Schneier on Security

Clive Robinson • November 18, 2017 11:35 AM

@ tired,

Now if everyone could comment with a lots of optimistic vibes

Err, not everything is backdoored Yet.

Oh, rumour has it a model T ford car can not be hacked by an ten year old with a harmonica from fifty feet away.

Not much else realy sorry 😉

Clive Robinson • November 18, 2017 5:59 PM

@ Albert,

They were drawn and quoted.

The old joke said “Hand drawn and quoted” to match “Hung drawn and quatered”.

A process I have described befor along with gelding and gouging, and one or two other entertainments from the time…

However the one that sticks most in my mind is “boiling alive” not because of the process but the reason given for the punishment originally. A cook allegedly poisoned a noble man and his family and the King decreed that “as he had killed by cooking he in turn should be killed by cooking” on the “eye for an eye” principle.

Clive Robinson • November 19, 2017 6:01 PM

@ What Now,

As Marcy points out there is much that is wrong with the US narrative, especially on time lines.

The question that arises is not just “Why” but also “Why now, not then?”

Put simply the US Government or an entity within it are trying to cover something up or trying to create a situation for some reason[1].

The “unnamed insiders” clearly have their stories wrong, which suggests they actually have no first hand knowledge of events but have actually been briefed from on high about what to say and the briefing details are wrong for some reason. Which suggests that the “Israeli Screen shots” are just as bogus.

In short there is a high stakes poker game going on here and Kaspersky is playing not just against the US Government, but the Russian and most European ones as well. Thus the question of what cards he is holding, some are fairly obviously real. For instance he has given sufficient information for the supposed NSA “homeworker” to be be identified by others outside the US Gov agencies. So it can be shown who the homeworker realy is if they exist or shown as a setup if they don’t. The question is will some one in the ISP show their logs or not and if they do to whom… Kaspersky is also holding real cards that he may use to bluff out a little. That is he’s made it clear that NSA work in progress has been recorded, he could publish the entire list and show when and where the NSA have been digging to cause diplomatic issues. Thus start another “Mommey Merkel’s phone’s been owned” type embarrassment for the NSA and the USG. He may also be bluffing up other things via sub context. Eiher way it’s a fairly astute piece of PR work that has wrong footed quite a few up on the hill…

It might also be good advertising. Dispite US protestations they do not do economic espionage, most outside the US who have heard them don’t believe them. Thus lost USG sales might well be balanced by increased sales in the rest of the Western world. Especially when other mainly US based AV vendors have not said a word about any of this NSA activity.

The one thing I will note is that nobody has come out and said just how the Kaspersky software might have been “got at” by third parties. There is obviously a command and control capability from Kaspersky’s mother ship but it’s security has not been evaluated publicaly. So we still do not know if the Russian FSB or SigInt entities were either passively or actively involved with the command and control capability.

It’s known that Kaspersky had a certain “training” background and quite a few that the company has employed have had the same or similar training background. Thus the qurstion arises as to if one or more employees have “old loyalties” that are stronger than those to Kaspetsky. Thus an insider attack to “lift crypto keys” or even open a backdoor is a definate possability…

So hopefully the entertainment will last for another bowl or two of popcorn.

[1] And no I don’t think it’s “Trumps in a russian bed” or “the reds hacked the election” but something else.

Clive Robinson • November 19, 2017 7:14 PM

@ Winston Smith,

I genuinely laughed at that comment

I hope you were not the only one, but thanks for letting me know I’ve managed to lift somebodies spirits a little.

Likewise thanks to our host Bruce who has made not just the odd joke possible but much else besides.

Oh if you look carefully somewhere in this blog is the Moderator being “shocked” at which earned me a yellow card. I thought I had got away with it but @Wael asked me to explain one of the points and thus I got caught…

Clive Robinson • November 19, 2017 9:50 PM

@ Tyr,

Compared to the last Spanish Civil war this one has been pretty tame so far.

I sincerly hope it stays that way. The stupid thing is it was very predictable months ago for a whole load of economic reasons.

It’s funny that you mentioned Varoufakis the Greek Finance minister, he spotted that Spain’s financial troubles would give rise to this sort of problem quite some time ago and did not make himself popular by telling it to the media. He has also more recently made himself unpopular with the current UK PM over Brexit. His advice makes way way more sense than any nonsense comming out of No10 or the three stooges.

Varoufakis’s views on the EU council of ministers and their authoritarian economics that originated with pre WWII German economic thinking, now does not appear any where near as doom saying as they once were…

Clive Robinson • November 20, 2017 5:00 PM

@ gru,

Gallivanting? He was attending an international law conference (that must have been quite a wine reception before the talks if you consider that gallivanting!)

