. Their “Tile Network” is their “MESH Network” remote location equivalent.

Tile were recently purchased for around 200million by Life360[4].

But the technology trail blazers on all of this goes back a long way[2] I got proffessionaly involved in the early 1980’s and had some theoretical and practical experience of the ideas back in the 1970’s.

Look up the likes of Phil Kan (KA9Q) and his predecessors and pre TNC modems,

https://en.wikipedia.org/wiki/KA9Q

What has held back takeup of the ideas and technology for nearly 80years is the size and cost of practical technology and thus the range available. Also the issues with UN controled Radio Spectrum managment via the ITU and the “squable” of arguing state representatives doing politics and spy craft in equal measure.

[1] MESH Networking has been common knowledge in the tech sector all of this century. Originally it became a known in a wider social scale by “disidents” using it in Hong Kong. There are now even “prepper products” that alow “Off Grid” usage of your mobile phone to send SMS’s over distance when there is no cell service.

https://en.wikipedia.org/wiki/Mesh_networking

https://en.m.wikipedia.org/wiki/Category:Mesh_networking

[2] Obviously once a base communications system like mesh networking is “in place” you can do just about what you want to ontop. The trick is getting various things right. One major issue is “coverage” and it’s complex due to the use of “shared resources”. The important rule of thumb though is the more users the less range is required. So higher frequencies with grater bandwidths and lower power result if people look up ARDEN you will see systems with more bandwidth than most mobile broadband. Back when I started we built NE565 or 4046 PLL circuits to generate FSK modems at 75baud for use on HF and VHF using SSB radios… The “home computing” brought the price of microcontrolers down into the “just affordable” range. Just a few years later I was writing DFT and “Numerical Oscillator” code for Z80 systems that did “Piccolo” all in software and worked reliably below Signal to noise ratios where even the best Morse code operators struggled. These days we have Nobel Prize winners writing software that gets even deeper into the noise.

[3] Unknown to many the Amateur/Ham Radio fraternaty has been doing mesh networking since before the term was invented. By using APRS since the 1980’s and other systems earlier, with the ISS taking it into space,

https://amsat-uk.org/beginners/how-to-work-the-iss-on-aprs-packet-radio/

So APRS is now not only globe circling but globe spanning with it’s own “remote location web” sites like,

https://www.aprsdirect.com/

But the person who has the best claim to have come up with the idea was Gorden Welchman, who thought it up as part of his seminal work that gave us “Traffic Analysis” back at Bletchly Park in WWII. With his thinking it gave us not just the mesh concept but remote location updating, and also gave us the Internet that came directly out of his further development on highly falut tolerant millitary networks whilst working at US “think tank” Rand Corporation.

[4] https://gizmodo.com/tile-is-being-acquired-after-apple-s-airtags-made-locat-1848110596

Clive Robinson • December 7, 2021 11:11 PM

@ Ted, SpaceLifeForm, ALL,

Okay. You got me. It did track the car. However it was on his friend’s car for 18 hours. And his friend never received any kind of notification.

Because of a failure of simple logic that Apple’s people made because they did not think things through sufficiently.

And it’s one of those “Oh kick me to wake me up moments” when you realise or get told, but then when you think a little more you realise it’s a problem that,

“You can not simply solve”.

The basic problem is using “a contact” counter or timer to minimise resource issues on raising alarms without false positives.

First a little “scene setting” so you can see how the problem occurs,

Most days people broadly “do the same thing” it’s called “routien” and anyone who has ever done “close protection work” knows it gets you killed.

So you have an a-tag on your keys and hundreds of others have them on their keys or bags. You all pass by randomly and two people might walk down the same road together, or even drive down it and their courses intersect for a while. Obviously you don’t want an alarm being sounded every time that happens.

But another person lets call her Teddy has an a-tag on her bag. You both go to town by public transport. You sit on the same bus or in the same train carriage for upto say half an hour or even more. Again obviously you don’t want an alarm being sounded every time that happens.

How about a two hour or more plane flight?

Likewise again you obviously don’t want an alarm being sounded every time that happens…

How about if Teddy is your new squeeze, or prospective squeeze? And you spend the evening walking to a movie, and having drinks or dinner? Do you realy want a “stalker alert” to come up on her phone from your a-tag? It would be a bit of a mood killer, not to say a little creepy… But then saying on a first date,

“Hi you look great, you’ve a lovely smile, you don’t mind if I ask if you have an a-tag do you? It’s,just so I can register it with my phone so an alarm does not ruin our date?”

Yeah right that one went the way the birds did in autumn…

So the 64,000 dollar question, how long does an a-tag have to be in range of your phone before some algorithm decides it’s not your a-tag but it is being used to track you?

That’s the simple “timer” case…

The slightly harder “counter” case of how often does any particular a-tag have to be in range of you before it decides it’s a “stalker?”

