July 2018 - cypherpunks-legacy

Re: NYT covers China cyberthreat
by Scott Weeks 06 Jul '18

06 Jul '18

--- Valdis.Kletnieks(a)vt.edu wrote: On Wed, 20 Feb 2013 15:39:42 +0900, Randy Bush said: > boys and girls, all the cyber-capable countries are cyber-culpable. you > can bet that they are all snooping and attacking eachother, the united > states no less than the rest. news at eleven. The scary part is that so many things got hacked by a bunch of people who made the totally noob mistake of launching all their attacks from the same place.... ------------------------------------------------ Maybe. The report says the following, but it doesn't make clear (I'm only on page 31, so I don't know if they do later in the report) if this is a small botnet, or individuals manning the 937 C&C servers: B;B; APT1 controls thousands of systems in support of their computer intrusion activities. B;B; In the last two years we have observed APT1 establish a minimum of 937 Command and Control (C2) servers hosted on 849 distinct IP addresses in 13 countries. The majority of these 849 unique IP addresses were registered to organizations in China (709), followed by the U.S. (109). B;B; In the last three years we have observed APT1 use fully qualified domain names (FQDNs) resolving to 988 unique IP addresses. B;B; Over a two-year period (January 2011 to January 2013) we confirmed 1,905 instances of APT1 actors logging into their attack infrastructure from 832 different IP addresses with Remote Desktop, a tool that provides a remote user with an interactive graphical interface to a system. B;B; In the last several years we have confirmed 2,551 FQDNs attributed to APT1. B;B; We observed 767 separate instances in which APT1 intruders used the b HUC Packet Transmit Toolb or HTRAN to communicate between 614 distinct routable IP addresses and their victimsb systems using their attack infrastructure. scott ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CRYPTO-GRAM, September 15, 2010
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM September 15, 2010 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1009.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Consumerization and Corporate IT Security News Schneier News More Skein News Wanted: Skein Hardware Help ** *** ***** ******* *********** ************* Consumerization and Corporate IT Security If you're a typical wired American, you've got a bunch of tech tools you like and a bunch more you covet. You have a cell phone that can easily text. You've got a laptop configured just the way you want it. Maybe you have a Kindle for reading, or an iPad. And when the next new thing comes along, some of you will line up on the first day it's available. So why can't work keep up? Why are you forced to use an unfamiliar, and sometimes outdated, operating system? Why do you need a second laptop, maybe an older and clunkier one? Why do you need a second cell phone with a new interface, or a BlackBerry, when your phone already does e-mail? Or a second BlackBerry tied to corporate e-mail? Why can't you use the cool stuff you already have? More and more companies are letting you. They're giving you an allowance and allowing you to buy whatever laptop you want, and to connect into the corporate network with whatever device you choose. They're allowing you to use whatever cell phone you have, whatever portable e-mail device you have, whatever you personally need to get your job done. And the security office is freaking. You can't blame them, really. Security is hard enough when you have control of the hardware, operating system and software. Lose control of any of those things, and the difficulty goes through the roof. How do you ensure that the employee devices are secure, and have up-to-date security patches? How do you control what goes on them? How do you deal with the tech support issues when they fail? How do you even begin to manage this logistical nightmare? Better to dig your heels in and say "no." But security is on the losing end of this argument, and the sooner it realizes that, the better. The meta-trend here is consumerization: cool technologies show up for the consumer market before they're available to the business market. Every corporation is under pressure from its employees to allow them to use these new technologies at work, and that pressure is only getting stronger. Younger employees simply aren't going to stand for using last year's stuff, and they're not going to carry around a second laptop. They're either going to figure out ways around the corporate security rules, or they're going to take another job with a more trendy company. Either way, senior management is going to tell security to get out of the way. It might even be the CEO, who wants to get to the company's databases from his brand new iPad, driving the change. Either way, it's going to be harder and harder to say no. At the same time, cloud computing makes this easier. More and more, employee computing devices are nothing more than dumb terminals with a browser interface. When corporate e-mail is all webmail, corporate documents are all on GoogleDocs, and when all the specialized applications have a web interface, it's easier to allow employees to use any up-to-date browser. It's what companies are already doing with their partners, suppliers, and customers. Also on the plus side, technology companies have woken up to this trend and -- from Microsoft and Cisco on down to the startups -- are trying to offer security solutions. Like everything else, it's a mixed bag: some of them will work and some of them won't, most of them will need careful configuration to work well, and few of them will get it right. The result is that we'll muddle through, as usual. Security is always a tradeoff, and security decisions are often made for non-security reasons. In this case, the right decision is to sacrifice security for convenience and flexibility. Corporations want their employees to be able to work from anywhere, and they're going to have loosened control over the tools they allow in order to get it. This essay first appeared as the second half of a point/counterpoint with Marcus Ranum in Information Security Magazine. You can read Marcus's half there. http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1519… or http://tinyurl.com/22qhrem ** *** ***** ******* *********** ************* News Breaking into a garage in seconds. Garage doors with automatic openers have always seemed like a lot of security theater to me: people regularly treat their garage door as if it had the same security as their front door. http://www.youtube.com/watch?v=CMz1tXBVT1s Hacking cars through wireless tire-pressure sensors. It's minor, but this kind of thing is only going to get worse. http://www.technologyreview.com/communications/25962/ http://arstechnica.com/security/news/2010/08/cars-hacked-through-wireless-t… or http://tinyurl.com/29tdys8 http://www.h-online.com/security/news/item/Known-by-their-wheels-1058068.ht… or http://tinyurl.com/3yqbdlf http://www.winlab.rutgers.edu/~Gruteser/papers/xu_tpms10.pdf Earlier paper on automobile