Schneier on Security

Clive Robinson • May 23, 2025 8:53 PM

@ Bruce,

This is not the first time Navy vessels have been attacked by large marine creatures.

Although they sound like “mysterious tales” wooden vessels in particular have been attacked by whales, orca, squid and similar.

The attacks have been put down to “feeding” in that “jetsam” of waste etc attracts a hierarch of creatures and “feeding frenzies” can arise. Commercial fishing vessels like trawlers get to see such things occasionally.

But “submarines” have been known to run into not just fishing nets, but “biologics” as well and some have given whales a nasty surprise such as during the Falklands War (apparently three were torpedoed).

The fact is many submarines when submerged move at very slow speeds as part of the measures to avoid detection by enemy vessels and this means that “biologics” can surround them, the crew would be aware of them in general but not specifically what has been hit.

We know that aircraft have “flown into mountains” and the results have mostly been catastrophic. But it is known that a submarine has hit a “seamount” and survived. It happened Jan 8th 2005 to the USS San Francisco,

https://www.popularmechanics.com/military/navy-ships/a24158/uss-san-francisco-mountain-incident/

So if a sub of this type was to hit a whale it’s reasonably certain it would survive, the whale or other large marine creature not so much.

Clive Robinson • May 24, 2025 4:55 AM

@ AlexT,

With regards,

“Wasn’t there a Russian (or Soviet) sub almost lost after a full speed collision with a whale ?”

So the “Cold War” story goes…

But it was never officially confirmed so as was oh so common of those times “It never happened”…

Remember it was a different time with the Kola Peninsula incident becoming confirmed because of a summit between Clinton and Yeltsin. And a couple of decades earlier in Nov 74 there was “the kiss at Holy Loch”,

https://history.scot/us-and-soviet-submarines-crash-in-scottish-waters/

That only got confirmed because “diplomatic cables got leaked”.

A lot of this went on in the “cold war” and later with the “Atlantic Gateway” in the North sea with Norway being the geographic center of much that went on stretching up to Iceland and the North Pole and round into the Barents Sea.

The official history of GCHQ mentions the intelligence war with UK vessels carrying out “intelligence gathering” of many forms. It was probably more dangerous than has ever been acknowledge with the lives of hundred if not thousands of mariners lost and officially unacknowledged.

But even Russia eventually confirms some stories,

https://www.themoscowtimes.com/2019/07/03/the-deadliest-submarine-accidents-in-soviet-and-russian-history-a66263

Clive Robinson • May 24, 2025 11:31 AM

@ Bruce,

In the UK there has just been a couple of cases of legal representatives “up for sanction” for using AI to prepare briefs.

The defence given by one would kind of sound preposterous to someone who does not understand what has happened on the technology side of the curtain.

That is they said they were unaware they were using AI, as they had been using Google Search, as they did not at the time have access to the formal on-line legal databases.

As Corry Doctrow has pointed out Google is the king of “enshitification” with their search engine now barely worth the sack the crap gets shifted in.

Further as is now becoming obvious to the more astute investors there has been billions if not trillions sunk into AI and in some areas of enquiry the “Soft Bullshit / Hallucination” is creeping ever closer to 50% of the output.

With one major AI investment having just imploded into bankruptcy despite their excuses some will see it as the windvain moving adversely and the barometer changing from fair weather to foul and the whole AI journey now sailing into very stormy waters.

So it’s recognised that the AI donkey is going to get not just overloaded but whipped into the ground, as some try to recover lost investment and try to keep the boat afloat.

But you are going to think “Only in the UK” some very senior judges who have obviously not had sufficient oversight are now suggesting AI would be a good way to reduce the court system backlog… Which with those hallucinations on their way to approaching 50% does not at all bode well for the citizens, the judiciary, or the legislating politicians. As for society in general what do people think will happen when society can nolonger trust the legal process?

Anyway you can see more,

https://m.youtube.com/watch?v=WPDCDf262PQ

Clive Robinson • May 25, 2025 9:33 PM

@ ResearcherZero,

Another group you can add to the list of Government aligned hacking organisations,

https://techcrunch.com/2025/05/23/mysterious-hacking-group-careto-was-run-by-the-spanish-government-sources-say/

They appear to be better at keeping a low profile than some entities.

