Crypto-Gram

March 15, 2006

by Bruce Schneier
Founder and CTO
Counterpane Internet Security, Inc.
schneier@schneier.com
<http://www.schneier.com>
<http://www.counterpane.com>

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <http://www.schneier.com/crypto-gram-0603.html>. These same essays appear in the “Schneier on Security” blog: <http://www.schneier.com/>. An RSS feed is available.

In this issue:

The Future of Privacy

Over the past 20 years, there’s been a sea change in the battle for personal privacy.

The pervasiveness of computers has resulted in the almost constant surveillance of everyone, with profound implications for our society and our freedoms. Corporations and the police are both using this new trove of surveillance data. We as a society need to understand the technological trends and discuss their implications. If we ignore the problem and leave it to the “market,” we’ll all find that we have almost no privacy left.

Most people think of surveillance in terms of police procedure: Follow that car, watch that person, listen in on his phone conversations. This kind of surveillance still occurs. But today’s surveillance is more like the NSA’s model, recently turned against Americans: Eavesdrop on every phone call, listening for certain keywords. It’s still surveillance, but it’s wholesale surveillance.

Wholesale surveillance is a whole new world. It’s not “follow that car,” it’s “follow every car.” The National Security Agency can eavesdrop on every phone call, looking for patterns of communication or keywords that might indicate a conversation between terrorists. Many airports collect the license plates of every car in their parking lots, and can use that database to locate suspicious or abandoned cars. Several cities have stationary or car-mounted license-plate scanners that keep records of every car that passes, and save that data for later analysis.

More and more, we leave a trail of electronic footprints as we go through our daily lives. We used to walk into a bookstore, browse, and buy a book with cash. Now we visit Amazon, and all of our browsing and purchases are recorded. We used to throw a quarter in a toll booth; now EZ Pass records the date and time our car passed through the booth. Data about us are collected when we make a phone call, send an e-mail message, make a purchase with our credit card, or visit a website.

Much has been written about RFID chips and how they can be used to track people. People can also be tracked by their cell phones, their Bluetooth devices, and their WiFi-enabled computers. In some cities, video cameras capture our image hundreds of times a day.

The common thread here is computers. Computers are involved more and more in our transactions, and data are byproducts of these transactions. As computer memory becomes cheaper, more and more of these electronic footprints are being saved. And as processing becomes cheaper, more and more of it is being cross-indexed and correlated, and then used for secondary purposes.

Information about us has value. It has value to the police, but it also has value to corporations. The Justice Department wants details of Google searches, so they can look for patterns that might help find child pornographers. Google uses that same data so it can deliver context-sensitive advertising messages. The city of Baltimore uses aerial photography to surveil every house, looking for building permit violations. A national lawn-care company uses the same data to better market its services. The phone company keeps detailed call records for billing purposes; the police use them to catch bad guys.

In the dot-com bust, the customer database was often the only salable asset a company had. Companies like Experian and Acxiom are in the business of buying and reselling this sort of data, and their customers are both corporate and government.

Computers are getting smaller and cheaper every year, and these trends will continue. Here’s just one example of the digital footprints we leave:

It would take about 100 megabytes of storage to record everything the fastest typist input to his computer in a year. That’s a single flash memory chip today, and one could imagine computer manufacturers offering this as a reliability feature. Recording everything the average user does on the Internet requires more memory: 4 to 8 gigabytes a year. That’s a lot, but “record everything” is GMail’s model, and it’s probably only a few years before ISPs offer this service.

The typical person uses 500 cell phone minutes a month; that translates to 5 gigabytes a year to save it all. My iPod can store 12 times that data. A “life recorder” you can wear on your lapel that constantly records is still a few generations off: 200 gigabytes/year for audio and 700 gigabytes/year for video. It’ll be sold as a security device, so that no one can attack you without being recorded. When that happens, will not wearing a life recorder be used as evidence that someone is up to no good, just as prosecutors today use the fact that someone left his cell phone at home as evidence that he didn’t want to be tracked?

In a sense, we’re living in a unique time in history. Identification checks are common, but they still require us to whip out our ID. Soon it’ll happen automatically, either through an RFID chip in our wallet or face-recognition from cameras. And those cameras, now visible, will shrink to the point where we won’t even see them.

We’re never going to stop the march of technology, but we can enact legislation to protect our privacy: comprehensive laws regulating what can be done with personal information about us, and more privacy protection from the police. Today, personal information about you is not yours; it’s owned by the collector. There are laws protecting specific pieces of personal data—videotape rental records, health care information—but nothing like the broad privacy protection laws you find in European countries. That’s really the only solution; leaving the market to sort this out will result in even more invasive wholesale surveillance.

Most of us are happy to give out personal information in exchange for specific services. What we object to is the surreptitious collection of personal information, and the secondary use of information once it’s collected: the buying and selling of our information behind our back.

In some ways, this tidal wave of data is the pollution problem of the information age. All information processes produce it. If we ignore the problem, it will stay around forever. And the only way to successfully deal with it is to pass laws regulating its generation, use and eventual disposal.

