CRYPTO-GRAM, August 15, 2002

                  CRYPTO-GRAM

                August 15, 2002

               by Bruce Schneier
                Founder and CTO
       Counterpane Internet Security, Inc.
            [email protected]
          <http://www.counterpane.com>


A free monthly newsletter providing summaries, analyses, insights, and=20
commentaries on computer security and cryptography.

Back issues are available at=20
<http://www.counterpane.com/crypto-gram.html>.  To subscribe, visit=20
<http://www.counterpane.com/crypto-gram.html> or send a blank message to=20
[email protected].

Copyright (c) 2002 by Counterpane Internet Security, Inc.


** *** ***** ******* *********** *************

In this issue:
      Palladium and the TCPA
      Crypto-Gram Reprints
      The Doghouse: Cedium
      Counterpane -- Featured Research
      License to Hack
      News
      Counterpane News
      Arming Airline Pilots
      Comments from Readers


** *** ***** ******* *********** *************

             Palladium and the TCPA



There's been more written about Microsoft's Palladium security initiative=20
than about anything else in computer security in a very long time.  My URL=
=20
list of comments, analysis, and opinions goes on for quite a while.  Which=
=20
is interesting, because we really don't know anything about the details of=
=20
what it is or how it works.  Much of this is based on reading between the=20
lines in the various news reports, conversations I've had with Microsoft=20
people (none of them under NDA), and conversations with people who've had=20
conversations.  But since I don't know anything for sure, all of this could=
=20
be wrong.

Palladium (like chemists, Microsoft calls it "Pd" for short) is Microsoft's=
=20
implementation of the TCPA spec, sort of.  ("Sort of" depends on who you=20
ask.  Some say it's related.  Some say they do similar things, but are=20
unrelated.  Some say that Pd is, in fact, Microsoft's attempt to preempt=20
the TCPA spec.)  TCPA is the Trusted Computing Platform Alliance, an=20
organization with just under 200 corporate members (an impressive list,=20
actually) trying to build a trusted computer.  The TCPA 1.1 spec has been=20
published, and you can obtain the 1.2 spec under NDA.  Pd doesn't follow=20
the spec exactly, but it's along those lines, sort of.

Pd has been in development for a long time, since at least 1997.  The best=
=20
technical description is the summary of a meeting with Microsoft engineers=
=20
by Seth Schoen of the EFF (URL below).  I'm not going to discuss the=20
details, because systems with an initial version of Pd aren't going to ship=
=20
until 2004 -- at least -- andthe details are all likely to change.

Basically, Pd is Microsoft's attempt to build a trusted computer, much as I=
=20
discussed the concept in "Secrets and Lies" (pages 127-130); read it for=20
background).  The idea is that different users on the system have=20
limitations on their abilities, and are walled off from each other.  This=20
is impossible to achieve using only software; and Pd is a combination=20
hardware/software system.  In fact, Pd affects the CPU, the chip set on the=
=20
motherboard, the input devices (keyboard, mouse, etc.), and the video=20
output devices (graphics processor, etc.).  Additionally, a new chip is=20
required: a tamper-resistant secure processor.

Microsoft readily acknowledges that Pd will not be secure against hardware=
=20
attacks.  They spend some effort making the secure processor annoying to=20
pry secrets out of, but not a whole lot of effort.  They assume that the=20
tamper-resistance will be defeated.  It is their intention to design the=20
system so that hardware attacks do not result in class breaks: that=20
breaking one machine doesn't help you break any others.

Pd provides protection against two broad classes of attacks.  Automatic=20
software attacks (viruses, Trojans, network-mounted exploits) are contained=
=20
because an exploited flaw in one part of the system can't affect the rest=20
of the system.  And local software-based attacks (e.g., using debuggers to=
=20
pry things open) are protected because of the separation between parts of=20
the system.

There are security features that tie programs and data to CPU and to user,=
=20
and encrypt them for privacy.  This is probably necessary to make Pd work,=
=20
but has a side-effect that I'm sure Microsoft is thrilled with.  Like books=
=20
and furniture and clothing, the person who currently buys new software can=
=20
resell it when he's done with it.  People have a right to do this -- it's=20
called the "First Sale Doctrine" in the United States -- but the software=20
industry has long claimed that software is not sold, but licensed, and=20
cannot be transferred.  When someone sells a Pd-equipped computer, he is=20
likely to clear his keys so that his identity can't be used or files can't=
=20
be read.  This will also serve to erase all the software he purchased.  The=
=20
end result might be that people won't be able to resell software, even if=20
they wanted to.

