This website does readability filtering of other pages. All styles, scripts, forms and ads are stripped. If you want your website excluded or have other feedback, use this form.

Friday Squid Blogging: Cephalopod Week on Science Friday - Schneier on Security

Schneier on Security

Blog >

Friday Squid Blogging: Cephalopod Week on Science Friday

It's Cephalopod Week! "Three hearts, eight arms, can't lose."

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

Tags: squid

Posted on June 15, 2018 at 4:12 PM • 93 Comments

Comments

EvilKiru • June 15, 2018 4:36 PM

TPM has a paid ad masquerading as a product review for the iPM World HD 360 Degree Wireless Camera that links to your smart phone, supposedly to make your home more secure:

[talkingpointsmemo.com]

Any bets on whether it even tries to be secure?

Winston Smith • June 15, 2018 5:25 PM

If a perfectly secure way to vote in an election was developed, would it be widely adopted? Power indeed corrupts, and for many (most?) nations, adoption of such technology would be quite challenging.

Here's where we are in the USA today ("fluff" journalism warning):

[www.nextgov.com]

Proposal to force paper trails of elections:

[techcrunch.com]

Here's an interesting use of the blockchain technology:

[www.investopedia.com]

I'm also of the opinion that securing an election absolutely requires voter registration of some sort to uniquely identify the voter. One citizen, one vote. Blockchain? Perhaps. Is there anything more suitable? Government issued Smartcards? How do you audit the auditors?

NOTE: I thought this was an interesting subject, but please-- let's not turn this into a Russian conspiracy thread. Just let it go.

Lawrence Roberts • June 15, 2018 8:26 PM

Novel voting methods

New Zealand is looking to quietly enter the area of electronic voting via experimentation based on local government elections. This is being introduced through a very small omnibus bill amendment to local government law.

One part of the proposed amendments is to amend "... the Local Electoral Act 2001 to support the conduct of trials of novel voting methods"

The explanatory notes that accompany the Bill include:

Clause 6 amends section 139(1)(c) of the Local Electoral Act 2001 to enable regulations to be made that authorise, for the purpose of conducting a trial of a voting method (for example, an electronic voting method), a local authority to adopt the voting method for a specified class of elector.

Does anyone think we can get it work safely and with both transparency and privacy?

John Barron • June 15, 2018 9:00 PM

Trump's campaign manager and partner in collusion used a simple tactic to try to evade justice :
[www.motherjones.com]

Maybe a little too simple? Nah. Great job. Heckuva guy.

And he's in prison tonight, the case builds towards the inevitable Trump indictment. The system works.

Next in line?

Thoth • June 16, 2018 12:51 AM

@all

If the paper votes are already easy to corrupt, what makes anyone think electronic votes cannot be corrupted with ease.

You can use blockchains and ID cards as much as you like but the devices are already perpetually backdoored and it's a matter of whether the Powers-That-Be wants to use their NOBUS access to influence electronic voting.

One example is you could generate your eVote signing key on a TPM or Smart Card you own. Assuming that the TPM or Smart Card is trusted in an idealistic world (which is not in the real world), the name of your candidates have to be transferred from your computer to the TPM or Smart Card to sign the candidate name to effect a vote.

You have Intel SGX, AMD PSP, ARM TZ et. al. or even an ordinary malware or backdoor in the Win/Mac/Nix OS to swap the candidate name under your nose and effect a vote.

Another note is the submission of your chosen public key could be intercepted and swapped if needed.

There are many ways to counteract the scenarios I mentioned above but my point is elections or acts of exercising one's democratic rights in our current era is almost unlikely to happen and unlikely to go down well.

If you walk on the wrong side of politics (especially in dictatorship regimes), who knowd if you might still be alive to tell the tale the next moment after you voted.

Eugene • June 16, 2018 1:38 AM

from [www.bloomberg.com]


" Investigators have restored 16 pages of documents found in Cohen’s shredder and recovered 731 pages of messages sent on encrypted platforms, including WhatsApp and Signal."

Clive Robinson • June 16, 2018 4:44 AM

@ moz,

IOT comes to padlocks. The result will make you smile.

The device appears to have been designed not by engineers of any kind, but by a Marketing Dept "subing it out" to a "China Knock Off"[1] house. None of whom appear to understand what even base physical security is about.

As anyobe with even a mear smidgen of knowledge knows the metal chosen yeilds to pocket power tools in seconds as will any "security pins"... Likewise "security screws" used in consumer products are generaly a compleat joke.

Having trained as a toolmaker many many years ago as part of my education I know no matter what funny shape they use for the screw/bolt head you can repurpose an existing screwdriver or similar hand tool like hex wrenches to fit in a very short time with just good quality needle files. I do it quite frequently when repairing electronic household items etc for friends and others. These screws/bolts are usually not designed to do anything other than keep untrained people out when the consumer device goes wrong. They are certainly not designed for security because they are virtually never "one way" due to rework and servicing under warranty requirments.

Even the supposadly "one way" screw/Bolts used in the likes of security fencing can have their heads repurposed with a grinding tool you can carry in a pocket, then an ordinary flat head screwdriver will work on it. The trick generally used to improve their security is to have a "Ny-lock" or similar nut on the "secure side" so that after half a turn or so of the screw/bolt from the "attacker side" the nut just spins and will not go further down the thread, even if a split tipped leaver --think small crow bar-- generally insufficient force can be applied under the screw/bolt head for there to be sufficient friction on the nut to enable it to be unscrewed further. Thus from an attackers point of view "chemical" solutions[2] against the actual fence rather than it's fixings are required.

[1] The name "China Knock Off" has been around for many years and originally applied to Taiwan that worked under "Made in the Republic of China" (ROC). It is only more recently with mainland theft of companies and IP has it been applied to the Communist Party controled mainland.

[2] By chemical I'm not limiting it to acids and similar corrosives, special forces tend to find a loop ot RDX / Detcord on small stand offs generaly punches a nice man sized hole in even concrete based fences and walls... Failing that an anti tank missile will work against even hardend command posts. Though as some one I used to know chearfully used to say "Shaped charges are your friend when you forget your keys" followed by a big smile and one of those thousand mile stares of fond memories. As a University Prof and researcher he was realy liked if not loved for his mad cap ways.

Clive Robinson • June 16, 2018 6:23 AM

@ Thoth,

If the paper votes are already easy to corrupt, what makes anyone think electronic votes cannot be corrupted with ease.

As Stalin noted it is not who casts the votes that matter it's who counts them.

But Stalin was "old school" as voth Jeb and W Bush proved there are other ways, such as eleventh hour disbaring of voters in certain areas and getting friendly is not down right conpliant judges to make usually daft rullings on the output of defective voting machines.

Either way you disbar the votes that count against you as though they were never made...

Other tricks are covered by Gerrymandering, where you do research to find out what areas vote which way then you redraw the voter constituency borders to your own advantage...

Then if all that goes wrong there are other things such as the electoral college that was designed to keep out those who were not "one of us"...

No doubt there are other non high tech ways to get the result you want. After all the US is a "two party" system which has decided disadvantages nit least of which is the often statistically to close to gether results that might otherwise show up various frauds.

It's all jolly good fun for the players, but not so much for their various types of self interested backers with legislative agenders they want favourably addressed. As for the ordinary mortal who is alowed a vote, little do they realise just what goes on... thus miss the fact that they are largely totally irrelevant to the process.

Ismar • June 16, 2018 7:28 AM

Machines are learning to keep their secrets

“In the same year, other researchers at Google Brain set up three networks called Alice, Bob and Eve. Their task was to learn how to encrypt information. Alice and Bob both knew a number – a key, in cryptographic terms – that was unknown to Eve. Alice would perform some operation on a string of text, and then send it to Bob and Eve. If Bob could decode the message, Alice’s score increased; but if Eve could, Alice’s score decreased.

Over thousands of iterations, Alice and Bob learned to communicate without Eve breaking their code: they developed a private form of encryption like that used in private emails today. But crucially, we don’t understand how this encryption works. Its operation is occluded by the deep layers of the network. What is hidden from Eve is also hidden from us. The machines are learning to keep their secrets.”

bttb • June 16, 2018 8:05 AM

@John Barron

More on "foldering":

"Back in January, I observed with some surprise that Paul Manafort was conducting his ongoing dalliance with Oleg Deripaska’s flunkie Konstantin Kilimnik on a PRISM provider’s server.
[...]
Which is why I find it so interesting that prosecutor Greg Andres emphasized Manafort and … he didn’t say whom (at least per the two reports that covered this) were communicating using the “foldering” technique that terrorists and unfaithful CIA Directors have been known to use in the past. Here’s how Josh Gerstein described the exchange:..."
[www.emptywheel.net]

bttb • June 16, 2018 8:37 AM

@Eugene

More on Cohen and discovery in New York:

"When Special Master Barbara Jones first reported privilege designations on matters seized from Michael Cohen on June 4, she found that three of the hard copy documents over which Cohen or Trump had claimed privilege were not.

'1. Contents of Eight Boxes of Hard Copy Materials: Out of 639 total items consisting of 12,543 pages, the Special Master agrees with the Plaintiff and/or Intervenors and finds that 14 items are Privileged and/or Partially Privileged. The Special Master also finds that 3 items are not privileged.'

Later that week, on June 8, Judge Kimba Wood ruled that if Cohen or Trump wanted to dispute any of Jones’ recommendations (it was Trump, not Cohen, who raised the issue), the legal argument (but not the contested documents) would have to be public.

'With respect to the President’s letter dated June 6, 2018, (ECF No. 75), the Court agrees with the Government that Plaintiff and Intervenors’ objections should be filed publicly, except for those portions that divulge “the substance of the contested documents,” (ECF No. 76, at 1), which should be filed under seal and ex parte.'

Jones has just submitted an amended report from those same materials, effectively reporting that Cohen and Trump now agree that the three documents are not privileged."

[www.emptywheel.net]


I wonder what the three claims of priviledge were?

Regardless, I hope that justice doesn't grind too slowly forward, but as fast as possible, under the circumstances.

bttb • June 16, 2018 8:39 AM

From, a conservative opinion writer, Gerson:

"Opinions
A lesson from Germany in dealing with right-wing populism
[...]
The CDU faces a challenge duplicated across the West: How does a center-right party deal with a populist insurgency? One option is for the CDU to co-opt the AfD by moving to the right on immigration. This would be the effective repudiation of Merkel’s leadership. And some in the party fear that conceding political ground to populism would merely feed and legitimize it. Another option is for the CDU to draw a sharp distinction with the AfD and consolidate control over the political center. But this might allow the AfD to appeal to the CDU’s own right wing in culturally conservative places such as Saxony.

