Recent Comments


Note: new comments may take a few minutes to appear on this page.

August 29, 2015 6:11 PM

Grauhut on Mickens on Security:

Funny rant: NSA, CIA, FBI, none of them named. Maybe Mickens knows them good enough as a M$ guy and fears they could MOSSSAAAAAD him! :)

August 29, 2015 5:48 PM

Jacob on Friday Squid Blogging: Cephalopod Anatomy Class:

Extend and extinguish. But no "embrace" here.

1. Yesterday it was reported that the British Library refused to accept a donation of rare collection of Taliban writings from the 80's or so, including newspaper clips, poetry(!) and essays, on the fear of being held in violation of some terrorist acts that criminalize possession of terrorism-related material and Jihadist literature. They have received some legal advice not to touch it.

2. Retweeting supportive comments on Jihadi stuff or in support of ISIS leadership will land you in jail. The same if you make a false statement about your twitter activity to a FBI agent.
http://www.huffingtonpost.com/entry/twitter-terrorism-fbi_55b7e25de4b0224d8834466e

No constitutional provision will stand in the way of a federal agent when he is tasked with saving his glorious country.

August 29, 2015 5:14 PM

Thomas_H on Defending All the Targets Is Impossible:

@ Gerard van Vooren:

I don't think I would feel any safer in a train car full of people armed with pepper spray than in one full of people armed with guns. Both are rather bad; I'd probably put the pepper spray version considerably higher on the "bad" scale than the gun version, if presented with an attacker armed with a AK-47.

In the "everyone has guns" scenario, the primary risk is untrained people using their guns to shoot each other instead of the attacker, followed by the gunner reciprocating with shots of his own (if he's not gunned down before that). Bullets fly in straight lines and can be stopped by certain materials. A train car contains seats, which depending on the type of train car may have metal backings - probably won't deflect much tho...but they provide cover and require people to reach around/above them to actually fire their guns at a target. If the gunner succeeds, it's a mass-murder. If he fails, he is either taken out quickly or he is taken out at a later point and there are many casualties.

In the "everyone has pepperspray" scenario, let us consider a few things. Firstly, closed circuit environment (especially in a Thalyss train). Everyone sprays their can in close succession, if they weren't shot by the gunner first for rummaging in their bags. Various people panic. Especially in children and eldery people this may cause respiratory trouble, which is greatly increased by the pepper spray. People are blinded by tears. You don't want this in an environment with severely restricted movement options. People will likely try to get out of the train car as fast as possible, but hampered by respiratory trouble, bad visions and limited movement space the center line of the train car will fill with stumbling and falling people. The gunner is also affected. In a reflex, he may pull the trigger and spray the train car interior with bullets in various directions. In this scenario, both success and failure of the attack may result in a very high number of casualties.

Of course, in reality both scenarios would be severely affected by the fact that many people boast they will do something during an attack, but in reality won't (and that especially applies to those that are cocky about it).


Regarding NATO's response, in the Netherlands they mostly seem to have supporters write opinion pieces for newspapers that read like most stereotypical Cold War propaganda.

August 29, 2015 4:27 PM

John on Regularities in Android Lock Patterns:

If you encrypt the phone, a pattern cannot be used. A passphrase is required - at least on Android 4+.

Or am I missing something.

After having my phone stolen overseas, I started encrypting **every** portable device and having a non-trivial passcode. Currently 6 characters + a Ubikey input to unlock netbook OSes and about 20 characters for the smartphone.

Yes, it sucks, but I sleep well at night.

August 29, 2015 2:25 PM

Buck on Friday Squid Blogging: Calamari Ripieni Recipe:

@Figureitout

Full moon is tonight ;-) Here's what I've found since last we spoke...

Seagate has open-sourced an Ethernet interface to traditional hard disks, but not any of their HDD controller code as far as I can tell...

While Western Digital is apparently also partnered with The Linux Foundation, their visible footprint in the open source community seems pretty small so far.

Realtek does have open source drivers for some of their wireless chips (provided by both Realtek and the reverse engineering community), but I was unable to find any code they offer for their popular audio chips. I did find this little doozey though:
Flaw in Realtek SDK for wireless chipsets exposes routers to hacking

The open source FTDI driver looks very mature and stable. Nice! Not sure if FTDI themselves helped out, or if it was entirely reverse engineered...

A couple years ago, some of American Megatrends' BIOS code was liberated from a third party's FTP server. Torrents are available for anyone so inclined. There's also some cool reverse engineering work that's been done.

So the situation looks a bit better than I thought, but not quite as nice as I'd hoped after reading your post...
With the right marketing campaign, some of these companies could increase their market shares by releasing more source code. The others will then have to follow as customers come to expect it. Oh well, someday... Back to reverse engineering in the meantime I suppose!

August 29, 2015 2:16 PM

me on Mickens on Security:

"Instead of training for such an event, perhaps a better activity is to discover why a madman is forcing people to swim, then bike, and then run.”

August 29, 2015 2:16 PM

Xelandre on Friday Squid Blogging: Cephalopod Anatomy Class:

@curious:

I am not aware of norway having some kind of FOIA law. I would think that you have to go search and find stuff for yourself online, search tool provided by the government. I guess they simply solicited the departments and ministries directly.

It does, and I would bet it dates back at least from when Norway was still part of the kingdom of Sweden, home of the world's first FOIA statute.

They have a nice online site with a catalog full of documents with promising titles, and an interface for ordering.

That's the theory.

But in practice...

My experience with that system was humbling.

I request from a certain govt. department 8 or 9 different documents related to a topic in which I have a keen interest. The language is sufficiently close to ones I'm familiar with so that I could still decipher it with some effort.

Only a couple of the stuff which I actually requested made it to me, but it was in fact irrelevant cover letters I could have dispensed with.

Some other "wrong" stuff was sent, without any direct connection with what I asked, but with a "positive" decision. Probably because it made the authority look better.

Strangely, a real gem of a document connected to my query was sent, but which I had never ordered, together with a negative decision stating it couldn't be released.

The online catalog did show that all the documents I was interested in were releasable without restriction. I'd have to see whether the classification changed.

I pointed out to the authority the mess the made in the handling my request, and demanded a fully reasoned decision, in view of making an appeal with the national Ombudsman's office, but after almost a year and several reminders, I finally got a reply meekly asking me whether I was still interested.

So much for that hallowed Scandinavian transparency.

I have experience with FOIA under 8 different statutes, if I count correctly, and nearly as many countries, has been rather mixed up to now. You must be patient, determined, and show that you're ready to take them to court.

Some techniques are:

- Excessive and arbitrary search and reproduction fees
- A deliberately literal and narrow interpretation of your request
- Acute passive-aggressive behaviour
- Incomprehensible delays
- Just plain stupid, clueless, answers.

My best experiences were in obtaining previously released information. Big deal.

FOI most certainly costs a minute fraction of what states spend to know everything about you. Yet in places like GB, the politicks are talking about "abuse" and are floating ideas abut restricting FOIA access by slapping high fees.

August 29, 2015 2:14 PM

Slime Mold with Mustard on Friday Squid Blogging: Cephalopod Anatomy Class:

@ Steve

The "no standing" ruling really pisses me off. For our non-US readers "no standing" means that the person filing the lawsuit cannot show that they were harmed our that their rights were violated.

The plaintiff in this case could not prove standing because the records are secret. Effectively, the government can legally avoid justice.

I am willing to believe that the NSA has no intention of ending or even reducing its bulk collection programs. You might recall that when the USA Freedom Act was first being discussed, we were informed that the NSA had already been considering ending the program, which, "for technical reasons, consisted mostly of landline records". That's what they said . What they meant was "no reason to snoop around this topic anymore".

We do know that the two largest carriers were targeted. We know others were. It is impossibly naïve to believe nearly all were/are not.

August 29, 2015 2:13 PM

John Galt IV on Friday Squid Blogging: Cephalopod Anatomy Class:


I'm OK with vague, rambling speculations as to the nature of reality. That's what this is. I had been thinking that a system monitor could provide some assurance that undocumented features of a CPU/chipset/motherboard, etc. aren't being utilized. The observer must run on trusted hardware, not the backdoored system under observation. In previous iterations I had suggested FPGA-based models could be built from chipset data sheets, but that introduces any weaknesses in the FPGA and toolchain into the composite system. I assume that people much smarter than I am, who not entirely coincidentally have a lot more resources, already have ploughed this field. The spookwerks output won't be in the public domain, but there is a lot of good scientific literature from universities. The fatal (or nearly fatal) weakness of the FPGA approach is that it will almost certainly run slower than dedicated hardware. It might be acceptable to slow the clock on the commercial hardware so that the FPGA can keep up for 100% comparison. Or it may be acceptable to verify only some subset of instructions. Previously, I realized that any sequence of instructions can be treated as a trajectory in an arbitrary dimensionality n-space. There will be some data visualization method that could convert the trajectories to graphs that can be viewed, and automatically monitored by a neural network. This probably overlaps pretty well with what commercial antivirus/antimalware does, except that runs on the suspect system. This line of thinking also applies to natural language (conversation is a sequence of trajectories in n-space) and there should be plenty of literature on natural language processing that applies to interpretation of trajectories and use of neural networks. Dimensions can be added as needed to address other aspects of the instruction sequences, such as the memory locations accessed, and the values in those locations, and the values resulting from the calculations. The trajectories can be thought of as fingerprints, in that bad trajectories (unwanted code/undocumented features) are different from the desired system operation. The sticking point is training the observer by getting known bad sets of instruction sequences and recognizing novel bad behavior. This is another point where crowd-sourcing can come into the picture in that statistics from large numbers of users would be valuable. If these general approaches were add-ons to an open-hardware project, enough people might run them to be able to see the differences between good behavor and bad behavior. An alternative to software monitoring of the CPU/system state trajectory is to monitor the CPU through a powerful side channel. For example, an array of ferrite rods with small coils on them can be mounted in close proximity to the bare silicon (ignoring the difficulty of accommodating the heat sink/ball grid array) to pick up the electromagnetic signature across the chip. The signals of the coils can be treated as trajectories and correlated to processor behavior. I assume that if I look in the scientific and patent literature, I will find out that people much smarter than I am already have ploughed this field. You'd think that someone could make a lot of money by offering tools that provide assurance that business intellectual property was safe from various bad actors.

August 29, 2015 1:17 PM

me on Friday Squid Blogging: Cephalopod Anatomy Class:

@sena kavote

BIOS installs keylogger via SMM mode (ring -2). Keylogger is not OS specific (it interacts with the keyboard controller directly). Information is squirreled away in writable firmware for later retrieval by either physical extraction or other targeted attack.

