Schneier on Security

Clive Robinson • January 16, 2025 10:27 AM

@ Bruce, All,

There is a fair bit of difference between 4,258 US based PC’s cleaned up and 45,000 IP addresses in the US seen having “back-and-forths”.

Which raises all sorts of questions that have not been answered.

However one that can be answered is the age old,

“How could this have happened?”

And it’s something US legislators the US DoJ and FBI are avoiding saying.

But the answer is,

“Due to lobbying and the like the US has failed to bring in legislation to stop “not fit for market” software being made. The DoJ and FBI have also failed to use the little legislation there is.

In part this was due to the “backdoor desire” but as we have seen the FBI has been forced to change it’s position on E2EE. In part because of alleged Chinese activities critically effecting US National Security and in part because many of the US non law enforcement security agencies have in effect read them the riot act.

But in the main I have reason to believe that “backdoor the crypto” is nolonger the desire it has been for four decades. Because of the oh so much more powerful “Device Side Scanning” that importantly also does an “ET Phone Home” “to the mother-ship” across an open network.

Even though the Device to OS Manufacturer personal and private data flow may be supposadly obscured by “encryption”, we know that any even less than half competent US Guard Labour agency could get the keys etc as the legislation to obtain the keys has been in place for quite some time.

As noted back in the days of the Carrier IQ scandal just about a decade and a half ago,

https://www.engadget.com/2011-12-01-carrier-iq-what-it-is-what-it-isnt-and-what-you-need-to.html

‘https://theweek.com/articles/479745/carrier-iq-cellphone-scandal-insane-breach-trust

It was pointed out on this blog at the time to some disbelief and skepticism that the NSA, –that had a practice of sitting on the backbone and in upstream routers from targets,– were “collecting it all” as it passed by to Carrier IQ’s servers (remember this was a couple of years before the Ed Snowden revelations).

Does anyone realistically think this practice has stopped, or that they would not be targeting user data flowing to Apple, Google and Microsoft?

We as consumers and commercial entities should require rather more than E2EE… We should require as well strong privacy protections (certainly stronger than the EU requirements that are about the best there is, but really not sufficient). Also quite importantly
a suitable level of “fit to market” from Apple, Google and Microsoft, and others they touch in various ways.

After all there has been a bit of a scandal over Apple and it’s new iteration of “Device Side Scanning” and Google over it’s renewed interest in “fingerprinting” users devices. As for Microsoft and Linux… Over the past few days, there have been events that should make any ordinary mortal pause for thought about the lack of quality coming out of Microsoft and process control for the Linux kernel,

https://www.phoronix.com/news/Linux-6.13-Dropping-EXECMEM_ROX

Luckily it was sufficiently bad that it was pulled.

What has not been said sufficiently well is what the code would do if it was functioning correctly, which is,

“The patches adapt Linux x86_64 to use large read only execute (ROX) pages for allocations of executable kernel. And in turn the large ROX pages to map text areas ends up reducing instruction TLB pressure and improving performance.”

I won’t go into details, but whilst “Large-ROX” will improve performance, it also falls foul of

“Security -v- Efficiency”

Thus makes things less secure in several ways.

I can not make my mind up if this is an innocent error or something more sinister by Microsoft.

The fact that it got into the Kernel code with no sign off from anyone should cause some serious eyebrow raising. As such it is a very literal “faux pas” and should cause some changes to procedures.