All posts by Robert Graham

Of course you can’t trust scientists on politics

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/07/of-course-you-cant-trust-scientists-on.html

Many people make the same claim as this tweet. It’s obviously wrong. Yes,, the right-wing has a problem with science, but this isn’t it.

First of all, people trust airplanes because of their long track record of safety, not because of any claims made by scientists. Secondly, people distrust “scientists” when politics is involved because of course scientists are human and can get corrupted by their political (or religious) beliefs.

And thirdly, the concept of “trusting scientific authority” is wrong, since the bedrock principle of science is distrusting authority. What defines sciences is how often prevailing scientific beliefs are challenged.

Carl Sagan has many quotes along these lines that eloquently expresses this:

A central lesson of science is that to understand complex issues (or even simple ones), we must try to free our minds of dogma and to guarantee the freedom to publish, to contradict, and to experiment. Arguments from authority are unacceptable.

If you are “arguing from authority”, like Paul Graham is doing above, then you are fundamentally misunderstanding both the principles of science and its history.

We know where this controversy comes from: politics. The above tweet isn’t complaining about the $400 billion U.S. market for alternative medicines, a largely non-political example. It’s complaining about political issues like vaccines, global warming, and evolution.

The reason those on the right-wing resist these things isn’t because they are inherently anti-science, it’s because the left-wing is. They left has corrupted and politicized these topics. The “Green New Deal” contains very little that is “Green” and much that is “New Deal”, for example. The left goes from the fact “carbon dioxide absorbs infrared” to justify “we need to promote labor unions”.

Take Marjorie Taylor Green’s (MTG) claim that she doesn’t believe in the Delta variant because she doesn’t believe in evolution. Her argument is laughably stupid, of course, but it starts with the way the left has politicized the term “evolution”.

The “Delta” variant didn’t arise from “evolution”, it arose because of “mutation” and “natural selection”. We know the “mutation” bit is true, because we can sequence the complete DNA and detect that changes happen. We know that “selection” happens, because we see some variants overtake others in how fast they spread.

Yes, “evolution” is synonymous with mutation plus selection, but it’s also a politically loaded term that means a lot of additional things. The public doesn’t understand mutation and natural-selection, because these concepts are not really taught in school. Schools don’t teach students to understand these things, they teach students to believe.

The focus of science eduction in school is indoctrinating students into believing in “evolution” rather than teaching the mechanisms of “mutation” and “natural-selection”. We see the conflict in things like describing the evolution of the eyeball, which Creationists “reasonably” believe is too complex to have evolved this way. I put “reasonable” in quotes here because it’s just the “Gods in the gaps” argument, which credits God for everything that science can’t explain, which isn’t very smart. But at the same time, science textbooks go too far, refusing to admit their gaps in knowledge here. The fossil records shows a lot of complexity arising over time through steady change — it just doesn’t show anything about eyeballs.

In other words, it’s possible for a kid to graduate high-school with a full understanding of science, including mutation, selection, and the fossil record, while believing God created the eyeball. This is anathema to educators, who would rather students “believe in evolution” than understand it.

Thus, “believing” in the “evolution” of the Delta variant becomes this horrible political debate because the left-wing has corrupted science. You have politicians like MTG virtue signaling their opposition to evolution in what should be a non-political, neutral science discussion.

The political debate over vaccines isn’t the vaccines themselves, but forcing people to become vaccinated.

The evidence is clear that the covid vaccines are in your own (and your kids’) best interest. If we left it there, few would be challenging the science. There is no inherent right-wing opposition to vaccines. Indeed, Trump championed the covid vaccines, trying to take credit for their development. 

But the left-wing chose a different argument, that covid vaccines are in the best interest of society, and therefore, that government must coerce/force people to become vaccinated. It’s at this point that political opposition appears on the right-wing. It’s the same whether you are describing the debate in the United States, Europe, or Asia.

We know the juvenile method which people defend their political positions. Once people decide to oppose “forcible vaccination”, they then build a position that vaccines aren’t “good” anyway.

Thus, you’ll get these nonsense arguments from people who have get their opinions from dodgy blogs/podcasts, like “these don’t even meet the definition of a vaccine”. The started from the political goal first, and then looked for things that might support it, no matter how intellectually vacuous. It’s frustrating trying to argue against the garbage arguments they’ll toss up.

But at the same time, the left is no better. The tweet above is equally a vacuous meme, that they repeat because it sounds good, not because they’ve put much thought into it. It’s simply an argument that strokes the prejudices of those who repeat it, rather than being a robust argument that can change the minds of opponents. It’s obviously false: people trust planes because of their track record, not because of scientists claim. They trust scientists and doctors on non-political things, but rightly distrust their pronouncements on politically-tainted issues. And lastly, the above argument is completely anti-scientific — science is all about questioning and doubting.