This essay was originally published in the Minneapolis Star-Tribune.
<http://www.startribune.com/562/story/284023.html>

Face Recognition Comes to Bars

BioBouncer is a face recognition system intended for bars:

“Its camera snaps customers entering clubs and bars, and facial recognition software compares them with stored images of previously identified troublemakers. The technology alerts club security to image matches, while innocent images are automatically flushed at the end of each night, Dussich said. Various clubs can share databases through a virtual private network, so belligerent drunks might find themselves unwelcome in all their neighborhood bars.”

Anyone want to guess how long that “automatically flushed at the end of each night” will last? This data has enormous value. Insurance companies will want to know if someone was in a bar before a car accident. Employers will want to know if their employees were drinking before work—think airplane pilots. Private investigators will want to know who walked into a bar with whom. The police will want to know all sorts of things. Lots of people will want this data—and they’ll all be willing to pay for it.

And the data will be owned by the bars that collect it. They can choose to erase it, or they can choose to sell it to data aggregators like Acxiom.

It’s rarely the initial application that’s the problem. It’s the follow-on applications. It’s the function creep. Before you know it, everyone will know that they are identified the moment they walk into a commercial building. We will all lose privacy, and liberty, and freedom as a result.

<http://www.wired.com/news/technology/1,70265-0.html>

Security, Economics, and Lost Conference Badges

Conference badges are an interesting security token. They can be very valuable—a full conference registration at the RSA Conference last month in San Jose, for example, cost $1,985—but their value decays rapidly with time. By the end of the conference, they were worthless.

Counterfeiting badges is one security concern, but an even bigger concern is people losing their badge or having their badge stolen. It’s way cheaper to find or steal someone else’s badge than it is to buy your own. People could do this sort of thing on purpose, pretending to lose their badge and giving it to someone else.

A few years ago, the RSA Conference charged people $100 for a replacement badge, which is far cheaper than a second membership. So the fraud remained. (At least, I assume it did. I don’t know anything about how prevalent this kind of fraud was at RSA.)

Last year, the RSA Conference tried to further limit these types of fraud by putting people’s photographs on their badges. Clever idea, but difficult to implement.

For this to work, though, guards need to match photographs with faces. This means that either 1) you need a lot more guards at entrance points, or 2) the lines will move a lot slower. Actually, far more likely is 3) no one will check the photographs.

And it was an expensive solution for the RSA Conference. They needed the equipment to put the photos on the badges. Registration was much slower. And pro-privacy people objected to the conference keeping their photographs on file.

This year, the RSA Conference solved the problem through economics: “If you lose your badge and/or badge holder, you will be required to purchase a new one for a fee of $1,895.00.”

Look how clever this is. Instead of trying to solve this particular badge fraud problem through security, they simply moved the problem from the conference to the attendee. The badges still have that $1,895 value, but now if it’s stolen and used by someone else, it’s the attendee who’s out the money. As far as the RSA Conference is concerned, the security risk is an externality.

Note that from an outside perspective, this isn’t the most efficient way to deal with the security problem. It’s likely that the cost to the RSA Conference for centralized security is less than the aggregate cost of all the individual security measures. But the RSA Conference gets to make the trade-off, so they chose a solution that was cheaper for them.

Of course, it would have been nice if the conference provided a slightly more secure attachment point for the badge holder than a thin strip of plastic. But why should they? It’s not their problem anymore.

Crypto-Gram Reprints

Crypto-Gram is currently in its ninth year of publication. Back issues cover a variety of security-related topics, and can all be found on <http://www.schneier.com/crypto-gram-back.html>. These are a selection of articles that appeared in this calendar month in other years.

SHA-1 Broken:
<http://www.schneier.com/crypto-gram-0503.html#1>

The Failure of Two-Factor Authentication:
<http://www.schneier.com/crypto-gram-0503.html#2>

Sensitive Security Information (SSI):
<http://www.schneier.com/crypto-gram-0503.html#11>

“I am not a Terrorist” Cards:
<http://www.schneier.com/crypto-gram-0403.html#10>

The Security Risks of Centralization:
<http://www.schneier.com/crypto-gram-0403.html#11>

Practical Cryptography:
<http://www.schneier.com/crypto-gram-0303.html#1>

SSL flaw:
<http://www.schneier.com/crypto-gram-0303.html#3>

SSL patent infringement:
<http://www.schneier.com/crypto-gram-0303.html#8>

SNMP vulnerabilities:
<http://www.schneier.com/crypto-gram-0203.html#1>

Bernstein’s factoring breakthrough?
<http://www.schneier.com/crypto-gram-0203.html#6>

Richard Clarke on 9/11’s Lessons
<http://www.schneier.com/crypto-gram-0203.html#7>

Security patch treadmill:
<http://www.schneier.com/crypto-gram-0103.html#1>

Insurance and the future of network security:
<http://www.schneier.com/crypto-gram-0103.html#3>

The “death” of IDSs:
<http://www.schneier.com/crypto-gram-0103.html#9>

802.11 security:
<http://www.schneier.com/crypto-gram-0103.html#10>

Software complexity and security:
<http://www.schneier.com/…>

Why the worst cryptography is in systems that pass initial cryptanalysis:
<http://www.schneier.com/crypto-gram-9903.html#initial>

Data Mining for Terrorists

In the post 9/11 world, there’s much focus on connecting the dots. Many believe that data mining is the crystal ball that will enable us to uncover future terrorist plots. But even in the most wildly optimistic projections, data mining isn’t tenable for that purpose. We’re not trading privacy for security; we’re giving up privacy and getting no security in return.

