Schneier on Security

Clive Robinson • July 28, 2023 8:08 PM

@ &ers, ALL,

This got grabbed by the auto-mod so I apologise for having to chop it into parts.

Part 1,

Re : Zero Day meaning.

“Not all know from where the term 0day came (Clive knows).”

Yes he does and it will supprise many.

It actually comes from “Zero Hour D-day” and similar military speak.

The term “Zero Hour” was the mark point for the end of the count down time to military action such as “Going over the top” from “The Great War” (later called World War One).

Military actions are not planed by a date and time but “-hours” and “+hours” where “-” was effectively somthing that was to be kept hidden from the enemy pre the start of action (note hidden not secret, because build ups were visable to observers in balloons, using odd looking perescopes on jack up masts and later aircraft).

The reason for not using dates and times was mostly a practical one, amoungst other things “the weather” which could change so much in a very short period of time that a planed action would have to be delayed. Sometimes for nearly a month… Think full moon every 28days and heavy cloud blocking the needed moon light to bring stuff upto the front.

Whilst many “Officers” and “Senior NCO’s” were used to using it, it did not make it into the public memes psyche untill “The Space Race” where every one talked of the “count down” and “zero hour” with big digital clocks in days hours minutes and seconds “counting down”.

In the early 1970’s Burnie Taupine wrote the words to the song “Rocket man” which many remember as Elton John’s 1972 smash hit. The first few words are,

“She packed my bags last night pre-flight

Zero hour, nine AM

And I’m gonna be high as a kite by then.”

The second line linking the countdown time to the actual launch pad time zone.

The other two lines have various meanings that both Bernie and Elton implied differently at various times.

But the hidden / secret action of things happening before zero-hour on D-Day kind of stuck due to the way history was taught to kids in the US and UK in the 1950’s through atleast the 1990’s when things started to diversify into “World Cultures”.

So ‘Zero Hour D-Day’ from WWII history teaching became ‘Zero Hour Launch Day” in the 1960’s for the Space Race, then just got shortened to ‘Zero Day, Zero hour’ for a planed day and time event in what we now call “Managment Speak”. And anthropology speaking so on into other Cultural “patois or slang” depending on how big the culture is. As the various “geek / nerd” kid groups were small and often insular it was a “slang” that was also used by other groups to deride members of another group.

Clive Robinson • July 28, 2023 8:15 PM

@ &ers, ALL,

Part 3,

I have plenty of stories, though some would technically be covered by NDA’s and even the UK DORA and OSA (I&II). Which is why I can talk a lot about other nations misbehaviours –with France high on the list– but not other nations “who club together” as say a pentagram of Shakespearean style “Hubble bubble toil and trouble” pot using witches. Or passing the eye around as the Gorgan’s sisters, Deino –dread–, Enyo –horror–, and Pemphredo –alarm– did to spy on the mortal world.

Clive Robinson • July 29, 2023 3:04 PM

@ Ted,

<

blockquote>”One thing I found amazing was that the word “cat” has a word vector that is described by 300 discrete numbers.”

<

blockquote>

The number of numbers is a function of the neural network, not the word.

In a way the form of the vector is irrelevant.

Think of it as a series of coordinates of say a hammers “abstracted function” not it’s form. That have been subject to constructive “Inter Symbol Interferance”(ISI). Such that a given functional atribute is spread across some or all of those 300 numbers.

Clive Robinson • July 30, 2023 11:43 AM

@ Ted, ALL,

Re : Homonyms are more common than most think.

The same word can have unrelated meanings

The one most know is “minute” meaning 60secs or something small. But it’s also a measurment of angle as well. Whilst “bank” also referes to an aircraft flying in a particular way, the use of multiple engines in trains and how to arrange a fire such that it burns slowly but for a long time

As a very rough rule of thumb short words of four or less letters are not homonyns, neither are very long words.

If you think about bare, bear, two, too, to and similar it can be seen that even though spoken the same way they are spelt differently. Also the length of words aproximately indicates when they started to be used. That is short words tend to be old and long words tend to be new or part of a distinct often professional domain. With longer words in English often being constructed by the conncatanation of short words from greek or latin.

To most people this would be at best a point that is whimsical or trivial but not to the likes of LLMs that have convolutional layers in their neural networks. The length of words act as a predictor to subsequent word usage.

A convolution layer kind of acts like a highly abstracted mask of a feature. In images for instance finding something aproximately “T” shaped can be part of a face, or a support structure in a building. In either case it can act not just as a mask but to align things for later layers.

It’s an area of research in AI that is drawing more attention, but is also hard to explain.

