Schneier on Security

Clive Robinson • March 25, 2022 5:34 PM

@ SpaceLifeForm,

Let them eat Bitcoin

It won’t work for Russia…

All coins are uniquely tracable, that’s what the “Public Block Chain” ensures (to stop double spend etc). So individual coins can be quickly and easily “black-listed” and their value will drop dramatically in any exchange that wants to trade with the west etc.

So in effect they will be of no use except inside a very small group of nations. Such an arrangement will almost certainly “fracture” as the bit coins have no intrinsic worth or for that matter “trust”.

But money transfers could be done in other ways in a much less costly way, it is what “junk bonds” were created for.

But that is not the issue that is going to cause the big problem…

Trade for physical items in any quantity will show up on satellite imagery… And physical items is all that Russia has to offer, and will certainly need fairly soon (think spare parys etc). Any ships, planes and other trafic flows will be identified and those involved in any way will discover that they will be “sanctioned” as harshly if not more so.

So take Turkey for instance, it might buy Russian Oil, Minerals etc, to “wash-up” to other nations, but they know they are going to get a sizable hit internationaly… So the price they will want from Russia may be even less than they are getting with the Ruble…

Basically it sounds like desperate men trying to talk a lead life-belt into to flying…

Clive Robinson • March 26, 2022 3:16 PM

@ name.withheld…,

More whitewashing via search engines. Again, in performing a search on Biblical…

Remember when it comes to religion “free screech” is a one way street.

They can preach any old lies, barbarity, and worse at you, but you are an evil blaspheming heretic fit only for nailing up, stabing in the gut, or being burnt alive or stoned to death for even saying “hang on a moment…”

The law in most places says religion has rights you as an individual do not have.

Such inequality is not the last bastion of aging conservative curtain twitchers, it is worse way worse, it is a form of enslavment where you have to pay to be enslaved…

Mankind would do a lot better for it’s self if it adopted a little honesty in life. Rather than chasing something that does not exist, maybe we should try to be the best we can with what we have got.

But then certain types would loose power over others, and they feel that can not be alowed.

So rather than face the wrath of religion Silicon Valley kow-tows to those them yet waves two fingers at the legislature…

What does that tell you about society?

As I’ve noted in the past I had to write a thesis for a DD and I chose to debunk deities… Whilst there is more evidence than anyone person could read in a lifetime about the callous manipulation of mankind through deity worship, there is actually no evidence for the existance of deities, just cultish brainwashing techniques.

It’s easy to conclude that religion is about political control, and an attempt by the landed gentry and other rich, to not pay for what needs to be done for a functional equitable society.

Clive Robinson • March 26, 2022 8:28 PM

@ Mafia,

With regards “Gladio”, if only my old kit bag could talk… Actually it does not need to, as much of what Gladio was “supposed” to be about, but what Allen Dulles tried to force it to be is now comming to light in European archives.

The name “Gladio” was Italian, and used for their “Stay behind” forces, in various places. They consisted of three parts that were not supposed to know about each other, and in some cases required to assasinate each other…

Broadly the three parts were,

1, Political
2, Civilian
3, Military

They were deployed in three basic types of territory,

1, Enemy nation (like CCCP)
2, A nation which the enemy would invade / overrun (like West Germany).
3, The controling nation (like UK) should the enemy invade.

Mostly the political and some of the civilian –like law enforcment– were natives to the territory and they got “recruited” (much like “agents” for spying). As they would pass background checks etc.

However civilian businessman were not always natives some were those that got “embedded” from the control nation a decade or so before in either enemy territory or territory that would most likely be invaded.

Their jobs were to behave in certain ways to disrupt things for the enemy but fascilitate in various covert ways the control nations goverments intentions.

Then there were the military…

They kind of fell into two groups,

1, Established in territory
2, Drop-ins to territory

The later group also known to some as “The awkward Squad” had dual roles,

1, Establish and maintain long term inteligence posts.
2, Drop in immediately in advance of special forces to establish not just inteligence but communications for command.

