Schneier on Security

Clive Robinson • August 16, 2019 11:54 PM

@ gordo,

With regards,

data privacy laws can render disinformation a weapon without a target.

From the first article,

It’s by no means a new thought but certainly one that is more rapidly coming of age (to late for many).

Whilst some have been doing the likes of turning off cookies and javascript in their browsers, or others who have run filters that do similar, both of which has helped reduced the leakage of PII, other things such as “source address” still leave many individuals trackable.

Those that track people can and will argue that “source address” are not “private” as they do about many things they can use to track people. My concern is even more invasive service provider tagging will become a norm. As the service provider “would own the tag” not the user it provides the data collectors with alternative methods to track users.

That is you have no control on your communications when it has gone into the first router upstream of you that you do not control. The person who does control that router can “tag” your communications in a number of ways. In the case of service providers they know at their “first router” exactly who you are from their business records etc. Thus any “business relationship” between a service provider and one of the big Silicon Valley Corps should be treated with suspicion at the very least.

But as you probably know with the likes of Google getting into supplying backbone and key infrastructure of the internet a whole load of things become not just possible but probable.

For instance DNS and other infrastructure services for resolving destination information of a users communications.

If Google become the hidden partner of African Service Providers the service provider can direct all DNS requests to Googles servers along with an identification tag. That would then enable them to build a profile almost as good as they currently do from other methods. And there is nothing personally that the average user would be able to do.

As has been shown with “Anonymized Medical” and similar records, they can almost always be de-anonymized with a second or third set of data. Service provider tagging would provide such a second set of data…

Therefor any network architecture that facilitates tagging or similar has a high chance of de-anonymizing users outside the control of current legislation.

Thus we also need to reconsider how the Internet currently works as well, and redesign infrastructure services to reduce the ability of such tagging to take over from other PII as and when it gets blocked by the use of the EU GDPR etc.

Thus I also echo the thought from the second article of,

I doubt we will even get rid of the problem if the business model of online services is not changed.

Which I suspect will only happen with infrastructure changes to prevent tagging type tracking and de-anonymizing wia second and third data sources.

Clive Robinson • August 17, 2019 4:02 AM

@ cilo,

With regards Firmware security and the quote,

“Nobody is trying,” said Sarah Zatko… “We found no consistency in a vendor or product line doing better or showing improvement. There was no evidence that anybody is making a concerted effort to address the safety hygiene of their products,”

I would argue that not only is it not just Firmware in consumer / SoHo products from the likes of “Linksys, Netgear” etc but it covers most if not all of atleast two other sectors,

1, Telecoms from the current 5G future back into the 1980’s software driven POTS exchanges.

2, Almost anything and everything you would call “IoT” or all but a few “Smart Devices”

But it’s not just what most would call “Firmware” it goes deep very deep below the CPU level of the computing stack in SoC’s down to the state control logic in hardware.

It’s all evidence of the “Free Market” issue of “Tail spin” where the only way to make profit is to cut back on every cost possible and speed up entry into the market. And Software from logic control state machines upwards through to the highest of high level languages are all targets for “reduced cost” because “testing” has real cost and time penalties. Thus we see lots of heredity code issues from the likes of “code reuse” of previously not fully/correctly tested code.

You can not build strong walls on weak foundations, no matter how much rubble you use from previous walls that have broken.

As for IoT most of the people developing that code have got other highly insecure ideas in mind… That is move the bulk of the functionality off device to some remote computer hardware a few thousand miles away. That is they gather all your PII and process it on their computers which obviously conferrs significant advantage that Amazon[1] amongst others are apparently not frightened to exploit into other more lucrative income streams. Hence US Law Enforcment can now see out of your front door across your garden and see your opposite neighbours…

[1] https://theintercept.com/2019/02/14/amazon-ring-police-surveillance/

Clive Robinson • August 17, 2019 5:33 PM

@ Sherman Jay,

Tux for all and all for Tux

Hey what about the “box/blow fish” or “The little devil”?

The reality is all OS’s and most applications have vulnerabilities regardless of if they are closed / open source mainstream / niche. Thus it’s asking for trouble connecting them to the Internet in the first place… Hence a CD/DVD in an old computer without “Flash ROM” is the way to go where you can. Buying old desktops with CD/DVD drives can be done for less than 50USD and pulling the hard drive out a sensible thing to do anyway.