As I understand it he was attending the 25th General Assembly of the Ibero-American Association of Public Prosecutors held this year in sunny Argentina.

The association is a bit of an oddity, in that originally it was not “Ibero-American” but just American and included just about every country south of the Texas Boarder. Quite some time after it got going Spain and Portugal joined. Depending on your view point the “Ibero” linkage is a case of the old deposed empire being invited back to join the club, or it’s a commonality of language and heritage thus vested interests.

Officially it’s purpose is aimed at establishing closer ties of cooperation, solidarity and professional enrichment between the ibero-American prosecutors.

However as with many “General Assemblies” the “Professional Enrichment” is the key, or as others would put it “Networking time” and “Time to asses your political rivals within the association over a glass of veno”…

As for “Galivanting” it’s a word that gets used when people are in effect seen as “slacking off during a crisis”. Having just looked at various English language news outlets the most restrained is “Sputnik News” which if the “Russian Accusations” of state level interferance had solid foundation you would expect something entirely different (note the accusation comes from an underfunded oddity in the EU and consists of only 14 people, and has many of the administrative signs of “not being wanted” by the parent organisation).

The reason I say “crisis” though it is not my choice of word, but in effect what MSM has called Spain’s Constitutional Crisis, based on the words of not just of Spain’s leaders but some of those in the EU Council of Ministers.

As for the Attorney General himself you will find many of the English language news outlets saying of him a variation of,

Maza was one of the leading figures in the Spanish state’s attempts to thwart Catalonia’s push for independence. On October 30, following a declaration of independence, Maza filled rebellion charges against the Catalan government and those Parliament bureau members who allowed the vote on the declaration of independence to take place. In total, 20 were accused, including deposed president Carles Puigdemont, his ministers and the president of the chamber Carme Forcadell. Maza also filed charges of sedition and misuse of public funds, amongst others.

Thus he was apparently a leading figure in Spain’s response and effectively named as the driving force against what are “Politicaly inspired” charges. But importantly for his detractors he was away from the crisis. If you think bsck to Deep Water Horizon the UK exec took a few days off and was pilloried in the US and other Western MSM. It’s easy to spin out as being “not at the helm” or equivalent, by detractors.

Whilst I do not think there is any foul play, there will be those that will talk about it to fill column inches. My point about “Spain’s problems have got a whole lot worse” is that the many detractors will jump on it in various ways as I’ve just described. It’s kind of “Pokitics 101” about “not letting a crisis real or otherwise go to waste”.

What it does alow is for the Spanish PM to “pull back the horns” on those prosecutions. Irrespective of the supposed and debatable waste of resources the other charges are going to be seen (and are) as Politicaly Inspired. The best thing the PM can do is stop them or kick them in the long grass as they realy are very unproductive at the least and the world press does see them as Politically inspired which is going to cause Spain pain. There is enough comments about two and a half thousand companies moving dur to the Catalan call for independence, it does not take much imagination to realise that the Spanish Government response is as much to blaim. Spain is not in a fiscally robust enough state to have an economic down turn due to businesses sailing for safe harbour else where.

By the way, it is important to distinguish between Catalonia and Catalan pro-independence parties. Although pro-independence groups like to refer to themselves as “the people” and “true Catalans”, there are plenty of political parties and social movements that are against independence in Catalonia

It goes without saying that for the average person in Catalonia the real question is “What’s in it for me” and at other times they would not even have thought of that. In the UK Brexit was assumed by many to be an irelivance and that the majority would be pro-Europe not exit. But that’s not how it turned out. On the day many voted for what are almost trivial reasons and it surfaced as a mixture of grumbles and “sending a message”. For instance “immigrants / refugees” the areas where that was given as the reason for the exit vote have the least amount of immigrants and refugees, those with the most were very strongly remain in Europe. Again the areas that gain most from EU subsidies were those who had the highest leave votes, surely they don’t expect the UK Gov to keep giving them subsides…

Humans are humans and do contrary way more often than you would think possible let alone sensible. In essence they vote with emotion not common sense, even though they wouldn’t see it that way. We saw it in the US Election and Brexit. People in the US have taken the Orwelian out of making and blaiming a faux existential threat of the old “Reds Under the Beds” or “Unamerican activities” variety. Brexit was a whole different kettle of fish, you actually had US companies that are associated with PayPal’s Peter Theil such as Plantair and Cambridge Analytica actually claiming they swung Brexit, by almost exactly the same tactics the US existential threat of Russia are claimed to be doing…

One thing you can say about Catalonia is it’s thought to be the city folks that are anti seperation whilst the urban and country dwellers are pro seperation. However it might well turn out that like Brexit the polsters are reading it wrong. But it’s certainly trie that the Proportional Representation system the use there has something wrong with it. Because it appears to take nearly 45,000 votes to get a city representing politician in whilst 20,000 or less to get a country/urban representing politician. Which means that the representation is badly skewede… Which means it’s unsuprising to find so many seperatist ministers in Catalan.