In the United States, the situation is different and direr. Because we don’t have a parliamentary system, the ethno-nationalists did not gather in their own party. They conducted a successful coup in the Republican Party and are consolidating their hold. What remains of the GOP establishment is faced with a similar decision: imitate the populists or try to marginalize them."
Christian Democratic Union (CDU)
Alternative for Germany (AfD)

[www.washingtonpost.com]

albert • June 16, 2018 10:54 AM

@Clive, @moz, @etc,

Re: Padlocks, physical access.
My favorite is still liquid nitrogen (LN2). It simply doesn't care what material you're dealing with. Be sure to wear safety glasses and don't try this a home.

Fasteners:
Nowadays, they're hardened, so grinding is required. In electronic devices, thread-locking compounds are often used. A bit of heat from a soldering gun does the trick. Star-head screws (like Torx) are almost standard today, and everyone has a set of Torx screwdrivers.

Voting systems:
As I have pointed out many times, -perfect- voting machines would have little effect on vote rigging. All systems are normalized, and 'they' like it that way.

. .. . .. --- ....

JG4 • June 16, 2018 12:14 PM


@lock discussion

In my troubled youth, I was tasked by the good guys with removing the padlock from a railroad signal that had gone rogue. First I tried my 36" boltcutters, but just nicked the jaws, even though I was fairly stout at the time. It was a serious lock close to 10 mm thick and properly case hardened. I had the bright idea to do a MacGyver and removed a carbon rod from one of the D-cells in my flashlight. This would have been well before the TV series, maybe in the early 80's. I may have sharpened the carbon rod with a Swiss army knife. I held the rod with the free end of a set of jumper cables connected to a nearby cop car and put the ground clamp on the lock. I still have the jumper set that I made from #2 aircraft cable with the premium fiberglass insulation, at least 3 meters long. I think that I still have the lock too. I attempted to burn through the padlock loop. I did get it somewhere between red and orange hot, and the tip of the carbon rod hotter, to the point that I could push around some melted metal on the lock. It was hard on the cop car's electrical system, so I gave up at just about the time that I realized the temper would be gone from the lock when it cooled down. The boltcutters went through it like butter - after it was cool enough to not hurt their temper. I think that the railroad paid me $100 for the emergency service, which would be close to $300 of today's money. Not bad for a couple of hours, including travel.

[www.nakedcapitalism.com]
...

Big Brother is Watching You Watch

Apple, Facebook, Google issue joint statement condemning NSA data mining Duffel Blog (Kevin W)

The Onion is on a crusade against Mark Zuckerberg because it says Facebook is choking its traffic Business Insider (David L)

Imperial Collapse Watch

Pentagon Admits Afghanistan’s New Black Hawks Can’t Match Its Older Russian Choppers The Drive

...

Humdee • June 16, 2018 2:10 PM

From a linked article,

"Andres cited Manafort’s use of this tactic in detailing the various means Manafort has employed for secret communications, including encrypted apps. The point was that Manafort, if allowed to remain free on bond, would resort to underhanded actions to mess with the ongoing prosecution. “There is a history of deception on behalf of Mr. Manafort in this case,” Andres told the court."

What a load of nonsense. Foldering is a legitimate security technique that isn't "underhanded" any more than encryption is underhanded. And by the way, are people's memory's so short? Foldering is the same tactic used by David Petraeus.

[en.wikipedia.org]

bttb • June 16, 2018 2:42 PM

@Humdee

"What a load of nonsense."

iirc Andres is a prosecutor, not a defense attorney, so his position seems consistent with that role.

thegrugq on "foldering":
[mobile.twitter.com]

bttb • June 16, 2018 3:14 PM

btw Andres is currently serving as an Assistant Special Counsel
[en.wikipedia.org]

Also regarding Andres, from 1 Aug 2017:
"Mueller Team Adds Lawyer With Experience In Foreign Bribery, White-Collar Crime
[...]
That Mueller continues to expand his team means the probe is not going to end anytime soon, said Robert Ray, who succeeded Kenneth Starr as independent counsel for the Whitewater investigation during the Clinton administration.
'“It’s an indication that the investigation is going to extend well into 2018,” said Ray. “Whether it extends beyond 2018 is an open question."'
[...]
Andres was a federal prosecutor in Brooklyn for over a decade, eventually serving as chief of the criminal division in the U.S. attorney’s office there."
[www.huffingtonpost.com]

NM Rat • June 16, 2018 3:27 PM

There has been a rather amazing tale of criminal hubris and human malice on display in rural New Mexico with a computer security angle at its core. Three people are mysteriously killed gangster-style in rural home, bodies not discovered for days. Nevertheless within 24 hours the police make multiple arrests. How? It turns out the home had a fancy video system and the murders were captured on video. And not just the murders, as it turns out, the people who discovered the bodies also robbed the place before notifying the police. Ho, did I fail to mention that the people who robbed the place happened to one of the victim's father and brother?

Anyway, the whole thing might have gone unsolved because the video system was password protected. That works about as well as one might expect.

"The recording system was password-protected, but video was recovered after the system was taken to an FBI laboratory in Albuquerque, according to state police."

[www.santafenewmexican.com]

I bet the password was "password123"

Ferber • June 16, 2018 5:39 PM

@Thoth

In principle, paper voting definitely is safer than electronic voting. Then again, it depends on the country. In Switzerland, we have paper voting and - as opposed to what some geezer from Estonia told the "Tages-Anzeiger" - it is bulletproof. If you do no get your voting documents by mail, you can fetch them at your local district office. Therefore, everybody gets the voting material. Second: You can vote by postal mail well ahead of the actual date. I guess, the number of envelopes that do not arrive via postal mail is less than one in 10,000. Then, of course, you can vote at the polling station. All votes, including the postal ones, are counted on the same day. If the margin is small, a recount is performed.

So, electronic voting makes no sense (nor is it safe), since you can vote by postal mail. The problem lies in the implementation of the result, which has to be done by the parliament and the government. That, however, is not resolved by electronic voting.

Well, I guess people who come from less developed countries or meme countries like the one mentioned above have no idea how paper voting in a developed / mature democracy works.

Thoth • June 16, 2018 6:06 PM

@Ferber, all

Singapore, which is usually called the Switzerland of the East uses paper votes too although we are exploring some rudimentary form of electronic voting, but we as a so-called democratic republic with tonnes of opposition party is actually a one party system like the Chinese system.

We are highly advanced in the East and similarly China too is highly advanced but we never knew democracy despite theoretically having a Constitution that gaurantees democracy and even calls itself a democratic society.

During voting day, we too have vote by physical mail or in-person but our first world Government is so good at ensuring they will always win the race by sueing, throwing into prison, or making people disappear, those who dare have opposing views.

Votes are just formalities but they themselves are the forever ruler of this small island coined as the Switzerland of the East.

Malaysia just saw an uprising where the first time in it's modern history, an opposing party took power simply because a powerful former Main Party leader decided to come out of retirement and switch sides. He, that shalt not be disobeyed, whichever democratic parties he joins, these parties will surely become the Main Party.

So much for so called democracy ... in name ...

Clive Robinson • June 16, 2018 6:33 PM

@ Humdee, bttb, et al

Foldering is a legitimate security technique that isn't "underhanded" any more than encryption is underhanded.

A little more on foldering[0],

Firstly and more importantly than a security technique at it's simplest level it is a legitimate ad hoc way of doing "collaborative working" and faster than bouncing emails back and forth. Importantly it is a "pull" not a "push" method, so does not require the participents to run or have run on their behalf Mail Transport Agents (MTA) or permanent Internet connections.

Think of it historicaly as "Cloud working" before the "Cloud". That is in times past systems admins in small widely distributed organisations might set up a "group account" on an email system as it was a lot lot cheaper than setting up a shared network folder. As a shared email account would work with "dial up" Intetnet accounts, where as a shared folder system would require atleast one permanent server and Internet connection which had other security concerns. You could look on it as being the predecessor of Google's collaborative "cloud" systems for the likes of tablet/pad users.

Secondly with encrypted links to and from the server being standard these days if might appear falsely to offer a slightly higher degree of "confidentiality". The reality is it does not for the colabarative asspect, because in most cases that requires the use of "plaintext"[1]. Which means the confidentiality depends on trusting[2] the server it's owner and operators and anyone who comes into contact with their systems and backups etc... Which with NSL's and other legislation and surveillance methods they can not be trusted these days in anyway shape or form, nomatter how trustworthy the individuals may appear to be[3]. Therefore any idea that you might get increased confidentiality by foldering for collaborative or other plaintext work on the server is entirely false.

Therefor if privacy or secrecy are required foldering should only be viewed as a "communications" method not a "privacy" or "security" method (which encryption can be but is not always).

Not understanding the difference between a communications method and a privacy or secrecy method is likely to give you a lot of grief later if you don't understand the differences.

However foldering if used as a "Storage" method for time shifted communications then in effect it becomes a "drop box" so full ciphering or coding of a files contents and it's file name meta-data can be easily achived as no extra support is required on the server. So it can be used to increase "privacy" but not "secrecy" on it's own.

To understand the difference you need to think about it in terms of old school OpSec fieldcraft. A dropbox is in effect like a mail box in shared accomadation or a post office. It's location and who uses it are in effect public knowledge. Whilst it might provide limited privacy of message content the meta-data of the communications is on public display, so it is not a secret communications method even though it gives privacy of message content. To get communications secrecy you need to avoid "Traffic Analysis", which in old school fieldcraft involved setting up a "dead letter drop" in an anonymous and often changing location prefereably accessed via "cut outs" and controled by covert indicators.

For "Foldering" this requires several email servers from entirely unrelated service providers to give multiple "drop boxes", that should also be set up anonymously. To make these drop boxes into "dead letter drops" you need to access them anonymously as well, not just on the human level but the network level as well. That is you need to access it from different IP addresses[4] unrelated to you at different times of the day or days of the week / month etc, and importantly only when there is something to exchange or if "cover is being run"[5].

Another issue is the recomended use of "cut outs" back when Tor and other privacy network systems were not blocked by service providers mix nets and onion routers provided reasonably good cut outs. However due to the perceived need of "low latency only" such systems were still susceptable to traffic analysis and some other attacks.

There is of course a further problem which is how to also run a covert signalling system. I've addressed this in the past on this blog when talking about how to run botnets in a headless manner[6], so don't need to cover it again here.

Not carrying out all these actions will almost inevitably result in your secrecy being rolled back, which in turn can give rise to a whole heap of issues, only some of which can be mitigated.

Thus we have the old problems of OpSec / Fieldcraft is hard, and inexperienced people usually implement insecure systems often to their cost. It requires further a good deal of "hinky thinking" backed by considerable experience to set up new secure ideas, and as our host @Bruce has been known to note "thinking hinky" is a rare skill. It also means that any quick description such as this will contain insufficient information as well as the potential for ambiguity, neither of which are good if you decide to build your own system.