August 29, 2015 12:56 PM

Sancho_P on Defending All the Targets Is Impossible:

Slightly off topic here, but it’s regarding “ban of encryption” :-)

@rgaff ”You can't ban the use of encryption, …”

Yes, we can.
But first we have to adjust the focus. It’s not “global” but “at detail”, focused at a single individual engaging in unacceptable behavior within our society.
It’s not against free speech or liberty of ideas.
It’s not against any peaceful believe / religion (but do not mistake Islam for being “simply a religion”).
It is against hate speech and preaching of murder [1].

So say Mahmud would be in the focus, suspect.
(Mahmud is the name of a good friend of mine, he works at a bike repair shop, but, even after several years, he’s still uncomfortable when I talk to his wife …)
So Mahmud is under secret surveillance for some days, evidence is collected.
Finally Mahmud is confronted with his “unacceptable” behavior by a judge who explains face to face what we, the society, don’t want and which consequences for Mahmud may arise.

”that is to ban the use of many electronics”
Yes, depending on the judge, Mahmud can only use his known phone and computer, which are now officially bugged at the provider, no other / new devices alowed. Otherwise he will swiftly meet the judge again, this would be his very last chance then.

”and you do that to someone who depends on any one of them for his livelihood and you've banned him from having a job …”
No, Pedro, who owns the bike shop, knows Mahmud for more than 2 years, he wouldn’t fire him - but he would be informed, and of course he would “discuss” the fact with Mahmud.

”they'd be banned from reading this very blog, …”
No, not any of that, Mahmud can use https because his known devices are bugged at the provider. He can’t use strong endpoint encryption, though.

”in such a prison, they should have a right to a fair trial”
Yes, that’s exactly what I want: Face to face, in the open, a right to a fair trial.

”and defense FIRST”
Well, first would be the suspicion, accusation and confrontation with a judge (or someone outside LE entitled to handle such issues).
Mahmud now has the chance to appeal - and to change!
Also all people around Mahmud would know that we, the society, are serious about.

”I don't understand expelling people from the country, are you suggesting we send all our criminals to Australia again?”
Let’s face it + name it: We are talking about radicalized Islamists, not criminals.
There are thousands of other idiots running around, but at the moment 99% who are fighting us are those from the countries we destroy.
[ * When we talk about justice we must hear both sides,
so I think we have to change - and they have to change. * ]

Anyway, these individuals do not accept our system of liberty.
But there are countries where the system may be heaven on earth to them.
I would not hinder anyone to go to these countries and fight for their paradise.
And if they don’t know where to go we’d find places where radicalized people are welcome to reinstate their “kingdom”.

Again, it’s an unsound proposal - but we must openly discuss, not hide.
But here is the problem with our bribery driven “constitutional democracy”.

[1] This is why I think we have to change first.

August 29, 2015 12:46 PM

Meta on Friday Squid Blogging: Cephalopod Anatomy Class:

Great news for Portugal.

The Constitutional court did not approved a law that would give the Secret Services (SIRP) access to metadata regarding financial and telecommunication records.

This law has been proposed by the 2 major parties in Portugal. The social democrates (PSD)
and the socialists (PS). There is a long tradition of political combat between these
two parties, nevertheless when it comes to setting up legal frameworks for increasing
the power of the secret services they all seem to agree.

An interesting fact is that from a total of 7 judges of the Constitutional Court,
6 voted against the law and 1 in favor. The one who voted in favor was a former director
of the Information Security Services (SIS) named Jose Teles Pereira.

Parties comments about the ruling follow the lines of "This is only metadata we are talking about....blah blah blah .. and we need to convince the judges..."


August 29, 2015 12:10 PM

Jullian Regina on "Santa Claus and the Surveillance State":

Wow, never thought of it that way! But kind of a weird big brother thing. The world is getting more and more connected, that isn't always a good thing. Sure constant surveillance deters criminals but what else does it have an effect on? Privacy? The lack thereof? This will be an interesting topic many years into the future!!! Great post!

Jullian

August 29, 2015 12:02 PM

Nick P on The Benefits of Endpoint Encryption:

@ Thoth

"What is the difference between trusted and trustworthy ?"

For me, there's a difference. I use the term trusted to mean exactly what you say: "a component privileged enough to violate the security policy." I use trustworthy to mean that there's sufficient evidence that the component will do its job in a given situation. So, the trusted components should be trustworthy. Might or might not be how other people use the terms.

Of course, once you're using either, they are equivalent in that you are trusting it to get the job done.

@ QuartzDragon, etc on FDE

It actually depends on the threat model first and then how FDE is implemented. Here's a few threat models:

1. Enemy steals the HD or physically inspects it. You don't use it again. Under this one, FDE stops them if it's any good.

2. Enemy steals the HD or physically inspects it. You use it again. This is already a bad idea given physical possession = compromise mantra. The talent of the person in possession and how long they had it determines what level of security is necessary.

So, you really want to keep the TCB out of enemies' hands while storage medium itself is throw-away. This is why cheap computers with Truecrypt are preferred by many with a concern for these threat models. Eliminates most of the issues. Far as strong HD security, the NSA's Inline Media Encryptor approach is still the best as it's OS neutral, hardware-implementation-neutral, and can incorporate the best security you can throw at it. My approach was to clone that with Truecrypt-like encryption and/or Truecrypt at software level. Clive went further by suggesting combining software, some kind of IME, and self-encrypting drives. I further that with my generic recommendation that each component is from a different, competiting country.

In any case, the current level of physical attack is too high to trust threat model 2. I mean, there's certainly all kinds of ways to slow enemies down to the point that they might not do much during a police stop, customs check, or bathroom trip where you left the laptop. However, we must assume they'll eventually figure out the workings of the hardware and probably accelerate an attack. Unlike software, you can't change hardware enough to prevent this given NRE costs. So, just use a strong method, counter known risks (firmware to software), do tamper-evidence, and don't let enemy get ahold of it outside your sight. And rest easy knowing 99.999% of attackers are using software or stealthy methods that this can stop. :)

Note: A potential solution to the above is a verified FPGA built into the SOC to allow diversification on a per-customer basis. The Archipelago open-source FPGA might be used. Experienced hardware people can also build all kinds of digital or analog tamper circuits with their own power sources. Very high risk of false positive destroying your stuff. Meanwhile, my recommendation stands with most resistance being choice of hardware/software or expensive hardware.

August 29, 2015 11:35 AM

Clive Robinson on Mickens on Security:

@ CallMeLate...,

..., and if you order a Russian bride on Craigslist YOU MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX."

Or...

    A GLOW IN THE DARK BRIDE from Chernobyl who brings her own caviar that also glowes green and is a sight for -- soon to be-- sore eyes.

I used to know someone who married a Russian girl, whilst she was not a super model, her face still makes it into fashion adds etc, last time I saw him he looked annoyingly happy and contented.

So heads you win tails you lose.

August 29, 2015 11:15 AM

Nick P on JackPair Encrypted Phone Add-On:

@ Raym

We just had a different thread here with a person named Litron saying much the same stuff. Far as specifics, I told Litron that it helps to Google simple terms such as "encrypted over GSM voice channel" instead of speculating. That high-tech, research method led me to these first-page results:

http://www.academia.edu/9281016/Secure_Data_and_Voice_Transmission_over_GSM_Voice_Channel_Applications_for_Secure_Communications

https://defcon.org/images/defcon-13/dc13-presentations/DC_13-Tanner-Smith-Lareau.pdf

http://www.koreascience.or.kr/search/articlepdf_ocean.jsp?url=http://ocean.kisti.re.kr/downfile/volume/kimics/E1ICAW/2010/v8n1/E1ICAW_2010_v8n1_64.pdf&admNo=E1ICAW_2010_v8n1_64

So, the technology was doable. The guy behind it had a track record in working on NonStop's fault-tolerant networking. The amount they asked for was *very small* relative to what I thought it should cost. That was my main worry. So, I determined it was an acceptable level of risk for the small funding I gave them. Like other startups, they'll deliver or they won't. However, technical feasibility isn't the issue given it's been done more than once.

"At 2:00 you can see the pairing up process and the figures appear one after the other, as in the movie War Games where the mainframe Joshua seeks nuclear codes one after the other."

Probably because it was a piece of marketing material that was supposed to get people (incl lay people) interested in a concept? People whose sole experience with hacking and crypto were movies like Wargames. It was goofy but the technical description wasn't. I went with the latter as my concept of how it works.

August 29, 2015 11:02 AM

CallMeLateForSupper on Mickens on Security:

Entertaining. Thanks.

Approving nod to Mickens' choosing "insipid".

I especially like:
"Security people are like smarmy teenagers who listen
to goth music: they are full of morbid and detailed monologues about the pervasive catastrophes that surround us, but they are much less interested in the practical topic of what people should do before we’re inevitably killed by ravens or a shortage of black mascara. It’s like, websites are amazing BUT DON’T CLICK ON THAT LINK, and your phone can run all of these amazing apps BUT MANY OF YOUR APPS ARE EVIL, and if you order a Russian bride on Craigslist YOU
MAY GET A CONFUSED FILIPINO MAN WHO DOES NOT LIKE BEING SHIPPED IN A BOX."

August 29, 2015 10:44 AM

vas pup on Heartbeat as a Biometric:

@all:
As I recall, even fingerprint analyzed template generated out of fingerprints, not exact image to be the same.
As with all biometrics, the particular threshold of mismatch should just trigger human security intervention on particular case, and each of triad of verification should be applied not simultaneously, but on each subsequent level of access. I guess biometric - to the last level of perimeter - just opinion.

August 29, 2015 10:40 AM

ianf on Friday Squid Blogging: Cephalopod Anatomy Class:

There are several potentially interesting books among the 25+ recently reviewed by Geoff Manaugh of the BLDGBLOG (tagline: “architectural conjecture :: urban speculation :: landscape futures”). Here but 3 of them:

#3) Ghost Fleet: A Novel of the Next World War by Peter Singer and August Cole

#4) Future Crimes by Marc Goodman (previously already mentioned here by nym).

#11) War Plan Red: The United States' Secret Plan to Invade Canada and Canada's Secret Plan to Invade the United States by Kevin Lippert

BTW. I found 2 title variants of #4 above:

    Future Crimes: A journey to the dark side of technology - and how to survive it Bantam Books Feb 2015 (paperback & hardcover), and
    Future Crimes: Everything Is Connected, Everyone Is Vulnerable and What We Can Do about It (Doubleday - presumably a hardback)

Are they the same book for different markets, or two somehow differing editions?

August 29, 2015 10:28 AM

Raym on JackPair Encrypted Phone Add-On:

There is an other problem :

The creator of Jackpair claims he uses Curve25519 and ECDH as key exchange protocol.

Once calculated, the secret shared key is the same on Alice and Bob side.

But in the main video on the jackpair site

jackpair main site : www.jackpair.com

At 2:00 you can see the pairing up process and the figures appear one after the other, as in the movie War Games where the mainframe Joshua seeks nuclear codes one after the other.


WFT?!???!
This is not possible in ECDH key exchange protocol, the shared secret is calculated in one block!!