Most people first learned about data mining in November 2002, when news broke about a massive government data mining program called Total Information Awareness. The basic idea was as audacious as it was repellent: suck up as much data as possible about everyone, sift through it with massive computers, and investigate patterns that might indicate terrorist plots. Americans across the political spectrum denounced the program, and in September 2003, Congress eliminated its funding and closed its offices.

But TIA didn’t die. According to “The National Journal,” it just changed its name and moved inside the Defense Department.

This shouldn’t be a surprise. In May 2004, the General Accounting Office published a report that listed 122 different federal government data mining programs that used people’s personal information. This list didn’t include classified programs, like the NSA’s eavesdropping effort, or state-run programs like MATRIX.

The promise of data mining is compelling, and convinces many. But it’s wrong. We’re not going to find terrorist plots through systems like this, and we’re going to waste valuable resources chasing down false alarms. To understand why, we have to look at the economics of the system.

Security is always a trade-off, and for a system to be worthwhile, the advantages have to be greater than the disadvantages. A national security data mining program is going to find some percentage of real attacks, and some percentage of false alarms. If the benefits of finding and stopping those attacks outweigh the cost—in money, liberties, etc.—then the system is a good one. If not, then you’d be better off spending that cost elsewhere.

Data mining works best when there’s a well-defined profile you’re searching for, a reasonable number of attacks per year, and a low cost of false alarms. Credit card fraud is one of data mining’s success stories: all credit card companies data mine their transaction databases, looking for spending patterns that indicate a stolen card. Many credit card thieves share a pattern—purchase expensive luxury goods, purchase things that can be easily fenced, etc.—and data mining systems can minimize the losses in many cases by shutting down the card. In addition, the cost of false alarms is only a phone call to the cardholder asking him to verify a couple of purchases. The cardholders don’t even resent these phone calls—as long as they’re infrequent—so the cost is just a few minutes of operator time.

Terrorist plots are different. There is no well-defined profile, and attacks are very rare. Taken together, these facts mean that data mining systems won’t uncover any terrorist plots until they are very accurate, and that even very accurate systems will be so flooded with false alarms that they will be useless.

All data mining systems fail in two different ways: false positives and false negatives. A false positive is when the system identifies a terrorist plot that really isn’t one. A false negative is when the system misses an actual terrorist plot. Depending on how you “tune” your detection algorithms, you can err on one side or the other: you can increase the number of false positives to ensure that you are less likely to miss an actual terrorist plot, or you can reduce the number of false positives at the expense of missing terrorist plots.

To reduce both those numbers, you need a well-defined profile. And that’s a problem when it comes to terrorism. In hindsight, it was really easy to connect the 9/11 dots and point to the warning signs, but it’s much harder before the fact. Certainly, there are common warning signs that many terrorist plots share, but each is unique, as well. The better you can define what you’re looking for, the better your results will be. Data mining for terrorist plots is going to be sloppy, and it’s going to be hard to find anything useful.

Data mining is like searching for a needle in a haystack. There are 900 million credit cards in circulation in the United States. According to the FTC September 2003 Identity Theft Survey Report, about 1% (10 million) cards are stolen and fraudulently used each year. Terrorism is different. There are trillions of connections between people and events—things that the data mining system will have to “look at”—and very few plots. This rarity makes even accurate identification systems useless.

Let’s look at some numbers. We’ll be optimistic. We’ll assume the system has a 1 in 100 false positive rate (99% accurate), and a 1 in 1,000 false negative rate (99.9% accurate).

Assume one trillion possible indicators to sift through: that’s about ten events—e-mails, phone calls, purchases, web surfings, whatever—per person in the U.S. per day. Also assume that 10 of them are actually terrorists plotting.

This unrealistically-accurate system will generate one billion false alarms for every real terrorist plot it uncovers. Every day of every year, the police will have to investigate 27 million potential plots in order to find the one real terrorist plot per month. Raise that false-positive accuracy to an absurd 99.9999% and you’re still chasing 2,750 false alarms per day—but that will inevitably raise your false negatives, and you’re going to miss some of those ten real plots.

This isn’t anything new. In statistics, it’s called the “base rate fallacy” and it applies in other domains as well. For example, even highly accurate medical tests are useless as diagnostic tools if the incidence of the disease is rare in the general population. Terrorist attacks are also rare, any “test” is going to result in an endless stream of false alarms.

This is exactly the sort of thing we saw with the NSA’s eavesdropping program: the “New York Times” reported that the computers spat out thousands of tips per month. Every one of them turned out to be a false alarm.