computer security: http://www.autosec.org/pubs/cars-oakland2010.pdf Good essay by Seth Godin on the "Fear Tax": http://sethgodin.typepad.com/seths_blog/2010/08/the-fear-tax.html Intel buying McAfee is another example of a large non-security company buying a security company. I've been talking about this sort of thing for two and a half years. http://www.schneier.com/blog/archives/2010/08/intel_buys_mcaf.html Malware might have been a contributory cause of an air crash. I say "might" because it's hard to get reliable information. http://www.schneier.com/blog/archives/2010/08/malware_contrib.html Skeletal identification: http://www.physorg.com/news201454875.html And you thought fingerprints were intrusive. danah boyd on social steganography: http://www.zephoria.org/thoughts/archives/2010/08/23/social-steganography-l… or http://tinyurl.com/33zrwyz Detecting deception in conference calls: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1572705 Their detection system is only slightly better than random, but this kind of thing will only get better. Full-body scanners in roving vans: http://www.schneier.com/blog/archives/2010/08/is_the_whole_co.html Since a fatal crash a few years ago, Boston T (their subway) operators have been forbidden from using -- or even having -- cell phones while on the job. Passengers are encouraged to report violators. But sometimes T operators need to use their official radios on the job, and passengers can't tell the difference. The solution: mark their official radios with orange tape. Of course, no T operator would ever think of putting bright orange tape on his cell phone. Because if he did that, the passengers would immediately know not to report him. http://www.boston.com/news/local/massachusetts/articles/2010/08/26/orange_t… or http://tinyurl.com/32kzqqf Chilling interview about misidentification and the court system. http://www.schneier.com/blog/archives/2010/08/misidentificati.html In Australia, a high school teacher assigned a movie-plot threat contest problem to his students, and everyone went crazy. He sounds like me, really. http://www.schneier.com/blog/archives/2010/08/high_school_tea.html Australian police are claiming the assignment was illegal, so Australians who enter my movie-plot threat contests should think twice. Also anyone writing a thriller novel about terrorism, perhaps. Interesting research: eavesdropping on smart homes with distributed wireless sensors. http://www.cs.virginia.edu/~stankovic/psfiles/UbiComp192-srinivasan-1-1.pdf or http://tinyurl.com/295j586 This, about the Pentagon and cyber-offense, is beyond stupid. http://www.schneier.com/blog/archives/2010/09/cyber-offence_i.html Very clever attack against a quantum cryptography system. http://www.nature.com/news/2010/100829/full/news.2010.436.html http://dx.doi.org/10.1038/nphoton.2010.214 UAE man-in-the-middle attack against SSL. http://www.slate.com/id/2265204 http://www.eff.org/deeplinks/2010/08/open-letter-verizon Great article on terrorism entrapment: http://www.salon.com/news/opinion/feature/2010/07/06/fbi_foiled_terrorism_p… or http://tinyurl.com/23nhkcy Parental fears vs. realities: http://www.npr.org/blogs/health/2010/08/30/129531631/5-worries-parents-shou… or http://tinyurl.com/372dyj9 The new German ID card is hackable. No surprise there. http://www.thelocal.de/sci-tech/20100824-29359.html In Japan, paint-filled orange balls are an anti-robbery device. http://www.schneier.com/blog/archives/2010/09/orange_balls_as.html Problems with Twitter's OAuth authentication system. http://arstechnica.com/security/guides/2010/09/twitter-a-case-study-on-how-… or http://tinyurl.com/2u8ofep http://hueniverse.com/2010/09/all-this-twitter-oauth-security-nonsense/ or http://tinyurl.com/2cmgju9 http://blog.nelhage.com/2010/09/dear-twitter/ The Onion on national security: "Smart, Qualified People Behind the Scenes Keeping America Safe: 'We Don't Exist.'" http://www.theonion.com/articles/smart-qualified-people-behind-the-scenes-k… or http://tinyurl.com/26jx93v Kenzero is a Japanese Trojan that collects and publishes users' porn surfing habits, and then blackmails them to remove the information. http://www.schneier.com/blog/archives/2010/09/kenzero.html Vulnerabilities in US-CERT network: http://www.wired.com/threatlevel/2010/09/us-cert/ http://www.nextgov.com/nextgov/ng_20100909_5549.php?oref=topnews http://www.dhs.gov/xoig/assets/mgmtrpts/OIG_10-111_Aug10.pdf http://gcn.com/articles/2010/09/09/us-cert-riddled-with-security-holes.aspx… or http://tinyurl.com/3a4xz56 Not answering questions at U.S. customs. http://knifetricks.blogspot.com/2010/04/i-am-detained-by-feds-for-not-answe… or http://tinyurl.com/264resf Police set up a highway sign warning motorists that there are random stops for narcotics checks ahead, but actually search people who take the next exit. http://420tribune.com/2010/03/narcotics-checkpoint/ Popular usernames and passwords, in graphical form. http://www.dragonresearchgroup.org/insight/sshpwauth-cloud.html ** *** ***** ******* *********** ************* Schneier News Back in May, I attended the EastWest Institute's First Worldwide Cybersecurity Summit in Dallas. I only had eight minutes to speak, and tried to turn the dialog to security, privacy, and the individual. http://www.youtube.com/watch?v=I6ZkU2fUM5w The conference: http://www.ewi.info/worldwide-cybersecurity-summit Commentary on my short talk: http://www.insidehighered.com/blogs/law_policy_and_it/watch_this_video On September 16, I'll be a keynote speaker at IDC's IT Security Conference 2010 in London. http://guest.cvent.com/EVENTS/Info/Summary.aspx?e=4cc6aaee-f08f-493b-8090-d… or http://tinyurl.com/2aok7d2 On September 18, I'll be a keynote speaker at Hacktivity in Budapest. http://hacktivity.hu/ On October 1, I'll be a keynote speaker at CELAES 2010: XXV FELABAN Conference on Bank Security in Miami. http://www.felaban-seguridadbancaria.com/index.php On October 8, I'll be giving a luncheon keynote speech at the Minnesota Library Association Conference in Rochester, MN. http://mnlibraryassociation.org/mlaconference10/ On October 12, I'll be a keynote speaker at RSA Europe in London. http://www.emc.com/microsites/rsa-conference/2010/europe/index.htm ** *** ***** ******* *********** ************* More Skein News Skein is my new hash function. Well, "my" is an overstatement; I'm one of the eight designers. It was submitted to NIST for their SHA-3 competition, and one of the 14 algorithms selected to advance to the second round. Last week was the Second SHA-3 Candidate Conference. Lots of people presented papers on the candidates: cryptanalysis papers, implementation papers, performance comparisons, etc. There were two cryptanalysis papers on Skein. The first was by Kerry McKay and Poorvi L. Vora. They tried to extend linear cryptanalysis to groups of bits to attack Threefish (the block cipher inside Skein). It was a nice analysis, but it didn't get very far at all. The second was a fantastic piece of cryptanalysis by Dmitry Khovratovich, Ivica Nikolie, and Christian Rechberger. They used a rotational rebound attack to mount a "known-key