Schneier on Security

Clive Robinson • July 16, 2022 11:00 AM

@ Nick Levinson, ALL,

“… resistance to surveillance seems to be becoming more open since a theft and offer for sale…”

I’m not surprised, in fact I expected it sooner.

As our host @Bruce pointed out quite some years ago aggregating entirely seperate databases is not a good idea security wise[1].

For some reason in the “West” the majority of people appear to be dumber than sheap droppings. Why we “buy-in” to the big data nonsense I’ve no idea, but as a long con it’s paying off the middle man very handsomely.

The Confucianism that under pins Chinese Society has certain view point advantages over apple pie capitalism.

[1] It’s the old “all the eggs in one basket” issue. There are several downsides,

1, Everything is commonly indexed.
2, Everything is in one place.
3, The place is easy to find.
4, Once defences are breached all data is vulnerable.

Which is great for attackers, but, there are no real upsides for the data subjects, or for that matter the supppsed data holders.

Clive Robinson • July 17, 2022 2:14 AM

@ SpaceLifeForm, JonKnowsNothing. Nick Levinson,

Re : Do you see

It was –past tense– a post that was there, that had two links in it.

One link was to a US Gov site that I got the text I quoted, the second a US CNN site that put the first in context…

Clive Robinson • July 17, 2022 3:30 AM

@ SpaceLifeForm,

Re : More popcorn please

Is best answered by,

“Why am I not surprised…”

With other “social media” sites running at between 20-30% fake traffic in one form or another Twitter claiming 5% or less was fairly suspicious just as a “paper claim”…

Anyone looking at a Twitter comment thread of more than around ten reply commentators would see obvious fakes of various kinds, even people just posting a smiley to get their name seen. With these fakes rising more quickly as the thread lengthens. Thus the 5% claim is laughable to the naked human eye.

For Twitter to make it a claim with legal repercussions to a Federal Government Authority that has significant legal powers and likes to use them against “HiTech Corps” was at best ill advised. If not out right deception for financial gain (fraud). Supportable as the lie it is only if the Twitter board could keep the “claim method” out of sight.

Mr Musk has had a few run-ins with that particular Federal Authority for way less. Thus you would think that the Twitter Board would consider that should Mr Musk become involved with Twitter he would go to the SEC in a public way to draw a line in the sand as well as to cover his own back.

Now that the Twitter “claim method” has been given in publicly accessible documentation and appears to be not a method of repute the fun starts…

And I suspect it will not just be for Twitter…

One of the reasons the Federal Government Agency is taking an interest in “Hi-Tech Corps” is without doubt politically inspired.

I suspect most in the First World are aware of all the alleged “Fake News” and “economic agents of a hostile foreign power” manipulating US Citizens views and political oppinions, and how various US political interests have had their boat rocked and are deeply unhappy to the point of being vengeful if not screaming for blood, scalps, or heads on platters.

Whilst not being able to get at the “economic agents of a hostile foreign power”, the politicians can get at the carriers of the messages, those “Hi-Tech Corps” via Government Agencies…

It would take very little to cause the more cautious investers to pull out of “Hi-Tech Corp” stock, lets be honest Twitter has been on a down hill slope for some time befor Mr Musk even started purchasing it’s stock and is going to have to 100% increase it’s value, to get back to the value it was once at. To do that just as we are entering what is becoming a significant inflation cycle would appear to be unlikely to happen.

The question then arises as to if a run on Twitter stock would cause a run on other “Hi-Tech Corp” stock? All of which we know is “over valued” and the “Social Media” side full of fakery and not delivering any real end returns just the froth of churn.

Once cautious money is seen to move, generally others start to follow and the snowball starts to roll…

Add to the fact that US citizens are seeing the underlying effects of the double digit inflation in basic consumer item pricing also turning into a quite real recession as the kick back from “out sourcing” lands on them via downgrading of employment through to unemployment and thus the hits on their pensions and childrens college funds, loss of healthcare etc.

Clive Robinson • July 17, 2022 5:49 AM

@ SpaceLifeForm,

Re : Did I forget to put the single quote…

I remember “cut and pasting” both URL’s but not specifically why.

The technical security asspect of the post should have been given as well as it’s quite important.

Are text messages equivalent to “informal talk” or “written record” and therefore does “factory reseting” phones actually delete the messages on them and if so is it destruction of evidence or not if they can be recovered other ways (something that recently came up in a UK civil case).

I suspect that the text messages are available “off of the phones” or in fact the factory reset has not actually deleted them.

Something to which even the US Secret Service appears to agree as they say they still have them even though some of the phones involved have been scrubbed[1]. But for some reason have not handed the messages over despite repeated quite legal requests for them.

It does not help as the text I quoted shows the comment from the USSS senior was to be blunt quite inflamitory in nature, and appears to be inventing some kind of persecution conspiracy.

