Schneier on Security

Clive Robinson • March 15, 2024 8:43 PM

@ vas pup, ALL,

Re : Horses do drink water.

“I guess this blog is not about LGBTQ+, WOKE, you name it but about really security issues which affect people regardless of their demographics, sexual orientation, political/religious affiliation.”

Or disabilities and a “hundred and one” other human/social issues.

Importantly though is nor is this blog anti any of those either.

There are two watch words for each and every thread,

1, Context
2, Relevance

The other day I posted again about a “relevant” security distinction between certain types of men and certain types of women as burglars. But importantly it was in a “context” of how long CCTV “footage” is retained.

The previous time I mentioned it was years ago, again it was both “relevant” and within “context”.

The fact that the gap was years was that security as a topic is very very broad, thus certain contexts come up very rarely or with the right relevance needing comment.

It was not as someone falsely assumed that the blog posters here,

1, Don’t get it,
2, Don’t see it,
3, Don’t acknowledge it,
4, Don’t want to talk about it.

It is because down the bottom of “The Computing Stack” where most of the blog threads are is “technical” which is agnostic to “good or bad” or “gender” or “sex” etc which are “human” thus up the top of the stack.

Yes, our host is broadening the blog and thread contexts are going “up the stack” as well as down.

But two things have to be remembered,

1, Most constructs have foundations it’s why we have the computing stack.
2, Getting foundations wrong is one of the most serious security flaws there is.

Thus like it or not this blog will remain “technical” in quite a large part, otherwise it would quickly be irrelevant as far as security is concerned

Oh the funny thing is that there is a flip side, in that some people have complained when we “talk technical” because it’s “not their sort of technical” or too deep down technical.

Because they fail to realise that “Domain Knowledge” is to “Renaissance People” a “transferable skill/asset” across many domains. That is what appears in what the complainer considers to be “not in their domain” thus riles against it, actually does apply to their domain, they just do not want to take the blinkers off and see “the knowledge transfer”.

I’m known to say that “Security folk” need to “get with it” as far as “Radio” is concerned and learn to play with “Software Defined Radio”(SDR) and GNU-Radio and similar. Untill recently I was almost “A lone voice in the dark” now however more people are seeing the relevance, even though they may not want to play in that sand pit.

Because for many in the past “radio” has been seen as at the very bottom of or even below the ISO OSI seven layer stack, or DoD APRA four layer stack. Thus they discount it…

I’ve explained the notion of,

1, Bubbling up attacks
2, Reach down / around attacks

Yet they do not put 2&2 together. Thus failed to realise there is a whole series of quite nasty attacks out there (which are now getting exploited). Not just RowHammer or Meltdown but many more such as the notion of “Phantom CPU’s” where the likes of “Memory Management Units”(MMUs), “I/O Management Units”(IOMMU) and “Direct Memory Access”(DMA) logic blocks well below the main CPU can not only be used as “backdoors” they also can be “Turing Compleat” thus “programmable” in ways most can not get their heads around easily.

Thus those on this blog need to have “wider horizons” and extend their knowledge both down and up the computing stack.

But… Also those with different perches on the rungs of the stack should remember that “horses do eventually drink water” they just want to do it in their own time and at their own pace.

Thus “context and relevance” remain as “watch words” of advice.

Clive Robinson • March 16, 2024 9:29 AM

@ JonKnowsNothing, MarkH, SpaceLifeForm, Winter,

Re : C19, JN1, long Covid and what’s to come.

Another year,
Another reaping of humanity,
Another maiming of many,
With vast waste and lost opportunity cost,
As Big Phama pulls in another billion or more in fraud earned dollar.

When will it end?

“While a lot of information on C19 has dried up, there is still a trickle of information seeping out into the public sphere. Much of it contradictory and lots of information missing the science part.”

If you look back to the very begining of 2019 on this blog, there were predictions and prognostications made by “the usual suspects” and most have been proved so far.

Some are still on the countdown clock such as increases in cancers and people incurring life long immunocompromise of organs and the like[1].

The only “honest” figures have been from things politicians and the like can not avoid such as the legally required recording of deaths, and the consequent “Excess Death” figures.

Though they are also “fiddled” by giving as percentages of preceding five year average… In an upward curve 10% of the previous five years growth is way more actual deaths this year than it was in the first year of that five year average, even though it’s still 10%…

You can see this from simple 10% per year growth you can calculate in your head starting at 100,

110, 121, 133.1, 146.41, 161.051

Now multiply by millions of coffins.

