Schneier on Security

Clive Robinson • April 25, 2025 11:30 PM

@ Bruce, ALL,

More “Internet Of Things”(IoT) being “tanked”

Some may remember “Nest” from before the Big G consumed them like a greedy child with a chocolate bar. As it really was not that long ago.

Well come this Sept Google is totally dropping support for the UK & Europe Nest Thermostats and the US is loosing support for the thermostats but Google are allegedly offering discounts on “upgrades”.

https://arstechnica.com/gadgets/2025/04/google-ending-support-for-older-nest-thermostats-will-stop-selling-nests-in-europe/

This IoT “End Of Life”(EOL) by corporate Dictate” is reducing product life times towards the span of the warranty or less (Amazon I’m looking at you…).

I’ve been asked in the past why I don’t do “Voice Assistants” and electronics controlled from a mobile phone… Well aside from Amazon killing an IoT device within 6 months and the entire lack of security in IoT, I oft mention the European Directive on “Waste Electronic and Electrical Equipment”(WEEE). Which is supposed to stop what Cory Doctorow calls “Enshitification” of such goods.

But consider on a couple of walls in my home I have Thermostats to control the pumps in my central heating that follow an electrical timer switch. As an independant pair for the upstairs and likewise the downstairs they have both been working quietly and unobtrusively for over 40years and still work today… I can not remember how much I paid for them it was probably less than 10UKP, so they have more than paid for themselves in that time.

But I do remember they only took a half day to replace the original downstairs untimed thermostat with a new timer and thermostat and install a “back box” and timer and thermostat upstairs with the hard part “pulling through and splicing in” a “frost override” from a thermostat in the porch (technically you are nolonger allowed to do a “wired OR” with mains wiring in the UK so I’d have to rewire if I ever upgrade). It’s been suggested to me that I should replace with a “Smart Heating” device to which I giveca hollow laugh and shake my head sadly, because,

“New does not imply better.”

More accurately these days it actually means “worse” a lot worse…

Clive Robinson • April 26, 2025 2:32 AM

@ lurker,

With regards sub-sea cable cutting, I’ve mentioned it as a major security threat several times over the years on this blog (search for “sub sea” or “choke point”).

https://www.schneier.com/blog/archives/2014/12/putting_nsagchq.html/#comment-235871

Gives an overview of what could be done more than a quarter century ago.

You can see the process is basically little different than the subsea equivalent of “walk up and strap a bomb on”.

Add a bit of fancy electronics as a detonator and you could bring the Western world to a near grinding halt in seconds…

Clive Robinson • April 26, 2025 8:47 AM

@ d30, ALL,

With regards,

“hi hello is this like exploding internet cables”

Rather more than…

Whilst we hear a lot about the new low earth orbit satellites bringing the Internet to the entire surface of the globe. The reality is nearly 99% of all “data” is hauled across microwave links, copper wires and fiber optic strands of glass. All of which are actually quite fragile and a good hit with the force of a “14lb lump hammer” in any one of a multitude of sensitive places will stop that data moving.

But much of that “data” is not what most would think of as the “Internet” it’s phone calls and other traditional communications like industrial and transportational “telemetry” that controls the flow of human voices, industrial process feedstock, and finalised product in supply chains.

It would not be unfair to say that,

“Next to nothing moves in the physical domain without bit movements preceding it in the information domain.”

Rather more bits of data moved, than there are granules in that big jar of instant coffee you had your morning cup of “eye opener” from, just to get the jar in your hands. Admittedly many if not most of them completely redundant but flow they did.

Whilst it’s all “fairly simple” when you understand enough of the foundations it still has an overwhelming feeling of fantasy about it.

The problem is that back in the mid Victorian days when sending bits of information over wire and even microwaves was starting most European Nations had “Enemies of the State” whilst not all top hat wearing long moustache twirling types of melodrama they did know how to make “Infernal Machines” that was the name given to explosive devices with mechanical fuses. As most surmise the percussive force of such devices in close proximity to fragile equipment oft results in fragile pieces being not just disrupted but spread widely about, thus not working or being easily reparable, thus remaining out of action for quite some period of time.

