Schneier on Security

Clive Robinson • April 16, 2022 5:03 AM

@ Leon Theremin,

Can You Insert Hardware Trojan Spyware IP into an IC at the Fab? Yes

This is realy old news.

@RobertT, @Nick P, @Wael, myself and others discussed the ins and outs of all of this something like a decade ago on this blog.

In part it was why I spent more time on “Castles -v- Prisons” as it’s potentially the only way to deal with such issues.

As for,

Russian Elbrus CPUs produced in Russia

If they ever get to see the light of day, why should anyone trust them anymore than product from America, China, Europe, France, Japan, South Korea, North Korea, Taiwan, UK, etc?

There is a saying about patriotism and idiocy both ruining a nations collective IQ.

Clive Robinson • April 17, 2022 4:08 AM

@ vas pup, ALL,

Re : Web3: What is it? How does it work?

We’ve been through this befor, it will be an unmitigated disaster.

The crypro-coin shills have been given a new place to scream their nonsense and all those who foolishly put their money into block-chain tech and the like see a new oportunity to try to make it back from new fools.

Oh and there is that new nonsense of Non Fungible Tokens to pretend is an investment in black tulips…

Web3 is a very definitely a “con” and people would be wise to stear well clear of anything to do with it.

Clive Robinson • April 18, 2022 12:02 PM

@ ResearcherZero,

…strong circumstantial evidence suggests a nexus with Spanish authorities.

You could also include the French and German authorities on that.

Their recent illigal behaviour in recent times towards Catalonian politicians, suggest they have way more than “a little skin in the game”.

Oh and then there are certain super power parties to the East and the West, who would very much like to be “panty sniffing” around the Catalan for stratigic advantage.

Whilst France, Germany, Russia and UK/US have their own malware, they also want “deniability” and no doubt currently the UK/US would gladdly see Spain get it in the neck, thus cause a lot further disruption in Europe.

Remember, the US State Dept Policy despite changes in executive, has very much been to “Destroy Europe” as a viable entity this century. Thus effectively stop another Super Power of larger Population and Economic viability than the US forming.

So do not rule out various “false flag” etc operations.

Spain is very much on the US “5h1t list” for various reasons, and leys just say there has been a lot of US activity there.

Remember the relationship the NSO had with Israel, and in turn the relationship Israel has with the US. Especially when it comes to clandestine activities of the very questionable kind. Since the days of Ollie North etc, those agencies have very much tried to work not just at arms length through “friendlies” but also to get the “friendlies” to set up “pasties” and “usefull idiots”.

What better way to get “Intel” than to “alow” the Spanish to gather it? Whislt unbeknown to the Spanish, the NSO say has backdoored the software that aggregates, so the NSO think that Israel is looking over the Spanish Shoulder and has convincing evidence of that (which they actually can not use). But in reality it’s the US, looking over NSO’s shoulder at Spanish activity through various potentially “Spanish” fronts/cut-outs.

It’s a typical sort of “Smoke-n-Mirrors” setup that is actually not that difficult to set up provided people are carefull[1]. But repeatedly they have not been sufficiently carefull, a case of way too much in the way of “wrong organisational incentives”… Effectively the old issue of a mad rush into pushing forward an attack with no or too little thought as to defending flanks, rear, and supply lines, with the obvious consequences[2].

But with sufficient care a false flag can run successfuly which is why “Attribution can be hard”.

Oh funny one for people to think about…

The usuall Communications advice given is “use VHF and UHF” as “it’s very short range”…

Actually it’s not, those little Boafeng UV5R hsndsets that cost only $20-30 are used by people with little more than those “tactical antennas” to work not just “Low Earth Orbit”(LEO) satellites but also APRS and similar upto the ISS 500km up in space… Likewise some of those old US Mil Sats are getting “Pirated” woth equally as low cost equipment.

Fun little fact, it’s very easy to make a very light weight broad band antenna underneath a hobby drone or RC model Aircraft. This can be connectd to a “Software Defined Receiver”(SDR) that is as small as a “thumb drive” which in turn can be connected to one of a whole variety of Gumstick miniture “Single Board Computers”(SBC) that can connect via WiFi networking back to a “Ground Station”.

Such a system flying at 200-300m in the air has a very very large “RF footprint” effectively a 50-62km say ~30-40 mile radius.

