Tuesday 15 August 2017

Surveillance self-defense

A good set of resources from EFF about the basics of anti-surveillance protection.

Read them! Send them to your friends and family!  Security and privacy are a joint enterprise.

Friday 11 August 2017

You can hack gene sequencers by hiding malware in DNA

This is seriously cool.

Today at the Usenix Security conference, a group of University of Washington researchers will present a paper showing how they wrote a piece of malware that attacks common gene-sequencing devices and encoded it into a strand of DNA: gene sequencers that read the malware are corrupted by it, giving control to the attackers.
I sometimes forget that we're living in the 21st century. 

Thursday 10 August 2017

Amber Rudd breaks the irony meter

The UK Home Secretary, Amber Rudd, is no fan of encryption. She's said that 'real' people don't need  encryption as an argument against secure communications apps such as Whisper System's Private Messaging service Signal, which uses end-to-end (e2e) encryption meaning that not even the operators themselves can intercept their users' messages.

It's ironic, then, that she has fallen victim to a prank which would not have been possible if she - presumably a real person - had used encryption.

The now-notorious email prankster known as Sinon Reborn set up an email address in the name of
Theresa May's communications chief, Robbie Gibb.  Reborn emailed Rudd's parliamentary email address and she replied from a private address.
“I managed to speak to a home secretary with relative ease on her personal email address,” Reborn told the Guardian. “I replied again saying: ‘Don’t you think you should be more aware of cyber security if you are home secretary?’ and I never got a reply from that.”
This ought to be embarrassing for any cabinet member. I'm sure there are numerous guidelines and memos on this, especially as Reborn has pulled the same trick on other high profile figures:
The same hoaxer has tricked the son of the US president, Eric Trump, the next US ambassador to Russia, Jon Huntsman Jr, and the former White House communications chief Anthony Scaramucci, sparking an investigation in Washington into cyber-security. He has also duped the governor of the Bank of England, Mark Carney, and Barclays boss Jes Staley by setting up fake email accounts.
It's especially embarrassing for the minister who is supposed to be in charge of cyber-security.

And even more so given her strong anti-encryption stance. If MPs and government staff used encryption, then Rudd could have verified that the email was really from Gibb.
A Home Office source confirmed that the exchange had taken place, but said Rudd does not use her personal email address to discuss government business. “As the email exchange shows, she rapidly established that this was a hoax and had only exchanged pleasantries up to that point.”
That, of course, is not the point. It was still a security breach and a national embarrassment. That it happened to the minister who is supposed to lead us through an age of rising cyber-crime is also terrifying.

Thursday 3 August 2017

Not this again

The BBC reports that someone has put a chip in his body to unlock his car. It is not clear why although his evident undeserved smugness is likely reason enough for him. It's also unclear that there's even a very credible security advantage since hacking car locks has so far proved easier than stealing people's keys.


But I'm biased. It reminds me too much of the pointless Kevin Warwick who has for decades been claiming to be a cyborg because he had an RFID chip in his arm. Having an RFID chip 1mm outside your skin in a badge doesn't make you a cyborg but having one 1mm on the other side does, apparently. The distinction without a difference has certainly earned him a lot of stupifyingly dull and stupid column inches over the years.

I've nothing in principle against using implants for authentication and I've no doubt it'll happen in the near future. It'll be convenient, but it won't pay to underestimate the security concerns, or the practical ones, for that matter.

It seems a nice idea, for example, to use an implant for 2FA alongside a physical artifact such as car keys, but then how do you lend your car to someone else or even allow them to unlock it to get stuff out? Perhaps taking care of your keys like, you know, an adult might be a superior solution all round.

We already know that RFID chips in passports etc can be skimmed from a distance. At least we can put our passports in RFID-proof wallets. It's a little less convenient to wear lead gloves.  And besides, how do we deactivate authentication when we know someone has skimmed our implant? How do we upgrade?

The problem is one of poor analogy. Authentication shouldn't be thought of as a key, it should be thought of as (some) proof of who we are. After that, infrastructure needs to decide what we're allowed to do in a given situation.

There are lots of smart people working out how that infrastructure might work, but slitting yourself open and installing an RFID chip is not approaching smart. People are working on how we might delegate authentication in complicated ways and how identity certifiers and authentication services could collaborate without creating a vast security minefield. There is already a fucktonne or so of literature on this subject.

But what's reported is some idiot injecting a chip into himself as though the future has already happened.

Broken encryption not required for policing encryption-using terrorists

Three people who planned terrorist attacks have been caught, tried, convicted and jailed for life. According to the BBC, they called themselves the Three Musketeers "when exchanging encyrpted messages". *GASP* - would-be terrorists using encryption!!!!!!!


But they were caught anyway, government-broken encryption was not required, conventional policing techniques sufficed.

Cory Doctorow's history of the rhetoric of the backdoor wars

Cory Doctorow writes at Boing Boing about the sort of rhetoric The UK Home Secretary Amber
Rudd used last week to justify her proposed ban on workable encryption.

