I can't tell

Methinks the Spook is using your sense of humor against you ...

 

Never borrow someone else's underwear.

 

https://www.tomshardware.com/tech-i...d-another-die-embedded-in-the-microcontroller

At first, I thought this was being alarmist since it seemed to be making an issue of the fact that a cable specifically designed for penetration testing had non-standard things in it. But that's not the point. It's that even something as sophisticated as this pen-test cable could likely slip right through even pretty careful product vetting protocols intended to detect supply-chain intrusions.

One point that I think it was too quick to downplay is the claim that the price tag of a cable like this makes it unlikely to see widescale use by bad actors. It's costly because there's a tiny market to spread out the NRE on. The actual cost to make each cable is probably barely more than the cost to make a basic cable, so if someone, particularly a nation-state, wanted to carry out a massive campaign, the cost wouldn't be much of a factor.

How many people even have any awareness that many of today's cables have electronics at all in them, let alone that those electronics are becoming increasingly complex and capable? And, of course, cables aren't the only thing. Many batteries have a significant amount of electronics in them, as well as lots of other devices that are all round us. That makes for lots of fertile ground for people to embed malicious hardware in places that will be difficult to detect because we expect to see electronic hardware there. Naturally, that's on top of the ability to put ever-more capable malicious hardware in all of the places that we don't expect hardware to be, but being able to put it in cables and such offers huge advantages to the bad guy since many of their problems are greatly simplified, such as powering their stuff, interacting with the target systems, and establishing communications with their control.

 

I can't tell: are you playing down the threat, or making fun of those who do?

All of the above in this case. Shocked, shocked that a cable advertised to have hidden spy capabilities actually does those capabilities. Yes, it's physical security threat but some make it seem this is some sort of secret.

OMG, a controller and software could be used in a supply chain attack.

https://hackaday.com/2014/10/22/watch-that-windows-update-ftdi-drivers-are-killing-fake-chips/

 

Never borrow someone else's underwear.

Or bathing suit

There is an episode of Seinfeld where Kramer wanted to borrow Jerry's bathing suit. Jerry replied, "I don't want your boys down there ... your boys should stay in their neighborhood." Ha ha.

 

Wait. Didn't the FBI just tell us all to use encrypted messaging apps?

I guess they changed their minds.

https://dailygalaxy.com/2024/12/fbi...acebook-messenger-signal-before-its-too-late/

 

Wait. Didn't the FBI just tell us all to use encrypted messaging apps?

I guess they changed their minds.

https://dailygalaxy.com/2024/12/fbi...acebook-messenger-signal-before-its-too-late/

The apps work too well.

 

Wait. Didn't the FBI just tell us all to use encrypted messaging apps?

I guess they changed their minds.

https://dailygalaxy.com/2024/12/fbi...acebook-messenger-signal-before-its-too-late/

Not too surprising that different parts of the government, even within the same agency, take very different views, particularly on a situational basis.

The fact that the FBI Director said, " The public should not have to choose between safe data and safe communities. We should be able to have both—and we can have both… " indicates that he is hopelessly naive, completely incompetent, and/or is knowingly spewing balderdash. We DO have to choose between the two -- and how much we are willing to give up in one area in exchange for the benefits of the other. You can make sounds arguments in either direction, but to claim that there is no trade off and we can have both unconditionally is nothing more than political snake oil.

The fact that these officials fail to even acknowledge that it is trivial for people that know that they have something to hide to use end-to-end encryption before it even touches any of these apps indicates that their real target is not criminals, but greater ability to access everyone's data.

 

https://arstechnica.com/tech-policy...-biometric-data-without-consent-lawsuit-says/

Photobucket was sued Wednesday after a recent privacy policy update revealed plans to sell users' photos—including biometric identifiers like face and iris scans—to companies training generative AI models.

The proposed class action seeks to stop Photobucket from selling users' data without first obtaining written consent, alleging that Photobucket either intentionally or negligently failed to comply with strict privacy laws in states like Illinois, New York, and California by claiming it can't reliably determine users' geolocation.
...
"Contrary to their plain language, the emails were not intended to allow users to 'reactivate,' 'unlock,' or even 'delete' their accounts," the lawsuit said. "Instead, no matter which link the user clicked on, they were taken to a page where the user was forced to accept Photobucket’s updated Terms of Use to proceed" and "agree to Photobucket’s brand-new Biometric Information Privacy Policy," even if they wanted to delete their account. Photobucket also apparently misled users to think they had to agree to the Biometric Policy if they wanted to download their data, when they could have retrieved images without doing so.

 

https://arstechnica.com/tech-policy...-biometric-data-without-consent-lawsuit-says/

I just don't get the mentality of these folks. They know that the overwhelming majority of their users simply don't care how much their information is abused in exchanged for whatever perceived benefit they get from using their service. So make it simple for the relatively small number of people that do care to be able to opt out by closing their accounts and downloading all of their data and parting company. Surely the marginal revenue associated with the marginal number of accounts that they hoped to trick into accepting such absurd rules that would prefer to part ways can't offset the legal bills that are going to pile up now.

