Flock Cameras Map

Flock Cameras

Via Detroit Steve

Downtown

Matador Bar

Went downtown yesterday for a meeting. Meeting was on the umpteenth floor of a high rise. Walk in the front door, tell the man at the desk our names and he gets up and walks over to the elevators, unlocks the console and programs it for our floor. I've never run into this kind of security before. On the upside I successfully navigated our way back to our car that we had parked in the Fox Tower parking garage.
Go in the wrong door of the building and take the wrong elevator and you can end up hiking for hours trying to find your car.

Matador Wallpaper

After the meeting we went to the Matador restaurant for lunch where I saw the most impressive bar (top) and the scary wallpaper in the bathroom (bottom).

Surveillance Tech

alpr.watch

I'm thinking that somebody doesn't trust big brother.

alpr.watch

Your local government might be discussing surveillance tech like Flock cameras, facial recognition, or automated license plate readers right now. This map helps you find those meetings and take action.

It's funny how much police dramas on TV rely on surveillance cameras to catch the bad guys. You watch enough of these shows and you might start to think that having all these cameras watching everyone is a good thing. If you could trust everyone, it would be, but if you could trust everyone, you wouldn't need all these cameras, would you? It's also funny how often the coppers find that the security cameras are broken and so there is no useful video.

Via Detroit Steve

 

The Original Sin of Computing...that no one can fix

The Original Sin of Computing...that no one can fix
LaurieWired

Boy she talks fast, and long, but pretty clear. I suspect the basic idea for writing a Quin is to have a block of text that contains all the code in the program. The program writes this block out twice, once as code, and once as a block of text in the middle of the code, so the program actually contains two copies of this block of text.

ZERO DAY - Netflix Series

ZERO DAY | Official Trailer | Netflix
Netflix

This show is great, for what it is. Basically they took all the politics that we have seen over the last couple of years and stuffed it into these 6 episodes. I mean they've got everything. Both sides of the political spectrum are well represented here, the more extreme the viewpoint the better. We also have vicious political infighting and all the conspiracy theories you could wish for. Good visiuals on how they track networks of people by the cell phone calls they make, but you know Hollywood, they're big on visuals. Linux terminals displaying lines of neon green text on a black screen is only interesting to those who are well versed in the intricacies of whatever program they are running. The show exaggerates the risk to our computerized environment, but not by much. The danger, as always, is adding remote control / monitoring capability to existing systems (because it saves having to pay someone to actually go there and check on it), but not establishing any security around your communications line because that would just be a needless expense.

Anyway. we've got Robert DeNiro playing the head of a new agency charged with investigating a huge cyber crime, and he's literally losing his mind. Cognitive decline is a real thing and they do a good job of illustrating it here.

6 episodes 50 minutes each

Coincidentally, the FBI busted a server farm somewhere in New York this week.

This photo provided by the U.S. Secret Service, in New York, Monday, Sept. 22,2025, shows signal euqipment at the location where they were seized by the agency. (U.S. Secret Service via AP) AP

I don't know exactly what these boxes are, but they look like each box holds 30 odd cell phones. Multiple that by ten boxes and you have 300 cell phones. I do wonder what they were doing with them.

I tried watching a news report about this incident, but it was full of TV blather, so I thought I'd read the transcript, but the format is a little rough. So I copied it to a spreadsheet and used the sort function to get rid of the time stamps. What we're left with is in all capitals and sans punctuation. It's still a little rough, but you can read it here if you want.

Iranian Blackout Affected Misinformation Campaigns

Stolen entire from Schneier on Security: 

Dozens of accounts on X that promoted Scottish independence went dark during an internet blackout in Iran.

Well, that’s one way to identify fake accounts and misinformation campaigns.

 

Smoke Compartment

Smoke Compartment

Came across this sign while I was idling in hall of the Providence Medical Center this morning. For the life of me, I cannot fathom why this sign is there.

Update 3 days later. Dennis found a page that explains this. Excerpts follow.

What Is a Smoke Compartment? By Valerie Ziavras 18-Jul-2024

Compartmentation is a passive fire protection feature intended to minimize the area impacted by an incident. There are two different types of compartments: smoke compartments and fire compartments.