[1] Whilst still disputed by the “old guard” and those with “blame the victim” accusations for pecuniary benefit, the evidence that certain pathogens like virii are direct causes or triggers of cancer and immunocompromise is growing remorselessly as it did with environmental triggers.

Clive Robinson • March 16, 2024 10:36 AM

@ ResearcherZero

Re : WA’s not so little problem.

$12.7 billion worth of meth, cocaine, MDMA, heroin and cannabis was consumed last year, more than $2 billion more than the year previous.

Quoting “price” is a bit of a “political trick” as it’s related to “supply and demand” not to actual net weight consumption.

But the rapid rise in cannabis consumption does not surprise me at all.

It’s a drug that is strongly related to pain relief (like the bodies own pain relief chemicals) both physical and mental.

It’s main “downside” is where it gets it’s early street name, in that it makes you “doppy”.

The opposite effect is achieved by amphetamines but they do not stop the pain relief effects of cannabis

Back in the 1980’s research was done on using the two in combination to deal with long term and otherwise incurable pain. Only as usual certain types of Politicians with very conservative often nutball religious convictions kicked off.

However like the active ingredient in “magic mushrooms” now getting proper research into how it helps for chronic depression. Research into chronic pain has alleviated restrictions on cannabis I suspect amphetamine research in combination will be re-started and published with probably beneficial results. As for other “drugs” it’s long been known that “LSD” helps those with chronic migraines. Medical literature is increasing with the likes of,

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC5584001/

What the graph in the “WA Today” article tells me is that for most recreational drugs little has changed, but that Cannabis and methamphetamine usage is rising significantly.

Which begs the question of people maybe “self medicating” for what they feel is incurable pain and consequent depression in WA…

Now the relevent question might be,

“What could have caused an increase in this sort of pain in WA?”

And for that matter world wide…

There might be a relevant answer a little further up this thread…

Clive Robinson • March 16, 2024 9:30 PM

@ vas pup, ALL,

With regards the Science Daily article,

“Advanced killer robots are more likely to blamed for civilian deaths than military machines, new research has revealed.
“

To be honest I can not say I’m surprised.

Most humans when presented with something outside of their actual knowledge domains resort to what is often called “The Duck Test” of,

If it,
1, Looks like a duck,
2, Quacks like a duck,
3, Waddles like a duck,
Why would you think it was a goose?

At one time I used to work on the design of sub systems for “Bomb Disposal Systems” some called them “wheelbarrows” some called them “robots” neither was true, they were more accurately “Remotely Operated Vehicles With Remotely operated actuators”(ROV-ROA).

But the point is to most people they were either,

1, A robot.
2, A machine.

We are familiar with machines in the general sense of realising they have no “free agency” even when the go wrong and jump the tracks etc. We do not consider “the machine to be at fault” as it has no agency. We instead blame the closest “Directing Mind” we can find, be it the operator, maintainer, owner, builder, designer, specifier of the machine and it’s intended purpose.

However most have no real familiarity with robots even though we might have one or two in high end kitchen appliances (the simplest being auto-cookers in microwaves, or washing machines, that change their operation dependent on what you load into them). Or other more mobile home appliances like vacuum cleaners. What we are familiar with though, is the B-Movie “Mechanical-Man gone crazy” with the obligatory in chest doomsday device, or the computer that will destroy the world from space memes with awful catch phrases like “I’ll be back” or clunky footsteps.

Then we see US Army “robots” that look like mechanical dogs or headless horses and some how leap to the conclusion they must be more intelligent than the animals they vaguely look like…

Thus we fool ourselves into nightmare worse case thinking, via our B-Movie preconceptions and the duck test.

Putting labels on things is in effect just “putting a thumb on the scales” of an observers balance of judgment.

I have a friend who is gadget crazy and has both a vacuuming robot and a security robot trundling around his home. He also has “a neighbors cat” that comes in to demand food and attention. The cat appears to have a more sensible approach to the robots than most humans…

Clive Robinson • March 17, 2024 7:10 AM

@ ResearcherZero, ALL,

“Your collection of personal germs is a unique blend. Pretty darn cool hey! 😀”

That depends…

Some see your “micro flora” as more unique than a fingerprint, and like skin cells subject to “Edmond Locard’s Principle”[1].

Thus they are already seriously looking at using it as a “biometric”.

Some TV series like “Bones” have mentioned it and “Warehouse 13” made a fairly big thing out of “Arties’ spit lock” on the “Bronzer” which had just the right amount of comedic yuck factor.