August 29, 2015 9:25 AM

Thoth on The Benefits of Endpoint Encryption:

@Clive Robinson, QuartzDragon, Nick P

"You also make the guard such that it also does encryption with keys, encryption or both "out of band" @Thoth will tell you more on how to make SIM and similar SmartCards into trusted "key-stores/encryptor""

Probably the Castle-Prison-Dataflow model that @Clive Robinson and others have been toying around might help a little.

You can simply use the smartcards (SIMs are smartcards but without too much of plastic). I would say use 2 smartcards (or SIMs). Logic is one is used as an RNG with non-strict key export so that you can generate a key and know what key you have gotten. The other part is you load this generated key from one smartcard to another which is acting as a keystore either via direct communications between smartcards (not advisable) or via a central host chip.

The mediating chip would probably be a normal General Purpose chip as it is expected to not be seen as a threat by the agencies and would probably be left alone. Most agencies would go for the crypto chips which in my view is a high priority threat that must be segregated and confined (prison model). Thew mediator chip would route packets around and inspect the packets.

The mediating chip would be assisted by it's own cryptography enabled chip (ARM ? MIPS ? Freescale ?) to do secure channel protocols with the smartcards (encryptor and RNG cards).

This scheme isn't very complete as I simply thought of it as I typed which some of you can help to cover it's huge gapping loopholes. Multiple low powered mediator chips can be used for obvious decision and random access protocols to confuse attackers and detect betraying chips. The problem is how to tamper resist the mediator chips since they are expected to be general-purpose chips without crypto (therefore no active and passive tamper resistant measures available in most crypto chips). The security of the ROM instructions in the general purpose mediators can be at risk too.

August 29, 2015 9:22 AM

sena kavote on Friday Squid Blogging: Cephalopod Anatomy Class:

How diversity of operating systems could help against BIOS malware

This is my assumption here:
BIOS malware has to replace something from the operating system. Most likely a part of kernel would be replaced. That replacing part needs to be customized for a particular kernel. So it seems to me that if the BIOS malware needs to prepare for more operating systems, the sizes of the replacing parts have to be smaller in order for all of them to fit in BIOS. If the BIOS malware has to work with Linux, FreeBSD/PCBSD, netBSD, Minix3, OpenBSD, dragonflyBSD and Windows, then the space for the replacing parts is divided by 7. If our example BIOS chip has 8 megabytes of space, of which 1 megabyte is needed for normal things and for some generic functionality of the BIOS malware, then there is 7 megabytes for payloads to different operating systems. Having 7 possibilities for operating systems means that, on average, every one of those listed OS could get 1 megabyte instead of 7 megabytes replaced by malicious code. Then there are all the different versions of one operating system's kernel. For example, Linux kernel could be newest 4.0 line or long term support version like 3.13.0. Also, the software that installs OS on a hard disk could use some randomized light obfuscation when compiling.

Is this right? If so, what could be the actual numbers with some common BIOS chips? How much the reduced payload sizes could actually help?

August 29, 2015 9:19 AM

Raym on JackPair Encrypted Phone Add-On:

@Clive Robinson

I sent the sound of Jackpair through a GSM mobile phone and I picked up the sound of the other side. The signal is not the same out of the GSM.
I can send you the original file and the file on the other side if you give me your email.

sound of Jackpair : https://www.youtube.com/watch?v=rh6yF79FkAA

August 29, 2015 9:05 AM

Thoth on The Benefits of Endpoint Encryption:

@G.Scott H.

"Many of the organizations we associate with being sophisticated attackers are the ones pushing against ubiquitous end-point encryption. Odd. "

We have to consider another option of these sophisticated attacker model. You left out the option of subverting or poisoning standards like the DUAL_EC_DBRG. Interestingly, NIST was poisoned into pushing the dreaded RNG and also if you look at the Suit B algorithms of the ECC curves, according to Daniel J Bernstein (DJB), those ECC curves are dubious in nature and their values, algorithms and points are questionable.

Interestingly, NIST and NSA have been pushing for the adoption of these curves ... The only open curves like DJB's Curve25519, Ed25519 and such are not even considered in the standards but the open crypto community uses the DJB curve3s extensively due to it's open designs.

I don't think we over-credited circumventing end-point encryption. Most of us underestimated how badly protected we are.

August 29, 2015 8:49 AM

Raym on JackPair Encrypted Phone Add-On:

@Clive Robinson

The synchronization problem i'm thinking is to send FSK or MFK signal over the RPE-LTP-LPC coder of the GSM voice channel which will modify the FSK or MFK signal.
But let's assume that you are right for the synchronization. Why the creators of jackpair give no information of the choices that have been made? They say Jackpair is complete and in production, why don't they give any information. For me the product does not exist

August 29, 2015 8:45 AM

ianf on Friday Squid Blogging: Cephalopod Anatomy Class:

Sometimes corroboration for the lingering suspicion that we already live in Orwellian times can be found in the most unlikely quarters. As in the Vulture/ New York Magazine's review of Jonathan Franzen's literary output to date:

The Big Idea in Purity belongs to [Franzen's protagonist] Andreas: his theory that Google and Facebook constitute the new Stasi. So anti-communism has morphed into technophobia, and the internet is the new totalitarianism. […]

August 29, 2015 8:31 AM

noah on Mickens on Security:

I'm a little surprised at how seriously some commenters are taking this. Did we all read that same paper? Mine says, "Girl Scouts (whose “cookie sales” are merely shell companies for the Yakuza)." Obviously this guy is in the pocket of the Girls Scouts, and trying to throw suspicion off their true backers, the Illuminati. But the password advice seems legit.

August 29, 2015 8:30 AM

Curious on Friday Squid Blogging: Cephalopod Anatomy Class:

Btw, it is ofc not my intention to lower the quality of comments on his blog, so if the ppl. running this blog think this is too much, pls, give consider sending me an email and I'll refrain from sharing my vague ideas in the future. :P

August 29, 2015 8:23 AM

Curious on Friday Squid Blogging: Cephalopod Anatomy Class:

Off topic, of sorts:

I am fascinated by the obscure meaning in this one message on Twitter:
"Practical quantum crypto without a non-quantum channel to distribute conjugate basis? I want to see this."

http://www.scientificamerican.com/article/quantum-spookiness-passes-toughest-test-yet/


Even more fun for me (not a scientist, nor a mathematician) is to ignore the apparent context, which was an article from 'Scientific American' linked above here.

I've always wondered if the math behind quantum mechanics could be used to subvert crypto, as if designing an encryption scheme with some very clever and obscure backdoor of sorts.


Please indulge me, the following is highly idiotic and intended to be very imaginative, the following isn't supposed to make strict sense, it is the best I could do atm. A lot of name dropping going on here off things I vaguely recall from Youtube videos:

I won't pretend to really understand quantum mechanics in physics or the relevant math, but what if every bit value processed for some cryptographic scheme, for encrypting something, could be represented by overlapping 'parity transformations', with each square matrix of real and imaginary numbers ALL being the complex conjugates of each other, either yielding a positive or a negative (effectively 1's or 0's), as if a "quantum-math-analysis" of some backdoored crypto algorithm worked by extrapolating each bit from a string of bit numbers to be encrypted into some kind of overlapping structures (permutations) of matrices, a structure that was self sustaining through permutations until the very end, for which an encrypted message somehow was produced. Then, as some kind of wishful thinking, you could reverse/inverse it all back into plaintext, simply because the algorithm was crafted that way (or maybe simply because future quantum crypto turns out to be a disaster math wise some years from now). :D

Btw, anything 'complex conjugate' seem imo eerily sort of similar to how all points for an elliptic curve is plotted in a coordinate system, specifically when I imagine how both are mirrored across the X axis in a cartesian coordinate system. What if parity transformations (point inversion/reflection) could be used for some kind of "backdoor math" for ECC crypto?

Also, probably *entirely* unrelated, I just noticed the following looking over a Wikipedia article; I am wondering, if "Complex conjugates are important for finding roots of polynomials" (from Wikipedia), maybe you could use "complex conjugates" to build a backdoored encryption algorithms/schemes?

August 29, 2015 7:36 AM

G.Scott H. on The Benefits of Endpoint Encryption:

The non-volatile memory component used to store the firmware password is usually a commonly available general purpose design. Those will have a reset pin. Most I have seen clear the password when the reset pin is grounded on power-up. If you have already identified which chip to remove, then resetting is usually going to be easier than re-soldering a new one in its place.

We here seem to have concluded that sophisticated attackers (as opposed to the common thief) can overcome end-point encryption. Many of the organizations we associate with being sophisticated attackers are the ones pushing against ubiquitous end-point encryption. Odd. Maybe we are giving more credit for overcoming end-point encryption than we should?

August 29, 2015 7:34 AM

Clive Robinson on The Benefits of Endpoint Encryption:

@ QuartzDragon,

I have to wonder whether even SSDs are safe. If the NSA or Mossad really wants your data, they will get it, one way or another... :/

The reality is, as always complicated, as a general rule SSDs are less secure than magnetics because of "erase issues" at the storage level (look up "wear levelling" in Flash chips). At all other levels they are probably about the same level of risk.

So the next question is how do you mitigate the risk?

Well being able to get into the HD controler sounds like it gives you lots of power, but even the most powerfull of men find themselves powerless when locked in solitary confinement with their only knowledge of the outside world coming through a guard who can not be easily subverted.

So you place a guard between the HD and the computer. It's job is two fold, the first is to only alow a certain minimum of the valid commands to pass to the drive, the second is to deliberatly realign cylinders and blocks of sectors, such that what gets written to where is unknown by either side of the guard. The minimum of valid commands helps eliminate attempts to get at the HDs firmware, the realignment helps reduce issues such as an already infected firmware sending back mal/spyware instead of valid OS / app / data files.

You also make the guard such that it also does encryption with keys, encryption or both "out of band" @Thoth will tell you more on how to make SIM and similar SmartCards into trusted "key-stores/encryptor" for this (the penalty however is access speed that may actually not be an issue).

In effect the guard is what the NSA etc call an "Inline Media Encryptor" or IME, the SIM/SmartCard the "Crypto Ignition Key". However you add some "extras" in the guard, one of which is a low level port you can attach a terminal or other device to so you can perform low level forensic style analysis with it. You also add a "false boot" trick, whereby the guard appears to be a computer booting up from the drive after powerup thus getting around another issue with spyware that may already be installed in the drive firmware.

For obvious reasons this drive and guard are going to be "external" to the computer so there are physical advantages to making it a USB drive. Likewise there are advantages with not making it the primary boot drive. Thus booting of a "read only media" device such as a CD/DVD ROM or even a floppy is desirable.

As the guard is "inline" you can in effect use it "transparently" and add a second layer of encryption such as the dreded "bitlocker" or TrueCrypt or if not using MS (a good idea) what ever OS Driver level and app level encryption it uses.

One way to use MS more safely is as an image in a VM on a *nix platform.