Which naturaly suggests there is rather more going on behind this than just the technical security asspects…

What I suspect may be rearing it’s ugly head is the latency of law in a technical domain. The crack it creates, what drops into it, and some do not want fished out.

Back in Nixon’s time most heard for the first time the question of the status of an analog audio recording as an “official record”. Prior to that it had mainly been assumed that,

1, Spoken was “ephemeral” unless noted down as a written record or transcript.
2, Written was in Government circles a record to be “archived” in perpetuity.

This can be seen in various bits of associated legislation. For instance in British Law a distingtion is made between a formal transcript, and jotted notes used as an aid to memory. It’s basically one of those very awkward “mental state” arguments, and likewise equity of armour[2].

With everything “going digital” and the cost of storage being very close to zero, and social changes where an informal word that once would have been spoken now being typed as an SMS or equivalent, it’s become oh so messy. With some who see an SMS for prosecutorial reasons as the equivalent of “written record” things are getting very very awkward.

As should be becoming clear to more people, lawyers do not try evidence these days but innuendo. That is they will pick on any tiny tiny thing and weave from it a rope by which to hang you.

As you noted the other day there is an argument between six lines or two lines going on over the alleged Cardinal Richelieu[3] quote of,

“If you give me six lines written by the hand of the most honest of men, I will find something in them which will hang him.”

Personally, I think in terms of not lines, but words singular as in the infomous,

“Do not say a wrong word”

That is a single word can be used to find you guilty by abusing it’s usage.

One such word is the British english word “popped” it has more than one meaning two common ones are,

1, To burst : the soap bubble popped.
2, To put down in an easy to reach place : She popped the book on the table.

A US prosecuter deliberately claimed the word was directly the same as “punched” or “dropped” in an alledged “shaken baby” case[4]. Which became quite famous as apparebtly it stopped the death oenalty being re-introduced in a US State.

[1] A friend currently here in the UK who has knowledge of these things, tells me the use of “scrubbed” can be different in the US to the UK. In the UK it would mean “removed” as in “a stain scrubbed out”, but in the US it can also refere to “motion” as in “scrubbed back and forth”. So when applied to say video tapes “scrubbing” can mean detectives have gone “back and forth” looking intently, or as in the UK “scrubbed” can mean it has been removed, cleaned, or deleted.

[2] English law and thus to an extent US law, has a history going back to “trial by combat”. To stop or at least lesson the accusation of it being “might is right” made against the process, there is the notion of “equity of arms”. In the modern parlance there should not be an imbalance in the process that favours one side over the other. Thus anyone testifing from memory should face their opponent who should equally be testifying from memory of the event… But what if one party jotted down “contemporary notes”? What is the status of those notes? Well as both parties could have made notes to re-mind them selves then they became sort of acceptable. But what of notes made from an audio recording? At what point do they stop being notes and become a transcript? Simple answer is nobody knows and nobody in their right mind wants to go there as it becomes a “legal minefield” using the nuclear option.

[3] Cardinal Richelieu by all accounts a thoroughly unpleasant individual for whom power obtained by coruption was ideal as it gave control beyond measure. Such is the evil he is claimed to have wielded, it has become a measure by which not just others but entire Governmental Entities are measured,

https://www.armstrongeconomics.com/world-news/corruption/give-me-six-lines-written-by-the-most-honest-man-i-will-find-something-to-hang-him/

[4] In 2007 the Boston law magazine “Exhibit A” named the defendent the “most notorious criminal convicted in Massachusetts”, which shows just how much power can be vested in a single word by one man (Gerard Leone) against a 19 year old girl from another country.

He has subsequently gone on to do very well for himself though quite questionably,

https://en.m.wikipedia.org/wiki/Gerard_Leone

https://www.dailymail.co.uk/news/article-448242/Former-British-nanny-tops-U-S-criminals-list.html

Clive Robinson • July 19, 2022 5:51 PM

@ Winter, ALL,

Re : while filing their pages with disaster stories about the heat

It’s not just the UK…

Apparently the Hoover Dam had an explosion, which caused the usual speculation stories doing the rounds.

Obviously the “T-word” got mentioned.

Then as it’s a transformer that has done the old Vesuvius routine the speculation moved on to “Summer Heat” and “overload”.

Whilst I would not rule out “lack of preventative maintenance” for “share holder value” reasons being at the bottom of it…

Apparently some think that it’s down to “Crypto-Coin” miners putting too much stress on the infrastructure…

Does this indicate that the MSM are soon going to have a new boogeyman of “crypto-coin miners”?

I guess they would make a convenient scapegoat, for “managment”, but… As normal we will have to wait and see.

I’m betting that what ever the real cause is, we won’t get to hear about it any time soon.

Clive Robinson • July 20, 2022 5:55 AM

@ SpaceLifeForm, Leon Theremin, ALL,

Re : Hacker News on Intel Microcode

OK the “Reverse Engineering” work carried out is quite impressive.

But I realy get the feeling that the level of understanding even in the ICTsec crowd is at best poor.

