On Monday, January 7, 2002, at 05:10 PM, Dr. Evil wrote:

...

Setting a trap gun to blow away anyone who inserts a floppy (or hooks up a cable) to a machine he has not been given access to is morally permissable.

Morally permissable or not, a shotgun and a string are unlikely to be effective. The FBI went so far as to get a law passed that says that they can use classified technical techniques to execute the warrant so that they don't have to reveal their methods in court. Could those methods include something as simple as a backdoor in Windows, or some kind of hack into Windows? I don't have any evidence one way or the other, but it's a reasonable possibility. These guys are risk averse and they are on a budget, and sending in a team of armed hackers is both risky and expensive.

Before you get the shotgun and some string and risk blowing your own head off, install a real OS. Do you think the FBI break-in team has an OpenBSD rootkit?

Look into what's inside OS X, which is what I run. A lot of FreeBSD, some Mach, etc. However, I don't kid myself that keystroke loggers for Macs, which I have bought myself for my own use (some years ago) won't be carried by spooks doing sneak and peak entries. One approach is to use a removable hard disk, or a PC Card (PCMCIA) to handle the PGP keys and buffers. The new flash-based USB dongles, a la "PEN," look intriguing. Carry it around your neck and only insert it long enough to get the needed passphrases and private keys off it. A technical question for anyone: If I store passphrases (and keys, for extra security) on a flash-based USB drive dongle, and then use cut-and-paste to access them and paste them into PGP, is it possible for a keystroke logger to see them? In the Mac at least, pasting from a file or from the clipboard does not of course go through the keyboard. So a straightforward intercept of the keyboard driver at the BIOS level should not see the pasted material. I realize that "keystroke logger" can mean more than just logging the keyboard, however. Some of you might have already looked into this and may have some data points. It seems to me that the older type of keystroke logger (history file in Unix, Ghostwriter, etc.) can be defeated thusly. Selecting letters with a mouse on the screen also bypasses the keyboard. The question is, are "keystroke loggers" actually doing more than keystroke logging. Are they, for example, monitoring all screen I/O (seems unlikely, for bandwidth reasons).

My attitude is to think about simple things and think about ways to de-escalate a conflict as much as possible, so I'm not so enthusiastic about a shotgun on a string.

That's cool. Just don't support laws affecting my decisions. --Tim May "A human being should be able to change a diaper, plan an invasion, butcher a hog, conn a ship, design a building, write a sonnet, balance accounts, build a wall, set a bone, comfort the dying, take orders, give orders, cooperate, act alone, solve equations, analyze a new problem, pitch manure, program a computer, cook a tasty meal, fight efficiently, die gallantly. Specialization is for insects." --Robert A. Heinlein

On Monday, January 7, 2002, at 07:31 PM, Dr. Evil wrote:

...

Yeah, that proposal (snipped above) would definitely defeat the plain old BIOS keyloggers. How sophisticated is the FBI stuff? Let's make some reasoned speculation.

Most of their targets aren't going to be super-sophisticated hackers who will do those kind of things. The FBI has a whole bunch of tools which they use to achieve their goal (get the conviction, etc). Generally, they don't need any one of those tools to be perfect. The plain old keystroke logger would work in most cases, probably. However, that is not the end of the story...

All security is economics. Move-countermove, defense-offense, etc. That basic keystroker loggers is "good enough" to get "most" of what they want is not surprising. Pareto tradeoffs apply. Higher security costs. Comments to follow.

...

Selecting letters with a mouse on the screen also bypasses the keyboard.

Ouch! That might work for occasional short messages, but for daily use?

I mostly meant for PGP passphrases, to decrypt a series of incoming messages. Though if they can keystroke log, all messages written by the target are vulnerable. No, I wouldn't suggest composing long messages one letter at a time. (Though the most sensitive of all messages are likely to be brief, a la the cononical "Attack at dawn.") A sufficiently worried person could use a scanner, either typing a message on a typewriter and then OCRing it, presumably beyond the ability of keystroke loggers to see, or just doing an image scan of a handwritten note and then PGPing that. At this level of worry, there are probably easier technological solutions, such as: using a Palm or other handheld for critical typing, using a second machine kept locked up (*), putting a laptop in a bag and then sealing it with sealing wax (hard for black baggers to duplicate on the spot), the dongle idea, removable disk drives, etc. All security is economics. When the U.S. Navy uses secure communications to communicate with a ship, they don't just have a guy sit down at a laptop and fire up PGP. They have nested security layers, including controls on access to the "crypto shack," layers of keyed access to crypto materials, and air gaps between machines and other parts of the system. All of this takes time to set up, training for the personnel (my condolences to them, as this is often drone work), and lots of bureaucracy. Almost everyone here is smart enough to realize that a lot of the jive about RSA taking all the computer power in the universe to crack (and then some, for large enough numbers) means nothing if key material has been compromised, if Van Eck radiation is being used to monitor equipment, and so on. The graph I always like to use is with "value of thing being protected" on the X-axis and "costs to use protection" on the Y-axis. Something that could land one in prison for 10 years, or worse, clearly jusitfies using very good crypto hygiene, that is, spending a fair amount of time and effort to ensure good security. Getting all traffic in PGP form, including mattd's and Choate's forwarded articles, clearly cannot justify the same level of care. The "one size fits all" approach of a "1024-bit key" is misleading. (I'm not saying that the important thing is to vary key lengths. In fact, may as well just standardize on 2048-bit keys or even larger. What I _am_ saying is that the whole PGP approach encourages people to think in terms of just using PGP...instead of using a layered approach. Seen this way, RSA/PGP is just one particular component of a larger system. Of course, selling this to the world is tough, as people want immediate gratification and ease-of-use. This is where "rolling your own" makes some sense, as the underlying mathematics is solid, but the crypto hygiene of using dongles, locking up laptops in safes, etc. is enough to stop many of the "sneak and peek" attacks.

