Schneier on Security

Clive Robinson • March 7, 2025 2:39 PM

@ Bruce, ALL,

With regards

“It runs on a $20 mobile hotspot.”

Such are the joys of technology where the price to capability just keeps dropping.

But you need to consider,

“Is the use of the technology actually lawful?”

Because the main thing to remember is that,

“Technology is agnostic to use.”

And that it is,

“The directing mind that choses the “use” any given piece of technology is used for.”

But also note the “usage warning” about the legality of use in any given jurisdiction… Which emphasises the point that,

“Usage as ‘good or bad’ is seen by a supposedly impartial observer at some point after the usage event.”

(Where impartiality is far from certain).

In the UK for instance you are only allowed to monitor or listen to the,

“designated public broadcast bands”

Not anything else, so you get an interesting situation of how you are licensed for non public broadcasts which covers all other EM emissions / communications as they say,

“From DC to Daylight and beyond.”

Which covers all cordless, mobile and Smart Devices not using ISM or Broadcast bands.

In effect this makes actual usage or usage intent “licensed” so you use the “HotSpot” or other equipment only for what it has been certified and licensed for, anything else is technically an offence…

Yup I know it’s a silly way to carry on, but that’s the way many countries licencing authorities work.

Even in the US this is true… Use a piece of Ham gear to work the CB frequencies is illegal as the Ham gear is not licenced for the CB band. Likewise use a cheap Chinese Ham HT that covers a lot of the VHF and UHF frequencies including GMRS and other “Family Radio Service”(FRS) and again your usage of the equipment is not licenced.

So even in the US this usage of the hotspot is “not licenced” thus technically not lawful.

But the article mentions,

“CSS operate by conducting a general search of all cell phones within the device’s radius. Law enforcement use CSS to pinpoint the location of phones often with greater accuracy than other techniques such as cell site location information (CSLI) and without needing to involve the phone company at all. CSS can also log International Mobile Subscriber Identifiers (IMSI numbers) unique to each SIM card, or hardware serial numbers (IMEIs) of all of the mobile devices within a given area. Some CSS may have advanced features allowing law enforcement to intercept communications in some circumstances.“

As most of these “Cell Site Simulators”(CSS) are,

1, Not licenced as equipment.
2, Not licenced for use.
3, Operators are not licensed.

Their use is actually illegal by any entity not formally covered by Federal or State Legislation and quite specific Legislation / Regulation… Which means they are more often than not being used illegally as the “National Security” excuse / clause really does not apply.

But note what I’ve highlighted. It’s rather more than “intercept” in the way most might think of it, like old school passive “wire tapping”.

As I’ve mentioned before people need to look up “SMS 0” it’s just a small part of how the “Network Operator” does “Over The Air”(OTA) Interface control of the “Subscriber Interface Module”(SIM) in your device.

Your device actually does not logically “connect to the network” it connects to the SIM and it is the SIM that connects to the network.

The SIM is a fully fledged computer in it’s own right and thus it decides what your device can and can not do at any and all levels of communication.

You’ve probably all heard of CALEA well technically your SIM should in the US have a CALEA interface capability “built in” (and due to the extended OTA Interface it does).

The only thing protecting your SIM from unauthorised OTA Updates is a small amount of Encryption… In quite a few SIMs untill recently that was DES using a general “network key”. Whilst the algorithms have been updated a bit, the system they are used in has not.

As most here should be aware getting a network wide encryption key is not exactly difficult.

One way is by issuing a letter be it NSL in the US or TCL in the UK etc. Alternatively as was seen with stuxnet, people on the network suppler side usually do not take sufficient care. Thus a semi covert “Black Bag Job” will do it as well, or as with the “Greek Olympics Scandal” you just lean on an individual who has access then dispose of them afterwards.

Once that network encryption key is known, there is very little someone with “appropriate technical capability” can not do as they own you through the SIM that owns the Device you hold.

One way that has been suggested in the past is to use a mobile phone only without a SIM via WiFi etc. This did work once… But most mobile / Smart device OS’s have back doors built right in for the likes of Alphabet/Google to own your device to “own you” as “product”…

It’s time people realised that the “communications endpoint” you call a smart/mobile device is very much,

“Insecure by Design.”

thus you have to,

“Take off device mitigations.”

