Crypto-Gram

December 15, 2013

by Bruce Schneier
BT Security Futurologist
schneier@schneier.com
http://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at <http://www.schneier.com/crypto-gram-1312.html>. These same essays and news items appear in the “Schneier on Security” blog at <http://www.schneier.com/>, along with a lively and intelligent comment section. An RSS feed is available.

In this issue:

NSA Spying on Online Gaming Worlds

The NSA is spying on chats in World of Warcraft and other games. There’s lots of information—and a good source document. While it’s fun to joke about the NSA and elves and dwarves from World of Warcraft, this kind of surveillance makes perfect sense. If, as Dan Geer has pointed out, your assigned mission is to ensure that something never happens, the only way you can be sure that something never happens is to know *everything* that does happen. Which puts you in the impossible position of having to eavesdrop on every possible communications channel, including online gaming worlds.

One bit (on page 2) jumped out at me:

The NMDC engaged SNORT, an open source packet-sniffing software, which runs on all FORNSAT survey packet data, to filter out WoW packets. GCHQ provided several WoW protocol parsing scripts to process the traffic and produce Warcraft metadata from all NMDC FORNSAT survey.

NMDC is the New Mission Development Center, and FORNSAT stands for Foreign Satellite Collection. MHS, which also appears in the source document, stands for—I think—Menwith Hill Station, a satellite eavesdropping location in the UK.

Since the Snowden documents first started being released, I have been saying that while the US has a bigger intelligence budget than the rest of the world’s countries combined, agencies like the NSA are not made of magic. They’re constrained by the laws of mathematics, physics, and economics—just like everyone else. Here’s an example. The NSA is using Snort—an open source product that anyone can download and use—because that’s a more cost-effective tool than anything they can develop in-house.

http://www.theguardian.com/world/2013/dec/09/…
http://www.nytimes.com/2013/12/10/world/…
http://www.propublica.org/article/…

Source document:
http://www.nytimes.com/interactive/2013/12/10/us/…

Dan Geer’s essay:
https://www.schneier.com/blog/archives/2013/11/…

NSA Tracks People Using Google Cookies

The “Washington Post” has a detailed article on how the NSA uses cookie data to track individuals. The EFF also has a good post on this.

I have been writing and saying that surveillance is the business model of the Internet, and that government surveillance largely piggy backs on corporate capabilities. This is an example of that. The NSA doesn’t need the cooperation of any Internet company to use their cookies for surveillance purposes, but they do need their capabilities. And because the Internet is largely unencrypted, they can use those capabilities for their own purposes.

Reforming the NSA is not just about government surveillance. It has to address the public-private surveillance partnership. Even as a group of large Internet companies have come together to demand government surveillance reform, they are ignoring their own surveillance activities. But you can’t reform one without the other. The Free Software Foundation has written about this as well.

Little has been written about how QUANTUM interacts with cookie surveillance. QUANTUM is the NSA’s program for real-time responses to passive Internet monitoring. It’s what allows them to do packet injection attacks. The NSA’s Tor Stinks presentation talks about a subprogram called QUANTUMCOOKIE: “forces clients to divulge stored cookies.” My guess is that the NSA uses frame injection to surreptitiously force anonymous users to visit common sites like Google and Facebook and reveal their identifying cookies. Combined with the rest of their cookie surveillance activities, this can de-anonymize Tor users if they use Tor from the same browser they use for other Internet activities.

http://www.washingtonpost.com/s/the-switch/wp/…
https://www.eff.org/deeplinks/2013/12/…

Me on this issue:
https://www.schneier.com/essay-467.html
http://www.darkreading.com/vulnerability/…
https://www.schneier.com/essay-436.html

Corporations calling for less surveillance:
https://reformgovernmentsurveillance.com/

Free Software Foundation’s statement:
https://www.fsf.org/news/reform-corporate-surveillance

