Crypto-Gram

October 15, 2011

by Bruce Schneier
Chief Security Technology Officer, BT
schneier@schneier.com
http://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <http://www.schneier.com/crypto-gram-1110.html>. These same essays and news items appear in the “Schneier on Security” blog at <http://www.schneier.com/>, along with a lively comment section. An RSS feed is available.

In this issue:

Three Emerging Cyber Threats

Last month, I participated in a panel at the Information Systems Forum in Berlin. The moderator asked us what the top three emerging threats were in cyberspace. I went last, and decided to focus on the top three threats that are not criminal:

* The Rise of Big Data. By this I mean industries that trade on our data. These include traditional credit bureaus and data brokers, but also data-collection companies like Facebook and Google. They’re collecting more and more data about everyone, often without their knowledge and explicit consent, and selling it far and wide: to both other corporate users and to government. Big data is becoming a powerful industry, resisting any calls to regulate its behavior.

* Ill-Conceived Regulations from Law Enforcement. We’re seeing increasing calls to regulate cyberspace in the mistaken belief that this will fight crime. I’m thinking about data retention laws, Internet kill switches, and calls to eliminate anonymity. None of these will work, and they’ll all make us less safe.

* The Cyberwar Arms Race. I’m not worried about cyberwar, but I am worried about the proliferation of cyber weapons. Arms races are fundamentally destabilizing, especially when their development can be so easily hidden. I worry about cyberweapons being triggered by accident, cyberweapons getting into the wrong hands and being triggered on purpose, and the inability to reliably trace a cyberweapon leading to increased distrust. Plus, arms races are expensive.

That’s my list, and they all have the potential to be more dangerous than cybercriminals.

Big data:
http://papers.ssrn.com/sol3/papers.cfm?…

Internet kill switches:
http://www.schneier.com/essay-224.html

Calls to eliminate anonymity:
https://www.schneier.com/blog/archives/2010/02/…

Cyberwar:
https://www.schneier.com/blog/archives/2010/12/…

Status Report: Liars and Outliers

At the beginning of the month, I completely reframed the book. I realized that the book isn’t about security. It’s about trust. I’m writing about how society induces people to behave in the group interest instead of some competing personal interest. It’s obvious that society needs to do this; otherwise, it can never solve collective action problems. And as a social species, we have developed both moral systems and reputational systems that encourage people behave in the group interest. I called these systems “societal security,” along with more recent developments: institutional (read “legal”) systems and technological systems.

That phrasing strained the definition of “security.” Everything, from the Bible to your friends treating you better if you were nice to them, was a security system. In my reframing, those are all trust pressures. It’s a language that’s more intuitive. We already know about moral pressure, peer pressure, and legal pressure. Reputational pressure, institutional pressure, and security pressure is much less of a stretch. And it puts security back in a more sensible place. Security is a mechanism; trust is the goal.

This reframing lets me more easily talk directly about the central issues of the book: how these various pressures scale to larger societies, and how security technologies are necessary for them to scale. Trust changes focus as society scales, too. In smaller societies (a family, for example), trust is more about intention and less about actions. In larger societies, trust is all about actions. It’s more like compliance. And as things scale even further, trust becomes less about people and more about systems. I don’t need to trust any particular banker, as long as I trust the banking system. And as we scale up, security becomes more important.

Possibly the book’s thesis statement: “Security is a set of constructed systems that extend the naturally occurring systems that humans have always used to induce trust and enable society. This extension became necessary when society began to operate at a scale and complexity where the naturally occurring mechanisms started to break down, and is more necessary as society continues to grow in scale.”

So the phrase “societal security” is completely gone from the book. (Like the phrase “dishonest minority,” it only exists in old blog posts.) There’s more talk about the role of trust in society. There’s more talk about how security, real security this time, enables trust. It felt like a major change when I embarked on it, but the fact that I did it in three days says how this framing was always there under the surface. And the fact that the book reads a lot more cleanly now says this framing is the right one.

The title remains the same: “Liars and Outliers.” The cover remains the same. The table of contents is the same, although some chapters have different names. The subtitle has changed to “How Security Enables the Trust that Holds Society Together.”