Smoke compartmentation may be required by a building code, fire code, life safety code, or some other code.

A smoke compartment is defined in NFPA 101 as “a space within a building enclosed by smoke barriers on all sides, including top and bottom.” Smoke compartments are intended to restrict the spread of smoke from one area of a building to another. Fire compartments, on the other hand, are formed by fire barriers on all sides and are intended to restrict the spread of fire from one area of a building to another. 

Certain occupancies require buildings to be subdivided into separate smoke compartments.

Examples of occupancies that require buildings to be subdivided using smoke barriers include new and existing health care occupancies (like hospitals), new and existing ambulatory health care occupancies (like day surgery centers), and new and existing detention and correctional occupancies. One factor these occupancies have in common is that a defend-in place strategy is typically used. This makes compartmentation even more important than in other occupancies that use a total evacuation strategy, since the first step during an emergency is to relocate building occupants.

Passwords

Baby Blues - Passwords

This sounds like our house when my wife and I are trying to navigate medical / insurance websites. The problem with using phrases is remembering the phrase exactly. Was it 'for the rest of your lives' or 'forever'? And then there are the password managers offering to save your password for you. Are they any more reliable than websites that offer to 'Remember me'? Shit, any seriously motivated hacker can steal everything on your computer including your passwords. And why do we have passwords on medical websites anyway? Why? Because of HIPAA, that's why:

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 establishes federal standards protecting sensitive health information from disclosure without patient's consent. - CDC

There must be some people out there who want to keep their medical records confidential, but I ain't one of them, and I don't understand this overarching desire for privacy. I suppose if you are operating in a contentious environment with people who will use any means, fair or foul, to trip you up or bring you down, you could want your medical records secure. Or you might just be paranoid. In the past I have just removed myself from those situations, but that may not always be feasible.

Be The Whole Problem

Bash Bunny
Chris Boden

I like this comment from @seonruiz4835:

Chris is speed running getting another visit from authorities.

 

Bravo Zulu

Stolen entire from Borepatch:

The Bad Guys are on a losing streak

Earlier this week we saw a bunch of Russian hackers sentenced to prison, now we see Interpol execute a massive take down of multiple groups of Bad Guys:

Interpol is reporting a big win after a massive combined operation against online criminals made 41 arrests and seized hardware thought to be used for nefarious purposes.

Operation Synergia II – the follow up to the first Synergia raids that were announced in February – saw cops in 95 countries crack down on phishers, ransomware extortionists, and information thieves around the world. The operation was carried out in conjunction with the corporate world, specifically Group-IB, Trend Micro, Kaspersky and Team Cymru.

In addition to the arrests, Interpol revealed 65 people are still under investigation and claimed to have shuttered 22,000 IP addresses, taken control of 59 servers and 43 other computing devices.

Bravo Zulu, y'all.

Bravo Zulu? Navy term for 'well done'. 

Cyber criminals are the worst. The Beekeeper springs to mind, as does the ransomware attack on an engineering firm I hired a couple of years ago. On one hand you could blame the victims for not ensuring their computer systems were secure, but on the other hand with exponential growth of the computing industry, is it even possible to make your system absolutely secure? Well yes, if you cut all the wires and lock it in a Faraday cage. Okay, it needs to be secure, but it also needs to be usable, so we have to balance these two requirements and when we do, sometimes security gets short-changed. That's why we've got to wade through these annoying identification protocols when you call most any business about most anything at all.

Kaspersky

Seven years ago the Federal government banned the use Kaspersky anti-virus software in government computers.

Last month the government banned the sale of Kaspersky anti-virus software in the USA starting July 20.

This morning (July 19), CrowdStrike anti-virus software caused Windows computer systems world-wide to crash. ZeroHedge has the same story.

Color me very amused. I quit using Windows years ago.

P. S. RT has a story about CrowdStrike, former FBI Executive Assistant Director Shawn Henry and Russiagate. Huh, imagine that, you put corrupt slimeballs in charge and you get screwups like this.

Assange

Stolen entire from Aljazeera, mouthpiece of Qatar Islamists.

Julian Assange enroute from London to Australia

Iraq to NSA spying: The biggest revelations by Julian Assange’s WikiLeaks

WikiLeaks unearthed documents ranging from conflicts within the US Democrats to toxic waste dumping in West Africa. 