But also some were to support Diplomatic Missions that had to fall back under enemy advance or may even have been over-run.

There is a myth in the UK that the SAS are the first in and last out… Often in reality they are not, nor are the inteligence services, it’s communications and logistics specialists from the military who are very definately “Not official Cover”(NOC) but may well be “under flag”. As such you were expected to respect the various Hague and Geneva Conventions (something the CIA under the psychopath Allen Dulles were unsurprisingly very much against).

Sometimes the Ops were “Milk runs” where teams of two or three “bricks” would come in and support “black bag job” operatives to get them to a place to gather physical intel or place surveillance equipment. Often those doing the black bag job were actually “contractors” on a daily rate which matched their status as expendable and fully deniable, some were natives of the country who had previously “emigrated”. Whilst getting in and setting up was generally an orderly process sometimes extraction was not…

But as the article you link to points out Gladio had a different meaning to some people and lets just say during the 50’s through 70’s the US placed to much emphasis on commercial technology solutions not boots on the ground HumInt and that let them down badly. But… The CIA under Dulles and successors realy were on a cuckoo’s nest circuit and bumps, where about the only place feet touched ground was the bottom of a bourbon bottle.

It’s now known that the CIA either carried out directly or more often through local proxies all sorts of atrocities against even quite moderate Union Leaders and left wing politicians. Where “left” in CIA eyes of Allen Dulles was considered anything less than rabidly fascist or stacking up “the disapeard” like cord-wood in a forrest. Something they were doing not just in Europe but South America as well. Allen Dulles and his brother “did many favours” for US Corporations to ensure access to raw resources like copper etc.

https://www.cambridgeclarion.org/press_cuttings/gladio.mi6.sas_graun_5dec1990.html

Clive Robinson • March 28, 2022 12:50 AM

@ olga,

One might reasonably have expected “RSA” Security to have come up with a system that didn’t require any private key to leave the token, or at least didn’t require the key to be programmed by the manufacturer.

I realy do not think you understand or know sufficient about what you are talking about.

For such a system to work there needs to be a “shared secret” between the token and the softwear on the server the user of the token is trying to log into. Such a secret needs to be generated and supplied to both the token and the software running on the server(s) the user is to authenticate to.

Now some things to note,

1, What ever “seed value” generation process is used it would have to leave the confines of the generator to become “shared” by the Token and the authentication software on the server(s) the user of the token authenticates to.

2, The authentication software on the server(s) the user authenticates to, needs to have the “seed value” for every RSA ID key that is to be used with it stored on it to work.

3, The security of the deployed system is only as strong as the weakest link. Which was in nearly all cases, not the technical system RSA supplied, but the OS and Apps running on the server(s) user(s) authenticate to, and the behaviours of the user(s) and owner of the tokens. .

4, The owners of the RSA ID token system were at best “cost not security” sensitive.

5, Because there was nothing stopping the “owner” of the RSA ID token from changing the shared “seed value” on the token and the authentication software on the server the user authenticates to if they wished to. RSA provided the tools required to do so.

6, The fact the owners of the tokens chose not to change the factory setting of the seed value in each token they owned, even though RSA provided the tools to do so was because of 4.

7, As previously indicated RSA kept the factory set “seed value” for “Customer support” reasons[1].

8, It was the cost of the customer support increasing that caused RSA managment to make the changes they did for “shareholder value” reasons.

What needed to be changed was not the technical design of the “system” as you insist, but the “behaviours” of those people involved. As I’ve pointed out in 3, the weakest link in the use of the system is the human behaviours, which you would have realised if you actually understood sufficient about the system.

As for,

What makes them and their customers look even worse is that they still seem to be selling them, and I don’t see anything about a redesign

As I’ve pointed out it’s not the technical design of the token system that was the weakest link, or what actualy failed but “human behaviours”

As for changing those… Good luck.

