Schneier on Security

Clive Robinson • February 23, 2018 6:56 PM

@ Albert,

Does a modem with wireless capabilities use the telephone line as an antenna?

I can not say for “private network” phones as they are not regulated in most parts of the world except by ordinary consumer legislation.

However in most places POTS public networks are heavily regulated and standardised, they have to be for genuine safety reasons[1]. Of the top of my head I can not remember seeing any standards or regulations that would alow the 2/4wire interface to be used that way either before or after the “demarc” between the public network and consumer premises wiring. In fact I can remember a few standards where it would very specifically not be alowed or the standard tests would be failed with the EMC etc masks.

I’m not sure why you asked, but many DSL and ADSL modems do put out some very high frequency signals. That said they should be using a form of “whitening” which works like a Direct Sequence Spread Spectrum (DSSS) system to spread the data signal energy widely across the available bandwidth to prevent quite a few issues.

[1] There are also “faux safety reasons” put in place by international and national standards “finessing” by those “in the know” of current domestic or equivalent inteligence agencies.

Clive Robinson • February 23, 2018 7:56 PM

@ (required),

A: If it did, you’d hear a ton of static on the line all the time.

It might be clear in your mind what you are commenting on, but I guess the other posters on this thread have at best only a hazy notion as to what it is.

How about giving a little hint by addressing the person by handle and quoting what it is you are responding to?

Clive Robinson • February 23, 2018 8:19 PM

@ All,

The two lead researchers brhind the “adorable” bobtail squid and it’s relationship with the light emitting bacteria, Dr Margaret McFall-Ngai and Dr Ned Ruby, have their own website called “Glowing Squid”,

http://glowingsquid.org

It has some quite fascinating articles on it. And yes many people think the diminutive bobtail is adorable / cute ignoring like they do with cats that it is a preditor.

Also that it will eat not just a close relative (octopuses) but like other squid even it’s own kind, which is most definitely not adorable or cute behaviour… But don’t let that put you off 😉

Clive Robinson • February 24, 2018 3:04 AM

@ tyr,

nobody knows until that moment what they are. All of the trappings they wear won’t make them a hero unless their heart can do it.

Very very few are capable of instant action, then it’s likely to be wrong. Because more than ten thousand years of disapearing up a tree at high speed takes condiderable, expensive and repeated training to over come.

I’ve found that out myself the hard way, luckily those I faced were considerably more inept than I was and, I was still alive to consider another day.

On other civilian occasions such as road accidents, I responded and did the right thing without thought due to training, only to have cold sweats the following day and many nights there after. Even if you are not a hero just following your training has costs few would even realise existed untill they have been through it. It’s when you find you need not just friends but commrads forged by similar experiences.

Clive Robinson • February 24, 2018 8:13 PM

The ease of getting CA certs for malware

In some respects ie “signed malware” this is not new news. But the methods and details given should make people realise that the whole CA pyramid is easily computable, thus pointless as a form of security, and long overdue for replacment as it can not be fixed as a problem,

https://arstechnica.com/information-technology/2018/02/counterfeit-certificates-sold-online-make-digitally-signed-malware-a-snap/

Clive Robinson • February 24, 2018 10:08 PM

@ Albert,

I’m still not 100% about what you want to do.

As @hmm and @Sancho_P have indicated above the old POTS lines are actually capable of carrying some quite high speed thus frequency data, in some quite complex systems.

The reason the POTS line can do this is two fold. Firstly it is a “balanced transmission line” secondly it is “twisted” which makes the balance considerably easier to maintain thus issolating it much better from it’s environment.

Importantly even if you had very qood test equipment –like a low noise spectrum analyser– measuring even quite high power signals on the line from outside it would be dependent on the inbalance on the line more than anything else…

Worse as I mentioned they use “whitening” which acts like a form of DS Spread Spectrum (DSSS) which lowers any “energy / Hz” by spreading the energy across a very wide bandwidth thus droping it “below the grass” of many test instruments.

However… Low cost hand made test instruments will in some cases work better. One such is the amplified diode detector.

Ordinary diode detectors are just “broad band envelope detectors” with no gain thus quite high detection thresholds but importantly even cheap silicon signal diodes like the 1N4148 diode can work up into the low end of the UHF band. More expensive but still cheap Shottky detection diodes will work into the low end of microwaves and more specialised expensive ones work up to near 100GHz.