Oh and further as @Bruce also notes attack methods move forward all the time, so what was once secure, given time in all probability will become insecure. So all security systems need to be not just reviewed regularly, they also must not be dependent at any point on a single method. For instance encryption we know has a habit of failing long before expected (thirty years appears to be the tops). Thus you would be well advised to use two encryption systems in series, provided the underlying methods used are not common.

[0] In this case should "foldering" be a noun? Even a proper noun?...

[1] The reason for this is in most cases colaborative working means information "processing" at the server. Currently there is no easy way to "process" information that is encrypted into ciphertext and it is extreamly unlikely that a server owner would alow it any way even if it could be easily done. Which means that you would need to do any processing locally, which means downloading, decrypting, modifying, encrypting and uploading files. Therefor the server is realy being used as a "store and retrieve" communications node. Both storage and communication of information can be done with any type of file including fully encrypted ciphertext, so foldering will give privacy when used this way.

[2] There are two types of trust, the human type and that of trusted systems. They are in effect the opposite of each other. Human trust is basically where you are crossing your fingers and hoping other people will not betray you[3]. Whilst trusted systems are designed against a security policy and when opperating correctly
enforce that system's security policy. Further the design of a trusted system is usually such that even if it develops faults or becomes subject to attack or in some cases even being seized by an adversary then it will still maintain the systems security policy.

[3] There is a very old notion, that the only way you can trust living people is by having more dirt on them than they have dirt on you. Whilst that might have been true at one point in the distant past, "Turning Kings Evidence" and in more modern times "Witness Protection Schemes" for entire families have renderd that method of trust fairly moot. As crime syndicates have found the LEOs can have even more persuasive argument and be very forgiving even to those who have committed multiple murders and worse. Thus the old "Three can keep a secret providing two are dead" starts to take on additional meaning in the modern world[7].

[4] These different IP adresses should however all be from an apparently localised area such as coffee shops / bars / etc in and around one business district. As this minimizes the "drawing of attention" to the account. Nothing says Foldering to an email service provider like two IP addresses in different countries "ping-ponging" fairly rapidly, other than perhaps a Tor exit node or known VPN provider...

[5] Running cover is a whole other subject, but in this case it referes to using the account as what appears to be a legitimate email account such that the signal to noise ratio on the Foldering or other private / secret messages puts it well down in the noise floor. There is a lot more to it than just traffic volume ratios, but it is a very lengthy subject in it's own right involving amongst others coding / stenography, compression encryption, steganography and cover stories / legands.

[6] Most recently at, [www.schneier.com]

[7] During WWII it was considered a very real possability that Britain might be invaded. Thus the idea of "stay behind" or "behind enemy lines" irregular forces were considered in depth. It was realised that there was an issue via training, in that it ment people who should not know about each other would thus information could be tourtured out of them if caught. So a solution was arived at by those in charge. All training of group members and all communications with the agency would be carried out by only one member of the group, the leader. For the number two of the group the leader would pass down "sealed orders" the leader had never seen. The orders were only to be opened if the country was invaded and the groups location over run by the enemy. The first order in those sealed orders was that the number two should kill the leader and assume the leadership role. Oh unbeknown to those that came up with that idea and those at a senior level in the organisation, trainers and those who implemented the idea there were also "Kill as required" orders... Bringing a whole new meaning to "Don't worry, I've got your back".

Winston Smith • June 16, 2018 7:43 PM

@Thoth

"You can use blockchains and ID cards as much as you like but the devices are already perpetually backdoored and it's a matter of whether the Powers-That-Be wants to use their NOBUS access to influence electronic voting."

The above is similar to other sentiments expressed here already. Unfortunate and obviously true, of course. It'll take Plato's God-King to set it right.

@Clive

"Then if all that goes wrong there are other things such as the electoral college that was designed to keep out those who were not "one of us"..."

I wholeheartedly disagree. It was designed to function essentially as a high pass filter in order to protect the democracy from, "the tyranny of the people".

[xroads.virginia.edu]

Now, it can be abused just like any other institution, yes, but it wasn't designed with the intention of preserving the status quo for the sake of the elites.

"As for the ordinary mortal who is alowed a vote, little do they realise just what goes on... thus miss the fact that they are largely totally irrelevant to the process."

We'll said, and such a crying shame, too. Technology's advances puts more power into an individual's hands, which serves as a check against abusive authority... so long as any legislation against it is not enforced.


Clive Robinson • June 16, 2018 7:48 PM

@ bttb,

thegrugq on "foldering"

I gave up on "thegrugq" some time ago, for someone who talks the talk on security his practices (use of twitter, Tumbler, Medium) are far from secure as they are data mining organisations.

Trying to use either Twitter or Tumbler witout "full tracking" methods (javascript cookies) enabled does not work. Medium can be used soet of but it's a mess, trying to find the index is at best a chance operation by the majority of potential readers. Whilst some of what thegrugq does is "in the moment" in the way some social media works, much of his stuff if properly indexed and accessable to mobile users would be a usefull resource.

Both he and other "security gurus" should realy know one heck of a lot better. In fact one way to rank those who have some security status is just how securely they treat those they diseminate information to and gow easy to use the information when not the current article. On that scoring thegrugq is way way down the ranking currently.

He realy should "get with the program" especialy since the Europran Directive came into force... There realy is no excuse.

Humdee • June 16, 2018 11:14 PM

@Clive, bttb

I meant "legitimate security technique" in the strict sense of "not illegal" rather than "secure", that is why I focused my comment of the use of the word "underhanded". One person's act of deceit is another person's act of privacy. But if America is a nation of laws the question is whether or not "foldering" is legal. It is. So calling perfectly legal behavior "decietful" or "underhanded" is is calumny. FWIW I think we should expect better of government officials, especially when operating in their official capacity, to be above casting aspersions on character.

John Barron • June 17, 2018 4:16 AM

"foldering" aka "consciousness of guilt" in this circumstance, yes.

It's damning of itself.

RG • June 17, 2018 6:28 AM

Creating an Android free of Google's data-slurping!

‘Although Android is nominally open source, the useful parts are in proprietary binary middleware owned by Google. It's Google's distribution and administration of this binary blob, GMS, that attracted the European Commission's attention. The blob presents APIs and services that developers need.
Through licensing agreements and third-party compatibility tests, Google ensures that the user sees Google services where possible, and apps use Google services. So Google's grip is really twofold: commercial – through the MADA contracts, which insist on the inclusion and prominent placement of Google apps – and technical, through the compatibility tests. Untangling all of this won't be easy.’

"I'd like us to join forces with Librem/PureOS, KDE," Duval told us, and to look at phone OEMs.

But it can be done. Many millions of Google-free AOSP (Android Open Source Project) phones (and media streamers) have been developed in China.

[www.theregister.co.uk]

An excellent technical report describing the open source tasks:
[www.indidea.org]

JG4 • June 17, 2018 6:51 AM


@Clive, Nick P, Thoth and others - Thanks for the continuing discussion of data security at all levels, including the processor level. Can't recall what I've posted about memristors, but those could be a game-changer by putting very fast, space-efficient and energy efficient memory close the (parallel) processing elements. You've come close to saying that the correct approach to programming is to take a data-centric view, then optimize what happens to the data. I like the tasklet concept, and that fits into a data-centric view.

[www.nakedcapitalism.com]
...
Big Brother IS Watching You Watch

The secret information hidden in your hair The Conversation

This nation faces a DNA dilemma: Whether to notify people carrying cancer genes McClatchy

Hands off my data! 15 more default privacy settings you should change on your TV, cellphone plan, LinkedIn and more. WaPo

The Administration of Mayor Rahm Emanuel Keeps Monitoring Protesters ProPublica

Imperial Collapse Watch

Why Do Air Force Planes Need $10,000 Toilet Seat Covers? American Conservative

The Chomsky Challenge for Americans Truthdig

INTERNAL CIA DOCS: ‘ENHANCED INTERROGATION’ IS TORTURE WhoWhatWhy.org
...

Who? • June 17, 2018 6:53 AM

Hyperthreading considered harmful

Theo de Raadt, founder of the OpenBSD project, warns us on a new microprocessor vulnerability. He is asking us to disable hyperthreading where not needed until this vulnerability —currently on embargo— is disclosed and an appropriate fix is publicly available:

[undeadly.org]

In the past I worked as freelance for a defense contractor building high-performance clusters. Disabling hyperthreading is not as bad as it looks and, in fact, it may increase performance under high processor loads.

I guess we will read a lot about this vulnerability on the next weeks, once announced.

Clive Robinson • June 17, 2018 8:29 AM

@ John Barron,

"foldering" aka "consciousness of guilt" in this circumstance, yes.

No foldering is not "consciousness of guilt" that is like saying having a mobile phone is "consciousness of guilt" or having a packet of evelopes is "consciousness of guilt".

You need to realise that you have to seperate a method from a deliberate act. As I've pointed out foldering is actually a communications method, as such it is entirely agnostic to it's use, it's the directing mind that decieds the use not the method. To argue otherwise is showing either ignorance or malicious intent, I'm unsure which applies to the prosecuting team. Either way if no evidence of the use is presented then the judge should have thrown it back at the prosecution to determin if it was ignorance or more likely malice calculated to put preasure on the defendent.

That makes it the modern day equivalent of the medieval process of "Pressing" where an accused person was chained on their back to the floor of a rank prison cell with a stout board across their body which was loaded down with heavy rocks untill the accused either died or was forced into an action that was harmfull to them.

As I'm sure you will agree either ignorance or malice in a prosecuter is highly undesirable and brings them into disrepute. Further not being chalenged by the judiciary brings the impartiality of the judiciary into question which brings the judiciary into disrepute.

Further such prosecution behaviour if left unchecked enboldens them to make further pushes of this kind which further degrades the judiciary and it's processes which is extreamly harmfull to all US citizens and others as it is the behaviour you would expect of a tyranny having a show trial.

The last time I read the news on this case it would appear that no evidence has been made available publically as to any message content / use so we have no way to make valid judgment, thus to blindly follow the prosecution argument would imply the behaviour of an authoritarian follower. But further the prosecution have a duty to disclose evidence to the defence in a reasonable time period, but from some of what has been said publically that appears not to have happened either...

So something very fishy appears to be going on at the very least, where is a matter of guess work currently.

6_7nbbbbr3d~ • June 17, 2018 8:37 AM

@Anders

There seems to be an extra space in the link causing it to fail.

albert • June 17, 2018 10:58 AM

@JG4,
Re: lock discussion.
Great story. Very clever. Today, we have more options. For example, battery-powered Dremel tools are now available. A small abrasive disk (we used to call them 'cutoff' disks) can easily cut a 10mm lock or chain. It will take some minutes, but it will be done. Dremels scream like Banshees, so illegal uses will be limited. LN2 is fast and quiet, hence its use by bicycle theft rings.