The hard reality though is all these vulnerabilities are in reality the price we pay for “convenience”… Which usually means hugh mostly pointless UI’s that drag around more complexity that the ghost of christmass past has chains. Or put more correctly “Is a disaster that has already started” and the AV suppliers are at best in a “Red Queens Race” at worst falling behind attack developers.

Thus you are actually doing yourself a favour by ditching the complexity where you can. Back even a few years ago personal computers were “resource limited” thus complexity then had to be less to have any chance of working. Whilst going back in time as it were by just having the command line and basic utilities may appear daunting to many, generally it’s not that bad.

My only real beef is “editors” vi and emacs I never could get on with. I cut my teeth on WordStar in the early 80’s and I still use version 4 of it off of two floppy drives today. On old hardware where the clock speed is measured in thousandths of a GHz but still cuts the mustard performance wise. Heck even the editor in Microsoft Basic works OK for me, and whilst I don’t crack out text documents in debug any more I’m still a “line editor” type of person.

The advantage of that old kit, is that you can also use it as a serial terminal and put your own “mandated check point” or data diode in that you can build yourself using cheap microcontroler development boards.

Whilst I’m not a ludite I also don’t have any realy problems using the user interface on modern Office applications. WYSIWYG is not realy my thing and it all just gets in the way or gives umpteen “time wasters”…

Which is why I still use an ordinary text editor then use the Word-Pro like we once used to use desktop publishing apps. There is a time and a place for everytging and DTPing every sentance you write as you write it is not productive.

I’ve actually noticed that other people should work that way as well. Because they fall into the make the sentence / paragraph look pretty trap as well… What you should do is “brain dump” in as much in the way of written words as you can, say five to ten pages or so in a day. Only when you have a chapter or section in and saved away go back and chop it about to make it read more coherently and to form basic paragraphs etc. Then go on and do the next ten pages or so untill you’ve got the next section / chapter done, wash, rinse and repeate untill the manuscript is done. Then and only then waste time if you have any on “beautifying it”. Better still get other people to read / sanity check the manuscript as a draft first. Because they are going to be happier criticising what looks and feels like a rough draft than a finished work.

Clive Robinson • August 18, 2019 6:43 PM

@ Bruce and the usuall suspects,

Early this morning (UK time) the town of Didcot in Oxfordshire suffered a major power cut that also affected other areas.

The reason is perhaps a little odd… Outside of Didcot is an old Drax B Coal fired power station that is very slowly being demolished. This morning they were blowing part of it up, and as always such things become a public spectacle.

The problem is that the adjacent power lines are still in use… Which is why the power cut happend.

Thus the question is where the short happend and how. When you think about possible “domestic terrorism” you realy need to know…

The two theories currently are,

1, Debris from the demolition caused the power lines to short together.

2, A drone flew into and shorted out a substation / power line feeder and got vaporised.

Yes drones, apparently there were several there to record the demolition, including one guy “live streaming” from three of the larger professional drones…

From talking to a couple of eye witnesses that were there to watch the demolition, the second option appears to have some credability as they saw a low down flash below the hight of the power line where a drone had been just a short while before.

https://www.oxfordmail.co.uk/news/17844534.power-cut-across-didcot/?ref=twtrec

It will be interesting to find out the actuall cause eventually.

Either way, it appears it does not take much to bring the now fragile UK power infrastructure down. If you combine this and the two generator fail problem from the other week, then it looks like it would take very little to bring down a large part of the power capacity of the English main grid… Something that should be cause to make people think…

Clive Robinson • August 19, 2019 5:59 AM

@ Ismar,

… but would not this technology be dangerous to use in an airport environments as it may interfere with the legitimate GPS signals used by other systems in the area?

Yup it will interfere quite a bit.

How badly depends on the type of TX antenna they use, at 1.5GHz there are quite a few options.

High gain yagi’s are quite directional, thus reduce the needed output power required. Unfortunatly they have a couple of issues, firstly you need to have not just azimuth but elevation tracking to get on target with the drone. Secondly they also have side lobe issues, one way around this is to make a Log Periodic antenna then add yagi style directors to get increased gain and directivity.

