Schneier on Security

Clive Robinson • November 1, 2019 9:16 PM

@ Vas Pup, SpaceLifeForm,

Russia’s internet law a ‘new level’ of censorship

The Russian’s aving their own DNS has been known to be an ambition of their’s for quite some years now. Back half a decade ago ay the UN ITU meetong in Doha, Rissoa and several other nations not just proposed but actually voyed on splittong up the Internet along not just DNS but various other infrastructure services. That is they wanted to be in control of what they saw as an internal juresdiction.

The US barely kept control, and thst is the real underlying issue, “The US controls the Internet” thus they get certain advantages, especially in the surveillance and “record it all” policy.

I’m realy surprised it’s taken them so long to make what is in effect a moderately small change.

Oh and don’t forget that DNS is a convenience rather than a necesity.Thus the Russian’s could change even more basic rules like IP addrressing…

Clive Robinson • November 2, 2019 8:22 PM

@ vas pup,

The problem is that violence and mental health are rather orthogonal features.

It’s a bit more complicated than that.

Obviously the use of violence by any individual at any one occasion is based on their mental state at the time, which in turn is based on “immediate environmental factors”, brain chemistry at the time and the underlying physical/chemical structure of the brain.

Further there is little doubt that you can fairly easily be taught to be not just violent but a killer even a mass killer without any immediate mental reservation (think of the military etc).

Nearly all –but not all– of us have a built in “fight or flight” mechanism. Likewise a significantly large percentage have an as yet poorly understood reasoning system that gives rise to an implicit “risk or reward” process that is so multifaceted that it works in an almost incomprehensible way.

But we also know through work involving NFL players that even low levels of physical trauma if repeated causes insults to the brain that cause massive mood and behaviour swings but are not currently viewable except at autopsy by specialised testing. Likewise more serious levels of physical trauma need less repeating. Till we get to the point where just a single physical trauma that renders a person unconcious may be sufficient to cause massive changes in mood and behaviour that become a new state of being.

Which raises a whole series of philisophical questions about responsability. For instance,

If you are in say your mid to late 20’s in a taxi that get’s t-boned at a junction and you suffer sideways whip lash and unconciousness – is that your fault, and if so why?

If as a result of that physical event you suffer a personality change – is that your fault, and if so why?

Further if as a result of that personality change you have difficulty controlling certain emotions and actions – is that your fault, and if so why?

Thus if you end up having a violent physical outburst – is that your fault, and if so why?

The US has over 30,000 road deaths a year due to impacts, which means the actuall number of survivors of impacts must be considerably higher. How many are there? And of those how many are potentially more prone to violence afterwards?

On the “pre-crime” argument they would all need to be subject to more restrictions on their personal freedoms as “pre-criminals” just as convicted criminals are…

Oh and it’s not just repeated physical insults to the brain that cause problems… For some reason we currently find more acceptable that repeated,emotional insults to the brain can cause such changes such as in “spousal abuse”…

Are all people thus abused also “pre-criminals”?

What about those bullied at school?

The simple fact is physical and mental abuse from a persons environment shapes them and some are more susceptible to these environmental factors than others and we don’t know why. Thus we tend to lift the corner of the rug marked PTSD and sweep them under.

In reality few ever go on to become violent, and even less dangerously so. By the logic of “pre-crime” every one who has had a brain insult be it physical or mental becomes a “pre-criminal” and has a label tied around their neck like a collar on a dog, or ring through a bulls nose.

The minute you have such labels history teaches us you become subject to discrimination, which just adds further insults to a damaged brain. Thus you get an abusive process that can only make things worse. In effect a self fulfilling downward spiral…

Great if you are a particular political mindset (Mr Barr for instance) or part of a group that almost always exists around such discrimination processes that profit by it. Bad if you are a normall tax paying citizen.