Risk analysis for DEF CON 2021

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/07/risk-analysis-for-def-con-2021.html

It’s the second year of the pandemic and the DEF CON hacker conference wasn’t canceled. However, the Delta variant is spreading. I thought I’d do a little bit of risk analysis. TL;DR: I’m not canceling my ticket, but changing my plans what I do in Vegas during the convention.

First, a note about risk analysis. For many people, “risk” means something to avoid. They work in a binary world, labeling things as either “risky” (to be avoided) or “not risky”. But real risk analysis is about shades of gray, trying to quantify things.

The Delta variant is a mutation out of India that, at the moment, is particularly affecting the UK. Cases are nearly up to their pre-vaccination peaks in that country.

Note that the UK has already vaccinated nearly 70% of their population — more than the United States. In both the UK and US there are few preventive measures in place (no lockdowns, no masks) other than vaccines.

 

Thus, the UK graph is somewhat predictive of what will happen in the United States. If we time things from when the latest wave hit the same levels as peak of the first wave, then it looks like the USA is only about 1.5 months behind the UK.

It’s another interesting lesson about risk analysis. Most people experience these things as sudden changes. One moment, everything seems fine, and cases are decreasing. The next moment, we are experiencing a major new wave of infections. It’s especially jarring when the thing we are tracking is exponential. But we can compare the curves and see that things are totally predictable. In about another 1.5 months, the US will experience a wave that looks similar to the UK wave.

Sometimes the problem is that the change is inconceivable. We saw that recently with 1-in-100 year floods in Germany. Weather forecasters predicted 1-in-100 level of floods days in advance, but they still surprised many people.

Nevada is ahead of the curve in the US, probably because Vegas is such a hub of unvaccinated people going on vacation. Because of exponential growth, there’s a good chance that in 2 weeks, that peek will be triple where it is now. It may not look like “time to cancel your ticket” now, but it probably will in 2 weeks when the event takes place. In other words, the closer we get to the event, the more people will look at this graph and cancel their tickets.

The risk is really high for the unvaccinated, but much less for the vaccinated. We see that in the death rates in the UK, which are still low, even accounting for the 2 week lag that you see between spikes in infections and spikes in deaths. This is partly due to the fact that while the new variant infects the vaccinated, it doesn’t cause much harm. Also, I suspect it’s due to how much better we are at treating infections if they do require a hospital visit.

But still, death isn’t the major concern. It appears the major concern is long term-lung (and other organ) damage caused by even mild cases. Thus, one should fear infection even if one believes they have no chance of dying.

So here’s my personal risk analysis: I’m not canceling my ticket. Instead, I’m changing my plans of what I do. For the most part, this means that wherever there’s a crowd, go someplace else.
It also means I’m going to take this opportunity to do things I’ve never had the opportunity to do before: go outside of Vegas. I plan on renting a car to go down to the Grand Canyon, Hoover Dam, and do hikes around the area (like along Lake Meade, up in the canyons, and so on). This means spending most of my time away from people.
During the pandemic, outdoor activities (without masks, socially distanced) is one of the safest things you can do, especially considering the exercise and vitamin D that you’ll be getting.
Also, airplanes aren’t much of a worry. They have great filtration and as far as anybody can tell, haven’t resulted in superspreader events this entire pandemic.
The real point of this blogpost is the idea of “predictions”. This post predicts that US infection rates will be spiking in 1.5 months in a curve that looks similar to the UK, and that in 2 weeks during DEFCON, Nevada’s infection rates will be around 3 times higher. The biggest lesson about risk analysis is that it’s usually done in hind-sight, what people should’ve known, once the outcome is known. It’s much harder doing it the other way around, estimating what might happen in the future.

Ransomware: Quis custodiet ipsos custodes

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/07/ransomware-quis-custodiet-ipsos-custodes.html

Many claim that “ransomware” is due to cybersecurity failures. It’s not really true. We are adequately protecting users and computers. The failure is in the inability of cybersecurity guardians to protect themselves. Ransomware doesn’t make the news when it only accesses the files normal users have access to. The big ransomware news events happened because ransomware elevated itself to that of an “administrator” over the network, giving it access to all files, including online backups.

Generic improvements in cybersecurity will help only a little, because they don’t specifically address this problem. Likewise, blaming ransomware on how it breached perimeter defenses (phishing, patches, password reuse) will only produce marginal improvements. Ransomware solutions need to instead focus on looking at the typical human-operated ransomware killchain, identify how they typically achieve “administrator” credentials, and fix those problems. In particular, large organizations need to redesign how they handle Windows “domains” and “segment” networks.

I read a lot of lazy op-eds on ransomware. Most of them claim that the problem is due to some sort of moral weakness (laziness, stupidity, greed, slovenliness, lust). They suggest things like “taking cybersecurity more seriously” or “do better at basic cyber hygiene”. These are “unfalsifiable” — things that nobody would disagree with, meaning they are things the speaker doesn’t really have to defend. They don’t rest upon technical authority but moral authority: anybody, regardless of technical qualifications, can have an opinion on ransomware as long as they phrase it in such terms.