However personally I’d use a backfire or corner reflector or curtain array on a large plane reflector. As these don’t have as many side lobe issues whilst still giving gain and directivity.

However as the authors point out in their paper (and Gatwick Airport indicated) once a drone is detected in the environs of an airport it shuts down outbound flights and holds or diverts inbound flights.

Thus the question arises of the “Command Control Loop” response time. That is how long from first detection before shutdown is achieved and secondly what other margines are required to reduce or eliminate false triggering.

But what is the difference between false triggering and Denial of Service type attacks? In theory the way some of these anti drone systems work all you would need is a bottle of helium gas, a bunch of mylar or other metalised ballons and a bunch of tiny transmitters that look like the link back on a drone system, such transmitters would use less than $10 of components… Experience tells me that a low end PIC microcontroler to generate fake data an overtone xtal oscilator and single transistor PA giving 10-100mW is all you realy need. But if you are technically challenged you could just get an ATmega Nano board knockoff and a si5351 clock generator hat link them together and push the squarewave output into a diode multiplier followed by a MAR2/4/6 or similar “ModAmp” to do the same thing. You can find plenty of articles on the web to tell you how to do most of this, the first one to come up on a “duckduck” search was,

https://vk3hn.wordpress.com/2017/02/02/arduino-and-si5351-dds-vfobfo/

The problem with all “counter measures” be you an attacker or defender is “How far down the rabbit hole do you go?”. Back in cold war times we had ECM, ECCM and ECCCM systems and I’m guessing one or two more “counters” in some systems. Though these days ECM for attackers is about as far as the Mil fraternity go.

The thing is with drones “the genie is out of the bottle” and they are exceptional cheap compared to any counter measure. Therefor from an attackers point of view launching a half dozen drones at an airport is way way less costly than a defenders counter measure system that can only deal with one drone at a time… Thus it’s fairly easy to see who is going to win if they put a little thought into it.

Clive Robinson • August 19, 2019 7:25 AM

@ Wael, Tatütata,

I would like to say “I remember edlin” as in “the past tense”, but as it’s on all versions of Dave Cuttlers abominable “Better Unix than Unix” New Technology 32bit OS from Microsoft (including Win10) I still use it occasionally even though it’s a pain in other parts of the anatomy as well.

Remember you could always use one of the other early MS tools such as debug, that pre DOS 5 version could edit disk sectors as well as files. So you could create a file of private info, then change the flags then change the leading char so the dir etc commands would think it was deleted. Then move the disk block refrences such that it would not end up on the free block list and also you could not undeleate with the programs around at the time.

Speaking of “private files” on NT Microsoft also added the “Alternative Data Stream” feature to be a rival to an Apple file system feature, for enriching a file into a multiple file object. That is “colon files” most documents say colons are “illegal characters” in MS file names. They are not under NT where the ADS feature originated, they have some quite handy features if you know how to use them. But are a right royal pain if you do not, hence the most common question you see is “How do I remove filenames with colons in them?”[1] where someone has unzipped etc unix or other OS files where the colon is just another acceptable file name character.

https://en.m.wikipedia.org/wiki/Fork_(file_system)#Microsoft

It’s funny what creaky things exist in memories from much younger days…

[1] Unix has an inbuilt trap for the uninitiated. The shell has a series of “substitution” methods (see shell escaping) for chars so it’s possible to put control charecters etc in file names… Or worse pull them off of an NFS server etc from a different OS. However whilst the shell sees \ as a special charecter, \ is a valid file name char… The way to remove or change the file name is to do a long listing with the inode flag (ls -il). Note the file inode number which is in the first column of the file name list, and substitute that in the find command… Find is a bit of a comolex beast to use,

https://www.cyberciti.biz/tips/delete-remove-files-with-inode-number.html

Importantly remember inodes are not file names so you may have problems if the file had multiple links to it.

However some versions of “rm” have the -i for interactive mode where you are asked the yes or no question for every file.

Clive Robinson • August 19, 2019 8:38 AM

@ Sherman Jerrold,

Hmm lots of questions, I do have consulting rates 😉

Joking aside,

Your more in-depth comments lead me to the question: if I go into setup (BIOS/UEFI) and turn-off the HDD controllers (IDEor SATA) before booting from the CD/DVD live o/s, will that keep the HDD unavailable for malware infestation?