With the right “Open Source Software” it can do some rather interesting Communications and Electronic Intelligence gathering. Unlike the mil systems where a lot of the grunt processing is done local to the receiver thus needs a big aircraft. The use of wireless networking enables the grunt to be done on the ground with laptops…

Something I don’t think the various “Super Power” militaries have given very much thought to untill recently…

The days of using VHF/UHF because it makes you more covert due to the “line of sight issues” actually now makes you very vulnerable…

This should not realy be “news” to the older readers here who have seen the increase of “spy in the sky” observation of mobile phones in crowds and what has been pulled forward on those Dec37 wanderers in places they should not be…

But as some say, sometimes “you have to join the dots”.

Oh for those that are curious about if they could do this themselves, the answer is “only too easily” but my advice is whilst “drones” sound like a good way to go I’d start with Radio Control Model Aircraft, they can stay up a lot lot longer with a heavier payload, they are quieter and more importantly can fly faster.

[1] Though the CIA has not been sufficiently carefull… There was the loss of agents in China and Iran due to very poor communications security… Then there has been those “Open Source Intel”(OSInt) types who have via the likes of ADS-B tracked back from funny flight paths all the way through several layers of Cut-Out’s back through CIA fronts, to discover that the CIA has been carrying out “Domestic Operations”[2].

[2] All very embarrassing, but a demonstration if you need it that due to the rapid pace of technology, the pedulum is swinging back. The Agencies assumed they had an advantage through technology, not realising that the technology was evolving so quickly that it was giving ordinary individuals faster paced technological advantage over the Agencies who are not keeping up for various reasons, not least is they do not employ anything like the best in the required fields. Also they have a poor mindset, when it comes to technology, back upto the 1960’s and 70’s it was the military pushing technological development. That had stoped befor well before the end of the last century. Now it is consumerism that is pushing technology and supris suprise neither the Agencies or in several cases their “Main Contractors” are keeping up with the pave of technology.

Clive Robinson • April 18, 2022 6:31 PM

@ SpaceLifeForm,

This might bring back memories of time past,

https://arstechnica.com/tech-policy/2022/04/microsofts-tactics-to-win-cloud-battle-lead-to-new-antitrust-scrutiny/

And “How leopards don’t change their spots”, just try and hide in the dappled shade under a different bush…

I hope the EU actually turn around and seriously “fillet them this time”.

Clive Robinson • April 19, 2022 5:54 AM

@ ResearcherZero,

… multiple suspected instances of Pegasus spyware infections within official UK networks.

Think of the ancient philosopher Sun Zhu’s proverb,

“Keep friends close and your enemies closer”

It goes back millenia even though many think of it as screen dialog from The GodFather. “Keep your friends close and Film.

Supposadly it just means that you need to keep on closer eye on what your enemies are upto.

But that’s not the way it works in the inteligence game. Where,

“Watch your enimes actions but see your friends real intentions”.

Is the way you have to think. Mostly what your enemy does is fairly predictable, but only someone you mistakenly trust can truely betray you. So,

“The more you trust, the more you can be betrayed, but the less you trust, the less trust you get from others”.

A bit of a conundrum for many in the relationship game from individuals all the way up to super powers. Just remember “Special Relationship” is a “two way street” thus people have different destinations on that same road. Oh and “special” has more meanings than there are shades of pink in the most spectacular of sunsets.

Whilst NSO is/was a “private comercial” entity that in no way means that they did not have “special relationships” with one or more “state intelligence entities”.

Thus look on NSO as a multiple lane express highway with multiple complex interchanges…

It’s sensible to assume that NSO must hwve had a special relationship with the Israeli Government, and through them the US Government, if not directly certainly indirectly.

Further the way NSO’s systems worked, made “watching” the data gathered for their multiple clients easy…

Thus it would not be to much to assume that NSO’s software acted like a network of measuring instruments. Each of which fed back to a specific control interest at a close level (Certain Arab and other “resource wealthy” but politically and educationally limited states being at this level).

But then step back a little, such “close level” activity tells a part of a larger story.