By Al Jazeera Staff 25 June 2024

On Monday, Julian Assange, founder of WikiLeaks, was released from prison after fighting a legal battle spanning more than 14 years.

In 2006, Assange launched the whistleblower website WikiLeaks, a platform that allows users to anonymously submit secret, classified documents and videos. The most recent publication by the platform was in 2021.

The New York-based Nation magazine reported in January 2024 that Assange said WikiLeaks was no longer able to publish documents since potential whistleblowers were thwarted following his imprisonment, United States government surveillance and funding cuts.

During the years it functioned, the whistleblower platform published classified documents that had been never seen before – embarrassing governments, causing diplomatic standoffs and forcing policy changes.

Here is a look at 10 such leaks by the platform:

Report about toxic waste in the Ivory Coast

In 2009, WikiLeaks released the Minton Report that exposed how an internal report commissioned by Singapore-headquartered multinational company Trafigura concluded that its dumping of 540,000 litres of toxic waste, including harmful chemicals, in the Ivory Coast potentially led to “burns to the skin, eyes and lungs, vomiting, diarrhoea, loss of consciousness and death”.

The United Nations reported that 108,000 people were affected by this dumping of waste.

Cablegate

In 2010, WikiLeaks started building out its Public Library of US Diplomacy (PLUSD), which is a growing collection of 3,326,538 US diplomatic cables between American diplomats posted to 274 consulates and embassies from 1966 to 2010, and their colleagues and bosses, including back home at the State Department.

In the first round of these leaks, 250,000 cables were released to the public – arguably the single largest such dump of confidential documents ever released.

The leaks included embarrassing details of how US diplomats perceived some of their foreign counterparts and nuggets of conversations where foreign officials, including many in high positions today, expressed frustrations with their own governments.

Afghanistan war files

In October 2010, the whistleblower site released 90,000 classified documents on the US war in Afghanistan.

The United States launched the Afghanistan war in 2001, following the September 11 attacks that year, finally withdrawing its forces from the country in 2021.

The documents painted a picture of the war – and the US struggle against the Taliban – that was very different from the public posture of confidence adopted by Washington.

Iraq war files

Also in October 2010, WikiLeaks made public almost 400,000 secret US files on the Iraq war.

In 2003, the US government under President George W Bush invaded Iraq.

The documents, from 2004 to 2009, showed that the civilian deaths in the Afghanistan and Iraq wars were much higher than the numbers being reported. The leaks represented the largest security breaches of their kind in US military history.

Collateral murder – Iraq helicopter video

Among the most prominent of WikiLeaks revelations, in April 2010, was the release of video footage showing a US Apache helicopter attack which killed a dozen unarmed people, including two Reuters journalists, Namir Noor Eldeen and Saeed Chmagh, in the Iraqi capital, Baghdad.

The video, filmed from the chopper’s cockpit shows a US missile strike and shooting on a square in a Baghdad neighbourhood in July 2007, according to WikiLeaks.

The Guantanamo files

In April 2011, WikiLeaks released secret documents spanning thousands of pages to select US and European media outlets.

These documents unearthed how the Geneva Conventions were being violated routinely in the Guantanamo Bay prison in Cuba. The documents, dating from 2002 to 2008 showed the abuse of 800 prisoners, some of them as young as 14.

At least 150 of these prisoners were found to be innocent Afghans or Pakistanis who were rounded up as part of frantic intelligence gathering and then imprisoned for years, in the aftermath of the September 11 attacks and the so-called “war on terror”.

The Syria files

In July 2012, WikiLeaks began making public two million emails from 680 Syrian political figures and ministries working with the Bashar al-Assad regime between August 2006 to March 2012.

The emails unearthed the involvement of European companies in the surveillance and crackdown on Syrian civilians. One such company was Italian-government-owned Selex, which continued to expand its contract with the Syrian police, despite sanctions.

The emails also exposed how PR company Brown Lloyd James (BLJ) was paid to engineer a now-deleted Vogue article about al-Assad’s wife Asma, according to WikiLeaks.

NSA spying

In 2015, the whistleblower website released details of illegal intercepts from the US electronic spy organisation, National Security Agency (NSA).

