CRYPTO-GRAM, December 15, 2006

                  CRYPTO-GRAM

               December 15, 2006

               by Bruce Schneier
                Founder and CTO
                 BT Counterpane
              [email protected]
             http://www.schneier.com
            http://www.counterpane.com


A free monthly newsletter providing summaries, analyses, insights, and 
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit 
<http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at 
<http://www.schneier.com/crypto-gram-0612.html>.  These same essays 
appear in the "Schneier on Security" blog: 
<http://www.schneier.com/blog>.  An RSS feed is available.


** *** ***** ******* *********** *************

In this issue:
      Revoting
      Real-World Passwords
      Crypto-Gram Reprints
      Tracking People by their Sneakers
      Notary Fraud
      News
      Separating Data Ownership and Device Ownership
      BT Counterpane News
      Fighting Fraudulent Transactions
      Cybercrime Hype Alert
      Comments from Readers


** *** ***** ******* *********** *************

      Revoting



In the world of voting, automatic recount laws are not uncommon. 
Virginia, where George Allen lost to James Webb in the Senate race by 
7,800 out of over 2.3 million votes, or 0.33%, is an example. If the 
margin of victory is 1% or less, the loser is allowed to ask for a 
recount. If the margin is 0.5% or less, the government pays for it. If 
the margin is between 0.5% and 1%, the loser pays for it.

We have recounts because vote counting is -- to put it mildly -- sloppy. 
Americans like their election results fast, before they go to bed at 
night. So we're willing to put up with inaccuracies in our tallying 
procedures, and ignore the fact that the numbers we see on television 
correlate only roughly with reality.

Traditionally, it didn't matter very much, because most voting errors 
were "random errors."

There are two basic types of voting errors: random errors and systemic 
errors. Random errors are just that, random -- equally likely to happen 
to anyone. In a close race, random errors won't change the result 
because votes intended for candidate A that mistakenly go to candidate B 
happen at the same rate as votes intended for B that mistakenly go to A. 
  (Mathematically, as candidate A's margin of victory increases, random 
errors slightly decrease it.)

This is why, historically, recounts in close elections rarely change the 
result. The recount will find the few percent of the errors in each 
direction, and they'll cancel each other out. In an extremely close 
election, a careful recount will yield a different result -- but that's 
a rarity.

The other kind of voting error is a systemic error. These are errors in 
the voting process -- the voting machines, the procedures -- that cause 
votes intended for A to go to B at a different rate than the reverse.

An example would be a voting machine that mysteriously recorded more 
votes for A than there were voters. (Sadly, this kind of thing is not 
uncommon with electronic voting machines.)   Another example would be a 
random error that only occurs in voting equipment used in areas with 
strong A support. Systemic errors can make a dramatic difference in an 
election, because they can easily shift thousands of votes from A to B 
without any counterbalancing shift from B to A.

Even worse, systemic errors can introduce errors out of proportion to 
any actual randomness in the vote-counting process. That is, the 
closeness of an election is not any indication of the presence or 
absence of systemic errors.

When a candidate has evidence of systemic errors, a recount can fix a 
wrong result -- but only if the recount can catch the error. With 
electronic voting machines, all too often there simply isn't the data: 
there are no votes to recount.

This year's election in Florida's 13th Congressional District is such an 
example. The winner won by a margin of 373 out of 237,861 total votes, 
but as many as 18,000 votes were not recorded by the electronic voting 
machines. These votes came from areas where the loser was favored over 
the winner, and would have likely changed the result.

Or imagine this -- as far as we know -- hypothetical situation: After 
the election, someone discovers rogue software in the voting machines 
that flipped some votes from A to B. Or someone gets caught vote 
tampering -- changing the data on electronic memory cards. The problem 
is that the original data is lost forever; all we have is the hacked vote.

Faced with problems like this, we can do one of two things. We can 
certify the result anyway, regretful that people were disenfranchised 
but knowing that we can't undo that wrong. Or, we can tell everyone to 
come back and vote again.

To be sure, the very idea of revoting is rife with problems. Elections 
are a snapshot in time -- election day -- and a revote will not reflect 
that. If Virginia revoted for the Senate this year, the election would 
not just be for the junior senator from Virginia, but for control of the 
entire Senate. Similarly, in the 2000 presidential election in Florida, 
or the 2004 presidential election in Ohio, single-state revotes would 
have decided the presidency.

And who should be allowed to revote? Should only people in those 
precincts where there were problems revote, or should the entire 
election be rerun? In either case, it is certain that more voters will 
find their way to the polls, possibly changing the demographic and 
swaying the result in a direction different than that of the initial set 
of voters. Is that a bad thing, or a good thing?

Should only people who actually voted -- records are kept -- or who 
could demonstrate that they were erroneously turned away from the polls 
be allowed to revote? In this case, the revote will almost certainly 
have fewer voters, as some of the original voters will be unable to vote 
a second time. That's probably a bad thing -- but maybe it's not.

The only analogy we have for this are run-off elections, which are 
required in some jurisdictions if the winning candidate didn't get 50% 
of the vote. But it's easy to know when you need to have a run-off. Who 
decides, and based on what evidence, that you need to have a revote?

I admit that I don't have the answers here. They require some serious 
thinking about elections, and what we're trying to achieve. But smart 
election security not only tries to prevent vote hacking -- or even 
systemic electronic voting-machine errors -- it prepares for recovery 
after an election has been hacked. We have to start discussing these 
issues now, when they're non-partisan, instead of waiting for the 
inevitable situation, and the pre-drawn battle lines those results dictate.