I’ve mentioned some before. Unfortunately as such,

‘The mitigations require a high degree of “Operational Security”(OpSec) to use.’

A part of which is,

‘Good “Key Material”(KeyMat) Management”(KeyMan).’

You only have to look at the various “faux-secure device” scams run by various LEO’s under “Mutual Assistance Instrument” that allows loop holes in one Nation’s legislation to be used by another Nations Law Enforcement in ways that would not otherwise be lawful (in the US think of the oft used running a call “off shore” so it comes under “Foreign Intelligence Surveillance Act of 1978″(FISA).

One such faux-secure device was EncroChat, and you can see the “hoops and loops” a tribunal had to jump through to make it “appear lawful”,

https://investigatorypowerstribunal.org.uk/judgement/sf-and-ors-v-nca-ipt-21-05-ch/

When,

“The authorities make it up as they go along”

And

“Can get the judiciary to ‘nod along’.”

You know you have “a tough journey ahead”.

And lookin at taking another path might be wise, even though at first it might appear harder to travel.

Clive Robinson • March 8, 2025 6:21 PM

@ lurker,

With regards,

“Software only for Mac or Linux? Hmmm…”

I’m guessing based on the article saying,

“… we do not support Windows as an installation platform at this time.”

But the GitHub saying,

“NOTE: We don’t currently support automated installs on windows, you will have to follow the manual install instructions below”

And my own experience of developing low level or hardware projects indicates that the issues are very probably not exactly “hardware technical” in nature… More a “deliberate road bump” from the organisation that makes the OS’s not effectively supporting them “at this time”.

Let’s just say the volume of “Bovine Scat” that is oft emitted by them would overwhelm a typical workshop fan.

Also the costs involved are a significant consideration if your project is of small market or effectively being given for free.

Also consider that Version 10 of the OS is effectively “EOL’d” and about to get killed off and by many reports Version 11 is not exactly “fit for Beta” let alone general release. So ask yourself,

“Do you need such nonsense and irresponsible behaviour to deal with?”

I’m also reminded about the old advice for dealing with recently dead rabidly and otherwise diseased varmints, and the minimum length of barge pole you need to use to touch them.

Clive Robinson • March 10, 2025 3:59 AM

@ ResearcherZero, ALL

With regards your observations of,

1, Nokia laid off the experienced employees and kept laying them off… …just so they could continue the trajectory of plummeting sales.
2, IBM and other well known businesses have decided, “why not get rid of institutional knowledge and expertise within the company and give ourselves a pay rise?”
3, Everyone else is doing it. ChatPHD can probably do whatever Bill does.

Layoffs are generally the sign of incompetent management following ludicrous “neo-con mantra”. It’s the sort of stupidity that gets drilled into the heads of the less able as they do their well over priced and nearly useless MBA studies.

In the past I’ve mentioned that the people behind these courses that have comfortable faculty offices and write large thick books of near nonsense. Do so because they are bought and paid for by certain personality types that in effect want excuses for their gut feeling harmful behaviours. It’s the same with “certain schools” of economics… You can see this in the likes of,

‘https://www.fraserinstitute.org/commentary/death-capitalism-schumpeters-prognosis-coming-true

Where the author entirely neglects the real issues of “feudalism by rent seeking as a religion”, that has been the crutch of the “King Game” which has very recently trumped much other paid for “failures to observe reality”.

Hence we have had originating in the US the rampant diseases of,

1, Out Sourcing.
2, Off Shoring.
3, Don’t invest just divest.
4, Short term behaviour.

And the other “mantra sins” of “neo-con thinking” to the instant gratification that is claimed incorrectly to be “Shareholder value”…

In short anything that allows them to sell, borrow against, or mortgage actual assets for instant cash. The aim is to suck and squeeze the “financial lifeblood out” and “take the money and run” then “rinse and repeat” over and over. In short the mantra of

“Don’t leave money on the table/floor.”

It’s the generic behaviour of a plague of parasites or disease that “kills the hosts”, thus kills it’s self.

The thing is the figures show it’s now a veritable tsunami of debt building up that starves and kills innovation and thus industry (currently US debt is around 1.4 times GDP…).

The supposed “finance industry” and “Capitalism” are in their current forms a failure…

And what do “bad gamblers do on a loosing streak” –remember the only real wining streak is the house percentage– they,

“Double down on stupidity”.