The question thus arising as to the “four axis of evil” nations of China, Iran, Russia, North Korea that the uninformed in Washington appear to think are “the only ones”.

Where as as I’ve observed in the past…

“I would expect any nation capable technology wise to have their own groups. Those that don’t but have the money such as Middle East nations to buy it in from the likes of Italian, Israeli, US, or similar companies either directly or through the likes of Bulgaria.”

Such is the way the world tends to work…

Clive Robinson • May 25, 2025 10:03 PM

Kreb’s gets hit with massive DDoS again!

This is perhaps not an enviable reputation to get, but some people sure like to use “Distributed Denial of Service”(DDoS) attacks on the “bigger is better” principle against Brian Krebs

https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/

The question is of course is,

“Was this just a test, and if so what comes next?”

As the old saw indicates,

“Only time will tell.”

But it appears to be “vulnerable IoT devices” behind it yet again…

We really need to start thinking how to stop these IoT plagues. One good way might be to destroy their business models.

Clive Robinson • May 27, 2025 9:47 AM

@ ResearcherZero, ALL,

With regards,

“Former intelligence officers are branching out into all lines of government contracting.”

I often ask myself the “Chicken or Egg” question of,

“Which came first?”

“The technology advance or the graft”

That now appear to be skipping hand in hand down the “halls of power” throwing bouquets to the chosen that abound there[1].

The written history says it was science in WWI and the resulting technology in WWII. In the intervening period the technology was too fragile and too expensive to be used in a general population. However WWII changed this making what was available rugged and importantly mass produced so the real cost dropped significantly and opened up to consumer production.

With this came other technology that under “military need” quickly became not just smaller but considerably more efficient and a lot lot less fragile, so making finished units a lot lot less heavy. The result in the 1960’s was the boom in consumer electronics that kind of started with “the portable/pocket radio” and even electromechanics got the same treatment as the consumers got the “Sony Walkman”.

A few more steps on the technology lader swap the positions of the military and the consumer. No longer was it the consumer fetting the cast of scraps from the military table, it was the military scurrying under the consumer buffet table looking for “droppings”.

But the written history does not really cover what happened with regards the graft[1] the consumer tax dollars were funding. Sure we occasional got to hear of the $600 hammer or toilet seat but that has migrated outwards to “Managed Facility” via the nutbar idea of “Public Private Partnerships” where light bulbs can cost more than $1500. This is in part enabled by the “rent seeking economy” we are foolishly moving into it is as such mostly legalised grift not graft at the moment but that appears to be changing[1].

But that’s not about the technology or how it’s being now developed.

In the past half century technology has advanced to fill existent ordinary consumer needs. But that changed with the notion of “electronic slaves” pandering to the whims of those that could afford them was pushed into peoples minds. After all why go to the effort of writing a shopping list and going out to purchase the items and lug them home… Just get your voice assistant on your smart device to do it for you.

The fact you will be over charged and given nearly out of date products that would have been thrown out as waste in a supermarket etc is just “the grift of the system”. But what about the fact of the bribery to sell you things you don’t want?

Yes the technology makes the selection, do you get the “own brand” product that is not only half the price of the high priced name brands, they are also not now so watered down they are dire (yup looking at you Heinz). So you pay twice the price and the “make your delivery up” get a double kick back from you and the named brand.

This push to consumer rent seeking needs technology to support it…

That same technology is now ending up being repurposed into military and law enforcement as well as other surveillance activities at well over premium pricing. And with it large chunks of tax revenue…

It’s the future, you are either a face sucking parasite, or you are a face in the crowd… That will get parasitized just like a caterpillar that gets infested by digger wasps, or any number of “bot flies”. Your survival depends to some extent on if you’ve been picked up and held captive or are still free to roam and seek help if of course it’s available.