QUANTUM:
https://www.schneier.com/essay-455.html

Tor Stinks presentation:
http://www.theguardian.com/world/interactive/2013/…

NSA and US Surveillance News

Nicholas Weaver has a great essay explaining how the NSA’s QUANTUM packet injection system works, what we know it does, what else it can possibly do, and how to defend against it. Remember that while QUANTUM is an NSA program, other countries engage in these sorts of attacks as well. By securing the Internet against QUANTUM, we protect ourselves against any government or criminal use of these sorts of techniques.
http://www.wired.com/opinion/2013/11/…

The US is working to kill United Nations resolutions to limit international surveillance.
http://thecable.foreignpolicy.com/posts/2013/11/20/…

This is a long article about the FBI’s Data Intercept Technology Unit (DITU), which is basically its own internal NSA.
http://www.foreignpolicy.com/articles/2013/11/21/…
There is an enormous amount of information in the article, which exposes yet another piece of the vast US government surveillance infrastructure. It’s good to read that “at least two” companies are fighting at least a part of this. Any legislation aimed at restoring security and trust in US Internet companies needs to address the whole problem, and not just a piece of it.

As more and more media outlets from all over the world continue to report on the Snowden documents, it’s harder and harder to keep track of what has been released. The EFF, ACLU, Cryptome, gov1.info, and Wikipedia are all trying. I don’t think any are complete.
https://www.eff.org/nsa-spying/nsadocs
https://www.aclu.org/…
http://cryptome.org/2013/11/snowden-tally.htm
https://en.wikipedia.org/wiki/…
And this mind map of the NSA leaks is very comprehensive.
http://www.mindmeister.com/326632176/nsa-css
This is also good:
http://www.tedgioia.com/nsa_facts.html

How Antivirus Companies Handle State-Sponsored Malware

Since we learned that the NSA has surreptitiously weakened Internet security so it could more easily eavesdrop, we’ve been wondering if it’s done anything to antivirus products. Given that it engages in offensive cyberattacks—and launches cyberweapons like Stuxnet and Flame—it’s reasonable to assume that it’s asked antivirus companies to ignore its malware. (We know that antivirus companies have previously done this for corporate malware.)

My guess is that the NSA has not done this, nor has any other government intelligence or law enforcement agency. My reasoning is that antivirus is a very international industry, and while a government might get its own companies to play along, it would not be able to influence international companies. So while the NSA could certainly pressure McAfee or Symantec—both Silicon Valley companies—to ignore NSA malware, it could not similarly pressure Kaspersky Labs (Russian), F-Secure (Finnish), or AVAST (Czech). And the governments of Russia, Finland, and the Czech Republic will have comparable problems.

Even so, I joined a group of security experts to ask antivirus companies explicitly if they were ignoring malware at the behest of a government. Understanding that the companies could certainly lie, this is the response so far: no one has admitted to doing so. But most vendors haven’t replied.

https://www.bof.nl/live/wp-content/uploads/…

Surveillance as a Business Model

Google recently announced that it would start including individual users’ names and photos in some ads. This means that if you rate some product positively, your friends may see ads for that product with your name and photo attached—without your knowledge or consent. Meanwhile, Facebook is eliminating a feature that allowed people to retain some portions of their anonymity on its website.

These changes come on the heels of Google’s move to explore replacing tracking cookies with something that users have even less control over. Microsoft is doing something similar by developing its own tracking technology.

More generally, lots of companies are evading the “Do Not Track” rules, meant to give users a say in whether companies track them. Turns out the whole “Do Not Track” legislation has been a sham.

It shouldn’t come as a surprise that big technology companies are tracking us on the Internet even more aggressively than before.

If these features don’t sound particularly beneficial to you, it’s because you’re not the customer of any of these companies. You’re the product, and you’re being improved for their actual customers: their advertisers.

This is nothing new. For years, these sites and others have systematically improved their “product” by reducing user privacy. This excellent infographic, for example, illustrates how Facebook has done so over the years.