Have a read of,

‘https://thehustle.co/originals/why-layoffs-dont-work

Under the section titled,

“Layoffs equal dwindling stock prices and bankruptcy risks”

Then have a read of,

‘https://www.theregister.com/2025/03/07/hpe_q1_2025/

And add the serial failure of HPE to your list… Because the only positive in their recent past hiding the long term general negative decline has been,

“jumping on the ‘AI Hype Bubble'”

Which has due to certain recent events shown the “AGI Hype” is “An Emperor with his ass hanging out in the public parade”.

But another example of such idiocy is Intel, and there are distinct signs that the other half of “Wintel” are again failing badly as the “rent seeking” XaaS of the Cloud does not deliver, nor does the “Pushing of turd polishing” or worse still the idiocy of current LLM “AI with everything”.

They all have a commonality of pushing “The law of diminishing returns”

As has been recently poetically said with the outing of GPT-4.5,

“ChatGPT, is now the Model-T, of AI History.”

And why the likes of

‘https://gizmodo.com/microsofts-relationship-with-openai-is-not-looking-good-2000573293

Are happening one such quip around about “Microsoft AI”(MAI) is,

“How long before MAI is rhymed with ‘Tay’ to give ‘May try’.”

Apparently even MS’s top bod CEO Satya Nadella is putting the brakes on the hype and reportedly said in a recent X Podcast interview,

“Success will be measured through tangible, global economic growth rather than arbitrary benchmarks of how well AI programs can complete challenges like obscure math puzzles.”

The thing is some have claimed with some justification, that the only growth in the US Economy has been the activity around the AI hype with $trillions sunk in… Even the “California Boat” meme of,

“A hole in the water into which you pour money.”

Does not appear to do it justice.

The funny thing for me is since the 1980’s I’ve had involvement with,

“Actually making AI work in the real world…”

With what back then were hyped-up “fuzzy logic” and “Expert Systems” and actually “stuffing them in robots” and the like.

You kind of get to see,

“An AI MO”

That whilst not exactly criminal like “Pump-n-Dump”, sure does take a lot of shirts off of investors backs… Before the tech become an “invisible part of life”.

The point is current AI LLM and ML systems are not going to actually replace workers, change work, or do most of the things many like Sam Altman are shrilly claiming.

To be only a little snarky,

“Would you let a spell checker run the economy?”

To which the reply might be “Only in America” home of the perverse capitalism “do or die” mantras.

One fun thing, somebody noted the other day that China did more to “throw the fox in the hen house” type harm to the US with “DeepSeek” than just about anything else,

https://theconversation.com/deepseek-how-chinas-embrace-of-open-source-ai-caused-a-geopolitical-earthquake-249563

(See former US Sec of State Mike Pompeo calling DeepSeek’s emergence as a “shot across America’s bow”, amongst similar OMG comments).

There are really only two questions of note,

1, How long before the hype dies down again?
2, How much human harm will the hype cause due to US neo-con short-term thinking in the mean-time?

Clive Robinson • March 11, 2025 6:27 AM

@ ResearcherZero,

I tried replying in a gently humourous way…

But it got “Held for Moderation”…

Clive Robinson • March 11, 2025 8:11 AM

@ Winter, ResearcherZero,

That “Mayor” neglected to mention that the “people” had payed year on year for the “infrastructure” and “supply chain” they were deliberately being denied…

And that in fact he was just a “mouth piece” excusing the behaviour of those who have “bought and paid for him” he mistakenly portrays as his “friends”…

Something I’ve made comment on in the past with regards “economists” and “MBA Course Organisers” who push neo-con nonsense and put the money in their pockets thinking they are “Smart”.

He also what either he does not realise, or has forgotten to act on, is that at some point there is always “civil unrest” and it’s the “mouth pieces” that get hung up by their toes…

Oh I also mentioned a week or so back about “US Eggs” and the supposed crisis and that there were clear shenanigans going on behind it.

Well it appears I’m not the only one to notice it’s a “Con”, in fact it is a quite deliberate play by two corporates who have acquired a “death grip” on the “supply chain” of the entire US egg production,

https://www.thebignewsletter.com/p/hatching-a-conspiracy-a-big-investigation

Expect to see an awful lot more on this sort of “rent seeking” by “supply chain manipulation/control” and similar corrupt practices by “GOP Friends” and the Corps they control.