. .. . .. --- ....

Gerard van Vooren • June 17, 2018 11:23 AM

@ Who?,

About: Hyperthreading considered harmful

The problem is what is going on today? With all this Intel crap who knows what is going on? This is going to scare me, and I don't like to be scared.

bttb • June 17, 2018 11:58 AM

@Clive Robinson, Humdee, John Barron

btw from any "pc" (OSX, Windows, Linux, etc.,), but not from pads or phones, afaik, you can browse Twitter with neither JavaScript nor cookies. For example, with Firfeox 'locked down' using TENS 1.4.1 from a DVD or as a guest with VirtualBox.

Also, iirc, in the past Bruce may have said something like: Foldering might work if your threat model includes your spouses, but less likely if it includes the USG.

Here is another thread regarding the grugq and Foldering. Like in the link above it starts with:
" the grugq
@thegrugq

Flawless technique, as approved by: Petraeus (slapped on the wrist), jihadis (droned), organized criminals (in jail)... This COVCOM technique never gets old (or works)! (HT @rob_pwners) twitter.com/MarshallCohen/…"

[and it continues]

Steven Bellovin
@SteveBellovin

Replying to @thegrugq @rob_pwners
It's what happens when you get your threat model wrong. If you're trying to avoid creating metadata by email address, it's ok. Pre-TLS, it was good for in-flight eavesdropping. But against subpoenas, it's worthless.
View conversation · Reply Retweet Like

emptywheel
@emptywheel

Replying to @SteveBellovin @thegrugq @rob_pwners
When Manafort and Kilimnik's obstruction efforts were starting KK was using a PRISM provider w/no artifice so it's not like HE'S trying very hard.
View conversation · Reply Retweet Like

the grugq
@thegrugq

Replying to @emptywheel @SteveBellovin @rob_pwners
I know it pains a lot of the ..Er.. more mature intelligence officers, but I think their tradecraft just hasn’t caught up to computers properly.
View conversation · Reply Retweet Like

emptywheel
@emptywheel

Replying to @thegrugq @SteveBellovin @rob_pwners
I honestly don't rule out the fact that it serves KK's purposes to have Manafort repeatedly exposed.
View conversation · Reply Retweet Like

the grugq
@thegrugq
Replying to @emptywheel @SteveBellovin @rob_pwners
Could be.
2:25 PM - 16 Jun 2018

[mobile.twitter.com]


justinacolmena • June 17, 2018 12:27 PM

banking security

Suppose you run a bank, and you wish to offer super-secure deposit accounts to your customers, whose funds you aggregate and lend out at slightly higher rates so that you can afford to pay your office expenses and stay in business.

So consider a "checking" account with a "book" balance which is divided (theoretically) into two subaccounts: a "pending" balance and an "available" balance.

At any one point in time, the book balance is equal to the sum of the pending balance and the available balance.

When the customer deposits cash, the money is placed immediately into the available balance. When the customer deposits a check, the amount is placed into the pending balance, and when the check "clears," the amount is subtracted from the pending balance, and added to the available balance.

When the customer writes a check, and records it in an online checkbook, the sum is moved from available to pending, and subtracted from pending when it clears.

When the customer writes a check but does not inform the bank, then the funds are withdrawn from available, if there are sufficient funds.

When the customer makes a debit card purchase which is not processed right away, then the amount is nonetheless moved from available to pending immediately, and subtracted from pending when payment clears, e.g. debit card run "as credit."

Tedious but rather basic and no reason for it to be anything but straightforward. So why is this process so incredibly interminably screwed up at major banks in the U.S.A.?

Herman • June 17, 2018 3:04 PM

‘Foldering’ is simply a DIY FTP server, or a Dropbox account without the bother of installing Dropbox.

There is even a gmail file system for this purpose in Linux land to use the gmail servers as a networked file store.

Labelling this slightly unconventional and very handy file store method underhanded is just silly.

some customer • June 17, 2018 3:33 PM

You go and do business at a government or company branch. Afterward you get an email requesting that you complete a survey about your experience. But the email comes from a domain name that, first, does not match the domain of the government or company office, and second, is not mentioned on their website. How would you decide whether the email and survey were legitimate?

MarkH • June 17, 2018 4:49 PM

@all:

I looked in on this thread, to see any discussion on how the FBI purportedly retrieved messages exchanged via the Signal app.

None so far ...

I haven't used or explored Signal, so I've no insights.

Is it likely something as simple as having stored decrypted plaintexts on the phone, or a poor passphrase?

(required) • June 17, 2018 4:54 PM

Herman it's not that foldering itself is underhanded, using it to evade court officers from finding out if you're talking to witnesses or colluding with Russian nationals to throw an election however is obviously where the southpaw comes in.

Paul Manafort isn't going to prison for the rest of his life for foldering, you're right.

Humdee • June 17, 2018 6:02 PM

@MarkH.

The FBI got the messages from Signal because the phone owner handed them over to the FBI. There is no magic here. An encrypted app is no substitute for being betrayed by the person you send the message to.

@(required)

"Herman it's not that foldering itself is underhanded, using it to evade court officers from finding out if you're talking to witnesses...."

That is correct. Now, why couldn't the prosecutor simply say that as simply as you said it? Maybe it is because the case against Manafort isn't as strong as the government lets on so they have to jive it up? Maybe the prosecutor is a asshole who has to diss on everything he sees? Hmmm. I admit, I don't know. I will stand behind my comment, however, that what the prosecutor is (reported) to have said is not befitting a competent government official.


(required) • June 17, 2018 6:28 PM

"Maybe it is because the case against Manafort isn't as strong as the government lets on"

Ahahaaaaa.... yeah, maybe! Ahaha, good one. That's why he's already in prison.

Because he's completely innocent of all the bogus "deep state" FBI charges, that's the ticket! *Snaps*

MarkH • June 17, 2018 9:27 PM

@Humdee:

As I understand the situation, the phones were seized in early morning raids authorized by a "no knock" search warrant.

This does not correspond to the usual meaning of "handed them over."

Who? • June 18, 2018 3:32 AM

@ Gerard van Vooren,

The problem is what is going on today? With all this Intel crap who knows what is going on? This is going to scare me, and I don't like to be scared.

Same here, I don't like to be scared either. When I bought my workstation last november my goal was carefully choosing the hardware so it was as secure as possible (e.g. it had an Intel Core i5-7600 processor so all cores were real, no hyper threading, its DDR4 memory modules had physical countermeasures against Rowhammer, it had AMT so there was a small chance getting Intel ME "under control" if the external firewall and the AMT-unsupported second NIC on the workstation fail, and so on). One month later the first Spectre and Meltdown variants were announced and, as Clive says, Spectre is a gift that keeps giving (I said something similar when the first vulnerabilities in AMT and memory technology were announced a few yearg ago, opening a shiny new research field: bugs in hardware).

Getting a somewhat secure hardware setup is a lost battle with our current technology, but we must close as many holes as possible until real alternatives are developed. Sadly, right now we trust more on a small Raspberry Pi than on any other computing device. Something is really broken with technology when we trust more on a $50 USD computer than on a $2500 USD one.

Wesley Parish • June 18, 2018 4:54 AM

@usual suspects

ElReg brings up the problem os attribution again:

[www.theregister.co.uk]

The lack of concrete evidence of what Kaspersky Lab is actually alleged to have done to merit this action continues to vex the Russian outfit. Thanks to the secretive nature of intelligence agencies and the potential sensitivity of the alleged stolen data, that evidence is unlikely to be shared any time soon.

My general rule is, where something is alleged to have taken place, and no evidence for the event is forthcoming, you are wise to dismiss it as a non-event. I'm sure there'll be some such thing in any intelligent legal text on Evidence, especially Evidence Admissible in a Court of Law.

Or you could take the view that it's McCarthyism, pure and simple.

Clive Robinson • June 18, 2018 9:13 AM

@ All,

A silly sounding World Cup factoid...,

Apparently when Mexico won against Germany enough people in Mexico jumped up and down to set of earthquake detectors...

Why is this "silly sounding" but actually of "security interest"?

Well many moons ago somebody postulated that China if it could get all it's Billion citizens to jump up and down in a synchronized way, could use them as an "earthquake weapon". This was immediately "poo pooed" at the time with various expert --talking heads-- rolled out to say it was not possible...

Well now we know that in part they were wrong, enough sychronised human jumping up and down can set of detectors.

Now whilst they may not be capable of doing damage, it could be used as a form of DoS weapon causing false triggering thus panic etc.

Sometimes the most unlikely of things can have security implications...

Clive Robinson • June 18, 2018 9:19 AM

@ Wesly Parish,

Or you could take the view that it's McCarthyism, pure and simple.

Like many things in the US there is an assumption amongst those that are at the top that if the citizens are dumb enough to swallow something once then twice or thrice should work as well.

Hence "Think of the Children" and "War on XXX" etc.

bttb • June 18, 2018 9:24 AM

Oops, a sentence from above with corrections:
"For example, with Firefox 'locked down' using TENS 1.7.4.1 from a DVD or as a guest with VirtualBox." By locked down I mean fiddling with add-ons, extensions and the search engine.

TENS public is a USG DoD 'hardened linux' product available at:
[www.tens.af.mil]

Speaking of the DoD, do you think the US DoD will get jammed into starting another war somewhere (perhaps Iran), or escalating an existing war, by Trump, Kushner, Israel, Saudi Arabia, UAE, Bolton, or other actors, each with their own or overlapping reasons?

Where will the US military be, within the USA, when things further 'heat up' in the USA?

From [www.newyorker.com] ; about 16 pages; some recent history:
"Clinton knew that the U.A.E. and Saudi Arabia were already working together behind the scenes with Mossad to counter Iranian influence. Netanyahu made it clear to Clinton that he wanted the next President’s support in strengthening those secret relationships and eventually moving them into the open. The regional dynamics had changed since Clinton left the State Department, but she knew that Netanyahu’s approach would be harder to execute than he made it sound.

Netanyahu and Dermer [Israeli Ambassador] made a similar pitch about the “regional opportunities” to Trump, Kushner, and Bannon in the candidate’s penthouse in Trump Tower. The task of persuading them was easier, at least in part because they had so little experience with the long, tortured history of the region and had yet to formulate a detailed strategy of their own. Bannon was “blown away” by the idea of an alliance between Israel and the Gulf states. A former Trump adviser told me that Dermer and Netanyahu “had thought this through—this wasn’t half-baked. This was well articulated, and it dovetailed exactly with our thinking.” The adviser credited Netanyahu and Dermer with inspiring the new Administration’s approach to the Middle East. “The germ of the idea started in that room . . . on September 25, 2016, in Trump’s penthouse.” A friend of Trump’s compared the candidate’s team to a “blank canvas”: “Israel just had their way with us.”