Pd is inexorably tied up with Digital Rights Management.  Your computer=20
will have several partitions, each of which will be able to read and write=
=20
its own data.  There's nothing in Pd that prevents someone else (MPAA,=20
Disney, Microsoft, your boss) from setting up a partition on your computer=
=20
and putting stuff there that you can't get at.  Microsoft has repeatedly=20
said that they are not going to mandate DRM, or try to control DRM systems,=
=20
but clearly Pd was designed with DRM in mind.

There seem to be good privacy controls, over and above what I would have=20
expected.  And Microsoft has claimed that they will make the core code=20
public, so that it can be reviewed and evaluated.  It's about time they=20
realized that lots of people are willing to do their security work for free.

It's hard to sort out the antitrust implications of Pd.  Lots of people=20
have written about it.  Will Microsoft jigger Pd to prevent Linux from=20
running?  They don't dare.  Will it take standard Internet protocols and=20
replace them with Microsoft-proprietary protocols?  I don't think so.  Will=
=20
you need a Pd-enabled device -- the system is meant for both=20
general-purpose computers and specialized media devices -- in order to view=
=20
copyrighted content?  More likely.  Will Microsoft enforce its Pd patents=20
as strongly as it can?  Almost certainly.

Lots of information about Pd will emanate from Redmond over the next few=20
years, some of it true and some of it not.  Things will change, and then=20
change again.  The final system may not look anything like what we've seen=
=20
to date.  This is normal, and to be expected, but when you continue to read=
=20
about Pd, be sure to keep several things in mind.

1.  A "trusted" computer does not mean a computer that is trustworthy.  The=
=20
DoD's definition of a trusted system is one that can break your security=20
policy; i.e., a system that you are forced to trust because you have no=20
choice.  Pd will have trusted features; the jury is still out as to whether=
=20
or not they are trustworthy.

2.  When you think about a secure computer, the first question you should=20
ask is: "Secure for whom?"  Microsoft has said that Pd allows the=20
computer-owner to prevent others from putting their own secure areas on the=
=20
computer.  But really, what is the likelihood of that really=20
happening?  The NSA will be able to buy Pd-enabled computers and secure=20
them from all outside influence.  I doubt that you or I could, and still=20
enjoy the richness of the Internet.  Microsoft really doesn't care about=20
what you think; they care about what the RIAA and the MPAA=20
think.  Microsoft can't afford to have the media companies not make their=20
content available on Microsoft platforms, and they will do what they can to=
=20
accommodate them.  There's often a large gulf between what you can get in=20
theory -- which is what Microsoft is stressing in their Pd discussions --=20
and what you will be able to have in practice.  This is where the primary=20
danger lies.

3.  Like everything else Microsoft produces, Pd will have security holes=20
large enough to drive a truck through.  Lots of them.  And the ones that=20
are in hardware will be much harder to fix.  Be sure to separate the=20
Microsoft PR hype about the promise of Pd from the actual reality of Pd 1.0.

4.  Pay attention to the antitrust angle.  I guarantee you that Microsoft=20
believes Pd is a way to extend its market share, not to increase=
 competition.

There's a lot of good stuff in Pd, and a lot I like about it.  There's also=
=20
a lot I don't like, and am scared of.  My fear is that Pd will lead us down=
=20
a road where our computers are no longer our computers, but are instead=20
owned by a variety of factions and companies all looking for a piece of our=
=20
wallet.  To the extent that Pd facilitates that reality, it's bad for=20
society.  I don't mind companies selling, renting, or licensing things to=20
me, but the loss of the power, reach, and flexibility of the computer is=20
too great a price to pay.


<http://www.theregus.com/content/4/25378.html>
<http://www.msnbc.com/news/770511.asp?cp1=3D1>
<http://news.com.com/2100-1001-938973.html?tag=3Dcd_mh>
<http://www.eweek.com/article2/0,3959,267488,00.asp>
<http://www.internetweek.com/story/INW20020626S0007>
<http://www.osopinion.com/perl/story/18379.html>
<http://www.infoworld.com/articles/hn/xml/02/06/25/020625hnpalladium.xml>
<http://www.newscientist.com/news/news.jsp?id=3Dns99992449>
<http://www.washingtonpost.com/wp-dyn/articles/A51780-2002Jun26.html>
<http://www.theregus.com/content/4/25630.html>
<http://www.internetweek.com/story/INW20020626S0007>

