CRYPTO-GRAM, February 15, 2010

                  CRYPTO-GRAM

               February 15, 2010

               by Bruce Schneier
       Chief Security Technology Officer, BT
              [email protected]
             http://www.schneier.com


A free monthly newsletter providing summaries, analyses, insights, and 
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit 
<http://www.schneier.com/crypto-gram.html>.

You can read this issue on the web at 
<http://www.schneier.com/crypto-gram-1002.html>.  These same essays and 
news items appear in the "Schneier on Security" blog at 
<http://www.schneier.com/blog>, along with a lively comment section.  An 
RSS feed is available.


** *** ***** ******* *********** *************

In this issue:
      Fixing Intelligence Failures
      Anonymity and the Internet
      News
      Security and Function Creep
      TSA Logo Contest Semi-Finalists
      The Chinese Attack Against Google
      Schneier News
      New Attack on Threefish


** *** ***** ******* *********** *************

      Fixing Intelligence Failures



President Obama, in his recent speech, rightly focused on fixing the 
intelligence failures that resulted in Umar Farouk Abdulmutallab being 
ignored, rather than on technologies targeted at the details of his 
underwear-bomb plot. But while Obama's instincts are right, reforming 
intelligence for this new century and its new threats is a more 
difficult task than he might like. We don't need new technologies, new 
laws, new bureaucratic overlords, or -- for heaven's sake -- new 
agencies. What prevents information sharing among intelligence 
organizations is the culture of the generation that built those 
organizations.

The U.S. intelligence system is a sprawling apparatus, spanning the FBI 
and the State Department, the CIA and the National Security Agency, and 
the Department of Homeland Security -- itself an amalgamation of two 
dozen different organizations -- designed and optimized to fight the 
Cold War. The single, enormous adversary then was the Soviet Union: as 
bureaucratic as they come, with a huge budget, and capable of very 
sophisticated espionage operations. We needed to defend against 
technologically advanced electronic eavesdropping operations, their 
agents trying to bribe or seduce our agents, and a worldwide 
intelligence gathering capability that hung on our every word.

In that environment, secrecy was paramount. Information had to be 
protected by armed guards and double fences, shared only among those 
with appropriate security clearances and a legitimate "need to know," 
and it was better not to transmit information at all than to transmit it 
insecurely.

Today's adversaries are different. There are still governments, like 
China, who are after our secrets. But the secrets they're after are more 
often corporate than military, and most of the other organizations of 
interest are like al Qaeda: decentralized, poorly funded and incapable 
of the intricate spy versus spy operations the Soviet Union could pull off.

Against these adversaries, sharing is far more important than secrecy. 
Our intelligence organizations need to trade techniques and expertise 
with industry, and they need to share information among the different 
parts of themselves. Today's terrorist plots are loosely organized ad 
hoc affairs, and those dots that are so important for us to connect 
beforehand might be on different desks, in different buildings, owned by 
different organizations.

Critics have pointed to laws that prohibited inter-agency sharing but, 
as the 9/11 Commission found, the law allows for far more sharing than 
goes on. It doesn't happen because of inter-agency rivalries, a reliance 
on outdated information systems, and a culture of secrecy. What we need 
is an intelligence community that shares ideas and hunches and facts on 
their versions of Facebook, Twitter and wikis. We need the bottom-up 
organization that has made the Internet the greatest collection of human 
knowledge and ideas ever assembled.

The problem is far more social than technological. Teaching your mom to 
"text" and your dad to Twitter doesn't make them part of the Internet 
generation, and giving all those cold warriors blogging lessons won't 
change their mentality -- or the culture. The reason this continues to 
be a problem, the reason President George W. Bush couldn't change things 
even after the 9/11 Commission came to much the same conclusions as 
President Obama's recent review did, is generational. The Internet is 
the greatest generation gap since rock and roll, and it's just as true 
inside government as out. We might have to wait for the elders inside 
these agencies to retire and be replaced by people who grew up with the 
Internet.