Trying to go around and change humans with non security oriented priorities to be more secure is going to continue to be a task of Sisyphus[2] our host has pointed that out as have others for some considerable time now. But it goes back long before even that. Because if the acient Greeks understood this basic fact of human behaviours, how come you appear unaware of it or chose to ignore it?

[1] Part of this would be to guarentee that each token that left the factory had a unique “seed value”.

[2] https://en.wikipedia.org/wiki/Sisyphus

Clive Robinson • March 29, 2022 5:35 PM

@ Olga, SpaceLifeForm,

First things in reverse,

The Clipper chip was very definately backdoored, and very much by overt design, and can not be argued otherwise. That is what the “Law Enforcement Access Field”(LEAF) was all about. Also as it turns out it was doubly backdoored possibly by accident but more probably by somebodies covert design.

Look up Mat Blaze and his investigation that showed how to by pass the LEAF control because the field size was way to small thus so was it’s work factor. Thus the NSA and others “in the know” could use Clipper without the LEAF being functional, thus turning the overt backdoor off covertly” making their communications via clipper secure from the LEAF overt user security bypass…

Which brings us onto the RSA issue.

The problem with saying that the RSA token is backdoored is a lot different. It’s built to a published specification and as far as I’m aware it functions the way described. The spec has had “many eyes” look it over and are content with the way it works. As these people are from all different places around the world, it would appear unlikely they are all colluding.

Thus any deliberate covert backdoor would have to be something rather special to evade all their eyes. The problem with that is bad as the RSA implementation might be considered, it’s actuall stronger security wise than just about everything else in use…

How do I put it politely, looking back historically, as far as I can see every MS Win NT OS version has been continuously vulnerable one way or several. Thus the only question would have been “Who knew of the vulnerabilities and when?”. That is the “zero day question” of “Cyber-Weapons”.

That is based on history all the current MS OS’s have a very high probability of having serious security vulnerabilities. It’s just a question of who knows them and when they found or were informed of them. Likewise all of the Apps in the MS OS that have any kind of connectivity access.

So the only way to make an MS environment –or any other consumer level OS/Apps– secure is by the mittigation of “segregation” by “total issolation”. That is if no entity can get to it via any kind of connectivity local or otherwise then they can not attack it. Such levels of issolation are at best impractical with most modern motherboards, and probably impossible to achieve in most normal environments (rumour has it that Win11 will not be able to run “off-line” not just by default but by deliberate design).

But it’s not just MS OS’s that have this problem, the same can be said for nearly every other consumer grade OS with user Apps on board runing on consumer oriented hardware. The nonsense currently coming out with Googles Chrome and Android products, shows without doubt they have been quite deliberately backdoored by design for Google to make profit.

So putting a clever backdoor in the RSA tokens that only run on consumer OS and consumer Hardware level systems would be as we say in the UK “guilding the lilly”. Because a sophisticated attacker could if they can get connectivity to the consumer level computer easily bypass the system security and get access to the required “seed values” for any and all users tokens on that system. Once you have those you can access any server that a given token works with, you don’t need to attack the RSA database.

The reason the customer “seed value” database exists, is as I said it ensures that the seed values are unique, or atleast unique within an owners domain.

But also the “customer support” issue… If you do not put a new seed value on a token, then you have the backup of RSA Customer support database when the server you are responsible for goes belly up and you have to rebuild it (as frequently happens with some consumer OS level Servers).

Users being (ab)users at the best of times, servers get felled like daisies in a hurricane.

Those (ab)users are known to be impatient at the best of times and woe betide any SysAdmin saying things were held up by “RSA Customer Support”, as the tokens are generally hated by (ab)users who also see “Single Sign On”(SSO) as an afront to their ability to get their job done and their bonus earned.

So using RSA Customer Support as the equivalent of “Online bullet proof backup” would be very appealing.