Which brings us around to another issue "why boot MS OSs?" For some time MS has had various ways to fast boot by using a suspended image held in mutable memory such as the hard drive. I'm not sure of the details but there are ways to make/use these images in VM's or in chain loaders. So it should be possible to store the images and a chain loader on a DVD etc.

There are still some dangers in booting off of such media but again you can mitigate them.

One mitigation is to inspect the memory in the computer and check it's what it should be. There are a number of ways to do this, the first is to halt the CPU and then connected to the computer buses use a hardware card to examine the memory. This works with older CPUs such as the 486 on ISA bus but not when you have "Intel's Bridges" to contend with. The second way is to use a second CPU or DMA device connected to the system buses. A third which I've not tried is to use the JTAG system, it may also be feasible to "image boot" Intel systems via JTAG, it certainly is for other families of CPU as it's the way some development systems work.

So for those with the desire, knowledge and other resources there are ways to beat even State Level attackers when it comes to "information attacks" forcing them into "physical attacks" which demand very high resource input by them and very significant risk (which is why the likes of the Israeli and Russian ICs have in the past simply gone for the lower risk assassination option).

I won't detail them here but there are even ways to prevent the "$5 Wrench" or "thermorectal" data extraction methods working, because you can only tell what you remember or provide access to...

At the end of the day the measures you take are dependent on a whole raft of things, many require specialised knowledge, and of course resources. But it also requires what few humans appear willing to do, which is "control themselves" part of which is OpSec and for most mortals they don't practice it when they should. Technology can only go so far, the rest is how strong your personal will is.

As we have seen recently with IS some people are willing to stand up to them even though they end up dying. The sort of people who have that will and determination who also practice good OpSec and Trade Craft will beat State Level opponents every time. And it's knowing they are impotent in this respect that makes States tourture and murder not out of any real need, but self destructive rage at being thwarted and their vaunted manhood proved worthless. If you think how little if anything "waterboarding" and "Gitmo" and the preceading "rendition" has gained the US or it's alies and compare that to the loss of face, prestige and credibility even amongst their own citizens you can see why no matter what the short term gains, it can never make up for the long term losses.

It's a lesson the US still has not learnt as evidenced by their behaviour towards Maning and Snowden, if anything it can be shown it's had entirely the opposite effect in that there are now more whistleblowers than before...

August 29, 2015 7:24 AM

Czerno on Friday Squid Blogging: Cephalopod Anatomy Class:

@Curious, @Not surprised :

It's been reported - even on to his blog, iirc -
that defeated Germany has been bound by secret provisions of treaties which in effect make her a vassal state /in aeternam/, at least limiting her 'sovereignty' wrt the USA and allies.

August 29, 2015 6:54 AM

Gerard van Vooren on Defending All the Targets Is Impossible:

@ ianf,

I am only pointing out that there are alternatives. The discussion was heading in the direction of about having guns for self defence. So I brought up pepper spray and running hard. Why did I introduce Ayaan Hirshi Ali? Because she is the only one I know who has used the stuff. That's all.

Besides that, I also like to argue about double standards on multiple subjects. If you think that I am a hard case because of that, so be it.

August 29, 2015 6:31 AM

ianf on Defending All the Targets Is Impossible:

You're a hard case, Gerard van Vooren, seemingly enthralled by some image of Ayaan Hirsi Ali wielding a pepper spray can… but you're forgetting one thing: because of differing legal regulations, that form of deterrent isn't seamlessly portable across disjointed borders. In fact, I'd be more wary of awakening the interest of some police, having to explain myself, than by the can's potential of thwarting a violent attack by shielding myself in a mist of pepper. Which I'd have to carry in my pocket at all times for it to be of use. Frankly, that's a non-starter.

BONUS: rent a copy of "Frantic" by Roman Polanski. It contains a scene in which Emmanuelle Seigner shows her temper by macing a US spook—Hollywood, but still. We should arrange a Celebrity Spray Ray Death Match between Seigner & Ali – who'd probably win this because Seigner can not afford a media outcry of her "fighting dirty."

August 29, 2015 6:04 AM

Thomas on Friday Squid Blogging: Cephalopod Anatomy Class:

@Bob

> I am beginning to think LINUX is finally ready for prime time.

As a long-time Linux user I often wonder if/when Windows will be ready for prime time :-)

I used to be dismissive of people who claimed Linux was too hard to use.
Then I had to use Windows after a long hiatus. It was rather humbling to realise just how difficult it is to use a system you're not used to. Everything was in the wrong place, all the useful stuff was missing and a bunch of useless junk kept leaping out at me.

The exact same reaction a Windows user would have on Linux...

So... I suggest that Linux is ready for prime time, and has been for some time.
However, like any complex system, it takes some getting used to.
I suspect that it's no more jarring than taking a Mac or XP user and unleashing them on Windows 10 (Windows 9? Windows Nine? Windows? NEIN!).

August 29, 2015 5:59 AM

Curious on Friday Squid Blogging: Cephalopod Anatomy Class:

NRK (norwegian national broadcasting) had another article about Snowden I see now, but the article is in norwegian. Looking at this now it seems as if this explains something about how they found the documents mentioned in my earlier comment here.

http://www.nrk.no/fordypning/snowden-dokumentene-skjult-og-hemmeligholdt-1.12521539 (not in English)

Here it is alleged that the department documents had been kept out of view for over two years. Department documents is by law required to be posted to a journal that the public can read, or at least get to know about. It is unclear to me how undisclosed stuff should be handled with regard to secrecy rules, if simply to be omitted in its entirely, or simply referenced in some limited way in the public and open system that provide online document files to the public.

The authors write that they found "the documents' existence" when trying to retrace how the bureaucracy handled Snowden's asylum request.

I am not aware of norway having some kind of FOIA law. I would think that you have to go search and find stuff for yourself online, search tool provided by the government. I guess they simply solicited the departments and ministries directly.

On the reporter's receiving a list of documents about Snowden's asylum request, and asking for the documents from the US embassy, they were denied. It appears then that they were kept hidden from the public, as I remember reading about that practice some time ago, by some generic secrecy rule, by the state department implying that exchange of sensitive information between countries require such sensitive information to not be disclosed to the public.

Ofc, I think these reporters should have known about the government's publication rules from the start. As mentioned, it is to me unclear by the story, if there might have been an issue with documents being wrongfully kept hidden as per rules, or on the contrary if having been kept hidden in some approved way, or if being partially hidden and partially referenced.

Four months after filing a complaint with an ombudsman, the reporters was given access to documents, seemingly because of how there was also an extradition warrant (my translation here) about this case that came up when reviewed.

The article make a point early on in the article, about how one might wonder how many documents are kept hidden this way. Apparently, the departments and ministries decided to keep the lot of the documents surrounding Snowden hidden from the public.

August 29, 2015 5:48 AM

deLaBoetie on German BfV - NSA Cooperation:

@rgaff - I very much had the dangers of the outflanking manoeuvres you mention in my point c). In my opinion it's treasonable and trashing the rule of law for them to have done this, and the only circumstances they should be able to do the data sharing is under the same protection as provided by their local laws.

But that's very much not happening, and in fact, bulk data sets are being shared amongst the x-eyes, like shipping around radioactive toxic waste.

August 29, 2015 5:27 AM

Prof McDick on Mickens on Security:

James Mickens speech has just been run through a bullshit translator and this is what it came up with:

My point is that working for Microsoft has made me soft in the head and an apologist for the Prison Planet. In matters related to security, I'm blind to cause and effect, symptoms versus etiology.

For instance, I don't understand that the average "threat model" section of a government Stasi intelligence report resembles the script for a telenovela that was written by a parnoid schizophrenic.

There are elaborate narratives - "the lone wolf is everywhere" - and grand conspiracy theories - "ALCIADA, ISIS, AL-NUSRA are a mortal threat to the homeland".

There are heroes: "American Sniper", "Jessica Lynch", and other brainless tools in service to projecting the power of the US military empire. There are also stereotyped Hollywood villians and plots: "We got him (Osama)" and "(INSERT COUNTRY HERE) is part of the axis of evil".

In the real world, these threat models are ridiculous. Basically spooks rarely deal with a statistically improbable event such as a a terrorist plot, thus leading them to unleash their paranoid fantasies upon the public in the form of groundless suspicion, monitoring and framing.

If your adversary really is a terrorist, statistics show that they really are likely to get away with it and these systems have hopeless predictive value, but are useful after the fact.MOST HARDCORE TERRORISTS WILL ACHIEVE THEIR AIM AND THERE'S NOTHING THE STASI CAN DO ABOUT IT.*

* Exception: Intellectually/emotionally/mentally challenged persons set up as a patsies by the FBI in contrived 'terrorist' plots; a common feature of the modern US 'justice system'.

Die-hard terrorists are not intimidated by the fact that the intelligence groups employ blanket monitoring of communications and various networks. If they want perfect information sharing, then they will forgo all electronic devices and return to a secret and trusted personnel chain for all critical messages.

When the Stasi Omnius electronic brain is dissected upon it's grisly death, we will be witness to a enormous cancerous tumour that has eaten the life from the patient - inside-out. The spooks will beg forgiveness and cry "I was just following orders!" as they face a Nuremberg trial wearing shirts saying "IT WAS DEFINITELY US".

Then you'll be able to enjoy cracking open your electronic Stasi files that inhabit the darkest reaches of NSA data centers. Instead of looking at the photos of your vacation and family, you will be seeing your most intimate 'dick pics' and email meltdowns laid bare.

In summary, when paranoia, hubris, delusions of grandeur, neo-con politics, banksters and twisted economics find a common friend in a fascist and militarised corporate state, you know that SANTA CLAUS ISN'T REAL.

When it rains shit, it pours bitchez.

August 29, 2015 5:20 AM

C U Anon, on Fingerprinting Burner Phones:

Assbole:

Apart from a shill or five, most commenting on this blog want to increase security not decrease it.

Thus you will find leading edge ideas discussed here the objective being to pick them apart and find the ways they work and more importantly fail or can be mitigated.

Security is dual use technology it can be used for good or bad, in general the community here want to use it for good, in general it would appear those who are tax dollar funded want to use it for bad.

Rather than get upset about it, learn how to work with it to your own advantage, because bad will succeeded if good does not continuously fight it. Good may not win but it assuredly can get even.

August 29, 2015 5:19 AM

Curious on Mickens on Security:

Two quotes about "paranoia":

1) Just because you're paranoid, doesn't mean they aren't out to get you.
2) "Paranoia is just reality on a finer scale." (Strange Days, James Cameron movie)

August 29, 2015 4:11 AM

Curious on Friday Squid Blogging: Cephalopod Anatomy Class:

Edward Snowden related

There was one story of 27. July by national broadcasting corporation's online news site (NRK), with a couple of articles for two languages about there being undisclosed documents that showed US pressure to solicit an extradition of Snowden from norway, and it is pointed out in the article that other European countries have likely received such notices as well.