Florida 13th:
http://www.heraldtribune.com/apps/pbcs.dll/article?AID=/20061111/NEWS/611110643 
or http://tinyurl.com/ygo73l
http://www.nytimes.com/2006/11/10/us/politics/10florida.html

http://www.newsbackup.com/about496345.html

This essay originally appeared on Wired.com.
http://www.wired.com/news/columns/0,72124-0.html


** *** ***** ******* *********** *************

      Real-World Passwords



How good are the passwords people are choosing to protect their 
computers and online accounts?

It's a hard question to answer because data is scarce. But recently, a 
colleague sent me some spoils from a MySpace phishing attack: 34,000 
actual user names and passwords.

The attack was pretty basic. The attackers created a fake MySpace login 
page, and collected login information when users thought they were 
accessing their own account on the site. The data was forwarded to 
various compromised web servers, where the attackers would harvest it later.

MySpace estimates that more than 100,000 people fell for the attack 
before it was shut down. The data I have is from two different 
collection points, and was cleaned of the small percentage of people who 
realized they were responding to a phishing attack. I analyzed the data, 
and this is what I learned.

Password Length: While 65% of passwords contain eight characters or 
less, 17% are made up of six characters or less. The average password is 
eight characters long.

Specifically, the length distribution looks like this:

1-4	0.82%
5	1.1%
6	15%
7	23%
8	25%
9	17%
10	13%
11	2.7%
12	0.93%
13-32	0.93%

Yes, there's a 32-character password: 
"1ancheste23nite41ancheste23nite4." Other long passwords are 
"fool2thinkfool2thinkol2think" and "dokitty17darling7g7darling7."

Character Mix: While 81% of passwords are alphanumeric, 28% are just 
lowercase letters plus a single final digit -- and two-thirds of those 
have the single digit 1. Only 3.8% of passwords are a single dictionary 
word, and another 12% are a single dictionary word plus a final digit -- 
once again, two-thirds of the time that digit is 1.

numbers only		1.3%
letters only		9.6%
alphanumeric		81%
non-alphanumeric	8.3%

Only 0.34% of users have the username portion of their e-mail address as 
their password.

Common Passwords: The top 20 passwords are (in order):  password1, 
abc123, myspace1, password, blink182, qwerty1, fuckyou, 123abc, 
baseball1, football1, 123456, soccer, monkey1, liverpool1, princess1, 
jordan23, slipknot1, superman1, iloveyou1 and monkey.

The most common password, "password1," was used in 0.22% of all 
accounts. The frequency drops off pretty fast after that: "abc123" and 
"myspace1" were only used in 0.11% of all accounts, "soccer" in 0.04% 
and "monkey" in 0.02%.

For those who don't know, Blink 182 is a band. Presumably lots of people 
use the band's name because it has numbers in its name, and therefore it 
seems like a good password. The band Slipknot doesn't have any numbers 
in its name, which explains the 1. The password "jordan23" refers to 
basketball player Michael Jordan and his number. And, of course, 
"myspace" and "myspace1" are easy-to-remember passwords for a MySpace 
account. I don't know what the deal is with monkeys.

We used to quip that "password" is the most common password. Now it's 
"password1." Who said users haven't learned anything about security?

But seriously, passwords are getting better. I'm impressed that less 
than 4% were dictionary words and that the great majority were at least 
alphanumeric. Writing in 1989, Daniel Klein was able to crack 24% of his 
sample passwords with a small dictionary of just 63,000 words, and found 
that the average password was 6.4 characters long.

And in 1992 Gene Spafford cracked 20% of passwords with his dictionary, 
and found an average password length of 6.8 characters. (Both studied 
Unix passwords, with a maximum length at the time of 8 characters.) And 
they both reported a much greater percentage of all lowercase, and only 
upper- and lowercase, passwords than emerged in the MySpace data. The 
concept of choosing good passwords is getting through, at least a little.

On the other hand, the MySpace demographic is pretty young. Another 
password study in November looked at 200 corporate employee passwords: 
20% letters only, 78% alphanumeric, 2.1% with non-alphanumeric 
characters, and a 7.8-character average length. Better than 15 years 
ago, but not as good as MySpace users. Kids really are the future.

None of this changes the reality that passwords have outlived their 
usefulness as a serious security device. Over the years, password 
crackers have been getting faster and faster. Current commercial 
products can test tens -- even hundreds -- of millions of passwords per 
second. At the same time, there's a maximum complexity to the passwords 
average people are willing to memorize. Those lines crossed years ago, 
and typical real-world passwords are now software-guessable. 
AccessData's Password Recovery Toolkit -- at 200,000 guesses per second 
-- would have been able to crack 23% of the MySpace passwords in 30 
minutes, 55% in 8 hours.

Of course, this analysis assumes that the attacker can get his hands on 
the encrypted password file and work on it offline, at his leisure; 
i.e., that the same password was used to encrypt an e-mail, file or hard 
drive. Passwords can still work if you can prevent offline 
password-guessing attacks, and watch for online guessing. They're also 
fine in low-value security situations, or if you choose really 
complicated passwords and use something like Password Safe to store 
them. But otherwise, security by password alone is pretty risky.

MySpace Attack
http://www.infoworld.com/infoworld/article/06/10/27/HNphishingmyspace_1.html 
or http://tinyurl.com/y29f8l
http://news.netcraft.com/archives/2006/10/27/myspace_accounts_compromised_by_phishers.html 
or http://tinyurl.com/yggk83
http://www.securiteam.com/securitynews/6O00M0AHFW.html

Another analysis of the same data:
http://www.infoworld.com/article/06/11/17/47OPsecadvise_1.html

Other password studies:
http://www.deter.com/unix/papers/passwords_klein.ps.gz
http://ftp.cerias.purdue.edu/pub/papers/gene-spafford/spaf-OPUS-observe.pdf 
or http://tinyurl.com/y8l5vm
http://www.fredstie.com/thesis/survey/survey_report.pdf
http://download.lawr.ucdavis.edu/pub/CambridgePWStudy.pdf

Password cracking:
http://www.lockdown.co.uk/?pg=combi&s=articles
http://www.accessdata.com/products/decryption/

Password Safe:
http://passwordsafe.sourceforge.net/

This essay originally appeared on Wired.com.
http://www.wired.com/news/columns/0,72300-0.html


** *** ***** ******* *********** *************

      Crypto-Gram Reprints



Crypto-Gram is currently in its ninth year of publication.  Back issues 
cover a variety of security-related topics, and can all be found on 
<http://www.schneier.com/crypto-gram-back.html>.  These are a selection 
of articles that appeared in this calendar month in other years.