And the cost was enormous: not just the cost of the FBI agents running around chasing dead-end leads instead of doing things that might actually make us safer, but also the cost in civil liberties. The fundamental freedoms that make our country the envy of the world are valuable, and not something that we should throw away lightly.

Data mining can work. It helps Visa keep the costs of fraud down, just as it helps Amazon.com show me books that I might want to buy, and Google show me advertising I’m more likely to be interested in. But these are all instances where the cost of false positives is low—a phone call from a Visa operator, or an uninteresting ad—and in systems that have value even if there is a high number of false negatives.

Finding terrorism plots is not a problem that lends itself to data mining. It’s a needle-in-a-haystack problem, and throwing more hay on the pile doesn’t make that problem any easier. We’d be far better off putting people in charge of investigating potential plots and letting them direct the computers, instead of putting the computers in charge and letting them decide who should be investigated.

This essay originally appeared on Wired.com.
<http://www.wired.com/news/columns/0,70357-0.html>

TIA:
<http://www.epic.org/privacy/profiling/tia/>
<http://www.fas.org/sgp/congress/2003/tia.html>

Its return:
<http://nationaljournal.com/about/njweekly/stories/…>

GAO report:
<http://www.epic.org/privacy/profiling/gao_dm_rpt.pdf>

MATRIX:
<http://www.aclu.org/privacy/spying/…>

Base rate fallacy:
<http://www.cia.gov/csi/books/19104/art15.html#ft145>

New York Times on the NSA eavesdropping program:
<https://www.schneier.com/blog/archives/2006/01/…>

Airport Security Failure

At LaGuardia, a man successfully walked through the metal detector, but screeners wanted to check his shoes. (Some reports say his shoes set off an alarm.) But he didn’t wait, and disappeared into the crowd.

The entire Delta Airlines terminal had to be evacuated, and between 2,500 and 3,000 people had to be rescreened. I’m sure the resultant flight delays rippled through the entire system.

Security systems can fail in two ways. They can fail to defend against an attack. And they can fail when there is no attack to defend. The latter failure is often more important, because false alarms are more common than real attacks.

Aside from the obvious security failure—how did this person manage to disappear into the crowd, anyway—it’s painfully obvious that the overall security system did not fail well. Well-designed security systems fail gracefully, without affecting the entire airport terminal. That the only thing the TSA could do after the failure was evacuate the entire terminal and rescreen everyone is a testament to how badly designed the security system is.

<http://www.newsday.com/news/printedition/newyork/…>
<http://news.bbc.co.uk/2/hi/americas/4795534.stm>

News

“Lessons from the Sony CD DRM Episode” is an interesting paper by J. Alex Halderman and Edward W. Felten.
<http://itpolicy.princeton.edu/pub/sonydrm-ext.pdf>

This is a great example of a movie-plot threat: terrorists hijacking school buses and using them to blow up things.
<https://www.schneier.com/blog/archives/2006/02/…>

A court has ruled that companies do not have to encrypt data under Gramm-Leach Bliley. I know nothing of the legal merits of the case, nor do I have an opinion about whether Gramm-Leach-Bliley does or does not require financial companies to encrypt personal data in its purview. But I do know that we as a society need to force companies to encrypt personal data about us. Companies won’t do it on their own—the market just doesn’t encourage this behavior—so legislation or liability are the only available mechanisms. If this law doesn’t do it, we need another one.
<http://writ.news.findlaw.com/commentary/…>
<http://www.securityfocus.com/columnists/387>

I find this phishing attack impressive for several reasons. One, it’s a very sophisticated attack and demonstrates how clever identity thieves are becoming. Two, it narrowly targets a particular credit union, and sneakily uses the fact that credit cards issued by an institution share the same initial digits. Three, it exploits an authentication problem with SSL certificates. And four, it is yet another proof point that “user education” isn’t how we’re going to solve this kind of risk.
<http://.washingtonpost.com/securityfix/2006/02/…>
<http://isc.sans.org/diary.php?storyid=1118>

Patrick Smith, a former pilot, writes about his experiences—involving the police—taking pictures in airports.
<http://www.salon.com/tech/col/smith/2006/02/10/…>

More on port security (funny):
<http://www.defectiveyeti.com/archives/001599.html>

The Houston chief of police wants to put surveillance cameras in apartment complexes, downtown streets, shopping malls and even private homes to fight crime during a shortage of police officers. He said: “I know a lot of people are concerned about Big Brother, but my response to that is, if you are not doing anything wrong, why should you worry about it?” One of the problems we have in the privacy community is that we don’t have a crisp answer to that question. I asked for suggestions on my blog, and there were some really good responses.
<http://www.dallasnews.com/sharedcontent/APStories/…>
<https://www.schneier.com/blog/archives/2006/02/…>

Here’s how to make your own hardware key logger for PS/2 keyboards.
<http://www.makezine.com//archive/2006/02/…>
Here’s where to buy one:
<http://www.keykatcher.com/>
<http://www.lakeshoretechnology.com/KeyPhantom.asp>
<http://www.keyghost.com/kgpro.htm>
<http://www.keytrapper.com/>
<http://www.spectorsoft.com/>