[1] Most simply expressed as,

“Every contact leaves a trace”

It’s the notion in forensics that there is an exchange of material on every contact. Thus if you have been to the scene of a crime you leave part of you behind, and take part of it with you. Thus you can be tied to the crime… (Actually not it’s a lot more complicated).

https://en.wikipedia.org/wiki/Locard%27s_exchange_principle

Clive Robinson • March 17, 2024 6:55 PM

@ ALL,

Any one remember the EncroChat encrypted phones that were a Police plant?

And wonder how any convictions were going?

https://www.yourlocalguardian.co.uk/news/24182572.croydon-dealer-jailed-encrochat-plans-uncovered/

Well “Stephen Dynan” has been awarded 12 years’ imprisonment on Friday, March 8, for admitting “Conspiracy to”,

1, Obtain a firearm
2, Import cocaine
3, Import cannabis
4, Supply cocaine
5, Transfer criminal property
6, Carry out a sophisticated warehouse burglary

Note they are all “Conspiracy to” charges which in all probability means it was just on data from the Backdoored EncroChat phone.

The desired firearm was apparently a “skorpion machine gun”, these are only a little bigger than a hand gun and can easily be concealed under the arm or carried in a belt pouch
they fire at a “stoped down” rate of 850/min and much favoured with certain types of criminal or terrorist.

Often the barrel is threaded and it can be fitted with a “moderator” (silencer) that actually makes it quite quiet in use as well as easy for “two handed” use for greater accuracy.

https://en.m.wikipedia.org/wiki/Škorpion

Apparently a non automatic version is liked in the US as “range toys” or “plinkers” and cost around $750.

I’m told that the full spec versions are currently coming out of the Ukraine War for less than €500.

Clive Robinson • March 17, 2024 10:03 PM

@ Jerome,

“Regarding my question about the security of Rasp Pi.”

Sorry I thought it was a general enquiry.

My “security view” of all consumer grade OS’s security wise “not fit for purpose”.

In many ways you would be more secure running pre 1995 hardware with no “connectivity” and an OS of that vintage.

The simple fact is anything with a radio chip –which is what the Raspberry Pi’s “Broadcom” chip is,– is decidedly “suspect” security wise… Even if being run without any network or other recognisable communications cables plugged in.

Since Apple and Google “did their thing for C19” their OS’s have had code to “beacon Bluetooth” in various ways, and in the case of Smart Devices WiFi is effectively mandatory.

I’m told that Microsoft Win 11 likewise sees RF chips as “use without user permission” for that “consumer experience”.

To be honest I’m not going to find out as I had such a bad experience with Win 10 and getting rid of it from a couple of laptops that I’ve banished any ‘current’ supported MS OS’s from my personal systems.

As far as I’m concerned Micro$haft are now subject to the,

“100% of everything is crap”

Rule.

As for Network SDR’s yup you can use them and they are very useful for “Radio Engineering” work. But not for computer security work. Because the antenna is “local to the SDR not you”.

Clive Robinson • March 18, 2024 4:56 AM

@ ResearcherZero, JonKnowsNothing,

Re : Hogs as “Ram Raiders”.

“Pig skin is super tough. Ridiculously so. Even large bullets often don’t stop them.”

It’s not just the thick skin.

A friend in Europe hunts “wild pig” as they are what is politely called an “invasive nuisance species”. A description that comes nowhere near close to the environmental damage they do, and they are spreading.

The gun my friend uses is the sort that would smash your shoulder if you are not properly trained, and would more properly be described as “ordinance”.

His comment is that unless you can get a clear shot to the brain you are very much endangering yourself. Because “they don’t drop” even when a bullet goes right through the body.

He tells a story about how he learned to be more cautious, he once put a round through the front shoulder of a sow and ended up having to jump up into a tree as the brut just went into “Ram Rage” mode smashing at the tree untill it finally bled out several minutes later. The tree was so damaged in the assault that it died as well… As my friend points out you can not fire a fifty cal rifle in a tree as you would pop right out. So he now carries a fairly large side arm that as he puts it would pass through a cylinder block of a family car.

But he also cautions against relying on vehicles to hide in as those piggy jaws are like those devices first responders use to cut cars open, and if the pig can get a grip on a vehicle body work it might as well be tin-foil…

Even wolves leave them alone so there are no predator species to keep them “naturally” under control. Except… “they eat their own”… if you wound one it’s friends come round and turn it into “dish of the day”… So they would have no problem leaving only your teeth behind.