Airplane Security:
http://www.schneier.com/crypto-gram-0512.html#1

Sony's DRM Rootkit:
http://www.schneier.com/crypto-gram-0512.html#6

Surveillance and Oversight:
http://www.schneier.com/crypto-gram-0512.html#10

Behavioral Assessment Profiling:
http://www.schneier.com/crypto-gram-0412.html#1

Kafka and the Digital Person:
http://www.schneier.com/crypto-gram-0412.html#8

Safe Personal Computing:
http://www.schneier.com/crypto-gram-0412.html#10

Blaster and the August 14th Blackout:
http://www.schneier.com/crypto-gram-0312.html#1

Quantum Cryptography:
http://www.schneier.com/crypto-gram-0312.html#6

Computerized and Electronic Voting:
http://www.schneier.com/crypto-gram-0312.html#9

Counterattack:
http://www.schneier.com./crypto-gram-0212.html#1

Comments on the Department of Homeland Security:
http://www.schneier.com./crypto-gram-0212.html#3

Crime: The Internet's Next Big Thing:
http://www.schneier.com./crypto-gram-0212.html#7

National ID Cards:
http://www.schneier.com/crypto-gram-0112.html#1

Judges Punish Bad Security:
http://www.schneier.com/crypto-gram-0112.html#2

Computer Security and Liabilities:
http://www.schneier.com/crypto-gram-0112.html#4

Fun with Vulnerability Scanners:
http://www.schneier.com/crypto-gram-0112.html#9

Voting and Technology:
http://www.schneier.com/crypto-gram-0012.html#1

"Security Is Not a Product; It's a Process"
http://www.schneier.com/crypto-gram-9912.html#1

ECHELON Technology:
http://www.schneier.com/crypto-gram-9912.html#3

European Digital Cellular Algorithms:
http://www.schneier.com/crypto-gram-9912.html#10

The Fallacy of Cracking Contests:
http://www.schneier.com/crypto-gram-9812.html#contests

How to Recognize Plaintext:
http://www.schneier.com/crypto-gram-9812.html#plaintext


** *** ***** ******* *********** *************

      Tracking People by their Sneakers



Researchers at the University of Washington have demonstrated a 
surveillance system that automatically tracks people through the 
Nike+iPod Sport Kit.  Basically, the kit contains a transmitter that you 
stick in your sneakers and a receiver you attach to your iPod.  This 
allows you to track things like time, distance, pace, and calories 
burned.  Pretty clever.

However, it turns out that the transmitter in your sneaker can be read 
up to 60 feet away.  And because it broadcasts a unique ID, you can be 
tracked by it.  In the demonstration, the researchers built a 
surveillance device (at a cost of about $250) and interfaced their 
surveillance system with Google Maps.   Very scary.

This is a great demonstration for anyone who is skeptical that RFID 
chips can be used to track people.  It's a good example because the 
chips have no personal identifying information, yet can still be used to 
track people.  As long as the chips have unique IDs, those IDs can be 
used for surveillance.

To me, the real significance of this work is how easy it was.  The 
people who designed the Nike+iPod system put zero thought into security 
and privacy issues.  Unless we enact some sort of broad law requiring 
companies to add security into these sorts of systems, companies will 
continue to produce devices that erode our privacy through new 
technologies.  Not on purpose, not because they're evil -- just because 
it's easier to ignore the externality than to worry about it.

http://www.cs.washington.edu/research/systems/privacy.html
http://www.cs.washington.edu/research/systems/nikeipod/tracker-paper.pdf 
or http://tinyurl.com/y7adl4


** *** ***** ******* *********** *************

      Notary Fraud



Many countries have the concept of a "notary public."  Their training 
and authority varies from country to country; in the United States, 
their primary role is to witness the signature of legal documents.  Many 
important legal documents require notarization in addition to a 
signature, primarily as a security device.

When I get a document notarized, I present my photo ID to a notary 
public.  Generally, I go to my local bank, where many of the employees 
are notary publics and I don't have to pay a fee for the service.  I 
sign the document while the notary watches, and he then signs an 
attestation to the fact that he saw me sign it.  He doesn't read the 
document; that's not his job.  And then I send my notarized document to 
whoever needed it: another bank, the patent office, my mortgage company, 
whatever.

It's an eminently hackable system.  Sure, you can always present a fake 
ID -- I'll bet my bank employee has never seen a West Virginia driver's 
license, for example -- but that takes work.  The easiest way to hack 
the system is through social engineering.

Bring a small pile of documents to be notarized.  In the middle of the 
pile, slip in a document with someone else's signature.  Since he's busy 
with his own signing and stamping -- and you're engaging him in slightly 
distracting conversation -- he's probably not going to notice that he's 
notarizing something "someone else" signed.  If he does, apologize for 
your honest mistake and try again elsewhere.

Of course, you're better off visiting a notary who charges by the 
document: he'll be more likely to appreciate the stack of documents 
you've brought to him and less likely to ask questions.  And pick a 
location -- not like a bank -- that isn't filled with security cameras.