To see why lets consider “industrial espionage” where the aim is to gain some advantage. As a supplier you know what rate you are supplying “raw feed” or “producer” stock to a manufacturer. But what you do not onow is how much is going into storage and how much into production. Knowing this, could be adventageous… So with an “Industrial Control System”(ICS) a couple of pressure sensors on either side of a valve give little information directly, but even over a very short period give an indication of producer flow. That ‘n an ICS would be “regulated” at a “close level” by a specific “control” system. That sensor information as part of a larger system over a longer period gives an indication of a larger process such as into a manufacturing process. Something that would be used as part of a “Supervisory Control And Data Acquisition”(SCADA) system. But this also indirectly reveals product production rate and output. So would be part of financial planing etc and so on upwards. Thus knowing the various sensor readings could be used to indicate things like potential share dividened etc or if as a supplier you could increase the cost of the raw feed / producer stock a little or even up your own production.

What applies to an ICS process whilst easy to see, also less obviously applies to all processes, including running a country.

Hence one part of “National Security” is very much “Economic Security” which makes it a “control nexus” for many not just the Sovereign Government but all those other Governments as well…

So think of NSO as an “instrument head” and work your way back up the chain as it were and identify interested parties as you go.

For instance due to various events in the recent past certain Middle East Governments have found “old friends” have become somewhat “cold and distant”… Due to those Sovereign Rulers “bad behaviours” such as butchering journalists that are employed by Newspapers owned by “Mr Amazon”.

Thus putting such malware onto political leaders phones to get an “inside track” on “old friends” thinking is not exactly unexpected.

Now consider how usefull such information might be to say Israel or the US?

So lets say a certain Arab leader through one of their Princes puts NSO spyware on a UK Gov Officials phone. He gets intel that he can use to plan with thus is happy. But the Israeli Government gets the same data without getting involved thus has better than “Plausable Deniability”. But also the US Government gets the same data with better than three solid layers of plausable deniability inbetween…

All because of the design of the NSO system…

In many ways it is what CarrierIQ was alleged to do back a decade or so OK to the vast majority of US citizens who had mobile phones. Obviously with “collect it all” carried out by the NSA at the “Internet router” level inside telcos they had not just a full ringside seat but full “deniability”…

It’s this sort of thing that is very obviously going on, that very few people actualy think about.

And when they do think about it and join a few dots, and possibly investigate a little it gets quite scarry for several people who would much prefere such things not be common knowledge…

Clive Robinson • April 19, 2022 3:58 PM

@ SpaceLifeForm, ALL,

Re : uefi vulnerabilities lenovo consumer laptops

Remember that Lenovo have some quite serious “previous” on this.

There was that persistent malware they put in their consumer laptop BIOS’s that nomatter how often you wiped the hard-drive the Lenovo malware would just be loaded yet again…

Clive Robinson • April 20, 2022 4:22 AM

@ Winter,

Wy do you think submarines are still invisible?

Firstly I did not say they were.

But they are not visable in the conventional sense fairly quickly in water.

Because conventional vessels have a horizon distance considerably larger than they are and submerged vessels do not.

With regards vortex shedding and the like, all objects in water displace water and any movment of water with regards to the object likewise has to be displaced. This requires “work” to be done which requires energy use at that point, and that energy use is in theory detectable.

However the same is true for “rocks on the bottom” and any other object.

But the point to remember is the refraction effects on absorbtion of coherant energy in the form of waves. In effect it reduces the area over which a submerged object is “visable” in relation to it’s depth.

Put simply whilst submarines are not invisable they can be very hard to see especially when they are deep and not moving at speed.

But your argument especially that derived from your “Dutch Navy” example has an implicit implication that I’ve discussed in the past. Which is the same problem we see with space vehicles and aerial vehicles and infact most vehicles. It is “the size required to support human operators” issue.

I’ve spent a large part of my engineering life doing one of two things,

1, Designing the fat out.
2, Pander to the fat’s needs, wants and desires.

Fat being an abstraction of the “human brain” which is made mainly from fat.

Vehicles designed around the former are very advantageous compared to the latter by several orders of magnitude in virtually every resource domain.

As I’ve noted in the past on one of my “work benches” is a cube that is just under 10cm on the edges. It is one of the larger prototype “Space vehicles” I design bits for. The smallest I guess is a little bit bigger than an Apple AirTag. It consists of two PCB’s one either side of a rechargable “coin cell” and outside of the PCB’s two high efficiency solar cells. Antennas and sensors are mounted between the PCB’s around the periphery of the coin cells. They are “functional vehicles” but “without the fat” and are good for way more than a year of opperation in LEO and VLEO. As it happens I’ve also worked on the design of maratime autonomous and remote vehical systems, both surface and submersible. Again “designing out the fat” was significantly adventageous even when it is “remote”.