Clive Robinson • July 30, 2023 11:38 PM

@ lurker, modem phonems, Ted,

Re : Contingencies and their planning.

Murphy’s Law or,

“The Perversity of Inanimate Objects”

Is an indicator that,

“If something can go wrong, then it will go wrong, when you would least like it to, in the way you would least like it to.”[1]

The secret to success on such occasions is to recognize that and plan accordingly with a contingency. Important to recognize though is that you can not plan for every individual eventuality.

So what to do?

Plan for what is most likely and implement so it covers many eventualities.

This is the equivalent of the extended “Fire Drill” if you plan it correctly it will cover all reasons why you would evacuate to a designated place of safety and have a head count.

[1] Though sounding at odds with random events and probability, science has shown that it happens. The reason is when you do things you start changing stresses thus failures are more likely at that time. Look at it this way we know about inertia it is a force that comes into play when a mass changes it’s velocity,

https://www.newscientist.com/definition/inertia/

You can measure it with a spring balance, and see it stores and releases. It’s also why you can “whip the table cloth out leaving the places set”. Thus the change in force must cause an equivalent change in stress.

Clive Robinson • August 1, 2023 3:10 AM

@ Bruce, the usual suspects,

Re : It’s not just the RATS looking to jump ship.

As some of you are aware for some years now I’ve been saying things that are unpopular like,

1, Defence before Offense.
2, Cloud can never be secure.
3, Offshoring is bad.
4, Software is not engineered.
5, Segregation is the only way.

Whilst @Bruce has pointed out,

1, Centralised security is bad.
2, Large Data is toxic.

And the industry has ignored the advice, and frankly done increasingly ludicrous things.

Well, it appears one or two others are starting to wake up,

Rupert Goodwins, a longtime computer journalist going back before ICTsec was a thing in industry, has this opinion piece,

https://www.theregister.com/2023/07/31/opinion_column_sustainable_infosec/

To be honest I think he’s being to nice / gentle on the Mega Corp Lunacies and US Style Management thinking of barely the next quater in front of their nose.

Back in the 1980’s there was a mantra taught to business people that “Communications was King” but few understood or wanted to understand the implications.

Appt to the opinion piece is the old British War Time saying of,

“Loose lips sink ships”

And it’s still true today. Few understand how to secure data, as for securing meta-data few even understand what it is outside of a buzz word. As for meta-meta-data and what you should be doing about it…

The next thing to come along at the end of the 1980’s was “Data-Warehousing” it originally had only one real purpose,

1, Protect the company operational data from ad-hoc enquire.

Put simply you seperated the operations from the research, by running research on a copy. Such that any SNAFU that brought the research server down on it’s knees did not adversely effect opperations.

Shortly there after came the notion that warehousing should be made simpler, so “middle-ware” came to life. Out went clunky Command Line Interfaces that even programers felt uncomfortable with and the notion of the web browser as the desktop came in. Thus you could run a query and have the data turned into a nice graph by some widget on the middleware server.

The problem with middleware was,

“Where do you do the security?”

A problem that is still with us some third of a century later… Back in the early half of the 1990’s I was having trouble explaining to people why they realy needed to understand what “state is” and it’s implications. Likewise the issues of “Errors & Exceptions” and why you should keep the handlers in the business logic and not try moving it to the left. As for rollback, yes the database people understood some of the issues, but by no means all. They had a centrified view of the world… Try explaining parallel systems and why the speed of light becomes an issue then you got the “I’m talking to a crazy man” looks.

Well as some will now know “High Frequency Trading”(HFT) has not just opened the lid on that can of worms it’s ripped it right open… With people spending billions on not just getting data there 1uS earlier but working out where to best do databases and the like in a very highly distributed model. Which in turn has security issues as ‘AES etc is to damn slow’ in most modes. Which is why the idea of the OTP has come back as you realy can not get much faster, as even pre-computing stream ciphers can cause unwanted time bottle necks. If people could get “Quantum Key Distribution”(QKD) workable then they would jump right over. But they have not so, other ways are still being used.

I won’t go into the other iceberg tips that are comming over the horizon other than to say “Post Quantum Crypto”(PQC) is something that is not going to work for many people without a lot of massaging. This in turn will raise security issues few have even realised exist and it’s going to reach right down the computing stack below the memory level…

Quite a few years ago not long after the AES contest @Bruce noted that we realy needed to start working on “Key Managment” issues in research… As such the progress has been slow to put it politely.

The same is true for oh so many other aspects of security, few realy realise are there and discover their designs smash into at full throttle.