The M4 project is trying to break three original Enigma messages left over from World War II.
<http://www.bytereef.org/m4_project.html>
<http://news.bbc.co.uk/2/hi/technology/4763854.stm>

Something like 50 million pounds was stolen from a banknote storage depot in the UK. The Times writes: “Large-scale cash robbery was once a technical challenge: drilling through walls, short-circuiting alarms, gagging guards and stationing the get-away car. Today, the weak points in the banks’ defences are not grilles and vaults, but human beings. Stealing money is now partly a matter of psychology. The success of the Tonbridge robbers depended on terrifying Mr Dixon into opening the doors. They had studied their victim. They knew the route he took home, and how he would respond when his wife and child were in mortal danger. It did not take gelignite to blow open the vaults; it took fear, in the hostage technique known as ‘tiger kidnapping,’ so called because of the predatory stalking that precedes it. Tiger kidnapping is the point where old-fashioned crime meets modern terrorism.”
<http://www.timesonline.co.uk/newspaper/…>
A good chronology of events:
<http://news.bbc.co.uk/1/hi/england/kent/4742972.stm>

DNA surveillance in the UK:
<https://www.schneier.com/blog/archives/2006/02/…>

Quantum computing just got more bizarre: you don’t even have to turn the computer on to get a result. So now, even turning the machine off won’t necessarily prevent hackers from stealing passwords.
<http://www.newscientist.com/channel/info-tech/…>
<http://cosmicvariance.com/2006/02/28/…>

Last month I wrote about a wiretapping scandal in Greece. More details are emerging. It turns out that the “malicious code” was actually code designed into the system. It’s eavesdropping code put into the system for the police. The attackers managed to bypass the authorization mechanisms of the eavesdropping system, and activate the “lawful interception” module in the mobile network. They then redirected about 100 numbers to 14 shadow numbers they controlled. There is an important security lesson here. I have long argued that when you build surveillance mechanisms into communication systems, you invite the bad guys to use those mechanisms for their own purposes. That’s exactly what happened here.
<https://www.schneier.com/blog/archives/2006/02/…>
<http://homes.esat.kuleuven.be/~gdanezis/intercept.html>
<http://www.quintessenz.org/cgi-bin/index?…>
<http://betabug.ch/s/ch-athens/312>

Jury duty identity-theft scam:
<http://www.snopes.com/crime/fraud/juryduty.asp>

The FedEx Kinko’s ExpressPay stored value card has been hacked. There’s nothing particularly amazing about the hack; the most remarkable thing is how badly the system was designed in the first place. The only security on the cards is a three-byte code that lets you read and write to the card. I’d be amazed if no one has hacked this before.
<http://www.mal-aware.org/2006/02/28/…>
<http://www.eweek.com/article2/0,1759,1932824,00.asp?…>

Nothing too surprising in this study of password generation practices:
<http://psychology.wichita.edu/surl/usabilitynews/81/…>

Caller ID spoofing: harmful pranks, invasions of privacy, and fraud.
<http://www.startribune.com/484/story/278518.html>
<http://www.wired.com/news/technology/0,70320-0.html>

AT&T’s 1.9-trillion-call database:
<https://www.schneier.com/blog/archives/2006/03/…>

This story shows how badly terrorist profiling can go wrong: a couple is investigated for paying down their credit card balance. The article goes on to blame something called the Bank Privacy Act, but that’s not correct. The culprit here is the amendments made to the Bank Secrecy Act by the USA Patriot Act, Sections 351 and 352. Remember, all the time spent chasing down silly false alarms is time wasted. Finding terrorist plots is a signal-to-noise problem, and stuff like this substantially decreases that ratio: it adds a lot of noise without adding enough signal. It makes us less safe, because it makes terrorist plots harder to find.
<http://www.shns.com/shns/g_index2.cfm?…>
The law:
<http://www.epic.org/privacy/terrorism/hr3162.html>
<http://www.cyberlaw.com/aml.html>
<http://www.fincen.gov/352ccards.pdf>

There seems to be some massive class break against Citibank ATM cards in Canada, the UK, and Russia. I haven’t waded through all the details, but here are a bunch of links:
<https://www.schneier.com/blog/archives/2006/03/…>
<http://ioerror.livejournal.com/301520.html>
<http://www.boingboing.net/2006/03/05/…>
<http://www.consumerist.com/consumer/citibank/…>
<http://www.liquidmatrix.org//2006/03/05/…>
<http://www.boingboing.net/2006/03/06/…>
<http://www.securityfocus.com/brief/157>
<http://www.msnbc.msn.com/id/11714119/>
<http://software.silicon.com/security/…>

Using social engineering to crash the Oscars:
<http://www.cnn.com/2006/SHOWBIZ/Movies/03/04/…>

Fighting misuse of the Patriot Act:
<http://www.suntimes.com/output/steyn/…>

Essay on the “analog hole,” the human dimension of the problem of securing information.
<http://www.infoworld.com/article/06/03/01/…>

Along the same lines, here’s a story about the security risks of talking loudly:
<http://networks.silicon.com/mobile/…>