The design of autonomous “mines” and “torpedoes” that can sit on the sea bed for years whilst it will have it’s complications is already in effect a “solved problem”. A vehicle or “delivery system” has been designed long ago for resource exploration and explotation just look up ROVs. We also know that the design of nuclear devices to go in torpedoes and missiles is a solved engineering issue as well. The question is of course humans being what they are is, “Who will be first?” to put the two together, assuming of course they have not done so already.

Compared to the cost of a submersable vehicle to keep a lump of fat alive and happy for even a few hours to the cost of doing the same for a “package” that will hold a ton of conventional explosive or similar volume/mass it’s effectively a “No brainer” in quite a few peoples lumps of fat…

Clive Robinson • April 20, 2022 7:28 AM

@ Winter,

But I think current technology is not yet at a level that we can outsource complex policy and tactical decisions to AI.

You realy are “over thinking it” there.

You do not need AI for a weapons system to work. Ever since the earliest of alarms there has been a very simple algorithm in play,

1, Look for sign.
2, Is sign there, if not then 1.
3, Trigger event.

The sign is a “differentiator” find one that works for Group A but not Group B and the algorithm works. When Group A is “in sight” then the “event” happens.

Such a differentiator can be a string a foot of the ground pulled taught against a balance. Small creatures pass underneath, larger creatures trip the balance past it’s tipping point thus “trigger” the “event” such as a “sapling sprung snare”.

As technology improved that ten thousand year old trap got updated in “The great war” and later “World War Two” we designed knew detectors for different differebtiators, hence passive acoustic, pressure, and magnetic, and active measured distance and similar mines.

No AI needed or involved for that.

As for delivery systems, I’ve sailed solo whilst asleep, using no more than a mechanical auto-stearing mechanism and a mechanical log. The “apparent wind” when sufficiently “off shore” stays relatively constant for hours at a time, thus can be used as a refrence. A look up table or mechanical calculator can correct for water movment based on the well established and reliable phase of the moon, so a mechanical clock/calander and assumed location as the input. The result a sailing vessel purely by the wind and simple mechanics can travel a straight line for a distance.

It’s actually very similar to the auto pilot in the V1 “cruise missile” only that used a mechanical compass, an air-screw to control the speed and when to stop the engine.

No AI needed or involved for that.

The use of assumed or calculated position can be used in a look up table and a complex course can be negotiated by moving on a series of straight line approximations, with the flextion or course change points more commonly called “way points”.

No AI needed or involved for that.

Once you have such a table, you can update it whilst it is being used. In effect it becomes an updatable buffer that can be made to appear endless (ie a circular buffer). Designing a simple “state machine” to do this requires justva clock source, a counter and a modulo function (mask all but the bottom bits). It’s what all sequential processing engines we call “Universal Turing Engines” have under the hood at the most primitive level. Known and established beyond doubt in the earky 1930’s several years before WWII.

No AI needed or involved for that.

But we also know know beyond doubt, that what underpined Turings Engine was also known to Charles Babbage at least a century prior to that. Probably before the 1820’s. He certainly knew all about data in tables and how to use them and was probably famillier with the “Jacquard Box/head” used on Dobby looms in his teenage years. Jacquard’s box was an incrementing “lookup table” using punched cards, the idea behind it started around a century earlier than that. Oh and the same principle was used in “Hurdy-Gurdies” that “Organ Grinders” used, much to Babbages anoyance and later life littigation.

So the principles of all that are required for a mechanical device to autonavigate a vessle used as a “Delivery System” were in place, and could have been made in the first quater of the 17 hundreds.

No AI needed or involved… Just technical accumen, and the abbility as Jacquard did “to bolt it all together”.

