Schneier on Security

Clive Robinson • September 1, 2019 6:10 AM

@ MarkH,

It’s unknown whether the explosion originated within the nuclear propulsion system, or had another source on the salvage vessel with the unfortunate consequence of dispersing intense radiation.

Based on what we know from US research with Pluto and Tory it is probably safe to assume there are actually two propulsion systems. The first to get the second upto hypersonic speeds.

An compact high thrust to weight ratio propulsion system with a large enough specific impulse to get up to hypersonic speeds would in essence be a bomb in it’s own right using highly volatile fuels etc.

I actually suspect that it is a three propulsion system, that is using what is in effect a three stage system. The first say solid fuel to do the basic lift and get the acceleration up to the point where a liquid fuel system can take over. Thus a bit like the space shuttle but smaller. When up to what would be hypersonic speeds it would then switch over to the nuclear based propulsion system.

Thus I would guess that the recovery process somehow triggered either a chemical explosion or somehow caused the nuclear propultion system to go critical for a short while before stopping catastrophicaly.

A spike followed by a return to low levels tends to suggest it went critical some how for a short while.

Clive Robinson • September 1, 2019 11:35 AM

@ Tatütata,

The whole thing is absolute madness.

I cup my hand to my ear and listen carefully straining every sinew taught as I listen yet I can not here a voice that disagrees with you 😉

The system by the way is not designed to land… The Pluto if it had ever got to the point of flight tests would have run for months if not longer before the fuel ran out. The resulting hulk nobody and I realy do mean nobody would want within several hundred miles of them as it would be “hot” for a thousand years or so at the very least.

The US stopped development after seven years, not because they had any concern about the nuclear waste, or killing everything for miles with neutron radiation. But believe it or not concern the then “rational actor” CCCP leaders might become as irational as the US and develop their own in a kind of “Space Race II”…

Well it looks like the current Russian leaders are not as rational as their forebears were. I could make some guesses as to why but although it’s a valid security concern it’s a “Human” on e rather than a “technical” one.

Clive Robinson • September 2, 2019 3:48 PM

@ VinnyG, Tatütata,

re: Rolls hood lock – That particular story may be apocryphal, but it nevertheless has an element of plausibility.

I heard about this nearly half a century ago from my dad as one of my relatives had had the problem, and it was not “being locked” that was the actual problem.

Quite a few years before that when both R’s were red and vital, you did not by a Rolls Royce, but a Bently – Rolls Royce or similar. That is Rolls Royce built the engine and hard chassis and Bently or some other coach maker built the body work for you either directly onto the hard chassis or onto a floating chassis that was bolted to the hard chassis.

For the most part the body works were a standard design with some custom finishes etc. But some were almost entirely “custom” and some owners had more than one set (my great uncle had a set of bodywork with special tubes running down the length of the body work to take several fly fishing rods that were 18ft long). So some coach makers of highly custom body work couldn’t / didn’t provide regular or even easy access to the engine or transmision due to customisations. Thus repairs nescescitated removing the body work, which was in effect on a floating chassis on top of the Rolls Royce chassis. So not a particularly difficult job to do if you had an inspection pit and gantry hoist etc to do it, not just safely but without scratching the body work. But back pre-WWII few driver/mechanics –which is what a chauffeur was expected to be back then– or village garages –which were little more than a single petrol pump and a part time attendant who was also a blacksmith or other hot work tractor mechanic– had them.

Post WWII this had compleatly changed due to not just surplus military vehicals, but surplus military personnel who were fully trained mechanics used to working with standard parts on larger vehicles where pits and gantries were a requirment to get them bacj to the line very quickly.