It depends on if they are built into the BIOS image or pulled in off of the IO device ROMs, or if the OS you are loading pulls them in. I assume that for any given hardware “I don’t know untill verified” thus in most cases pulling the HD is the way easier method to play safe. One way to do this if you can still find them is “HD Trays” which people used to use to lock their hard drives in fire proof safes at the end of the day.

Since you have shown us that there are a lot of ‘unlocked doors’ in any motherboard, how likely is it that most malware in the wild will go to the trouble to find and use such relatively obscure ‘unlocked doors’?

That depends on the attacker, if it’s your run of the mill coin miner or ransomware idiot it’s unlikely. However if you have become a “Person of Interest” because some idiot name on the No Fly list etc matches yours then it becomes more likely. If however you’ve become a “target” then the possability goes up yet again. However if your attacker is from a Western IC or SigInt organisation they may just stick to monitoring your traffic from an “upstream router” either your home router or the ISP router. Those attackers doing APT will go for what ever foot hold they can so would target the non BIOS Flash first then BIOS Flash then the hard drive. Because at the end of the day, reinstalling a hard drive is quite common, upgrading the BIOS happens, but upgrading other Flash only the paranoid do that 😉 So the other Flash if they can get into it gives them a much higher probability of going not just undetected but more importantly installed. However what they will put in there is just a “loader” so they can then put what looks like everyday malware on the hard drive to cover their tracks if it’s found.

Also, my ‘air-gapping’ involves keeping the internet connected computer at least one or two rooms distant from any other computers. I have been hopeful that since my computers are always also acoustically/vibrationally isolated by that distance that would prevent a lot of mischief. Do you concur?

The use of acoustics is limited by the sensitivity of the receiving transducer, noise in the used audio spectrum at the receiver and the power from the transmitting transducer. Whilst laptop to laptop will work in a twenty foot range without any specialised coding, a high power TX transducer put in some other part of the building may reach the laptop even though the laptop can not communicate back. Theoretically this alows the laptop to be triggered and then say turn on it’s EM communications such as Bluetooth, WiFi or even mobile phone. Practically I’m not aware of anybody doing it “yet” but now it’s been said someone will probably do some experiments. But whilst that 20ft is for “uncoded” communications you can trade bandwidth for distance thus halve the bandwidth double the distance and so on. In Amateur Radio it used to be the case that the minimum bandwidth was 30-50Hz with a good CW filter. Now however there are the “Whisper modes” that work some -30dB below the CW noise floor. Thus the software is out there for people to study and make work with audio…

Conducted vibration is always problematical, I don’t know where you live, but in Southern England railways are quite numerous including the trains that run on them. You can be in the “countryside” at night and if in a field close to the railway tracks hear the rails “twitching/singing” as they radiate out some of the conducted energy from a train still five miles away. Using an electronic stethoscope actually stuck to the side or underneath of the rail you can hear other things such as points changing and importantly “bolts breaking” from considerable distances.

Similar problems occure with EM signals. It’s been known that the low power MF signal from a cordless phone of just a few milliwatts that is supposed to have a range of no more than 50-100meters has been picked up more than 300 times that (~19miles) distance, because both the cordless base and the receiver that picked it up were close to a conductor such as an overhead power cable or even barbed wire fence. I’ve experienced similar issues when experimenting using barbed wire stranded fences as antennas for both transmitting and receiving when operating portable (look up Beverage antenna https://en.wikipedia.org/wiki/Beverage_antenna )

Thus whilst your “air gap” may be working, it might not depending on the building and surounding environs. Which is the reason TEMPEST kit is big bulky and heavy. The requirment is “To ensure Emmission Security” thus the use the “bolts and braces” method of metalic shielding and absorbing materials on shock mounts etc to “Ensure” rather than “Assume” communications security. It’s the same policy with SCIF’s.

Clive Robinson • August 19, 2019 9:56 AM

@ Anders,

Pre-2000 computers are also vulnerable to persistence
hiding… they don’t have flash rom but eeprom, which is also rewritable.

You wabt the long explanation rather than the short 😉

The late 90’s was a transition phase. The standard ROM be it rewritable or not came in a “Byte-wide” 0.6 DIL package.

The down side of the non rewritable ROMs was inventory costs even those that were not “mask programed” they were still usually “bulk programed” outside of the motherboard manufacturer.