 

https://www.wired.com/story/how-public-key-cryptography-really-works-using-only-simple-math/
The Simple Math Behind Public Key Cryptography

To understand how this works, it’s easier to think of the “keys” not as objects that fit into a lock, but as two complementary ingredients in an invisible ink. The first ingredient makes messages disappear, and the second makes them reappear. If a spy named Boris wants to send his counterpart Natasha a secret message, he writes a message and then uses the first ingredient to render it invisible on the page. (This is easy for him to do: Natasha has published an easy and well-known formula for disappearing ink.) When Natasha receives the paper in the mail, she applies the second ingredient that makes Boris’ message reappear.
...
The foundations for public key cryptography were first discovered between 1970 and 1974 by British mathematicians working for the U.K. Government Communications Headquarters, the same government agency that cracked the Nazi Enigma code during World War II. Their work (which remained classified until 1997) was shared with the US National Security Agency, but due to limited and expensive computing capacity, neither government implemented the system. In 1976, the American researchers Whitfield Diffie and Martin Hellman discovered the first publicly known public key cryptography scheme, influenced by the cryptographer Ralph Merkle. Just a year later, the RSA algorithm, named after its inventors Ron Rivest, Adi Shamir and Leonard Adleman, established a practical way to use public key cryptography. It’s still in wide use today, a fundamental building block of the modern internet, enabling everything from shopping to web-based email.

But while computers helped make public key cryptography possible, they’ve also created cracks in its armor. In 1994, the mathematician Peter Shor discovered a way for quantum computers to efficiently reverse the trapdoor functions that underlie most current public key cryptography systems, including prime factorization. This algorithm, if implemented, would act like an all-purpose “reappearing ink,” capable of making any invisible message reappear. Goodbye, internet security.

Luckily, quantum computers themselves are “still in the ENIAC phase,” Impagliazzo said, referring to the room-size machine built for the US Army in 1945. By the time quantum computers become sophisticated enough to pose a real threat to public key cryptography, its original trapdoor functions could be replaced by “quantum-safe” versions called lattice problems.

 

Though some of today's cryptographic algorithms would be rendered obsolete with the advent of adequate quantum computing capability, many of them are already quantum safe or would be made so by simply doubling the key length. Almost all symmetric-key systems are quantum safe. The big challenge is replacing public-key systems, but we do already have several alternatives available there. Unfortunately, as with today's public-key systems, they tend to have large key sizes. This is somewhat the nature of the beast. Public-key systems, by their nature, require much large keys because the attacker has access to more information than in a symmetric-key system. Throw quantum computing at it, and the key sizes not-surprisingly go up even more.

 

Though some of today's cryptographic algorithms would be rendered obsolete with the advent of adequate quantum computing capability, many of them are already quantum safe or would be made so by simply doubling the key length. Almost all symmetric-key systems are quantum safe. The big challenge is replacing public-key systems, but we do already have several alternatives available there. Unfortunately, as with today's public-key systems, they tend to have large key sizes. This is somewhat the nature of the beast. Public-key systems, by their nature, require much large keys because the attacker has access to more information than in a symmetric-key system. Throw quantum computing at it, and the key sizes not-surprisingly go up even more.

Our old symmetric-key systems (that used tubes, are still classified and likely still secure) used keys that could fit on a hollerith card for a 24 hour (cryptographically secure for longer than that for emergencies) crypto day.

Each crypto transmitter had three identical encoders that were compared for errors. Any deviations would cause an alarm and possibly halt the stream.



Key sizes into the thousands should not be a problem with today's technology.

The problem, as you say is key distribution. One that was solved before by big men with guns.

 

That system (JASON, I think) was removed from service in the 90's. It was a shining example of the Key Distribution Problem in that the Walker Spy Ring was selling the keys to the Soviets for decades before it was discovered. So much for secure communications!

I've never been able to track down information on its effective key length, but one source says that the Remington punch cards that held the keys could be used for fourteen years before a repeat would occur. That's just just under 42,000 keys, which is not a very big search space at all. I don't know how the keys were encoded onto the cards, which were 45 column cards with 9 positions each. If each position were an independent bit, that would have been 405 bits. But I'm pretty sure that wasn't the case. If each column could have one position punched (and, potentially, no punches for zero?), that would still be 10^45, which is huge, but even that would only be about 150 bits. But what little I've been able to glean, the actual effective key space was much smaller than that.

You might be able to shed some light on how the keys were encoded so that we might be able to back out an estimate.

 

That system (JASON, I think) was removed from service in the 90's. It was a shining example of the Key Distribution Problem in that the Walker Spy Ring was selling the keys to the Soviets for decades before it was discovered. So much for secure communications!

