Schneier on Security

Clive Robinson • July 18, 2024 3:00 PM

@ Bruce, ALL,

Re : Easily Transportable value.

“I think cryptocurrencies are more susceptible to this kind of real-world attack because they are largely outside the conventional banking system.”

It’s a lot more than just “outside the conventional banking system”.

In the UK and other places hogh end cars were “grabbed off the street” and gone before the authorities could do anything about it.

Before that there were the “Rolex grabbers” who would just grab the watches and again they would be gone before the authorities could do anything about it.

As far as has been said the valuables were out of the country legitimised and sold on.

Then high end cars were stolen from peoples homes, in some cases because of poor security in the vehicles.

Also there was a gang in London that were targeting people in their homes with a level of violence via torture etc that few recovered from.

The problem is the mentality of the thrives and the fact of easy “grab and run” with value.

So it’s not just Crypto-coins that are going to come under this sort of attack it’s what gives apparently easy gain of value.

However it appears the physical attacks were far less successful than the online attacks for this gang.

So I suspect that we will soon be reading about a new form of home invasion or similar physically violent attack on things that have high value but are easy to transport away and beyond current recovery.

Because the only way to stop it is to stop those with the mentality for this type of violent crime. How you do that is currently an open question as the “old fashioned ways” are considered abhorrent to modern society.

Clive Robinson • July 22, 2024 7:30 AM

@ Bruce, ALL,

Re : ICT Six degrees of separation and the critical path to Hades.

When people are taught about computer communications networks they get taught that the ICT world is like the roots of a tree. Or even a bunch of chains hanging from a single point. Thus data traverses up then down, with the failing that there is only one path between any two points. Hence every link forms part of a “Critical Path” for one or more points so there is always a “Single Point of Failure” in all the communications paths and actually many. Thus such networks are very fragile and increasingly so as you go up the hierarchy, with one link breaking at the top taking out half the tree from the other half.

Anthropologists and Sociologists get taught early on that people form clusters that form communications nets with multiple cross links giving a multidimensional arrangement that gives rise to the

“Six Degrees of Separation[1].”

But importantly no single path thus “critical path” or “Single Point of Failure”. Thus are usually very robust.

The reality is that in all large communications networks it’s a mixture of both types of networks.

With humans in social groups it’s small multidimensional groups or “tribes” linked by less dimensional paths between “tribes” to form larger social groupings.

With ICT it’s almost the opposite, for reliability the top levels in the hierarchy are almost always linked in a multidimensional way and at the bottom for low cost and simplicity they are linked in simple stars or chains with almost every link being a single point of failure, hence are fragile.

What is not much thought about outside of network engineering is that with data communications networks there is a middle layer where chains/stars become aggregated around local servers or services and these services have two or more connections upwards to increase reliability. It’s this third layer where from an attack point of view the most advantage for an attacker can be found.

I was reminded of this over the weekend with the fall out effects from the CrowdStrike Update “patch” released on Friday.

The reality which will surprise many is that not that many computers were actually “patched” thus “directly effected”.

Yes there were quotes floating around of 20% of computers world wide were effected but that gave the incorrect impression to most people and that in turn caused more problems[2].

What happened was that computers that were not “patched” thus not “directly effected” were “indirectly effected” because they could not “communicate” with services their users wanted to. Because either the service was “Directly Effected” or some intermediary service was “Directly Effected”. Though on reading the MSM it sounded like all major services were Directly Effected, the reality is most major service providers were not. It was mid to small corporate and consumer company “business support services” that got hit (ie organisations who see ICT as a necessary evil not a core business who buy-in rather than develop their ICT solutions).

The reason this CrowdStrike patch caused such wide spread effects is that in many cases it was the “third layer” services and systems that had been patched with it. And they in effect broke the communications links between low reliability chain and star networks connections to the high reliability multiple linked networks.

From a “maximum disruption” perspective hitting this third layer is probably the most advantageous for an attacker.

Especially if they have a certain type of intent, such as getting people to pull in malware[2].

Whilst we have seen similar malware pushing during “lockdown” with “home working” being done on the cheap this is effectively a first.

That is whilst some were aware that “theoretically” the same disruption as lockdown could be done by an attack on third layer systems, I doubt many linked it with using it to push malware.

Well this CrowdStrike “Friday Patch” caused those “weekend worker/users” at home to do the wrong things and we will be seeing the malware fall-out still being cleaned up for months if not a year or so to come.

But the real concern from a “security economics” perspective, is how many “toe-holds” have been created that will cause future abuse of commercial and corporate systems as they are now effectively unlocked “backdoors”.