Especially when,

1, Changing token seed values needs some hardware, and a process that whilst not difficult is less easy than leaving the RSA suppled defaults.

2, Changing seed values carries way more responsability than leaving things the way RSA supplied the token defaults.

RSA senior managment came to look on it as just another “revenue stream” to be optomised for “Shareholder value” and did not consider the issue of,

“Having all your eggs in one basket on a table that can easily be toppled over.”

But… can you argue RSA designed it originally as a backdoor? Not realy because they did not put the required failings in place untill later much later than you would have expected if that were the case.

If you want to argue that RSA backdoored their other Crypto Software, now there is evidence for the fact they did that with the NIST RNG standard. In that they took a large handfull of cash to give priority to the NSA Back-Doored algorithm. If they knew the NSA recommended DRNG algorithm was backdoored or not is irrelevant. The “bribe” alone should have made them deeply suspicious, but for some reason they chose to fail to look…

Somebody else did, and now as they say, that NIST “approved NSA algorithm is toast”.

Have I made that sufficiently clear?

Clive Robinson • March 30, 2022 6:47 AM

@ ResearcherZero, JonKnowsNothing,

I hate to tell you this, but Australia has been well ahead of the U.K. for decades. It started dismantling and mothballing our quarantine facilities and the quarantine department in the 1990’s

I thought @JonKnowsNothing was only talking about “covid” with the 2.5 year marker.

If you are talking about the longer term, well I’m old enough to remember the 1970’s and not just the Vietnam war footage on TV, but only being able to see it three or four nights a week and reading books huddled in blankets due to the power cuts.

Vietnam was not the only war visable in my then young life, there was a power strugle between the Government and those who did manual work, and the Goverment was visably loosing and for good reason[1]. It effectived others rather more strongly than it did me. One such was Margaret Thatcher the so called “milk snatcher”. As she gained powervshe started an intetnal almost civil war against “the workers” which she paid for by “cutting services”, “Selling off national assets”, “market liberalisation”, “anti-worker legislation” and much more. The thing is “slash and burn” applies to much more than agriculture, it applies to all types of production. So though her policies appeared to be successful they were abything but. They were infact a compleate disaster. The same applies to Reaganomics and other such nonsense, such as the “free market” and all that neo-con claptrap pushed by the likrs of the Chicago School of Economics into MBA’s via silly mantras of “not leaving money on the table” and much more.

So yes the “war on resilience” to build private war chests to fight a slow burn civil war that few are even aware of due to much propaganda, has been building apace since the end of WWII and took a significant upturn in the 1980’s, which is what you are seeing part of in retrospect.

However based on predominant history it will only come to an end with WWIII. Usually the side to come out worst from such conflicts, is the one that appears to have the bigger wealth as seen by others at the outset. So WWIII will be about the US and it’s conspicuous consumption, then other parts of the West. It will as in all wars destroy much that has built up, some at the bottom will see improvmentd, but they will be fractional compared to the losses.

Thus “ratchet step by ratchet step” humanity spirals downwards and destroys it’s self…

As no doubt @Winter can point out this war cycle will continue to happen as long as we or those we put in power venerate those of the “Dark Triad” (narcissism, sadism, socio/psychopathy). There is a maths game that is used to illistrate some of the core concepts, look up the “Hawkes and Doves” and successor models. Supprisingly they are not that difficult to get your head around. One thing that comes out of it is “shortetmism” especially of “slash, and burn” to “run with the profit” is always at the expense of the longtermism of survival. That is longternism takes the excess today and invests it in the future thus not only builds it’s self, but builds resilience against the natural swings and random purtibations of existance. In short “Robbing and destroying the now, kills the future” with no way out in a “bounded and finite environment” that the world is.