Another flaw of these “unfalsifiable” solutions is that they are not measurable. There’s no standard definition for “best practices” or “basic cyber hygiene”, so there no way to tell if you aren’t already doing such things, or the gap you need to overcome to reach this standard. Worse, some people point to the “NIST Cybersecurity Framework” as the “basics” — but that’s a framework for all cybersecurity practices. In other words, anything short of doing everything possible is considered a failure to follow the basics.

In this post, I try to focus on specifics, while at the same time, making sure things are broadly applicable. It’s detailed enough that people will disagree with my solutions.

The thesis of this blogpost is that we are failing to protect “administrative” accounts. The big ransomware attacks happen because the hackers got administrative control over the network, usually the Windows domain admin. It’s with administrative control that they are able to cause such devastation, able to reach all the files in the network, while also being able to delete backups.

The Kaseya attacks highlight this particularly well. The company produces a product that is in turn used by “Managed Security Providers” (MSPs) to administer the security of small and medium sized businesses. Hackers found and exploited a vulnerability in the product, which gave them administrative control of over 1000 small and medium sized businesses around the world.

The underlying problems start with the way their software gives indiscriminate administrative access over computers. Then, this software was written using standard software techniques, meaning, with the standard vulnerabilities that most software has (such as “SQL injection”). It wasn’t written in a paranoid, careful way that you’d hope for software that poses this much danger.

A good analogy is airplanes. A common joke refers to the “black box” flight-recorders that survive airplane crashes, that maybe we should make the entire airplane out of that material. The reason we can’t do this is that airplanes would be too heavy to fly. The same is true of software: airplane software is written with extreme paranoia knowing that bugs can lead to airplanes falling out of the sky. You wouldn’t want to write all software to that standard, because it’d be too costly.

This analogy tells us we can’t write all software to the highest possible standard. However, we should write administrative software (like Kaseya) to this sort of standard. Anything less invites something like the massive attack we saw in the last couple weeks.

Another illustrative example is the “PrinterNightmare” bug. The federal government issued a directive telling everyone under it’s authority (executive branch, military) to disable the Printer Spooler on “domain controllers”. The issue here is that this service should never have been enabled on “domain controllers” in the first place.

Windows security works by putting all the security eggs into a single basket known as “Active Directory”, which is managed by several “Domain Controller” (AD DC) servers. Hacking a key DC gives the ransomware hacker full control over the network. Thus, we should be paranoid about protecting DCs. They should not be running any service other than those needed to fulfill their mission. The more additional services they provide, like “printing”, the larger the attack surface, the more likely they can get hacked, allowing hackers full control over the network. 

Yet, I rarely see Domain Controllers with this level of paranoid security. Instead, when an organization has a server, they load it up with lots of services, including those for managing domains. Microsoft’s advice securing domain controllers “recommends” a more paranoid attitude, but only as one of the many other things it “recommends”.

When you look at detailed analysis of ransomware killchains, you’ll find the most frequently used technique is “domain admin account hijacking“. Once a hacker controls a desktop computer, they wait for an administrator to login, then steal the administrators credentials. There are various ways this happens, the most famous being “pass-the-hash” (which itself is outdated, but good analogy for still-current techniques). Hijacking even restricted administrator accounts can lead to elevation to unrestricted administrator privileges over the entire network.

If you had to fix only one thing in your network, it would be this specific problem.

Unfortunately, I only know how to attack this problem as a pentester, I don’t know how to defend against it. I feel that separating desktop admins and server/domain admins into separate, non-overlapping groups is the answer, but I don’t know how to achieve this in practice. I don’t have enough experience as a defender to know how to make reasonable tradeoffs.

In addition to attacking servers and accounts, ransomware attackers also target networks. Organizations focus on “perimeter security”, where the major security controls are between the public Internet and the internal organization. They also need an internal perimeter, between the organization’s network and the core servers.

There are lots of tools for doing this: VLANs, port-isolation, network segmentation, read-only Domain Controllers, and the like.

As an attacker, I see the lack of these techniques. I don’t know why defenders doin’t use them more. There might be good reasons. I suspect the biggest problem is inertia: networks were designed back when these solutions were hard, and change would break things.

In summary, I see the major problem exploited by ransomware is that we don’t protect “administrators” enough. We don’t do enough to protect administrative software, servers, accounts, or network segments. When we look at ransomware, the big cases that get splashed across the news, its not because they compromised a single desktop, but because they got administrative control over the entire network and thus were able to encrypt everything.

Sadly, as a person experience in attack (red-team) and exploiting these problems, I can see the problem. However, I have little experience as a defender (blue-team), and while solutions look easy in theory, I’m not sure what can be done in practice to mitigate these threats.