distinguisher attack" on 57 out of 72 Threefish rounds faster than brute force. It's a new type of attack -- some go so far as to call it an "observation" -- and the community is still trying to figure out what it means. It only works if the attacker can manipulate both the plaintexts and the keys in a structured way. Against 57-round Threefish, it requires 2**503 work -- barely better than brute force. And it only distinguishes reduced-round Threefish from a random permutation; it doesn't actually recover any key bits. Even with the attack, Threefish has a good security margin. Also, the attack doesn't affect Skein. But changing one constant in the algorithm's key schedule makes the attack impossible. NIST has said they're allowing second-round tweaks, so we're going to make the change. It won't affect any performance numbers or obviate any other cryptanalytic results -- but the best attack would be 33 out of 72 rounds. The second-round algorithms are: BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grostl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein. You can find details on all of them, as well as the current state of their cryptanalysis, at the SHA-2 Zoo site. NIST will select approximately five algorithms to go on to the third round by the end of the year. In other news, we're once again making Skein polo shirts available to the public. Those of you who attended either of the two SHA-3 conferences might have noticed the stylish black Skein polo shirts worn by the Skein team. Anyone who wants one is welcome to buy it, at cost. All orders must be received before October 1, and we'll have all the shirts made in one batch. http://www.schneier.com/skein-shirts.html The Second SHA-3 Candidate Conference: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/index.html Conference program: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/Program_… or http://tinyurl.com/2g24ybz Kerry McKay and Poorvi L. Vora's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2cj5swk http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/M… or http://tinyurl.com/282kv6h Dmitry Khovratovich, Ivica Nikolie, and Christian Rechberger's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/28uulbg http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/R… or http://tinyurl.com/2b2ltnu Known-key distinguisher: http://www.springerlink.com/content/y2437717g1630plp/ https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=31551 or http://tinyurl.com/2fvjare Our Skein update from the SHA-3 conference: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/242x77w Skein website: http://www.skein-hash.info/ Skein paper: http://www.schneier.com/skein.pdf Skein source code: http://www.schneier.com/code/skein.zip My previous essays on Skein: http://www.schneier.com/essay-249.html http://www.schneier.com/blog/archives/2009/09/skein_news.html SHA-3 website: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html SHA-3 Zoo: http://ehash.iaik.tugraz.at/wiki/The_SHA-3_Zoo ** *** ***** ******* *********** ************* Wanted: Skein Hardware Help As part of NIST's SHA-3 selection process, people have been implementing the candidate hash functions on a variety of hardware and software platforms. Our team has implemented Skein in Intel's 32 nm ASIC process, and got some impressive performance results. Several other groups have implemented Skein in FPGA and ASIC, and have seen significantly poorer performance. We need help understanding why. For example, a group led by Brian Baldwin at the Claude Shannon Institute for Discrete Mathematics, Coding and Cryptography implemented all the second-round candidates in FPGA. Skein performance was terrible, but when they checked their code, they found an error. Their corrected performance comparison has Skein performing much better and in the top ten. We suspect that the adders in all the designs may not be properly optimized, although there may be other performance issues. If we can at least identify (or possibly even fix) the slowdowns in the design, it would be very helpful, both for our understanding and for Skein's hardware profile. Even if we find that the designs are properly optimized, that would also be good to know. A group at George Mason University led by Kris Gaj implemented all the second-round candidates in FPGA. Skein had the worst performance of any of the implementations. We're looking for someone who can help us understand the design, and determine if it can be improved. Another group, led by Stefan Tillich at University of Bristol, implemented all the candidates in 180 nm custom ASIC. Here, Skein is one of the worst performers. We're looking for someone who can help us understand what this group did. Three other groups -- one led by Patrick Schaumont of Virginia Tech, another led by Shin'ichiro Matsuo at National Institute of Information and Communications Technology in Japan, and a third led by Luca Henzen at ETH Zurich -- implemented the SHA-3 candidates. Again, we need help understanding how their Skein performance numbers are so different from ours. We're looking for people with FPGA and ASIC skills to work with the Skein team. We don't have money to pay anyone; co-authorship on a paper -- and an Erdos number of 4 -- is our primary reward. (Also, a Skein polo shirt.) Please send me e-mail if you're interested. Our presentation and paper on Skein in a custom ASIC: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/25keymm http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/W… or http://tinyurl.com/2bddhn7 Brian Baldwin's original presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2dz4q2l http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/B… or http://tinyurl.com/2653k99 Brian Baldwin's corrected presentation and paper: http://www.ucc.ie/en/crypto/SHA-3Hardware/NISTSHA-3/Baldwin-SHA-3-Presentat… or http://tinyurl.com/2c55hb2 http://www.ucc.ie/en/crypto/SHA-3Hardware/NISTSHA-3/Baldwin-SHA-3-Paper-Aug… or http://tinyurl.com/29qbrud Kris Gaj's presentation and papers: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/26qatdx http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/G… or http://tinyurl.com/27lkjhw http://eprint.iacr.org/2010/445.pdf Stefan Tillich's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/27cpqom http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/T… or http://tinyurl.com/2d5p9p7 Patrick Schaumont's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/28t9qxc http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/S… or http://tinyurl.com/2dju4rn Shin'ichiro Matsuo's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2byyycq http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/M… or http://tinyurl.com/24qxhdo Luca Henzen's papers: http://www.vlsi.uwaterloo.ca/~ahasan/web_papers/technical_reports/web_five_… or http://tinyurl.com/2be9nj8 http://www.vlsi.uwaterloo.ca/~ahasan/web_papers/technical_reports/web_five_… or http://tinyurl.com/2g4u2dj http://www.springerlink.com/content/g0115v3272156r06/ ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2010 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

