Security

Bruce Schneier linked to an interesting essay about mass screening of people with infrared thermometry guns. With this devices you can measure the temperature of a person from a certain disctance. But the essay questions the sense of such a method as they compared the results of this IR guns with :

We assessed the accuracy of cutaneous infrared thermometry, which measures temperature on the forehead, for detecting patients with fever in patients admitted to an emergency department. Although negative predictive value was excellent (0.99), positive predictive value was low (0.10). Therefore, we question mass detection of febrile patients by using this method.

Negative predictive value means "The device says you have no fever and you have really no fever". Negative predictive value stands for "The device says you have fever, and you have really fever." So the system is good at detecting a person without fever, but not at dividing people with a higher (but normal for them) skin temperature and people with fever.

Craig Wright was able to hack into a leading brand of a really critical part of the internet: A Jura F90 with the Jura Internet Connection Kit. And the effects are really devastating. It can force the the admins into a denial-of-service mode:

1. Change the preset coffee settings (make weak or strong coffee)
2. Change the amount of water per cup (say 300ml for a short black) and make a puddle

In case you didn´t got it already: The F90 a coffee machine ....

I´ve suspected in a coffee kitchen discussion with a customer after a presentation a few days ago, that the Debian openssl vulnerability will haunt us for a while and hit us from behind while showing us many problemswith our existing internet security infrastructure. I assume i was correct. Fefe explains some of the uprising problems in his blog.

A hard disk goes down in flames through the atmosphere and specialists were still able to recover 90 percent of the data: Data recovered from Seagate drive in Columbia shuttle disaster. At the end, data seems to be more resistant then most of us believe, when you put a vast amount of effort behind the recovery.

This leads me to annother thoughtgame: Let´s assume, you shredder a disk to pieces as tiny as 1 square millimeter. This would just look like dust to you. A modern harddisk stores 200 gigabit per square inch. One square inch are 645.16 square milimeters. Thus a harddisk would store 310 megabits on a square milimeter. Let´s assume 10 bits per byte (for error correction and similar things) and you have 31 megabytes worth of data on one of these pieces of dust.

It´s just a question of effort to recover the data, when you can yield 10 million euros out of the data (trade secrets, credit card data) it would give you a nice profit when you spend for example 9 million to recover the data. Yet another reason for cryptography everywhere or you may end up with degaussing, shreddering and remelt your old harddisks just to be safe.

No software is without errors. This is a basic law of computer science. And when there is no bug in the software (by a strange kind of luck) your hardware has bugs. And when there are no bugs in the hardware, cosmic rays are flipping bits. Thus an operating system needs some mechanisms to stop a process or the complete kernel at once without allowing the system to write anything back to disk and thus manifesting the corrupted state. This tutorial will cover the most important concepts surrounding the last life signs of a system or an application.

Your colleague is at lunch, he or she didn´t loged out, and the screen is locked? And you need the workstation right now? No problem! Adam Boileau has a neat solution or this problem. Simply use winlockpwn to unlock the system. You colleagues notebook has no Firewire port? No problem, you only have to put a Cardbus Firewire card into the system. Wait for auto installation (Windows autoinstall drivers while screenlocked) and use winlockpwn to get access to the system.

Don´t hassle around with this strategy to cool down chips and put them in a different system for the cold boot attack, you can read the memory of the live system.

How does this hack work? Well, just read this presentation:Hit by a Bus: Physical Access Attacks with Firewire . This trick was presented 2 years ago, but you can still use it. This hack uses a feature of Firewire: It uses DMA for the fast transfer of data. With this capability you can read and write the memory of the system ... and that´s the master key to the kingdom. And to add insult to injury: You can´t really change it, as the DMA is the "Fire in Firewire" as Adam coined it ..

PS: Where is my credit card ... i need a firewire card for my old notebook

Excellent article about the post 9/11 security society - What Our Top Spy Doesn't Get: Security and Privacy Aren't Opposites:

But it's still a false dichotomy. There is no security without privacy. And liberty requires both security and privacy.

Vor etwa einem Monat habe ich ja schon über die Aktion "Himmel" berichtet. Damaligerzeit wurden 12.000 Personen verdächtigt, sich Kinderpornographie verschafft zu haben. Die Presse feierte damals die Aktion.

Worüber man allerdings sehr wenig hoert ist der weitere Verlauf. Ich spekulierte ja seinerzeit, das von dieser Zahl 12000 sehr viel weniger uebrig bleiben wurde. Wie wenig das werden würde, habe ich allerdings auch nicht geahnt ... . In Köln wurden beispielsweise sämtliche Ermittlungverfahren (500 an der Zahl) eingestellt, da den Nutzern nichts nachgewiesen werden konnte, was strafrechtlich relevant gewesen wäre. Ich moechte nicht wissen, wieviele Existenzen ähnlich wie in diesem Fall kaputt gemacht worden sind.