Seth Schoen's meeting summary:
<http://vitanuova.loyalty.org/2002-07-03.html>

Opinions:
<http://www.nytimes.com/2002/07/04/business/04SCEN.html>
<http://online.securityfocus.com/columnists/96>
<http://zdnet.com.com/2102-1107-942699.html>
<http://online.securityfocus.com/columnists/93>
<http://zdnet.com.com/2102-1107-939817.html>
<http://www.theregister.co.uk/content/4/25843.html>
<http://www.pbs.org/cringely/pulpit/pulpit20020627.html>

Ross Anderson on TCPA and Palladium:
<http://www.cl.cam.ac.uk/users/rja14/tcpa-faq.html>
<http://www.theregus.com/content/4/25415.html>

TCPA Web site:
<http://www.trustedcomputing.org/tcpaasp4/index.asp>


** *** ***** ******* *********** *************

             Crypto-Gram Reprints



Crypto-Gram is currently in its fifth year of publication.  Back issues=20
cover a variety of security-related topics, and can all be found on=20
<http://www.counterpane.com/crypto-gram.html>.  These are a selection of=20
articles that appeared in this calendar month in other years.

Code Red:
<http://www.counterpane.com/crypto-gram-0108.html#1>

Protecting Copyright in the Digital World:
<http://www.counterpane.com/crypto-gram-0108.html#7>

Vulnerabilities, Publicity, and Virus-Based Fixes:
<http://www.counterpane.com/crypto-gram-0008.html#2>

Bluetooth:
<http://www.counterpane.com/crypto-gram-0008.html#8>

A Hardware DES Cracker:
<http://www.counterpane.com/crypto-gram-9808.html#descracker>

Biometrics: Truths and Fictions:
<http://www.counterpane.com/crypto-gram-9808.html#biometrics>

Back Orifice 2000:
<http://www.counterpane.com/crypto-gram-9908.html#BackOrifice2000>

Web-Based Encrypted E-Mail:
<http://www.counterpane.com/crypto-gram-9908.html#Web-BasedEncryptedE-Mail>


** *** ***** ******* *********** *************

              The Doghouse: encryptHTML



Here's the problem: when someone surfs to your Web page, they can read the=
=20
HTML source.  Of course, there's no way to solve that problem: if they=20
don't read the HTML source, they can't display the page.  But encryptHTML=20
claims to be a fix.

encryptHTML is a program that encrypts HTML pages, and then packages them=20
up with a JavaScript program that can decrypt them.  Both the encrypted=20
pages and the decryption program are sent to websurfers, who use them to=20
view the pages.  The company goes on about how it uses the TEA encryption=20
algorithm, and how it's super-secure.  No attempt is made to explain how=20
something can be secure when you deliver the decryption program along with=
=20
the encrypted data.

It gets funnier.  In Mozilla, when you choose the "save page as" entry from=
=20
the "file" menu, the browser simply saves the file as plain HTML.  Since=20
the decryption script had already been run, the HTML has already been=20
decrypted.

Security.  What security?

The author of the program knows about the problem, and stopped working on=20
the software a year ago.  It's hard to tell if the company hosting the=20
webpage, Cedium, knows about this.  The link to download the software=20
stopped working in the past month, so I don't know what's going on.  This=20
may be one of those abandoned Web sites that litter the net.

Entertaining, in any case.

<http://htmlcrypt.cedium.net/>


** *** ***** ******* *********** *************

       Counterpane -- Featured Research


"Implementation of Chosen-Ciphertext Attacks against PGP and GnuPG"

K. Jallad, J. Katz, and B. Schneier, Information Security Conference 2002=20
Proceedings, Springer-Verlag, 2002, to appear.

We demonstrate a social-engineering attack against PGP and other compatible=
=20
e-mail encryption systems.  The attack works like the:

1.  Alice sends Bob an encrypted message, encrypted in Bob's key.  Eve=20
intercepts that message.

2.  Eve uses the intercepted ciphertext to create a different encrypted=20
message.  She sends it to Bob.

3.  Bob decrypts the message.  The results are gibberish.

4.  Eve somehow convinces Bob to send her the gibberish plaintext.

5.  Eve reconstructs the original plaintext (from Step 1) from the=20
plaintext she receives in Step 4.

<http://www.counterpane.com/pgp-attack.html>


** *** ***** ******* *********** *************

                License to Hack



A bill introduced into Congress gives copyright holders -- that's the RIAA,=
=20
the MPAA, and similar guys -- the right to break into people's computers if=
=20
they have a reasonable basis to believe that copyright infringement is=20
going on.  Basically, the bill protects organizations from federal and=20
state laws if they disable, block, or otherwise impair a publicly=20
accessible peer-to-peer network.