CRYPTO-GRAM, September 15, 2010
by Bruce Schneier 06 Jul '18

06 Jul '18

CRYPTO-GRAM September 15, 2010 by Bruce Schneier Chief Security Technology Officer, BT schneier(a)schneier.com http://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit <http://www.schneier.com/crypto-gram.html>. You can read this issue on the web at <http://www.schneier.com/crypto-gram-1009.html>. These same essays and news items appear in the "Schneier on Security" blog at <http://www.schneier.com/blog>, along with a lively comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: Consumerization and Corporate IT Security News Schneier News More Skein News Wanted: Skein Hardware Help ** *** ***** ******* *********** ************* Consumerization and Corporate IT Security If you're a typical wired American, you've got a bunch of tech tools you like and a bunch more you covet. You have a cell phone that can easily text. You've got a laptop configured just the way you want it. Maybe you have a Kindle for reading, or an iPad. And when the next new thing comes along, some of you will line up on the first day it's available. So why can't work keep up? Why are you forced to use an unfamiliar, and sometimes outdated, operating system? Why do you need a second laptop, maybe an older and clunkier one? Why do you need a second cell phone with a new interface, or a BlackBerry, when your phone already does e-mail? Or a second BlackBerry tied to corporate e-mail? Why can't you use the cool stuff you already have? More and more companies are letting you. They're giving you an allowance and allowing you to buy whatever laptop you want, and to connect into the corporate network with whatever device you choose. They're allowing you to use whatever cell phone you have, whatever portable e-mail device you have, whatever you personally need to get your job done. And the security office is freaking. You can't blame them, really. Security is hard enough when you have control of the hardware, operating system and software. Lose control of any of those things, and the difficulty goes through the roof. How do you ensure that the employee devices are secure, and have up-to-date security patches? How do you control what goes on them? How do you deal with the tech support issues when they fail? How do you even begin to manage this logistical nightmare? Better to dig your heels in and say "no." But security is on the losing end of this argument, and the sooner it realizes that, the better. The meta-trend here is consumerization: cool technologies show up for the consumer market before they're available to the business market. Every corporation is under pressure from its employees to allow them to use these new technologies at work, and that pressure is only getting stronger. Younger employees simply aren't going to stand for using last year's stuff, and they're not going to carry around a second laptop. They're either going to figure out ways around the corporate security rules, or they're going to take another job with a more trendy company. Either way, senior management is going to tell security to get out of the way. It might even be the CEO, who wants to get to the company's databases from his brand new iPad, driving the change. Either way, it's going to be harder and harder to say no. At the same time, cloud computing makes this easier. More and more, employee computing devices are nothing more than dumb terminals with a browser interface. When corporate e-mail is all webmail, corporate documents are all on GoogleDocs, and when all the specialized applications have a web interface, it's easier to allow employees to use any up-to-date browser. It's what companies are already doing with their partners, suppliers, and customers. Also on the plus side, technology companies have woken up to this trend and -- from Microsoft and Cisco on down to the startups -- are trying to offer security solutions. Like everything else, it's a mixed bag: some of them will work and some of them won't, most of them will need careful configuration to work well, and few of them will get it right. The result is that we'll muddle through, as usual. Security is always a tradeoff, and security decisions are often made for non-security reasons. In this case, the right decision is to sacrifice security for convenience and flexibility. Corporations want their employees to be able to work from anywhere, and they're going to have loosened control over the tools they allow in order to get it. This essay first appeared as the second half of a point/counterpoint with Marcus Ranum in Information Security Magazine. You can read Marcus's half there. http://searchsecurity.techtarget.com/magazineFeature/0,296894,sid14_gci1519… or http://tinyurl.com/22qhrem ** *** ***** ******* *********** ************* News Breaking into a garage in seconds. Garage doors with automatic openers have always seemed like a lot of security theater to me: people regularly treat their garage door as if it had the same security as their front door. http://www.youtube.com/watch?v=CMz1tXBVT1s Hacking cars through wireless tire-pressure sensors. It's minor, but this kind of thing is only going to get worse. http://www.technologyreview.com/communications/25962/ http://arstechnica.com/security/news/2010/08/cars-hacked-through-wireless-t… or http://tinyurl.com/29tdys8 http://www.h-online.com/security/news/item/Known-by-their-wheels-1058068.ht… or http://tinyurl.com/3yqbdlf http://www.winlab.rutgers.edu/~Gruteser/papers/xu_tpms10.pdf Earlier paper on automobile computer security: http://www.autosec.org/pubs/cars-oakland2010.pdf Good essay by Seth Godin on the "Fear Tax": http://sethgodin.typepad.com/seths_blog/2010/08/the-fear-tax.html Intel buying McAfee is another example of a large non-security company buying a security company. I've been talking about this sort of thing for two and a half years. http://www.schneier.com/blog/archives/2010/08/intel_buys_mcaf.html Malware might have been a contributory cause of an air crash. I say "might" because it's hard to get reliable information. http://www.schneier.com/blog/archives/2010/08/malware_contrib.html Skeletal identification: http://www.physorg.com/news201454875.html And you thought fingerprints were intrusive. danah boyd on social steganography: http://www.zephoria.org/thoughts/archives/2010/08/23/social-steganography-l… or http://tinyurl.com/33zrwyz Detecting deception in conference calls: http://papers.ssrn.com/sol3/papers.cfm?abstract_id=1572705 Their detection system is only slightly better than random, but this kind of thing will only get better. Full-body scanners in roving vans: http://www.schneier.com/blog/archives/2010/08/is_the_whole_co.html Since a fatal crash a few years ago, Boston T (their subway) operators have been forbidden from using -- or even having -- cell phones while on the job. Passengers are encouraged to report violators. But sometimes T operators