In a series of publications released from 2015 to 2017, WikiLeaks said the US, using the NSA, was also routinely spying on foreign officials from Japan, the European Union, Israel, Germany and Brazil.

Additionally, the whistleblower said the NSA intercepted communications between former United Nations Secretary-General Ban Ki-moon and German Chancellor Angela Merkel.

WikiLeaks said that the NSA was not only spying on international politicians but also civilians. In 2017, it tweeted that the NSA could hack Pakistan’s mobile networks.

Sony Pictures hack

In 2015, WikiLeaks released at least 170,000 emails and more than 20,000 documents from a 2014 cyberattack on Sony Pictures Entertainment.

The leak was around the same time Sony was set to release the film about a fictional American plot to kill North Korean leader Kim Jong Un.

The emails also revealed that female celebrities such as Amy Adams and Jennifer Lawrence were paid less than their male counterparts in the 2013 crime comedy film American Hustle.

US Democratic Party emails leaked

In 2016, WikiLeaks exposed 19,252 emails and 8,034 attachments from the US Democratic Party national leadership.

The emails exposed that even though the Democratic National Committee (DNC), the party’s principal committee, pledged impartiality in the 2016 presidential race, it appeared to act against Bernie Sanders in favour of Hillary Clinton.

The leaks resulted in the resignations of five top DNC officials including the chair, CFO, CEO, communications director and finance director. Clinton accused WikiLeaks and Assange of colluding with Russia to raise questions about the credibility of the US election process. She lost the 2016 presidential race to Donald Trump.

I am glad Julian was released. I always thought the charges were bullshit and I still think so. The US Federal Government seems to be in the hands of idiotic maniacs, or maybe it's maniacal idiots. Somebody needs to bring the smack down on those useless fools.

Fishing for Privacy

Stolen entire from Schneier on Security

 

Online Privacy and Overfishing

Microsoft recently caught state-backed hackers using its generative AI tools to help with their attacks. In the security community, the immediate questions weren’t about how hackers were using the tools (that was utterly predictable), but about how Microsoft figured it out. The natural conclusion was that Microsoft was spying on its AI users, looking for harmful hackers at work.

Some pushed back at characterizing Microsoft’s actions as “spying.” Of course cloud service providers monitor what users are doing. And because we expect Microsoft to be doing something like this, it’s not fair to call it spying.

We see this argument as an example of our shifting collective expectations of privacy. To understand what’s happening, we can learn from an unlikely source: fish.

In the mid-20th century, scientists began noticing that the number of fish in the ocean—so vast as to underlie the phrase “There are plenty of fish in the sea”—had started declining rapidly due to overfishing. They had already seen a similar decline in whale populations, when the post-WWII whaling industry nearly drove many species extinct. In whaling and later in commercial fishing, new technology made it easier to find and catch marine creatures in ever greater numbers. Ecologists, specifically those working in fisheries management, began studying how and when certain fish populations had gone into serious decline.

One scientist, Daniel Pauly, realized that researchers studying fish populations were making a major error when trying to determine acceptable catch size. It wasn’t that scientists didn’t recognize the declining fish populations. It was just that they didn’t realize how significant the decline was. Pauly noted that each generation of scientists had a different baseline to which they compared the current statistics, and that each generation’s baseline was lower than that of the previous one.

What seems normal to us in the security community is whatever was commonplace at the beginning of our careers.

Pauly called this “shifting baseline syndrome” in a 1995 paper. The baseline most scientists used was the one that was normal when they began their research careers. By that measure, each subsequent decline wasn’t significant, but the cumulative decline was devastating. Each generation of researchers came of age in a new ecological and technological environment, inadvertently masking an exponential decline.

Pauly’s insights came too late to help those managing some fisheries. The ocean suffered catastrophes such as the complete collapse of the Northwest Atlantic cod population in the 1990s.

Internet surveillance, and the resultant loss of privacy, is following the same trajectory. Just as certain fish populations in the world’s oceans have fallen 80 percent, from previously having fallen 80 percent, from previously having fallen 80 percent (ad infinitum), our expectations of privacy have similarly fallen precipitously. The pervasive nature of modern technology makes surveillance easier than ever before, while each successive generation of the public is accustomed to the privacy status quo of their youth. What seems normal to us in the security community is whatever was commonplace at the beginning of our careers.