At the very least “pre-crime” is going to be “more harmful than helpful” and it’s time people woke up to reality. No computer algorithm is going to be any better than human judgment and no less susceptible to bias, when it comes to future events we can not know, therefore we can not stop, and any attempt to do so is a waste of resources as it’s actually a “faux market”.

Clive Robinson • November 3, 2019 1:31 PM

@ gordo, Sancho_P,

This new list would be dual use: People who believe, have or hold conspiracy theories, but are also pseudo scientifically susceptible to entrapment via ginned-up conspiracy plots.

It’s not as though we have not seen entrapment by the FBI, et al, of people of low IQ or other issues such as minor mental or physical health issues already.

We know that they get “third party” “agent provocateurs” to feed them, cloth them, drive them to medical appointments, faux befriend them, all the while seperating them from other people and increasing the persons paranoia. Untill they give them money and faked up arms dealers to spend it with, help them build a phoney bomb and then having spent the proverbial 23hours and 59minutes controling their almost every move, thought and action, sweep in at the last moment to a blaze of news spotlights etc etc.

Heck they got so obvious at it they had to stop as even the usually gullible MSM started to smell a rotting rodent…

The result, the more I hear about the FBI and their “big cases” the more I look for a “fall guy”… Especially if it’s ICT or drug or terrorism related.

But the fact that like a number of US Journalists, I smell a large rotting rodent to, probably qualifies me in their eyes as being a few breakfasts less than a jumbo box of fruit loops…[1]

As Douglas Adams once so delightfully put it,

Slartibartfast: Ah, no, well, yeah, no. That’s what they wanted you to think, but you were actually elements in their computer program.

Arthur: Actually, this explains a lot. All my life I’ve had this strange feeling there’s something big and sinister going on in the world.

Slartibartfast: No, that’s normal paranoia. Everyone in the universe gets that…

The trouble is there is no “Earth 2.0” so we need to take a little care of 1.0 so we can get a few more miles on the clock, but apparently “We are not destroying the environment” or as the old T-Shirt had it nor are we about to “Nuke the gay whales”. I guess atleast one of them might be right 😉

[1] I hope they are not listening in to the very few phone calls I make… Because they are so dull it would probably bore them to death, and that’s probably one of those secret crimes in the PATRIOT act =( I guess not only are you not alowed to lie to the FBI, you are probably not alowed to make them yawn at work either as for looking stupid… What do they call it “Special Administrative Measures”[2] via some deep hole in the ground somewhere,

That there’s some corner of a foreign field that is for ever England. There shall be in that rich earth a richer dust concealed

<

ul>A pulse in the eternal mind, no less, gives somewhere back the thoughts by England given; Her sights and sounds; dreams happy as her day; And laughter, learnt of friends; and gentleness, in hearts at peace, under an English heaven.

From “The Soldier” by Rupert Brooke.

[2] You can read more about Special Administrative Measures from the lawyers who have had clients put under them and ther researchers investigating,

https://ccrjustice.org/sams-report

Clive Robinson • November 4, 2019 5:16 PM

@ Anders, Bruce, ALL,

With regards the Estonian implementation of the EU required legislation the following is a bit of an “eye opener”,

Tõnu Mets and Arnis Parsovs show that the legal requirement to establish the time of signing is not met in practice. The related legal requirement that the validation of the digital signature should confirm that the certificate was valid at the time of signing is also not met.

That is a couple of real shockers.

Either would be bad enough on it’s own but together it’s compleatly disastrous.

Look at it this way you buy a house or similar on longterm finance such as a mortgage.

25years later with your final payment you think great time to enjoy that €1000/month insted of passing it over to the mortgauge company.

You then get a letter that instead of a basic “repayment mortgauge” the company has you down as having an “interest only mortgauge”.

You say “no way” but they then use a long out of date even revoked digital signiture to sign a modified document that changes the mortgague type. The second fault alows this, the first fault alows them to predate it back to the original day of signing…

Thus there is no way that you can show the digital document is not valid.

The only thing that might stop it is if you have also digitally signed the document in a correctly implemented protocol[1].