need to use their official radios on the job, and passengers can't tell the difference. The solution: mark their official radios with orange tape. Of course, no T operator would ever think of putting bright orange tape on his cell phone. Because if he did that, the passengers would immediately know not to report him. http://www.boston.com/news/local/massachusetts/articles/2010/08/26/orange_t… or http://tinyurl.com/32kzqqf Chilling interview about misidentification and the court system. http://www.schneier.com/blog/archives/2010/08/misidentificati.html In Australia, a high school teacher assigned a movie-plot threat contest problem to his students, and everyone went crazy. He sounds like me, really. http://www.schneier.com/blog/archives/2010/08/high_school_tea.html Australian police are claiming the assignment was illegal, so Australians who enter my movie-plot threat contests should think twice. Also anyone writing a thriller novel about terrorism, perhaps. Interesting research: eavesdropping on smart homes with distributed wireless sensors. http://www.cs.virginia.edu/~stankovic/psfiles/UbiComp192-srinivasan-1-1.pdf or http://tinyurl.com/295j586 This, about the Pentagon and cyber-offense, is beyond stupid. http://www.schneier.com/blog/archives/2010/09/cyber-offence_i.html Very clever attack against a quantum cryptography system. http://www.nature.com/news/2010/100829/full/news.2010.436.html http://dx.doi.org/10.1038/nphoton.2010.214 UAE man-in-the-middle attack against SSL. http://www.slate.com/id/2265204 http://www.eff.org/deeplinks/2010/08/open-letter-verizon Great article on terrorism entrapment: http://www.salon.com/news/opinion/feature/2010/07/06/fbi_foiled_terrorism_p… or http://tinyurl.com/23nhkcy Parental fears vs. realities: http://www.npr.org/blogs/health/2010/08/30/129531631/5-worries-parents-shou… or http://tinyurl.com/372dyj9 The new German ID card is hackable. No surprise there. http://www.thelocal.de/sci-tech/20100824-29359.html In Japan, paint-filled orange balls are an anti-robbery device. http://www.schneier.com/blog/archives/2010/09/orange_balls_as.html Problems with Twitter's OAuth authentication system. http://arstechnica.com/security/guides/2010/09/twitter-a-case-study-on-how-… or http://tinyurl.com/2u8ofep http://hueniverse.com/2010/09/all-this-twitter-oauth-security-nonsense/ or http://tinyurl.com/2cmgju9 http://blog.nelhage.com/2010/09/dear-twitter/ The Onion on national security: "Smart, Qualified People Behind the Scenes Keeping America Safe: 'We Don't Exist.'" http://www.theonion.com/articles/smart-qualified-people-behind-the-scenes-k… or http://tinyurl.com/26jx93v Kenzero is a Japanese Trojan that collects and publishes users' porn surfing habits, and then blackmails them to remove the information. http://www.schneier.com/blog/archives/2010/09/kenzero.html Vulnerabilities in US-CERT network: http://www.wired.com/threatlevel/2010/09/us-cert/ http://www.nextgov.com/nextgov/ng_20100909_5549.php?oref=topnews http://www.dhs.gov/xoig/assets/mgmtrpts/OIG_10-111_Aug10.pdf http://gcn.com/articles/2010/09/09/us-cert-riddled-with-security-holes.aspx… or http://tinyurl.com/3a4xz56 Not answering questions at U.S. customs. http://knifetricks.blogspot.com/2010/04/i-am-detained-by-feds-for-not-answe… or http://tinyurl.com/264resf Police set up a highway sign warning motorists that there are random stops for narcotics checks ahead, but actually search people who take the next exit. http://420tribune.com/2010/03/narcotics-checkpoint/ Popular usernames and passwords, in graphical form. http://www.dragonresearchgroup.org/insight/sshpwauth-cloud.html ** *** ***** ******* *********** ************* Schneier News Back in May, I attended the EastWest Institute's First Worldwide Cybersecurity Summit in Dallas. I only had eight minutes to speak, and tried to turn the dialog to security, privacy, and the individual. http://www.youtube.com/watch?v=I6ZkU2fUM5w The conference: http://www.ewi.info/worldwide-cybersecurity-summit Commentary on my short talk: http://www.insidehighered.com/blogs/law_policy_and_it/watch_this_video On September 16, I'll be a keynote speaker at IDC's IT Security Conference 2010 in London. http://guest.cvent.com/EVENTS/Info/Summary.aspx?e=4cc6aaee-f08f-493b-8090-d… or http://tinyurl.com/2aok7d2 On September 18, I'll be a keynote speaker at Hacktivity in Budapest. http://hacktivity.hu/ On October 1, I'll be a keynote speaker at CELAES 2010: XXV FELABAN Conference on Bank Security in Miami. http://www.felaban-seguridadbancaria.com/index.php On October 8, I'll be giving a luncheon keynote speech at the Minnesota Library Association Conference in Rochester, MN. http://mnlibraryassociation.org/mlaconference10/ On October 12, I'll be a keynote speaker at RSA Europe in London. http://www.emc.com/microsites/rsa-conference/2010/europe/index.htm ** *** ***** ******* *********** ************* More Skein News Skein is my new hash function. Well, "my" is an overstatement; I'm one of the eight designers. It was submitted to NIST for their SHA-3 competition, and one of the 14 algorithms selected to advance to the second round. Last week was the Second SHA-3 Candidate Conference. Lots of people presented papers on the candidates: cryptanalysis papers, implementation papers, performance comparisons, etc. There were two cryptanalysis papers on Skein. The first was by Kerry McKay and Poorvi L. Vora. They tried to extend linear cryptanalysis to groups of bits to attack Threefish (the block cipher inside Skein). It was a nice analysis, but it didn't get very far at all. The second was a fantastic piece of cryptanalysis by Dmitry Khovratovich, Ivica Nikolie, and Christian Rechberger. They used a rotational rebound attack to mount a "known-key distinguisher attack" on 57 out of 72 Threefish rounds faster than brute force. It's a new type of attack -- some go so far as to call it an "observation" -- and the community is still trying to figure out what it means. It only works if the attacker can manipulate both the plaintexts and the keys in a structured way. Against 57-round Threefish, it requires 2**503 work -- barely better than brute force. And it only distinguishes reduced-round Threefish from a random permutation; it doesn't actually recover any key bits. Even with the attack, Threefish has a good security margin. Also, the attack doesn't affect Skein. But changing one constant in the algorithm's key schedule makes the attack impossible. NIST has said they're allowing second-round tweaks, so we're going to make the change. It won't affect any performance numbers or obviate any other cryptanalytic results -- but the best attack would be 33 out of 72 rounds. The second-round algorithms are: BLAKE, Blue Midnight Wish, CubeHash, ECHO, Fugue, Grostl, Hamsi, JH, Keccak, Luffa, Shabal, SHAvite-3, SIMD, and Skein. You can find details on all of them, as well as the current state of their cryptanalysis, at