There are two things going on here.  The first is to wonder why copyright=20
infringement needs special laws allowing vigilante justice (if someone=20
broke into a bank's computers and stole $1B, the bank wouldn't be legally=20
allowed to retaliate by disabling the attacker's computer), and the second=
=20
is to ponder the nature of counterattack.

The best defense is a good offense, and that's what counterattack=20
is.  Passive defense is making yourself harder to hit.  Active defense is=20
fighting back.  Counterattack is turning the tables and attacking the=20
attacker.  It's by far the most effective means of defense, but it's also=20
the most error prone.

In almost all of civilized society, counterattack is not legal.  If you=20
catch someone burglarizing your home, it's not legal for you to follow her=
=20
home and shoot her.  If you're being blackmailed by someone, turning around=
=20
and blackmailing him back is just as illegal as the first crime.  I can't=20
think of any exceptions to this.  Law enforcement is the sole purview of=20
the police, an organization that has what I have previously described as "a=
=20
state-sponsored monopoly on violence."

The exception to the above is warfare.  In war, the rules about=20
counterattack -- and preemptive attack -- are different.  In war, attack=20
and defense are so jumbled up that counterattack is the norm.  In war, the=
=20
difference between an offensive weapon and a defensive weapon is the=20
direction it's pointing.  But that's not what we're talking about here.

Counterattack is wrong, both legally and morally.  Vigilante justice is=20
wrong, both legally and morally.  Victims of attack are allowed to defend=20
themselves, but they're not allowed to take the law into their own hands=20
and attack back.  That's why we have police.

None of this is new or controversial, so why are copyright holders even=20
talking about this?  This bill would make it legal for the MPAA, the RIAA,=
=20
and its ilk to break into computer systems they suspect (with no standard=20
of evidence) are guilty of copyright infringement.  It will allow them to=20
perform denial-of-service attacks against peer-to-peer networks, release=20
viruses that disable systems and software, and violate everyone's=20
privacy.  People they choose to target would be deemed guilty until proven=
=20
otherwise.  In short, this bill would set up the entertainment industry as=
=20
a Gestapo-like enforcement agency with no oversight.

To me, it's another example of the insane lengths the entertainment=20
companies are willing to go to preserve their business models.  They're=20
willing to destroy your privacy, have general-purpose computers declared=20
illegal, and exercise special vigilante police powers that no one else=20
has...just to make sure that no one watches "The Little Mermaid" without=20
paying for it.  They're trying to invent a new crime: interference with a=20
business model.

Sad, really.

<http://zdnet.com.com/2100-1106-946341.html>
<http://www.wired.com/news/politics/0,1283,54153,00.html>
<http://www.newscientist.com/news/news.jsp?id=3Dns99992464>

Analyses:
<http://online.securityfocus.com/columnists/99>

An opinion piece by Rep. Howard Berman:
<http://www.house.gov/berman/p2p062502.html>


** *** ***** ******* *********** *************

                      News



Last month I put Cryptoco in my "Doghouse" column, on the strength of a=20
very snake-oil-filled press release.  Seems that at least one respectable=20
cryptographer, Ivan Damg=E5rd, is involved in this company.  I still think=
=20
this is snake-oil -- nothing I've read says anything different -- but there=
=20
may be something of mathematical interest inside all of the business=20
cluelessness.  They're patented their algorithm, though, which pretty much=
=20
guarantees the death of their ideas.
<http://www.2minvest.com/news.asp?id=3D216>

Entertaining story about the New York Times and insecure passwords:
<http://www.oreillynet.com/cs/weblog/view/wlg/1482>