I do know that general hand-waving, exhorting people to “take security seriously” and perform “cyber hygiene” is the least helpful answer to the problem.

Some quick notes on SDR

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/07/some-quick-notes-on-sdr.html

I’m trying to create perfect screen captures of SDR to explain the world of radio around us. In this blogpost, I’m going to discuss some of the imperfect captures I’m getting, specifically, some notes about WiFi and Bluetooth.

An SDR is a “software defined radio” which digitally samples radio waves and uses number crunching to decode the signal into data. Among the simplest thing an SDR can do is look at a chunk of spectrum and see signal strength. This is shown below, where I’m monitoring part of the famous 2.4 GHz pectrum used by WiFi/Bluetooth/microwave-ovens:

There are two panes. The top shows the current signal strength as graph. The bottom pane is the “waterfall” graph showing signal strength over time, display strength as colors: black means almost no signal, blue means some, and yellow means a strong signal.

The signal strength graph is a bowl shape, because we are actually sampling at a specific frequency of 2.42 GHz, and the further away from this “center”, the less accurate the analysis. Thus, the algorithms think there is more signal the further away from the center we are.

What we do see here is two peaks, at 2.402 GHz toward the left and 2.426 GHz toward the right (which I’ve marked with the red line). These are the “Bluetooth beacon” channels. I was able to capture the screen at the moment some packets were sent, showing signal at this point. Below in the waterfall chart, we see packets constantly being sent at these frequencies.

We are surrounded by devices giving off packets here: our phones, our watches, “tags” attached to devices, televisions, remote controls, speakers, computers, and so on. This is a picture from my home, showing only my devices and perhaps my neighbors. In a crowded area, these two bands are saturated with traffic.

The 2.4 GHz region also includes WiFi. So I connected to a WiFi access-point to watch the signal.

WiFi uses more bandwidth than Bluetooth. The term “bandwidth” is used today to mean “faster speeds”, but it comes from the world of radio where it quite literally means the width of the band. The width of the Bluetooth transmissions seen above is 2 MHz, the width of the WiFi band shown here is 20 MHz.

It took about 50 screenshots before getting these two. I had to hit the “capture” button right at the moment things were being transmitted. And easier way is a setting that graphs the current signal strength compared to the maximum recently seen as a separate line. That’s shown below: the instant it was taken, there was no signal, but it shows the maximum of recent signals as a separate line:

You can see there is WiFi traffic on multiple channels. My traffic is on channel #1 at 2.412 GHz. My neighbor has traffic on channel #6 at 2.437 GHz. Another neighbor has traffic on channel #8 at 2.447 GHz. WiFi splits the spectrum assigned to it into 11 overlapping channels set 5 MHz apart.
Now the reason I wanted to take these pictures was to highlight the difference between old WiFi (802.11b) and new WiFi (802.11n). The newer standard uses the spectrum more efficiently. Notice in the picture above how signal strength for a WiFi channel is strongest in the center but gets weaker toward the edges. That means it’s not fully using all the band.
Newer WiFi uses a different scheme to encode data into radio waves, using all the band given to it. We can see the difference in shape below, when I change from 802.11b to 802.11n:

Instead of a curve it’s more of a square block. It fills its entire 20 MHz bandwidth instead of only using the center.
What we see here is the limits of math and physics, known as the Shannon Limit, that governs the maximum possible speed for something like WiFi (or mobile phone radios like LTE). It’s simply the size of that box: its width times its height. The width is measured in frequency, 20 MHz wide. It’s height is signal strength measure above the noise floor (which should be straight line across the bottom of our graph, but as I mentioned before, is shown in this SDR by a curved line increasingly inaccurate near the edges).
As we move toward faster and faster speeds, we cannot exceed this theoretical limit.
One solution is directional antennas, such as the yagi antennas you see on top of houses or satellite dishes. A directional antenna or dish means getting a stronger signal with less noise — thus, increasing the “height” of the box.
The same effect can be achieved with something called “phased arrays”, using multiple antennas that transmit/receive at (very) slightly different times, such that waves they produce reinforce each other in one direction but cancel each other out in other directions. This is how SpaceX “Starlink” space-based Internet works. The low Earth orbit satellites whizzing by overhead travel too fast to keep an antenna pointed at them, so their antenna is a phases array instead. The antennas are fixed, but the timing is slightly altered to aim the beam toward the satellite.
What’s even more interesting is MIMO: receiving different signals on different antennas. With fancy circuits and math, doubling the number of antennas doubles the effective bandwidth.
The latest mobile phones and WiFi use MIMO and phases arrays to increase bandwidth.
But mostly, higher frequencies give more bandwidth. That’s why WiFi at 5 GHz is better — bands are a minimum of 40 MHz (instead of 20 MHz as in 2.4 GHz WiFi), are more commonly 80 MHz, and can go up to 160 MHz.
Anyway, these are more imperfect picture I’m creating to explain WiFi and Bluetooth. At some point in the time, I’ll be generating more perfect ones.