With regards,

I don’t see that at all. All political parties in Catalonia, including the most radical groups, e.g. CUP (anti-system) and Junts pel Si (hardcore separatists) have already confirmed that they will run.

I think you are not getting what I’m pointing out. By not accepting I mean you will get the same sort of response as was seen after the Presidential elections in the US and similar in Britain over Brexit.

To see why think back to recent European elections, a far right party nearly won but due to non political reasons the election had to be re-held. During that time people woke up and realised that trying to send a message by tactical voting had nearly brought ruin on them all. This the second election produced very markedly different results.

Which is pretty much what I’m expecting to see in a months time. In the UK we call this political change of heart “Buyers Remorse” and I suspect if we were to hold a new referendum on EU membership to day the vote would be fairly solidly remain, because people have had the oportunity to see not just the SNAFU behaviour of the encumbrant politicos but also get to see not just “Market revenge” but also “EU Council of Ministers revenge” as well. Their view as seen through their actions is that Britain should be not just horrendously punnished for it’s temerity to in effect call the ministers out, but also to be broken and “rent assunder” then where possible asset stripped for the benifit of a few on Germany and Northern France.

Worse the EU ministers are quite deliberately making it public so people can see not just any pretence at “justice being done” being a nonsense. But to actively disincentivise any other Nation trying to pull the rip-cord out of the EU from under the Council of Ministers authoraterian economic and social model which is little different to that thought up in Germany in the late 1930’s

Clive Robinson • November 21, 2017 3:45 AM

@ Nick P,

Also, it’s Elovici’s people again

Err have you missed out a link to another paper?

It’s just that the paper you give a link to goes back to work that was done around three years ago, and is kind of a repeate of stuff done at the UK’s Cambridge Labs several years prior to that.

Also I did work that I’ve mentioned before back in the 1980s/1990s that demonstrates the same basic principles. Further it appears, having chatted with other curious engineers, I was not the only one. In atleast one case one engineer had written a paper on it back in the Thatcher-Reagun years but could not get it published…

I know from later events that certainly the UK Gov all the way up to Thatcher knew about the implication of RF Cross modulation effects because she inked a ban on the use of early cell phones in secure areas in the mid to late 1980’s.

It realy looks like we’ve had to wait a third of a century for the academic community to get papers published. Which begs the question Why?

Clive Robinson • November 21, 2017 7:53 AM

@ Wael,

And I am more than familiar with cross-modulation before I read any of these papers, btw.

Yes I’m aware that you know it’s one of “The Roots of All Evil Side Channels”, of which there are rather more than the horsemen of the Apocalypse…

Speaking of knowledge, I note 255 has not yet replied to your OTP challenge 😉

Clive Robinson • November 21, 2017 8:11 AM

@ Wael,

I’ve just noticed the time are you “away from base” or is the usual mistress being harsh again?

If the latter she’s been getting at me again since I got “bluetooth” enabled 🙁

I’m currently on two trips a day to the land of nod because of her and it’s not just anoying it’s stopping me getting a full day in with the old nose to the grind stone…

Clive Robinson • November 21, 2017 2:48 PM

Play it again Linus

As some of you are aware Linus Torvalds has his “Casablanca Moments” when he turns around and rants in language most intemperate… And he’s fired of one or two salvos at Security People… Well he’s done it again

https://www.theregister.co.uk/2017/11/20/security_people_are_morons_says_linus_torvalds/

I will let others judge the merits of his latest missives and the language used…

Oh I guess I should say might be risky for the workplace if you have “sensitive types” around. As some of the expleatives have only been partialy bleeped with asterisks.

Clive Robinson • November 21, 2017 3:50 PM

In need of a smile as BlackF approaches?