Something good from Microsoft.  Their "Five-Minute Security Advisor" is a=20
collection of tips and tricks on a variety of topics.  Things like "Simple=
=20
Firewall Setup for Home Office Users," "The Road Warrior's Guide to Laptop=
=20
Protection," and "Configuring Your Computer for Multiple Users."  There's=20
some pro-Microsoft propaganda in the mix -- see "How Windows XP Protects=20
Your Privacy" for a good example -- but there's also lots of useful=20
information.
<http://www.microsoft.com/technet/treeview/default.asp?url=3D/technet/column=
s/=20
security/5min/default.asp>
See also Microsoft's "Security How-To" guides for more in-depth information=
=20
on certain topics:
<http://www.microsoft.com/technet/treeview/default.asp?url=3D/technet/itsolu=
ti=20
ons/howto/sechow.asp>

Interesting claims and counterclaims about the relationship between=20
malicious hackers and security companies:
<http://theregister.co.uk/content/55/26198.html>
<http://theregister.co.uk/content/55/26202.html>
<http://theregister.co.uk/content/55/26247.html>
For what it's worth, I have nothing but respect for @Stake and their=20
integrity as a company.  (I am also on their Technical Advisory Board.)  I=
=20
don't particularly like their relationship with Microsoft, but that's=20
something completely different.

Yikes!  This could very well be a patent on network firewalls.
<http://patft.uspto.gov/netacgi/nph-Parser?Sect1=3DPTO1&Sect2=3DHITOFF&d=3DP=
ALL&p=3D=20
1&u=3D/netahtml/srchnum.htm&r=3D1&f=3DG&l=3D50&s1=3D'5,790,554'.WKU.&OS=3DPN=
/5,790,554&R=20
S=3DPN/5,790,554>

This sounds a whole lot like snake oil.  My hope is that the reporter has=20
the story wrong, and that there's something interesting in the underlying=20
research.
<http://news.uns.purdue.edu/UNS/html4ever/020625.Atallah.security.html>

Clever security idea:  The music industry is flooding peer-to-peer networks=
=20
with bogus copies of popular songs.
<http://www.siliconvalley.com/mld/siliconvalley/3560365.htm>

The ACLU is challenging the DMCA:
<http://news.com.com/2100-1023-946266.html>

NIST is seeking comments on wireless security: 802.11, Bluetooth, etc.
<http://csrc.nist.gov/publications/drafts.html>
<http://csrc.nist.gov/publications/drafts/draft-sp800-48.pdf>

Carnival Booth is an algorithm for defeating the Computer-Assisted=20
Passenger Screening System (CAPS).  The point of CAPS is to try to maximize=
=20
security resources by profiling likely terrorists and spending more effort=
=20
on them.  "Why frisk Eleanor, the 80-year-old grandmother from Texas when=20
you can stop Omar, the 22-year-old student fresh from Libya?"  Sounds good,=
=20
but the authors of this paper show that, given a reasonably diverse=20
population of terrorists, this system is provably less secure than random=20
searching.  Really good work, and an excellent example of applying=20
techniques honed in computer security to the real world.
<http://swissnet.ai.mit.edu/6805/student-papers/spring02-papers/caps.htm>

Automatic face recognition fails miserably at Boston's Logan Airport, as=20
expected (what horrible URLs this newspaper has):
<http://www.boston.com/dailyglobe2/198/metro/_Face_testing_at_Logan_is_found=
=20
_lacking+.shtml>
<http://www.boston.com/dailyglobe2/217/business/Reliability_of_face_scan_tec=
=20
hnology_in_disputeP.shtml>

Here's an attack that could do real damage: MSN TV units are calling 911=20
after a malicious program changes their dial-out number.  This has the=20
potential of affecting emergency services.
<http://news.com.com/2100-1040-945911.html>

I've been starting to see more talk about counterattack: reaching back and=
=20
attacking the computer that's attacking you.  As satisfying as it sounds,=20
it's most likely illegal.  (It's also illegal to visit the home of the=20
person who robbed you and rob him back.)
<http://online.securityfocus.com/columnists/98>

Government-mandated background checks for IT personnel?
<http://www.computerworld.com/securitytopics/security/story/0,10801,72921,00=
=20
.html>

Eli Lilly has settled with the government in a computer privacy liability=20
case.  They leaked the names of 669 patients on Prozac.
<http://www.computerworld.com/securitytopics/security/privacy/story/0,10801,=
=20
72978,00.html>

New Rijndael cryptanalytic result.  It's not an attack, but it's a newly=20
discovered mathematical property of the cipher that may lead to one.
<http://eprint.iacr.org/2002/111/>

A new, faster, algorithm to test whether or not a given number is=20
prime.  While this has no direct cryptographic implications, it's an=20
enormously big deal.  Whether an algorithm like this even existed was an=20
open question until now.
<http://www.cse.iitk.ac.in/news/primality.pdf>