You can buy quite cheaply “ModAmp” broadband matched impeadence broadband surface mount amplifers that do near DC to 6GHz for around a dollar from the likes of Mouser and Digikey that will give upto a ten fold voltage gain, thus making any diode you do use after it ten times more sensitive.

But if you look back half a century “diode detectors” were also made more sensitive by using tuned circuits as voltage multipliers. That is if you have a parallel tuned circuit of reasonable Q you can take a tap point near the “earthy end” which would be about 50 ohms and take the diode up several tap distances at the 1-5 kilohm impeadence thus getting a “power match” which gives you a passive voltage gain as well as increased selectivity. You can find such circuits by looking for “poor mans spectrum analyser” which replaces the mechanically variable capacitance with an electronically variable one known as a “varicap diode” which you then drive with the output of a low frequency audio “sawtooth waveform” generator from the likes of an NE555 timer chip. You feed the sweep voltage into an oscilloscope Y input and the output from the detector diode to the X input. This was infact the way early spectrum display systems for EW etc worked.

The detector diode can be made more sensitive by “DC bias” put simply you “add in” via a high value inductor on the RF side a small DC voltage that is temprature compensated that provides a “forward bias” to the diode this will up it’s detection sensitivity by a factor of ten with care. Such a temprature compensated bias source can be made with just another diode of the same type as the detector diode closely thermally bonded and an Opamp circuit even an old 741 chip will work well. Speaking of Opamps you can put one on the DC side of the detector diode to up it’s effective impeadence thus lower it’s negative effect on the Q of the tuned circuit whilst giving a low output impeadence to a following signal amplifier.

Which brings us to the question of “log amps” –expensive– or RSSI detectors –cheap– that will provide you with a logrithmic (decibell) output from the detector.

NXP that used to be Philips make the SA602 and SA604 that were based on Plesse parts. Though you often see them as “NE602” and “NE604” parts in circuit diagrams. If you look at their data sheets and application notes you can see they are easy to use, thus loved by amateur radio/home constructor/ maker types but also have an RSSI output,

https://www.nxp.com/docs/en/application-note/AN1993.pdf

These chips were used to make a poor mans spectrum analyser with the outputs going to the left and right audio inputs of a PC sound card. There was a circuit and software published by Elektor magazine some years ago based on a Plesse application note from the 1980s (IIRC writen by Peter Chadwick). Various versions have since been made and put up on the Internet in various places, and somebody used to sell one commercialy.

Thus you can with a little skill at home electronics construction make yourself a suitable piece of “low cost test kit”. However calibrating it requires other test kit which again you can build. Such as a VCO driving a 74ACT family inverter/buffer feeding a surface mount resistor divider to give a 50ohm output at a fixed power level that you can then feed into home made antennuator strip to give lesser but more than sufficiently accurate levels to calibrate your detector.

There is the old saying about “A poor workman blaims his tools”, well the opposite is “A good workman makes his own tools”.

It’s not actually difficult to “boot strap” your way upto reliable RF test kit. Both the ARRL and RSGB publish very low cost books on making and using low cost but effective test equipment.

You can with a little ingenuity and sideways thinking make equipment that is way way better than even high priced proffessional equipment. One I made was an FM modulation meter, proffessional kit of the time used quite complex and sensitive analog circuits… I thought “s0d that” and designed a partial the fully digital version based on a “Pulse Count Demodulator” using three 74 family logic gates for the detector that easily outperformed any proffessional kit you could rent at the time. They were at best 200 to 1000 parts per million(ppm), mine when using an ordinary XTAL was better tha 1ppm and with a cheap 10MHz “off air” standard beter than 0.01ppm and even more so if you had access to better time/frequency standards.

Such is the way of the world, you make one good bit of kit and then use it to leverage up other bits of kit till the point you have kit to rival the proffessionals.

I’m currently thinking about how to improve a design of “Vector Network Analyser” for “big signal” not “small signal” analysis. What I designed originally used a modified VSWR bridge meter as the detector head. Effective as it is for designing RF Power Amps in the 20Watt and up range and rapid switched Antenna Tuning Units for HF frequency hopping/agile systems with “random wire aerials” the “directivity” of the directional couplers hold it back for other work 🙁

Clive Robinson • February 26, 2018 12:43 AM

@ maqp,

I’m taking for granted attacker is able to exploit an up-to-date OS with a click of a button.

