Schneier on Security

Clive Robinson • July 26, 2024 10:41 PM

@ ALL,

Re : Fun thought for you all.

As several people pointed out about the various reasons Secure Boot and similar came into existance was not to protect the end user as Microsoft and others have claimed. But it was as the Fritz-Chip or DRM replacement. Needed due to effectively the same “Root of trust” leak we see with Secure Boot. It was of the DVD CSS “Player Key” reverse engineered by “DrinkOrDie”[1]. That gave us the likes of DeCSS that so upset DVD producers like Disney and Co. They pressured the likes of Microsoft and Intel to come up with a way to “Protect their IP Rights”.

Well for those that know what to do, this “PKfail” key leakage will enable the use of “Shims” in drivers etc to “Rip Media” of even the more modern supposedly secure varieties…

So I suspect there are a number of people at “Copyright Holders” that are grinding their teeth.

[1] The issue with the DVD “Content Scrambling System”(CSS) is –as was pointed out on this blog long ago,– it was an “Off-Line” system using “symmetric encryption” which could never be thought of as secure, just obfuscated at best (ie “Security by Obscurity” which is no security at all in an Off-Line system).

Put simply it ment that the user had a copy of the key somewhere on their computer, all they had to do was find it. Which is what a reverse engineering group who called themselves “DrinkOrDie” did. Once they had found it, it was only a matter of time.

Clive Robinson • July 28, 2024 6:36 AM

@ Winter, ALL,

Re : IP and Markets.

“But I am convinced the IP they wanted to protect was their own, or rather, MS’ own applications.”

Whilst that was almost certainly part of it much later, the reasoning was simpler than that.

People forget that CD’s came long before DVD’s were even thought of and before PC’s were at the 16bit I/O bus stage.

Microsoft completely misjudged the potential CD market. In part because to them “audio was for games” and they did not support it in the kernel or most other parts of the OS and not really in applications either.

Third party developers pushed audio onto Microsoft hence eventually the “Intel Architecture Labs”(IAL) AC97 standard prevailed over Microsoft junk and other power hungry systems from specialised audio companies.

But others had pushed CD not just for audio but more importantly for data. At that time 100megabyte hard drives were seen as the “high-end” so why worry about a bit of plastic with unreliable storage of just under a gigabyte…

Well a company called Silverplatter which I worked with and eventually for decided to bother. As CD’s with reliable 650megabytes of data were an ideal way to ship certain types of “read only” databases. In effect “libraries on a disk” for researchers a new market was created that rapidly expanded.

Microsoft had been blind sided several times thus rushed to catch up, dumping much of their “lock-in” projects in the process.

As part of that Audio CD’s got played on computers and audio tracks converted from WAV format to one of the then new lossy compression modes and the Recording industry went into battle mode and launched law suits etc. And the Fritz-Chip initiative that had already started some time before became more heated. Have a look at the “Digital Audio Tape”(DAT) standards to see about the “Copy Protect”(Cp) bit of the “Serial Copy Management System”(SCMS) designed to stop copying of CD’s onto various DAT formats also US legislation of the 1992 “Audio Home Recording Act”(AHRA). Which,

“amended the United States copyright law by adding Chapter 10, “Digital Audio Recording Devices and Media”. The act enabled the release of recordable digital formats such as Sony’s Digital Audio Tape without fear of contributory infringement lawsuits.”

https://en.m.wikipedia.org/w/index.php?title=Audio_Home_Recording_Act

Such law suits had come from CBS and the RIAA in the 1980s prior to the PC being capable of dealing with audio in anything other than low 8bit resolution at low rates.

Like other Europeans I took exception to the US Recording industry and the legislation, thus designed an “interface” that disabled or enabled the “Cp” bit protection at the “artists will”. It was designed to work with either S/Pdiff or TOSlink systems that I’ve talked about in the past (for using as Data Diodes for “gapping” Crypto Systems).

That’s why CSS was put on DVD’s. The “recording industry” controlled the keys and were not going to ceed the whip hand. Microsoft could not “break into that market” without access to those keys. Thus the recording industry dictated to both Microsoft and Intel.

So both Microsoft and Intel accepted that they were “locked-in” to the wishes of the RIAA and others who have a legal mandate not just through the AHRA but later DMCA.