Here's an huge hole in Microsoft IE's SSL security.  Anyone with a valid=20
VeriSign certificate for any Internet site anywhere can forge a fake=20
certificate for any other Internet site, and Microsoft Internet Explorer=20
will accept the bogus certificate as valid.  The X.509 standard specifies=20
that certificates are supposed to include a bit saying whether the=20
corresponding public key can be used to sign other certificates.  VeriSign=
=20
certificates have the bit disabled, of course.  But Microsoft IE doesn't=20
check the bit, and assumes that any certificate can sign any other=20
certificate, and any certificate signed by any certificate is valid.  What=
=20
this means is that if you're a Microsoft IE user, the cryptographic=20
protections in SSL don't work for you.  The fact that Microsoft isn't all=20
over this problem tells me that their take-security-seriously initiative is=
=20
a whole lot of hot air.
<http://www.theregus.com/content/4/25935.html>
<http://www.eweek.com/article2/0,3959,462375,00.asp>
<http://story.news.yahoo.com/news?tmpl=3Dstory&u=3D/ap/20020812/ap_on_hi_te/=
encr=20
yption_flaw_2>


** *** ***** ******* *********** *************

                Counterpane News



Bruce Schneier is the subject of a lengthy, and very interesting, article=20
in The Atlantic:
<http://www.theatlantic.com/issues/2002/09/mann.htm>

Counterpane has just come off its best quarter ever.  We're monitoring more=
=20
companies in more countries than ever before, and are by far the largest=20
Managed Security Monitoring company in the world.  And with RipTech's=20
absorption into Symantec, there's no other security monitoring company that=
=20
can claim to be vendor independent.  We now have over 70 VARs selling=20
Counterpane monitoring, and more are signing up every week.  It's kind of=20
cool, really.

Counterpane's second-quarter results:
<http://www.counterpane.com/pr-2002q2.html>


** *** ***** ******* *********** *************

             Arming Airplane Pilots



It's a quintessentially American solution: our nation's commercial aircraft=
=20
are at risk, so let's allow pilots to carry guns.  We have visions of these=
=20
brave men and women as the last line of defense on an aircraft, and=20
courageously defending the cockpit against terrorists at 30,000 feet.  I=20
can just imagine the made-for-TV movie.

Reality is more complicated than television, though. Sometimes, security=20
systems cause more problems than they solve.  Putting guns on aircraft will=
=20
make us more vulnerable to attack, not less.

When people think of potential problems with an weapons in a cockpit, they=
=20
think of accidental shootings in the air, holes in the fuselage, and=20
possibly even equipment shattered by a stray bullet.  This is a problem,=20
certainly, but not a major one. A bullet hole is small, and doesn't let a=20
whole lot of air out.  And airplanes are designed to handle equipment=20
failures -- even serious failures -- and remain in the air.  If I ran an=20
airline, I would worry more about accidents involving passengers, who are=20
much less able to survive a bullet wound and much more likely to sue.

The real dangers, though, involve the complex systems that must be put in=20
place before the first gun can ride along in the cockpit.  There are major=
=20
areas of risk.

One, we need a system for getting the gun on the airplane.  How does the=20
pilot get the gun? Does he carry it through the airport and onto the=20
plane?  Is it issued to him after he's in the cockpit but before the plane=
=20
takes off?  Is it secured in the cockpit at all times, even when there is=20
no one there?  Any one of these solutions has its own set of security=20
vulnerabilities.  The last thing we want is for an attacker to exploit one=
=20
of these systems in order to get himself a gun.  Or maybe the last thing we=
=20
want is a shootout in a crowded airport.

Second, we need a procedure for storing the gun on the airplane.  Does the=
=20
pilot carry it on his hip?  Is it locked in a cabinet?  If so, who has the=
=20
key?  Is there one gun, or do the pilot and co-pilot each have=20
one?  However the system works, it's ripe for abuse.  If the gun is always=
=20
at the pilot's hip, an attacker can take it away from him when he leaves=20
the cockpit.  (Don't laugh; policemen get their guns taken away from them=20
all the time, and they're trained to prevent that.)  If the guns remain in=
=20
the cockpit when it is unoccupied, we have a whole new set of problems to=20
worry about.