Apparently as poison and even exploding bait does not work there is apparently ongoing research into a “genetic solution”. That is if you can not find a big predator then find a micro one such as a pathogen that kills or sterilises them.

I think we can see where that might end up…

But it kind of proves the old,

“Can man create a problem, man can not solve?”

Clive Robinson • March 18, 2024 7:27 AM

@ Winter

Somebody I’m aquatinted with who has “An English sense of humour” is doing a “Recreational Vehicle”(RV) tour of the US… and Texas is one of those places with weird sounding RV parks. Apparently they were not attracted to,

“Peace N Quiet RV” in “Gun Barrel City” main street…

According to the add,

“The Newest RV park in Gun Barrel City. Located right on Main Street with EZ access from 175, close to town, Cedar Creek Lake, Activities, and more! Last Updated: 03/13/2024.”

Apparently there is an app especially for RVing giving places activities and attractions like “No Children”, “No Dogs”, “No …”.

For someone like myself who has spent time “living in a hole in the ground under a tarp” such amenities do sound a step up 😉

Clive Robinson • March 19, 2024 7:25 PM

@ Winter,

“The whole conspiracy theory is in line with every other epidemic.”

It was not a conspiracy theory I was talking about but the simple provable truth.

The thing about conspiracy theories is they only appear to be based on truth. They are either some “held to be true” falsehood that gets twisted in some way or some faux truth that can be neither proved or disproved based on religious type cult belief systems.

Corona viruses are not DNA based but RNA based, so can not have a DNA sequence. So can not have been DNA sequenced.

So claiming it’s all XXX because labs/science have not produced a DNA sequence only shows one of two things,

1, @AL does not know what they are talking about and has no relevant domain knowledge.
2, @AL is deliberately creating a falsehood hoping to create cognitive bias in others based on their lack of knowledge.

Out of politeness and that it appears to be a common issue, I’m assuming the first.

What others decide is upto them and their point of view.

Clive Robinson • March 20, 2024 4:09 PM

@ ALL,

I refer to the owner of a media empire as Rupert “the bare faced lier” Murdoch and one of his past senior editors as just “The Dragon Queen”.

And people wonder why, well it’s because he lied in court, and she was a spousal abuser amongst other crimes.

Well here is an update on them both separately and jointly liable,

https://www.bbc.co.uk/news/uk-england-london-68615789

In it you will read of a number of things security related including the mysterious disappearance from a secured repository of an evidence containing hard drive that had been in the dragon queens computer.

Clive Robinson • March 21, 2024 1:06 AM

@ ,

Re : Google had lined the sights up on their big toe…

“The only surprise is how easy Google/Alphabet have made it. I would have assumed they would made a walled garden impossible to escape from.”

There is a little history you may not be aware of…

Back a long time ago when Micro$haft decided to move off of “desktops and servers” and were very hot on TPM Google as was then told them if Micro$haft tried any of it’s “lockin” nonsense, then Google would put them six foot under via every legal avenue open to them. Back then Google appeared to have real teeth as Micro$haft had been on the end of a loosing streak against regulators on both sides of the puddle.

So Micro$haft backed off from “lockin” back then, but with Win 10 and now 11 they are “trying it on” again (just one reason I never went that way). Well see “Embrace, Extend, Lockin” with the “Linux on Win” go to the next step any time soon I suspect.

Any way having threatened Micro$haft the way they did and with there being documented evidence to that effect… Google can not go down the “lockin” route themselves without getting a “tap on the shoulder from a regulator” or three.

As for the SDR stuff it’s on my list of things to do, but medical issues are taking up rather more of my time and energy than I would like[1].

But an interesting thing… People buy radio scanners and they cost upwards of $100 USD. However a Chinese company called “Quangsheng” has come out with a Two Way radio the UV-K5 that is around $30 USD it’s also very “modder friendly”. Not only are there some really interesting firmware upgrades that turn it into an 18MHz and up to 1Ghz all mode scanner panoramic receiver,

https://hamradioinsights.com/2024/02/04/quangsheng-uv-k5-best-budget-handheld/

There is also hardware mods, one of which takes it down to longwave,

https://m.youtube.com/watch?v=jxwBlp8HfKU

So you can get all the benefits and more of a “all mode” “pocket scanner” that does what was once called “DC to daylight” and also FM VHF/UHF two way radio for less than 1/3rd the price of just a VHF/UHF FM scanner.

For those doing adventurous activities including sailplanes, paragliding airsoft paintballing and more traditional “out and about” activities it’s a useful thing to have.