The paper "WiFi Epidemiology: Can Your Neighbors’ Router Make Yours Sick?" evaluates an interesting thought game: How would a worm that infects WLAN routers spread in a large population of this devices. As a large amount of router devices inherit their architecture from only a few reference design, such an attack may not as remote as you think at the first time.

One of the nice thing of modern on-board navigation is the availability of traffic information via FM radio (it´s encoded in the RDS). Joern of Ende-der-Vernunft linked to a interesting presentation held on a security conference: Unusual Car Navigation Tricks: Injecting RDS-TMC Traffic Information Signals.

It would be interesting to know, if TMCpro is vulnerable as well. TMCpro is a paying-subscriber service (you pay the subscription with you TMCpro enabled receiver). To close the user group it´s nescessary to encrypt the TMC. This may close the vulnerability of the public TMC, as long the the receiver don´t switch to the public service in case the pro signal isn´t available.

In den deutschen Postillen wird ja momentan die Polizei für die Aktion "Himmel" gelobt. Beispielsweise in diesem Artikel im Spiegel. Man denkt nun als erstes: Geschieht diesen Idioten recht.

Nur wie üblich, hat die Realität ein paar Facetten mehr und wahrscheinlich wird am Ende von der genannten Zahl 12.000 wesentlich weniger uebrig bleiben. Einen interessanten Einblick in die Aktion bietet der Artikel von Udo Vetter, seines Zeichens bloggender Rechtsanwalt im Artikel "Vom “Himmel” in die Hölle". Sein Bericht über einen Mandaten zeichnet ein etwas anderes Bild: So wie es aussieht, war auf dem gleichen Server ein Portal für sogenannte Teen-Photos. Teen bedeutet im Sprachgebrauch dieser Branche die Zeitspanne von 18-19. Man mag jetzt davon halten, was man will, aber diese Photos sind legal. Man hat sich jetzt anscheinend nicht allenortens die Mühe gemacht, zu unterscheiden, ob auf das legale oder illegale Portal zugegriffen worden ist. Mancherorts scheint das blosse Vorhandensein der IP-Addresse in den Logfiles einen hinreichenden Anfangsverdacht ergeben zu haben, ohne das geprüft worden ist, was dieser User wirklich auf dem System gemacht hat.

Am Ende kam es, dann wie es kommen muss:

Mein Mandant, stellte der Staatsanwalt im Abschlussvermerk fest, habe “offenbar eine Vorliebe für junge Frauen und lade gezielt solche Bilder aus dem Internet”. Einige zehntausend solcher Fotos fand die Polizei auf der Festplatte meines Auftraggebers. Das reichlich bemühte Fazit der Auswerter, wenigstens ein halbes Dutzend der knapp 50.000 Bilder könnte vor Gericht als kinderpornografisch durchgehen, teilte der Staatsanwalt nicht. Es handele sich um legale Inhalte. Für Moral seien die Ermittlungsbehörden nicht zuständig. Der Staatsanwalt stellte das Verfahren ein.

Für den Mandanten von Herrn Vetter hatte diese Aktion übrigens doch erhebliche Folgen:

Bei meinem Mandanten wurden Büro und Wohnung durchsucht. Seine Frau und sein Chef zogen schon zu Beginn der Aktion die naheliegenden Konsequenzen. Dass mein Mandant nach Monaten einen schmucklosen Einstellungsbescheid ohne ein Wort des Bedauerns erhielt, interessierte sie nicht sonderlich. Über das Umgangsrecht mit den Kindern wird demnächst entschieden.

Ich glaube die Tateinheit von Vorratsdatenspeicherung und Suchmaschinen werden uns noch sehr interessante Zeiten bescheren. Insbesondere, wenn die Ermittlungsbehoerden auf die geschilderte Art und Weise arbeiten.

Do you remember the article linking to Bruce Schneiers article about the possible backdoor in the NIST-endorsed Dual_EC_DRBG random number generator. Well exactly this algorithm was added to Microsoft Vista SP1.. As Bruce writes it in his blog:

t's not enabled by default, and my advice is to never enable it. Ever.

Interesting article about CAPTCHAs. The author has an interesting metric for the quality of a CAPTCHA ... the price for the software to break it.

This presentation explains, why scissors would be illegal, when the DMCA would apply to the the physical world : The Digital Millenium copyright act - An Example of Analougue Circumvention and Idiocy

Wenn Karlsruhe den Politikern irgendwann hoffentlich mal die Sammelwut austreibt, muss die Aufmerksamkeit mal auf die Firmen gelenkt werden, die allzu freizuegig mit Kundeninformation umgehen. Jens von Pixelfeuer (und Sun) schreibt in seinem Blog ueber eine sehr merkwürdige Pressemitteilung von ebay:Mein Kiel lob ich mir - Ebay wertet aus