Historically, people controlled their computers, and software was standalone. The always-connected cloud-deployment model of software and services flipped the script. Most apps and services are designed to be always-online, feeding usage information back to the company. A consequence of this modern deployment model is that everyone—cynical tech folks and even ordinary users—expects that what you do with modern tech isn’t private. But that’s because the baseline has shifted.

AI chatbots are the latest incarnation of this phenomenon: They produce output in response to your input, but behind the scenes there’s a complex cloud-based system keeping track of that input—both to improve the service and to sell you ads.

Shifting baselines are at the heart of our collective loss of privacy. The U.S. Supreme Court has long held that our right to privacy depends on whether we have a reasonable expectation of privacy. But expectation is a slippery thing: It’s subject to shifting baselines.

The question remains: What now? Fisheries scientists, armed with knowledge of shifting-baseline syndrome, now look at the big picture. They no longer consider relative measures, such as comparing this decade with the last decade. Instead, they take a holistic, ecosystem-wide perspective to see what a healthy marine ecosystem and thus sustainable catch should look like. They then turn these scientifically derived sustainable-catch figures into limits to be codified by regulators.

In privacy and security, we need to do the same. Instead of comparing to a shifting baseline, we need to step back and look at what a healthy technological ecosystem would look like: one that respects people’s privacy rights while also allowing companies to recoup costs for services they provide. Ultimately, as with fisheries, we need to take a big-picture perspective and be aware of shifting baselines. A scientifically informed and democratic regulatory process is required to preserve a heritage—whether it be the ocean or the Internet—for the next generation.

If you are using a computer for anything you want to keep private, you need to realize that any sufficiently motivated individual will be able to discover your secrets. So it is best to consider how likely it is that someone would target you and how much damage they could cause if they got it. Would such a security breach embarrass you, or would it ruin your reputation in your society? Would such a breach empty your checking account, or would they steal the title to your house?

Today's Lesson

Stolen entire from JMSmith.

The Secret Badges that we Wear

“She bound the scarlet line in the window.” Joshua 2:21

A shibboleth is a special kind of password, which is to say a key or badge that opens a social door and grants admission to a social group.  As everyone versed in scripture knowledge knows, shibboleth was at first a word that the lisping Ephramites could not pronounce, and that the Sons of Giliad therefore used to identify the survivors of a shattered Ephramite army.  When a bloodied and bedraggled warrior staggered down to the ford of the Jordan, he was challenged to pronounce the word “shibboleth,” and thereby show his secret badge. Those who pronounced it “sibboleth” were immediately slain.

As I explained some years ago, shibboleths often take the form of sacrilege.  The password that grants admission to one social group is in such cases a violation of the norms of that group’s enemy.  Thus anti-Christian secret societies used to require an aspiring member to trample on a crucifix, spit on a Bible, or otherwise treat the sacred objects and words Christianity as profane.  In on-line culture, such sacrilegious shibboleths are called “shill tests,” and in these tests an aspiring member is required to type words that an undercover agent would find it very hard to type.  As I explained in that long-ago post, to get past the sentries of one group, you must often slay another group’s sacred cow.

A shibboleth is a password that prevents infiltration by spies.  A “scarlet thread” is a secret badge with which a traitor makes himself known to his new compatriots, and is thereby passed over when his new compatriots descend like wolves on the people whose compatriot the traitor only pretends to be.  Like shibboleth, the term “scarlet thread” comes from the Old Testament, and more particularly from the curious tale of a traitor known as Rahab the Harlot.

Rahab the Harlot dwells in the city of Jericho, and when Joshua sends two spies into that city, the two young men somehow fall in with Rahab, who we must never forget is a harlot, and she hides these two handsome young spies in her house.  This house was built on, or rather up against, the city wall; and on its city-wall side had a high window that looked out over the countryside.  It was from this high window that Rahab lowered Joshua’s spies on a “scarlet thread,” after telling them that her people were ripe for conquest because they were rotten with fear.

“Your terror is fallen upon us . . . the inhabitants of the land faint because of you.”