It also can be used as a cheap “test instrument” for fault finding and the like and will also do “bug finding” for those looking for old style surveillance devices.

[1] I’ve been annoyingly effectively poleaxed with medical issues for over a year now. In part due to medication changes for one nuisance –blood clot the size of the end of your thumb in the right atrium– being changed thus really aggravating another nuisance peripheral vascular issues. Causing not just issues with my feet and stability on them but the resulting muscle loss and exhaustion due to being near bed ridden by the other issues. You truly know you are an “old fart” when you get giddy fall over then lack the ability to get back on your feet. Trust me when I say there is very quickly no fun what so ever in having to sleep three times a day and it’s worse with being less mobile than a slug on a salt patch as well as having feet so swollen that there are no actual shoes made to fit… Recent surgery on the feet has improved things a lot but the lack of stability and exhaustion is not improving at anything like the rate I would like. Also having to keep “dressings dry” whilst wearing size 20 “jesus boots” sandles in the wettest month for years makes “getting out” for even a short walk a hazard. The resulting muscle loss means that even sitting down is really really uncomfortable really quickly as is laying on my back. And as it also stops blood flow that causes other issues. And so the Medical Merry go round revs up a couple of gears… Oh and the Dr called today to say not just Hi but I also not only need other meds changes, I now have to have Vitamin B12 injections and foliate supplements urgently as I’ve got significant issues… As they say “it never rains, only pours”

Clive Robinson • March 22, 2024 10:17 PM

@ JonKnowsNothing, ALL,

Re : Triage, discrimination and negligence.

“Unfortunately, people don’t encounter this until something catastrophic happens and then they get smacked in the face.”

It’s not just in the case of “alleged accidents” and age.

As both you and I know from experience the “hidden argument” is not actually anything “medical” in most cases, but “economic worth” described in terms such as,

“Years of quality of life benefit”

Where another dread term “micromorts” comes into play as a rationalisation.

Put simply for political reasons as far as “the state” is concerned you “die on the day you retire”. Because you in effect move from one column –pay in– to the other column –pay out– on their books. That is you cease to be a “contributor” to be gulled and robbed, to become an “expense”. Thus the sooner you are dead in reality the more profit there is you make for them. With the amounts involved justifying what is murder.

The only factor that comes into play is if your cost is payed for by another entity such as insurance, but they for the same profit reasons they want you dead even quicker and are more blatant about it.

I have very recently had “elective surgery” on my feet that I had been putting off for a number of years (me and surgery do not get on for various reasons). The reason is that there are two lines on the graph that matter,

1, The first is the increasing complications as my body tires of fighting the problem (infection from ingrowing toe nail etc).

2, The second is the rapidly decreasing probability the surgery will be made available to me (as I get older).

These are not straight lines but power laws. The first increases with time, the second decreases at an even greater rate with time.

Thus there is a crossing point. If you are to the left you get the surgery and the first curve effectively stops rising thus you live longer. If you are to the right you don’t get the surgery and you die maybe twenty years earlier than you would otherwise. In part because even low cost out of patent anti-biotics get withdrawn as you get older (about four years after retirment age).

The only reason you get vaccines after retirment is that on balance it costs less than the embarrassment of having old folks gasping to death in bus shelters outside hospitals.

The “official” lie for this behaviour is the current “Austerity Economics” favoured by the right wing politicians. The reality is that it has nothing what so ever to do with austerity but everything to do with,

“Robbing the poor to pay the rich”.

That is what you pay in tax or insurance for your future and old age gets “stolen from the pot” and given to certain wealthy people in various ways. Who then “kick back” a tiny fraction to the politicians via lobbyists and campaign funds and similar (supposedly “free speech” in the US…).

Almost invariably the stolen money that should have be working for peoples future, ends up in political pockets of those the people would certainly not vote for. Thus in my view it represents an illegal tax at best through deep corruption and on to what is effectively murder.

It’s one of the reasons why there is increasing disparity of the 1% of the 1% who are rich and nearly all others who are by definition “the exploited poor people” even if they are upper middle class in nice houses etc. Thus the result is,

1, The poor get poorer,
2, The poor are dying ever younger.
3, The rich get richer,
4, The rich live twenty years or more longer.

I very much doubt any of the “self entitled” rich read this blog, but if enough “honest” but exploited poor people read this then maybe their outlook will change.

It’s just one of many reasons why I say that,

“Money should be removed from politics.”

But then what do I know 😉