But… there is the issue of “signitures” and “hashes” you don’t sign the document but a hash of the document, the larger the document the less unique the signiture potentially is[2].

Hashes can have unknown at design time faults in them[3]. Which is why NIST had a hash competition to in effect replace two generations of previous hashes that were less than 25years old when questions got asked about their potebtial weaknesses in light of more modern knowledge.

So it’s fair to say that potentially any hash that has been designed even quite recently over a 25year period of a mortgage, might end up with “more holes than a second hand pair of string underpants”.

If that is the case then with the two faults shown, the bank only have to find one not two collisions. That is to the hash you signed of the document. Which whilst not trivial has been shown possible with some hash functions.

Whilst I’m reasonably certain someone will come up with a new algorithm or protocol to prevent the problem, it leaves the question of,

What other vulnarabilities are there to find?

[1] I’m not going to go through it but it is possible for the document producer to structure the mechanics of the signing protocol such that your signiture scope is not what it should be, nor are the other protocol protections. Thus the document remains malleable in certain ways.

[2] To see this think of a hash as a N = M_[i] mod C operation where the result N is in the range 0 to C-1. N then gets put through a “one way function”, the output of which gets “chained” in some way. Thus you can see as the document gets larger the same value of N can apear over and over. Using the wrong type of chaining function –say XOR or ADD based often used in CRCs– gives rise to weaknesses that can be exploited[3].

[3] Whilst modern hashes are designed to reduce or eliminate known problems of the above[2] type, crypto designers are not omnipotent nor do they have the ability to see into the future, thus they can not defend –except in a general way– against future attacks. The history of the Fast Encryption ALgorithm (FEAL) should be a salutory lessen in this respect.

Clive Robinson • November 5, 2019 2:24 AM

@ SpaceLifeForm, r,

Light Commands is a vulnerability of MEMS microphones that allows attackers to remotely inject inaudible and invisible commands into voice assistants

I’m not surprised, MEMS devices have caused other proplems in the past.

The most memorable being Apple users in a hospital finding their “new Apple products” not working after thr NMRI techs did a large dump of helium purge,

https://www.extremetech.com/mobile/279902-the-iphone-is-apparently-allergic-to-helium

MEMS devices are extreamly small and are thus have very low thermal mass which makes them very sensitive to very small changes in energy. A laser is all things considered little more than a “coherant EM energy beam”.

You will probably find that two narrow focus high frequency audio beams that have a beam crossing point focussed on a MEMS device or it’s housing will do the same thing (have a look at the “Mosquito” device to get a feel for the technology). If you hear either beam alone you hear just noise if your hearing still works up to those frequencies. It’s only when you get both beams constructively interfering with each other do you hear the normal audio signal (see how WWII German Knickebein system and it’s Lorenze radio beams worked[1] from the late 1930’s).

But getting back to laser beams, the US military discovered a problem with them, in that a very high energy beam focused on say tamk armor had a problem. That is as it vaporized the metal the vapour would be “in the drill hole” effectivly “fouling it” just as swarf can do with drills. Thus significantly limiting the power that could be used. During testing of using pulsed lasers to get around the problem they discovered that the pulsed laser would create vibrations in the armor sufficient for destructive resonance to come into play…

Thus the pulse energy gets integrated by the target which effectively integrates it and the result is just as with a high efficiency Class D amplifer a very pure audio waveform appears at the target which in effect becomes a miniture loud speaker.

But… as with many “trasducers” such a system is bidirectional, thus with small additions to the design would also make a quite sensitive “laser microphone”.

Thus an attacker could interact fully in speaking and listening to “Alexa and friends” and with other software do it in a voice that sounds like the actual users voice from first listening to and analysing it using the same algorithms “Alexa and friends” use…

So there’s a second paper for them to write straight off or anyone else with a quick mind and nimble fingers 😉

[1] https://en.m.wikipedia.org/wiki/Battle_of_the_Beams