A version of this op-ed previously appeared in the San Francisco Chronicle.
http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2010/01/14/ED0L1BIFK6.DTL 
or http://tinyurl.com/y8cjosq

The notion that U.S. intelligence should have "connected the dots," and 
caught Abdulmutallab, isn't going away.  But reality is much more 
complicated, and dots are easy to connect after the fact.
http://www.schneier.com/blog/archives/2010/01/the_abdulmutall.html

I wrote about fixing intelligence failures in 2002:
http://www.schneier.com/crypto-gram-0206.html#1

Another opinion:
http://online.wsj.com/article/SB10001424052748704586504574654261998633746.html 
or http://tinyurl.com/ydjso9g


** *** ***** ******* *********** *************

      Anonymity and the Internet



Universal identification is portrayed by some as the holy grail of 
Internet security. Anonymity is bad, the argument goes; and if we 
abolish it, we can ensure only the proper people have access to their 
own information. We'll know who is sending us spam and who is trying to 
hack into corporate networks. And when there are massive 
denial-of-service attacks, such as those against Estonia or Georgia or 
South Korea, we'll know who was responsible and take action accordingly.

The problem is that it won't work. Any design of the Internet must allow 
for anonymity. Universal identification is impossible. Even attribution 
-- knowing who is responsible for particular Internet packets -- is 
impossible. Attempting to build such a system is futile, and will only 
give criminals and hackers new ways to hide.

Imagine a magic world in which every Internet packet could be traced to 
its origin. Even in this world, our Internet security problems wouldn't 
be solved. There's a huge gap between proving that a packet came from a 
particular computer and that a packet was directed by a particular 
person. This is the exact problem we have with botnets, or pedophiles 
storing child porn on innocents' computers. In these cases, we know the 
origins of the DDoS packets and the spam; they're from legitimate 
machines that have been hacked. Attribution isn't as valuable as you 
might think.

Implementing an Internet without anonymity is very difficult, and causes 
its own problems. In order to have perfect attribution, we'd need 
agencies -- real-world organizations -- to provide Internet identity 
credentials based on other identification systems: passports, national 
identity cards, driver's licenses, whatever. Sloppier identification 
systems, based on things such as credit cards, are simply too easy to 
subvert. We have nothing that comes close to this global identification 
infrastructure. Moreover, centralizing information like this actually 
hurts security because it makes identity theft that much more profitable 
a crime.

And realistically, any theoretical ideal Internet would need to allow 
people access even without their magic credentials. People would still 
use the Internet at public kiosks and at friends' houses. People would 
lose their magic Internet tokens just like they lose their driver's 
licenses and passports today. The legitimate bypass mechanisms would 
allow even more ways for criminals and hackers to subvert the system.

On top of all this, the magic attribution technology doesn't exist. Bits 
are bits; they don't come with identity information attached to them. 
Every software system we've ever invented has been successfully hacked, 
repeatedly. We simply don't have anywhere near the expertise to build an 
airtight attribution system.

Not that it really matters. Even if everyone could trace all packets 
perfectly, to the person or origin and not just the computer, anonymity 
would still be possible. It would just take one person to set up an 
anonymity server. If I wanted to send a packet anonymously to someone 
else, I'd just route it through that server. For even greater anonymity, 
I could route it through multiple servers. This is called onion routing 
and, with appropriate cryptography and enough users, it adds anonymity 
back to any communications system that prohibits it.

Attempts to banish anonymity from the Internet won't affect those savvy 
enough to bypass it, would cost billions, and would have only a 
negligible effect on security. What such attempts would do is affect the 
average user's access to free speech, including those who use the 
Internet's anonymity to survive: dissidents in Iran, China, and elsewhere.

Mandating universal identity and attribution is the wrong goal. Accept 
that there will always be anonymous speech on the Internet. Accept that 
you'll never truly know where a packet came from. Work on the problems 
you can solve: software that's secure in the face of whatever packet it 
receives, identification systems that are secure enough in the face of 
the risks. We can do far better at these things than we're doing, and 
they'll do more to improve security than trying to fix insoluble problems.

The whole attribution problem is very similar to the 
copy-protection/digital-rights-management problem. Just as it's 
impossible to make specific bits not copyable, it's impossible to know 
where specific bits came from. Bits are bits. They don't naturally come 
with restrictions on their use attached to them, and they don't 
naturally come with author information attached to them. Any attempts to 
circumvent this limitation will fail, and will increasingly need to be 
backed up by the sort of real-world police-state measures that the 
entertainment industry is demanding in order to make copy-protection 
work. That's how China does it: police, informants, and fear.