The manuscript is still due to the publisher at the end of the month, and publication is still set for mid-February. I am enjoying writing it, but I am also looking forward to it being done.

Previous status reports:
https://www.schneier.com/blog/archives/2011/02/…
https://www.schneier.com/blog/archives/2011/05/…
https://www.schneier.com/blog/archives/2011/08/…
https://www.schneier.com/blog/archives/2011/09/…

News

I’ve already written how it is possible to detect words and phrases in encrypted VoIP calls. Turns out it’s possible to detect speakers as well.
http://www.ncfta.ca/papers/voip.pdf

The effectiveness of plagiarism detection software. As you’d expect, it’s not very good.
http://davideharrington.com/?p=594

Luis “Guicho” Mijangos, “sextortionist.” It’s a pretty creepy story of cyber-stalking.
http://www.wired.com/threatlevel/2011/09/sextortionist/

The interesting thing about this electronic banking fraud from Malaysia is how it abuses a variety of different security systems. The criminals use a fake ID card to get a new cell phone SIM, which they then use to authenticate a fraudulent bank transfer made with stolen credentials.
http://www.thesundaily.my/news/143839

Interesting story of shifting risk. By raising the driving age, California just moved automobile deaths to a different age group.
http://www.latimes.com/health/…
The long-standing U.S.-Australia ANZUS military treaty now includes cyberspace attacks:
http://www.theregister.co.uk/2011/09/15/…

An interesting software liability proposal.
http://queue.acm.org/detail.cfm?id=2030258

Man-in-the-middle attack against SSL 3.0/TLS 1.0. It’s the Browser Exploit Against SSL/TLS Tool, or BEAST.
http://arstechnica.com/business/news/2011/09/…
http://threatpost.com/en_us/s/…
http://www.theregister.co.uk/2011/09/19/…
http://www.educatedguesswork.org/2011/09/…
Iran blocks Tor, and Tor releases a workaround on the same day.
https://.torproject.org//…
Problems with Mac OS X Lion passwords. Seems like some dumb mistakes.
http://www.defenceindepth.net/2011/09/…
http://www.theregister.co.uk/2011/09/19/…
Faking ATM fronts using 3D printers. One group stole $400K.
http://krebsonsecurity.com/2011/09/…
An analysis of extensions to the Chrome browser shows that 25% of them are insecure.
http://www.adrienneporterfelt.com/blog/?p=226

Custom HTC Android firmware breaks standard permissions and allows rogue apps to access location, address book, and account info without authorization.
http://www.androidpolice.com/2011/10/01/…
Isaac Asimov on security theater:
https://www.schneier.com/blog/archives/2011/10/…

Nice cartoon on the problems of content filtering.
http://onefte.com/2011/10/01/we-are-not-bad-people-2/

FBI-sponsored backdoors.
https://www.schneier.com/blog/archives/2011/10/…

Dilbert on security standards.
http://dilbert.com/fast/2011-08-02/
The previous day’s cartoon:
http://dilbert.com/fast/2011-08-01/
XKCD makes the same point:
http://xkcd.com/927/

Security seals on voting machines.
http://www.cs.princeton.edu/~appel/voting/…
http://dl.acm.org/citation.cfm?…
U.S. drones have a computer virus. You’d think we would be more careful than this.
http://www.wired.com/dangerroom/2011/10/…
http://arstechnica.com/business/news/2011/10/…
http://www.reuters.com/article/2011/10/07/…
No one bothered to tell the Air Force’s IT department for two weeks:
http://arstechnica.com/tech-policy/news/2011/10/…
New attacks on CAPTCHAs.
http://homepages.cs.ncl.ac.uk/jeff.yan/google.pdf

Weird World War II security puzzle.
https://www.schneier.com/blog/archives/2011/10/…

Two California burglars tip off the police after they find child porn on CDs they stole from someone’s house.
http://www.cnn.com/2011/10/06/us/…

Official Malware from the German Police

The Chaos Computer Club has disassembled and analyzed the Trojan used by the German police for legal intercept. In its default mode, it takes regular screenshots of the active window and sends it to the police. It encrypts data in AES Electronic Codebook mode with—are you ready?—a fixed key across all versions. There’s no authentication built in, so it’s easy to spoof. It sends data to a command-and-control server in the U.S., which is almost certainly against German law. There’s code to allow the controller to install additional software onto the target machine, but that’s not authenticated either, so it would be easy to fool the Trojan into installing anything.