When we’ll get a 128-bit CPU

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/06/when-well-get-128-bit-cpu.html

On Hacker News, this article claiming “You won’t live to see a 128-bit CPU” is trending”. Sadly, it was non-technical, so didn’t really contain anything useful. I thought I’d write up some technical notes.

The issue isn’t the CPU, but memory. It’s not about the size of computations, but when CPUs will need more than 64-bits to address all the memory future computers will have. It’s a simple question of math and Moore’s Law.

Today, Intel’s server CPUs support 48-bit addresses, which is enough to address 256-terabytes of memory — in theory. In practice, Amazon’s AWS cloud servers are offered up to 24-terabytes, or 45-bit addresses, in the year 2020.

Doing the math, it means we have 19-bits or 38-years left before we exceed the 64-bit registers in modern processors. This means that by the year 2058, we’ll exceed the current address size and need to move 128-bits. Most people reading this blogpost will be alive to see that, though probably retired.

There are lots of reasons to suspect that this event will come both sooner and later.

It could come sooner if storage merges with memory. We are moving away from rotating platters of rust toward solid-state storage like flash. There are post-flash technologies like Intel’s Optane that promise storage that can be accessed at speeds close to that of memory. We already have machines needing petabytes (at least 50-bits worth) of storage.

Addresses often contain more just the memory address, but also some sort of description about the memory. For many applications, 56-bits is the maximum, as they use the remaining 8-bits for tags.

Combining those two points, we may be only 12 years away from people starting to argue for 128-bit registers in the CPU.

Or, it could come later because few applications need more than 64-bits, other than databases and file-systems.

Previous transitions were delayed for this reason, as the x86 history shows. The first Intel CPUs were 16-bits addressing 20-bits of memory, and the Pentium Pro was 32-bits addressing 36-bits worth of memory.

The few applications that needed the extra memory could deal with the pain of needing to use multiple numbers for addressing. Databases used Intel’s address extensions, almost nobody else did. It took 20 years, from the initial release of MIPS R4000 in 1990 to Intel’s average desktop processor shipped in 2010 for mainstream apps needing larger addresses.

For the transition beyond 64-bits, it’ll likely take even longer, and might never happen. Working with large datasets needing more than 64-bit addresses will be such a specialized discipline that it’ll happen behind libraries or operating-systems anyway.

So let’s look at the internal cost of larger registers, if we expand registers to hold larger addresses.

We already have 512-bit CPUs — with registers that large. My laptop uses one. It supports AVX-512, a form of “SIMD” that packs multiple small numbers in one big register, so that he can perform identical computations on many numbers at once, in parallel, rather than sequentially. Indeed, even very low-end processors have been 128-bit for a long time — for “SIMD”.

In other words, we can have a large register file with wide registers, and handle the bandwidth of shipping those registers around the CPU performing computations on them. Today’s processors already handle this for certain types of computations.

But just because we can do many 64-bit computations at once (“SIMD”) still doesn’t mean we can do a 128-bit computation (“scalar”). Simple problems like “carry” get difficult as numbers get larger. Just because SIMD can do multiple small computations doesn’t tell us what one large computation will cost. This was why it took an extra decade for Intel to make the transition — they added 64-bit MMX registers for SIMD a decade before they added 64-bit for normal computations.

The above discussion is about speed, but it’s also a concern for power consumption. Mobile devices were a decade later (than desktops) adopting 64-bits, exceeding the 32-bit barrier just now. It’s likely they be decades late getting to 128-bits. Even if you live to see supercomputers transition to 128-bits, you probably won’t live to see your mobile device transition.

Now let’s look at the market. What the last 40 years has taught us is that old technology doesn’t really day, it’s that it stops growing — with all the growth happening in some new direction. 40 years ago, IBM dominated computing with their mainframes. Their mainframe business is as large as ever, it’s just that all the growth in the industry has been in other directions than the mainframe. The same thing happened to Microsoft’s business, Windows still dominates the desktop, but all the growth in the last 15 years has bypassed the desktop, moving to mobile devices and the cloud.

40 years from now, it won’t be an issue of mainstream processors jumping from 64-bits to 128-bits, like the previous transitions. I’m pretty sure we’ll have ossified into some 64-bit standard like ARM. Instead, I think 128-bit systems will come with a bunch of other radical changes. It’ll happen on the side of computers, much like how GPUs evolved separately from mainstream CPUs can became increasingly integrated into them.

Anatomy of how you get pwned

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/04/anatomy-of-how-you-get-pwned.html

Today, somebody had a problem: they kept seeing a popup on their screen, and obvious scam trying to sell them McAfee anti-virus. Where was this coming from?

In this blogpost, I follow this rabbit hole on down. It starts with “search engine optimization” links and leads to an entire industry of tricks, scams, exploiting popups, trying to infect your machine with viruses, and stealing emails or credit card numbers.