The “Do Not Track” law serves as a sterling example of how bad things are. When it was proposed, it was supposed to give users the right to demand that Internet companies not track them. Internet companies fought hard against the law, and when it was passed, they fought to ensure that it didn’t have any benefit to users. Right now, complying is entirely voluntary, meaning that no Internet company has to follow the law. If a company does, because it wants the PR benefit of seeming to take user privacy seriously, it can still track its users.

Really: if you tell a “Do Not Track”-enabled company that you don’t want to be tracked, it will stop showing you personalized ads. But your activity will be tracked—and your personal information collected, sold and used—just like everyone else’s. It’s best to think of it as a “track me in secret” law.

Of course, people don’t think of it that way. Most people aren’t fully aware of how much of their data is collected by these sites. And, as the “Do Not Track” story illustrates, Internet companies are doing their best to keep it that way.

The result is a world where our most intimate personal details are collected and stored. I used to say that Google has a more intimate picture of what I’m thinking of than my wife does. But that’s not far enough: Google has a more intimate picture than I do. The company knows exactly what I am thinking about, how much I am thinking about it, and when I stop thinking about it: all from my Google searches. And it remembers all of that forever.

As the Edward Snowden revelations continue to expose the full extent of the National Security Agency’s eavesdropping on the Internet, it has become increasingly obvious how much of that has been enabled by the corporate world’s existing eavesdropping on the Internet.

The public/private surveillance partnership is fraying, but it’s largely alive and well. The NSA didn’t build its eavesdropping system from scratch; it got itself a copy of what the corporate world was already collecting.

There are a lot of reasons why Internet surveillance is so prevalent and pervasive.

One, users like free things, and don’t realize how much value they’re giving away to get it. We know that “free” is a special price that confuses people’s thinking.

Google’s 2013 third quarter profits were nearly $3 billion; that profit is the difference between how much our privacy is worth and the cost of the services we receive in exchange for it.

Two, Internet companies deliberately make privacy not salient. When you log onto Facebook, you don’t think about how much personal information you’re revealing to the company; you’re chatting with your friends. When you wake up in the morning, you don’t think about how you’re going to allow a bunch of companies to track you throughout the day; you just put your cell phone in your pocket.

And three, the Internet’s winner-takes-all market means that privacy-preserving alternatives have trouble getting off the ground. How many of you know that there is a Google alternative called DuckDuckGo that doesn’t track you? Or that you can use cut-out sites to anonymize your Google queries? I have opted out of Facebook, and I know it affects my social life.

There are two types of changes that need to happen in order to fix this. First, there’s the market change. We need to become actual customers of these sites so we can use purchasing power to force them to take our privacy seriously. But that’s not enough. Because of the market failures surrounding privacy, a second change is needed. We need government regulations that protect our privacy by limiting what these sites can do with our data.

Surveillance is the business model of the Internet—Al Gore recently called it a “stalker economy.” All major websites run on advertising, and the more personal and targeted that advertising is, the more revenue the site gets for it. As long as we users remain the product, there is minimal incentive for these companies to provide any real privacy.

This essay previously appeared on CNN.com.
http://edition.cnn.com/2013/11/20/opinion/…
http://mattmckeon.com/facebook-privacy
http://web.mit.edu/ariely/www/MIT/Papers/zero.pdf

Google’s actions:
http://www.latimes.com/business/technology/…
http://www.usatoday.com/story/tech/2013/09/17/…

Facebook’s actions:
http://www.theregister.co.uk/2013/10/11/…

Microsoft’s actions:
http://adage.com/article/digital/…

Evading “Do Not Track”:
http://www.informationweek.com/security/privacy/…
http://www.zdnet.com/…

Internet tracking by corporations:
http://www.wired.com/business/2013/10/…

The public/private surveillance partnership:
https://www.schneier.com/blog/archives/2013/08/…

Al Gore’s remarks:
http://www.vancouversun.com/news/…

News

Fokirtor is a Linux Trojan that exfiltrates traffic by inserting it into SSH connections. It looks very well-designed and -constructed.
http://www.theregister.co.uk/2013/11/15/…
http://www.symantec.com/security_response/…
http://np.reddit.com/r/programming/comments/1qoj11/…