Criminals are breaking into stores and pretending to ransack them, as a cover for installing ATM skimming hardware, complete with a transmitter. Note the last paragraph of the story—it’s in Danish, sorry—where the company admits that this is the fourth attempt they know of criminals installing reader equipment inside ATM terminals for the purpose of skimming numbers and PINs.
<http://www.dr.dk/Nyheder/Indland/kriminalitet/2006/…>

According to the TSA, in the 9th Circuit Case of John Gilmore, you are allowed to fly without showing ID—you’ll just have to submit yourself to secondary screening. The Identity Project wants you to try it out. If you have time, try to fly without showing ID. I know you can do this if you claim that you lost your ID, but I don’t know what the results would be if you simply refuse to show ID.
<http://www.papersplease.org/investigation.html>

In the Netherlands, criminals are stealing money from ATM machines by blowing them up. First, they drill a hole in an ATM and fill it with some sort of gas. Then, they ignite the gas—from a safe distance—and clean up the money that flies all over the place after the ATM explodes. Sounds crazy, but apparently there has been an increase in this type of attack recently. The banks’ countermeasure is to install air vents so that gas can’t build up inside the ATMs.
<http://www.nu.nl/news/683538/13/…>

GPG is an open-source version of the PGP e-mail encryption protocol. Recently, a very serious vulnerability was discovered in the software: given a signed e-mail message, you can modify the message—specifically, you an prepend or append arbitrary data—without disturbing the signature verification. (This bug is fixed in Version 1.4.2.2. Users should upgrade immediately.) It appears this bug has existed for years without anybody finding it. Moral: Open source does not necessarily mean “fewer bugs.” I wrote about this back in 1999.
<http://lists.gnupg.org/pipermail/gnupg-announce/…>
<http://www.schneier.com/…>

Finding covert CIA agents using the Internet:
<http://www.chicagotribune.com/news/nationworld/…>
<http://www.theregister.co.uk/2006/03/13/ispy/>
<http://www.telegraph.co.uk/news/main.jhtml?xml=/…>

An article explains how you can modify, and then print, your own boarding pass and get on an airplane even if you’re on the no-fly list. This isn’t news; I wrote about it in 2003.
<http://www.csoonline.com/read/020106/caveat021706.html>
<http://www.schneier.com/crypto-gram-0308.html#6>

Interesting, but long, article on bioterrorism:
<http://www.technologyreview.com/BioTech/…>

Clever college basketball prank relies on social engineering:
<https://www.schneier.com/blog/archives/2006/03/…>

Police Department Privilege Escalation

It’s easier than you think to create your own police department in the United States.

Yosef Maiwandi formed the San Gabriel Valley Transit Authority—a tiny, privately run nonprofit organization that provides bus rides to disabled people and senior citizens. It operates out of an auto repair shop. Then, because the law seems to allow transit companies to form their own police departments, he formed the San Gabriel Valley Transit Authority Police Department. As a thank you, he made Stefan Eriksson a deputy police commissioner of the San Gabriel Transit Authority Police’s anti-terrorism division, and gave him business cards.

Police departments like this don’t have much legal authority, they don’t really need to. My guess is that the name alone is impressive enough.

In the computer security world, privilege escalation means using some legitimately granted authority to secure extra authority that was not intended. This is a real-world counterpart. Even though transit police departments are meant to police their vehicles only, the title—and the ostensible authority that comes along with it—is useful elsewhere. Someone with criminal intent could easily use this authority to evade scrutiny or commit fraud.

“Deal said that his agency has discovered that several railroad agencies around California have created police departments—even though the companies have no rail lines in California to patrol. The police certification agency is seeking to decertify those agencies because it sees no reason for them to exist in California.

“The issue of private transit firms creating police agencies has in recent years been a concern in Illinois, where several individuals with criminal histories created railroads as a means of forming a police agency.”

The real problem is that we’re too deferential to police power. We don’t know the limits of police authority, whether it be an airport policeman or someone with a business card from the “San Gabriel Valley Transit Authority Police Department.”

<http://www.latimes.com/news/local/…>

Database Error Causes Unbalanced Budget

A house erroneously valued at $400 million caused budget shortfalls and possible layoffs in municipalities and school districts in northwest Indiana. Seems that some unauthorized user accidentally changed the value of some database entry.

Three things immediately spring to mind:

One, the system did not fail safely. This one error seems to have cascaded into multiple errors, as the new tax total immediately changed budgets of “18 government taxing units.”

Two, there were no sanity checks on the system. “The city of Valparaiso and the Valparaiso Community School Corp. were asked to return $2.7 million.” Didn’t the city wonder where all that extra money came from in the first place?

Three, the access-control mechanisms on the computer system were too broad. When a user is authenticated to use the “R-E-D” program, he shouldn’t automatically have permission to use the “R-E-R” program as well. Authentication isn’t all or nothing; it should be granular to the operation.

<http://cnews.canoe.ca/CNEWS/WeirdNews/2006/02/10/…>

Credit Card Companies and Agenda

A guy tears up a credit card application, tapes it back together, fills it out with someone else’s address and a different phone number, and send it in. He still gets a credit card.