Just as the music industry needs to learn that the world of bits 
requires a different business model, law enforcement and others need to 
understand that the old ideas of identification don't work on the 
Internet. For good or for bad, whether you like it or not, there's 
always going to be anonymity on the Internet.

This essay originally appeared in Information Security, as part of a 
point/counterpoint with Marcus Ranum.  You can read Marcus's response 
below my essay.
http://searchsecurity.techtarget.com/magazinePrintFriendly/0,296905,sid14_gci1380347,00.html 
or http://tinyurl.com/ydvm725

Comments that anonymity is bad:
http://www.theregister.co.uk/2009/10/16/kaspersky_rebukes_net_anonymity/ 
or http://tinyurl.com/yknbuh2
http://curiouscapitalist.blogs.time.com/2010/01/30/drivers-licenses-for-the-internet/ 
or http://tinyurl.com/yfjg7up

Storing child porn on innocents' computers:
http://www.huffingtonpost.com/2009/11/09/internet-virus-frames-use_n_350426.html 
or http://tinyurl.com/yg8jaka

Onion routing:
http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci775657,00.html?int=off 
or http://tinyurl.com/y9onwrt


** *** ***** ******* *********** *************

      News



Clever ruse by a prison escape artist.
http://www.schneier.com/blog/archives/2010/01/prison_escape_a.html

Security vs. sustainability in building construction.
http://www.facilitiesnet.com/security/article/Green-Building-Goals-and-Security-Initiatives-Can-Find-Common-Ground--11349 
or http://tinyurl.com/yjxutbk

Eavesdropping in the former Soviet Union:
http://www.schneier.com/blog/archives/2010/01/eavesdropping_i.html

I don't know if this discussion of privacy violations by Facebook 
employees is real, but it seems perfectly reasonable that all of 
Facebook is stored in a huge database that someone with the proper 
permissions can access and modify.  And it also makes sense that 
developers and others would need the ability to assume anyone's identity.
http://therumpus.net/2010/01/conversations-about-the-internet-5-anonymous-facebook-employee/?full=yes 
or http://tinyurl.com/yaxu5j5

The problems of profiling at security checkpoints.
http://news.bbc.co.uk/2/hi/uk_news/magazine/8452260.stm

Wrasse punishing cheaters:
http://scienceblogs.com/notrocketscience/2010/01/cleaner_fish_punish_cheats_who_offend_their_customers.php 
or http://tinyurl.com/yhw9da4
It's a classic fishing attack.

Neat pictures of an ATM skimmer. I would never have noticed it, which is 
precisely the point.
http://www.krebsonsecurity.com/2010/01/would-you-have-spotted-the-fraud/ 
or http://tinyurl.com/ykbvnlb

Nice article on web security.
http://www.smashingmagazine.com/2010/01/14/web-security-primer-are-you-part-of-the-problem/ 
or http://tinyurl.com/ylzrq3m

Transport Canada on its new security regulations.  Okay, it's really the 
Rick Mercer Report.
http://www.youtube.com/watch?v=yZfbTlYpKYo

Penny shooter business card. Of course, this means the TSA will start 
banning wallets on airplanes.
http://www.youtube.com/watch?v=5KNZZ9qDJtQ

UK police are planning on using unmanned spy drones for "routine" 
monitoring.
http://www.guardian.co.uk/uk/2010/jan/23/cctv-sky-police-plan-drones

New technology could scan cargo for nuclear material and conventional 
explosives.
http://www.technologyreview.com/blog/arxiv/24694/

January 8th was World Privacy Day.
http://dataprivacyday2010.org/
Celebrate by signing on to the Madrid Privacy Declaration, either as an 
individual or as an organization.
http://thepublicvoice.org/madrid-declaration/