Rahab’s reward for betraying her people is that she and her family will be spared when Jericho is sacked and its citizens are slaughtered.  But to assure their deliverance, Rahab must keep her family in her house (of ill repute), and must display the “scarlet thread” in the front window. of that house.

“Behold, when we come into the land, thou shall bind this thread in the window which thou didst let us down by; and thou shalt bring thy father, and thy mother, and thy brethren, and all thy father’s household, home unto thee” Joshua 2: 18.

Thus a “scarlet thread” is a means whereby a traitor escapes the destruction brought down by his or her treason.  One wonders how many who “miraculously” survive some near-universal destruction owe their deliverance to display of a secret badge or “scarlet thread.”  Rahab was a harlot, so she knew how treachery works.

“She bound the scarlet line in the window.”

Not long after, as every Sunday-school scholar knows, Joshua’s army compasses the city of Jericho and “the walls came a tumbling down.”  Then, as many Sunday-school scholars do not know, before the sack and slaughter begins, a house displaying a “scarlet thread” is sought and a traitorous harlot is saved.   Which was very fortunate for that traitorous harlot and her family, because of Joshua’s army we are told:

“They utterly destroyed all that was in the city, both man and woman, young and old, and ox, and sheep, and ass, with the edge of the sword.”  Joshua 6: 21

Like a shibboleth, a “scarlet thread” is a special kind of password, although it grants its possessor the privilege of escape and not admission.  It is a secret badge with which traitors and spies show their true colors to their true friends, and by which traitors and spies are exempted when their true friends utterly destroy their pretended friends with the edge of the sword.

 

NSO Group

i cant stop thinking about this exploit
Low Level Learning

Ben Hawkes has a webpage about this.

So who is this NSO? They have a website that is completely opaque, it tells you nothing about who they are. Wikipedia is a little more forthcoming. Here is the introduction:

NSO Group Technologies (NSO standing for Niv, Shalev and Omri, the names of the company's founders) is an Israeli cyber-intelligence firm primarily known for its proprietary spyware Pegasus, which is capable of remote zero-click surveillance of smartphones. It employed almost 500 people as of 2017.

NSO claims that it provides authorized governments with technology that helps them combat terror and crime. The company says that it deals with government clients only. Pegasus spyware is classified as a weapon by Israel and any export of the technology must be approved by the government.

According to several reports, NSO Group spyware has been used to target human rights activists and journalists in various countries, was used for state espionage against Pakistan, for warrantless domestic surveillance of Israeli citizens by Israeli police, and played a role in the murder of Saudi dissident Jamal Khashoggi by agents of the Saudi government.

In 2019, instant messaging company WhatsApp and its parent company Meta Platforms (then known as Facebook) sued NSO under the United States Computer Fraud and Abuse Act. In 2021, Apple filed a lawsuit against NSO in the U.S., and the US included NSO Group in its Entity List for acting against U.S. national security and foreign policy interests, effectively banning U.S. companies from supplying NSO.

 

Spectre

When you Accidentally Compromise every CPU on Earth
Daniel Boctor

What he's talking about here is virtual lockpicking. There is something about locks that attracts a certain kind of person, a person who says 'Hah! You think you can keep me out? I will show you. Nothing can keep me out. Your security is worthless!' The Lock Picking Lawyer comes to mind. They are people who like solving puzzles. I like solving puzzles, but I only enjoy working on puzzles that I can solve in short order, like five minutes. Oh, I might spend a couple of hours on a jigsaw puzzle, but that's about my limit.

I sometimes think about wading into computer security, but that is going to take a lot more time, and where's the payoff? Even if you manage to break into a computer system, are you even going to find anything valuable? And valuable to who? And would you trust anyone who sanctions breaking into someone else's computer system? Psychopaths could find ways to entice computer security experts into breaking into other's computers with enticements and challenges, but do you really want to be doing business with psychopaths? Get paid in cash and never tell them where you are. They'll sell you down the river in a heartbeat.

The crux of Spectre is that it can 'trick' the CPU into accessing memory belonging to another process because it is only a 'speculative' access. Another interesting bit is that apparently you can time how long it takes to access a single memory location. A simple way would be by setting a timer before reading memory and reading the timer afterwards, but that would mean locking out interrupts for the duration, and I'm pretty sure nobody but the operating system gets to lockout interrupts. Given that CPUs have gotten a zillion times more complex since I last fiddled with interrupts, there's probably several other ways to do it.