It's pretty much spot on:
Here's a brief history of the rhetoric of the backdoor wars:
* "No one wants crypto, you can tell because none of the platforms are deploying it. If crypto was something normal people cared about, you'd see it in everyone's products. You crypto advocates are weird and out-of-step." (Clipper Chip - San Bernardino)
* "Companies are all using crypto. They are being irresponsible. Sure, everyone wants crypto and adding it to a product helps you sell it, but that's just profiteering while reducing our common security." (San Bernardino - This week)
* "Companies are all using crypto. But no one wants it. The fact that every major platform has rolled out working, end-to-end cryptography tells us nothing about the preferences of their customers. They're wasting their shareholders' money on working security that no one wants, while reducing our common security." (Last week - ??)
Next: some company will cave to Rudd and lose all their business to a competitor with working crypto. Then Rudd will say:
* "Sure, everyone wants working crypto, but you can't always get what you want. Look at Sellout.com, plc: they caved to our demands to eliminate security and got destroyed in the market. We must defend the good corporate stewardship of Sellout.com, plc by punishing their competitors for not joining them in the race to the bottom."
Here's a brief history of the rhetoric of the backdoor wars:
  • "No one wants crypto, you can tell because none of the platforms are deploying it. If crypto was something normal people cared about, you'd see it in everyone's products. You crypto advocates are weird and out-of-step." (Clipper Chip - San Bernardino)
  • "Companies are all using crypto. They are being irresponsible. Sure, everyone wants crypto and adding it to a product helps you sell it, but that's just profiteering while reducing our common security." (San Bernardino - This week)
  • "Companies are all using crypto. But no one wants it. The fact that every major platform has rolled out working, end-to-end cryptography tells us nothing about the preferences of their customers. They're wasting their shareholders' money on working security that no one wants, while reducing our common security." (Last week - ??)
Next: some company will cave to Rudd and lose all their business to a competitor with working crypto. Then Rudd will say:
  • "Sure, everyone wants working crypto, but you can't always get what you want. Look at Sellout.com, plc: they caved to our demands to eliminate security and got destroyed in the market. We must defend the good corporate stewardship of Sellout.com, plc by punishing their competitors for not joining them in the race to the bottom."
Here's a brief history of the rhetoric of the backdoor wars:
* "No one wants crypto, you can tell because none of the platforms are deploying it. If crypto was something normal people cared about, you'd see it in everyone's products. You crypto advocates are weird and out-of-step." (Clipper Chip - San Bernardino)
* "Companies are all using crypto. They are being irresponsible. Sure, everyone wants crypto and adding it to a product helps you sell it, but that's just profiteering while reducing our common security." (San Bernardino - This week)
* "Companies are all using crypto. But no one wants it. The fact that every major platform has rolled out working, end-to-end cryptography tells us nothing about the preferences of their customers. They're wasting their shareholders' money on working security that no one wants, while reducing our common security." (Last week - ??)
Next: some company will cave to Rudd and lose all their business to a competitor with working crypto. Then Rudd will say:
* "Sure, everyone wants working crypto, but you can't always get what you want. Look at Sellout.com, plc: they caved to our demands to eliminate security and got destroyed in the market. We must defend the good corporate stewardship of Sellout.com, plc by punishing their competitors for not joining them in the race to the bottom."
Here's a brief history of the rhetoric of the backdoor wars:
* "No one wants crypto, you can tell because none of the platforms are deploying it. If crypto was something normal people cared about, you'd see it in everyone's products. You crypto advocates are weird and out-of-step." (Clipper Chip - San Bernardino)
* "Companies are all using crypto. They are being irresponsible. Sure, everyone wants crypto and adding it to a product helps you sell it, but that's just profiteering while reducing our common security." (San Bernardino - This week)
* "Companies are all using crypto. But no one wants it. The fact that every major platform has rolled out working, end-to-end cryptography tells us nothing about the preferences of their customers. They're wasting their shareholders' money on working security that no one wants, while reducing our common security." (Last week - ??)
Next: some company will cave to Rudd and lose all their business to a competitor with working crypto. Then Rudd will say:
* "Sure, everyone wants working crypto, but you can't always get what you want. Look at Sellout.com, plc: they caved to our demands to eliminate security and got destroyed in the market. We must defend the good corporate stewardship of Sellout.com, plc by punishing their competitors for not joining them in the race to the bottom."
Here's a brief history of the rhetoric of the backdoor wars:
* "No one wants crypto, you can tell because none of the platforms are deploying it. If crypto was something normal people cared about, you'd see it in everyone's products. You crypto advocates are weird and out-of-step." (Clipper Chip - San Bernardino)
* "Companies are all using crypto. They are being irresponsible. Sure, everyone wants crypto and adding it to a product helps you sell it, but that's just profiteering while reducing our common security." (San Bernardino - This week)
* "Companies are all using crypto. But no one wants it. The fact that every major platform has rolled out working, end-to-end cryptography tells us nothing about the preferences of their customers. They're wasting their shareholders' money on working security that no one wants, while reducing our common security." (Last week - ??)
Next: some company will cave to Rudd and lose all their business to a competitor with working crypto. Then Rudd will say:
* "Sure, everyone wants working crypto, but you can't always get what you want. Look at Sellout.com, plc: they caved to our demands to eliminate security and got destroyed in the market. We must defend the good corporate stewardship of Sellout.com, plc by punishing their competitors for not joining them in the race to the bottom."