[1] It’s the notion that socially there are very short chains of no more than six people between you and every one else in your country, continent, or the world,

https://en.wikipedia.org/wiki/Six_degrees_of_separation

But not explicitly stated is that the shorter the chains the more of them there are hence the multidimensional topology that gives multiple chains between any two points. Thus the very high degree of reliability of communication results, as the expression “Gossip spreads faster than weeds” implies. Scientific investigation into “fake news” has shown this to be probable because we all have a threshold where the more people we hear something from, we reach a point where we in turn will tell it to others and so it quickly “snowballs”.

[2] One problem that has been seen is that as the patch went out on a Friday the number of people available to work on it was reduced and so an information vacuum developed. Unfortunately this opened up an opportunity.

Since lockdown people “working from home” over the weekend has increased significantly. These people because they have career effecting deadlines were to put it politely in a form of desperation / panic mode. The vacuum of information allowed those pushing malware to put out “fake news” fixes and “How-Tos”.

Thus desperate people not understanding the problem dropped protections and pulled in malware onto their computers. How many backdoors and toe-holds this will give into corporate networks in the future I’ve no idea, nor has anyone else currently. But I suspect that as with the older APT attacks that were in place for years we will still be seeing the after effects for months if not years.

Clive Robinson • July 22, 2024 9:39 AM

Marco Charlin,

Re : Information is not physical.

With regards,

So this is different from hoarding Cash How?

Well cash is physical and bulky and not something you would want to try carrying around in any great quantity. As a rough idea $1million in single bills is about twenty five cubic feet and weighs about a ton. And why only idiots try to do stick-up robberies on banks or shops.

It does not matter if the crypto coin value is $1 or $billion it’s just ones and zeros whizzing down a wire after you push the enter key. There is no staggering around the streets under the weight of it.

But also consider the information about who has or has not got cash is usually quite private. Also people who keep tokens –valuables– of high value but small size tend to keep them locked up in safes that are not in view by anyone. Some even have multiple safes, one with small value items in a wall with a picture or similar over it “just in case” they get raided or for small “day to day stuff” and one longterm safe somewhere else that holds the high value items[1].

One of the problems with these “Public Ledgers” like Blockchains is that they are “public” and whilst they pretend to have anonymity in that personal details are not as such held, transactions are there for all to see and analyse as is the total number of tokens held in a wallet.

So unless the holder of the wallet is extraordinarily careful with how they use it these wallets become traceable back to individuals and any raiders will know exactly how much they are getting.

So contrary to what many think crypto coins really are very bad for your health.

[1] Such hide aways have been found In garage floors with a large steel plate over the top with a 4×4 on top jacked up as though having engine work being done on it or a boat on a trailer etc. Some have been cemented over with a “float coat” over the whole garage floor, so you would beed a Ground penetrating radar to find it. I’m aware of one criminal who built a hidey hole in his garden under a composting bin on a wooden plinth made of shipping pallets that you’d need a fork lift to shift. But also one that made the news in NI who hid a large amount of stolen money in a large “wheely-bin” down the bottom of his garden. But the one that made me laugh was back in the 1980’s the executive of a foreign oil company in Nigeria who whilst kneeling praying at his mothers grave was quietly burying the money he had embezzled. But the best was yet to be, because when the police arrested him and dug the money up it filled four large suitcases… Due to one thing or another by the time the Nigerian Police had escorted him to the near by police station three of the suitcases and two police officers had vanished. One of the missing police officers was later detained at the boarder with a suitcase of money that somehow became miraculously only a quarter full by the time it got to “head quarters”… As expected the executive was finally brought to court and found guilty and jailed… But the bit that made me smile was on being released the oil company gave him his old job back, because they had not been able to find anyone who could run the operation as profitably as he could…

Clive Robinson • July 22, 2024 6:38 PM

@ Bruce, Nicholas Weaver, ALL

Re : Formalising block chain proof of work trilemma.

Back over a half decade ago in a blog post it was posited –as was fashionable at the time– that with blockchains there were three desirable factors,

1, Decentralisation
2, Scalability
3, Security

With the usual “You can not have all three…” type comment.

Whilst most accepted it as was, there was no mathematical or logical basis by which it could be proved.

Well the IEEE have provided a paper that goes some way to providing a mathematical formalisation,

T. Nakai, A. Sakurai, S. Hironaka and K. Shudo
“A Formulation of the Trilemma in Proof of Work Blockchain,”
IEEE Access, vol. 12, pp. 80559-80578, 2024,
doi: 10.1109/ACCESS.2024.3410025.

https://ieeexplore.ieee.org/document/10549891

Abstract :

“The blockchain trilemma, introduced in 2017 on a blog post authored by Vitalik Buterin, one of Ethereum’s co-founders, asserts that achieving decentralization, scalability, and security simultaneously within a blockchain is unattainable. While this concept has garnered empirical support through extensive analyses of blockchain performance, it remains unproven theoretically. In this study, we establish a formula representing the trilemma within a Proof of Work blockchain and validate it through theoretical and experimental analyses”