Well have a thought about it as an asymmetric exercise, of how you protect fragile from percussive and just how crud the infernal devices can be.

If you are unsure what that means in the modern day look up the AT&T Xmas Day bombing in Nashville half a decade ago in 2020,

https://en.wikipedia.org/wiki/2020_Nashville_bombing

Whilst temporary repairs started in days, it’s argued that even now service is not what it once was.

How do you stop what are crude device attacks?

The answer is bluntly “You Can Not” all you can do is design in mitigations to limit damage and bring things up more quickly.

Whilst this is difficult with communications, think just how much more difficult with other utilities such as energy, water, sewerage, roads, railways, aircraft and shipping.

If a ship that looses control can bring a bridge down and close an international harbour, cracks in the runway close international airports, similar damage to roads and bridges stop trucks and cars and firing bulltes into transformers can bring down entire electrical grids

Ask what damage an “infernal machine” could do if placed out of sight and without being detected?

Yes we could mitigate some but how many devices are needed to overwhelm such mitigations.

And it’s not just data/information that flows in wires and pipes… All those other “primary utilities” do as well…

The trick for a mustache twiddling type, is knowing which points will cause most damage. I’ve mentioned before that “power and communications” are intertwined, you need one to bring back the other and vice verser due to,

“Management decisions for ‘Shareholder value'”

So rather than try going for a cascade failure in the power grid with several devices, just two one in power and one in communications could be way more devastating and longer to repair if at all…

Such thinking we know is “Standard Russian Tactics” and by what China has allegedly done theres as well.

This is because modern battles really are not won by boots on the ground but by the information that puts the boots where they need to be at any given time.

As drones can move faster and are a lot less expensive that a pair of boots and what stands up in them it’s not at all surprising that the war that Russia started in Eastern Europe has gone the way it has.

Because drones are small light and mostly inexpensive and can carry an “infernal machine” to just about where ever you want it.

Which is why the Ukrainians not just realised but acted upon the idea that you don’t need to destroy a well protected tank engine or turn it’s turret into a low orbital capsule fun though either might be. You just have to put a small hole in the main gun barrel or just deform it. Because without a main gun a tank is a not very useful metal box and main guns really are a problem to replace.

Clive Robinson • April 28, 2025 9:09 AM

@ Uaf, ALL,

With regards,

“law enforcement seemingly using WiFi jamming/deauthentication technology to disable home surveillance cameras.”

They don’t have to be “law enforcement” to cause WiFi or BlueTooth or any other modern RF based communications system to fail.

In fact an eight year old child could do it long long before WiFi etc or even the start of the 1970’s, I know because I was such a child.

All you need is an old electromechanical bell ringer or buzzer and remove the “spark suppression” likewise the cap on the rotor arm of an old fashioned car.

At school we used to have to sit and listen to a “Schools broadcast” by the UK BBC it was dull tedious and uncomfortable as we had to sit on the assembly hall floor.

I made up a “spark gap” transmitter that covered the “Medium Wave”(MW) band that the BBC transmitted in. All it was was a “toilet roll inner” with a coil of wire wrapped around it to make an “auto transformer” with a length of wire from the HiPot end of the transformer. A variable capacitor across from the tap to the ground end of the autotransformer to form a parallel tuned circuit.

The auto transformer tap was coupled to the “hot end” of a low voltage relay wired up as an oscillator that generated quite a “back EMF kick” from the coil of the relay[1] and it a ran off of a 6V radio “filament battery” (back then tube/valve portable radios that used them were still around).

As a jammer the range was not great maybe 60-100ft but that was enough to make really painful on the ears bursts of interference.

The thing about WiFi Bluetooth and most other low power data networks is that they use one of the “Industrial Scientific or Medical”(ISM) bands of which the most well known is at two and a half Gigs which is the same band your home microwave probably works in.

Because of the way these network protocols work, all you have to do is jam the “ACK packets” at the data source (ie the camera). You need very little power to do this a couple of milliwatts will do it from a resonant antenna which you could easily run down the lapel or arm of a jacket.

You can buy such jammers from a Chinese Electronics site, or just by the components to make one yourself for a few dollars.