F-Secure has announced it will treat the Trojan as malware. I hope all the other anti-virus companies will do the same.

EDITED TO ADD (10/12): Another story. And some good information on the malware. Germany’s Justice Minister is calling for an investigation.
http://www.ccc.de/en/updates/2011/staatstrojaner
http://www.ccc.de/system/uploads/76/original/…
F-Secure:
http://www.f-secure.com/weblog/archives/00002249.html
http://www.f-secure.com/weblog/archives/00002250.html

Analyses:
http://nakedsecurity.sophos.com/2011/10/09/…
http://nakedsecurity.sophos.com/2011/10/10/…
Calls for an investigation:
http://www.bbc.co.uk/go/em/fr/-/news/…

Domain-in-the-Middle Attacks

It’s an easy attack. Register a domain that’s like your target except for a typo. So it would be countrpane.com instead of counterpane.com, or mailcounterpane.com instead of mail.counterpane.com. Then, when someone mistypes an e-mail address to someone at that company and you receive it, just forward it on as if nothing happened. These are called “doppelganger domains,” and they’re already being used to spy on companies.

Defenses are few. I suppose you can buy up the most common typos, but there will always be ones you didn’t think about—especially if you use a lot of subdomains.

http://www.wired.com/threatlevel/2011/09/…

Schneier News

I will be speaking at the Hacker Halted conference on October 25 in Miami.
http://www.hackerhalted.com/2011/

I will be speaking at the Pennsylvania I.T. and Security Conference in King of Prussia, PA, on November 2.
http://www.pasecurityconference.com/2011/index.shtml

I will be speaking at the AISA National Conference on November 9 in Sydney.
http://www.aisa.org.au/national-conference/

I will be speaking at the American Society of Consultant Pharmacists Technology Summit on November 15, in Phoenix.
http://www.ascpannual.com/technology-summit

Insider Attack Against Diebold Voting Machines

This is both news and not news:

Indeed, the Argonne team’s attack required no modification, reprogramming, or even knowledge, of the voting machine’s proprietary source code. It was carried out by inserting a piece of inexpensive “alien electronics” into the machine.

It’s not news because we already know that if you have access to the internals of a voting machine, you can make it do whatever you want.

It is news because it’s so easy. The entire hack took two hours, start to finish. The attacker doesn’t have to know how the machine works, he just needs physical access. (And we know that voting machines are routinely left unguarded, and have locks that are easily bypassed.)

I find this all so frustrating because there are a gazillion ways to hack electronic voting machines. Specific attacks get the headlines, and the voting machine companies counter with reasons why those attacks are not “valid.” And in the noise and counter-noise, no one hears the general truth: these systems are insecure, and should not be used in elections.

http://politics.salon.com/2011/09/27/votinghack/

Unguarded voting machines:
https://freedom-to-tinker.com//felten/…
Easily bypassed voting-machine locks:
https://freedom-to-tinker.com//felten/…

National Cybersecurity Awareness Month

October is National Cybersecurity Awareness Month, sponsored by the Department of Homeland Security. The website has some sample things you can do to celebrate, but they’re all pretty boring. Surely we can do better. Post your suggestions in the comments section of the blog post.

Blog entry URL:
https://www.schneier.com/blog/archives/2011/10/…

National Cybersecurity Awareness Month:
http://www.dhs.gov/files/programs/gc_1158611596104.shtm

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers “Schneier on Security,” “Beyond Fear,” “Secrets and Lies,” and “Applied Cryptography,” and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>.

Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT.

Copyright (c) 2011 by Bruce Schneier.

Sidebar photo of Bruce Schneier by Joe MacInnis.