Tips on how to avoid getting arrested, more psychological than security.
http://www.theatlanticcities.com/politics/2013/11/…
Rebuttal and discussion:
http://.simplejustice.us/2013/11/08/…

Renesys is reporting that Internet traffic is being manipulatively rerouted, presumably for eavesdropping purposes. The attacks exploit flaws in the Border Gateway Protocol (BGP). The odds that the NSA is not doing this sort of thing are basically zero, but I’m sure that their activities are going to be harder to discover.
http://www.renesys.com/2013/11/mitm-internet-hijacking/
http://arstechnica.com/security/2013/11/…

Safeplug is an easy-to-use Tor appliance. I like that it can also act as a Tor exit node. I know nothing about this appliance, nor do I endorse it. In fact, I would like it to be independently audited before we start trusting it. But it’s a fascinating proof-of-concept of encapsulating security so that normal Internet users can use it.
http://www.pogoplug.com/safeplug

Ralph Langer has written the definitive analysis of Stuxnet. There’s a short, popular version, and long, technical version.
http://www.foreignpolicy.com/articles/2013/11/19/…
http://www.langner.com/en/wp-content/uploads/2013/…

Earlier this month, Eugene Kaspersky said that Stuxnet also damaged a Russian nuclear power station and the International Space Station.
http://www.timesofisrael.com/…
http://www.v3.co.uk/v3-uk/news/2306181/…

Some apps are being distributed with secret Bitcoin-mining software embedded in them. Coins found are sent back to the app owners, of course. And to make it legal, it’s part of the end-user license agreement (EULA). This is a great example of why EULAs are bad. The stunt that resulted in 7,500 people giving Gamestation.co.uk their immortal souls a few years ago was funny, but hijacking users’ computers for profit is actually bad.
https://www.schneier.com/blog/archives/2013/12/…

Here’s a new biometric I know nothing about: your heartwave.
http://techcrunch.com/2013/09/03/nymi/
http://bionym.com/resources/NymiWhitePaper.pdf

Telepathwords is a pretty clever research project that tries to evaluate password strength. It’s different from normal strength meters, and I think better. Password-strength evaluators have generally been pretty poor, regularly assessing weak passwords as strong (and vice versa). I like seeing new research in this area.
https://telepathwords.research.microsoft.com/

This is the best explanation of the Bitcoin protocol that I have read.
http://www.michaelnielsen.org/ddi/…

Evading Airport Security

The news is reporting about Evan Booth, who builds weaponry out of items you can buy after airport security. It’s clever stuff.

It’s not new, though. People have been explaining how to evade airport security for years.

Back in 2006, I—and others—explained how to print your own boarding pass and evade the photo-ID check, a trick that still seems to work. In 2008, I demonstrated carrying two large bottles of liquid through airport security. There’s a paper about stabbing people with stuff you can take through airport security. And there’s a German video of someone building a bomb out of components he snuck through a full-body scanner. There’s lots more if you start poking around the Internet.

So, what’s the moral here? It’s not like the terrorists don’t know about these tricks. They’re no surprise to the TSA, either. If airport security is so porous, why aren’t there more terrorist attacks? Why aren’t the terrorists using these, and other, techniques to attack planes every month?

I think the answer is simple: airplane terrorism isn’t a big risk. There are very few actual terrorists, and plots are much more difficult to execute than the tactics of the attack itself. It’s the same reason why I don’t care very much about the various TSA mistakes that are regularly reported.