EEPROM memory became available in byte-wide format and as indicated some but by no means all motherboard manufacturers moved over on their high end Pentium systems.

There were problems with EEPROMs in that whilst their “read” behaviour was standard their “programing” behaviour was quite different from one chip manufacturer to another. Also quite a few motherboard manufacturers did not “route in” on the PCB the electronics required to do on-board programing. There is a coralation between the rerouting and USB ports, if a motherboard does not have USB and as long as it’s not from Dell then the chances are you won’t have one that is vulnerable.

Whilst CIH was quite devastating to any hard drives it came across unless they were large FAT32, it was actually not very successfull at overwriting BIOS chips. Those it did were usually scrapped because the motherboard manufactures were then not set up to deal with the problem. So the effected boards mostly could not be repaired so were in landfill befor Y2K.

Whilst it did happen, comparatively it was only to a small number. The reason for this was the disparate nature of the then Byte-Wide EEPROMs program cycles made it quite difficult to trash let alone overwrite.

And that problem still exists, any malware getting onto such a motherboard can not determin which type of EEPROM is on there thus reprograming is going to be hit and miss at best. Which is not at all good if you are trying to do covert APT. Also as the motherboards effected were high end and had what is now a compleatly unsuported IO bus architecture, even seeing such a board would be quite a surprise.

Business desktops of the time tended not to use such motherboards or even EEPROM and it’s only those boards I see from that era in the past decade or so.

Basically back then when business machines got EOL’d staff used to get to take them home which is where they have lurked since then. But at the end of the 1990’s abother change was happening, organisations started outsourcing IT and this ment the desktops were nolonger owned by the companies but the outsorcers. The outsourcers had the bulk monoculture that they could actually get real value out of them and they used to run or use businesses that made money selling them on to places like Africa, India and Russia (where nobody looked at the software licenses etc).

It’s actually now quite difficult to find 486 and first generation Pentium motherboards or even ISA I/O cards, I have a stock of them just incase my own machines have a failure.

Which is why I mention the use of modern microcontrolers for making mandated data pumps etc (thing data diode on steriods doing protocol and data level inspection rejection). If you write the code yourself or modify somebody elses code the chances of an external attacker being able to hack it are very small. Which means if you are a “target” they will actually pay you a visit, so it’s physical security that then becomes an issue. If you look back a few years on this blog you will find a series of conversations with @Nick P and myself about putting computers into safes and how you would add thermite if you realy did want to maintain your privacy.

Clive Robinson • August 19, 2019 9:37 PM

@ maqp,

Hi I trust you are well.

Just a question about location of the TFC project files…

Bearing in mind what Microsoft did to Skype, and now appear to be poisoning Linux with FAT32 and similar patent encumbrances. Now Microsoft have taken over GitHub, and appear to some to be targeting personal private communications apps under the guise of “Export Regulations”.

Any thoughts on enlargening the number of places where the project files are stored and made available?

Clive Robinson • August 21, 2019 4:17 PM

@ Anders,

Hmm the Silence Cyber criminals presumed based in Russia.

That’s the problem, in that we don’t know where exactly they are, their money mules are based all over the place and as of yet, there has been no statment made as to what route the money then takes and to where.

As I occasionaly point out it’s the HumInt trail that we realy need pretty much every thing else is too easily subject to deception.

For instance I’m not in Russia or any ex CCCP / USSR satellite / buffer zone coubtries. However a friend up in Hammersmith West London chucks me network/comms code with Russian comments in it every so often. She has three or four coders that not just write code with Russian comments, they fluently speak Russian even though they were born in the UK as does she though she came over at the end of the cold war married and set up a business with her husband. Her programmers are third generaton descent from Russian WWII refugees that wisely did not go back.

Let’s put it this way you could take chunks of their comms code and drop it in other code… Then could you say where it had come from? Not realy and that’s the problem of non HumInt intelligence.

As any old well seasond police detective will tell you, it’s what people say and do that gives them away and starts a crime being solved, not the forensics that’s just confirmation. Such listening and watching means there can be a lot of shoe leather in it, but when that has produced a suspect you can start testing the forensics against them… Generally it’s best to have the horse infront of the cart pulling, not the other way, that tends to push things into going wild way to easily.