Of course, this won't be enough if the final recipient of the document 
checks the signature; you're on your own when it comes to forgery.  And 
in my state the notary has to keep a record of the document he signs; 
this one won't be in his records if he's ever asked.  But if you need to 
switch the deed on a piece of property, change ownership of a bank 
account, or give yourself power of attorney over someone else, hacking 
the notary system makes the job a lot easier.

Anyone know how often this kind of thing happens in real life?

http://en.wikipedia.org/wiki/Notary_public


** *** ***** ******* *********** *************

      News



Here's a dumb idea: voting from your TiVo.
http://www.wired.com/news/technology/0,72113-0.html

EPIC on electronic voting machines:
http://www.epic.org/privacy/surveillance/spotlight/0906/default.html

This paper describes an inherent flaw with the way ATM PINs are 
encrypted and transmitted on the international financial networks, 
making them vulnerable to attack from malicious insiders in a bank.
http://www.arx.com/documents/The_Unbearable_Lightness_of_PIN_Cracking.pdf 
or http://tinyurl.com/ygq84h
One of the most disturbing aspects of the attack is that you're only as 
secure as the most untrusted bank on the network.  Instead of just 
having to trust your own issuer bank that they have good security 
against insider fraud, you have to trust every other financial 
institution on the network as well.  An insider at another bank can 
crack your ATM PIN if you withdraw money from any of the other banks' ATMs.

UK RFID passport cracked:
http://www.guardian.co.uk/idcards/story/0,,1950226,00.html
http://blog.wired.com/sterling/2006/11/arphid_watch_fi.html

This fraudster inserted a recording device into an ATM's phone line and 
recorded customer card numbers and PINs.  I'm amazed that ATMs still 
don't have basic communications security measures.
http://technology.timesonline.co.uk/article/0,,19509-2453590,00.html
http://www.theregister.co.uk/2006/11/18/mp3_player_atm_hack/

A 2004 U.S. government study found that RFID passports are less reliable 
than traditional passports.
http://www.epic.org/privacy/rfid/foia/2004results.pdf
I've written about RFID passports before.
http://www.schneier.com/blog/archives/2006/09/renew_your_pass.html

I've written about the 2006 Workshop on Economics of Information 
Security (WEIS); I think it's the most interesting security conference 
out there.
http://www.schneier.com/blog/archives/2006/06/economics_and_i_1.html
WEIS 2007 will be held at Carnegie Mellon University on June 6-7. 
There's still time to submit a paper.
http://weis2007.econinfosec.org/

Several TSA stories this month.  First, an innocent passenger arrested 
for trying to bring a rubber-band ball onto an airplane.
http://www.flyertalk.com/forum/showthread.php?t=618629
Second, a woman passed out on a plane after her drugs were confiscated.
http://www.thelocal.se/5493/20061113/
Third, San Francisco International Airport screeners were warned in 
advance of undercover test.
http://sfgate.com/cgi-bin/article.cgi?f=/c/a/2006/11/17/BAG72MESP91.DTL 
or http://tinyurl.com/vmuzj
Fourth, frozen spaghetti sauce almost confiscated:
http://www.salon.com/tech/col/smith/2006/11/22/askthepilot210/
We have a serious problem in this country.  The TSA operates above, and 
outside, the law.  There's no due process, no judicial review, no appeal.

And a TSA cartoon:
http://www.gocomics.com/thefifthwave/2006/11/19/

Six Muslim imams removed from a plane by US Airways because...well 
because they're Muslim and that scares people.  After they were cleared 
by the authorities, US Airways refused to sell them a ticket.
http://www.startribune.com/462/story/826056.html
http://www.tcdailyplanet.net/node/2963
Note that US Airways is the culprit here, not the TSA.  Refuse to be 
terrorized, people!
http://www.schneier.com/essay-124.html

Interesting article on the history and current search for a drug that 
compels people to tell the truth:
http://www.washingtonpost.com/wp-dyn/content/article/2006/11/19/AR2006111900891.html 
or http://tinyurl.com/w9mgp

David Kahn donates his cryptology library to the National Cryptologic 
Museum, at Fort Meade, MD:
http://www.nytimes.com/2006/11/23/arts/23arts.html

Earlier this month there was a bioterrorism drill in Seattle.  Postal 
carriers delivered dummy packages to "nearly thousands" of people (yes, 
that's what the article said; my guess is "nearly a thousand"), testing 
how the postal system could be used to quickly deliver medications. 
Sure, there are lots of scenarios where this kind of delivery system 
isn't good enough, but that's not the point.  In general, I think 
emergency response is one of the few areas where we need to spend more 
money.  And, in general, I think tests and drills like this are good -- 
how else will we know if the systems will work the way we think they will?
http://www.king5.com/localnews/stories/NW_110906WABbioterrordrillKC.205f0d23.html
http://www.metrokc.gov/health/postaldelivery/index.htm
http://alexfandra.livejournal.com/107641.html

Last week, the U.S. Copyright Office released a new list of exemptions 
to the DMCA.
http://www.copyright.gov/1201/
http://www.freedom-to-tinker.com/?p=1090
http://www.businessweek.com/ap/financialnews/D8LIEI5O0.htm

Erasable ink scam:  Someone goes door-to-door, soliciting contributions 
to a charity.  He prefers a check -- it's safer for you, after all.  But 
he offers his pen for you to sign your check, and the pen is filled with 
erasable ink.  Later, he changes both the payee and the amount, and 
cashes the check.  This surely isn't a new scam, but it's happening in 
the UK right now.  I've already written about attackers using different 
solvents to wash ink off checks, but this one is even more basic -- the 
attacker gives the victim a bad pen to start with.  I thought checks 
were printed with ink that also erased, voiding the check.  Why does 
this sort of attack still work?
http://iccroydon.icnetwork.co.uk/news/headlines/tm_headline=-magic-ink--conmen-fleece-cash-donors&method=full&objectid=18151895&siteid=53340-name_page.html 
or http://tinyurl.com/yc5mp7
http://www.schneier.com/blog/archives/2006/02/check_washing.html