Thus the sensible game plan is to use a WiFi camera like a “ring doorbell” and a Wired camera from the likes of Swann in Australia that is built into the bottom of a “porch light”.

Those surveilling the place will find the Ring WiFi signal but not the Swann wired signal. They will jam the Ring WiFi signal giving away their intentions. Meanwhile you can watch and record them on the Swann wired signal…

It’s a “cat and mouse game” if you want to “double down” Swann also make concealed battery powered cameras that hid behind jacket buttons and the like…

If you have an old mobile phone it’s easy enough to rig it up to record through a shirt breast pocket button hole.

[1] I used the same circuit and components to power up a three foot florescent tube a few years later to make a “light saber” as a “inventor project” for the local Boy Scouts. The tubes are really quite efficient when you don’t have to drive the “heaters” to keep the mercury in vapour form to become plasma.

Clive Robinson • April 28, 2025 10:49 AM

@ GeekDad, ALL

Just to prove my above and explained in different words I said it back on 21st Sept 2018,

https://www.schneier.com/blog/archives/2018/09/new_findings_ab.html/#comment-327038

And almost a year later,

https://www.schneier.com/blog/archives/2019/09/the_doghouse_cr_1.html/#comment-340617

And going back to at least 17th March 2016 you will see me talk about it,

https://www.schneier.com/blog/archives/2016/03/financial_crypt.html/#comment-268878

So not whilst,

“It’s newly published”

By them it’s most certainly not new in the slightest.

As for “and has yet to undergo peer review” it’s kind of failed that as it’s effectively plagiarism from a public “publishing” on this web site and other web sites…

You would be quite surprised just how often this has happened with my comments posted to this blog. I can usually show that it was being talked about hear ~8years before hand…

It kind of amused Ross Anderson and some of his PhD students that I “got in first” as did @Nick P and others.

As I’ve said in the past I don’t mind people taking my ideas and working on them two rules,

1, Be polite and acknowledge me.
2, Buy our host @Bruce two drinks.

Why two drinks, well the first for his hosting this blog as a publicly available resources for ideas to be swapped, and the second should he ever meet me, so he can buy me one or three cups of tea 🙂

Clive Robinson • April 29, 2025 7:18 AM

@ Bruce, ALL,

South West Europe went dark

At the time I write this, much of the power grid has been brought back up.

However as of yet little is known of the cause and all “the usual suspects” from “Space Weather” down to terrorists has been guessed at by the MSM press

There is a live Wikipage for those that want to keep their eye on it,

https://en.m.wikipedia.org/wiki/2025_European_power_outage

If I had to guess I’d suggest three things need to be looked at,

1, Solar and Wind “feed in” to the grid.
2, The requirements for frequency and phase synchronisity.
3, Recent rapid growth in power needs (not just for AI).

European Politicians are “Going Green” as fast as they can, in part due to what is happening to the East of Europe that I’ve mentioned before. Letting VVP have control of the “off switch/valve” gives a lot of “leverage” not just politically, economically, and socially…

The problem with “going green” is that the entire grid becomes fragile. Part of it is that as items become up in the 85-95% and above efficiency what is known as “base load” drops and what is known as “peek load” goes up, thus the gap between them can get to large and things become unstable.

If a heavy load gets thrown on the grid, then the generator frequency drops. Protection circuits see this an “throw off load” etc and this reduces generation capacity, thus a “cascade fail” can start.

Not many realise that “sell back” from their home solar etc generation actually makes it worse, a lot worse.

Some utility corps rather than do the required and very expensive maintenance, have been cheating and using peoples home generation to power other peoples homes etc at a very small fraction of the cost it would have been and thus massive “Shareholder Value”.

Thus when the line frequency goes out of spec even more generator capacity gets shed.

Thus any 1/1000 weather event like heavy clouds causing solar generation to tank, and lots of people to turn on lights and electric kettles can “kill the grid” that is now “to fragile”.

Now imagine if you can all the current AI LLM’s getting “thrown off” to protect the grid…

At the moment the use of such AI is not “critical” but lots of people are “Moving Fast and Breaking things” to cash in on the current AI bubble. I suspect they have not thought long and deep enough about what gets broken and how and what the cascade effects are…