Third, we need a system of training pilots in gun handling and=20
marksmanship.  Guns require training to use well; how much training can we=
=20
expect our pilots to have?  This is different from training sky=20
marshals.  Security is the primary job of a sky marshal; they're expected=20
to learn how to use a gun.  Flying planes is the primary job of a pilot.

Giving pilots guns is a disaster waiting to happen.  The current system=20
spends a lot of time and effort keeping weapons off airplanes and out of=20
airports; the proposed scheme would inject thousands of handguns into that=
=20
system.  There are just too many pilots and too many flights every day;=20
mistakes will happen. Someone will do an inventory one night and find a gun=
=20
missing, or ten.  Someone will find one left in a cockpit.  Someone may=20
even find one on a seat in a terminal.

El Al is the most security-conscious airline in the world.  Their pilots=20
remain behind two bulletproof doors, and they're unarmed.  It's the job of=
=20
the pilot to land the plane safely, not to engage terrorists in close=20
combat.  For that, they rely on sky marshals, crew, and passengers.  If=20
pilots have to leave the cockpit to solve a security problem, it's too late.

United States airlines are not comparable to El Al.  Our flights don't=20
travel with two armed sky marshals each.  We don't perform security checks=
=20
on passengers that, while legal in Israel, would violate U.S. laws.  We=20
don't have two bulletproof doors separating the cockpit from the=20
passengers.  Many politicians see guns as a quick fix to a problem that=20
can't wait for a careful solution.

Personally, I don't think pilots should be armed.  But even if I thought=20
they did, I still wouldn't give them guns.  Guns aren't designed to be used=
=20
in the cramped spaces you find in airplane cockpits.  They have too high a=
=20
risk of doing unwanted damage if they miss.  And there's too much risk=20
involved in putting thousands of guns in airports, storing them, getting=20
them on and off airplanes, and keeping them in cockpits.  If you want to=20
arm pilots, it would be much smarter to give them billy clubs or=20
tasers.  At least those weapons make sense for the situation.


** *** ***** ******* *********** *************

             Comments from Readers



From: "Travis Puderbaugh" <[email protected]>
Subject: Embedded Systems

The security of an embedded system doesn't necessarily have to be in the=20
chip itself.  In the pipeline example, the individual embedded controllers=
=20
that run the valves should not (and aren't, I don't think) be connected=20
directly to the Internet.  Rather, they go through a control computer at=20
some point.  If the security on that control computer is maintained, then=20
all those embedded products aren't in any danger.  Similarly with traffic=20
lights, they are controlled by a central computer.  If the security on that=
=20
central computer is adequate, then each light can be considered as secure=20
as that computer.  The danger of someone walking up to a control box and=20
reprogramming an EEPROM or FPGA is very low, and if they can get that kind=
=20
of access then they can just throw a rock at the circuit -- which will be=20
just as damaging.



From: Bruce McNair <[email protected]>
Subject: Microsoft's Palladium

I think the name says it all.  It was sent from the gods; no man may look=20
at it, lest they be blinded (probably a reference to the open source=20
movement and reverse engineering lawsuits).  It was supposed to protect=20
Troy, but it doesn't protect against attacks by Trojan horses.  And, if you=
=20
look at it from a commodities perspective, it may be more expensive than=20
gold...


** *** ***** ******* *********** *************


CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses,=20
insights, and commentaries on computer security and cryptography.  Back=20
issues are available on <http://www.counterpane.com/crypto-gram.html>.

To subscribe, visit <http://www.counterpane.com/crypto-gram.html> or send a=
=20
blank message to [email protected].  To unsubscribe,=
=20
visit <http://www.counterpane.com/unsubform.html>.

Please feel free to forward CRYPTO-GRAM to colleagues and friends who will=
=20
find it valuable.  Permission is granted to reprint CRYPTO-GRAM, as long as=
=20
it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier.  Schneier is founder and CTO of=20
Counterpane Internet Security Inc., the author of "Secrets and Lies" and=20
"Applied Cryptography," and an inventor of the Blowfish, Twofish, and=20
Yarrow algorithms.  He is a member of the Advisory Board of the Electronic=
=20
Privacy Information Center (EPIC).  He is a frequent writer and lecturer on=
=20
computer security and cryptography.

Counterpane Internet Security, Inc. is the world leader in Managed Security=
=20
Monitoring.  Counterpane's expert security analysts protect networks for=20
Fortune 1000 companies world-wide.

<http://www.counterpane.com/>

Copyright (c) 2002 by Counterpane Internet Security, Inc.