Bottom line: I don't have any knowledge of what the FBI actually does, but there are off-the-shelf commercial things out there which defeat what you described, so it's safe to assume that the FBI has something like that if they feel they need it.

Meta-bottom line has always been: if the adversary can get access to your hardware, all bets are off. Morris showed this many years ago with compilers. Hence the approach of using PDAs or removable disk drives (flash, iPod, Dallas Semiconductor buttons) which make it much tougher for the FBI to compromise.

Bottom line 2: You need to have a tamper resistant system if you are faced with an attack from the FBI hacker team. Fortunately, in this case tamper resistance is pretty easy. Get yourself a webcam. I don't think many Mafiosos are sophisticated enough for this, or they probably would have found some other line of work.

We've talked a bit about deploying Webcams (with offsite or well-locked storage) for logging entries, etc. A cluster of several of them, some of them monitoring a system, some of them doing conventional burglar work, could be very useful. X10 wireless cams are down to just $50 each. Various strategies are obvious for how to use them: 1. Just leave them on and logging. Very tough for the guys in black to reproduce a plausible sequence which erases themselves from the archive. Just seeing the webcams aimed at the computer, with wires going off into a closet, may be enough to scare them off. (Have a pinhole webcam monitoring the entire room, too.) 2. Send the signals to a computer in a locked room, or just the archived images to a small disk drive inside a vault or safe. (One of my Firewire drives inside my gun vault, for example.) 3. Offsite storage is possible. Or a machine hidden in a closet or crawlspace and communicating via 802.11b. (On a battery backup in case they cut the power first.) (This is a variation on Brin's camcorder and escrow system.) The point is not to get too cute. Start talking about storing the images on an offshore platform and the scheme gets too complicated to use. A simple X10 camera system feeding a bottom-end PC and then 802.11b-broadcasting to another PC seems quite feasible. And if you do it yourself, with no "security consultants" involved, pretty hard for the FBI to bypass. Again, all security is economics. Having an unsecured machine sitting around in an office with PGP installed on it is at one extreme (regardless of the strength of RSA qua RSA), having a machine inside a secured room with webcams aimed at it and with removable disk drives and "mouse entry" methods to obscure keystrokes, all inside a Faraday cage, is nearly at the other extreme. How much one wants to spend depends on what one is protecting. --Tim May "That government is best which governs not at all." --Henry David Thoreau

It seems pretty clear from the court documents that the Scarfo keyboard logger only recorded keystrokes. We don't have details ("classified," "national security," "CIPA") but the exhibit introduced as evidence shows backspaces, up-down arrows, and other functions you'd normally associate with keyboard entry only.

That does not mean that they were using only a primitive BIOS level logger. A GUI-interceptor would generate a huge log of activities; you would just pipe it through grep TYPE: KEYBOARD-INPUT or something and it would give you the same thing. It doesn't really matter, because GUI-interceptors are off-the-shelf things, so if they felt they needed it, they would get it. It's all pretty basic. Bottom line: If your attacker gets access to your hardware without you knowing it, and he has resources and a clue, he wins. The threshold for "clue" and "resources" in this case is very very low; maybe $100 to install your basic hardware keylogger.

On Monday, January 7, 2002, at 08:52 PM, Declan McCullagh wrote:

On Mon, Jan 07, 2002 at 04:46:02PM -0800, Tim May wrote:

...

Setting a trap gun to blow away anyone who inserts a floppy (or hooks up a cable) to a machine he has not been given access to is morally permissable.

Except when the local firefighters show up when your house is on fire, you're away, and the gun is rigged...

...

As the Mafia case shows, Big Brother and his courts no longer even think a warrant is needed.

Actually, the warrant in the Scarfo case was signed by a federal magistrate judge. That doesn't mean it's constitutional, but the judge had exactly this in mind.

I meant a wiretap warrant, as you talked about in your article. A "search warrant," duly presented to the resident and defining the general scope of the search, is substantially different from a wiretap order or secret search warrant. But such secret or extra-warrant search orders are part of the public lore, hence part of the current law. In "The Sopranos," Tony's entire house is wired for sound. In "Law and Order: Criminal Something or Other," a completely warrantless keystroke logger is inserted in a witnesses computer. I think those who violate the C. should be killed. --Tim May

--Tim May "They played all kinds of games, kept the House in session all night, and it was a very complicated bill. Maybe a handful of staffers actually read it, but the bill definitely was not available to members before the vote." --Rep. Ron Paul, TX, on how few Congresscritters saw the USA-PATRIOT Bill before voting overwhelmingly to impose a police state