Which makes,

“This is going to have a lot of comments, let there be no doubt”

A very veru high noise to signal read at best (as I’ve waded through that Stygian mess this AM I can confirm this.

It appears that essentially all commenters have no idea what Microcode is or the underlying “Register Transfer Logic”(RTL) is or why Microcode came about or when[1]…

For those that don’t know a microprograming system implementing a microcode language is in effect a block of memmory used as a ROM the address inputs of which are driven by a state machine. The Data outputs of the ROM drive the lower level hardware of ALU, MUX and Registers via their respective control lines. Importantly some of those data output lines also go back into the state machine thus enabaling it to be Turing Complete. In essence it is the hardware “interpreter” at the bottom of the “software stack”.

The distinction between horizontal and vertical microcode is a little bit fuzzy and means different things to different people (such is life).

At the simplest horizontal microcode is seen as “one data bit for every control line” and vertical microcode as N-data-bits to M-control-lines. For instance if you have a register file that drives the ALU, you might have eight, sixteen or a lot more actual registers, only one of which you can use at a time. So rather than have say 64 data-bits driving 64 registers, you have only 6 data-bits driving an “address decoder” that has the required 64 outputs to drive the register control lines.

So in a simplistic way, vertical microcode is in effectct “compressed” horizontal microcode.

See,

https://www.zeepedia.com/read.php?microprogramming_general_microcoded_controller_horizontal_and_vertical_schemes_advance_computer_architecture&b=1&c=22

[1] When some people talk about “microcode” especially if they come from an IBM background they get it wrong. You will often hear refrence to the “MIT Whirlwind” system in the 1940’s. In fact it was not the first computing system designed with such a sequential control store system (see Babbage’s engine ~1810) and that has it’s history in pattern stores on looms (see Jacquard box ~1800). But the Tommy Flowers designed system in WWII you can see a rebuild of at Bletchly Park, well predates the MIT Whirlwind by quite some time.

By the time of the MIT Whirlwind the use of “Diode Matrix” sequential and switched control stores was well established by decades in what we would now call “Industrial Control Systems”(ICS) in the form of switched “Ladder Logic” the earliest examples most would have come in contact with being “lift controls” and the “Phone Network” in the 1930’s. You can still find similar electromechanical systems in some old washing machines still chugging along from the last century. The use of “diodes” just made things smaller, faster, and eventually less expensive.

It was in 1951, Maurice Wilkes head of Cambridge University mathmatics dept, published the first book on programing. He also had came up with the term “microprograming” and “microcode” and published a paper on it in that year (an idea IBM filched for it’s later 360 systems). Conceptually microprograming and microcode was a very very different idea to that of using a simple “diode matrix” in a switched sequencer system. His leap forward was to add “conditional execution” by using a second matrix and state machine. It also alowed “code reuse” so got way more from the control store than a simple Diode Matrix sequencer ever could. More importantly though less recognised is it gave rise to the idea of heirarchical programing hence our high level languages. As a more practical side effect a microprogramming aystem also easily alowed variable clock cycle instructions thus improving through put. As I’ve mentioned before, back in the 1980’s I met Prof. Wilkes when working on the Cambridge Ring at another University. In many respects he was the father of modern personal computing as we understand it,

https://www.theguardian.com/technology/2010/nov/30/sir-maurice-wilkes-obituary

Clive Robinson • July 20, 2022 7:08 PM

@ vas pup, ALL,

Re : Heat is the ultimate form of pollution.

It’s funny you should mention,

But the concentrated computing power generates heat so powerful that cooling is essential.

So much so a well known company I won’t mention was looking at an interesting idea…

Think,

1, Off shore wind farm generation
2, Off shore tidal geberation
3, Sub sea containerised data center
4, Fish farming.

The UK especially up in Scotland has some of the most reliable wind and wave power in the Northern Hemisphere. It could generate around eight times the energy from the total pipline gas that Russia was pushing into Germany / austria (where I’ve been led to believe natural gas prices are up 300% with electricity soon to follow, and significant outages expected this autumn/winter in Austria).

Also the sea is of the right depth for wind and wave generation but shallow enough that you could put specialy designed unmaned data centers on the seabed[1].

The excess heat measured in megawatts could be used to warm the water just one or two degree C which would make certain types of fish farming much more productive…

So all you need is very high bandwidth data communications, running with the back to shore power transfer. The data centers effectively run on the difference between generation and on shore consumption.

[1] Off Shore engineering is a bit of a black art at certain water depths due to build up effects as deep wayer waves hit shallower water. It does not take much imagination to work out the sort of energy required to lift a wave of water –think cylinder on it’s side– 30ft / 10meter in hight and 20km long… Thus protecting the base supports for off shore wind farms can be a significant engineering task. But… If you take the energy out with wave power generation on the prevaling wind side you reduce the engineering required for the wind farm suppprts, so some people see wind and wave as complementary.