Screw Your Electronic Dodads

Tubes delivered documents from the floor of a typewriter factory in England in 1954.
Walter Nurnberg / Hulton Archive / Getty Images

No, it's not the German Chancellory, but it is the coolest picture I could find of a pneumatic tube system.

From a report on RT: 

Berlin’s concerns over possible espionage have led to distrust in more modern message delivery techniques, a report has claimed

German leader Olaf Scholz has shelved plans to phase out a 19th century-era pneumatic tube system that is being used in Berlin’s chancellery to distribute about 1,000 documents per month amid fears that more modern electronic systems may pose an espionage risk, a report by Der Spiegel has claimed.

For decades, Germany’s government headquarters has relied upon the archaic system, which uses compressed air to send capsules containing documents between 36 stations inside the building. The network costs just $16,000 to operate annually – far less than some other more sophisticated electronic message delivery methods.

The documents are often “generally urgent transactions that cannot be forwarded electronically or via house courier service, for example, because they are subject to secrecy or have to be signed in the original,” a government spokesman said, according to Der Spiegel on Thursday.

The network of tubes was intended to be phased out by 2025. Still, according to a report by the German daily Suddeutsche Zeitung, Scholz has put those plans on hold – with the newspaper citing concerns over an alleged increase in Russian espionage attempts since the onset of the conflict in Ukraine in February 2022 as the primary reason.

Time to trot out the old saw about houses and locks. When people first started using computers nobody was worried about the security of the data because nobody else had a computer that could process it. As more people got computers they discovered that these things could be handy, kind of like when people first started building houses. They weren't worried about someone breaking in because there weren't any locks. But then somebody realized that there weren't any locks and started walking in and stealing stuff. So people started putting locks on their doors and we've been doing it ever since. Computers are still trying to figure out what locks work and what locks don't, The guys who are good at figuring out how to make locks for computers are the same guys who are good at figuring how to break those locks, so it's probably going to be a while before we have a system we can agree on. Given the nature of computers it may not even be possible to build a really secure system. And given the rampant corruption running around loose in the world, even a truley secure system can be compromised.

The Illusion of Privacy

Redpitaya Logic Analyzer

The Feral Irishman posted a video yesterday where Gardiner Bryant that talks about how evil Google is and how they are invading your privacy and stealing all your secrets. The first few minutes where he gives us some basic background are good, but then we get over into the whole privacy argument. My view is that I don't care. 

If you have some kind of information that you want to keep secret, like where your stash of anti-tank land mines or where your chest full of gold doubloons are hidden, don't put it on the net. Period. There was that capo in some gangster movie whose important conversations were all carried out by whispering into people's ears. That's how you keep a secret, not by using a different browser.

Gardiner's argument about Google reminds me of a scene from The Merchant's War by Fredrik Pohl. Our hero, one Tennison Tarb, returns to Earth and walks out onto the street, but the street is packed with people, shoulder to shoulder all jostling each other as they try to go about their business. He happens across on an open piece of sidewalk about ten feet by twenty feet. It's wide open, there is no one there. There are no barriers keeping anyone from entering that area, but still there is no one there. Our dude sees this as an oasis and walks into it where he is immediately assaulted by a loud, specially formulated ad that is designed to make him addicted to some kind of cola. Later on we find these 'oases' are marked with 'prominently displayed' signage due to a court ruling. When these first appeared, it didn't take long for people to figure out there were a hazard to your health and peace of mind and now everyone knows. Everyone except people like our hapless hero.

I see the ads go by when I am surfing the web, but I grew up watching television - I long ago learned to ignore the ads. Perhaps some people are unable to ignore the ads. Those people might be well advised to switch to Firefox. 

Anyway, onto more insidious stuff. Something in the video prompted me to look up the Intel Management Engine and what I found is some really low level creepy. From Wikipedia (edited):

The Intel Management Engine (ME) is an autonomous subsystem that has been incorporated in virtually all of Intel's processor chipsets since 2008. It is located in the Platform Controller Hub of modern Intel motherboards.

The Intel Management Engine always runs as long as the motherboard is receiving power, even when the computer is turned off. This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power.