the SHA-2 Zoo site. NIST will select approximately five algorithms to go on to the third round by the end of the year. In other news, we're once again making Skein polo shirts available to the public. Those of you who attended either of the two SHA-3 conferences might have noticed the stylish black Skein polo shirts worn by the Skein team. Anyone who wants one is welcome to buy it, at cost. All orders must be received before October 1, and we'll have all the shirts made in one batch. http://www.schneier.com/skein-shirts.html The Second SHA-3 Candidate Conference: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/index.html Conference program: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/Program_… or http://tinyurl.com/2g24ybz Kerry McKay and Poorvi L. Vora's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2cj5swk http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/M… or http://tinyurl.com/282kv6h Dmitry Khovratovich, Ivica Nikolie, and Christian Rechberger's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/28uulbg http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/R… or http://tinyurl.com/2b2ltnu Known-key distinguisher: http://www.springerlink.com/content/y2437717g1630plp/ https://online.tugraz.at/tug_online/voe_main2.getvolltext?pCurrPk=31551 or http://tinyurl.com/2fvjare Our Skein update from the SHA-3 conference: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/242x77w Skein website: http://www.skein-hash.info/ Skein paper: http://www.schneier.com/skein.pdf Skein source code: http://www.schneier.com/code/skein.zip My previous essays on Skein: http://www.schneier.com/essay-249.html http://www.schneier.com/blog/archives/2009/09/skein_news.html SHA-3 website: http://csrc.nist.gov/groups/ST/hash/sha-3/index.html SHA-3 Zoo: http://ehash.iaik.tugraz.at/wiki/The_SHA-3_Zoo ** *** ***** ******* *********** ************* Wanted: Skein Hardware Help As part of NIST's SHA-3 selection process, people have been implementing the candidate hash functions on a variety of hardware and software platforms. Our team has implemented Skein in Intel's 32 nm ASIC process, and got some impressive performance results. Several other groups have implemented Skein in FPGA and ASIC, and have seen significantly poorer performance. We need help understanding why. For example, a group led by Brian Baldwin at the Claude Shannon Institute for Discrete Mathematics, Coding and Cryptography implemented all the second-round candidates in FPGA. Skein performance was terrible, but when they checked their code, they found an error. Their corrected performance comparison has Skein performing much better and in the top ten. We suspect that the adders in all the designs may not be properly optimized, although there may be other performance issues. If we can at least identify (or possibly even fix) the slowdowns in the design, it would be very helpful, both for our understanding and for Skein's hardware profile. Even if we find that the designs are properly optimized, that would also be good to know. A group at George Mason University led by Kris Gaj implemented all the second-round candidates in FPGA. Skein had the worst performance of any of the implementations. We're looking for someone who can help us understand the design, and determine if it can be improved. Another group, led by Stefan Tillich at University of Bristol, implemented all the candidates in 180 nm custom ASIC. Here, Skein is one of the worst performers. We're looking for someone who can help us understand what this group did. Three other groups -- one led by Patrick Schaumont of Virginia Tech, another led by Shin'ichiro Matsuo at National Institute of Information and Communications Technology in Japan, and a third led by Luca Henzen at ETH Zurich -- implemented the SHA-3 candidates. Again, we need help understanding how their Skein performance numbers are so different from ours. We're looking for people with FPGA and ASIC skills to work with the Skein team. We don't have money to pay anyone; co-authorship on a paper -- and an Erdos number of 4 -- is our primary reward. (Also, a Skein polo shirt.) Please send me e-mail if you're interested. Our presentation and paper on Skein in a custom ASIC: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/25keymm http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/W… or http://tinyurl.com/2bddhn7 Brian Baldwin's original presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2dz4q2l http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/B… or http://tinyurl.com/2653k99 Brian Baldwin's corrected presentation and paper: http://www.ucc.ie/en/crypto/SHA-3Hardware/NISTSHA-3/Baldwin-SHA-3-Presentat… or http://tinyurl.com/2c55hb2 http://www.ucc.ie/en/crypto/SHA-3Hardware/NISTSHA-3/Baldwin-SHA-3-Paper-Aug… or http://tinyurl.com/29qbrud Kris Gaj's presentation and papers: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/26qatdx http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/G… or http://tinyurl.com/27lkjhw http://eprint.iacr.org/2010/445.pdf Stefan Tillich's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/27cpqom http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/T… or http://tinyurl.com/2d5p9p7 Patrick Schaumont's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/28t9qxc http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/S… or http://tinyurl.com/2dju4rn Shin'ichiro Matsuo's presentation and paper: http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/presenta… or http://tinyurl.com/2byyycq http://csrc.nist.gov/groups/ST/hash/sha-3/Round2/Aug2010/documents/papers/M… or http://tinyurl.com/24qxhdo Luca Henzen's papers: http://www.vlsi.uwaterloo.ca/~ahasan/web_papers/technical_reports/web_five_… or http://tinyurl.com/2be9nj8 http://www.vlsi.uwaterloo.ca/~ahasan/web_papers/technical_reports/web_five_… or http://tinyurl.com/2g4u2dj http://www.springerlink.com/content/g0115v3272156r06/ ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. You can subscribe, unsubscribe, or change your address on the Web at <http://www.schneier.com/crypto-gram.html>. Back issues are also available at that URL. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. CRYPTO-GRAM is written by Bruce Schneier. Schneier is the author of the best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," and "Applied Cryptography," and an inventor of the Blowfish, Twofish, Threefish, Helix, Phelix, and Skein algorithms. He is the Chief Security Technology Officer of BT BCSG, and is on the Board of Directors of the Electronic Privacy Information Center (EPIC). He is a frequent writer and lecturer on security topics. See <http://www.schneier.com>. Crypto-Gram is a personal newsletter. Opinions expressed are not necessarily those of BT. Copyright (c) 2010 by Bruce Schneier. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] NATO usage of drones set to expand
by Gregory Foster 06 Jul '18