NRK has put up two similar articles, one in norwegian and one in English, however they are somewhat different, and the one in norwegian also has more text and an additional document linked. I haven't checked to see if there are more recent articles.

The norwegian version has 7 hyperlinks to faximiles of documents/email in pdf format at the bottom, and the English one has 6. Comparing the content of the document files in the links, they seem to show the same content, with a couple of exceptions. One document has been doubled in length to add an English translation to the latter half. The other document seem to be omitted in the English article.

The omitted and brief document dated 5. July 2013, from the norway's "Ministry of Justice and Public Security" to the state attorney is afaik not linked to in the English article. This letter start by referring to a phone conversation between the two parties and has the title "Anmodning om eventuell pågripelse - Edward Snowden"/"Request for possible apprehension - Edward Snowden"(my attempt at translation). It refers to an enclosed copy of diplomatic note no.54 from the US embassy and to an extradition treaty of 9. June 1977, and asks of the state attorney to take this request into consideration in the case that "Snowden should come to norway". Finally, the letter makes a point about how they believe there is no warrant for Edward Snowden in Interpol at present time. Letter indicates that a copy of the letter was sent to 'Kripos' (norway's version of FBI I guess) at Interpol. (Important?)

Note, I see that the wording/language of this letter to the 'state attorney' from the ministry of 'justice and public security' is somewhat different than the letter from the 'state departement' to the 'ministry of justice and public security', which may or may not be of importance. First it is made a point of how Snowden should be 'arrested' if 'arriving' at 'norwegian territory', but in the letter to the state attorney, the wording is about "should Snowden come to norway".

I would say that the letter having made a point with the precise wording of "should Snowden come to norway" might come to mean more than being about someone arriving to norway. The NRK story as I understand it, alleges that US embassy hasn't received a reply to their request in any way, so I am inclined to think that norway has both seemingly not responded to the request of USA, while also, effectively by wording, possibly kept having a pending case against Edwards Snowden up to present time, because the words "should come to norway" imo could mean any hypothetical case for which it is believed that Snowden, even as a remote chance, might end up in norway somehow, thus being more of a proactive concern than a mere concern as if after the fact of Snowden having arrived to norwegian territory.

In the NRK story, it is pointed out that Snowden's legal advisor knows of similar documents from Germany. Afaik the article doesn't say anything about how these documents came about. There are some graphics that indicate some of it is being classified as (U//FOUO//REL TO USA, DNK, NOR, SWE, FIN)

"What is troubling to me is the suggestion that if Mr. Snowden showed up in one of these countries, he should be promptly extradited – before he would have a chance to raise his humanitarian rights under international law, he says." Snowden's legal advisor Ben Wizner.

The norwegian version makes a point that the police has a case file number on Snowden

http://www.nrk.no/fordypning/usa-asked-norway-to-arrest-edward-snowden-1.12521802 (English)
http://www.nrk.no/fordypning/usa-ba-norge-arrestere-edward-snowden-1.12521290 (norwegian)

Note, I'd claim that norwegian media isnt' good at quoting people, so one can't trust a quotation to be a direct quote, or if it might effectively be a paraphrase.

Also, whatever a country like norway were to eventually decide in any case, it probably isn't anti-USA in any case. Fyi norway is a country that have on the record as having no issue at all having lent out war material to USA in its warfare against other countries.

Having read the recent news about how US' FBI is to have previously solicited for the extradition of Edward Snowden from some Scandinavian countries, I incidentally looked up "political crime" on Wikipedia and I think I might have learned a few things. I know very well that Wikipedia isn't the final place to go for any kind of hard fact checking as such, but this will do for now.

I have no idea what defense lawyers around the world think of this, but according to the Wikipedia text, crimes of "treason" is thought of as being political crimes, as opposed to "state crimes", because of how treason is deemed to be threatening or directly challenging the state/government.

This looks almost too easy to me. With the government of USA being antipathetic to Edward Snowden as a person and likely thinking of him as a criminal , it never occurred to me before that crimes in general could be considered 'political crimes' in "criminology" as is pointed out on Wikepedia.

It would not surprise that if Snowden got on a plane, the plane would be intercepted and diverted to some pro-USA country, if not flying straight to some area deemed USA territory, but ofc, I am no expert in such matters. Heh, a commenter in an article somewhere suggested that such people should instead be moved by train. Not sure what would be more complicated, a flight perhaps across the airspace of multiple countries, or by train, across multiple countries.

August 29, 2015 4:08 AM

Joe Larabell on Mickens on Security:

Even more important than *who* is attacking you would be the question of whether they are attacking you specifically for a good reason or whether you've been picked at random. A random attack is likely to be thwarted by some pretty simple measures -- all you really need is to put enough obstacles in the way that the bad guys find it easier to pick on someone else. The strong password comes in here because they're not just trying to crack your password but 1000s of passwords at once and they're going to be too busy keeping up with the small percent of people who used "1234" to even get around to your account.

But if you're being targeted specifically by someone who wants to get at YOU, be it Mossad or not, they're eventually going to get through no matter what you do short of encasing your computer in concrete. So in addition to picking a strong password, it's probably a good idea not to piss off the Mossad or the Yakuza or anyone else who might tend to hold a grudge.

August 29, 2015 3:16 AM

rgaff on Friday Squid Blogging: Cephalopod Anatomy Class:

@Wesley Parish

I completely agree... and it is why figuring out ways of denying collectors from collecting the data in the first place is really paramount in backwards nazi-like countries like the usa! Not that this is always possible, but it is much much more than "default" if you get creative...

August 29, 2015 2:43 AM

Wesley Parish on Movie Plot Threat: Terrorists Attacking US Prisons:

@albert

The system needs changing. Instead of electing representatives from a set of 1%ers who get bribed to run for office like it's escaping from them, by other 1%ers who pay the bribes to get 50% ROI, elect who gets to spend time in the remodeled High-Security Capitol Hill under bogus charges of pterorism ...

August 29, 2015 2:25 AM

Wesley Parish on Friday Squid Blogging: Cephalopod Anatomy Class:

@Bruce,

I've just been reading Data & Goliat6h, and when I got to

Unlike in the EU, in the US personal data about you is not your property; it is owned by the collector.
I had to take a walk to digest this.

What an incentive for fraud! What a boon for fraudsters! It disconnects data from reality. If data collector X "owns" my data, data collector X is not under any obligation to see that it is in any way correct. Nor is there any sunset provisions on a company's own data, except of course when it's under scrutiny by the authorities ... so much like the fraudulent "derivatives" market ...

I hope Chinese investors take note. The Chinese authorities are much, much stricter on fraud than we are in the West. I think the Chinese authorities should put the United States under watch, and discourage investors from investing in the US until this incentive to fraud is eliminated.

August 29, 2015 2:05 AM

Assbole on Fingerprinting Burner Phones:

You people make me sick in the comments who advocate gov activities like this. Soon enough well be to the thought crime Era. .. wait a second we already are. What is a hate crime? Fuxking stupid shit.

August 29, 2015 1:30 AM

Thomas on Mickens on Security:

So a guy working for a company late to the "spy on your users" party (but as usual doing an exceptional job catching up) tells us that all we need to be safe is good passwords (which are uploaded to said companies servers and shared with your friends).

Don't know about you, but I'm convinced!

August 29, 2015 1:20 AM

Thoth on The Benefits of Endpoint Encryption:

@QuartzDragon
Reality is, there are research experiments and papers in the open public sector that shows it isn't all too hard to get whatever you want (as you mentioned about NSA or Mossad). Security is not as robust as we wishfully think because of the lack of RoT.

Maybe the FDE can prevent petty intrusions until someone does massive or single targeted insertions and exploits. If you are talking about just preventing that casual somebody, it might work against them but not against agencies.

August 29, 2015 1:09 AM

rgaff on Mickens on Security:

We have to try, because we have to TAKE our right to privacy... nobody's going to just give it to us, we have to take it.

But, currently we're doomed to fail, because all our hardware and software is designed wrong... This doesn't mean we shouldn't try though, it means we have to recognize that we'll need to just keep learning from our failures and learning from our failures, until we eventually succeed (perhaps not in my lifetime, or much later in my lifetime). If we don't try, we'll never learn. So keep trying, failing, and learning, then trying again. It's only the right thing to do.

August 29, 2015 1:08 AM

65535 on Friday Squid Blogging: Cephalopod Anatomy Class:

@ Dark State Canary

I have a relative who is an attorney. He advises PI’s on some of the legal issues with this cell phone spyware. He tells me it is astounding the type of smart phone interception devices marketed to PI’s globally. He basically says if a PI wants your voice, text and location he can get it.

I just wonder how large this Smartphone spyware industry is. The next question is when Drug Cartels will start to buy the stuff. It’s a world wide market.

As for determining if your iPhone or Android is infected, you might ask Clive or Nick P.

August 29, 2015 12:58 AM

Gerard van Vooren on Defending All the Targets Is Impossible:

@ ianf,

Ayaan Hirsi Ali once demonstrated how to use pepper spray in a restaurant and accidentally sprayed onto other diners there. She apologised of course and that's it. I didn't read anything about her being fined.

About your escape from the dog attack. Guns probably won't do the trick. Pepper spray however, if it works onto people it also works onto dogs. It could be the difference between being bitten and eaten alive.

August 28, 2015 11:46 PM

QuartzDragon on The Benefits of Endpoint Encryption:

Well... I am not sure that hard-drive encryption is even to be trusted, if the likes of the NSA are able to insert their malware into the hard-drive firmware... I have to wonder whether even SSDs are safe. If the NSA or Mossad really wants your data, they will get it, one way or another... :/

Maybe I am just being pessemistic?

August 28, 2015 11:16 PM

Evan on Mickens on Security:

Mickens' argument is a simplified version of one Bruce has made before: good security practices will defend against attackers who are merely curious or with limited resources; you can never defend against the well-funded intelligence and counter-intelligence agencies of rich countries, against whom the best defense was simply not to be a target of national importance.

There are, however, three problems with this:

1. Even if we can't keep out Mossad 100% of the time, that doesn't mean we should make things easy for them or fail to understand the techniques they may be using to accomplish it. Having to work for our data is one way, at thing point probably the only way, to keep intelligence agencies honest. The more time and manpower have to go into getting at your data, the less likely employees are to be able to put it to their own personal use.

2. As cybercrime becomes more profitable and cyberwarfare becomes more economically appealing, the line between the capabilities of Mossad and not-Mossad is going to get blurry. Ex- and even current intelligence employees could make a lot of money selling techniques and packages to paramilitaries, organized crime, private companies, etc; it's only a matter of time before grey or black market products start appearing.

3. The line between political and non-political targets is also going to get blurry. To some extent this is already happening: Russian, Chinese and US intelligence agencies obtain secrets that end up not in their governments' hands but in those of private companies. Additionally, the trend of privatization, outsourcing, and cutting costs with off-the-shelf software means private companies further and further from direct government action are going to be within the sphere of influence, because they host sensitive data, because they interact with sensitive data, or simply because their products are potential vectors for attacks against important targets.