[1] It started with the “Beer and fags for the boys” policy after WWII, Britain was destroyed, more thoroughly by “the war effort” than it was by German bombs and terror weapons. Basically every part of manufacturing and transport was compleatly knackered or too out of date and inefficient to bevof use to rebuild the economy and make the switch back from “war work” to “piece-work” in factories and the like. The country was actually starving to death, and if it had not been for the ordinary people in the US sending countless numbers of food parcels I suspect my parents would have starved along with thousands of others. There was a fundemental reason that food rationing was still happening in Britain even in the 1950’s, as a nation Britain was entierly bankrupt, our treasuries and industries gone and not replacable, and we could not grow sufficient food to feed ourselves as our population was too large. When Britain got support from abroad via the George C. Marshal plan, the British Politicians then in power unfortunately decided to waste it on providing quick fix cheap consumables rather than rebuild industry, national infrastructure and thus a functioning economy. US Politicians however still assumed that Britain was sitting on vast wealth from the Empire and wanted it effectively as there slice of war reparations. But Britain did not have vast piles of treasure hidden away it was sitting on nore had it been. The British Empire lasted as long as it did because it was mainly a “Trading Empire” not a “Parasitic Empire”. Britain sustained it’s wealth from two things, industrial processes and trade. We imported raw materials and energy, and turned out “value added” goods in return, and we lived off the difference. Such apparent wealth is not based on vast troves of treasure, but economic churn and the differential you create by hiding information (the real “hidden hand of the market” is deception, fraud and theft but it keeps the merry-go-round running).

So what the British Politicians failed to do in not restarting the economy was a death sentence. Made worse by US politicians like conquistadors of an earlier age seeking fabled mountains of gold and finding only rocks.

The sad thing is “conquest” element of the “empire” was caused by what we would now call “super power proxie wars”. Europe had had way to many wars for over half a millennium and that was why people were moving out into what they considered “un-claimed territory” and unfortunately took their power strugles with them. Much of the nonsense that happened in the Americas was because of this (and the fact they had started out thinking it was potentially the other side of Asia). The other part was “merchant venturers” quite deliberatly using propagander to get their home nations to subsidise them with military support (see what Cecil Rhodes and similar got upto).

The simple fact is a parasitic empire colapses fairly quickly because it costs to much to defend against those it oppresses, and not just the eventual opportunistic “barbarian hords outside the gate” you get told about from the idealised “Roman Empire” nonsense used as propaganda for hundreds of years (if you think about it the barbarians would have been easily defeated if the Romans had not been so badly weakened by having endless internal wars caused by power struggles and driven by economic stagnation).

Clive Robinson • March 30, 2022 6:28 PM

@ SpaceLifeForm,

Re : Ubiquiti is suing Brian Krebs

Apparantly the back story through a court filing is,

1, A senior developer at Ubiquiti came up with a get rich scheme.

2, The developer used own AWS credentials to download data through a VPN he payed for via PayPal.

3, During the download an issue at the Developers ISP caused the Developers IP address to become known.

4, The developer then tried to get 50bitcoin from Ubiquiti.

5, Ubiquiti did not pay.

6, Developer pretended to be a whistleblower or some such and contacted journalist.

7, Story went out Ubiquiti share price dropped 4billion.

8, Eventually US Law Enforcment went and had “a chat” with the Developer whilst taking some of his personal possessions, and he denied having payed for the VPN at the time.

9, The developer is facing the usual charges including lying to Federal Authorities.

As for the 4billion loss by Ubiquity, well others have pointed out that Ubiquity will have problems proving that was not down to their own actions/inactions/behavioirs in part or full.

Time to rumage in the kitchen cupboard for a real pan, popcorn and vegtable oil, and turn up the heat…

Not a brown envelope of that strangebrew stuff of hydrolised this that or the other you throw in the microwave and “duck and cover” lest you get hit by tinfoil hat rays. That a certain company apparently stocks equipment to generate…

Remember the plot line,

“Betty!! Don’t go in the kitchen!”