Evidence of the attack first appeared with occasional popups like the following. The popup isn’t part of any webpage.

This is obviously a trick. But from where? How did it “get on the machine”?

There’s lots of possible answers. But the most obvious answer (to most people), that your machine is infected with a virus, is likely wrong. Viruses are generally silent, doing evil things in the background. When you see something like this, you aren’t infected … yet.

Instead, things popping with warnings is almost entirely due to evil websites. But that’s confusing, since this popup doesn’t appear within a web page. It’s off to one side of the screen, nowhere near the web browser.

Moreover, we spent some time diagnosing this. We restarted the webbrowser in “troubleshooting mode” with all extensions disabled and went to a clean website like Twitter. The popup still kept happening.

As it turns out, he had another windows with Firefox running under a different profile. So while he cleaned out everything in this one profile, he wasn’t aware the other one was still running

This happens a lot in investigations. We first rule out the obvious things, and then struggle to find the less obvious explanation — when it was the obvious thing all along.

In this case, the reason the popup wasn’t attached to a browser window is because it’s a new type of popup notification that’s suppose to act more like an app and less like a web page. It has a hidden web page underneath called a “service worker”, so the popups keep happening when you think the webpage is closed.

Once we figured the mistake of the other Firefox profile, we quickly tracked this down and saw that indeed, it was in the Notification list with Permissions set to Allow. Simply changing this solved the problem.

Note that the above picture of the popup has a little wheel in the lower right. We are taught not to click on dangerous thing, so the user in this case was avoiding it. However, had the user clicked on it, it would’ve led him straight here to the solution. I can’t recommend you click on such a thing and trust it, because that means in the future, malicious tricks will contain such safe looking icons that aren’t so safe.

Anyway, the next question is: which website did this come from?

The answer is Google.

In the news today was the story of the Michigan guys who tried to kidnap the governor. The user googled “attempted kidnap sentencing guidelines“. This search produced a page with the following top result:

Google labels this a “featured snippet”. This isn’t an advertisement, not a “promoted” result. But it’s a link that Google’s algorithms thinks is somehow more worthy than the rest.

This happened because hackers tricked Google’s algorithms. It’s been a constant cat and mouse game for 20 years, in an industry known as “search engine optimization” or SEO. People are always trying to trick google into placing their content highest, both legitimate companies and the quasi-illegitimate that we see here. In this case, they seem to have succeeded.
The way this trick works is that the hackers posted a PDF instead of a webpage containing the desired text. Since PDF documents are much less useful for SEO purposes, google apparently trusts them more.
But the hackers have found a way to make PDFs more useful. They designed it to appear like a webpage with the standard CAPTCHA. You click anywhere on the page such as saying “I’m not robot”, and it takes you to the real webstie.

But where is the text I was promised in the Google’s search result? It’s there, behind the image. PDF files have layers. You can put images on top that hides the text underneath. Humans only see the top layer, but google’s indexing spiders see all the layers, and will index the hidden text. You can verify this by downloading the PDF and using tools to examine the raw text:

If you click on the “I am not robot” in the fake PDF, it takes you to a page like the following:

Here’s where the “hack” happened. The user misclicked on “Allow” instead of “Block” — accidentally. Once they did that, popups started happening, even when this window appeared to go away.

The lesson here is that “misclicks happen”. Even the most knowledgeable users, the smartest of cybersecurity experts, will eventually misclick themselves.

As described above, once we identified this problem, we were able to safely turn off the popups by going to Firefox’s “Notification Permissions”.

Note that the screenshots above are a mixture of Firefox images from the original user, and pictures of Chrome where I tried to replicate the attack in one of my browsers. I didn’t succeed — I still haven’t been able to get any popups appearing on my computer.

So I tried a bunch of different browsers: Firefox, Chrome, and Brave on both Windows and macOS.

Each browser produced a different result, a sort of A/B testing based on the User-Agent (the string sent to webservers that identifies which browser you are using). Sometime following the hostile link from that PDF attempted to install a popup script in our original example, but sometimes it tried something else.

For example, on my Firefox, it tried to download a ZIP file containing a virus:

When I attempt to download, Firefox tells me it’s a virus — probably because Firefox knows the site where it came from is evil.

However, Microsoft’s free anti-virus didn’t catch it. One reason is that it comes as an encrypted zip file. In order to open the file, you have to first read the unencrypted text file to get the password — something humans can do but anti-virus products aren’t able to do (or at least, not well).

So I opened the password file to get the password (“257048169”) and extracted the virus. This is mostly safe — as long as I don’t run it. Viruses are harmless sitting on your machine as long as they aren’t running. I say “mostly” because even for experts, “misclicks happen”, and if I’m not careful, I may infect my machine.

