Schneier on Security

Clive Robinson • June 17, 2022 9:35 AM

@ Bruce, ALL,

This is not “news”…

The same or very similar issues occures “WITH ALL” systems that transmit data.

As I’ve pointed out in the past, whilst you may not be able to decrypt the signals from passports and bank cards, you can “tell which chips and step” are being used.

So you could make a “device” that activates whenever someone holding a US Passport and particular credit card walks through a doorway or similar. It’s not that difficult. The more RF devices the more unique it becomes to individuals.

As I said “not new” but “not yet used” in a way that has become public.

When it does it could be explosive, and have a real backlash effect, which would have almost the same effect on society as the costs from 9/11.

Clive Robinson • June 17, 2022 4:06 PM

@ lurker, ALL,

Re: Welcome to our world.

Yes, and it’s not going to get any better, only worse, because,

“We don’t learn.”

As a general notion every one thinks the world is “Digital” thus they assume incorrectly that because everything is apparently copyable perfectly it must be indistinguishable in all things “Digital”.

Well that is very far from the truth, though the authors of the paper appear to buy into it, which is actually quite sad…

They call these diferences defects and the like where as the reality is that underneath the “Digital Myth” you find “The world is analogue” and those supposed “defects” are nothing more than “manufacturing spread”.

In the “mechanical engineering world” they have a word for required imprecision to get things to work with out “bind” they call it “slop” it is necessary to stop things like temprature causing things to grind to a halt. It’s the reason all mechanical locks will always be pickable, no matter what “marketing” nonsense says.

As many real analogue communications engineers know, things have got to the point where Einstein’s “Special Relativity” and “time cones” have to be “designed for” in ordanary consumer and comercial decices. Take a moment to think on that and where it might take you.

Sometimes it works the other way… You might have heard of a security device called a “Physically Unclonable Function” well these come about because of the requirment for “slop” in electronics device physics.

But as long as we can measure beyond what we need for our communications systems to work, then our communications devices we will be “tracable” (Just one Special Relativity side effect).

Suprisingly to most the ability to do this goes back before “electronics” to “Electro-Mechanical” communications way more than a century ago… When what would later be called “Teletypes” came into fashion as “Telex machines” rather more than a century or more ago. For most people the dialable “Telex Network” that started in the 1930’s is unknown to them, though from black and white movies prior to WWII they are aware of the much much earlier “ticker-tap” machines that used to be used to send “Stock Price” information on point-to-point systems using “relays” developed in the later half of the 1800’s.

The so called “Serial Communications” has always been subject to “oddities” from the “manufacturing spread” mostly it was only of concern to engineers and technicians.

However the “pull-in” and “release” time differences on electromechanical relays were known over a century ago to be a way to “strip off” super-encryption by “One Time Tape” systems that should have in theory given perfect security (Something the NSA went on to exploite with NIST and the AES competition, and why you should never use AES in “on-line” mode).

The Canadian “Pat” Bayly spent considerable time and effort in developing the “British Inter-Departmental”(BID) OTT Crypto machine “Rockex” from these early attacks before the terms TEMPEST or EmSec were thought up.

http://www.campx.ca/patbayly.html

I’ve known about this for over fourty years and have mentioned it from time to time on this blog.

As I said “nothing new” even the fact that in the ICT Industry in general and in the ICTsec industry specifically,

“We do not learn from our history.”

Why this should be I do not know, but I can guarentee that within a decade there will be yet another “Shock Horror” “everything is tracable” story…

Here’s me mentioning it on this blog as “nothing new” back in September 2005,

https://www.schneier.com/blog/archives/2005/09/snooping_on_tex.html/#comment-13377

And that is not the first time, but people appeared genuinely surprised to know this even though they had worked with the equipment,

http://jproc.ca/crypto/rockex.html

Sometimes secrets can be kept, when they realy should not be…

Speaking of which I would recomend the first half of Peter Wright’s “Spy Catcher” to people, it was written in the early 1980’s and tells you a very great deal about what is still “current Attack / Surveillance” methods. I did not get to know Peter Wright but his MI5 “assistant” Tony Sale I did get to know and we swapped some fun stories about things now past. I don’t know how many other people know them but I know it realy surprises modern “Security Experts / Gurus” when I mention them… Both Ross J. Anderson and Mat Blaze, got “surprised” and there are others less well known.