Photo ID required for pancakes:
http://www.redorbit.com/news/oddities/746680/ihop_changes_policy_of_asking_for_ids/index.html?source=r_oddities 
or http://tinyurl.com/ya6no8

The DHS wants to share terrorist biometric information with other 
countries, in a program called "Global Envelope."  Does anyone think 
that this will be any better than the no-fly list?
http://www.gcn.com/online/vol1_no1/42677-1.html?topic=authentication&CMP=OTC-RSS 
or http://tinyurl.com/w85bw

There's new software that claims to be able to predict who is likely to 
become a murderer.  Pretty scary stuff, as it gets into the realm of 
thoughtcrime.
http://www.philly.com/mld/philly/news/local/16104571.htm?template=contentModules/printstory.jsp 
or http://tinyurl.com/yygj4f

In secret and for the past few years, immigration agents have been 
giving anyone entering or leaving the country a computer-generated 
terrorist risk score.  Like all these systems, we are all judged in 
secret, by a computer algorithm, with no way to see or even challenge 
our score.  Kafka would be proud.  One quote from the AP story:  "'If 
this catches one potential terrorist, this is a success,' Ahern said." 
That's just too idiotic a statement to even rebut.
http://news.yahoo.com/s/ap/20061201/ap_on_go_ca_st_pe/traveler_screening_6 
or http://tinyurl.com/ylnab6
http://www.washingtonpost.com/wp-dyn/content/article/2006/11/02/AR2006110201810.html 
or http://tinyurl.com/yl92on
http://www.ledger-enquirer.com/mld/ledgerenquirer/news/local/16196947.htm 
or http://tinyurl.com/y7lbnp
Commentary:
http://www.epic.org/privacy/surveillance/spotlight/1006/default.html
http://digbysblog.blogspot.com/2006_12_01_digbysblog_archive.html#116497716038834002 
or http://tinyurl.com/y88lnr
Federal Register notice:
http://edocket.access.gpo.gov/2006/06-9026.htm
Comments to the notice:
http://www.epic.org/privacy/pdf/ats_comments.pdf
http://www.eff.org/Privacy/ats/ats_comments.pdf
http://www.aclu.org/privacy/gen/27593leg20061201.html
Evidence that the program is illegal:
http://www.washingtonpost.com/wp-dyn/content/article/2006/12/08/AR2006120801833.html 
or http://tinyurl.com/u2j9s
http://www.wired.com/news/technology/0,72250-0.html
http://hasbrouck.org/IDP/IDP-ATS-comments.pdf
http://www.ledger-enquirer.com/mld/ledgerenquirer/news/local/16196947.htm 
or http://tinyurl.com/y7lbnp
http://www.chron.com/disp/story.mpl/ap/politics/4387187.html

Congress has passed an anti-pretexting bill.  The law doesn't go as far 
as some of the state laws -- which it pre-empts -- but it's still a good 
thing.
http://arstechnica.com/news.ars/post/20061211-8395.html
Previously, the MPAA killed a California anti-pretexting bill, claiming 
that it needed to commit fraud to stop illegal downloading.  My comment 
at the time:  These people are looking more and more like a criminal 
organization every day.
http://www.wired.com/news/technology/0,72214-0.html

"A Romanian man has been indicted on charges of hacking into more than 
150 U.S. government computers, causing disruptions that cost NASA, the 
Energy Department and the Navy nearly $1.5 million."  It's been a while 
since I've seen one of these stories.
http://www.cnn.com/2006/TECH/12/01/hacker.charged.ap/index.html

I give a talk called "The Future of Privacy," where I talk about current 
and future technological developments that erode our privacy.  One of 
the things I talk about is auditory eavesdropping, and I hypothesize 
that a cell phone microphone could be turned on surreptitiously and 
remotely.  I never had any actual evidence one way or the other, but the 
technique has surfaced in an organized crime prosecution.  Seems that 
the technique is to download eavesdropping software into the phone.
http://news.zdnet.com/2100-1035_22-6140191.html
http://www.nj.com/news/ledger/index.ssf?/base/news-10/1165815713294600.xml&coll=1 
or http://tinyurl.com/y36o9d

Interesting story of a British journalist buying 20 different fake EU 
passports.  She bought a genuine Czech passport with a fake name and her 
real picture, a fake Latvian passport, and a stolen Estonian passport. 
Note that harder-to-forge RFID passports would only help in one 
instance; it's certainly not the most important problem to solve.
http://news.bbc.co.uk/2/hi/uk_news/6169678.stm

I've written about backscatter X-ray technology before.  It's great for 
finding hidden weapons on a person, but it's also great for seeing naked 
images of them.  The TSA is piloting this technology in Phoenix, and 
they're deliberately blurring the images to protect privacy.  Note that 
the system is being made better by making the resulting images less 
detailed.  Excellent.
http://www.tsa.gov/research/privacy/backscatter.shtm
http://www.schneier.com/blog/archives/2005/06/backscatter_x-r.html
Blog entry URL:
http://www.schneier.com/blog/archives/2006/12/backscatter_xra.html

This is interesting.  Ted Kaczynski (the Unabomber) wrote in code.  It 
was a pencil-and-paper cipher that the government (the article says 
"CIA," but presumably the NSA was involved) couldn't crack until someone 
found the key amongst his papers.  Does anyone know the details of the 
algorithm?
http://cbs5.com/topstories/local_story_332014518.html
http://cbs5.com/slideshows/local_slideshow_332010422/view?slide=7

I'll be the first to admit it: I know next to nothing about MySpace or 
Facebook.  I do know that they're social networking sites, and that -- 
at least to some extent -- your reputation is based on who are your 
"friends" and what they say about you.  Which means that this follows, 
like day follows night: "Fake Your Space" is a site where you can hire 
fake friends to leave their pictures and personalized comments on your 
page.  Now you can pretend that you're more popular than you actually 
are.  What's next?  Services that verify friends on your friends' 
MySpace pages?  Services that block friend verification services?  Where 
will this all end up?
http://www.fakeyourspace.com/
Note: This is probably a hoax site.