How unique is your browser?  Can you be tracked simply by its 
characteristics?  The EFF is trying to find out.  Its site Panopticlick 
will measure the characteristics of your browser setup and tell you how 
unique it is.  I ran the test on myself, and my browser is unique 
amongst the 120,000 browsers tested at that time.  It's my browser 
plugin details; no one else has the exact configuration I do.  My list 
of system fonts is almost unique; only one other person has the exact 
configuration I do.  (This seems odd to me; I have a week-old Sony 
laptop running Windows 7, and I haven't done anything with the fonts.) 
EFF has some suggestions for self-defense, none of them very satisfactory.
http://panopticlick.eff.org/
http://arstechnica.com/tech-policy/news/2010/01/even-without-cookies-a-browser-leaves-a-trail-of-crumbs.ars 
or http://tinyurl.com/yagts94
http://www.schneier.com/blog/archives/2010/01/tracking_your_b.html#c410841

Deconfliction: this is well worth watching.
http://www.youtube.com/watch?v=g39xIewgGaM

Online credit/debit card security failure:
http://www.lightbluetouchpaper.org/2010/01/26/how-online-card-security-fails/ 
or http://tinyurl.com/ykwyp4e
http://www.cl.cam.ac.uk/~rja14/Papers/fc10vbvsecurecode.pdf

The Foreign Policy website has its own list of movie-plot threats: 
machine-gun wielding terrorists on paragliders, disease-laden insect 
swarms, a dirty bomb made from smoke detector parts, planning via online 
games, and botulinum toxin in the food supply.  The site fleshes these 
threats out a bit, but it's nothing regular readers of this blog can't 
imagine for themselves.  Maybe they should have their own movie-plot 
threat contest.
http://www.foreignpolicy.com/articles/2010/01/27/the_world_s_most_bizarre_terror_threats 
or http://tinyurl.com/y8mfmrz

Scaring the Senate Intelligence Committee.
http://www.schneier.com/blog/archives/2010/02/scaring_the_sen.html

10 cartoons about airport security.
http://www.telegraph.co.uk/travel/picturegalleries/7091780/Matt-on-travel-airport-security.html 
or http://tinyurl.com/y8qshyw

Interesting research on the limits of visual inspection.  This has 
implications for searching for contraband at airports.
http://www.cell.com/current-biology/abstract/S0960-9822(09)02122-8
http://www.npr.org/templates/story/story.php?storyId=122561355

Isn't it a bit embarrassing for an "expert on counter-terrorism" to be 
quoted as saying this?  "Bill Tupman, an expert on counter-terrorism 
from Exeter University, told BBC News: 'The problem is trying to predict 
the mind of the al-Qaeda planner; there are so many things they might 
do.  And it is also necessary to reassure the public that we are trying 
to outguess the al-Qaeda planner and we are in the process of protecting 
them from any threat.'"  I think it's necessary to convince the public 
to refuse to be terrorized.  What frustrates me most about Abdulmutallab 
is that he caused terror even though his plot failed.  I want us to be 
indomitable enough for the next attack to fail to cause terror, even if 
it succeeds.  Remember: terrorism can't destroy our country's way of 
life; only our reaction to terrorism can.
http://news.bbc.co.uk/2/hi/uk_news/england/devon/8481446.stm

Subversive organizations registering in South Carolina.  The rumor was 
that the law was passed year, but it seems to be from the 1950s.
http://www.schneier.com/blog/archives/2010/02/all_subversive.html

Dahlia Lithwick on "Terrorism Derangement Syndrome":
http://www.slate.com/id/2243429

Terrorists prohibited from using iTunes:
http://www.schneier.com/blog/archives/2010/02/terrorists_proh.html

Interview with a Nigerian Internet scammer:
http://www.schneier.com/blog/archives/2010/02/interview_with_16.html

Man-in-the-middle attack against chip-and-PIN payment card system:
http://www.schneier.com/blog/archives/2010/02/man-in-the-midd_1.html

Car key copier:
http://www.schneier.com/blog/archives/2010/02/car-key_copier.html

Nice article about a would-be spy and his homebrew pencil-and-paper 
cryptography.
http://www.wired.com/magazine/2010/01/ff_hideandseek/all/1

Crypto comic book:
http://www.schneier.com/blog/archives/2010/02/crypto_comic_bo.html

James Fallows and the Chinese cyber-threat:
http://www.theatlantic.com/doc/201003/china-cyber-war


** *** ***** ******* *********** *************

      Security and Function Creep



Security is rarely static. Technology changes both security systems and 
attackers. But there's something else that changes security's 
cost/benefit trade-off: how the underlying systems being secured are 
used. Far too often we build security for one purpose, only to find it 
being used for another purpose -- one it wasn't suited for in the first 
place. And then the security system has to play catch-up.