Imagine that some fraudster is rummaging through your trash and finds a torn-up credit card application. That’s why this is bad.

To understand why it’s happening, you need to understand the trade-offs and the agenda. From the point of view of the credit card company, the benefits of giving someone a credit card is that he’ll use it and generate revenue. The risk is that it’s a fraudster who will cost the company revenue. The credit card industry has dealt with the risk in two ways: they’ve pushed a lot of the risk onto the merchants, and they’ve implemented fraud detection systems to limit the damage.

All other costs and problems of identity theft are borne by the consumer; they’re an externality to the credit card company. They don’t enter into the trade-off decision at all.

We can laugh at this kind of thing all day, but it’s actually in the best interests of the credit card industry to mail cards in response to torn-up and taped-together applications without doing much checking of the address or phone number. If we want that to change, we need to fix the externality.

<http://www.cockeyed.com/citizen/creditcard/…>

Counterpane News

Counterpane and MessageLabs has released a joint Attack Trends report:
<http://www.counterpane.com/pr-20060313.html>
Report here.
<http://www.counterpane.com/dl/…>

TippingPoint partners with Counterpane:
<http://www.crn.com/sections/security/security.jhtml?…>

Schneier is speaking at the Software Development Conference in Santa Clara on March 15:
<http://www.sdexpo.com/>

Schneier is speaking at the IDC IT Security Roadshow in Istanbul, Prague, and Warsaw, March 21st – 28th:
<http://www.idc-cema.com/?…>
<http://www.idc-cema.com/?…>
<http://www.idc-cema.com/?…>

Schneier is speaking at the Rochester Institute of Technology on April 7th:
<http://www.gccis.rit.edu/index.php3?dir=sidebar/…>

Counterpane is hiring. We have an urgent need for a Database and Systems Analyst and a Senior Java Software Engineer. There are other job openings, too.
<http://www.counterpane.com/jobs.html>

Schneier received the 2006 Dr. Dobb’s Journal Excellence in Programming Award:
<http://www.ddj.com/documents/s=10035/ddj0604a/…>

Password Safe 3.0 Beta is available for public testing:
<https://sourceforge.net/forum/forum.php?forum_id=549069>

CNN interviewed Schneier for a story about cell phone tracking. Video:
<http://dynamic.cnn.com/apps/tp/video/tech/2006/03/…>

Proof that Employees Don’t Care About Security

Does anyone think that this experiment would turn out any differently?

“An experiment carried out within London’s square mile has revealed that employees in some of the City’s best known financial services companies don’t care about basic security policy.

“CDs were handed out to commuters as they entered the City by employees of IT skills specialist The Training Camp and recipients were told the disks contained a special Valentine’s Day promotion.

“However, the CDs contained nothing more than code which informed The Training Camp how many of the recipients had tried to open the CD. Among those who were duped were employees of a major retail bank and two global insurers.

“The CD packaging even contained a clear warning about installing third-party software and acting in breach of company acceptable-use policies—but that didn’t deter many individuals who showed little regard for the security of their PC and their company.”

This was a benign stunt, but it could have been much more serious. A CD-ROM carried into the office and run on a computer bypasses the company’s network security systems. You could easily imagine a criminal ring using this technique to deliver a malicious program into a corporate network—and it would work.

But concluding that employees don’t care about security is a bit naive. Employees care about security; they just don’t understand it. Computer and network security is complicated and confusing, and unless you’re technologically inclined, you’re just not going to have an intuitive feel for what’s appropriate and what’s a security risk. Even worse, technology changes quickly, and any security intuition an employee has is likely to be out of date within a short time.

Education is one way to deal with this, but education has its limitations. I’m sure these banks had security awareness campaigns; they just didn’t stick. Punishment is another form of education, and my guess it would be more effective. If the banks fired everyone who fell for the CD-ROM-on-the-street trick, you can be sure that no one would ever do that again. (At least, until everyone forgot.) That won’t ever happen, though, because the morale effects would be huge.

Rather than blaming this kind of behavior on the users, we would be better served by focusing on the technology. Why does the average computer user at a bank need the ability to install software from a CD-ROM? Why doesn’t the computer block that action, or at least inform the IT department? Computers need to be secure regardless of who’s sitting in front of them, irrespective of what they do.

If I go downstairs and try to repair the heating system in my home, I’m likely to break all sorts of safety rules—and probably the system and myself in the process. I have no experience in that sort of thing, and honestly, there’s no point trying to educate me. But my home heating system works fine without my having to learn anything about it. I know how to set my thermostat, and to call a professional if something goes wrong.

Computers need to work more like that.

<http://software.silicon.com/security/…>

U.S. Port Security and Proxies

Does it make sense to surrender management, including security, of six U.S. ports to a Dubai-based company? This question has set off a heated debate between the administration and Congress, as members of both parties condemned the deal.

Most of the rhetoric is political posturing, but there’s an interesting security issue embedded in the controversy. It’s about proxies, trust, and transparency.

A proxy is a concept I discussed in my book “Beyond Fear.” It’s a person or organization that acts on your behalf in some way. It’s how complex societies work—it’s impossible for us all to do everything or make every decision, so we cede some authority to proxies.