It’s still “fun times ahead” but less and less people will be knowledgable enough let alone qualified enough to be able to do it.

I was reminded the other day that an astronaut spends most of their very scarce time training. Due to physiological reasons your career is 10-12months in zero-g. Thus every second of an astronauts time in space counts and the employer want’s to get the best bang etc. Thus training two or three crews for more than two years for a very short activity is cost effective…

We are going to see the need for similar view points moving more deeply into ICTsec in the not to distant future. Whilst there are a handfull of practicioners with the skills, managment are nowhere near even understanding the 50,000ft view let alone the 20,000ft.

To say ICTsec as an industry sector is grossly under prepared for it’s future is it’s self an understatment of enormous proportions…

ICTsec has not in any real way caught up with it’s past needs from back in the 1990’s some would say earlier…

Clive Robinson • August 1, 2023 9:55 AM

@ Bruce, ALL,

Re : AI halucinations unfixable.

“This isn’t fixable”

Is the conclusion of Emily Bender Professor of Linguistics and Director of the University of Washington’s Computational Linguistics Laboratory. Her argument is

“It’s inherent in the mismatch between the technology and the proposed use cases.”

https://techxplore.com/news/2023-08-chatbots-ai-hallucination-problem-fixable.html

My view point is as I’ve pointed out before is LLMs have no Intelligence Artificial or otherwise, they are “matched filters” where the output is a stochastic (random) output of the next most likely word.

If you extend that stochastic behaviour you end up with “A drunkards walk” all be it down a semi-constraining pathway. The issue arise when the constraint weakens or becomes ineffective, it will go any which way chance takes it.

Clive Robinson • August 2, 2023 5:00 AM

@ ResearcherZero,

Re : Air gap crossing both ways.

“One of the implant types appeared to be a sophisticated modular malware, aimed at profiling removable drives and contaminating them with a worm to exfiltrate data from isolated, or air-gapped, networks of industrial organizations in Eastern Europe.”

That brought a nostalgic lump to my throat. It is more than a decaded ago now that I worked out how to do this air-gap crossing.

It was part of my looking at how I would attack electronic voting machines. I in effect discovered a way to do bot control wirhout the use of swrvers that could be taken down. I talked about how to do it on this blog about a year before stuxnet did it’s thing.

At the time I noted that getting data out was almost as easy, but unlike getting commands in, I was very sketch on the details as I did not want to give the recipe away to all and sundry as protection was not practical back then. As for mitigation of any kind just remember it was designed to cross air-gaps so the then maximum security of “segregation” as practiced in industry was not going to work…

As I noted not long after stuxnet the part I had reveled on this blog “got used” whilst the bit I’d kept more secret had not been.

In a way it’s nice to see it’s finally in use by others, however what you do not say is just how covert it is and if it’s “server-less” or not.

I guess I’m going to have to read the paperwork, the trouble is they write them in such a dull way these days 🙁

Clive Robinson • August 2, 2023 8:16 AM

@ Phillip, SpaceLifeForm, ALL,

Let me think,

1, A CPU with a defective TRNG.
2, Microsoft with a history of questionable crypto choices in their OS’s.

Giving rise to various alledged “fixes” that only work for Microsoft.

And you ask,

“Now, allow me to move into conspiracy mode.”

What took you so long 😉

Clive Robinson • August 2, 2023 9:39 PM

@ Bruce, the usual suspects, all,

Re : Hardware as a security failure.

Two hardware failures that EmSec and other practicioners and secure developers should take on board,

1, Re working of RAM-Freeze.
2, Power Spectrum Side Channel

The first is going to be of real interest to forensic types as even though currently clunky it will improve a lot and become a “smooth to use”(c) tool.

The second is of interest for other reasons. On the face of it, it’s an impractical tool. However some used to ask why I talked about the bandwidth of side channels and how it was never zero so would always leak secure information in any active system. Well this nicely demonstrates it.

So start in on the First in a little more detail,

https://www.theregister.com/2023/06/09/cold_boot_ram_theft/

“Robot can rip the data out of RAM chips with chilling technology”

Knowing how to do this goes back a long way, early signs of being practical were with people working on work-arounds on “pay2use” ‘Set-top Boxes” back in the early 1990’s if not earlier. Modifing a home freezer to get below -20C (-4F) and putting the settop box in enabled the contents of memory chips to be held long enough to get the data out. Who first moved to spraying liquid nitrogen around to do the same trick is unknown but by the 1990’s it was a very serious concern to those involved with “Smart Card” development. If you go back to work comming out of New Zeland on erasing hard drive data you will also find refrence to using liquid nitrogen attacks on DRAM to get the hard drive encryption keys. You will also find –if you can get at it– the NSA also started using “In-line Media Encryption”(IME) devices to be used between PC’s and Hard Drives that were constructed in a way to reduce the likelyhood of a RAM-Freeze attack. I did some work on storing the Keys in RAM such they continuously evolved with the secret needed to recover the keys also evolving but kept inside a CPU register. I refered to it as like “a snake eating it’s tail”.