For my son, for fun we built a very simple state machine out of lego bricks and the “Technics rods” etc. The “lookup table” and “modulo opperator” were made with what many would call a “cam rod” which as any mechanic knows is the “sequencer” in a piston type engine…

The same sort of “cam table” can still be found in mechanical switches driven by a timer motor in washing machines still being made in the 1990’s. They were also still in use in “Ladder Logic” used in “Industrial Control Systems”(ICS) “Programable Logic Controlers”(PLCs) into atleast the begining of this century for high reliability “safety systems” used for the likes of “Emergancy Shutdown” sequencers. The simplicity of the cam being it can be easily driven by any kind of motor including what is a knob, acting as a “hand crank”.

The idea that we need AI in any way shape or form for weapons delivery systems is ludicrous. Some would note that it’s an attempt to keep a failed idea of some “faux current relevance” as a “side show” as a “Scary Monster” to distract people away from the real issue,

Some people with “Dark mental traits” such as being psychopaths will just build or get others to build the weapons systems. That they want to use, or more importantly sell, to gain power thus control to achieve their objectives.

They care squat-diddly about AI or the “socialogical arguments” around it. Either it furthers their objectives or it is irrelevant.

Trust me except where AI can be used to achive a specific objective as a “cut-out” by putting “hidden outcomes” in it, it is irrelevant to even high functioning psychopaths.

AI is currently irrelevant, except for the fact it can be used as a steping stone to hidden objectives that would scare most beyond comprehension if the actually saw and understood them. The psycopaths do not need AI, they never did, nor will they ever, except as some kind of way to achive objectives faster, using less resources, diverting attention etc.

In reality they see the world as three groups. Group A is their target group, Group B are others, not including themselves, thus they are Group C. Their primary focus is,

1, Keep Group C functional.
2, Ensure Group A is dealt with.
3, Treat Group B as irrelevant.

Thus their requirment for a “discriminator” is that it triggers for as many of Group A as possible. Never for Group C, and as for Group B, if some fall into the discriminator window and trigger it, it is irrelevant unless it effects the first two requirments negatively.

So for a weapon it must render Group A out, not blow up in Group C’s face, and as for Group B, well collateral damage happens…

Clive Robinson • April 21, 2022 5:16 AM

@ SpaceLifeForm, ALL,

Re : Oracle screw up the crypto pooch by zero…

What’s the bet it gets a blog page to it’s self this week?

This is NOT good… And somebody was right to say it should get a “Perfect 10” on the “OMG how bad can it get” scale.

It is in quite a few cases the equivalent of a “Golden Front Door Key” that certain “Politzi” motivated people have fantasized about.

But how did it happen… All to easily I suspect, here is a guess,

As most readers hear know “Divide by zero” is something you don’t do so software people test-n-avoid.

But, software developers of what they consider “time critical” or “constant time” code hate “tests” with a passion as they not only “add time” they “add indeterminate time”.

Or more correctly from the security asspect “add input dependent time” which creates a “time based side channel” that can often easily be used to leak confidential information like “KeyMat”.

So there is quite an incentive not to do such tests…

Especially if there is an assumption that “in the real world that ain’t ever going to happen”…

After all if you throw a dice,

“How long will you have to throw it to get five hundred “even” numbers in a row?”

The glib answer is going to –incorrectly be– something like,

“The universe has not been around that long, nor will be”.

Even the correct “Buzz Lightyear” time scale response of,

“To Infinity and beyond!”

Is not regarded as a “time scale” but as a “never going to happen” point in time…

Which leads to the mistaken thought of,

“This test will always fail, so why do it?”

Or similar…

But that’s not the only “code minded” issue that comes up. There is one so common it should some how have a prohibition seared into the hearts and minds of every person who even dares to think “Can I do…” or “Could we do…” with a computer.

It all starts with the notion of “business logic”, that is there is some core algorithm or procedure the computer is going to do. It’s what “example code” almost always is. That is, it is stripped of all “Error and Exception Handeling code” and organised in some wanted flow on the excuse of “clarity” or “ease of understanding”.

The results are that people develop a view that there is,

1, Business logic code.
2, Glue logic code.

With sometimes,

3, Error code.

The result is that “Error code” either gets,

A, Left out.
B, Incorrectly implemented.
C, Shuffled to the left.
D, Is “Somebody Elses Problem”(SEP).

An almost “built in by education” and in the some standards –Common Unix, Posix et al– problem is that data thus it’s processing,

A, Moves from the left (side of the page).
B, To the right (side of the page).
C, Therefore “input errors” (on the left).
D, Propogate to “business logic” (on the right).
E, Errors can not be “reliably” dealt with “down stream” (as NO right to left movment means data loss).