Banks are spending millions preventing outsiders from stealing their 
customers' identities, but there is a growing insider threat.
http://news.com.com/2100-1029_3-6137940.html

Clever hack against gift cards.  Fraudster takes unactivated cards off 
racks in stores and copies down the serial numbers.  Later, he checks 
online to see if the card has been activated.  If it has, he goes on a 
shopping spree.
http://www.startribune.com/535/story/857643.html
What's the security problem?  A serial number on the cards that's 
visible even though the card is not activated.  This could be mitigated 
by hiding the serial number behind a scratch-off coating, or opaque 
packaging.

Absolutely fascinating paper about a personal RFID firewall.  The basic 
idea is that you carry a personalized device that jams the signals from 
all the RFID tags on your person until you authorize otherwise.  They 
even built a prototype.  As Cory Doctorow points out, this is 
potentially a way to reap the benefits of RFID without paying the cost.
http://www.rfidguardian.org/
http://www.cs.vu.nl/~melanie/rfid_guardian/papers/lisa.06.pdf
http://www.boingboing.net/2006/12/06/personal_firewall_fo.html

This is a weird story, about "the square root of terrorist intent."  It 
appears in an equation that determines how much federal money different 
locals receive for anti-terrorism defense.
http://www.schneier.com/blog/archives/2006/12/the_square_root.html
http://public.cq.com/public/20061204_homeland.html

I wrote an essay on spam for the Forbes.com website.
http://www.forbes.com/security/2006/12/11/spam-security-email-tech-security-cz_bs_1212spam.html 
or http://tinyurl.com/y6a63u
There's little in it I haven't said before.
http://www.schneier.com/blog/archives/2005/05/combating_spam.html
http://www.schneier.com/crypto-gram-0402.html#9

Another essay on spam:
http://www.freedom-to-tinker.com/?p=1094

Hackers have gained access to a database containing personal information 
on 800,000 current and former UCLA students.  This is barely worth 
writing about: yet another database attack exposing personal 
information.  My guess is that everyone in the U.S. has been the victim 
of at least one of these already.  But there was a particular section of 
the article that caught my eye.  "Jim Davis, UCLA's associate vice 
chancellor for information technology, described the attack as 
sophisticated, saying it used a program designed to exploit a flaw in a 
single software application among the many hundreds used throughout the 
Westwood campus.  'An attacker found one small vulnerability and was 
able to exploit it, and then cover their tracks,' Davis said."  It 
worries me that the associate vice chancellor for information technology 
doesn't understand that *all* attacks work like that.
http://www.latimes.com/news/local/la-me-ucla12dec12,0,7111141.story

CATO report on data mining and terrorism.  Definitely worth reading:
http://www.cato.org/pub_display.php?pub_id=6784

Defeating motion-sensor secured doors with a stick.  An old trick, but a 
good story:
http://thedailywtf.com/forums/thread/106137.aspx


** *** ***** ******* *********** *************

      Separating Data Ownership and Device Ownership



Consider two different security problems.  In the first, you store your 
valuables in a safe in your basement.  The threat is burglars, of 
course.  But the safe is yours, and the house is yours, too.  You 
control access to the safe, and probably have an alarm system.

The second security problem is similar, but you store your valuables in 
someone else's safe.  Even worse, it's someone you don't trust.  He 
doesn't know the combination, but he controls access to the safe.  He 
can try to break in at his leisure.  He can transport the safe anyplace 
he needs to.  He can use whatever tools he wants.  In the first case, 
the safe needs to be secure, but it's still just a part of your overall 
home security.  In the second case, the safe is the only security device 
you have.

This second security problem might seem contrived, but it happens 
regularly in our information society: Data controlled by one person is 
stored on a device controlled by another.  Think of a stored-value smart 
card: If the person owning the card can break the security, he can add 
money to the card.  Think of a DRM system: Its security depends on the 
person owning the computer not being able to get at the insides of the 
DRM security.  Think of the RFID chip on a passport.  Or a postage 
meter.  Or SSL traffic being sent over a public network.

These systems are difficult to secure, and not just because you give 
your attacker the device and let him utilize whatever time, equipment 
and expertise he needs to break it.  It's difficult to secure because 
breaks are generally "class breaks."  The expert who figures out how to 
do it can build hardware -- or write software -- to do it automatically. 
  Only one person needs to break a given DRM system; the software can 
break every other device in the same class.

This means that the security needs to be secure not against the average 
attacker, but against the smartest, most motivated and best funded attacker.

I was reminded of this problem earlier this month, when researchers 
announced a new attack against implementations of the RSA cryptosystem. 
  The attack exploits the fact that different operations take different 
times on modern CPUs.  By closely monitoring -- and actually affecting 
-- the CPU during an RSA operation, an attacker can recover the key. 
The most obvious applications for this attack are DRM systems that try 
to use a protected partition in the CPU to prevent the computer's owner 
from learning the DRM system's cryptographic keys.

These sorts of attacks are not new.  In 1995, researchers discovered 
they could recover cryptographic keys by comparing relative timings on 
chips.  In later years, both power and radiation were used to break 
cryptosystems.  I called these "side-channel attacks," because they made 
use of information other than the plaintext and ciphertext.  And where 
are they most useful?  To recover secrets from smart cards.