How does that “counter” get effected by that commute to work, or walk to the coffee shop or waiting in the line at the deli at lunch every work day?

So you can see why Apple might set the thresholds way high to stop false alarms.

Now back to your car problem…

Let’s start the day with it in the parking garage under your appartment block.

I know you come down to drive your car to work at seven in the morning so I slip the a-tag out of the Evidence RF proof bag and under the rear bumper of your car just before then. You drive to work for ~45 mins then park up and walk away out of range of the a-tag. In case you don’t get out of range, I follow find your car and remove the a-tag and put it back in the RF proof evidence bag and slap a WiFi “game camera” up on a lamp post etc to watch your car from around the corner in my vehicle etc. I do this over several days till I know your morning routien and probable leaving work routien. Now lets say I know a little about electronics I take an a-tag and take the battery out and put a little timer circuit in their to turn it on and off at certain times that are shorter than Apples time thresholds but long enough to track you…

Now how about at the weekend… I bug your car shortly before you go shopping in the morning. You drive to the market park up and walk away from your car and go out of range of my a-tag. You come back drive to meet a friend and you walk away from your car again out of range of my a-tag. Lets say you go to the gym you park up and walk away from your car and my a-tag. You go out in the evening you park up and walk out of range of my a-tag…

Knowing a little about RF I know where to place my a-tag on your car so it’s range is not upto 300m but 10meter or less… Guarenteeing that when less than 15seconds walk from your car your iPhone is out of range of my a-tag.

The chances are you would stay out of range of my a-tag enough that it does not get triggered because of the false alarm counters have not reached their trigger values…

Yes a more complicated algorithm could work out that it was on your car. But the same algorithm would get falsely triggered by you commuting on public transport.

When you think about it, what ever timer or counter based “false alarm” prevention algorithm is used even quite normal activities would alow a window in which you could be tracked.

How’s that “Kick me” feeling?

Let’s take it up a notch,

If I was a semi-smart stalker I’d have half a dozen a-tags in little RF proof evidence bags, and when ever you stopped up and were out of sight I’d swap one a-tag with another I’d not used recently in some faux-random sequence.

That would stop most more complex algorithms dead in their tracks. But with a little thought you realise that as an attacker there is a slightly better stratagy with a-tag swapping that would stop even quite complex and resourse intensive algorithms dead, which I don’t need to go into.

Because it’s time to look at the issue a different way,

My real objective as the adversary is to fool your iPhone into tracking a variety of tags I have, without causing it to get close to any of the alarm thresholds. But what does that realy mean?

Let’s analyze the issue a bit,

I, knowing where my tags are, know where your phone may probably be, thus where you are. By a process of what is averaging I work out what your travel routien is without triggering any alarms.

But think a little further and you will realise that I can also work out using my own iPhone what the thresholds Apple have set are…

So I can “game the system” as long as it is sufficiently simple.

The next thought is can Apple make the system more complex? The answer to that is “yes but…”. Where the “but” is comprised of,

1, The number of tags(M)
2, The number of phones(N)
3, The average number of contacts(C)

And the resources required for each contact threshold alarm. As this is a C(N^M) problem you can see why they would want to keep the resorces required down by keeping things as simple as they can get away with without raising false alarms.

That is the entire system is designed to minimise it’s ability to recognise what we humans would call “BAD” surveillance “person tracking” whilst maximising “GOOD” remote “property location”.

The problem is technology wise the “GOOD” and the “BAD” are in most cases effectively the same due to the way the technology works.

Untill you get into the more sophisticated “gaming of the system”, where things get a whole lot more interesting. Because beyond a certain point, you start to use multiple tags…

That is it changes what you do as an adversary of the system. Because it becomes not the tags position you are locating but, the anonymouse phone on the user, that is locating the tags for you.

It might sound like an almost hair splitting difference but actually it makes a very significant difference as to what you can get away with without triggering any alarms.

That is look on it as a graph of a tree problem, it’s not the terminal nodes or leaves you are tracking but the penultimate node before the leaves. The more leaves you can present to the penultimate node, the more they look “random” rather than “purposeful” signal to it. But to you, the more it averages the supposadly anonymous penultimate node out from other penultimate nodes and makes it visable. This asymmetry works in the attackers not defenders favour.

Something very few would realise unless it’s specifically pointed out.

Oh and there is a whole bunch of maths just ready made to help become an uber-adversary. Look into “Low Probability of Intercept”(LPI) systems, Digital Watermarking, “Direct Sequence Spread Spectrum”(DSSS), “Frequency Hopping Spread Spectrum”(FHSS), Matched Filters and the real fun MIMO systems. Also “Electronic Counter Counter Measures”(ECCM) or “anti-jam” systems. Even basic “Digital Signal Processing”(DSP) gives information about things like “sampling” which altough on the face of it looks entirely different, is actually very relevant mathmatically you just have to see “sampling” in a more generalised way (think about it in another domain than the time domain).