I just wish they would spread them on with more “vigor” because not knowing these things is realy not just “hurting people” it’s “Getting them killed” as those in Iran and China found out with the fairly usless CIA system in more recent times.

Clive Robinson • June 20, 2022 4:38 AM

@ Marian,

we should work on social ways to make use of that data bitter to the people and organisations gathering it.

History shows, that some will turn swallowing the most bitter of pills into a virtue.

Some realy do “Wear their hair shirts on the inside” because it makes them feel some how superior thus more worthy than others…

With such people the more you do to stop their stupidity, the more it encourages them.

It’s why some talk not of “bitter pills” but “poison pill” solutions… But as has been seen with Musk -v- Twitter board, you have to be careful when you make one, lest the person you are trying to stop rams it down your own throat.

As some have pointed out… Unlike others Musk now gets firehose access without an NDA, can still potentially walk away, so what will be his next trick? Re-negotiate the price down 20% or more…

Clive Robinson • June 20, 2022 10:00 AM

@ JonKnowsNothing, Marion,

Breech of contract would find M.Musk obligated to pay the $1,000,000,000 ($1B) in forfeit.

Not quite true, if Elon Musk fails to procead without good reason, does he have to pay it.

So if the Twitter Board withdraw, or do not procead “with good faith” then Elon Musk keeps his billion and may have cause to seek damages.

Twitters SEC filings about the levels of real and fake content, are quote a way out of alignment with orher Social Media, so to put it politely are “highly suspect unless proven otherwise”.

The supposed “Smart Money” says the Twitter board have probably been “cooking the books” on this. Which means they are now caught between the Devil (SEC) and the Deep Blue Sea (Musk).

Put bluntly if the Twitter board has been misleading the SEC and Shareholders, then there may be both Criminal and Civil penalties to be paid that would effectively wipe a very very large amount off of their share price which could drop into the $20/share range or less before fines and compensation.

The question then arises as to what Elon Musk would do if he does discover the Twitter Board has been cooking the books… Outside of certain “crimes” he can chose to ignore it “officially” and just re-negotiate at a lower cost. He could report whay he finds to the SEC and let them decide, or he could go public in some way and having effrctively “killed Twitter” walk away, and pick it up from the “liquidators” at way less than the usual 5cents on the Dollar “fire sale prices, say a couple of billion give or take rather than the 43billion.

If the Twitter Board had not tried to grossly over value the share price and “poison pill” Musk out, then Elon’s choices would be less.

At the moment Elon has the Twitter board tongue in one hand and a poison pill in the other he could just shove down their throat. Any action by Twitter to get the 1billion almost certainly would result in an open court case with all sorts of stuff coming out into public, most of it bad for Twitter, such is the nature of such court cases…

So it will be interesting to see where Elon decides to push things. He has choices which the Twitter Board realy does not…

As for what happens to Twitter, well they appear to have had their time in the Sun, and they did not grow well, nor do they appear to be able to jump to the next level… Their day may well be drawing to a close.

Clive Robinson • June 20, 2022 10:34 PM

@ JonKnowsNothing, SpaceLifeForm,

Re : Cold Feet

Remember the story of that wooden horse from getting on for three thousand years ago, and that expression “Beware of Greeks bearing Gifts”?

Well when it comes to,

I do not know why anyone who would walk away from $1B laying on the table.

I do, when it is effectively a “Booby Trap”[1] that is picking it up will cost you more in some way than leaving it there, same as that mythical Trojan Horse should have been left where it was.