M.B.Z. [UAE leader] was equally determined to get an early foothold with Trump. On December 15, 2016, five weeks after the election, he flew to New York to see Kushner, Bannon, and Flynn. They met discreetly at the Four Seasons Hotel, instead of at Trump Tower, where there were always reporters in the lobby. (The Obama White House was tipped off about the visit when Emirati officials provided Customs and Border Protection agents in Abu Dhabi with a flight manifest that listed M.B.Z.’s name.) M.B.Z. wanted Trump’s advisers to know that he and his counterpart in Saudi Arabia, M.B.S., were committed to working with the new Administration to roll back Iran’s influence.

bttb • June 18, 2018 9:36 AM

Oops, missing end quote above, ie. influence".

Is it true you can't have security without privacy?
From Why Do We Care So Much About Privacy?:
[www.newyorker.com]

"What makes us feel powerless today is the scale. Fifty years ago, the government could not have collected the metadata for every phone call in a fourteen-year period. The technology did not exist (or would have been prohibitively expensive). Radio and television enabled advertisers to come right into your living room, but the reach of online industries is vaster by many orders of magnitude. Last month, the season finale of CBS’s most popular show, “The Big Bang Theory,” had roughly fifteen million viewers, and People reaches an estimated forty-one million readers a week. Those are tiny numbers. Facebook has 2.2 billion active monthly users. Google processes 3.5 billion searches every day.
[...]
As we are learning, the danger of data collection by online companies is not that they will use it to try to sell you stuff. The danger is that that information can so easily fall into the hands of parties whose motives are much less benign. A government, for example. A typical reaction to worries about the police listening to your phone conversations is the one Gary Hart had when it was suggested that reporters might tail him to see if he was having affairs: “You’d be bored.” They were not, as it turned out. We all may underestimate our susceptibility to persecution. “We were just talking about hardwood floors!” we say. But authorities who feel emboldened by the promise of a Presidential pardon or by a Justice Department that looks the other way may feel less inhibited about invading the spaces of people who belong to groups that the government has singled out as unpatriotic or undesirable. And we now have a government that does that.
This article appears in the print edition of the June 18, 2018, issue, with the headline “Nowhere to Hide.”"

Petre Peter • June 18, 2018 12:35 PM

@Clive Robinson

Sometimes the most unlikely of things can have security implications...

Like a bridge collapsing because soldiers forgot to fall out of step when crossing it.

Clive Robinson • June 18, 2018 12:35 PM

@ MarkH,

I looked in on this thread, to see any discussion on how the FBI purportedly retrieved messages exchanged via the Signal app.

Put simply they did not retrieve any signals in transit as far as I'm aware.

However as I've repeatedly pointed out the securiry end point with all these apps is in the wrong place. Thus all the FBI has to do is get at the User Interface in a number of ways and it's "game over".

Thus there are a number of options available to them if they can be bothered to put some effort in.

1, Use the Over The Air interface to "end run" attack the Apps User Interface.

2, Place a key logger of some kind on the device which can be done in a number of ways to get at "user secrets" at the User Interface.

3, Get direct access to the device and use some form of coercion on the user, or appropriate forensics devices/code.

So these apps are not secure, and having them on your device makes you "guilty" in the prosecutions eyes irrespective. And judges appear to give the prosecution way way to much leaway without any supporting evidence. The prosecution just waves it's arms and says "here be big scary monsters" or "think of the children" or some such nonsense.

The aim being to force the defendent to plee bargin or bankruptcy or some such. Basically to deny a fair trial. Such prosecuters need to be permanently removed from such positions, preferably by being made totally bankrupt themselves.

MarkH • June 18, 2018 1:07 PM

@Clive:

I don't understand the first alternative you listed ... would that apply only while the user was communicating, or retrospectively (data at rest)?

The devices were seized in a dawn raid, and there is (at present) no indication of any warrant prior to that one. As far as we know, prosecutors didn't have access to the devices before any communications were made.

Mr Cohen probably has not cooperated with the prosecutors in gathering evidence related to his phones; in the context of the present prosecution, such cooperation would most likely become public.

It's the last half of your third alternative (forensics) that is of particular interest, because Signal has a high reputation, and the apparent attack (device seized after communications were made) is probably the most important threat model.
____________________________________________

I'm not aware of any case in which use of encryption (or any kind of security) has been accepted by a US court as evidence of guilt.

Does anyone have examples of that?

According to public information, there was abundant evidence of Mr Cohen's violation of multiple laws to support the search warrant, with no mention of his use of encryption.

Perhaps investigators didn't even know that Cohen used Signal, before they seized the phones.

MarkH • June 18, 2018 1:57 PM

@Wesley Parish:

You've hit on a "bugbear" of mine. Certainly, I respect the right of each person to apply his/her own criteria when evaluating information, and I don't imply any personal criticism.

For me, "Evidence Admissible in a Court of Law" is massively impractical to apply to almost any situation, outside of a court of law.

Almost every day, almost every adult on Earth makes consequential decisions -- including life-or-death -- without applying such a standard. Such decisions include taking a new job, whom to sleep with (or even marry!), whether it's safe to cross the street at a particular moment ...

It seems to me that to raise such a cumbersome "standard of evidence" (outside a court of law) is a rhetorical device. Certainly, every human believes many, many things absent such evidence, because we have a warm feeling about their sources, or they are consistent with things we already believe, or believing them is somehow comforting.

So we erect the high bar of evidence selectively, against something we don't want to believe in the first place.
___________________________________________

Two persons who have been frequent commenters on this site, proposed a standard the US should apply before sanctioning Russia: not only courtroom standards of evidence, but a conclusion beyond reasonable doubt.

I quickly ascertained that such a standard was infeasible. In fact, I suspect that neither of them actually took the idea seriously, because it needs less than 5 minutes of analysis to understand why it's not workable.

That's another way to recognize a rhetorical device: people make preposterous arguments as a way of venting emotion and bias. I learned from reading a brilliant scientist: when someone makes an absurd argument, try taking it seriously -- because the person making the argument surely has not! By becoming the first person to take the argument seriously, you can convincingly expose its flaws.

By the way -- and a propos of McCarthyism -- both of those commenters have insisted on the truth Kremlin fabrications, whose implausibility is not difficult to establish. [For the record, I'm not suggesting that these folks, who are perfectly decent individuals, are either "fish or fowl." Rather, it's a poignantly human example of how we apply adverse standards of evidence to some things, and wide-eyed credulity to others.]
___________________________________________

Yes, attribution of "cyber attacks" is fraught with uncertainty.

It's a hard reality of life, that (with the possible exception of proofs in mathematics and formal logic) we must make every single decision based on information which might be wrong.

As a painful example, in countries where criminal courts apply not only standards for admissibility of evidence, but also substantial biases in favor of the defendant (such as proof of guilt beyond a reasonable doubt), there is a chronic percentage of false convictions.

A fundamental skill of life in this messy world, is to optimize decision-making on the wobbly foundation of uncertain information and imperfect tools. I suggest that this kind of optimization is at the heart of security engineering.

bttb • June 18, 2018 3:55 PM

From KrebsonSecurity

A) "Google to Fix Location Data Leak in Google Home, Chromecast"
B) "Librarian Sues Equifax Over 2017 Data Breach, Wins $600"


A) "Google in the coming weeks is expected to fix a location privacy leak in two of its most popular consumer products. New research shows that Web sites can run a simple script in the background that collects precise location data on people who have a Google Home or Chromecast device installed anywhere on their local network."

[krebsonsecurity.com]

and

B) "In the days following revelations last September that big-three consumer credit bureau Equifax had been hacked and relieved of personal data on nearly 150 million people, many Americans no doubt felt resigned and powerless to control their information. But not Jessamyn West. The 49-year-old librarian from a tiny town in Vermont took Equifax to court. And now she’s celebrating a small but symbolic victory after a small claims court awarded her $600 in damages stemming from the 2017 breach."

[krebsonsecurity.com]

Clive Robinson • June 18, 2018 4:32 PM

@ Mark H,

I quickly ascertained that such a standard was infeasible.

The feasability of finding evidence at a given level is not the issue.

What is at issue is the response that follows on from that evidence.

Let me put it this way the US has seriously talked about "Kinetic Response" to "Cyber-Atacks". Thus if you are going to bomb the crap out of some location by drone etc what level of evidence would you want?

Because the one thing we do knoe with very little doubt is that false attribution is easy way to easy. Thus creating a situation with false attribution being the aim would not be very difficult.

So ask yourself the question what would you feel if Russia sent in a cruise missile into a US city and blew up a block of a business district, because they thought they had "evidence" of people attempting to hack the Russian infrastructure from a computer in that location?

As I said it's not the evidence that concerns me but the actions taken on that evidence. If they eant to have diplomats being rude to each other or being kicked out of the country fine that generally is just so much ruffled feathers. But going kinetic where people will die and infrastructure will be destroyed thats altogether different. We know from the ME that the US has got it wrong numerous times with drone attacks already and many innocent people have suffered as a result. What do you think would happen if the US did the same to a city block in downtown Moscow, Beijing or other states with the capability to retaliate not just in kind but more so?

I get the feeling that the leaders of several super powers don't believe in MAD these days. Thus the danger of escalating into all out war is on the table...

That is why I insist on high evidentiary standards and others should as well, especially if it's members of their families and friends that are going to be the cannon fodder.

(required) • June 18, 2018 8:14 PM

" Thus if you are going to bomb the crap out of some location by drone etc what level of evidence would you want? "

The only instance where "going kinetic" makes any sense is where they ARE sure of who is responsible,
and it's of a series of reasons forming such a rationale and not a single errant instance.

Nobody is bombing anywhere based on a whim, that's an unfounded fear so far.

65535 • June 18, 2018 9:28 PM

Anders and the stingray case:

That is a concise article that shows the perils of allowing police to use NSA style digital weapons on common vice or fraud crime.

[www.politico.com]

For all we know that “stingray” technology has now trickled down to private investigators and possibly criminals.

I find it odd the FBI would be allowed to handout Stingray style of weapons to local police with just and Non-Disclosure letter from a military contractor. What’s next handing out VX nerve gas instead of tear gas from a military contractor for crowd control with a NDA letter?

Note:

‘Supreme Court language—“reasonable expectation of privacy”—of a landmark privacy case known as Katz v. United States, finding that the use of a stingray does require a warrant. But as of this writing, no cases challenging the use of stingrays have reached the Supreme Court, so this legal theory hasn’t been cemented just yet, as stingrays continue to be used in everyday law enforcement.’- politico

[www.politico.com]

My guess is that most vice criminals don’t have the money or other resources to fight heavy handed tactics from police and other enforcement “Agencies” when faced with a trumped up charge of ‘20 years to life’ in jail or plea-bargain down to a minimal penalty and bury the case so the evidence of stingrays and other military grade weapons are never documented [or the government just drops the case when faced with a smart defense lawyer].