Anyway, I want to see what the virus actually is. The easiest way to do that is upload it to VirusTotal, a website that runs all the known anti-virus programs on a submission to see what triggers what. It tells me that somebody else uploaded the same sample 2 hours ago, and that a bunch of anti-virus vendors detect it, with the following names:
With VirusTotal, you can investigate why anti-virus products think it may be a virus. 
For example, anti-virus companies will run viruses to see what they do. They run them in “emulated” machines that are a lot slower, but safer. If viruses find themselves running in an emulated environment, then they stop doing all the bad behaviors the anti-virus programs might detection. So they repeated check the timestamp to see how fast they are running — if too slow, they assume emulation.
But this itself is a bad behavior. This timestamp detection is one of the behaviors the anti-virus programs triggered on as suspicious.

You can go investigate on VirusTotal other things it found with this virus.

Viruses and disconnected popups wasn’t the only trick. In yet another attempt with web browsers, the hostile site attempt to open lots and lots of windows full of advertising. This is a direct way they earn money — hacking the advertising companies rather than hacking you.

In yet another attempt with another browser, this time from my MacBook air, it asked for an email address:

I happily obliged, giving it a fake address.

At this point, the hackers are going to try to use the same email and password to log into Gmail, into a few banks, and so on. It’s one of the top hacks these days (if not the most important hack) — since most people reuse the same password for everything, even though it’s not asking your for your Gmail or bank password, most of the time people will simply reuse them anyway. (This is why you need to keep important passwords separate from unimportant ones — and write down your passwords or use a password manager).
Anyway, I now get the next webpage. This is a straight up attempt to steal my credit card — maybe. 

This is a website called “AppCine.net” that promises streaming movies, for free signup, but requires a credit card.

This may be a quasi-legitimate website. I saw “quasi” because their goal isn’t outright credit card fraud, but a “dark pattern” whereby they make it easy to sign up for the first month free with a credit card, and then make it nearly impossible to stop the service, where they continue to bill you month after month. As long as the charges are small each month, most people won’t bother going through all the effort canceling the service. And since it’s not actually fraud, people won’t call their credit card company and reverse the charges, since they actually did sign up for the service and haven’t canceled it.
It’s a slimy thing the Trump campaign did in the last election. Their website asked for one time donations but tricked people into unwittingly making it a regular donation. This caused a lot of “chargebacks” as people complained to their credit card company.
In truth, everyone does the same pattern: makes it easy to sign up, and sign up for more than you realize, and then makes it hard to cancel. I thought I’d canceled an AT&T phone but found out they’d kept billing me for 3 years, despite the phone no longer existing and using their network.
They probably have a rewards program. In other words, they aren’t out there doing SEO hacking of google. Instead, they pay others to do it for them, and then give a percentage profit, either for incoming links, but probably “conversion”, money whenever somebody actually enters their credit card number and signs up.
Those people are in tern a different middleman. It probably goes like this:
  • somebody skilled at SEO optimization, who sends links to a broker
  • a broker who then forwards those links to other middlemen
  • middlemen who then deliver those links to sites like AppCine.net that actually ask for an email address or credit card
There’s probably even more layers — like any fine tuned industry, there are lots of specialists who focus on doing their job well.
Okay, I’ll play along, and I enter a credit card number to see what happens (I have bunch of used debit cards to play this game). This leads to an error message saying the website is down and they can’t deliver videos for me, but then pops up another box asking for my email, from yet another movie website:

This leads to yet another site:

It’s an endless series. Once a site “converts” you, it then simply sells the link back to another middleman, who then forwards you on to the next. I could probably sit there all day with fake email addresses and credit cards and still not come to the end of it all.

Summary

So here’s what we found.
First, there was a “search engine optimization” hacker who specializes in getting their content at the top of search results for random terms.
Second, they pass hits off to a broker who distributes the hits to various hackers who pay them. These hackers will try to exploit you with:
  • popups pretending to be anti-virus warnings that show up outside the browser
  • actual virus downloads in encrypted zips that try to evade anti-virus, but not well
  • endless new windows selling you advertising
  • steal your email address and password, hoping that you’ve simply reused one from legitimate websites, like Gmail or your bank
  • signups for free movie websites that try to get your credit card and charge you legally
Even experts get confused. I had trouble helping this user track down exactly where the popup was coming from. Also, any expert can misclick and make the wrong thing happen — this user had been clicking the right thing “Block” for years and accidentally hit “Allow” this one time.

Ethics: University of Minnesota’s hostile patches

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/04/ethics-university-of-minnesotas-hostile.html

The University of Minnesota (UMN) got into trouble this week for doing a study where they have submitted deliberately vulnerable patches into open-source projects, in order to test whether hostile actors can do this to hack things. After a UMN researcher submitted a crappy patch to the Linux Kernel, kernel maintainers decided to rip out all recent UMN patches.