The “Haulage Trade” had become a nescesity as during the war the British Government took over the railways and effectively knocked the stuffing out of them and left the serverly delapidated, run down and in many ways unusable by the public. Worse due to certain Ministers having significant interests in Haulage and road construction, the railways were starved with prefrence being given to road construction. This however was still not enough for one self interested Minister who actively attacked the railways and culminated in the “Dr Beeching Report” which was an organised stitch up for which Beeching was very significantly rewarded for (with a salary two and a half times that of equivalent civil cetvents and significantly above that of the Prime Minister and later a Baronessey[1]). This carried on later woth Margaret Thatcher doing even more significant damage, which we are still stuck woth today along with some of the most expensive regular fares in the world (and because it’s so screwed up also some of the cheapest special advanced fares…).

[1] There is still argument half a century later as to the effect Beeching had, some say it was inspired but badly implemented by their successors[2]. The reality was it was political not financial or sound. Beeching quite deliberatly ignored the social asspects or the increasing passenger numbers where the rolling stock was not compleatly delapitated. The simple fact was the country was still in the late 1950’s still in a very unsettled post war state due to the starvation of investment. Thus the figures Beeching used did not reflect the changes that the lead into the 60’s was bringing. In fact some claimed fairly realistically that Beechings cuts actually reduced mobility of the work force causing significant labour problems that lasted well into the 80’s that actually significantly hampered economic development, whilst those in Europe that had made other choices had outstripped not just Britain but the entire UK in economic prosperity.

https://en.m.wikipedia.org/wiki/Richard_Beeching

[2] A point I’ve made before is that you start a grandiose project and about a third of the way in you jump ship. Because if against all common sense it succeeds then you can claim it’s success as beingvto your vison and laying of solid foundations. If however it does what most gradious projects do whichvis fail to even reach the most basic of objectives, you can claim the failure was due to the timidity / incompetence / etc of those who took over from you. So “Win-Win” no matter how usless you might actually be…

Clive Robinson • September 3, 2019 12:34 AM

RE JavaScript,

As some here know, I decided some years ago various things in web browsers were undesirable for good and proper security reasoning.

The only two that have not yet fallen on my old list are,

1, JavaScript.
2, Cookies.

Both of which I normally have switched off.

More recently I added amongst others, HTML5 and WebAsm.

What people appear not to understand is that any programing ability within you web browser is dangerous, conversations about “sand boxes” are moot, they simply do not work to the required level for security.

Having programability open to any and all which it is in webbrowsers is arguably one of the daftest things we have done to ourselves information security wise.

It does not favour users but “pushers”[1] from the server side who are trying to infect you at all levels including your mind (see Facebook and other Silicon Valley large Corporate Research).

Thus the real question is how long is it going to take folks to “wise up” and drop such dangerois technologies?

[1] I’m using “pusher” not in the sometimes heard technical sense but in the sense related to drug deals.

Clive Robinson • September 3, 2019 6:24 AM

@ Tom,

I will add a contrary note which would apply to users such as myself whose requirements are modest.

I’ve no problem with people having different view points or different needs in terms of security levels.

One thing people need to remember is that attacking peoples computers is not just a “low hanging fruit” game it is also one of probability and network distance.

The latter is rarely talked about, but if your aim is DDoS then it is desirable to use computers close to your target for a number of reasons. Three of which are, firstly the less the distance the less options there are to stop the attack, secondly generaly the shorter the distance the greater the available bandwidth and thirdly the closer to the attacker the less others it effects which means the numbers demanding action or actively trying to stop it are reduced.

Thus your probability on that score is how far your computer is to a target and how much bandwidth you have.

More generalised “Fire and Forget” attacks are also probabilistic for various reasons. AV software is not all the same thus some let pass what other block. Also tge Internet is a “Target rich environment” thus more potential targets than an attacker has time to gain. Currently these types of attack are forming a lesser conponent of attack types, which has the consequence of making AV software appear better than it actually is. There is also the persistent rumour that Government Entities have control over AV companies in their jurisdiction thus State Level malware won’t be detected.

However there is an obvious couple of facts that people forget with the more traditional types of AV. Firstly put crudly they are only effective against attacks that the developers are not just aware of but have decided to take action against. Thus an attacker has a time window, that is more often than not dependent on how soon users see the effects of malware. This means that APT attacks that are both stealthy and covert in function could be using attack vectors built into consumet OSs and Apps that might be twenty years or more old. This is why APT tacks can get so deeply into systems.