Now we move to the Manafort case which only would have seen the light of day because he as an “important” guy. He has the resources to fight digital cases were the average Jane/Joe do not. I am not on either side of the Manafort case but I am just using it to show these spy weapons tend appear on the front page only when an “important” person is involved and not the average person.

“What these judges have realized is that there is now a turning point with respect to smartphones: We carry them with us and they hold all of our secrets. No wonder the police find them valuable during an investigation. But should the police need to get a warrant to find our phones?”-politico

See above link.

Next to cell phone location tracking:

“Accessing Cell Phone Location Information” –Bruce S.

[www.schneier.com]

or

“How a “location API” allows cops to figure out where we all are in real time, The New York Times reported on Securus, a prison telecom company that has a service enabling law enforcement officers to locate most American cell phones within seconds. The company does this via a basic Web interface leveraging a location API—creating a way to effectively access a massive real-time database of cell-site records.”-Arstechnia

[arstechnica.com]

Could this have been used in the Manafort case? Maybe or maybe not. We will probably never know. It is “classified” data.

There is a lot of blame to go around in regards to how wide this digital spying goes. But, some of the blame must fall on the legal education system that doesn’t provide adequate training for lawyers to tackle digital cases.

I have talked to a lawyer about these digital cases and just the chain of custody of handling digal evidence is large and doesn’t even cover the cost of the few law firms who specialize in digital cases. The lawyer I talked to said it could cost 15K to 50K+ USD just to get a reputable law firms to handle a digital case. There are not that many law firms who handle digital cases in the USA so the cost is very high.

Some of the problem is that certain legal districts require lawyers to know digital technology before even being allowed to handle any digital case. That is a large hurtle in and of itself. The legal costs goes up.

Next, is the high cost problem of handling discovery, handling digital chain of evidence and a host of problems regarding over classification of digital information from the police cruiser and on up the FBI and so on.

Because of the lack of law firms handling digital cases and the high cost of those case the average Jane/Joe is getting buried in costs and red tape.

The balance of digital spy items out in the public’s hands far exceeds the legal community ability to handle those cases in a cost effective way.

I think law schools have to get up to speed on this digital spyware sector. They have to produce law students able to tackle these digital cases at a reasonable cost. The digital training will probably have to begin in pre-law classes. This will be a long term change for the legal education system.

I will say this same digital training should be instituted in other fields such as finance, medical, taxation and others.

To move one post further, take a look at “Ridiculously Insecure Smart Lock” post by Bruce S.

[www.schneier.com]

In past times consumer advocacy lawyers would have jumped on this unsafe lock and probably sued the maker into to the ground. The lack of economical digital trained law firms and lawyers is a part of the problem.

These unsecure digital items are foisted upon the public as "safe" and let the average Jane/Joe twist in the wind when their assets are stolen because of this “secure not-so-secure” items are purchased.

Hat tip to moz on the digital lock.

gordo • June 18, 2018 11:53 PM

"A former coder for the CIA has been indicted for computer hacking and espionage for allegedly passing the agency’s computer intrusion secrets to WikiLeaks, the Justice Department announced Monday."
[www.thedailybeast.com]

"The Justice Department’s news release announcing Schulte’s indictment does not mention WikiLeaks by name, signaling that it has not been charged in the case. There was no mention of any other individuals being charged."
[www.politico.com]

Wesley Parish • June 19, 2018 3:42 AM

@Clive Robinson

Re: Think of the Children

It seems that sometimes they do:

[www.theregister.co.uk]

As a company, Microsoft is dismayed by the forcible separation of children from their families at the border. Family unification has been a fundamental tenet of American policy and law since the end of World War II. As a company Microsoft has worked for over 20 years to combine technology with the rule of law to ensure that children who are refugees and immigrants can remain with their parents.
It will be interesting to see how President Trump barefaces his way out of this. It will be amusing to see how the GOP squirms.

@MarkH

In reply, and in a single phrase: The Gulf of Tonkin Resolution. Could also add the name of a ship, the USS Maine and the name of a harbour, Havana.

The reason for the various safeguards in the Common Law legal tradition is to defuse the kind of rabidity that ruled on those occasions.

For what it's worth, the separation of the legislature and the courts is relatively recent: it didn't exist in the Roman Republic, as I found out myself by working my way through Cicero's First Oration against Catiline.

There is a very close link between the empanelling of a jury and the opening the question of whether such-and-such a bill should become law: both imply that the common man is a fit judge of his peers.

Herman • June 19, 2018 4:44 AM

Do you really want an immigrant who's very first act upon entering your country, is to break the law?

All immigrants should do the paper work and get in line same as everyone else.

Thoth • June 19, 2018 6:50 AM

@Clive Robinson, all

Big MNC ITY Security corp (Yubico) steals two researchers work and claimed a bug bounty of USD$ 5000 from Google. Drama ensued between security researchers, Yubico and Google and finally it becomes known that Yubico played dirty and beat the researchers to the punch to claim the bug bounty first.

Yubico finally apologized for their bad behaviour .. but I don't think the researchers would ever get their fair share of bug bounty money or be compensated fully for their loses.

Time to hoarde vulns and stay shush ???!!

Why bother report vulns and e the good guy ???!!

That was the train of thoughts going through the two researchers minds as they express themselves in their blogs.

As usual, it has now become a taboo to fully open source or in public domain any work or research materials.

Always lock them behind paywalls, royalty fees and patents.

It's simply not worth the good faith that people will respect "public domain work" and "open source" designs and codes.

Link:
- [pwnaccelerator.github.io]
- [www.theregister.co.uk]

(required) • June 19, 2018 9:26 AM

"Do you really want an immigrant who's very first act upon entering your country, is to break the law?"

I want someone who can form a coherent sentence in charge of our policy either way.

In fact the founding of "our country" here in North America wasn't exactly legal at inception...
It's funny how pseudo-hardline "law and order" types fail to address that intrinsic fact.

If you want to address someone who is clearly breaking US law, Donald John Trump needs shiny bracelets more than any single migrant I think we've seen cross the border under any circumstance, because his crimes far and away surpass anything any immigrant to this country has EVER been accused of in its history.

So, to answer your question, sure I'd like everything to be by the book. The fish rots at the head though.

vas pup • June 19, 2018 10:28 AM

Two good articles on AI:
IBM’s machine argues, pretty convincingly, with humans:
[www.bbc.com]
"On a stage in San Francisco, IBM’s Project Debater spoke, listened and rebutted a human’s arguments in what was described as a groundbreaking display of artificial intelligence.
The machine drew from a library of “hundreds of millions” of documents - mostly newspaper articles and academic journals - to form its responses to a topic it was not prepared for beforehand.
“A future bone of contention, Prof Reed suggested, might not be the AI system itself - but the data it is fed, and what biases may be contained within.”

Can we trust AI if we don't know how it works?
[www.bbc.com]
"Imagine being refused health insurance - but when you ask why, the company simply blames its risk assessment algorithm.
Or if you apply for a mortgage and are refused, but the bank can't tell you exactly why.
Or more seriously, if the police start arresting people on suspicion of planning a crime solely based on a predictive model informed by a data-crunching supercomputer.
These are some of the scenarios the tech industry is worrying about as artificial intelligence (AI) marches inexorably onwards, infiltrating more and more aspects of our lives
These software algorithms are becoming so complex even their creators don't always understand how they came up with the answers they did.
David Stern, quantitative research manager at G-Research, a tech firm using machine learning to predict prices in financial markets, warns that "the most rapid progress in AI research in recent years has involved an increasingly data-driven, black box approach.
Adrian Weller, program director for AI at The Alan Turing Institute, suggests that the need to understand how a machine reaches its decisions will depend on how critical those decisions are. And other considerations might be more important than explicability.
"If an algorithm recommended I be imprisoned for six years, I'd want an explanation which would enable me to know if it had followed appropriate process, and allow a meaningful ability to challenge the algorithm if I disagree," says Dr Weller.
"I agree with recommendations that we should require companies to be clear about when an algorithm is doing something, particularly if we might otherwise expect that it's a human," he adds.
Without these safeguards there is a risk people could be discriminated against without knowing why and become "extremely marginalized".
To tackle the transparency issue the European Union's GDPR [General Data Protection Regulation] legislation has introduced a right to know if an automated process was used to make a decision.
"The concept of automated decision making in GDPR is that you should not be able to take a decision that affects the fundamental rights of a data subject based solely on automated decision making," explains Mr Deem.
We have a right to some human explanation and oversight. But what if companies can't explain it? It's a grey area that will have to be tested in the courts.
So will we be happy to work alongside super-intelligent machines making beneficial decisions we might not be able to understand, or will this make us slaves to automation at the expense of our rights and freedoms as humans?"

CallMeLateForSupper • June 19, 2018 11:44 AM

"Hotel rooms will serve as the newest homes for Amazon's Alexa starting this summer. Amazon announced a special version of its virtual assistant, Alexa for Hospitality, that will live across Echo devices placed in hotels, vacation rentals, and other similar locations."

Translation: the "personal assistant" craziness is set to spread beyond private homes.

You will be able to play with Alexa (admit it: you want to) in your hotel room (in case you don't want to sleep or otherwise relax) and without the inhumane inconvenience of ordering and installing, not to mention coughing up any of your own money.

But if an always-listening microphone in your hotel room is just too creepy to exist, Amazon understands: "According to an Amazon representative, hotel guests can request for the Echo device to be removed from their room if they do not want to make use of Alexa during their stay."

Being a pro-active guy, I would simply unplug the thing and carefully relocate it as far from "my space" as possible.

[arstechnica.com]

PatriotJune 19, 2018 10:29 PM


From [superuser.com]

According to RFC 4880,

"String-to-key (S2K) specifiers are used to convert passphrase strings into symmetric-key encryption/decryption keys. They are used in two places, currently: to encrypt the secret part of private keys in the private keyring, and to convert passphrases to encryption keys for symmetrically encrypted messages."

The latter works; the former, for the secret part of private keys, does not. The following command in GPG2:

gpg2 --s2k-cipher-algo AES256 --s2k-digest-algo SHA512 --s2k-mode 3 --s2k-count 65000000 --export-secret-keys | gpg2 --list-packets

Shows a result that includes:

iter+salt S2K, algo: 7, SHA1 protection, hash: 2,
protect count: 13107200.

So, it's a discreet, de facto downgrade to AES128 and GPU-friendly SHA-1 from what was expected. This problem was brought up here [dev.gnupg.org] long ago, and then lessened in urgency as a question after two years of inaction.

Gpg-agent has a default that limits the time that the KDF can take.