Whenever I see security systems with this data/device separation, I try 
to solve the security problem by removing the separation.  This means 
completely redesigning the system and the security assumptions behind it.

Compare a stored-value card with a debit card.  In the former case, the 
card owner can create money by changing the value on the card.  For this 
system to be secure, the card needs to be protected by a variety of 
security countermeasures.  In the latter case, there aren't any secrets 
on the card.  Your bank doesn't care that you can read the account 
number off the front of the card, or the data off the magnetic stripe 
off the back -- the real data, and the security, are in the bank's 
databases.

Or compare a DRM system with a financial model that doesn't care about 
copying.  The former is impossible to secure, the latter easy.

While common in digital systems, this kind of security problem isn't 
limited to them.  Last month, the province of Ontario started 
investigating insider fraud in their scratch-and-win lottery systems, 
after the CBC aired allegations that people selling the tickets are able 
to figure out which tickets are winners, and not sell them.  It's the 
same problem: the owners of the data on the tickets -- the lottery 
commission -- tried to keep that data secret from those who had physical 
control of the tickets.  And they failed.

Compare that with a traditional drawing-at-the-end-of-the-week lottery 
system.  The attack isn't possible, because there are no secrets on the 
tickets for an attacker to learn.

Separating data ownership and device ownership doesn't mean that 
security is impossible, only much more difficult.  You can buy a safe so 
strong that you can lock your valuables in it and give it to your 
attacker -- with confidence.  I'm not so sure you can design a smart 
card that keeps secrets from its owner, or a DRM system that works on a 
general-purpose computer -- especially because of the problem of class 
breaks.  But in all cases, the best way to solve the security problem is 
not to have it in the first place.

New timing attack on RSA:
http://www.newscientisttech.com/article/dn10609
http://eprint.iacr.org/2006/351.pdf

My essay on side-channel attacks:
http://www.schneier.com/crypto-gram-9806.html#side

My paper on data/device separation:
http://www.schneier.com/paper-smart-card-threats.html

Street-performer protocol: an alternative to DRM:
http://www.schneier.com/paper-street-performer.html

Ontario lottery fraud:
http://www.cbc.ca/canada/toronto/story/2006/10/26/ombudsman-probe.html

This essay originally appeared on Wired.com.
http://www.wired.com/news/columns/0,72196-0.html

Note:  I completely misunderstood the lottery problem in Ontario.  The 
frauds reported were perpetrated by lottery machine operators at 
convenience stores and the like stealing end-of-week draw tickets from 
unsuspecting customers.  The customer would hand their ticket over the 
counter to be scanned to see if it was a winner. The clerk (knowing what 
the winning numbers actually were) would palm a non-winning ticket into 
the machine, inform the customer "sorry better luck next time" and claim 
the prize on their own at a later date.   Nice scam, but nothing to do 
with the point of this essay.


** *** ***** ******* *********** *************

      BT Counterpane News



Bruce Schneier and Ray Stanton's perspectives on BT's acquisition of 
Counterpane and BT's future directions:
http://www.counterpane.com/csn-interview.pdf

Ovum's report on BT's acquisition of Counterpane:
http://www.counterpane.com/ovum.pdf

There was a profile of me in the "St. Paul Pioneer Press."  I'm pretty 
pleased with the article, but this is -- by far -- my favorite line, 
about "Applied Cryptography":  "'The first seven or eight chapters you 
can read without knowing any math at all,' Walker said. 'The second half 
of the book you can't export overseas -- it's classified as munitions.'" 
  It's not true, of course, but it's a great line.
http://www.twincities.com/mld/pioneerpress/16041202.htm

Another article on me from the Providence Journal:
http://www.schneier.com/news-022.html

Podcasts:
I was interviewed on the subject of RFID passports:
http://digitaldebateblogs.typepad.com/digital_identity/2006/11/bruce_schneier_.html 
or http://tinyurl.com/yxdx37
Gary McGraw interviewed me for his Silver Bullet Security Podcast.
http://www.cigital.com/silverbullet/show-009/


** *** ***** ******* *********** *************

      Fighting Fraudulent Transactions



Last March I wrote that two-factor authentication isn't going to reduce 
financial fraud or identity theft, that all it will do is force the 
criminals to change their tactics.  Back then, this is what I said:

"Unfortunately, the nature of attacks has changed over those two 
decades. Back then, the threats were all passive: eavesdropping and 
offline password guessing. Today, the threats are more active: phishing 
and Trojan horses.

"Here are two new active attacks we're starting to see:

"Man-in-the-Middle attack. An attacker puts up a fake bank website and 
entices user to that website. User types in his password, and the 
attacker in turn uses it to access the bank's real website. Done right, 
the user will never realize that he isn't at the bank's website. Then 
the attacker either disconnects the user and makes any fraudulent 
transactions he wants, or passes along the user's banking transactions 
while making his own transactions at the same time.

"Trojan attack. Attacker gets Trojan installed on user's computer. When 
user logs into his bank's website, the attacker piggybacks on that 
session via the Trojan to make any fraudulent transaction he wants.

"See how two-factor authentication doesn't solve anything? In the first 
case, the attacker can pass the ever-changing part of the password to 
the bank along with the never-changing part. And in the second case, the 
attacker is relying on the user to log in."

The solution is not to better authenticate the person, but to 
authenticate the transaction.  (Think credit cards.  No one checks your 
signature.  They really don't care if you're you.  They maintain 
security by authenticating the transactions.)

Of course, no one listens to me.  U.S. regulators required banks to 
implement two-factor authentication by the end of this year.  But 
customers are rebelling, and banks are scrambling to figure out 
something -- anything -- else.  And, amazingly enough and purely by 
accident it seems, they've stumbled on security solutions that actually 
work.  From CSO:

"Instead, to comply with new banking regulations and stem phishing 
losses, banks and the vendors who serve them are hurriedly putting 
together multipronged strategies that they say amount to "strong" 
authentication. The emerging approach generally consists of somehow 
recognizing a customer's computer, asking additional challenge questions 
for risky behavior and putting in place back-end fraud detection.