The point is AV alone is insufficient to protect an Internet connected computer, and thus nearly all consumer computers especially those of leisure, SOHO and even SBLB entities are in the “attack lottery” and there is little they can do about it. Even “whitlisting” is not proof to fairly simple to understand Man In The Middle attacks.

It’s one of the reasons I fairly endlessly talk about using two computers, your work/private computer not connected to any network, the second a sacrificial browsing computer. With appropriate methods to move the security end points past the sacrificial computer communications end point.

The problem with “target rich” is that it has a probability function of attack. Which means the most insecure computer in the world may never get attacked… Which is just one reason people have a distorted view of the privacy and security of their systems.

Clive Robinson • September 3, 2019 5:32 PM

@ All,

From time to time I’ve mentioned some of the things the British Broadcasting Corp (BBC) got upto during WWII with the likescof “messages for our friends” that were “One Time Phrases”.

Well the BBC appear to be finally “coming out” over some of what they got upto,

https://www.bbc.co.uk/news/entertainment-arts-49562570

Clive Robinson • September 5, 2019 5:21 AM

@ Rachel,

What do you think about this being disinfo?

It’s a good question, which first needs a little bit of history.

The US was as far as most could tell badly loosing the space race back in the 1950’s and 1960’s if you watched / listened / read the Western Media of the time. The CCCP/USSR appeared to be faultlessly putting things into space every few months, whilst the US however had disaster after disaster appearing in the news.

The reality was the CCCP were actually having more and worse disasters but those were in secret, whilst the US for political reasons did things in public.

The US spent over seven years on Pluto and Tory before canceling it at what would be considered a very early stage. Russia appears to have got to “flight trials” in less than a couple of years of research and engineering. Which appears improbable under normal considerations (hence the question)

Whilst this is getting on for half a century of technology development since Pluto’s inception, the actuall technology involved has not received that much development. Hypersonic flight is to put it mildly very difficult. In essence aerodynamics becomes hydrodynamics when you cross the sound barrier and increasingly like a solid as the mach number goes up. But as with banging a long thin nail into seasoned oak you have a very narrow angle over which you can get it to penetrate without buckling up. But worse the faster you go the less time margin you have to make corrections thus manoverability is at the very least just to fly a steady course difficult. Thus at horizontal low hights traditional cruise missiles fly at you run into problems that you don’t with vertical accelerating flights of rockets. Thus something like an ordinary thermal can be a significant hazard to hypersonic navigation. But it also opens up a hole in the “invulnerable missile” argument made about hypersonic flight.

But even so we are with the best will in the world still around twenty years of normal paced engineering and material science away from hypersonic flight as a practical low level flight method. Assuming of course we ever want to go there considering the effect of shock waves etc.

So yes in “war footing” development corners are cut and envelopes pushed way beyond limits (think German V weapons etc).

Is Russia doing this on a “war footing” time scale? From the little information we have the sparse evidence points that way.

Russia sees it’s self as a ‘Resource rich super power’ and like China it can see the US has burnt it’s resources rapidly, and likewise as most outside the US see it the US is “Happy to resort to conflict to get more resources”. Russia also sees China “capturing” other areas with resources such as Africa by various means. Thus it’s not difficult to conclude that the likely hood of a new world war is increasing exponentialy with time.

So yes I can see Russian leadership beleving it has not just the US but China, Europe and India as potential aggressors thus put it’s self effectively on a war footing for the highest tech of weapons, with a globe spaning nuclear tipped hypersonic cruise missile technology being a major goal. Even though, as with the North Korean nuclear weapons and rockets, it is in reality more of a “Keep of the Grass” sign rather than a full on MAD deterrent. It is after all what a rational actor does when faced with one or more aggressors that behave as a non rational actor.