The thing is RAM-Freeze has gone out of fashion not because it’s not still a viable method, but because hardware manufacturers have just made it physically harder by using smaller components in newer packaging types such as “Ball Grid Array”(BGA) where getting at the “pin-outs” can be made quite difficult just by “Printed Circuit Board”(PCB) design in “multi layers”.

Which is where Ang Cui’s Robot comes in… It can lift a chip and get it into a specialist chip socket fast, but as Cui indicates, not fast enough,

“… we had to do not one but five chips, because they’re all interlaced together. And then three of the chips are on one side of the board, and two of them are on the bottom of the board. So we had to come up with a way to somehow magically either pull all five memory chips off at literally the same instruction – which is, you know, hilariously complicated and it’s just not really doable.”

Which is why hardware designers of these modules think they don’t need to worry about RAM-Freeze attacks. But as Cui goes on,

“We came up with this other really cool trick where we do this one at a time and we’re looking for not just deterministic execution, but we’re also looking at the electromagnetic emanation of the device to figure out basically where the device is going through CPU-bound operation periods. Because if you’re CPU-bound, guess what you’re not doing? You’re not writing from memory,”

This “CPU-bound” operation applies to any CPU with “cache” to get speed up performance, which is basically nearly all CPU’s these days including quite a few microcontrolers… As for “secure enclaves” I won’t go into it but this attack is going to make those not anywhere as near secure as their designers thought…

It’s also why I was working on the continuousky evolving RAM encryption oh so long ago… Such attacks are shall we say “predictable” if you “think hinky”. Which obviously not enough do as Cui notes,

“But the more important a thing is for the world, the less security it has,” he said. “So guess what has [memory encryption]? XBox has it. PS5 has it. Guess what doesn’t? Every PLC [programmable logic controller] CPU on the planet effectively. A lot of the critical infrastructure embedded things that we depend on, almost none of them are addressing this kind of attack.”

In essence the designers of games consoles are in a continuous battle with those who hack their systems, thus “They have to think hinky”. But those important systems that control infrastructure and centrifuges in uranium enrichment and similar do not have a clue when it comes to security. Because they are not continuously fighting an enemy.

Something I expect will need to be changed now that a real bombs-n-bullets war is including cyber-warfare as a standard tactic.

So hopefully with a few new thoughts bubbling away onto the Second article in more detail,

https://www.theregister.com/2023/08/01/collide_power_cpu_attack/

“Bad news: Another data-leaking CPU flaw. Good news: It’s utterly impractical”

Don’t believe the “Good News” it’s my experience that all side channel leaks can be,

1, Usefull.
2, Improved.

Especially when people think hinky as Cui and his team did about the timing in their RAM-Freeze reading Robot.

The first thing to realise is that whilst Core RAM can be –but usually is not– encrypted[1] internal cache menory is not due to speed issues[2].

So whilst slow this attack can be used against systems that do use Encrypted Core RAM, quite successfully. Which means certain security features like Secure Enclaves need to be looked at with a whole lot more care (to check what’s printed on the tin is what’s actually inside the tin –remember processing agents are not ingreedients so don’t have to be on the list– as it may be different),

So from an attackers perspective the fact it gets around RAM Crypto makes this attack of immediate consideration for further investigation. Because only getting a bit a day whilst slow, is going to be a heck of a lot faster than a hundred times the expected life of the universe some claim some crypto algorithms will take to break…

The researchers indicate that with a simple mitigation the leaking data would be brought down to at best 0.136 bits per hour (23bits/week). But with the way the likes of memory prefetching works means the attack in real world usage would be slower still. With an estimate of as low as 2.86years/bit.

But you will see that the researchers can also “think hinky” and realise that the attack could probably be significantly improved so say

“However, this low security risk might drastically change if new architectural or microarchitectural ways of prefetching victim data in co-location with attacker-controlled data are discovered.”

With the rate these low level attacks are coming out, I personally think that something in that area will almost certainly come out within a relatively short time.

Also consider that 23bits/week is worth having for a 128bit AES or similar key in a server in a “shared user environment” such as low cost cloud or co-lo where such keys would remain valid for an entire power cycle, and the curve would probably crossover with a brutforce search in less than four weeks.