In short, just because you know you won't be able to beat Mossad doesn't mean you shouldn't try.

August 28, 2015 11:15 PM

rgaff on Defending All the Targets Is Impossible:

@Gerard van Vooren

I can't agree and disagree at the same time? hah :)

@ Sancho_P

wow what a headache with all those secrets...

You can't ban the use of encryption, that is to ban the use of many electronics... and you do that to someone who depends on any one of them for his livelihood and you've banned him from having a job (and therefore, banned him from feeding himself and paying for housing too!)... they'd be banned from reading this very blog, doing most shopping and banking, the list goes on and on... If you're going to put someone in such a prison, they should have a right to a fair trial and defense FIRST, know what they're being accused of, etc.

I don't understand expelling people from the country, are you suggesting we send all our criminals to Australia again?

August 28, 2015 10:41 PM

Thoth on The Benefits of Endpoint Encryption:

@jaime
What is the difference between trusted and trustworthy ?

Trusted is something you trust and once it fails, it breaks the system security as a whole. Similarly, trustworthy is something where you place trust and denotes the same meaning. Either way, both are referring to the same thing no matter how you look at it.

I think @RobertT, @Nick P, @Clive Rosbinson, @Wael, @Figureitout, @Markus Ottella (hope I got the name right) and myself have extensively discussed on such systems in many posts before. We have included points where security chips deployed in real life have not lived up to their expectations and theories let alone political meddling and human desires in play which caused these "trusted" or "secure" chips to not perform as they have to in our eyes.

The entire security of a system boils down to a Root of Trust (RoT) and for most computing system not designed for security, they have no RoT. Most security chips as we know (including TPMs and security integrated chips like Intel, MIPS and ARM) have some form of RoT but that's in theory because you must trust Intel/MIPS?ARM certificates and designs inside their integrated chips while history and current politics and human meddlings have cautioned us that these kind of trust can be easily misplaced.

A few of us including myself have proposed absurd ideas like a trusted controller with tiny open transistors for inspection as a RoT unit and of course it's absurd but our suspicions of "trusting someone's trust" just isn't working out the way we expected.

@Clive Robinson, @Wael and @Nick P have contributed with their security designs which I called it the "Castle-Prison-Dataflow" architecture which compromises the best of all worlds they have to offer but again, it is not commercially viable because of the current politics and human meddlings in the industry (and resources needed).

By the way, take a look at Qualcomm's ARM TrustZone implementations (QSEE) and you will see a couple of rather fatal bugs already occuring over the past few years which was suppose to be the RoT of many "secure phones" and I would guess the Boeing Black designed for US DOD and agencies usage might also be ARM with TrustZone from their public documents and I would guess they might be using Qualcomm as it's the single biggest mobile chipset provider with ARM TrustZone all rolled in one.

Unless one can solve the RoT problem, all these security systems have large gapping holes......

August 28, 2015 9:58 PM

jaime on The Benefits of Endpoint Encryption:

Ironically, there are no known ways to do a secure or trusted boot with the user in control due to the proprietary nature
Thoth, you may be confusing "trusted" with "trustworthy". A trusted system is one you rely on to enforce your security policy, whether or not such trust is justified. "Restricted boot" would be a more accurate and neutral term than "secure" or "trusted".


Matthew Garrett wrote about a way to improve the security of full-disk encryption to prevent bootloader replacement attacks. The TPM and another portable computer (e.g. smartphone) are the main trusted components.

August 28, 2015 8:34 PM

Clive Robinson on Friday Squid Blogging: Cephalopod Anatomy Class:

@ Bob S.,

I am beginning to think LINUX is finally ready for prime time. BTW, it's free, too.

If you pick the right distribution it's probably going to be FREE of spyware* as well ;-)

* I can't say that for the apps though, but the likes of Debian in the past has been fairly good on this score. As for Googles Android... what can I say, let's just say that they've had to pull quite a few "nasties" recently from their store...

August 28, 2015 7:50 PM

Steve on Friday Squid Blogging: Cephalopod Anatomy Class:

Bulk collection - No Standing to sue.

https://firstlook.org/theintercept/2015/08/28/court-cant-rule-nsa-bulk-collection-dont-know-whose-data-collected/

https://www.eff.org/deeplinks/2015/08/appeals-court-falls-for-governments-shell-game-nsa-spying-case

Ok so It is known (FOIA) that bulk collection of untold millions of phone records have taken place for a long time, but no one individual can penetrate to gain proof that they were swept up in it.

My question is can a class action suit with a very large group of N plaintiffs prove with statistics that some percentage of them were swept up with probability 1.0, in which case would the plaintiffs as a group have standing? Who could do the math here? Or would the gov still say you can't prove which ones...

August 28, 2015 7:35 PM

Thoth on The Benefits of Endpoint Encryption:

@all
Trusted boot or secure boot has gotten a bad name for itself due to UEFI and the stuff of vendor lock-ins like Microsoft and Apple. Neither setting a BIOS password nor encrypting the hard disk with FDE encryption secures the entire boot process fully and at best a half done job. Ironically, there are no known ways to do a secure or trusted boot with the user in control due to the proprietary nature of the chips, fimrware and all other parts of it.

If someone can edit the bootloader or lower level firmwares controlling the boot process and hand it over to the user, there is no need to bruteforce any passwords or certificates anytime. During the infected boot process, a user can key in his password and the low level malware can use side-channels to exflitrate the keys and passwords.

"Encryption itself has no agency ...", which our host, @Bruce Schneier always like to say.

This is very true when the very hardware and firmware you use can badly betray you deliberately or inevitably. Look at the amount of blackbox chips the GCHQ dudes demanded to be removed from The Guardian's Macbooks.

August 28, 2015 7:34 PM

Bob S, on Friday Squid Blogging: Cephalopod Anatomy Class:

A friend impulsively installed FREE! Windows 10 on his computer apparently because it was FREE! then wondered why it was acting stupid and slow. Would I look at it?

OMG! The privacy option pages were very scary in person. MS wants to Mass Surveillance everything. Literally. Unless you opt out of course.

My fingers got sore working about a hundred sliders.

Anyway that prompted me to make the plunge to Linux Mint 17 on a bootable USB stick and must say I am very pleased so far. Anyone who has worked under the hood of Windows can certainly be up and running with Mint in less than 10 minutes once the USB is ready. Mint is quick and there are a great many installed packages like LibreOffice not to mention Firefox, media apps and so on. There is also built in encryption.

One tip: Of course you must change the boot order to boot from the USB. On mine all that was necessary was to choose "Legacy" BIOS as opposed to the default "UEFI" on the boot order screen.

I am beginning to think LINUX is finally ready for prime time. BTW, it's free, too.

August 28, 2015 7:32 PM

Clive Robinson on JackPair Encrypted Phone Add-On:

@ Raym,

The main problem of Jackpair is not to create an encryption algorithm or digitalize the voice, the main problem is the SYNCHRONIZATION on the GSM VOICE CHANNEL

Synchronization of what? you don't say which makes it difficult to rationally discuss. So I'll work my way upwards from the basics of FSK.

FSK at a low level is in effect self synchronising and can be received reletaivly easily by a non synchronus receiver followed by a clock regeneration and pulse width restoration circuit. Which you can look up in most graduate text books on data communications.

The reality is FSK can be generated in various ways some using in effect a single voltage controled oscilator driven by the data after it has been through a raised cosine filter to minimise the bandwidth by minimising the side bands. Others are realy MFK using two or more oscilators that you switch between. If the oscilators are derived from a master source then frequency changes can be made in such a way that the waveform is continuous (modern systems use Digital Oscilators for convenience). Such a system can work with either an asynchronous or synchronous receiver, the latter has around a 6dB advantage. However MFK systems can be made orthagonal to give an even greater advantage over FSK.

In orthagonal MFK signaling systems the duration of a tone is the reciprocal of the frequency seperation thus a tone duration of 0.1sec would use tones of ten Hertz seperation. This alows the use of quenched infinate Q resonators to pick the signal out of the noise to such an extent that 75baud --ten character/sec 100word/min-- teletype traffic could be sent very reliably across a very low quality HF link that even slow morse at 5word/min could not be achieved, it can also be designed to be more jamming resistant than FSK and non orthagonal MSK systems. Later versions ran at 600baud which with modern high compresion codecs is enough to send intelligible voice communications. I'm aware there were designs for a 2400baud system in the 80's to attach a digital voice encryptor system developed by Plessey Comms for VHF and microwave systems used by the UK military at the time.

The British Diplomatic Wireless Service (DWS) invented orthagonal multitone signaling in the 1950's and called it Piccolo after the musical instrument it sounded like. They built it into the Kaynard system (manufactured by Racal) in the 1980's that had the modem and receiver 100watt transmitter all in a couple of attache cases at every UK embassy and resedency and often moved with the senior members of the delegation.

I was indirectly involved with developing 9600bps modems for the original analouge cellular radio systems in the 80's and the problems were not with low level sync but audio drop outs. Which whilst almost imperceptable to humans made things akward for data. However the solution arived at did not require the modem to be connected to anything other than the audio connectors. Overly simply it used a sliding window protocol which learnt when audio drop outs were to be expected and losely sychronised with them. Such systems would still work quite happily on GSM network audio at well over 2400baud which is all the data rate required to send reasonable quality voice communications.

Whilst getting a sliding window error correction system to work well can be a pain it is a solved problem.

If there are other sync issues you are thinking of state what they are and I'll see if I can answer the questions for you.

August 28, 2015 7:15 PM

ianf on Defending All the Targets Is Impossible:

@ Gerard von Vooren doesn't think the police are gonna make a major fuss when you carry pepper spray.

That's not my (admittedly, limited) experience of how patrol/ street police operate. They may not stop-and-frisk me looking for a spray, but, should I be forced to use it IRL, and they get involved, I may just as well be slapped with a summons or first-offender-caution, if not end up having to answer stupid questions like “what was my intention with carrying a [here] forbidden substance that could blind a bystander?” So what would be the point.

I'll tell you something… the worst “self-inflicted” life-threatening situation that I was ever in happened 14 years ago when I fancied walking down the hill from the pictoresque town of Taormina to Giardini-Naxos in Sicily. It was pretty steep, but there were marble steps downhill – to begin with. After a while it became rough hillside, pretty neat to scale down at leasure. Then I heard the dogs. They were both above and below me, either wild/ feral, or at best half-tame shaggy guard dogs without visible human supervision. This forced me to stop & decide on tactics. I couldn't retreat… the one above was bigger & more vicious of the two, and I saw that it avoided certain ledges that could have brought it near me. I filled my pockets with sharp palm-sized stones, and continued down towards what I now saw was much younger, thus rather scared/ excited dog. I used steeper outcroppings to advance down at a pretty slow pace. After a while I could no longer see the older/ bigger dog, which also quit barking. But the young one went gaga now that it stood alone in my path. There was some kind of shack a bit away on the slope, looked like a stone shepherd's hut, or it might have been that dog's err… doghouse… I wasn't going to look any closer. I advanced down steadily, could see beginning of a paved street that surely would lead me down to the beach level. Then I heard someone apparently reining the dog in… just as well, because, had it lurched at me, I'd shower it with rocks, and perhaps end up being shot by that dog's must've been mafioso's sawed-off shotgun (nasty wounds, see Godfather III for instructions).