I've never been able to track down information on its effective key length, but one source says that the Remington punch cards that held the keys could be used for fourteen years before a repeat would occur. That's just just under 42,000 keys, which is not a very big search space at all. I don't know how the keys were encoded onto the cards, which were 45 column cards with 9 positions each. If each position were an independent bit, that would have been 405 bits. But I'm pretty sure that wasn't the case. If each column could have one position punched (and, potentially, no punches for zero?), that would still be 10^45, which is huge, but even that would only be about 150 bits. But what little I've been able to glean, the actual effective key space was much smaller than that.

You might be able to shed some light on how the keys were encoded so that we might be able to back out an estimate.

Exactly, it was suspected they were reading (and countermeasure were used on our side), some things were super-encoded with off-line systems before the online systems but the real problem was lack of two man control (TPI) of some TS keying material back then, after Walker, they revamped all crypto (with new devices like the KG-84A/C) to two man control like was done with special codes.
https://irp.fas.org/doddir/navy/cms1.pdf

(1) TPI handling requires that at least two persons, authorized access to COMSEC keying material, be in constant view of each other and the COMSEC material requiring TPI whenever that material is accessed and handled. Each individual must be capable of detecting incorrect or unauthorized security procedures with respect to the task being performed. (2) TPI storage requires the use of two approved combination locks (each with a different combination) with no one person authorized access to both combinations.

https://www.cryptomuseum.com/crypto/usa/kg84/
https://www.cryptomuseum.com/crypto/algo/saville/index.htm

The Walker Spy Ring got GENSER keys, not SAP/SCI/SI (Special Intelligence) or EAM/SIOP decoding cards and keys. What they did was horrible but much remained secure.

https://en.wikipedia.org/wiki/Classified_information_in_the_United_States

To be clear, "collateral" (formerly referred to as General Service or GENSER) simply means one lacks special access (e.g. SCI, SAP, COMSEC, NATO, etc.). Confidential, Secret, and Top Secret are all, by themselves, collateral clearance levels.[65][63]

"You might be able to shed some light on how the keys were encoded so that we might be able to back out an estimate"

The technical school, manuals and even the test cards for JASON were SECRET. The fact there is little information of the internals even this long after Walker is intentional because the JASON hardware was never cracked.

From a similar system.
KOKEN shift register stages

Tetrahedral key combining logic

 

Wait. Didn't the FBI just tell us all to use encrypted messaging apps?

I guess they changed their minds.

https://dailygalaxy.com/2024/12/fbi...acebook-messenger-signal-before-its-too-late/

I've got whiplash.

https://www.npr.org/2024/12/17/nx-s...urity-fbi-chinese-hackers-security-encryption

 

Wait. Didn't the FBI just tell us all to use encrypted messaging apps?

I guess they changed their minds.

https://dailygalaxy.com/2024/12/fbi...acebook-messenger-signal-before-its-too-late/

It's interesting that they are basically saying, "If we can't spy on you then the application is no good to use." ha ha
Of course they don't say it that way, but that's definitely a by-product. What ever happened to the right to privacy.
They also say in another place that the keys are "impossible or very hard" to decipher. "Very hard" is not "very good" either.

I guess we have to accept that some forms of technology have very bad consequences even though it may be very, very useful.
I am surprised that they have not yet figured out a way around all this. Is it really going to take quantum communications before all this is resolved. What kind of dummies are making up these schemes anyway.

I am lucky that it would not be too bad if they figured out that I said, "Hey what are you making for dinner tonight" to someone via text message.

 

I've got whiplash.

https://www.npr.org/2024/12/17/nx-s...urity-fbi-chinese-hackers-security-encryption

 

https://www.wired.com/story/digital-license-plate-jailbreak-hack/
Hackers Can Jailbreak Digital License Plates to Make Others Pay Their Tolls and Tickets

Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By removing a sticker on the back of the plate and attaching a cable to its internal connectors, he's able to rewrite a Reviver plate's firmware in a matter of minutes. Then, with that custom firmware installed, the jailbroken license plate can receive commands via Bluetooth from a smartphone app to instantly change its display to show any characters or image.

Reviver says it's also redesigning its license plates to avoid using chips vulnerable to Rodriguez's hacking technique in the future.

While Rodriguez agrees that jailbreaking a Reviver plate would require removing it from a vehicle, he disputes Reviver's claim that it would require “specialized tools” or “expertise.” To develop his jailbreaking method, he did use a fault-injection technique that required attaching wires to the plates’ internal chip, monitoring its voltage, and “glitching” that voltage at a specific moment to switch off its security features and gain the ability to analyze and rewrite its firmware. But once that reverse engineering process was complete, he used its results to develop a jailbreak tool that requires none of that technical complexity.

These guys at Reviver never heard of OTP for controller chips and EROM?
https://microchip.my.site.com/s/article/OTP--One-Time-Programming--memory-area
https://ww1.microchip.com/downloads.../MCU08/ProductDocuments/DataSheets/40182D.pdf

 

Electronic Measures vs Electronic Counter Measures. It's a game.

Ron