Appears some has not heard it on the air…

Clive Robinson • March 30, 2022 7:07 PM

@ SpaceLifeForm,

RE : Not buying

Note they are only saying the system as supplied is still the same functionality as before…

In what you quote they’ve said nothing about,

1, Software vulnerability
2, Protocol vulnerability
3, Standard vulnerability

Or if configuration data in semi-mutable memory on the device has been changed…

Now consider it was only some terminals in Europe not all effected, and what that might imply.

If I had 2cents to gamble with I’d put it on 1 or 2 to do with a “test harness” or “tech support” device similar to that found in Cable TV “set top boxes” that was somehow remotely accessable. At a stretch it was possibly “triggerable APT” that had gone into semi-mutable memory at some point in the past –which needed a “stay-alive” signal to not be activated– that a factory reset clears out.

If my guesses are correct that would imply the terminals are still as vulnerable after a factory reset, as they were when they were supplied.

Now… If no similar attacks happen again, we might make a further guess along the lines of,

The vulnerability was accessed from the Internet through the backend systems the company supplies and they have now fitted a filter of some kind, to trap such attempts again[1].

If you think back we’ve discussed such “stay behind” / “Deadman’s switche” APT on this blog since the days of the “Obama Big Red Button” anouncment. Because it’s the obvious counter to such “Molly buttons”.

[1] https://www.urbandictionary.com/define.php?term=molly-guard

Clive Robinson • March 31, 2022 12:40 AM

@ SpaceLifeForm, ALL,

The otherday I noted similarities in the older SolarWinds attacks and the more recent Lapsus$ and the faillings of other organisations…

Well it appears I’m not the only one to notice that such people have similar habits,

“Lapsus$ and SolarWinds hackers both use the same old trick to bypass MFA”

https://arstechnica.com/information-technology/2022/03/lapsus-and-solar-winds-hackers-both-use-the-same-old-trick-to-bypass-mfa/

In this case the article is specific about “Multi-factor Authentication”(MFA) which is unfortunatly seen by way to many peoplw as the way to solve all those password problems.

The problem is, in the over six decades since passwords were thought up the world has moved on significantly and much has radically changed.

Whilst MFA is seen almost as an incantation to substantiate a “gold standard” by some who want a tick in the auditors checkbox. You can only do this through either “rose tinted glasses” or “sepia prints”, that filter out the raw realities of the more modern age.

Back in the 1950’s and 60’s computers were so rare, and so difficult to use, they only did one job at a time, and there realy was no concept of users or that they needed to be authenticated except by the security guard at the door, or building entrance.

These days we may use more than half a hundred different servers a day, many of which we may never use again. If we consider our usage by proxie such as search engines then our usage could be up in the tens of thousands a day most of which we never ever visit directly now or ever.

In effect the computing world has been stood on it’s head, but…

We still need to do somethings “the old fashioned way” and actually interact directly with a host system either as directly as a keyboard, mouse, microphone, and speaker alow. Or more likely at some distantce via some “shared communications” medium. In the first case, physical security is still possible, in the second I guess “not a chance” would not be too far off of the mark.

The majority of humans are about “communications” and “sharing” but mostly not about “trust”, we call it “being social”. You only have to be on a far distant edge of “gossip central’s web” to be aware of this, or within ear shot of the office water cooler / coffee pot. Worse for most “security” is seen as authoritarian, “secrecy” as paranoid/criminal, and “privacy” as anti-social except for the messy things in life where embarrassment is a major risk.

So “authentication”(AuthN) and “authorization”(AuthZ) whilst not quite alien concepts to most “neurotypical” humans are very definately seen as a hinderance at best most of the time.

So what do we get… well from what the majority see as, –the lets face it– ‘non-neurotypical’ humans we get the technological response of “We can fix it” with a “Single Sign On”(SSO) or similar concept. Worse if you are realy unluky by some “bio-metric” do hicky… But that does not rely fix the AuthN nuisance factor and lets be honest as way too much web development so acutely shows, most developers take the non-neurotypical view by apparently having no concept of the standard social concept of “roles” and their segregation etc, so AuthZ is a mine field we have yet to realy come to[1].