Clive Robinson • August 1, 2024 9:06 AM

@ cybershow, ALL

Re : Individual v societal balance.

You observe,

“It’s no failure of science, technology and engineering but a long overdue moral reckoning.
“

It’s actually a failure of the avarice that is the “Great American Dream”.

Most should know by now –I hope– that we only survive because of supply chains. Less well known is that supply chains are just the paths by which raw resources become value added price inflated goods.

Each step of the value added path allows for a degree of profit that comes about when you look at the implicit costs in the supply and demand basic notion of economics.

If you get the input resources for nothing or next to nothing, but hold the supply of wanted goods by blocking the supply chain, then your profit potential starts moving toward maximum. But these deliberate market manipulations are “dishonest moves” hence legislation to try to limit them.

This leaves only “cost reduction” as a faux way to “increase productivity” for most “managers”. But increase “share holder value” in the very very short term.

Since the 1980’s I have been not just observing but commenting on such behaviours. Thankfully I know longer feel like a voice in the wilderness these days.

But think about the way that the software industry went because of Bill Gates and Co.

To get around a lot of legislative restrictions the did not “sell goods” but early on “leased them” or now “rent them”.

Without going through all the steps it can be seen that such control of goods not just creates actual monopolies/cartels but actually prevents fair competition in not just the primary “faux market” but any subsequent secondary markets.

But it also has an issue. A long long time ago I stopped buying into a,

“New OS every year”

That in turn ment you also had to have

“New Apps the following year”

As the support to make them work was removed and you were forced into an unwanted and unwarranted upgrade path at considerable cost.

As I’ve mentioned I still have an Apple ][ not just running but being productive with apps and other software I developed. And the key press to screen response for a 1MHz 8bit CPU still out performs that of the most modern of computers…

That alone should tell people something.

I could go through the other OS’s and APPs, but my work style has been fairly constant and is,

“Type in an editor, pretty up in a publishing package” only if needed.

Yes I,

1, Brain dump in,
2, Do spell corrections,
3, Move text blocks,
4, Make “sections and chapters”,

And a few more steps before finally shoving the “text file” into either a “Desktop Publisher” or “WYSIWYG” word processor.

Finally outputting in the best file format “lingua franca” that is reasonable for recipients. Which was in a formatted text style of “Rich Text Format”(RTF) but is now a variant of multi file HTML/XML files in a compressed “archive” called DocX. Keeping things in simple text file format allows so many other things such as putting the documents in databases for revision control scanning for dubious content / malware and quite a lot else including effective “energy gap crossing”. Some of which others are now catching onto with GitHub and similar (but unfortunately not the security).

The point is “my process” has in effect remained the same for over three decades. And not only has various security properties as benefits, it means all changes and updates are kind of incremental at worst (and retraining humans is the most expensive thing you can do in any environment).

Whilst those using MS Word etc are forced onto a treadmill or “Hamster wheel of pain” that is at best stressful, disruptive, inefficient, insecure, and worse, but unavoidable due to the software supplier dictate to create “profit”.

So yes I still use Wordstar 4, and Turbo C in a 16bit “DOS compatibility box” running inside a VM on a more upto date and secure *nix OS.

A habit I started back in the early to mid 1990’s when I could personally afford to buy a SysV unix and DOS Merge OS package (I still have and use).

The reason I did this was because of “In Circuit Emulators”(ICEs) supplied by Motorola. They would only work in MS-DOS via a serial port… So you had to use a whole 486 to run one, which on my home network was not something I could afford for a multitude of reasons.

However stick on Unix and DOS Merge and you could via a “network serial concentrator” run six or more ICE and quite some test kit on a single 486 effectively remotely (with the kit in the “small room” lab and you at your more comfortable desk in the lounge 😉

Oh and creating test reports and the like was likewise very easy because it was all on the single box.

So I did the same at work and kept the computer very much out of sight under my desk. My work colleagues were suspicious of my “productivity” and the fact I spent so much of my time at my desk.

However because of a break-in with theft of the computers a whole R&D lab with thirty odd people crashed to a halt. Loaning a half dozen of my home computers at least got the engineers back up and running.