[1] The difference between grift and graft may be lost on many people, but a grift is generally a form of con or pull the wool activity against an innocent victim. Graft however is where both sides know fully well what is being done is at best unlawful if not downright illegal, at it’s simplest it’s bribery at worst it’s as bad as treason,

‘https://medium.com/fourth-wave/whats-the-difference-between-grift-and-graft-90d3f3ecfbe9

Clive Robinson • May 28, 2025 7:55 AM

@ not important, ALL,

With regards,

“The new law makes it a federal crime to knowingly publish or threaten to publish intimate images without the subject’s consent, whether those images are real or computer-generated.”

This is “bad” in many ways but consider,

1, What is an “intimate image”?
2, What is a “subject’s consent”?

They fall under the old nonsense answer of,

“I can’t put it in words, BUT ‘you’ll know it when you see it’.”

But consider it’s not just there is no “meaning” in the definitions there is also no measure for “intent” or “compliance”.

It’s the sort of nonsense legislation that is “open scope” thus “free licence” for prosecutors to fill up the courts with what are in effect “nuisance cases” and gain unlawful convictions” to further their own objectives.

Oh and the awkward side of things,

To be “evidence” the image will have to be “produced in court” and “included in the record”. Both of which are usually public…

So it will make a mockery of “due process” and thus the judiciary, and inturn the legislators…

Clive Robinson • May 29, 2025 8:02 AM

@ ResearcherZero, ALL,

Identifing people is a fantasy

This is something I was going to “Squid About” with Regards Greg Abbot signing ridiculous “age verification” legislation[1]. That is unfortunately going to make identity theft almost trivial…

And also, as you note,

“Verifying a fraudulent identity locally is not something people typically do either.”

Because sensible people should after a little thinking and research find that,

“There is no way to tie an individual biological to a paper trail.”

As I’ve pointed out in the past, this came to a head in the UK when “National ID Cards” argument came up. As the first female Director of MI5 Stella Rimington spoke very publicly on the issue and got quoted in much of the UK MSM,

“ID cards have possibly some purpose…”

“But I don’t think that anybody in the intelligence services, particularly in my former service, would be pressing for ID cards.”

But her key point she warned they would be “absolutely useless” unless they could be “made unforgeable”.

And that’s the “key thing” they can not be made “unforgeable” for two basic reasons,

1, There is no way that the ordinary person can check in any way they have available to them if the ID card is genuine.

But secondly and more importantly,

2, Even if you could prove “the physical document” was not forged, it’s still meaningless. Because just as with “Code Signing” it attests nothing to the quality or reliability of the information that it has signed.

Even if you “follow the paper trail” it does not actually prove anything either each and every piece of information on all those documents likewise can not be attested to because of the second reason.

At one point the shills for blockchain were claiming it could solve these issues, they can not the only thing they might bring to the party is a “time line”. But there is nothing to stop the second issue.

The best you can achieve is by having having hash functions for every document “image” but hash functions rest on the unproven notion that there are non-invertible “One Way Functions”. A hypothesis that is “unproven” and worse some of those ideas for past OWF’s are now known to be false…

So if someone presents you with some kind of ID Token, the best you can do is

1, Sniff it.
2, Say “the ink is still wet”
3, Watch their face for tells.

That’s it, that’s all you can do.

[1] Both Apple and Google strongly protested and gave good reasons but the authoritarian idiot just signed everyone not just Texans into life long danger,

https://www.bbc.co.uk/news/articles/cz63ny02d8po

As pointed out,

“[I]t requires app marketplaces to collect and keep sensitive personal identifying information for every Texan who wants to download an app, even if it’s an app that simply provides weather updates or sports scores”

So a longterm kept “treasure trove of information” that will be very valuable to all those people,

1, You do not trust
2, You would be stupid to trust

And you can be as certain as night follows day that those that can not and should not be trusted will try to gain access to the detriment of anyone they get details of…

Apple told Bloomberg after Abbott signed the law,

“We believe there are better proposals that help keep kids safe without requiring millions of people to turn over their personal information,”

Yes that’s the nub of it “backdoor compulsory ID” surveillance assistance for Authoritarian Bureaucrats desperate to “collect everything” in the hope that it will give them those Cardinal Richelieu “six lines” “to hang” you by.