After the release of some of the NSA tools and the subsequent malware attacks based on it… I would say “I’m taking for granted” is how should I put it an “understatment”.

Personally I’d take it “as a given” when doing any kind of security design, and that is not just because of the incredibly poor record of commercial OS design.

It’s becoming clear with the likes of the Jupiter Networks key leakage that certain people are directly developing implementation side channels in security products. Further that they also directly targeted standards with a similar key leakage attack. But also as with the AES competition they were able to rig it such that “side channel” infested code would end up in all but a few implementations of AES. Importantly those “few” would be the sort not to use AES in “on-line” mode anyway. It’s why the NSA only rate AES for “data at rest”.

With regards design of secure systems the old adage about “You are not being paranoid when they realy are out to get you!” applies. The TAO is a fraction of the NSA yet they are very clearly out to get everyone they can every which way they can. Likewise Blufdale shows “Collect it all” is most likely about as true as it gets on the information available. The turn up of those phone calls from Russia and Israel kind of lends weight to the idea of “collect it all”.

Thus even the little old lady down the road does not have to be paronoid to think they are out to get her words, she might blaim her cat but it does not alter the fact thay her words are being stored.

One of the major mistakes designers of security systems make is “going with the accumulator odds”. That is the old mistake of multiplying individual step odds such that ten, even odds steps, becomes a one in one thousand chance, thus can be treated as such. When dealing with a sentient opponent it’s only the “weakest link” odds that count. Thus those ten even odds steps just stays at even odds, because that’s how hard it is for a sentient attacker to attack each part of the system. It might take them ten times as long but then they can throw in ten times the resources to get that time back.

That’s how you have to view things when doing security design, and trust me when I say that thinking that way hurts but it is necessary.

Try looking at it this way, there is a big treasure chest with ten entirely different locks on it each requiring a different length of time to pick. You bring in ten lock picking experts and asign each a lock. The chest will be open after the hardest lock to pick is picked, not the total time to pick all the locks.

Thus if something can be done to attack a system it will be done in parallel with all the other somethings that can be attacked.

Clive Robinson • February 28, 2018 5:48 AM

@ Bruce and the usual suspects,

You might have noticed over the weekend things have got a little fraught in the Crypto-Currancy arena.

It appears that there is a bit of a difference of opinion over IOTA and security researchers that has gone acrimonious with those on one side threatening the other with lawyers…

Anyway even the IEEE is commenting on the much increased volume of claim and counter claim which is not normaly a good sign…

https://spectrum.ieee.org/tech-talk/computing/networks/cryptographers-urge-users-and-researchers-to-abandon-iota-after-leaked-emails

Whilst some push and shove is expected in a newish technology, Crypto-Currencies are getting to be a severely disruptive technology for pretty much all the wrong reasons.

Clive Robinson • February 28, 2018 6:27 AM

@ Thoth, all,

SAML is used to enable Single Sign-On [SSO] services and for security services to communicate with each other and the vulnerability would allow a well placed XML comment tag be mis-parsed and thus gaining access to an account.

It’s not the first nor will it be the last time XML based systems will have security faults due in part to it’s complex nature

As for SAML SSO it’s also a “centralised” security system. Centralised systems are also generally a problem when it comes to security systems. It’s not just the hierarchical nature that is a problem, it is also the “all the eggs in one basket” as well.

But it also causes more human issues as well. One is that cetralised systems act not just as “magnets” but “power domains” for owner / operators. Thus there is an over incentivisation to put as much as possible into a central system often when things are not a natural fit. This almost always increases complexity which brings with it the likely increase in problems thus potentially security vulnerability.

But it also has a “lowest common denominator” effect on users. As we know people are incetivised to make their work processes more productive, which from a security perspective usually means weaker security. Thus centralising has a multiplicative effect. A user would most likely pick the weakest password the central system will let them get away with which will likely be the lowest common denominator of all the protected system policies. But worse they will share passwords… Thus the security of not just one but all protected systems fail…

Such is the way of the world, SSO whilst reducing user stress also tends to decrease security.

Clive Robinson • March 1, 2018 8:34 AM

@ terryG,

have you considered using a 6-port reflectometer?

