Friday Squid Blogging: Squid Mural
Large squid mural in the Bushwick neighborhood of Brooklyn.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
Page 212
John Paul Stevens Was a Cryptographer
I didn’t know that Supreme Court Justice John Paul Stevens “was also a cryptographer for the Navy during World War II.” He was a proponent of individual privacy.
EDITED TO ADD (8/12): More on his cryptography career.
Identity Theft on the Job Market
Identity theft is getting more subtle: “My job application was withdrawn by someone pretending to be me“:
When Mr Fearn applied for a job at the company he didn’t hear back.
He said the recruitment team said they’d get back to him by Friday, but they never did.
At first, he assumed he was unsuccessful, but after emailing his contact there, it turned out someone had created a Gmail account in his name and asked the company to withdraw his application.
Mr Fearn said the talent assistant told him they were confused because he had apparently emailed them to withdraw his application on Wednesday.
“They forwarded the email, which was sent from an account using my name.”
He said he felt “really shocked and violated” to find out that someone had created an email account in his name just to tarnish his chances of getting a role.
This is about as low-tech as it gets. It’s trivially simple for me to open a new Gmail account using a random first and last name. But because people innately trust email, it works.
Zoom Vulnerability
The Zoom conferencing app has a vulnerability that allows someone to remotely take over the computer’s camera.
It’s a bad vulnerability, made worse by the fact that it remains even if you uninstall the Zoom app:
This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user’s permission.
On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call.
Additionally, if you’ve ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install ‘feature’ continues to work to this day.
Zoom didn’t take the vulnerability seriously:
This vulnerability was originally responsibly disclosed on March 26, 2019. This initial report included a proposed description of a ‘quick fix’ Zoom could have implemented by simply changing their server logic. It took Zoom 10 days to confirm the vulnerability. The first actual meeting about how the vulnerability would be patched occurred on June 11th, 2019, only 18 days before the end of the 90-day public disclosure deadline. During this meeting, the details of the vulnerability were confirmed and Zoom’s planned solution was discussed. However, I was very easily able to spot and describe bypasses in their planned fix. At this point, Zoom was left with 18 days to resolve the vulnerability. On June 24th after 90 days of waiting, the last day before the public disclosure deadline, I discovered that Zoom had only implemented the ‘quick fix’ solution originally suggested.
This is why we disclose vulnerabilities. Now, finally, Zoom is taking this seriously and fixing it for real.
EDITED TO ADD (8/8): Apple silently released a macOS update that removes the Zoom webserver if the app is not present.
Palantir's Surveillance Service for Law Enforcement
Motherboard got its hands on Palantir’s Gotham user’s manual, which is used by the police to get information on people:
The Palantir user guide shows that police can start with almost no information about a person of interest and instantly know extremely intimate details about their lives. The capabilities are staggering, according to the guide:
- If police have a name that’s associated with a license plate, they can use automatic license plate reader data to find out where they’ve been, and when they’ve been there. This can give a complete account of where someone has driven over any time period.
- With a name, police can also find a person’s email address, phone numbers, current and previous addresses, bank accounts, social security number(s), business relationships, family relationships, and license information like height, weight, and eye color, as long as it’s in the agency’s database.
- The software can map out a person’s family members and business associates of a suspect, and theoretically, find the above information about them, too.
All of this information is aggregated and synthesized in a way that gives law enforcement nearly omniscient knowledge over any suspect they decide to surveil.
Read the whole article—it has a lot of details. This seems like a commercial version of the NSA’s XKEYSCORE.
Boing Boing post.
The FBI wants to gather more information from social media. Today, it issued a call for contracts for a new social media monitoring tool. According to a request-for-proposals (RFP), it’s looking for an “early alerting tool” that would help it monitor terrorist groups, domestic threats, criminal activity and the like.
The tool would provide the FBI with access to the full social media profiles of persons-of-interest. That could include information like user IDs, emails, IP addresses and telephone numbers. The tool would also allow the FBI to track people based on location, enable persistent keyword monitoring and provide access to personal social media history. According to the RFP, “The mission-critical exploitation of social media will enable the Bureau to detect, disrupt, and investigate an ever growing diverse range of threats to U.S. National interests.”
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak:
- I’m speaking at Black Hat USA 2019 in Las Vegas on Wednesday, August 7 and Thursday, August 8, 2019.
- I’m speaking on “Information Security in the Public Interest” at DefCon 27 in Las Vegas on Saturday, August 10, 2019.
The list is maintained on this page.
Friday Squid Blogging: When the Octopus and Squid Lost Their Shells
Cephalopod ancestors once had shells. When did they lose them?
With the molecular clock technique, which allowed him to use DNA to map out the evolutionary history of the cephalopods, he found that today’s cuttlefish, squids and octopuses began to appear 160 to 100 million years ago, during the so-called Mesozoic Marine Revolution.
During the revolution, underwater life underwent a rapid change, including a burst in fish diversity. Some predators became better suited for crushing shellfish, while some smaller fish became faster and more agile.
“There’s a continual arms race between the prey and the predators,” said Mr. Tanner. “The shells are getting smaller, and the squids are getting faster.”
The evolutionary pressures favored being nimble over being armored, and cephalopods started to lose their shells, according to Mr. Tanner. The adaptation allowed them to outcompete their shelled relatives for fast food, and they were able to better evade predators. They were also able to keep up with competitors seeking the same prey.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
Clickable Endnotes to Click Here to Kill Everybody
In Click Here to Kill Everybody, I promised clickable endnotes. They’re finally available.
Presidential Candidate Andrew Yang Has Quantum Encryption Policy
At least one presidential candidate has a policy about quantum computing and encryption.
It has two basic planks. One: fund quantum-resistant encryption standards. (Note: NIST is already doing this.) Two, fund quantum computing. (Unlike many far more pressing computer security problems, the market seems to be doing this on its own quite nicely.)
Okay, so not the greatest policy—but at least one candidate has a policy. Do any of the other candidates have anything else in this area?
Yang has also talked about blockchain: ”
“I believe that blockchain needs to be a big part of our future,” Yang told a crowded room at the Consensus conference in New York, where he gave a keynote address Wednesday. “If I’m in the White House, oh boy are we going to have some fun in terms of the crypto currency community.”
Okay, so that’s not so great, either. But again, I don’t think anyone else talks about this.
Note: this is not an invitation to talk more general politics. Not even an invitation to explain how good or bad Andrew Yang’s chances are. Or anyone else’s. Please.
Sidebar photo of Bruce Schneier by Joe MacInnis.