You might find this lightly satirical piece from “The Register” in the UK might raise a smile,

https://www.theregister.co.uk/2017/11/16/steve_bong_kremlin_confession/

And for those not in the US in need of a laugh or three,

http://newsthump.com/2017/11/21/pardoned-thanksgiving-turkeys-should-face-death-penalty-insist-republicans/

Clive Robinson • November 21, 2017 5:23 PM

As Black Friday approaches, with all that dodgy electronics at knock down prices…

Have a care about a dodgy AI,

https://rochdaleherald.co.uk/2017/11/03/turning-trump-off-doesnt-seem-done-good/

Clive Robinson • November 21, 2017 6:33 PM

Apple get another phone Warrant

Another shooting spree another dead shooter with a locked iPhone and Apple get hit with a warrant again, this time from the Texas Rangers, long after the event[2].

https://www.theregister.co.uk/2017/11/20/warrant_texas_shooter_iphone/

Again this is almost certainly political grandstanding by authorities cynically using the grief of those who have suffered as blackmail to force an issue.

Apple will be put in the position of bad guy yet again. And no doubt yet again the authorities will throw millions of tax payer dollars at any opposition by Apple.

Likewise the FBI, DoJ etc will start not just their rhetoric but also leaning on politicals for legislation again using the usuall grieving relatives blackmail tactics.

The real question that people should be asking is what are the Silicon Valley Companies and other high tech firms going to do?

Well there are various things to stop these warrants being effective, primarily by moving chunks of the design process “off shore” as a form of “out sourcing”

This will have negative effects on the US economy way worse than most people will be able to see.

Thus the secondary question of “Is the cost worth it?” and the actual answer is almost certainly no in this case. Because the likelyhood of their being anything on the phone that will make a difference is minimal at best, because the shooter appears to have been a loner with longterm issues including a history of violence[1]. He killed himself and thus can not be brought into court etc, thus the evidence of his actions already gathered is more than sufficient for any further legal requirments.

The issue of how he obtained the weapons he used is probably not difficult to solve. Because there are well known methods of purchasing legal weapons from legal sellers that in effect legaly negate the background checks that might just prohibit sales to those who are not legaly alowed to own guns.

Importantly though it was known by authorities long before hand that he had weapons even though he should not have. Because reports from his neighbours about his firing of guns where he lived were made to the authorities and should have been easily cross checked against the appropriate records. So as is probably going to be said but not actioned in future is “it was a lost opportunity”…

[1]http://www.bbc.co.uk/news/world-us-canada-41884342

[2] Various news sources have made comment that the authorities had both the phone and the owners finger and imply that the authorities should have unlocked the phone then and there before the timed lockout occured.

Clive Robinson • November 21, 2017 10:31 PM

@ Tatütata,

I’m quite sure that what I’m seeing is not what you’re seeing.

Yes it’s changed for me as well now and is nolonger funny. Originally it was something like “Thrust successfully into end to end cloud telephony” only funnier

Clive Robinson • November 24, 2017 8:34 AM

@ Bruce and the usual suspects,

If you add a little lateral thinking this paper might be of interest,

KV-Direct: High-performance in-memory key-value store with programmable NIC

https://lrita.github.io/images/blog/kv-direct.pdf

It implements a quite rapid and energy efficient way to implement a Key-Value store[1]

With 10 programmable NIC cards in a commodity server, we achieve 1.22 billion KV operations per second, which is almost an order-of-magnitude improvement over existing systems, setting a new milestone for a general-purpose in-memory key-value store.

Which is quick, but also of importance is that at around 3x more power efficient than other systems KV-Direct is the first general purpose KV system to achieve 1 million KVstore operations per watt on what are commodity servers.

Which as most of this is done on the 10 NICs, the server CPU is not doing a lot Thus it can also be used to run other functions at the same time. So you can quite easily make the case that it is getting on for being on for 9-10x more efficient power wise than sttaight CPU-based commodity systems.

As the authors note,

More recently, as both the single core frequency scaling and multi-core architecture scaling are slowing down, a new research trend in distributed systems is to leverage Remote Direct Memory Access (RDMA) technology on NIC to reduce network processing cost.

Which is what they have done with the 10 FPGA NICs.

One thing the aurhors are aiming for is vector array operations, which in recent years have moved to the likes of high performance graphics processing units. Which are also available as commodity components. The problem with this currently being the PCI bus which now becomes the system bottle neck.

It will be interesting to see where KVstores with the value being the sort of data suitable for GPU Vector processing will go. It’s one of the things AI and Big Data can make a lot of use of.

[1] Think of a KVstore as an associative array of very large size, a simple example might be a Rainbow Table for instance or a generalised password cracking DB. But it can also be more general with the value being complex data or a pointer to complex data of the forms that vector processing or object processing can use.

Clive Robinson • November 24, 2017 4:16 PM

May the victims and those who love them find peace.