What I want to know is how to account for Werner Koch's inaction. I want to know why he does not want PGP in the OpenPGP standard to be as strong as it could be, even as outlined in RFC 4880 itself.

bttb • June 20, 2018 7:14 AM

Seymour Hersh for most of this hour at:
[www.democracynow.org]
or, perhaps, a Pacifica radio station or TV channel.

"American investigative journalist and political writer based in Washington, D.C. He is a longtime contributor to The New Yorker magazine on national security matters and has also written for the London Review of Books since 2013.[5][6]"
[en.wikipedia.org]

JG4 • June 20, 2018 8:17 AM


In case you were wondering why we need computer security.

Violent Chimp War Was About the Same Stuff Humans Fight Over
Insights from the Jane Goodall archive at Duke trace the origins of the “Gombe War” to power and sex.
[work.qz.com]

It will be interesting to see if and how humans can navigate post-scarcity. The last commodity in short supply will be trust, and that may result in extinction.

I still need to get an autographed copy of "In Human Hands" and see if it defines Grinspoon's gauntlet. My working definition is the narrow space (of possibly negative volume) where political skills (scalability of trust) are tested against destructive capacity.

bttb • June 20, 2018 9:21 AM

@JG4

Thank you for listing the Naked Capitalism link, above, on Noam Chomsky:

"It’s no wonder that most Americans are clueless about why “their” country is feared and hated the world over. It remains unthinkable to this day, for example, that any respectable “mainstream” U.S. media outlet would tell the truth about..."
[www.truthdig.com]


Living in the USA, is it propaganda when Trump, and others, talk about: America, the victim; for example with trade treaties, trade deficits, NATO payment issues, Intelligence matters, Iran Treaty, etc.; of course with hind sight things could have been done differently..., but victim?

Food for thought ("'FFT'"):
"Our country's biggest enemy is the fake news?"
Trump June 2018

vas pup • June 20, 2018 12:23 PM

@Clive: That is amazing fact on Mexican football fans. I have another question - may be a little bit esoteric: if all Chinese population will thing simultaneously about something bad (kind of killing by thought) e.g. leader of other country, is it possible he/she died of stroke or heart attack as result? Sounds crazy? Or let say one billion voodoo dolls pierced simultaneously by the pins?
We have not too much knowledge about such synchronized mental/biological power yet.

Rachel • June 20, 2018 8:35 PM

JG4

Nice lock story! Cost you part of your torch though!

you may be interested in lock labs hosted by Bosnian Bill

[locklab.com]

he shows a portable 'safe' bag made by pacsafe here, it meets his approval - I believe the sort of thing you would appreciate
for the passing reader: Master Locks are absolutely not safe, as demonstrated by BB

Clive Robinson • June 21, 2018 1:49 AM

@ vas pup,

We have not too much knowledge about such synchronized mental/biological power yet.

Just a few years ago science had kind of ruled out ESP abilities and had also ruled out other EM relayed activities with regards the brain of most living cretures.

However the "plants have feelings" crowd gave science a bit of a kick up the backside by demonstrating that sick plants had different electrical fields and that other close by plants would respond to the sick plant. Whilst cause and effect were not seperated from what I remember it did start people investigating.

Roger Penrose went out on quite a long limb over quantum structurrs in the brain. Whilst none have yet been found there they have in other biologicals. The recent discovery of "lower than red" photosynthesis has generated yet more renewed interest in such quantum effects in biologicals.

But backto the brain we now have proof that the brain will respond to EM signals and "mag pulse" systems are starting to be used in medical therapy trials to try and ease if not stop the biggest epidemic heading most of our ways which is dementia.

So I would not rule out further research showing us even more interesting results...

JonKnowsNothing • June 21, 2018 2:36 AM

Greetings and Salutations...

After being In The Dark for soooo long and unable to access this fantastic site I have "uncovered the problem".

Of course, it can be said the problem is Right In Your Face because of the nature of the blog. The idea that an old piece of junk like my system should be able to connect to a High Class Security Topic Blog with no doubt every patch ever released, patched and re-patched and patched again plus the every possible security setting on the server that an Admin can tweak from here to eternity....

For those who care...

I accessed the blog with no problem then On A Day it went 404. That's all the info I had. I could reach the blog from another browser but still my old hunk of junk wouldn't connect. So the blog was fine. I could connect to everything else but not here ...

I found the problem while perusing some help text in Firefox which like all searches suggested things I wasn't searching for and instead offered up something totally different. What caught my attention was the topic header was about 404 pages...

Hmmm 404 on a recent Firefox release... Hmmm Hmmm

Well what else would a desperate user do? I followed the Rat Hole and this time I found The Rat.

And the rat is:

TLS 1.2 needs to be enabled

Given my cursory review it is clear that somewhere between Here and There, a setting requiring TLS 1.2 was forced ON and rejecting all other connections. As this appears to be the New Security Setting De Jour... I set my old hunkajunka to TLS 1.2 (it did complain of course) and Voila! Friday Squid Blog Soup and Salad.

:)

I've no idea if the connection will stay up but gosh... nice to see something besides a blank page..

VinnyG • June 21, 2018 6:48 AM

@(required) re: kinetic response - Are you mindful that my "sure", your "sure", and "their" "sure" may differ markedly (the latter is likely to weight anticipated political outcomes far more heavily than objective evidence?) Isn't that what standards (of anything, but in this example particularly of evidence) are about in the first place? Are you willing to get a missile on your lap based on what some wannabe warmonger wants to believe?

(required) • June 21, 2018 8:14 PM

@vinnyg

"Are you willing to get a missile on your lap based on what some wannabe warmonger wants to believe?"

You're asking what exactly here, can people in high positions lie and start a war that has consequences for me personally? Yes absolutely. We have been given very limited rights to vote for a local representative, and those representatives largely police themselves and decide what we as a national entity believe. A quorum of them have in effect absolute power should they manage to wield it coherently, for good or bad. We have submitted ourselves to that reality by virtue of being born here and not having the temerity to leave. It itself decides whether we are at war, with whom, when, why, and what is reported of it internally. It has the power to write its own rules, and when manipulated coherently by powerful monied non-public interests it itself has the power to disregard ALL of them at will also. There are really no consequences for mistakes in this system, unlike say war. There's been very little consequence for massive consequential lies either, campaigns of illegal action, coverups thereupon, etc.

War with massive mistakes and terrible unacceptable consequences is in my estimation a matter of time.

You're asking if I'm willing to accept that. The answer is no, I'm working on it with little success.
Very little.

In my view we need to re-establish serious actual consequences for lying, right now.
Everything hinges off of veritas in our society in every direction. It's failing.
It's being deliberately chiseled at by known saboteurs we have tolerated far too long.
That's where we need to begin swinging the broom, before we can debate merits.

I'm certainly happy entertaining suggestions if you have any Vinny. Tar/feathers is taken already.

Anura • June 22, 2018 12:24 AM

I was reading the latest emptywheel post on Malwaretech, and it strikes me that this case is an awful lot like trying to arrest a gun maker for the homicide committed with the gun they made. I wonder, if in this age of cyberwarefare, we can make a second amendment argument for why citizens have a right to keep and bear malware? Probably not, but it would be a fun case to watch.

65535 • June 22, 2018 1:00 AM

@ Zephyr4

“DHS is reportedly developing a massive new biometric and biographic database with extensive data on citizens and foreigners alike. The Homeland Advanced Recognition Technology (HART) database will reportedly include at least seven biometric identifiers, including face and voice data, tattoos, DNA, scars, and other "physical descriptors" on as many as 500 million people. The agency has been remarkably hush-hush on how HART will be utilized — but the possibilities are frightening.”-theweek

[theweek.com]

Yes, that is truly unsettling. This could include all pictures from school graduation photos to cameras on the street and in police cruisers photo technology and many others.

I would not rule out the possibility of finger print un-lockers on Smartphone’s exfiltration those prints to Homeland Advanced Recognition Technology database via metadata.

This leads back to my original theory that lawyers are not be trained to handle complex digital cases in an economic fashion as they were reguarding industrial safety legal issues of the previous industrial booms [exploding Auto gass tanks, weak and dangerous electrical devices and building fire hazords and so on].

“…the lack of law firms handling digital cases and the high cost of those case the average Jane/Joe is getting buried in costs and red tape. The balance of digital spy items out in the public’s hands far exceeds the legal community ability to handle those cases in a cost effective way.”-65535

Sure the EFF and the ACLU are handling as many major digital cases as possible but they are backup for years in this digital legal sector. There just too few good lawyer to handles these new and complex digital cases.

The legal system must adjust to all of the new digital products in the public’s hands. There needs to be more digitally trained lawyers to keep the public safe from so advertised “safe” digital devices being developed, sold and turned against the public for various spying and other dangerous purposes [IoT].

@ gordo

"A former coder for the CIA has been indicted for computer hacking and espionage for allegedly passing the agency’s computer intrusion secrets to WikiLeaks…”

[www.thedailybeast.com]

I would like to see the hourly billing cost of this guy’s lawyers. I bet it is quite high. This goes back to my theory of a scarcity of good digital lawyers. To repeat:

“…the lack of law firms handling digital cases and the high cost of those case the average Jane/Joe is getting buried in costs and red tape. The balance of digital spy items out in the public’s hands far exceeds the legal community ability to handle those cases in a cost effective way.”-65535

@ Wesley Parish

Re: Think of the Children

“For what it's worth, the separation of the legislature and the courts is relatively recent: it didn't exist in the Roman Republic…”

I agree. To add to the public’s woes for what it’s worth there are not that many digitally trained lawyers who can handle these cases in an economic fashion which is a relatively recent problem seen during the tech boom.

Both digitally trained judges and law makers are rather scarce in the population.

@ Thoth

“Yubico finally apologized for their bad behaviour ... but I don't think the researchers would ever get their fair share of bug bounty money or be compensated fully for their loses.”

I agree.

But, what lawyer will touch this complex digital case in an economic fashion? I would guess very few. There is a scarcity of good digital lawyers.

@ CallMeLateForSupper

"Hotel rooms will serve as the newest homes for Amazon's Alexa starting this summer. Amazon announced a special version of its virtual assistant, Alexa for Hospitality, that will live across Echo devices placed in hotels, vacation rentals, and other similar locations…if an always-listening microphone in your hotel room is just too creepy to exist, Amazon understands: "According to an Amazon representative, hotel guests can request for the Echo device to be removed from their room if they do not want to make use of Alexa during their stay."-arstechnia

[arstechnica.com]

I wonder how long it will take hotels to in mandatory Alexa device in their rental agreements?

Probably not too long. The public will be “conditioned” to accept this handy spy device.