Because of these changes and trying to make things work MFA is actually very nearly as much of a liability as passwords and in some cases more so.

In fact with Silicon Valley’s Mega-Corps using MFA as a way to get more valuable data on people, arguably MFA has become a “Health Hazzard” in it’s own right. But worse in that particular usage type MFA has opened up way more new attack methods for criminals and worse, than most people realise.

So MFA is in fact more dangerous, in those forms, than old fashioned passwords, and it’s almost certainly not going to get any better, which does not bode well for the future.

[1] The concept of an individuals sepetate “social roles” and the fact neither Governments or Sillicon Valley’s Mega-Corps want you to have them is an issue I mention from time to time. But few in ICTsec want to hear about let alone even consider “roles” in the easier non social sense as it applies to tasks.

So “roles” has like the famed “head in the sand” posture the developers have instinctively adopted, left them looking, both undignified and highly vulnerable. Worse, with most normaly people having a fairly good idea of what outcome is likely to happen (historical note, the “Stocks” held those who had offended in a similar bottom upmost position and were frequently placed on the village green outside of the local tavern, for the convenience of the passing patrons not the offender).

Clive Robinson • March 31, 2022 4:50 PM

@ SpaceLifeForm, ALL,

My original “test harness” comment,

https://www.schneier.com/blog/archives/2022/03/friday-squid-blogging-unexpectedly-low-squid-population-in-the-arctic.html/#comment-402506

Clive Robinson • March 31, 2022 5:16 PM

@ vas pup,

Researchers test far-UVC lamps that kill bacteria safely

UV-C is generally not safe near humans as it can go through the dead skin and do DNA damage below.

Far-UVC is of a higher frequency and mostly does not make it through the dead skin layers so does not do DNA damage to humans.

Bacteria lacking the protection of dead skin cells are vulnerable under certain conditions… But caution needs to be excercised because with some mediums, bacteria will thrive in them safety as the medium like dead skin cells blocks Far-UVC.

As a rule of thumb, all mediums respond differently to EM energy at different frequencies. So can be,

1, Transparent to some.
2, Opaque by scattering to others.
3, Reflective to some.
4, Absorbant to others.

Clive Robinson • March 31, 2022 6:22 PM

@ SpaceLifeForm,

If I had to chose one, thr most likely would be,

Were select modems already backdoored?

As you, I and others have discussed over the years “APT as a Deadman’s Switch” is a very valid stratagy to turn into reality as an attack method.

Just the fear of it could stop a nation “puting up the shutters” on the “electronic frontier”.

The fact that every neo-con mantra chanting idiot that enters managment ignores this rather obvious point is more than somewhat scary. Especially as the also strive to make everything more vulnerable by removing as much resiliance and defence in depth as possible does not fill me with any kind of confidence they are “safe behind the wheel”.

But them I’m an engineer of many forms with many scars earnt through others at best cupidity, if not down right malicious behaviours (making “Disaster Capitalism” look almost tame in comparison).

Clive Robinson • April 1, 2022 6:23 AM

@ JonKnowsNothing, ALL,

Re : This is the line the USA LEAs use when someone has gotten their nose(s) out of joint.

You can add,

1, Gordon Welchman
2, Peter Wright

To your list, neither were US citizens, and it was UK PM “Mad Maggie” Thatcher they upset…

I’ve mentioned in the past that my name has shown up involved with DMCA take down, I don’t know why, and Google will not say.

So it confirmed my view I’d taken that the US was not a wise place to travel to based on what happened to Russian programer Dmitry Sklyarov. Who had legitimately and legaly reversed engineered and reported that Adobe used XOR with a short fixed string as a protection mechanism…

https://www.eff.org/uk/wp/unintended-consequences-seven-years-under-the-dmca

I have also mentioned that I nearly got my collar felt back in the 1980’s for what at the time was the perfectly legal investigating and reporting on a weakness in the BT Gold system and the very diliberate misrepresebtation by BT in the press.