Difference from Intel AMT

The Management Engine is often confused with Intel AMT (Intel Active Management Technology). AMT runs on the ME, but is only available on processors with vPro. AMT gives device owners remote administration of their computer, such as powering it on or off, and reinstalling the operating system.

However, the ME itself is built into all Intel chipsets since 2008, not only those with AMT. While AMT can be unprovisioned by the owner, there is no official, documented way to disable the ME.

Design

The subsystem primarily consists of proprietary firmware running on a separate microprocessor that performs tasks during boot-up, while the computer is running, and while it is asleep. As long as the chipset or SoC is supplied with power (via battery or power supply), it continues to run even when the system is turned off. Intel claims the ME is required to provide full performance. Its exact workings are largely undocumented and its code is obfuscated using confidential Huffman tables stored directly in hardware, so the firmware does not contain the information necessary to decode its contents.

First, note this statement: 

"This issue can be mitigated with deployment of a hardware device, which is able to disconnect mains power." 

is contradicted by this one: 

"As long as the chipset or SoC is supplied with power (via battery or power supply), it continues to run even when the system is turned off."

Just so we are clear, unplugging the power cord isn't going to stop it. The battery on the motherboard is enough to keep it alive. If you really want to stop you need to unplug it from the internet and the power outlet. And put it in a Faraday cage so no radio (like Cell phone, Wifi or Bluetooth) signals can get through.

If you really wanted to know what was going on, you'd want to know what was in those Huffman tables. Figuring that out might be a bit of a trick. You could, if you had good people skills, go out and talk to Intel employees until you found the guys who designed these tables and then using dastardly secret agent techniques get them to spill the beans. Problem with this method is that even if they hand over the tables, they might not be correct.

The other way, the hammer and tongs way, is to hook up the chip to a logic analyzer, step through the code and record what the relevant pins are doing. Might have to write some special code to exercise the chip in specific ways to get it to exercise the full extent of those tables.

You are still not done because now you get to look at all those traces and try and deduce what kind of logic produced them. 

If you have gotten this far and you also happen to have the secret table that you managed to squeeze out of the Intel engineer, you are liable to find that the table does not match what you found. Could be a deliberate error, or an error made in translating to hardware. 

Which reminds me of the bit of speculating I did about back doors in exported weapons. They could easily be there, in any equipment with any kind of solid state electronics and you would never know without doing a microscopic, destructive, layer by layer scan of all of the electronic chips.

Computer Security

U.S. Cyber Trust Mark

Borepatch has a post up about some new government standards for the Internet-Of-Things (IOT). His post inspired Landroll to comment:

Ah yes! Excellent. Just had a valuable lesson on the Internet of Things. Decided to quit HP Instant Ink program. Printer is now locked up with ink cartridge carrier in home position. Can not get old ink cartridge out to install new HP cartridge. PO'd much? why yes. Glad you asked.

Also bestirred me enough to comment: 

Typical. Industry charges on with their haphazard methods of building new widgets, blindly oblivious to the side-effects their new whiz bang gizmos create. This goes on until enough people get fed up and start making a fuss. Eventually the government gets involved and we get a new bureaucracy and a big fricking pile of new regulations. Well, what you gonna do? That's modern life in the USA.

I've had an idea kicking around for awhile that maybe what we need are some sealed modules for communication, modules that were tested and 'certified' to be secure. Problem is that people are very good at counterfeiting, so how would you know whether the module you hold in your hand is legit or not? Well, where did you get it? And do you trust them? It all comes down to personal trust.

Links

Finnish soldier loading a Mosin-Nagant rifle - SA-Kuva, Finnish National Archives, via Tom Laemlein

Guns: My Daily Kona has a longish post about the Mosin-Nagant rifle. Seems that a hundred years ago the world was in flames just like it is now. WW1 and the Russian revolution were raging and even Ireland was getting into the act. Westinghouse and Remington were churning out Mosin-Nagant rifles that went everywhere.

The New York State Court of Appeals

Computer Security: Borepatch talks about the US government's attempt to force software companies to take some basic precautions against hacking.

White Cliffs of Dover

Life Planning: The Scratching Post talks about walking towards the edge of the metaphorical cliff.