With an unfortunate side effect, due to my boss thinking it was such a “productive way” to work, my downfall as an engineer into System/Network manager started…

Clive Robinson • August 5, 2024 10:28 PM

@ ResearcherZero,

“Code signing is the process of applying a digital signature to a software binary or file.”

Whilst not incorrect you will find “install package”, “build package”, or “archive” used as well.

In essence you take the “finished” package or directory compress it and take the hash of the final glob and sign that.

Without going into details there are certain ways it can be attacked but they are considered as hard as finding a collision (though there is no proof I’ve seen on that).

The important thing to remember is that code signing says nothing about the quality or security or other important attributes of the software. Worse the way most software houses go about things there is no method to stop malicious code being slipped in as we’ve seen in the past.

Think of it like the seal on a plastic jug of milk, it says nothing about the quality or freshness of the milk, or if some disgruntled factory floor worker “gobbed in the jug” or worse before it was sealed.

Clive Robinson • August 11, 2024 9:33 PM

@ ResearcherZero, ALL,

I also made comment several days ago about “SinkClose” vulnerability and the fact it goes back probably two decades at least,

https://www.schneier.com/blog/archives/2024/08/people-search-site-removal-services-largely-ineffective.html/#comment-439936

It’s funny in a way, well over a decade ago and long before Ed Snowden lifted the curtain a little @Nick P and I had discussions on this blog about what hardware we considered untrustworthy by date.

I indicated anything beyond the mid 1990’s and he prefered the mid “naughties” of 2005 as a cut off.

As it turns out the NSA were exploiting the “go faster stripe” in CPU vulnerabilities back even before that…

Having been involved with designing high performance CPUs from “bit slice” chips back in the early 1980’s for very high performance “embedded” systems in body scanners I was aware of the “across the ISA gap”[1] issues of not just “MicroCode” errors but also the lower “Register Transfer Language/logic”(RTL) and bus timing issues that gave rise to “pipeline” designs and the further complications they added.

Then from designing specialised instrument control systems for high radiation environments (think Space craft payloads, nuclear reactors, and medical equipment etc) I’m aware of “bit flip” issues in memory and logic and how there are some forms of attack you can not protect against from “up the computing stack” no matter how much various programming and hardware methodology advocates try to insinuate otherwise. All you can do is “move the probability” line a bit, but each move is expensive not just in hardware but more importantly time, thus cycles/sec. One dirty secret is the more cache methods you use as “Go Faster Stripes” the more likely you are to have bit-flips happen (look up metastability for the “down in the dirt reasons”). So you end up “on a hiding to nothing” game, of trying to find a “sweet-spot” with each technology change. It kind of makes “The Red Queen’s Race” look easy, as you can not beat the speed of light,

“Just get closer and closer till heat death, claims yer”.

[1] The “across the ISA gap” is a way of looking at the “Central Processing Unit”(CPU) and what is inside it and what is outside it at a 20,000ft view. The “Instruction Set Architecture”(ISA) is in effect not just “the personality” of the CPU and how the “Arithmetic Logic Unit”(ALU) and “Register Set” are addressed by the software Assembler Instruction Set, but also the physical logic and timing of the electrical signals of the CPU pins. As more and more gets integrated onto chips like co-processors, “Memory Management Unit”(MMU) and “Direct Memory Access”(DMA) controllers and even I/O, the expression becomes more wooly. The early-ish IAx86 book from last century I have is split into volumes and covers well north of a thousand pages, and even three decades later I can honestly say I’ve not read it all, and I suspect that is true for nearly all who work at the hardware level at the motherboard side of the gap.

Clive Robinson • August 22, 2024 10:57 AM

@ ResearcherZero, Who?, ALL,

Re : SBAT worse than you think and doomed before it was thought up.

The way “Secure Boot” was thought up was bad, the way it has been extended worse, and for various technical reasons it’s a failure that can not be repaired or augmented, it really can not go on as is as it gets worse with every alleged improvement.

When you indicate,

“Before the the UEFI Revocation List can be updated, some devices require a BIOS update.”

Even then problems remain… Have a read of,

https://github.com/rhboot/shim/blob/main/SBAT.md

And have a think about why that revocation list is bad, and why the version number idea is bad as well.

Then try and think your way down the notion of “Dual Boot OS” systems and how you might try to make it work…

Do not expect to find a solution as there is not one that is secure or reliable as far as we can tell…