Schneier on Security

Clive Robinson • January 6, 2023 4:03 PM

100K car 63 seconds and gone.

On of the problems with all these internal electronics systems in cars, is they make then oh so much easier to steal…

https://www.bbc.co.uk/news/uk-england-essex-64151619

These are increasingly “highly organised” and very much “stolen to order” the chance of getting the vehicle back intact is fairly close to zero.

Whilst the Police do not say it, out right, they know that all these electronics being added to cars makes them easier to steal not harder.

Read down into the article where you will see they talk about “Faraday bags” and “Double locking”.

My advice, either do not buy these vehicles or go for a reliable “triple locking” of a very solid garage with very solid doors and strong locks (and don’t have internal access to the house, from a garage that’s a sure way to get a knife against someones neck).

So the safest and least expensive option is,

“Don’t buy these cars”.

Clive Robinson • January 13, 2023 6:01 PM

@ Matthias U,

Re : Health and Safety.

“Also, there’s the eCall button.”

We finally get around to the very long running excuse used by the Spooks Representatives on Standards committees.

Look up what “operator break in” is and how it worked from the earliest days of the pre-Strowger phones[1] through to today.

And how the Spooks abused it’s pressence all along. And even when land line phone design changed, post WWII how the Spooks still abused the design[2].

Who first started bugging phones is unknown, and certainly in the UK it was probably “some engineer” who worked for the “General Post Office” long prior to WWII. In the US again we don’t know, but we do know that the “Maffia bugged the FBI” with the “infinity bug” before the FBI started bugging them with people sitting in vans and the like in the 1960’s.

It’s been such a powerfull tool for both espionage and counter-espionage and more recently Law Enforcment, it is one of those “Drugs that you can not get unhooked from”.

The problem is right from the very begining “it’s been illegal”…

So the tripple problem,

1, How to stop the opposition finding out.
2, How to stop the public and polititions finding out.
3, How to stop technical changes stoping it’s availability.

The solution as I’ve mentioned before post WWII was easy, nearly all “Telephone Networks” were either owned or controlled by a Government Dept. Thus having just one or two “read in / in the know” technical representatives in the Departments and on Standards Committees was sufficient with a good cover story.

The story is a clasic “Think of the children” finess, and it’s the “think of the lives saved because…” an operator can listen in and hear a colapsed person yada yada yada.

I’ve had the misfortune to see these silly games in play. If you try to object, the “in the know” representatives from the Five-Eyes etc all club together and call any one who objects some kind of uncaring / selfish / depraved person and when they “tag team” thr attack you realy can not stop it…

So if people want to find the stuff the first place to look is under the “health and safety” features, involving “opperator assistance” or similar. From there work your way down through the technical specifications and you will always find something that sounds slightly odd from a technical perspective. You will also find it carried forward into the approvals testing.

Though like the A5/1 and A5/2 story you have to dig a bit or get lucky.

A5 came out by “accident” because somebody gave a confidential specification to some one, and “forgot” to get them to sign an NDA.

But A5 was always problematic from when first thought up in the mid 1980’s. From Wikipedia[3],

“Security researcher Ross Anderson reported in 1994 that “there was a terrific row between the NATO signal intelligence agencies in the mid-1980s over whether GSM encryption should be strong or not. The Germans said it should be, as they shared a long border with the Warsaw Pact; but the other countries didn’t feel this way, and the algorithm as now fielded is a French design.””

There are one or two sayings in the EU technical community such as, “It’s always the French who are to blaim” and “The French will say yes to anything providing the committee is named in French”. Whilst neither is strictly true, there is that “feeling”. But what is true is that back in the 1960’s and onwards the French did not alow encryption to be used. Further it became clear that the French Government were spying on foreign companies and passing over the “industrial espionage” over to the “favoured few” to profit by, thereby the argument goes “be good for the French State”. The fact that at one point the French were fairly open about this is what stopped it ever becoming an international scandal just a “Coq Gaulois Strut” or “Gallic Shrug”[4]. Unfortunately it has caused many issues including the deliberate murder of protestors.

[1] Almon Brown Strowger founded his “Automatic Telephone Exchange Company” in 1891. Supposadly because all his business was getting stolen by a competitor who had “a girl” who was an operator redirecting calls.

[2] The first half of Peter Wrights “Spycatcher” published in 1987 makes a very interesting read on the technical side of Spooks. Peter Wright, was the former MI5 technical officer and Assistant Director. His assistant mentioned in the book was Tony Sale, now more famous for rescuing Bletchly Park.

[3] One of those odd Wikipedia URL’s where the subject name inadverantly has an effect on the directory substructure,

https://en.m.wikipedia.org/wiki/A5/1

[4] The “gallic shrug” is apparently an invention of the “Perfidious Albion” and “their Colonial Cousins”,

https://www.askafrenchman.net/what-is-gallic-shrug/

Mind you the French are right about the “Just say it louder mindset” so they are not always wrong 😉