Tuesday 1 August 2017

'Real' people don't need encryption

Unfortunately, our Home Secretary here in the UK is the increasingly deranged Amber Rudd. Amber Rudd wants to break encyrption in the name of security fascism.

She seems to be channelling the Australian Prime Minister, Malcolm Turnbull, who recently said:
The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia.
Here’s Rudd’s version:
I know some will argue that it’s impossible to have both – that if a system is end-to-end encrypted then it’s impossible ever to access the communication. That might be true in theory. But the reality is different.
Unfortunately, the source is behind a paywall if that’s the sort of thing that slows you down.

She goes on to say that “real” people don’t use encryption:
Real people often prefer ease of use and a multitude of features to perfect, unbreakable security. So this is not about asking the companies to break encryption or create so called “back doors”. Who uses WhatsApp because it is end-to-end encrypted, rather than because it is an incredibly 
user-friendly and cheap way of staying in touch with friends and family? Companies are constantly making trade-offs between security and “usability”, and it is here where our experts believe opportunities may lie.
I’m not sure what “opportunities” she means or why usability is scare-quoted, but there are lots of us who use certain channels because they are e2e encrypted rather than because of how nice they look. We have legitimate reasons for keeping secrets, not least of which are the things Amber Rudd says.

Want to see something even scarier from the same article?
So, there are options. But they rely on mature conversations between the tech companies and Government 
– and they must be confidential.
Let that sink in. Let. It. Sink. In. We won't be privy to the details of whether or how our conversations are to be laid bare to all and sundry. It'll be done and it'll be done in secret.

She finishes thisway:
The key point is that this is not about compromising wider security. It is about working together so we can find a way for our intelligence services, in very specific circumstances, to get more information on what serious criminals and terrorists are doing online.
It might not be about compromising wider security but that’s what it will do. She obviously knows that or she wouldn’t be fielding those objections. She’s lying. She's obviously lying.

What not to do while anonymous

Ineffective security can be worse than no security at all. Being lulled into a false sense of security can cause us to engage in risky behaviours. This is true of anonymous browsing technologies such as Tor.  As the Tor Project site takes pains to tell us, Tor is by no means a panacea. We need to avoid certain behaviours to remain anonymous online even if we're using anonymisation technology.

Hiding our IP address and encrypting our traffic is not enough to remain anonymous. As the Tor Project puts it:
Also, to protect your anonymity, be smart. Don't provide your name or other revealing information in web forms. Be aware that, like all anonymizing networks that are fast enough for web browsing, Tor does not provide protection against end-to-end timing attacks: If your attacker can watch the traffic coming out of your computer, and also the traffic arriving at your chosen destination, he can use statistical analysis to discover that they are part of the same circuit.
Whonix is more specific on its Do Not page. Note: you should definitely check out Whonix if you are interested in online anonymity.

Here's their index of things not to do while trying to be anonymous.  All excellent advice, as you'd expect.
Things NOT to Do

    Visit your Own Website when Anonymous
    Login to Social Networks Accounts and Think you are Anonymous
    Never Login to Accounts Used without Tor
    Do not Login to Banking or Online Payment Accounts
    Do not Switch Between Tor and Open Wi-Fi
    Prevent Tor over Tor Scenarios
    Do not Send Sensitive Data without End-to-end Encryption
    Do not Disclose Identifying Data Online
    Do Use Bridges if Tor is Deemed Dangerous or Suspicious in your Location
    Do not Maintain Long-term Identities
    Do not Use Different Online Identities at the Same Time
    Do not Login to Twitter, Facebook, Google etc. Longer than Necessary
    Do not Mix Anonymity Modes
        Mode 1: Anonymous User; Any Recipient
        Mode 2: User Knows Recipient; Both Use Tor
        Mode 3: User Non-anonymous and Using Tor; Any Recipient
        Mode 4: User Non-anonymous; Any Recipient
        Conclusion
        License
    Do not Change Settings if the Consequences are Unknown
    Do not Use Clearnet and Tor at the Same Time
    Do not Connect to a Server Anonymously and Non-anonymously at the Same Time
    Do not Confuse Anonymity with Pseudonymity
    Do not Spread your Own Link First
    Do not Open Random Files or Links
    Do not Use (Mobile) Phone Verification
This is just the index. Visit the page to see why these are all bad ideas.

There are things you can do to help projects like this.

You can donate to Tor and/or Whonix. You can run a Tor relay. You can campaign and advocate for privacy and you can harangue your government representatives. You can support the Open Rights Group and the Electronic Frontier Foundation. And you can educate your loved (or hated) ones.