What lawyer will touch this type of digital case? Probably very few. The few good digital lawyers work for the big tech companies. There are too few good digital lawyers to handle this type of case. Or too few to handle it in an economic fashion.

What law maker will stop it? Sen. Wyden? He has got his hands full as it is. There are too few lawyers and lawmaker that are digitally trained to handle the on gusher of safe not-so-safe digital devices.

Try to hire a good lawyer to take on Alexa’s security holes and you will find it quite expensive or impossible. We need more digitally trained lawyers and law makers to fight complex and dangerous digital devices dumped on us daily.

The problem will get worse until some large digital spy company is slapped with a costly lawsuit. That will require more digitally trained lawyers and law makers.

Clive Robinson • June 22, 2018 3:40 AM

@ Thoth,

Big MNC ITY Security corp (Yubico) steals two researchers work and claimed a bug bounty of USD$ 5000 from Google.

As you know I have a certain bias when it comes to corps and companirs steeling work of individuals without credit.

As you probably realise in this case it was not the money that was the key point for both parties.

Whilst "Publish or Die" might have started in the academic community it has spread it's tenticals into the ITSec industry.

To be blunt most of ITSec products are little more than a steaming pile of "Bovine excrement" with a fancy windows user interface and a hyper inflated price, thus more often the distinction of one pile over another is "Cult of Personality" of the people behind it. Whilst this still works to an extent people are now seeing that having a lipstick coated steaming load on the premises is not desirable, so they are looking at "research contribution" as a new differentiator. Google gave this it's blessing by setting up their own research team, and as has often been seen where Google lead others follow...

Thus stealing credit for research is now the new "cult of personality", which is just a new "skin" on the old criminal act of "passing off" aka Fraud.

Clive Robinson • June 22, 2018 3:49 AM

@ Bruce,

It's Cephalopod Week! "Three hearts, eight arms, can't lose."

Yet the "Grim Reaper" collects the harvest...

The solution to this would appear to be "brains" whereby you invent your way to a longer life.

Speaking of brains some cephalopods are somewhat disadvantaged in this respect, in that they have a "hole in the middle" of theirs. Worse we talk of "heart burn" as a symptom of excess eating, those brains with a whole in the middle have the equivalent of the esophagus going through, do they suffer from "brain burn" as a consequence?

Bob Paddock • June 22, 2018 6:54 AM

@Clive Robinson

"Just a few years ago science had kind of ruled out ESP abilities"

That is not at all true. ESP, now called Anomalous Cognition (AC), has been well established by experiment. There is a very active community of scientists studying Parapsychology.

It is true that no one yet knows how it works. Things are being ruled out one at a time. We know it is not EM nor 'Broadcast' like Radio Tx/Rx.

Faraday Shielding has no meaning to Anomalous Cognition, significant security implication there.

To keep this at least tangential related to Security, always pay attention to the Local Sidereal Time, from something I've been working on:

A sidereal day - 23 hours 56 minutes and 4.1 seconds - is the amount of time needed to complete one rotation of Earth, giving a slow daily drift from Wall Clock Time. It may be possible to find Security Breaches follow a LST pattern.

[tycho.usno.navy.mil]


"Apparent Association between Effect Size in Free Response Anomalous Cognition Experiments and Local Sidereal Time" - S. James P. Spottiswoode [www.jsasoc.com]

"... A independent database of 1,015 similar trials was subsequently obtained in which trials within 1 hour of 13.5 [13.47] hours LST showed an effect size increase of 450% (p = 0.05) providing confirmation of the effect."

The conjecture is that the Earth is between the experimenter and the center of the galaxy acting as a shield. When the experimenter is exposed to the center of the galaxy ESP tests have worse results

Anomalous Cognition Effect Size: Dependence on Sidereal Time and *Solar Wind* Parameters [www.jsasoc.com] S. James P. Spottiswoode; Edwin C. May [Ed May is the scientists behind Army/CIA/SRI Remote Viewing programs. With such funding they spared no expense in developing some of their hardware. [www.jsasoc.com] ]

Geomagnetic Activity and Anomalous Cognition: A Preliminary Report of New Evidence S. James P. Spottiswoode [www.jsasoc.com]

Geomagnetic Fluctuations and Free Response Anomalous Cognition: A New Understanding S. James P. Spottiswoode [www.jsasoc.com]

Understand that some of this work was done decades ago:

Possible Effect of Geomagnetic Fluctuations on the Timing of Epileptic Seizures S.James P. Spottiswoode, BSc; Erick Tauboll, MD; Michael Duchowny, MD; Vernon Neppe, MD, PhD [www.jsasoc.com]

The bottom line is that no one today knows how Anomalous Cognition works. Ed May's current theory is Decision Augmentation Theory. That comes down to every decision we make is based on precognition of the future. Easy to dismiss out-of-hand until you understand the background of the people involved proposing it.

There is lots of work like this going on, just not in places that most people look...

Bob Paddock • June 22, 2018 7:23 AM

@Clive Robinson

"However the 'plants have feelings' crowd gave science a bit of a kick up the backside by demonstrating that sick plants had different electrical fields and that other close by plants would respond to the sick plant. Whilst cause and effect were not seperated from what I remember it did start people investigating."

"Floral signs go electric" - [www.bristol.ac.uk] ; 2013.

Local to you to pay them a visit perhaps?

Comes down to the flowers use electrostatic fields as a 'Gas Guage' to let the bees know when they have nectar available. Don't want the bees showing up when there is nothing to offer and have them lose interest.

See also: Detection and Learning of Floral Electric Fields by Bumblebees by Dominic Clarke et al. Science 340, 66 (2013); DOI: 10.1126/science.1230883 [science.sciencemag.org]

[www.npr.org]

To keep this Security related consider the somewhat related electrostatic effect the Aharonov Bohm Effect. Few consider the Potentials and spend all of their time focusing on Fields. E. T. Whittaker showed that Electromagnetic Fields could be broken down into two Potentials as I understand his work (Math really isn't my thing. In Math this is known as Curl Free Magnetics. See Raymond C. Gelinas patents assigned to Honeywell for devices that are purported to communicate through Faraday Shields and salt water.)

There is little in the way of detection equipment for Potentials, publicly available; Barkenhausen Effect (See Feynman Lecture on Phycics Volume-II) is one crude method.

Our equipment only detects the things that we know how to detect. :-(

Any insights here Clive?

As an aside pay attention to the increasing levels of UV-C and the decreasing levels of Insects in the wild...

Clive Robinson • June 22, 2018 3:09 PM

@ Bruce and the usuall suspects,

The following paper is about differential testing of various C compilers. Quite a few (read hundreds) of bugs have been found over the years by random testing.

Whilst many are of minor interest to many, many can be used as starting points for vulnerabilities.

[www.complang.tuwien.ac.at]

Clive Robinson • June 22, 2018 6:00 PM

@ Bob Paddock,

Any insights here Clive?

As an engineer by training as I did not have the money to put myself through University at the usual age to become a scientist, I tend to make decisions based on what I can measure in a manner that is of experimental use.

As I tell trainee engineers and scientists, the most important thing they need to learn is "testing techniques", not only is it a fundemental part of the scientific method, you do not learn anything new when things do not go wrong or you don't fix them when they do.

It's one of the reasons "ITSec" gets my goat, as nobody wants to come up with rational and testable measurands (it would wipe out the lucrative "Snake Oil Market" ITSec products have become). Even information theory is lacking in appropriate measurands for more than just it's statistical observations.

As for those who write programs, and give the testing to others, "nugh said already" ;-)

Thus I can usually tell when measurands are missing and can sometimes describe the required properties they should have to move onto the next stage of observational verification. Worse though I can spot a number of "experimental errors" or poor methodology.

The most famous example I can think of this is the "Rat Maze Experiments debunking". As you are probably aware there were a very large number of papers written about rats food treats and mazes. A researcher from another field was skeptical of what was being claimed, so repeated the experiments. To cut a longish story short the researcher found that all the tests had significant failings in methodology, and when the errors were eliminated, unsuprisingly the experimental results were not the same as all those previous experiments that were written up and published...

Thus I am cautious about any paper written where recognised measurands and methodologies are not used, as there is little of predictive use, or to aid in repeating tests by others to confirm the observational data.

That is not to say that the use of new methods or measures is verboten, just that they should go through the "mill of acceptance" prior to their use as much more than observations and hypotheses. If they do survive the mill then they can be used for verification and then prediction.

As many know we actually realise that we know less than there is to know, and there is a finite limit on what can be known. Thus there will always be things that are unknown to us, and with time what we know now may well become forgotten knowledge in the future. That is, in the same way that history shows there is now forgotten knowledge from earlier human history some of which we rediscover.

Thus a number of simple predictions can be made but of sufficient generality that they could be considered either banal or obvious. One such is that our understanding of not just the theory of mind put the practicalities of the bio-mechanics of the brain will improve. Of less obviousness is that at some point we will find out if the human brain does have quantum abilities as some other biological processes are now known to do.

But will we find out if human creativiry is purely based on complex yet determanistic rules or on random processes or a combination of both?

We may never know due to some fundemental questions we may never be able to answer.

It's currently not possible to say as we do not have a testable method of correctly identifing by observation of the outout alone the difference between determanistic and random processes, and in all probability we may never be able to.

Which gives rise to the possibility that "random" does not realy exist. If it does not then we might have to consider the possability that we have determanistic but chaotic systems that are in effect one way. That is they are so sensitive to initial conditions at any given point in time that they quickly progress beyond a point where they can be "wound back".

Theory has an axiom that a closed process has memory of all previous states/interactions. But the reality is it is not possible to measure a system with sufficient accuracy to carry out an experiment to verify this (lesser flea / turtles all the way down issue).

It is also dependent on if the universe is truly analog at all levels or quantitative at some level below which you can not go. If the latter is true then it is not possible for a system closed or open to have "memory" of all previous states/interactions (see "Cantor's diagonal argument" that was used by both Gödel and Turing in the 1930's to answer certain fundamental questions).

One thing we are aware of is that "madness has stalked early contemplaters of infinity by rigours process", but not by later mathmeticians. Various suggestions have been made for this including that of inheritable genetics. Which if true has other implications we would probably rather were not answered.

Which brings us to an awkward philosophical question. We know that there are limits on our knowledge based on our current understanding of the physical finite universe. Thus the question of "What do we want to know and what do we not want to know arises?" there is a certain logical reasoning that says we have no choice in the matter...

What we can reasonably safely assume is that what we currently understand as "human" will be gone long long before the universe reaches even close to maximum entropy. But that actually is saying little as we may continue to evolve into forms we consider not human by our current standards.

Anyway it's midnight in the UK and I have to get up early tomorow/today ;-)

Subscribe to comments on this entry

Leave a comment

← Thomas Dullien on Complexity and Security Ridiculously Insecure Smart Lock →

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of IBM Resilient.