Thus the thinking gives rise to a fairly hard and fast but often wrong rule of,

“All error checking should be moved as far left as possible.”

But then there is,

4, Exception code.

Do consumer code developers ever write that? Or do they always opt for “Blue Screen of Death”(BSoD) SEP solutions to exceptions?

Hence there is always “data loss” and “system failure” built into the very foundations of a very great deal of “consumer application” code.

This sort of issue is so common it actually gave rise to the idea of “Design/Coding by contract”(DbC) as a methodology to “try” and stop it, or atleast limit it.

In essence DbC assums three things,

1, Side Effects happen.
2, Left-side “Pre-conditions”.
3, Right-side “Post-conditions”.

The first is an implicit assumption of two facts,

1, You have no right-side control.
2, Your left-side control is imperfect.

But there are three “weasle words” in there “conditions” and “imperfect” and importantly “contract”.

Conditions means “tests” and “imperfect” gives latitude to the designer to “minimise” both the tests carried out and what remedial action is taken (big mistake in the methodology).

But importantly “contract” requires code, in fact two pieces of code for each “contract” on either side of all the “interfaces”. This is generically,

5, Interface code.

But how many interfaces are there actually? Most assume two hence “Pre-conditions” and “Post-conditions. However people either don’t realise or chose to forget “side-effects” that arise because of “imperfect”… Which gives rise to the “target rich” “happy hunting ground” of “bugs / vulnerabilities”…

But interfaces are “boundaries of responsability” if you push something across an interface then it becomes “Somebody Elses Problem” not yours… But what happens if you make it a “Pre-Condition” thus push it left across your “input interface”? Well that automatically makes it a “Post-Condition” on the output interface of the preceding or calling proccess block. If that block is preceading BUT NOT calling then congratulations your push left has become an “exception”… Do you write “exception handlers” for your output interface?

Probably rarely and almost only when you “call” a subroutien. So if you are “writing to disk” and you get an exception what do you do with it?

Dump and Abort is the usual response sometimes but mostly not with a usefull error message in a log file.

So back to “divide by zero” issues… It’s easy to see how the get shifted out of business logic into the notion of interface logic at the input, making it either an implicit exception or worse unimplemented and untested for vulnerability…

But there’s another more subtal vulnerability…

What if there is a test and it branches?

What if handeling it also avoides some or all of the following business logic, or more importantly security steps?

Suprisingly you would think this happens so often it might as well be treated as a coin toss given.

Well somewhere in the above is what Oracle have done in their Java ‘mplementation library code, that is used in Smart Cards and SIMs so a major security blunder what ever the cause, and certainly not tested for…

So “Design by Contract” used?

I think not, or only given lip service to…

Clive Robinson • April 22, 2022 2:13 AM

@ SpaceLifeForm,

Re : Here’s the really dumb part

The reference implementation did in fact do the tests for zero.

Raises the question of “Why?” that is what was the real reasoning, not the excuse they will no doubt scramble together with legal consul.

Which from the list I gave do you favour as “the real explanation”, or do you have another of your own?

I’m tentatively going with the “It aint goner ever happen in the real world so why bother” thinking of someone trying to over optimize library code for “specmanship” or similar reasons.

But they were wrong, it has happened… Because in the real world, not only is their random, there is also chaos and down via agency at work determanisticaly sifting through complexity to exploit…

But of course at the back of some peoples minds will be,

1, By accident or design?
2, If design, with what intent?
3, Is the intent malicious?
4, If malicious for who’s benifit?

To rephrase a song[1],

“Zero is a magic number”

[1] Originally from Disney’s Multiplication Rock from the very early seventies called “3 is a magic number” by Bob Dorough. It was made more famous in the late eighties by “Del a soul” who sampled in the Bob Borough track and added drums and a little scratch acid.

Oh and do remember “3 is a magic number” when considered as a result mod 4… Because the sums of squares are never 3 mod 4. Which is of relevence when it comes to Fermat’s theorem on odd primes being the sum of two squares (thus are called Pythagorean Primes). Hence the definition for Gaussian Primes, which have useful properties.

For some reason my brain won’t let me sleep like a stuck record it keeps spining around…