[...]

"Despite the FFIEC guidance about authentication, the emerging 
technologies that actually seem to hold the most promise for protecting 
the funds in consumer banking accounts aren't authentication systems at 
all. They're back-end systems that monitor for suspicious behavior.

"Some of these tools are rule-based: If a customer from Nebraska signs 
on from, say, Romania, the bank can determine that the log-on always be 
considered suspect. Others are based on a risk score: That log-on from 
Romania would add points to a risk score, and when the score reaches a 
certain threshold, the bank takes action.

"Flagged transactions can get bumped to second-factor authentication -- 
usually, a call on the telephone, something the user has. This has long 
been done manually in the credit card world. Just think about the last 
phone call you got from your credit card company's fraud department when 
you (or someone else) tried to make a large purchase with your credit 
card in Europe. Some banks, including Washington Mutual, are in the 
process of automating out-of-band phone calls for risky online 
transactions."

Exactly.  That's how you do it.

CSO article:
http://www.csoonline.com/read/110106/fea_strong_auth.html

My essay on two-factor authentication:
http://www.schneier.com/blog/archives/2005/03/the_failure_of.html

My essay on mitigating identity theft:
http://www.schneier.com/blog/archives/2005/04/mitigating_iden.html

Banks required to implement two-factor authentication:
http://www.schneier.com/blog/archives/2005/10/us_regulators_r.html

Another example:
http://www2.csoonline.com/blog_view.html?CID=27198


** *** ***** ******* *********** *************

      Cybercrime Hype Alert



It seems to be the season for cybercrime hype.  First, we have a CNN 
article, which seems to have no actual news:

"Computer hackers will open a new front in the multi-billion pound 
'cyberwar' in 2007, targeting mobile phones, instant messaging and 
community Web sites such as MySpace, security experts predict.

"As people grow wise to email scams, criminal gangs will find new ways 
to commit online fraud, sell fake goods or steal corporate secrets."

And next, a BBC article which claims that criminal organizations are 
paying student members to get IT degrees:

"The most successful cyber crime gangs were based on partnerships 
between those with the criminals skills and contacts and those with the 
technical ability, said Mr Day.

"'Traditional criminals have the ability to move funds and use all of 
the background they have,' he said, 'but they don't have the technical 
expertise.'

"As the number of criminal gangs looking to move into cyber crime 
expanded, it got harder to recruit skilled hackers, said Mr Day. This 
has led criminals to target university students all around the world.

"'Some students are being sponsored through their IT degree,' said Mr 
Day. Once qualified, the graduates go to work for the criminal gangs.

[...]

"The aura of rebellion the name conjured up helped criminals ensnare 
children as young as 14, suggested the study.

"By trawling websites, bulletin boards and chat rooms that offer hacking 
tools, cracks or passwords for pirated software, criminal recruiters 
gather information about potential targets.

"Once identified, young hackers are drawn in by being rewarded for 
carrying out low-level tasks such as using a network of hijacked home 
computers, a botnet, to send out spam.

"The low risk of being caught and the relatively high rewards on offer 
helped the criminal gangs to paint an attractive picture of a cyber 
criminal's life, said Mr Day.

"As youngsters are drawn in the stakes are raised and they are told to 
undertake increasingly risky jobs."

Criminals targeting children -- that's sure to peg anyone's hype-meter.

To be sure, I don't want to minimize the threat of cybercrime.  Nor do I 
want to minimize the threat of organized cybercrime.  There are more and 
more criminals prowling the net, and more and more cybercrime has gone 
up the food chain -- to large organized crime syndicates.  Cybercrime is 
big business, and it's getting bigger.

But I'm not sure if stories like these help or hurt.

CNN article:
http://www.cnn.com/2006/TECH/internet/12/12/cyber.crime.reut/index.html 
or http://tinyurl.com/y6shu6

BBC article:
http://news.bbc.co.uk/2/hi/technology/6220416.stm


** *** ***** ******* *********** *************

      Comments from Readers



There are hundreds of comments -- many of them interesting -- on these 
topics on my blog. Search for the story you want to comment on, and join 
in.

http://www.schneier.com/blog


** *** ***** ******* *********** *************

CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, 
insights, and commentaries on security: computer and otherwise.  You can 
subscribe, unsubscribe, or change your address on the Web at 
<http://www.schneier.com/crypto-gram.html>.  Back issues are also 
available at that URL.

Comments on CRYPTO-GRAM should be sent to [email protected]. 
Permission to print comments is assumed unless otherwise stated. 
Comments may be edited for length and clarity.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to 
colleagues and friends who will find it valuable.  Permission is also 
granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier.  Schneier is the author of the 
best sellers "Beyond Fear," "Secrets and Lies," and "Applied 
Cryptography," and an inventor of the Blowfish and Twofish algorithms. 
He is founder and CTO of BT Counterpane, and is a member of the Board of 
Directors of the Electronic Privacy Information Center (EPIC).  He is a 
frequent writer and lecturer on security topics.  See 
<http://www.schneier.com>.

BT Counterpane is the world's leading protector of networked information 
- the inventor of outsourced security monitoring and the foremost 
authority on effective mitigation of emerging IT threats.  BT 
Counterpane protects networks for Fortune 1000 companies and governments 
world-wide.  See <http://www.counterpane.com>.

Crypto-Gram is a personal newsletter.  Opinions expressed are not 
necessarily those of BT or BT Counterpane.

Copyright (c) 2006 by Bruce Schneier.