I have looked into them but they have a number of problems. Firstly they use five directional couplers in each of the pair of six-ports. The second problem is that they use slotted lines on the four measuring ports, each with three sample points that need to be in a reasonable phase arrangment.

It’s the directional couplers (DCs) that are giving me the problems, in that transformer or transmission line DCs only give around 30dB of directivity and don’t have much more than a two or three decades of frequency coverage unless you use considerable care in construction and the shielding used. But with a little thought they can handle upwards of a hundred watts without problems and have very very small insertion loss.

You can however use resistive DCs which is what most commercial VNCs use, they have good directivity and very wide bandwidth thus are ideal for lab bench test kit for S-parameter measurments etc. However they have a high insertion loss as they are in effect resistive Wheaston Bridges that need to be made with very small surface mount devices with max power measured in fractions of a watt, thus are small signal device measurments only.

Where the Six-Port Reflectometer (SPR) realy comes into it’s own is in Built In Test Equipment (BITE) for transmission systems where you can fiddle things a bit and end up using a slotted line with a built in DC to take a refrence level from and then three point probes on a slotted line. Such arangments have a negligible insertion loss and very wide power range and are working in 100KW peak output multichannel systems used for telecommunications etc. They have the advantage of not requiring much in the way of calibration once set up, thus can be used for very long periods of time.

So the choice falls on the usage. From what I remember both NIST and the French standards people still use and develop SPRs for internal use with NIST switching over to using Agilent VNA’s they calibrate internaly for customer calibration as they are faster to use and require less manpower.

Clive Robinson • March 1, 2018 10:13 AM

@ Thoth, All,

More bad news for the Intel SGX Enclaves as more Spectre hauntings targetting Intel SGX enclaves emerges.

Ahh Spector and Meltdown, those Xmas gifts that just keep giving and giving… And as I’ve said will do for some time to come…

Seriously though from a security aspect are they realy any worse than the Intel Managment Engine as a method of backdooring the security of your privacy?

In both cases the bottom line is just about anything that is in core memory becomes available to the attacker…

Thus if you have anything you wish to do privately you are going to have to take a whole bunch of precautions to put your computer out of range of an attacker… Time to think about the likes of having an “Off line/grid” computer building SCIFs, “energy-gapping”, “paper and pen crypto” and “Old School trade craft” as taught at all the best Government Sponsored IC agencies…

Clive Robinson • March 1, 2018 6:49 PM

@ Milo M,

With regards,

‘If ultrasound is to blame, then a likely cause was two ultrasonic signals that accidentally interfered with each other, creating an audible side effect,’ Fu says

I would remove the word “accidentally” from that and it was my first thoughts on hearing about the afliction the diplomats suffered.

As I’ve mentioned a number of times before on this blog, back in the last century using two ultrasonic beams with a frequency difference that matches neurological waves were investigated to be used as a “nonlethal weapon” for crowd control in the UK.

So Fu and his colleagues have not done anything new in that respect.

What they have not mentioned is how you get a very narrow beam at distance. Back in WWII the Germans had a radio navigation aid which translates as the “Crooked leg”. It used two transmitters into two high gain antennas that were nearly but not quite parallel. Thus only the edges of each divergent beam were in common. On transmitter played dashes of 2/3rds on 1/3rd off the other dots 1/3rd on 2/3rds off, where the beams crossed you got the dots filling in the gaps of the dashes thus a contiuous tone.

Two high gain transducers carrying around 20KHz arranged so the edges of their beams just crossed would produce a long narrow beam of the difference frequency of the two signals. If the beams are modulated correctly then on hitting a nonlinear surface like skin the two beams would multiply giving a sum and difference frequency.

The difference frequency if the same or very similar to neurological frequencies would then cause stimulation that would in effect override the bodies frequencies via a process called “injection locking” which as discovered with pendulums will cause them to synchronise.

Experiments have show that itches and similar can be stimulated causing people to scratch themselves raw. As others might know there are two cardiac rythms that can be quite dangerous Atrial or Ventral fibrillation (AF and VF) one of which is usually fatal within a very short period of time unless treated. Also there are waveforms associated with epileptic attacks etc.

So whilst I would tend to rule out “accidental” on a lack of power and difference frequency basis, I would not rule out a weapon of some sort.