Or if you prefer when it’s possibly been turned into a “poison pill” of it’s own…

Usually in a “Takeover deal” due dilligence is required, that is the seller has to “open ALL the books” to the buyer. This is generally a dangerous thing to do for the seller, because if the deal falls through then the potential buyer has information that they can go to a third party with, or use against the sellers continuing performance.

Whilst their might be a “no due dilligance” in the contract, the seller can not use it to hide illegal, unlawful or questionable behaviour / conduct on their behalf. Likewise the potential buyer on finding such behaviour if they do not report it becomes complicit, thus liable on one of those “conspiracy charges” Federal Authorities almost always add at the bottom of the charge sheet as a “catch all”. Much like the “lying to Federal Officers” because as charges they are very very difficult to defend as proving a negative is difficult even using bivalent logic.

So as @SpaceLifeForm observers,

The best option for all concerned may be to completely drop the deal and forgive the $1B penalty.

But that is also dangerous on the old,

“No smoke without fire principle.”

This dance has been very raunchy and public… If they don’t jump into bed, then people are going to ask why?… In the absence of a believable excuse people are either going to make something up, dig something up, or both. The questionable way silicon valley Corps are run in general gives plenty of soft mud to grab and fling, and it will stick like the proverbial to the blanket, thus give of a stink for years to come.

So they might have to atleast “hold hands” for a while to protect each others reputations whilst they find something they can both live with without too much embarrassment / loss of face / reputation.

So we are kind of like in that “Waiting on the blood tests” phase or “fertility tests” with race horses and bulls.

But I still maintain my point, that if I had been daft enough to own Twitter Shares I would have unloaded them long before they dropped to $40. I’d rather go for a small loss, rather than wait around for the “maybe baby day” of the take over, that is getting less likely day by day.

That is if you look at the Twitter share price figures and filter off the noise and remove the “Musk Hump” Twitter shares have had a downwards trajectory for the past year and have gone from a high of just under $80 to significantly below $40… The smoothed curve is still in what appears the initial “straightline drop” of exponential decay… Probably safe to say that Twitter was not a Corp on the “fast track to success”, more like the morgue via the ITU.

What ever it is the Twitter Board has been doing, the market does not think very much of it. Hence the underlying “trajectory of doom” of the Twitter share price.

A state of affairs that many might see as “confirmation” the Twitter Board have probably been “fiddling the figures” in their SEC filings etc.

I’ve “no skin in the game” with either side, and I must admit, it’s begining to feel like watching a worm that tried to cross the concrete patio in a rain show that turned to baking sun when the worm got half way across…

[1] The stories behind the “Booby Trap” are many, one credible one is based around Sailors and an albatross sized bird called a “Booby” (Spanish for foolish/stupid – to do with it’s mating ritual of displaying feet to the femail by lifting them up and wavibg them). Apparantly all that was required to catch them was “food on the deck” and a simple “slip noose” plainly visable, and a simple spring and release trigger mechanism that the bird would activate on moving the food. Apparently it was not untill the first world war that it gained it’s modern military meaning, that became entrenched with “asymetrical warfare tactics” of WWII and later conflicts.

Clive Robinson • June 21, 2022 7:23 AM

@ SpaceLifeForm, JonKnowsNothing,

Re : Cold Feet

As you note,

The ‘out’ here is to do a stock swap, with some marketing bs to make it look plausible to the public.

It is one of several ways, but there is still the “Bride left at the alter” problem. M.Musk can pretend to be the rejected swain riding off into the sunset, that is the easiest part to accomplish.

However Miss Twitter would be an unwed bride and history indicates no matter how virtuous there will be stains on not just the bridal trousseau, and thus attracting a new suiter doubtfull.

As I’ve indicated Miss Twitter appears to be not just a fading bloom but well over the hill and defending into the twilight of neather years.

It will be for others to finish the melodrama, but there will have to be a bill to be payed, and I’ve a fealing that M.Musk will not be opening his coin-purse…