Schneier on Security

Clive Robinson • April 12, 2023 7:09 PM

@ Bruce,

“How much of a risk is this, really?”

What is “your risk” in a “target rich environment”.

On trick to get around it that can work is that you don’t charge your device but a “battery bank” as an intermediate step.

@ ALL,

There is a new “variation” on this “attack” people should think about…

You might see “battery packs” for “rent” in hospitals and the like…

Well the lithium-ion “Battery Managment System”(BMS) in such packs can be “replaced” by ones that have been “augmented” by a stealth “USB to Go” system.

I’ve built and tested a functional prototype by just striping down existing systems available for pocket change from “alibaba.com” and doing a software upgrade and soldering four wires…

Why did I build it?

Simple answer people don’t believe a vulnerability exists untill you have a “proof of concept”(POC) exploit to demonstrate directly to them.

So I built a POC for a consulting friend of mine to use as a “demonstration” to “certain types of people” in shall we say “GS” as a “product to be aware of”.

Hopefully they will take the hint and upgrade their security practices.

After all it’s well known that “Russian Crackers” are extreamly adept at “reprogramming” USB devices like USB thumb drives so they can sell low value parts as high value parts… You can even find instructions on the Internet in a “How-To” form, and after reading them you will realise “It ain’t rocket science”.

Clive Robinson • April 16, 2023 7:29 AM

@ JonKnowsNothing, &ers, Sydney Australia, ALL,

Re : They don’t learn.

So to address your quite valid points in reverse order, starting with @JonKnowsNothing’s,

“There are No Masks and No Vax for the Internet.”

True…

But there are what are called “rubber prophylactics” and or “Personal Protective Equipment”(PPE) to stop infection from pathogens. And the idea does cross over…

Hence the expression “USB Condom” as a “cross over” term.

But… there is also the oh so effective measure of “quarantine” that in the EmSec world gets flipped and is called “segregation”.

Which I’ve discussed several times in the past on this blog with the idea of “Energy Gapping” as well as explaining in near layman terms how to go about doing it.

So “All is not lost” in this respect, if people constrain their urges just a little and behave in a more circumspect way… So I’m not an absolutist saying “just say NO”, but I am saying “No glove no love” or to misuse a once popular expression “you will get clapped up” 😉

So on to @&ers point,

“why bother using USB when you can do all this (and a lot more) over the OTA?”

As far as I’m aware I’ve been publically banging on about OTA’s multitude of issues longer than just about anyone else going back into the last century… Finally near a third of a century later the various parts of the “Mobile Phone Industry” are “taking it on board”…

But less clear to the general public was that what was billed as an OTA attack was something else. The OTA was “access to Flash ROM” something else that I and @Nick P went over at some length quite some time prior to the Ed Snowden revelations and subsequent release of the ANT catalogue (which having designed surveilence devices for now half a century I knew and said at the time was not close to what was commercially availble).

@Nick P thought, that hardware before 2005 was OK I from knowledge said 1995 (ie 486 era kit). History shows so far 1999 and all Pentium kit was bad news for “hardware insecurities”

But I also knew that what became known as “Evil Maid Boot attacks” actually were possible since the inception of the Apple ][ back in the 1970’s which was the first successfull “Personal Computer” befor IBM misappropriated much of it in their “Skunk Works” project. Which is why I could easily explain things like “persistant unremovable malware” in Lenovo consumer laptops and the potential mechanism that gave rise to BadBIOS.

The real problem is Flash ROM that now lurks in almost every chip you are going to find in devices. The secondary issue and what makes it virtually impossible to solve as long as Flash is in use is the myriad of access routes.

Something I developed a POC “air gap crossing” attack for, whilst considering the vulnerability of voting machines and talked about the mechanism here some time prior to Stuxnet being developed (then poorly deployed, thus becoming public).

So after what feels like longer than a decade and a half I’ve been looking for solutions… So far it looks like the equivalent of “hard endless quarantine” is the only solution with “consumer and commercial” equipment.

And for those thinking “data diodes” I’ve demonstrated how they are a “fail” due to the “error handling” being a “reverse communications channel”. That coupled with the near “trasparancy” of “consumer and commercial” equipment due to the issues of “Efficiency -v- Security” makes access to Flash ROM almost guarenteed for a patient and knowledgeable attacker.

Thus you need not just in use “hard segregation” you need to kill off any “Evil Maid” or equivalent beyond “End of Life” by hard physical measures such as guards with guns and secure disposal. Which Goverments do routienly deploy for security.