Evan Booth:
http://www.terminalcornucopia.com/
http://www.terminalcornucopia.com/#weapons
http://www.wired.com/design/2013/12/…
http://www.newstatesman.com/future-proof/2013/11/…
http://www.fastcoexist.com/3022106/…
http://slashdot.org/story/13/11/16/0228204/…

Bypassing the boarding pass check at airport security:
https://www.schneier.com/blog/archives/2006/11/…
https://www.schneier.com/blog/archives/2012/10/…

Carrying lots of liquids through airport security:
https://www.schneier.com/news-072.html

Stabbing people after airport security:
https://www.schneier.com/blog/archives/2009/11/…

Bringing a bomb through a full-body scanner:
https://www.schneier.com/blog/archives/2010/01/…

Why terrorism is difficult:
https://www.schneier.com/blog/archives/2010/05/…

Schneier News

I did a Reddit “Ask Me Anything” on 22 November.
http://www.reddit.com/r/IAmA/comments/1r8ibh/…

0-Day Clothing has taken 25 Bruce Schneier Facts and turned them into T-shirts just in time for Christmas.
http://www.zerodayclothing.com/schneierfacts.php

I have a new book. It’s “Carry On: Sound Advice from Schneier on Security,” and it’s my second collection of essays. This book covers my writings from March 2008 to June 2013. (My first collection of essays, “Schneier on Security,” covered my writings from April 2002 to February 2008.) There’s nothing in this book that hasn’t been published before, and nothing you can’t get free off my website. But if you’re looking for my recent writings in a convenient-to-carry hardcover-book format, this is the book for you. Unfortunately, the paper book isn’t due in stores—either online or brick-and-mortar—until 12/27, which makes it a pretty lousy Christmas gift, though Amazon and B&N both claim it’ll be in stock there on December 16. And if you don’t mind waiting until after the new year, I will sell you a signed copy of the book.
https://www.schneier.com/book-co.html

I’m speaking at the Real World Cryptography Workshop in New York on January 15.
http://realworldcrypto.wordpress.com/

Crypto-Gram Has Moved

The Crypto-Gram mailing list has moved to a new server and new software (Mailman). Most of you won’t notice any difference—except that this month’s newsletter should get to you much faster than last month’s. However, if you’ve saved any old subscribe/unsubscribe instructions that involve sending e-mail or visiting http://listserv.modwest.com, those will no longer work. If you want to unsubscribe, the easiest thing is to use the personalized unsubscribe link at the bottom of this e-mail. And you can always find the current instructions here:

https://www.schneier.com/crypto-gram-sub.html

The TQP Patent

One of the things I do is expert witness work in patent litigations. Often, it’s defending companies against patent trolls. One of the patents I have worked on for several defendants is owned by a company called TQP Development. The patent owner claims that it covers SSL and RC4, which it does not. The patent owner claims that the patent is novel, which it is not. Despite this, TQP has managed to make $45 million off the patent, almost entirely as a result of private settlements. One company, Newegg, fought and lost—although it’s planning to appeal

There is legislation pending in the US to help stop patent trolls. Help support it.

Patent trolls:
https://www.eff.org/issues/…

TQP vs Newegg:
http://arstechnica.com/tech-policy/2013/11/…
http://arstechnica.com/tech-policy/2013/11/…

Pending US legislation:
https://www.eff.org/cases/…
https://action.eff.org/o/9042/p/dia/action3/common/…
http://jolt.law.harvard.edu/digest/patent/…

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier. Bruce Schneier is an internationally renowned security technologist, called a “security guru” by The Economist. He is the author of 12 books—including “Liars and Outliers: Enabling the Trust Society Needs to Survive”—as well as hundreds of articles, essays, and academic papers. His influential newsletter “Crypto-Gram” and his blog “Schneier on Security” are read by over 250,000 people. He has testified before Congress, is a frequent guest on television and radio, has served on several government committees, and is regularly quoted in the press. Schneier is a fellow at the Berkman Center for Internet and Society at Harvard Law School, a program fellow at the New America Foundation’s Open Technology Institute, a board member of the Electronic Frontier Foundation, an Advisory Board Member of the Electronic Privacy Information Center, and the Security Futurologist for BT—formerly British Telecom. See <http://www.schneier.com>.

Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT.

Copyright (c) 2013 by Bruce Schneier.

Sidebar photo of Bruce Schneier by Joe MacInnis.