Would carrying a pepper spray make my predicament easier? Hardly, and I probably would have forgotten to bring it along in the first place (not to mention been able to take it abroad to begin with - that was in the last week before "9/11," my Swiss Army knife had to fly in the hold in an airline-tagged cloth sack.)

That said, and since I later had tangential, untreathening, but nevertheless unpleasant encounters with other guard dogs in Italy and Spain, I now travel with a small empty pistol-spray bottle that I fill at destination with household ammonia, for just such walk-in-the-countryside warding-off purposes.

August 28, 2015 7:12 PM

Dark State Canary on Friday Squid Blogging: Cephalopod Anatomy Class:

Cell phone spyware is everywhere -

Sleazy advertising by a mobile spy tool. Also, better talk to a lawyer before you start bugging people's phones. pic.twitter.com/ZCkJDXGG5E

— Mikko Hypponen (@mikko) August 28, 2015

So what's the best way to identify the source and type of that pesky, sneaky spyware some troll stuck on your cell phone? NYC Private Investigators say it's very unusual to be able to positively confirm the presence of spyware on a cell phone. Is this true? Why?

P.I.s often use Cellibrite systems for cell phone data recovery fitted with a BitDefender module for malware. Is this the best approach? Is there a better way?

Here are cell phone symptoms, sure looks like cell phone spyware to me:
http://www.reportingwrongdoing.com/2015/07/cellphone-malware-hacking.html

What's the best way to confirm and identify the presence of spyware on a mobile device?

August 28, 2015 6:54 PM

Naysayer on Defending All the Targets Is Impossible:

Bruce,
I'd argue against you here. Trains have some unique risks that other crowded spaces do not. Once the train starts moving, the people inside are stuck, An active shooter or team thereof can just move through the cars, with their targets like fish in a barrel. An additional risk is train takeover. I'm not well versed on train security measures, but even if there was a security door protecting the conductor, if you can get AKs into france, getting some detcord or other breaching explosive is not too far behind. After that all it takes is a high speed derailment to boost the casualty figures on an operation. I'd assess that baggage checking may be a very good idea.

Of course, you are correct in that it only shifts the targets for attacks, but if you force a shift to less vulnerable spaces, I'd consider that an improvement.

August 28, 2015 6:29 PM

Kevin Bone on Choosing Secure Passwords:

Despite all the great tools and gadgets that are out there, the weakest link in security is still us. As long as humans manage passwords they will be broken.

Here's an example:

Daughter: Dad, I need to transfer money into your Chase account.
Me: That's great.
Daughter: I need your Chase login. I forgot mine and I'm locked out now for a while until everything resets.
Me: You can use mine. Just log into my LastPass (LastPass is the password utility I use) account and get it. Remember, I put my LastPass info in a locked document on your Google drive.
Daughter: I don't have any of that available, just send me your Chase log in.
Me: No. Find the LastPass stuff.

...this goes on for a while and eventually she wears me down. I know it's stupid to give her my Chase login in the clear, but I'm human, she's my little girl, and so on.

What usually happens at this point is I send her several text messages, one for each of the characters in my password (have you ever tried to change your user code? almost impossible). This will include a couple of messages with fake information (I will call her on the phone to tell her which ones to ignore), probably a picture (if I send her a picture of the dog she knows the next letter is "n", the last letter in his name), etc. I absolutely know that anyone out there can siphon this information off. This process ends with me reminding her to tell me when she's done which she might or might not do. After a few minutes I'm going to call her and ask her if she's done. If she doesn't answer the phone call, I know she's done because she would answer if she still needed access to the account. She prefers to TEXT me which effectively limits the length and complexity of the conversation. TEXTing is almost the only way any of my children talk to me any more.

Finally, I hop back on whatever device is handy (usually my phone) and create a new password to my checking account. LastPass lets me choose how long it will be, whether it can have special characters and spaces, how many digits I want to include. I like 12 characters with a bit of everything. Note that LastPass also has an option to make your password pronounceable which is a way of saying, "Easier to hack.", but for most people using a password utility is a giant step from using the same password for most of their sites.

The point is that humans are and will always be the weakest part of security. When I was consulting I would frequently see passwords on sticky notes on the monitor. Personal passwords were bad enough, but they also had neatly typed out the pass phrases to use procedures which required higher security levels. The sneaky ones stuck it to the bottom of the keyboard. At one site the step by step instructions for printing a special check including the combo to the vault where the check forms were kept and instructions where to find them in the vault, instructions on how to use the signer including where to find it (Larry's desk) and where to get the key to Larry's desk (under Dan's keyboard) and notes on items the security system audited and checked. These instructions were so good that a custodian was able to produce a check that was absolutely perfect.

For anyone who disagrees with me, please read Kevin Mitnick's book "The Art of Deception". If you don't find yourself in those pages somewhere, you are truly unique...and anti-social.

August 28, 2015 5:48 PM

Anura on Mickens on Security:

@Karl Lembke

"Uranium's heavy."

Not necessarily; it depends on the mass.

August 28, 2015 5:27 PM

Karl Lembke on Mickens on Security:

Uranium's heavy. Unless it's hollowed out quite a bit, I'd notice the difference.

August 28, 2015 4:34 PM

Frank Wilhoit on Mickens on Security:

The First Axiom of the Great Forgetting is that the most important things are forgotten first. At any given moment, we can reassure ourselves by taking inventory of the things we still remember; but they are not only growing fewer, they are each becoming less important. All the good stuff is already gone.

Mickens columns are among the higher-value things that we still have.

The crown jewel was the whole hinterland of the understanding that surveillance is ethically invalid.

We a'n't getting that back and everything we may yet do in our time on Earth is counting sawdust. Fortunately, the sawdust, too, diminishes.

August 28, 2015 4:22 PM

Sancho_P on Defending All the Targets Is Impossible:

Back to the topic “Defending All the Targets Is Impossible”
and TSA - like checks at train stations, which is the main part of Bruce’ linked article:

As briefly mentioned in that business sponsored pamphlet to promote security equipment and personnel:
What if the poor idiot would not enter the bus / train / aircraft but hide in a bush along the track / landing zone?
A short salvo and … hopefully everyone on board had a gun, well trained to defend himself, enclosed in a metal container at 50 - 200 mph.

Good that most insane people are not anything brighter than our powers + media, because that would seriously disrupt the “security” business.

August 28, 2015 4:20 PM

Spaceman Spiff on The Benefits of Endpoint Encryption:

@Who? My grandson can defeat all of these in about 15 minutes. FWIW, he has his own wave solder system so he can remove and replace any SMT chips he needs.

August 28, 2015 4:18 PM

Sancho_P on Defending All the Targets Is Impossible:

@Skeptical:
”At what point would such surveillance cease to be justified?”

—> From the beginning.
The reason is otherwise we are cowards and liars, acting behind a veil.

First, today we avoid to name the cause of the issue: Our aggression / colonialism / imperialism, instead we name it “mission(ary)” because we need it to feed our economy.
We have to change.

Second, for the “individuals associated with …”
[ - a proposal - ]:

A) We (society) clearly and publicly have to say what we want (openness, liberty?) and don’t want (facade, radicalism?),
and we have to entitle our justice system and LE to act accordingly.
Here we fail miserably, hiding behind a wall of laws interpreting the basics of justice (e.g. The Constitution) to our advantage (business).

B) When someone gets into the focus there must be publicly known due process to proceed with that “suspect”, e.g.:
Put them on a list “suspected”.
Collect “evidence” (even secret personal surveillance is accepted here).
But: After max 4 weeks it is mandatory to involve a judge.
Failing to do so will lead to disciplinary consequences, not of the agent but the agent’s supervisor.
The judge may, only in a very special case of national security, agree to another 4 weeks of secret surveillance, escalating the case to federal justice.
But then, at least after 8 weeks of surveillance, that suspect is to call in to an informal hearing with LE and a judge, explaining suspicion and surveillance.
The judge now and immediately may dismiss the case (all personal surveillance has to stop, the list is updated but not automatically cleared) or inform the suspect about ongoing personal surveillance, restrict some “freedoms” (e.g. ban the use of automated encryption, restrict the use of comm devices, …). Also they will immediately inform all known contacts of the suspect about the suspicion and surveillance. The list entry is updated and now accessible to all LEs and same organisations (if indicated by the judge).
Now it must be clear to suspects (and their family and friends) that their behavior very likely is not accepted in our society.
After that first hearing the suspect may consult a lawyer and appeal against the listing (and treatment).

C) In case of more evidence of unaccepted behavior there will be another hearing and finally a trial where the suspect could be stripped of nationality and expelled from the country.

However: Whatever we do must be visible, in the open, face to face.
As always, to lead by example is the way to go.

August 28, 2015 4:16 PM

Anura on Mickens on Security:

I'll read the whole paper tonight, but I don't see the purpose of using HTTPS or end-to-end email/messenger encryption as being to fight against targeted attacks by these intelligence agencies, but about fighting their mass surveillance operations. It's about raising the cost until targeted surveillance is all they *can* do. Targeting specific organizations that are actually a threat are why the agencies exist in the first place (but is not an excuse for deliberately weakening the security of our systems or infrastructure).

August 28, 2015 4:08 PM

Who? on The Benefits of Endpoint Encryption:

@Anura, parabararian

Removing the laptop/CMOS batteries does not help on well designed laptops (e.g. ThinkPads). Usually replacing a surface mount chip on the motherboard is required. Reflashing firmware using an external SPI programmer does not help either. CMOS settings and BIOS passwords are stored on different chips.

@Dr. I. Needtob Athe

FDE should be resistant against most attackers, but there are weaknesses that can be exploited. My computers usually have FDE drives (OpenBSD's softraid, AES-256 in XTS mode), but the encryption key is protected by just a passphrase. If I were an attacker I would try to recover the certificate that protects the drive by brute forcing the passphrase itself.

August 28, 2015 4:02 PM

Sancho_P on Defending All the Targets Is Impossible:

@rgaff (re: Happy shooting - Didn’t we Americans already try this?)

Yep, the red color was intended as a reminder of the “Good Old Times”. However, the game of “white man shoots, red man is dead” is still alive, only the color of the victims doesn’t matter nowadays.

But there is another remarkable difference:
During the GOT everybody, good or evil, bore their weapon in the open.
It was the time of brave men (and women), being bold and honest in their intentions (to kill - not that I want to glorify it / them, + guns are the opposite of any solution, we have way too many “heroes” behind a weapon out there).