[1] One problem with encrypting Core RAM is that the more processes the nore KeyMat is required. That KeyMat has to be stored somewhere, and mad as it might sound that’s almost certainly in Core RAM.

[2] In theory Cache RAM could be encrypted, but, it very probably never will be. Without geting into it, you need to see how cache memory actually works at low level to see it’s not realy practical, for the way we want Cache RAM to work. Thus if we want Cache RAM to be secure, we will need to compleately redesign the CPU to take it into account. The performance hit going through such a process will induce will almost guarantee it won’t happen in existing 32bit and above CPU designs.

Clive Robinson • August 3, 2023 9:32 PM

@ SpaceLifeForm, ALL,

Re : Even turtles have life signs.

The link kind of says it all,

“collide-pluspower-side-channel-attack-impacts-almost-all-cpus”

I would say as far as CPU’s with cache is concerned “almost” is kind of superfluous.

Without goining into lots of details, changing the state of a memory bit requires more power than simply just writing to the bit address.

So, overly simplistically if you write a “zero” and get less power used than writing a “one” then it’s reasonable to assume the bit was originally “zero”. Likewise if you write a “one” and it takes less power than writing a “zero” then it’s reasonable to assume the bit was originally a “one”.

This is because the fundemental laws of nature are preserved.

Firstly doing work –changing state– uses energy.

Secondly all work is inefficient and the “lost energy” has to go somewhere as it’s not destroyed.

Thirdly it’s that “lost energy” via a process of radiation transport that eventually becomes heat. However in the early steps when it is still quite coherant it’s pressence on a bit by bit basis can be measured if the side channel mechanism has sufficient bandwidth.

Lastly, for the electronics to function effectively as digital logic, the power supply to the individual bit storage electronics needs around five times the bandwidth of the maximum rate it’s state can be switched at.

Put that all together and you can see why a “known plaintext” attack on the cache will on a bit by bit basis leak information out of the chip…

Yes there is quite a bit more to it, but back in the late 1990’s even undergraduate students used to be given lab-work fishing information out of “Smart Cards” via their power supply circuit as a demonstration of this issue.

More than a decade earlier some of us had worked out how to get the information out by not having to directly connect to the electronic circuits (It was easier back then because clock frequencies were down in the low MHz range and second hand test equipment covering it was fairly easily available at lowish or no cost[1]).

This was done by using low power EM Carriers that got “cross modulated” by the changing state. Thus using “Physically tamper secure tamper evident casing” was a bust which was a big Opps…

I demonstrated this on “Electronic Wallets” and “Pocket Gambling Games” back in the 1980’s both of which people hoped would become billion dollar industries and were busy investing money in. They were not happy with what I’d found… Guess what such attacks can still work today… If you look around it’s not exactly happening the way the investors hoped as the security can not be ensured thus money like the lost energy of work will get transported out of electronic Smart Devices.

It turns out I was not the only engineer back last century showing this… The problem was it was not just the investors not wanting to know such systems were insecure. I know for certain one or two UK Government Security Agencies were not happy especially when I moved on to modulating the EM carrier to do active fault injection which I’ve talked about on this blog before…

But I’m a little shocked that after more than a third of a century these attacks are seen as new and exciting.

The real thing people should realise is the basic TEMPEST / EmSec rules about energy and side channels. They will always exist because they are the base laws of nature. With the result being the best you can do is “keep both the bandwidth and energy down” and loop areas small, very small.

Oh and don’t do the “knee jerk” thing the Continental Europeas did back last Century of trying to “add noise” or “Whitening” it does not work in fact it can make things worse. Look up “Low Probability of Intetcept”(LPI) radio systems especially “Direct Sequence Spread Spectrum”(DSSS) systems and process gain and you will see why.

For students of Prof Ross J. Anderson have a chat with him about it, he can tell you the issues and some “war stories”. One of which was “self synchronising logic” the idea being if there was no central clock, then there would be no reliable signal to synchronize to… Which is true up untill some one illuminates the electronics with an EM carrier and causes all those free running circuits via the process of “injection locking” to sync upto the EM carrier… Which actually makes the next stages of the attack so much easier, as you control the synchronization signal not the clock in the electronics, so you get upto ~20db of improved signal availability…

[1] The UK National Physics Lab over in Teddington in SW London, gave me quite a bit of such equipment to pass on to Schools, Scout Groups, Radio Clubs and the just forming Computer Clubs as the kit got EOL’d by book-keeping.