06 Jul '18

A timely piece given the lock down in Chicago to host the NATO summit, where discussion will cover the Alliance Ground Surveillance project's acquisition of five Global Hawk UAVs to perform persistent surveillance (via link in article). Foreign Policy (May 18) - "Unmanned and Dangerous" by @Louise_Arbour <http://twitter.com/Louise_Arbour> of @CrisisGroup <http://twitter.com/CrisisGroup>: http://www.foreignpolicy.com/articles/2012/05/18/drones_uav_dangerous?page=… Nice one: /But beyond being of dubious legitimacy under international law, the use of [drone] technologies may be counter-productive. In Pakistan, Somalia, and Yemen, unmanned planes are being flown by the CIA -- an organization that clearly lacks the military's culture and training in international humanitarian law. / HT @Drone_Wars_UK <http://twitter.com/Drone_Wars_UK>, gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster<> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] NATO usage of drones set to expand
by Gregory Foster 06 Jul '18

06 Jul '18

A timely piece given the lock down in Chicago to host the NATO summit, where discussion will cover the Alliance Ground Surveillance project's acquisition of five Global Hawk UAVs to perform persistent surveillance (via link in article). Foreign Policy (May 18) - "Unmanned and Dangerous" by @Louise_Arbour <http://twitter.com/Louise_Arbour> of @CrisisGroup <http://twitter.com/CrisisGroup>: http://www.foreignpolicy.com/articles/2012/05/18/drones_uav_dangerous?page=… Nice one: /But beyond being of dubious legitimacy under international law, the use of [drone] technologies may be counter-productive. In Pakistan, Somalia, and Yemen, unmanned planes are being flown by the CIA -- an organization that clearly lacks the military's culture and training in international humanitarian law. / HT @Drone_Wars_UK <http://twitter.com/Drone_Wars_UK>, gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster<> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

[drone-list] NASA's Unmanned Aircraft Systems Airspace Operations Challenge
by Gregory Foster 06 Jul '18

06 Jul '18

Network World Layer 8 (Oct 17) - "NASA exploring $1.5 million unmanned aircraft competition": http://www.networkworld.com/community/blog/nasa-exploring-15-million-unmann… A little surprising to see NASA pulled into this by the FAA and Air Force Research Lab. Looks like they're trying to get competitors to figure out how to integrate drones in the NAS. Doesn't really give me warm fuzzies, crowdsourcing the Next Generation Air Transportation System... Also, the competition is not a done deal, this RFI is just a trial balloon... gf -- Gregory Foster || gfoster(a)entersection.org @gregoryfoster <> http://entersection.com/ _______________________________________________ drone-list mailing list drone-list(a)lists.stanford.edu Should you need to change your subscription options, please go to: https://mailman.stanford.edu/mailman/listinfo/drone-list If you would like to receive a daily digest, click "yes" (once you click above) next to "would you like to receive list mail batched in a daily digest?" You will need the user name and password you receive from the list moderator in monthly reminders. Should you need immediate assistance, please contact the list moderator. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

How planespotters turned into the scourge of the CIA
by Brian Randell 06 Jul '18

06 Jul '18

Dave: I don't know how fully the story of the information-gathering role played by plane spotters in the mounting controversy here in Europe about the CIA and "rendition" has featured in the US media, but in case it hasn't, you might want this for IP. Cheers Brian ==== >From the (UK) Guardian newspaper: How planespotters turned into the scourge of the CIA Gerard Seenan and Giles Tremlett Saturday December 10, 2005 The Guardian Paul last saw the Gulfstream V about 18 months ago. He comes down to Glasgow airport's planespotters' club most days. He had not seen the plane before so he marked the serial number down in his book. At the time, he did not think there was anything unusual about the Gulfstream being ushered to a stand away from public view, one that could not be seen from the airport terminal or the club's prime view. But that flight this week was at the centre of a transatlantic row that saw the prime minister being put on the spot on the floor of the House of Commons and the US secretary of state, Condoleezza Rice, forced on the defensive during a visit to Europe. The Gulfstream V has been identified as having been used by the CIA for "extraordinary renditions" - abducting terror suspects and taking them to secret prisons around the world where they may be tortured. The recording of flights by spotters like Paul from places as far afield as Bournemouth and Karachi has unintentionally played a significant role in helping journalists and human rights groups expose the scale of the CIA's renditions system. But his impact on such international intrigue largely passes Paul by. "It's not the CIA bit that interests us. You don't even know who owns the plane when you take down the serial number," he said, already distracted as something comes in to land through the grey drizzle. "You keep accurate logs, for your own records." . . . Despite the particular eccentricity of planespotting - and the obvious capacity for fun-poking - it is not a pastime limited to Britain. In Spain town planner Josep Manchado is part of a small group who gather with their long lenses and foil-wrapped sandwiches at Majorca's Son Sant Joan airport. In January last year Mr Manchado saw a Boeing 737 on the airport tarmac. He pressed his camera shutter button while speculating idly that some US millionaire was in town. Then he put the picture of the Boeing (tail fin number N313P) on airliners.net, and forgot about it. Within a few days Mr Manchado starting getting strange calls and emails. They came from the US and from Sweden. "People were asking me questions about the plane. They obviously weren't all planespotters because they were asking questions that people who know about planes don't ask," he said. Activists and journalists had become interested in the rendition flights. There were also, however, strange calls. "One man wanted to buy up all the photos. He eventually sent me a form in which he asked for everything, including my home address. I didn't give it to him and I never heard from him again," he said. . . . For those prepared to sift through the endless information complied by planespotters and posted on websites, there are many more clues to the CIA's activities to be found. In Ireland peace campaigners have turned themselves into planespotters. At Shannon airport Tim Hourigan uses a scanner that allows him to see what air traffic control sees, and he, and other activists, religiously note down the numbers of landing planes. Then, using a combination of Federal Airport Authority Records and planespotting websites, they can track the movements of intelligence planes across the world. "It is a tedious job looking through hundreds of pictures of planes," says Mr Hourigan, who is not a planespotting enthusiast. "But it allows you to confirm and expose the activities of the CIA and our own government." . . . Full story at: http://www.guardian.co.uk/humanrights/story/ 0,7369,1664146,00.html -- School of Computing Science, University of Newcastle, Newcastle upon Tyne, NE1 7RU, UK EMAIL = Brian.Randell(a)ncl.ac.uk PHONE = +44 191 222 7923 FAX = +44 191 222 8232 URL = http://www.cs.ncl.ac.uk/~brian.randell/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