So the difference is: Nowadays we are a society of cowards.

Bearing concealed weapons.
Killing by remotely operated drones.
Concealed (mass) surveillance.
Eavesdropping on allies.
Clandestine “enhanced interrogation technics” in secret prisons.
Secret “No Fly List”.
Top secret “Terror Watch List”.
Redacted documents.
“Officials” speaking out in “anonymity”.
Classified laws.
Secret courts.
Even classified TTIP (“a “free trade agreement”, what an irony).

A world of candy-asses.

There is no crime, no ruse, no trick, no fraud, no vice which does not live by secrecy. Bring this secrets to light, unveil and ridicule them to everybody. Sooner or later the public opinion will sweep them out.
Publication may not be enough - but it is the only means without all other attempts will fail.


(Joseph Pulitzer 1847-1911)

[Apologize my attempt to translate, didn’t find that in English]

August 28, 2015 3:36 PM

parabararian on The Benefits of Endpoint Encryption:

Removing the CMOS battery for five minutes almost always clears the custom settings but some tweaker stealing my laptop is unlikely to know that.

August 28, 2015 3:33 PM

Dr. I. Needtob Athe on The Benefits of Endpoint Encryption:

"I backup regularly and always enable disk encryption which is an important step to protect the information stored on the hard-disk from unwanted access by criminals, employers, or other actors (with the exception of very sophisticated adversaries)."

Is he correct to presume that "very sophisticated adversaries" can overcome hard disk encryption?

August 28, 2015 3:32 PM

Gerard van Vooren on Defending All the Targets Is Impossible:

@ rgaff,

> Pepper spray is a good alternative, in the sense that accidents and mistakes aren't generally lethal.

I settle for that!

> But it's NOT a panacea.

Come on here. You are splitting hairs but you defend carrying guns?

August 28, 2015 3:18 PM

tyr on Defending All the Targets Is Impossible:


Now let me see if I have this correct.

Advocacy for prohibition of X because.

We can start with the Volstead Act ban on alcohol that
increased the number of alcohol users by 40% and made
the current organized big business model of crime.
How about the mad scheme to end drug use by wasting
enormous amounts of tax money. The recreation of the
slavery model with privatized prisons a nice side
effect.

Gun control achieved its first victory in Chicago with
a waiting period for handgun purchases. Dealers then
sold Thompson submachine guns to criminals because of
the lack of a waiting period. Notice that that Tommy
gun is an assault rifle (area denial weapon). They have
been banned in USA since the passage of the Sullivan
Act.

Schools began to teach that guns are only used to kill
people, a mantra which is false but sounds good.

I predict that a gun ban has the usual effect, people
who have absolutely no clue about them will get one.
The criminals will begin to import and sell machine
weapons, might as well have an AK 74 if you're going to
be a criminal anyway.

Gun fighting is a martial art and nobody learns one very
easily.

When I went to school they taught us that if you shoot someone
we will hang you. Everybody there had ready access to them
but nobody ever shot up a school, something to do with the
idea of being hung for it.

New York City has had a gun ban for decades, but a recent
incident had a NYPD officer shoot an unarmed man for the
flash of a metallic candy wrapper. So is that the model
of the future we all agree on.

One thing never mentioned is the link between those who are
impaired by drugs or alcohol and shootings. It turns out
that sober people rarely shoot anyone. I have found most
armed people polite and circumspect about giving offense.

I do think dis-armament is a good idea to ensure peace.
Start with the governments armed forces, then the police,
and finally the citizen with a sigh of relief will melt
his down into a plowshare.

The magic of TV is the worst way to get educated about guns.

Lets see the Nukes banned first. Now there's an existential
threat that is real.


August 28, 2015 2:57 PM

Anura on The Benefits of Endpoint Encryption:

Maybe I'm out of the loop, but I always remember being able to defeat BIOS passwords by clearing the CMOS. That said, HDD encryption combined with a strong password is invaluable.

August 28, 2015 2:52 PM

rgaff on Defending All the Targets Is Impossible:

@Gerard van Vooren

First of all, not everyone is going to have a handgun. If you meet me there, I won't. And I probably never will, given the constraints I've already described (I don't need to kill people, so I'm not getting myself trained to either). I'm sure I'm not the only person in the whole wide world like this.

Pepper spray is a good alternative, in the sense that accidents and mistakes aren't generally lethal. But it's NOT a panacea. For one, release during a close quarters fight means you're likely to get as much of it as he does. Even well-aimed, releasing it in a closed space like a train means likely lots of people (including YOU) get a significant dose too, even if not as much as he does. And tolerances can be built up to it, which can be an increasing effectiveness issue the more common it becomes (though this does give you an avenue to help with the first 2 issues, assuming you get yourself some tolerance and "bad guys" don't).... This is in addition to other issues that are common to all weapons in combat (like the other guy wrestling it away from you and using it on you instead).

August 28, 2015 2:45 PM

Gerard van Vooren on Defending All the Targets Is Impossible:

@ ianf

You can still buy pepper spray legally in Germany. That said, I don't think the police is gonna make a major fuss when you carry pepper spray. As an offensive weapon it is rather ineffective, compared with guns. I remember that Ayaan Hirshi Ali carried pepper spray in her hand bag.

August 28, 2015 2:37 PM

Raym on JackPair Encrypted Phone Add-On:

I think that the Jackpair product does not exist in reality. It must be a software prototype on a computer but not a hardware prototype. The creator constantly change the date of the delivery due to problems.
But no details about the open source software in jackpair and no schema was never released.
The delivery date is now postponed to late October and of course late October it will be pushed back still further.

The main problem of Jackpair is not to create an encryption algorithm or digitalize the voice, the main problem is the SYNCHRONIZATION on the GSM VOICE CHANNEL. The GSM codec compresses the voice and Jackpair uses the voice channel. Jackpair digitalize the voice, encrypts it and creates sound bursts to transmit the digitalized voice like FSK sounds (Frequency Shift Keying). These FSK sounds are sent on the voice channel of the GSM.

Allow efficient synchronization on the voice channel of the mobile phone without having access to the hardware of the mobile phone seems impossible.
All sellers of encryption voice hardware use the data channel of GSM and not the voice channel.

A digital voice encryption system is possible if there is no compression on the voice channel. For example systems like ham radio on HF, VHF, UHF in AM/FM/SSB mode but not on the GSM voice channel.

August 28, 2015 2:31 PM

Alien Jerky on German BfV - NSA Cooperation:

On a semi-related note

http://www.cbsnews.com/news/appeals-court-reverses-ruling-that-found-nsa-program-illegal/

A federal appeals court on Friday ruled in favor of the Obama administration in a dispute over the National Security Agency's bulk collection of telephone data on hundreds of millions of Americans.

The U.S. Court of Appeals for the District of Columbia Circuit reversed a lower court ruling that said the program likely violates the Constitution's ban on unreasonable searches.


August 28, 2015 2:18 PM

ianf on Defending All the Targets Is Impossible:

… pepper spray is IMO the best self defence weapon next to running hard.

You assume that pepper spray is free to purchase & use everywhere, rather than of restricted distribution to license holders, just as are are non-lethal but weapon-classed retractable (folding) police batons, and all sorts of non-hunting knives. Not so, at least in the continental countries I visit (exception: saw pepper spray on sale at a market in 1998? Berlin, but it may have been illegal).

August 28, 2015 2:06 PM

Grauhut on German BfV - NSA Cooperation:

The autor is a real killer!

After reading his "Zeit" article about xkeyscore i had to clean my display, keyboard, workspace and change shirt. Sprayed some coffee... :)


"What exactly is XKeyscore?

Xkeyscore is a database system. It contains a collection of functions to sort and analyze data. It is based on the operating system Red Hat Enterprise Linux 5.7. This is totally out of date, current version is 7.1, but it is considered a mature, stable operating system. The NSA has removed all functions that normally serve to talk with other systems and programs. As if you were welding a cars doors in order to lock it and remove the windows and seats because you presume anyway only the engine is used and nobody drives with you therein. The database used for the analysis uses the common MySQL format.

All this is run by the Verfassungsschutz in Berlin on a computer that is not connected to the Internet or to another networks. Only the computer analysts are connected to it. The analysts access data via their Firefox browser connecting to the database.

NSA and BND use xkeyscore in order to search the Internet for clues and suspects. For them it is a kind of super-Google, they use it to find, for example, vulnerabilities in third-party servers. The Verfassungsschutz is not allowed to do so by the law. Xkeyscore as run by them, therefore, works as a completely closed system. ...

Xkeyscore recognizes and understands even the most exotic and app information contained in (internet data). All data is shown byte by byte in hexadecimal and analyzed on this lowest level of the data processing in a so-called hex editor.

The Verfassungsschutz therefore referres to xkeyscore as a "sorting tool". This analysis is very fast and large amounts of data, gigabytes are available, are no problem for the software."

http://www.zeit.de/digital/datenschutz/2015-08/bfv-verfassungsschutz-was-kann-xkeyscore

August 28, 2015 2:01 PM

Gerard van Vooren on Defending All the Targets Is Impossible:

@ rgaff,

The chance of meeting a terrorist in a train who wants to commit his plot are slim to zero. However if everyone has a handgun the chance of meeting guys in a train with handguns is 100%. People are people.

Serious, with pepper spray you are gonna live another day and without regret in case of an accident or a small riot. I know, it sounds female like but pepper spray is IMO the best self defence weapon next to running hard.

August 28, 2015 1:58 PM

Anura on Iranian Phishing:

@Mike Amling

When it comes to things like software and standards or prescription drugs, that line of reasoning is completely irrelevant as nothing is really secret. 20 year patents are a very modern idea anyway.

August 28, 2015 1:34 PM

Mike Amling on Iranian Phishing:

@Clive Robinson
"Patents and IP in general very very rarely do what they are supposed to do which is reward the innovator. Worse they are frequently used for anticompetitive and antimarket control,"

Let's not forget why Thomas Jefferson (I think it was; I could be worng.) supported patents: The alternative is trade secrets. The patent office trades a 20-year monopoly for a public description of the invention. A trade secret, in contrast, could last indefinitely or be lost forever.

While I would agree that this line of reasoning is not particularly helpful in forming policy toward patent trolls, it does establish that allowing patents on software is unnecessary, because it's so hard to keep software a trade secret.

August 28, 2015 1:27 PM

Anura on Defending All the Targets Is Impossible:

@Clive Robinson

What I expect to happen is that who uses the guns will change. If you can't steal a gun or get one from a straw purchase, you are left with organized crime, and it will be a lot more difficult to find a gun dealer if you don't know the right people (if it's easy for anyone to get a gun, it's easy for police to find gun dealers, and if you have 3-5 year sentences for selling a handgun it becomes too risky to sell to just anyone).

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of Resilient Systems, Inc.