Take driver's licenses, for example. Originally designed to demonstrate 
a credential -- the ability to drive a car -- they looked like other 
credentials: medical licenses or elevator certificates of inspection. 
They were wallet-sized, of course, but they didn't have much security 
associated with them. Then, slowly, driver's licenses took on a second 
application: they became age-verification tokens in bars and liquor 
stores. Of course the security wasn't up to the task -- teenagers can be 
extraordinarily resourceful if they set their minds to it -- and over 
the decades driver's licenses got photographs, tamper-resistant features 
(once, it was easy to modify the birth year), and technologies that made 
counterfeiting harder. There was little value in counterfeiting a 
driver's license, but a lot of value in counterfeiting an 
age-verification token.

Today, US driver's licenses are taking on yet another function: security 
against terrorists. The Real ID Act -- the government's attempt to make 
driver's licenses even more secure -- has nothing to do with driving or 
even with buying alcohol, and everything to do with trying to make that 
piece of plastic an effective way to verify that someone is not on the 
terrorist watch list. Whether this is a good idea, or actually improves 
security, is another matter entirely.

You can see this kind of function creep everywhere. Internet security 
systems designed for informational Web sites are suddenly expected to 
provide security for banking Web sites. Security systems that are good 
enough to protect cheap commodities from being stolen are suddenly 
ineffective once the price of those commodities rises high enough. 
Application security systems, designed for locally owned networks, are 
expected to work even when the application is moved to a cloud computing 
environment. And cloud computing security, designed for the needs of 
corporations, is expected to be suitable for government applications as 
well -- maybe even military applications.

Sometimes it's obvious that security systems designed for one 
environment won't work in another. We don't arm our soldiers the same 
way we arm our policemen, and we can't take commercial vehicles and 
easily turn them into ones outfitted for the military. We understand 
that we might need to upgrade our home security system if we suddenly 
come into possession of a bag of diamonds. Yet many think the same 
security that protects our home computers will also protect voting 
machines, and the same operating systems that run our businesses are 
suitable for military uses.

But these are all conscious decisions, and we security professionals 
often know better. The real problems arise when the changes happen in 
the background, without any conscious thought. We build a network 
security system that's perfectly adequate for the threat and -- like a 
driver's license becoming an age-verification token -- the network 
accrues more and more functions. But because it has already been 
pronounced "secure," we can't get any budget to re-evaluate and improve 
the security until after the bad guys have figured out the 
vulnerabilities and exploited them.

I don't like having to play catch-up in security, but we seem doomed to 
keep doing so.

This essay originally appeared in the January/February 2010 issue of 
IEEE Security and Privacy.


** *** ***** ******* *********** *************

      TSA Logo Contest Semi-Finalists



Last month, I announced a contest to redesign the TSA logo.  We have 
finalists.  Go and vote in the blog comments; clicking on the images 
will bring up larger and easier-to-read versions.

Entries:
http://www.schneier.com/blog/archives/2010/01/tsa_logo_contes.html

Finalists:
http://www.schneier.com/blog/archives/2010/02/tsa_logo_contes_1.html

Patrick Smith and I promised copies of our books to the winner.  The 
winner will also receive a fake boarding pass for any flight on any 
date, and an empty 12-ounce bottle labelled "saline" that can be 
refilled and taken through any TSA security checkpoint.


** *** ***** ******* *********** *************

      The Chinese Attack Against Google



Last month, Google announced a sophisticated attack against them from 
China.  There have been some interesting technical details since then.

The rumor that China used a system Google put in place to enable lawful 
intercepts, which I used as a news hook for an essay on CNN.com, has not 
been confirmed.  At this point, I doubt that it's true.