So onto @Sydney Australia’s points,

“FBI got wind of this mission and decided to ambush it by warning everyone”

Whilst US Agency “turf wars” are legandary, they are not always the cause of what looks like “odd” disclosure. Consider your,

“It occurred to me the only actors capable of carrying out this threat in an airport are nation-state.”

Is not quite true. Any “employee or contractor” who works at an airport and has “air side clearance” can “change face plates” on electrical and similar outlets in departure lounges, especially those pretend VIP lounges frequented by frequent flyer business travelers. Who would have one heck of a lot of information someone doing “industrial espionage” would as the saying has it “kill for” and if not on the travelers computer, the computer could just as easily be used to “get inside the perimiter” of their employers systems thus give both air and energy “gap crossing” in both directions. Something else I did a POC for pre Stuxnet, as a follow on from my “Hack voting machines” whilst I mentioned it, I did not detail the mechanism. However I did detail how to do a an “anonymous headless” botnet “command channel” that could not be taken down by the FBI or Microsoft methods, due to a variation on the “too big to fail” notion that came to the fore during the Financial crises.

But as with the real-estate industry you have to think about “location, location, location” of the airport.

Consider “China” that has a loudly proclaimed by US Agencies alledged history of,

1, “Advanced Persistant Threat”(APT) attacks by any route possible.
2, “Industrial Espionage” by any means possible.
3, Policies to attract business people into coming to China.

It’s also known from the CIA failure that got a lot of “agents” in China and Iran “disapeared” or “terminated” that China can be very much “ahead of the game”. So “methods and sources” for China are now very much better protected.

Thus it could be reasoned there is a very real threat that has “become known” about Chinese airports and hotels etc hence the odd way the warning was given.

So onwards and upwards,

“You perceive the need for absolute, total, perfect, military level security as a minimum, even with consumer grade electronics, and anything else is an epic fail.
“

Whilst the current state of affairs makes the “epic fail” true the “absolute…” part is not, though I can understand why it would appear that way.

Note from my above I’ve long in advance predicted on this blog the attacks that have happened.

Because in my perhaps rare “thinking hinky” perspective “they are easy to do” and also “others have good reason in their view to carry them out”.

Back when Stuxnet “hit the news” I was a lone voice saying “The real target was North Korea” and I got some unkind words from some here even though I gave very clear reasoning as to why I had concluded that due to things that had occured via Pakistan’s “Father of the bomb” AQ Khan. It was belatedly admitted by the US Government, effectively for the reasons I had pointed out. Later evidence from AV company “Suspected malware” repositories confirmed this, and likewise revealed much else US agencies had failed at but did not want the public becomming aware of hence the repeated attacks on Kaspersky who were not as easily amenable to the “suasion” US and other Five-Eye AV vendors are (think back to not just lavabit if you want proof it goes on ‘https://theconversation.com/after-lavabit-a-brief-history-of-securing-email-and-failing-at-it-16945 ).

However the “epic fail” I believe is jus a temprary “current state of affairs”. There is clear evidence that the ICTindustries are moving all be it glacialy slowly towards more security.

Which is why to speed things up in the past I’ve provided quite detailed ways to either eliminate current risks and reduce future risks. All of which are doable by most people if a little inconvenient.

And that is the real crux of the problem “convenience” and “target meeting” moronic employers set which positively encorages insecure behaviour by staff and the near total negation and undermining and denoralising of the staff tasked with trying to stop the organisation bring,

“The lowest of the low, low hanging fruit”

A point I know has frustated our host @Bruce and quite a few others.

“This is educational for us on this forum. But makes security incredibly and frustratingly inaccessible for the majority. No wonder they give up and decide there is nothing one can do.”

It’s actually worse than that, I take a very broad via on “security” especially when it comes to arising technology. You might remember I’ve repeatedly talked about not just “Software Defined Radio”(SDR) but radio in a wider perspective. Some have complained quite vocally about this not being suitable for this “security venue” and have said they were going to take their toys home or equivalent.

Yet just a day or so back @Bruce posts about a significant security issue from the past with,

https://www.schneier.com/blog/archives/2023/04/gaining-an-advantage-in-roulette.html

That actually involved many of the things I’ve talked about in the past such as mechanical wear and slop, but also the use of radio at the levels I’ve previously talked about which is why I could talk knowledgably on it.

My aim has always been to.

1, Help others get ahead.
2, Educate people at all levels from K12 through and beyond PhD.
3, Widen peoples scope of view.
4, Predict where future problems are likeky to happen and why.

Part of that is “challenging people to think”. That way things will not actually be “there is nothing one can do” except where the laws of nature/physics have the casting vote 😉

Hopefully I will be able to carry on doing so for many years yet to come.