Whether it’s the cook at the restaurant where you’re eating, the suppliers who make your business run or your government, proxies are everywhere. Doctors, stockbrokers, hotel chains and government regulators like the FDA and the FAA are all proxies.

Sometimes proxies act in our behalf simply because we can’t do everything. But more often we have these proxies because we don’t have the expertise to do the work ourselves.

Most security works through proxies. We just don’t have the expertise to make decisions about airline security, police coverage and military readiness, so we rely on others. We all hope our proxies make the same decisions we would have, but our only choice is to trust—to rely on, really—our proxies.

Here’s the paradox: Even though we are forced to rely on them, we may or may not trust them. When we trust our proxies, we come to that trust in a variety of ways—sometimes through experience, sometimes through recommendations from a source we trust. Sometimes it’s third-party audit, affiliations in professional societies or a gut feeling. But when it comes to government, trust is based on transparency. The more our government is based on secrecy, the more we are forced to “just trust” it and the less we actually trust it.

The security of U.S. ports involves a lot of proxies. We, the people, gave our proxy to our elected officials. They passed laws—the Maritime Transportation Security Act (a U.S. law) and the International Ship and Port Facility Security codes—regulating security at these ports, and tasked the Coast Guard, another proxy, to oversee that.

The same elected officials (or perhaps some different elected officials, through some other bureaucratic proxy entirely) have hired yet another proxy—a company based in the United Kingdom called Peninsular and Oriental Steam Navigation Company (P&O)—to manage the ports in New York, New Jersey, Philadelphia, Baltimore, Miami and New Orleans.

And now the officers of P&O, acting as proxies for the company’s shareholders, agreed to be absorbed by yet another proxy: Thunder FZE, itself a subsidiary of another company called Dubai Ports World, which is a corporation based in the United Arab Emirates.

Still another proxy, the Committee on Foreign Investment in the United States, part of the Treasury Department, approved the sale. And finally, both P&O and Thunder FZE hire thousands of proxies—employees, suppliers and partners—to carry out the actual jobs at the various ports they operate.

This is a complicated web of proxies, but it’s a complicated system. We have trouble trusting it, because so much is shrouded in secrecy. We don’t know what kind of security these ports have. We hear snippets like “only 5 percent of incoming cargo is inspected,” but we don’t know more than that. We read that security aspects of the P&O sale were “rigorously reviewed,” and that the review was “cursory.”

We don’t know what kind of security there is in the UAE, Dubai Ports World or the subsidiary that is actually doing the work. We have no choice but to rely on these proxies, yet we have no basis by which to trust them.

Pull aside the rhetoric, and this is everyone’s point. There are those who don’t trust the Bush administration and believe its motivations are political. There are those who don’t trust the UAE because of its terrorist ties—two of the 9/11 terrorists and some of the funding for the attack came out of that country—and those who don’t trust it because of racial prejudices. There are those who don’t trust security at our nation’s ports generally and see this as just another example of the problem.

The solution is openness. The Bush administration needs to better explain how port security works, and the decision process by which the sale of P&O was approved. If this deal doesn’t compromise security, voters—at least the particular lawmakers we trust—need to understand that.

Regardless of the outcome of the Dubai deal, we need more transparency in how our government approaches counter-terrorism in general. Secrecy simply isn’t serving our nation well in this case. It’s not making us safer, and it’s properly reducing faith in our government.

Proxies are a natural outgrowth of society, an inevitable byproduct of specialization. But our proxies are not us and they have different motivations—they simply won’t make the same security decisions as we would. Whether a king is hiring mercenaries, an organization is hiring a network security company or a person is asking some guy to watch his bags while he gets a drink of water, successful security proxies are based on trust. And when it comes to government, trust comes through transparency and openness.

Think of it as security from proxies.

This essay previously appeared in Wired:
<http://www.wired.com/news/columns/0,70258-0.html>

This is some good commentary on the Dubai port issue:
<http://politicalwire.com/archives/2006/03/01/…>

Comments from Readers

There are hundreds of comments—many of them interesting—on these topics on my blog. Search for the story you want to comment on, and join in.

<http://www.schneier.com/>

CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL.

Comments on CRYPTO-GRAM should be sent to schneier@schneier.com. Permission to print comments is assumed unless otherwise stated. Comments may be edited for length and clarity.

Please feel free to forward CRYPTO-GRAM to colleagues and friends who will find it valuable. Permission is granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers “Beyond Fear,” “Secrets and Lies,” and “Applied Cryptography,” and an inventor of the Blowfish and Twofish algorithms. He is founder and CTO of Counterpane Internet Security Inc., and is a member of the Advisory Board of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>.

Counterpane is the world’s leading protector of networked information – the inventor of outsourced security monitoring and the foremost authority on effective mitigation of emerging IT threats. Counterpane protects networks for Fortune 1000 companies and governments world-wide. See <http://www.counterpane.com>.

Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of Counterpane Internet Security, Inc.

Copyright (c) 2006 by Bruce Schneier.

Sidebar photo of Bruce Schneier by Joe MacInnis.