It was only my “sixth sense” that kept me being “entrapped” as slightly later happened to two others over BT Prestel security failings, even though I had warned them and our other mutual friends and aquaintances of my then suspicions…

Well fairly recebtly via the UK National Archives, it shows I was indeed very lucky to have escaped. The entrapment I nearly got caught in had been personaly ordered by “Mad Maggie” Thatcher.

She was in the process of trying to sell off BT and obviously wanted the best price she could get. Having a teenager, bring bucket loads of “cow bird droppings, on her parade” was not something she was going to allow. So she issued the equivalent of a Fatwa or if you preferr “Off with their heade, action this day” instruction. We were thus marked out for “show trials” but first we had “to be caught with our hands in the pot” as it were.

The fact I dug my heels in and absolutly refused to play, even though my credibility was repeatedly challenged[1], saved me.

But I’m glad I did listen to an older journalist who had once been under State Surveillance[2] back in earlier “labour times”, when talking to union leaders was considered “treason” an idea “Mad Maggie” had brought back…

Any way I’m now glad, I’d declined an offer to go to the US for a “job interview”… The sort of crap that got people into is not something you want landing on you.

That’s not to say I did not later go to the US, I did and have friends there who these days also tell me I probably got “lucky by chance”.

A lesson in life,

“You do not have to be a criminal to be treated as one or turned into one by those who find you inconvenient, or usefull as an example to others.”

A reality even US MSM Journalists are waking upto…

[1] I had given fairly detailed instructions in writing that was way way more than what these days we would call a “Proof of Concept”. Even a child who could barely read and not type could have followed them… So when they said they wanted a denonstration I asked myself,

1, Are they idiots?
2, What’s in it for me?
3, Are they prepared to pay me consultant rates?

So as I’d caught BT out having already changed things and lying about it, and the fact they were not going to pay just made me think it was some hooky publicity stunt at first to discredit me.

But more preasure arose and I just became what some said at the time was paranoid… I in effect issued a “no way, no how, jose” edict and refused to entertain any further discussion. In one case having very pointedly and loudly saying NO, and when it persisted walking out and slaming an office door.

Then odd things started to happen, it became clear that there were things wrong with my phone line, and when a BT engineer tried to convince me that the problems with bad line noise and interferance comming off of the line was some how my fault with a multimeter I chucked him out on his ear. But there were other odd things, the wife of a neighbour had said the workmen I’d had around were “odd”. But even though I had not had workmen around I did not immediately realise what she had seen. But then I remembered that things in my place had been moved… I’m one of those “untidy people” that stack work up in heaps, but the heaps are not random piles, a bit of each thing sticks out so I can see it thus immediately put my hand on it when needed, and things were most definately not as I’d left them. As a couple of friends had “emergancy spare keys” and occasionaly “stopped over” to “doss on the couch” I thought it could have been one of them. But when I phoned them up, not only did they say no, as if by magic the “line noise” issues disapeared. All most odd… Or not[2].

[2] Back then I knew quite a few journalists like Guy Kewney and later author Neil Gaiman (both who encoraged my unsuccessfully to write). I got introduced to older journalists as a kind of “intermeduary” to the very young “home computer types”. On having a few beers on night, I mentioned the facy BT were a bunch of liars, and got asked more… A couplevof the older jornos looked knowingly and took me aside and suggested that I needed to keep an eye open over my shoulder and being paranoid “kept you alive, alive and at large”. Which to a twenty sonething orphan full of “piss-n-vinegar” trying to make a go of things kind of fell on deaf ears. So one of them told me the story of what happened to another journalist and “State Surveillance”… Any way shortly there after it all blew up one way or another.