My initial reaction:
http://www.schneier.com/blog/archives/2010/01/google_vs_china.html

My CNN.com essay.  Again, the rumor that the Chinese attack made use of 
pathways established for lawful interception seems not to be true.
http://www.cnn.com/2010/OPINION/01/23/schneier.google.hacking/index.html 
or http://tinyurl.com/y9fz5ew

Another blog entry on the topic:
http://www.schneier.com/blog/archives/2010/02/more_details_on.html

Technical details:
http://www.wired.com/threatlevel/2010/02/apt-hacks/
http://www.darkreading.com/database_security/security/attacks/showArticle.jhtml?articleID=222600139 


Google and the NSA: the world's largest data collector teams up with the 
world's largest data collector.  Does anyone think this is a good idea?
http://www.washingtonpost.com/wp-dyn/content/article/2010/02/03/AR2010020304057.html 
or http://tinyurl.com/ydvrnaw

EPIC has filed a Freedom of Information Act request for information 
about the agreement:
http://epic.org/2010/02/epic-seeks-records-on-google-n.html
I've already written about the NSA's role in securing cyberspace:
http://www.schneier.com/essay-265.html


** *** ***** ******* *********** *************

      Schneier News



I was interviewed on the New Horizons radio show in Boise:
http://radio.boisestate.edu/NewHorizons.html

I'll be speaking at the Minneapolis College of Art and Design on Feb 18:
http://events.mcad.edu/?q=node/97

I'm also speaking at the RSA Conference in San Francisco on March 4:
http://www.rsaconference.com/2010/usa/


** *** ***** ******* *********** *************

      New Attack on Threefish



At FSE 2010 last week, Dmitry Khovratovich and Ivica Nikolic presented a 
paper where they cryptanalyze ARX algorithms (algorithms that use only 
addition, rotation, and exclusive-OR operations): "Rotational 
Cryptanalysis of ARX."  In the paper, they demonstrate their attack 
against Threefish.  Their attack breaks 39 (out of 72) rounds of 
Threefish-256 with a complexity of 2^252.4, 42 (out of 72) rounds of 
Threefish-512 with a complexity of 2^507, and 43.5 (out of 80) rounds of 
Threefish-1024 with a complexity of 2^1014.5.  (Yes, that's over 2^1000. 
  Don't laugh; it really is a valid attack, even though it -- or any of 
these others -- will never be practical.)

This is excellent work, and represents the best attacks against 
Threefish to date.  (I suspect that the attacks can be extended a few 
more rounds with some clever cryptanalytic tricks, but no further.)  The 
security of full Threefish isn't at risk, of course; there's still 
plenty of security margin.

We have always stood by the security of Threefish with any set of 
non-obviously-bad constants.  Still, a trivial modification -- changing 
a single constant in the key schedule -- dramatically reduces the number 
of rounds through which this attack can penetrate.  If NIST allows 
another round of tweaks to the SHA-3 candidate algorithms, we will 
almost certainly take the opportunity to improve Skein's security; we'll 
change this constant to a value that removes the rotational symmetries 
that this technique exploits.  If they don't, we're still confident of 
the security of Threefish and Skein.

The paper:
http://www.skein-hash.info/sites/default/files/axr.pdf

Threefish:
http://www.schneier.com/threefish.html

SHA-3 candidate algorithms:
http://csrc.nist.gov/groups/ST/hash/sha-3/index.html

Skein:
http://www.skein-hash.info/


** *** ***** ******* *********** *************

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing 
summaries, analyses, insights, and commentaries on security: computer 
and otherwise.  You can subscribe, unsubscribe, or change your address 
on the Web at <http://www.schneier.com/crypto-gram.html>.  Back issues 
are also available at that URL.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to 
colleagues and friends who will find it valuable.  Permission is also 
granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety.

CRYPTO-GRAM is written by Bruce Schneier.  Schneier is the author of the 
best sellers "Schneier on Security," "Beyond Fear," "Secrets and Lies," 
and "Applied Cryptography," and an inventor of the Blowfish, Twofish, 
Threefish, Helix, Phelix, and Skein algorithms.  He is the Chief 
Security Technology Officer of BT BCSG, and is on the Board of Directors 
of the Electronic Privacy Information Center (EPIC).  He is a frequent 
writer and lecturer on security topics.  See <http://www.schneier.com>.

Crypto-Gram is a personal newsletter.  Opinions expressed are not 
necessarily those of BT.

Copyright (c) 2010 by Bruce Schneier.