[IP] How planespotters turned into the scourge of the CIA
by David Farber 06 Jul '18

06 Jul '18

Begin forwarded message:

1 0

[>Htech] Supply Chain Review: Device To Disable RFID Tags In The
by Premise Checker 06 Jul '18

06 Jul '18

Works Reply-To: transhumantech(a)yahoogroups.com Device To Disable RFID Tags In The Works http://www.supplychainreview.com.au/index.cfm?li=displaystory&StoryID=25767 RFID Kryptonite Supply Chain Review - Australia Monday 23 January 2006 Two students have turned a disposable camera into a gadget that literally shocks the power out of RFID tags. The pair behind the "RFID-Zapper", Tim and Chris (who don't reveal their last names online), say the gadget is designed to deactivate (destroy) passive RFID-Tags permanently. Goals are a proof-of-concept and the construction of at least one functioning and appealing prototype, as well as a documentation of the project. The pair plan to publish the instructions for build online, "so that everyone can build an own RFID-Zapper". "We have to expect to be surrounded by RFID-Tags almost everywhere within the near future, and they will serve many different purposes," write Tim and Chris online. "The benefits and risks of this technology and its use are already being discussed. "However, there will be atempts to use RFID-Tags to establish constant surveiliance and to further threaten and compromise the privacy of customers (and citizens and even non-citizens, when [governments] start to use RFID-Tags like the German [government] already did). "To defend yourself against such measures, you might want a small, simple and relatively appealing gadget to permanently deactivate RFID-Tags around you, e.g., to deactivate RFID-Tags in recently bought clothes or books without damaging those [items]." How does it work? There are several ways to deactivate RFID-Tags, including RFID-deactivators, which send the RFID-Tag to sleep. "A problem with this method is, that it is not permanent, the RFID-Tag can be reactivated," write Tim and Chris. "Several ways of permanently deactivating RFID-Tags are known, e.g., cutting off the antenna from the actual microchip or overloading and literally frying the RFID-Tag in a common microwave-oven, which needs to be turned on only for a short period of time. "Unfortunately both methods aren't suitable for the destruction of RFID-Tags in clothes: cutting off the antenna would require to damage the piece of cloth, while frying the chips is likely to cause a small but potent flame, which would damage most textiles or even set them on fire." The RFID-Zapper copies the microwave-oven-method, but on a much smaller scale. The duo modified the electric component of a singe-use-camera with flash, readily available in most retail outlets, to "keep the costs of the RFID-Zapper as low as possible". The coil is made from coated copper wire and placed inside the camera where the film normally lies. "Then one end of the coil is soldered to the camera's capacitor, from which we earlier disconnected the flash," Tim and Chris write. "The other end of the coil is soldered to a switch, which itself is connected to the capacitor's other terminal. Once everything is tested, the camera can be closed again and henceforth will serve as a RFID-Zapper, destroying RFID-Tags with the power of ordinary batteries." The zapper generates a strong electromagnetic field with a coil, which, claim the inventors, should be placed as near to the target RFID-Tag as possible. The RFID-Tag then will receive a strong shock of energy comparable with an EMP and some part of it will blow, thus deactivating the chip forever. Until now the pair have only had access to 13.56 MHz RFID tags, but hope to be able to test the RFID-Zapper on other tags soon. A German privacy advocacy group -- FoeBuD -- plans to manufacture and sell a device that consumers could used to disable RFID tags permanently. FoeBuD says it wants to manufacture the RFID-Zapper and sell it at its online store. The group met with a hardware developer last week, but says it has no timescale for production or product price yet. Post message: transhumantech(a)yahoogroups.com Subscribe: transhumantech-subscribe(a)yahoogroups.com Unsubscribe: transhumantech-unsubscribe(a)yahoogroups.com List owner: transhumantech-owner(a)yahoogroups.com List home: http://www.yahoogroups.com/group/transhumantech/ Yahoo! Groups Links <*> To visit your group on the web, go to: http://groups.yahoo.com/group/transhumantech/ <*> To unsubscribe from this group, send an email to: transhumantech-unsubscribe(a)yahoogroups.com <*> Your use of Yahoo! Groups is subject to: http://docs.yahoo.com/info/terms/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: Over a decade of DDOS--any progress yet?
by Dobbins, Roland 06 Jul '18

06 Jul '18

On Dec 6, 2010, at 2:50 PM, Sean Donelan wrote: > Other than buying lots of bandwidth and scrubber boxes, have any other DDOS attack vectors been stopped or rendered useless during the last > decade? These .pdf presos pretty much express my view of the situation, though I do need to rev the first one: <https://files.me.com/roland.dobbins/y4ykq0> <https://files.me.com/roland.dobbins/k54qkv> <https://files.me.com/roland.dobbins/j0a4sk> The bottom line is that there are BCPs that help, but which many folks don't seem to deploy, and then there's little or no thought at all given to maintaining availability when it comes to server/service/app architecture and operations, except by the major players who'd been through the wringer and invest the time and resources to increase their resilience to attack. Of course, the fundamental flaws in the quarter-century old protocol stack we're running, with all the same problems plus new ones carried over into IPv6, are still there. Couple that with the brittleness, fragility, and insecurity of the DNS & BGP, and the fact that the miscreants have near-infinite resources at their disposal, and the picture isn't pretty. And nowadays, the attackers are even more organized and highly motivated (OC, financial/ideological) and therefore more highly incentivized to innovate, the tools are easy enough for most anyone to make use of them, and tthe services/apps they attack are now of real importance to ordinary people. So, while the state of the art in defense has improved, the state of the art and resources available to the attackers have also dramatically improved, and the overall level of indifference to the importance of maintaining availability is unchanged - so the overall situation itself is considerably worse, IMHO. The only saving grace is that the bad guys often make so much money via identity theft, click-fraud, spam, and corporate/arm's-length governmental espionage that they'd rather keep the networks/services/servers/apps/endpoints up and running so that they can continue to monetize them in other ways. ----------------------------------------------------------------------- Roland Dobbins <rdobbins(a)arbor.net> // <http://www.arbornetworks.com> Sell your computer and buy a guitar. ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0