Both things can be true:

  • Their study was an important contribution to the field of cybersecurity.
  • Their study was unethical.
It’s like Nazi medical research on victims in concentration camps, or U.S. military research on unwitting soldiers. The research can simultaneously be wildly unethical but at the same time produce useful knowledge.
I’d agree that their paper is useful. I would not be able to immediately recognize their patches as adding a vulnerability — and I’m an expert at such things.
In addition, the sorts of bugs it exploits shows a way forward in the evolution of programming languages. It’s not clear that a “safe” language like Rust would be the answer. Linux kernel programming requires tracking resources in ways that Rust would consider inherently “unsafe”. Instead, the C language needs to evolve with better safety features and better static analysis. Specifically, we need to be able to annotate the parameters and return statements from functions. For example, if a pointer can’t be NULL, then it needs to be documented as a non-nullable pointer. (Imagine if pointers could be signed and unsigned, meaning, can sometimes be NULL or never be NULL).
So I’m glad this paper exists. As a researcher, I’ll likely cite it in the future. As a programmer, I’ll be more vigilant in the future. In my own open-source projects, I should probably review some previous pull requests that I’ve accepted, since many of them have been the same crappy quality of simply adding a (probably) unnecessary NULL-pointer check.
The next question is whether this is ethical. Well, the paper claims to have sign-off from their university’s IRB — their Institutional Review Board that reviews the ethics of experiments. Universities created IRBs to deal with the fact that many medical experiments were done on either unwilling or unwitting subjects, such as the Tuskegee Syphilis Study. All medical research must have IRB sign-off these days.
However, I think IRB sign-off for computer security research is stupid. Things like masscanning of the entire Internet are undecidable with traditional ethics. I regularly scan every device on the IPv4 Internet, including your own home router. If you paid attention to the packets your firewall drops, some of them would be from me. Some consider this a gross violation of basic ethics and get very upset that I’m scanning their computer. Others consider this to be the expected consequence of the end-to-end nature of the public Internet, that there’s an inherent social contract that you must be prepared to receive any packet from anywhere. Kerckhoff’s Principle from the 1800s suggests that core ethic of cybersecurity is exposure to such things rather than trying to cover them up.
The point isn’t to argue whether masscanning is ethical. The point is to argue that it’s undecided, and that your IRB isn’t going to be able to answer the question better than anybody else.
But here’s the thing about masscanning: I’m honest and transparent about it. My very first scan of the entire Internet came with a tweet “BTW, this is me scanning the entire Internet”.
A lot of ethical questions in other fields comes down to honesty. If you have to lie about it or cover it up, then there’s a good chance it’s unethical.
For example, the west suffers a lot of cyberattacks from Russia and China. Therefore, as a lone wolf actor capable of hacking them back, is it ethical to do so? The easy answer is that when discovered, would you say “yes, I did that, and I’m proud of it”, or would you lie about it? I admit this is a difficult question, because it’s posed in terms of whether you’d want to evade the disapproval from other people, when the reality is that you might not want to get novichoked by Putin.
The above research is based on a lie. Lying has consequences.
The natural consequence here is that now that UMN did that study, none of the patches they submit can be trusted. It’s not just this one submitted patch. The kernel maintainers are taking scorched earth response, reverting all recent patches from the university and banning future patches from them. It may be a little hysterical, but at the same time, this is a new situation that no existing policy covers.
I partly disagree with the kernel maintainer’s conclusion that the patches “obviously were _NOT_ created by a static analysis tool”. This is exactly the sort of noise static analyzers have produced in the past. I reviewed the source file for how a static analyzer might come to this conclusion, and found it’s exactly the sort of thing it might produce.
But at the same time, it’s obviously noise and bad output. If the researcher were developing a static analyzer tool, they should understand that this is crap noise and bad output from the static analyzer. They should not be submitting low-quality patches like this one. The main concern that researchers need to focus on for static analysis isn’t increasing detection of vulns, but decreasing noise.
In other words, the debate here is whether the researcher is incompetent or dishonest. Given that UMN has practiced dishonesty in the past, it’s legitimate to believe they are doing so again. Indeed, “static analysis” research might also include research in automated ways to find subversive bugs. One might create a static analyzer to search code for ways to insert a NULL pointer check to add a vuln.
Now incompetence is actually a fine thing. That’s the point of research, is to learn things. Starting fresh without all the preconceptions of old work is also useful. That researcher has problems today, but a year or two from now they’ll be an ultra-competent expert in their field. That’s how one achieves competence — making mistakes, lots of them.
But either way, the Linux kernel maintainer response of “we are not part of your research project” is a valid. These patches are crap, regardless of which research project they are pursuing (static analyzer or malicious patch submissions).
Conclusion

I think the UMN research into bad-faith patches is useful to the community. I reject the idea that their IRB, which is focused on biomedical ethics rather than cybersecurity ethics, would be useful here. Indeed, it’s done the reverse: IRB approval has tainted the entire university with the problem rather than limiting the fallout to just the researchers that could’ve been disavowed.
The natural consequence of being dishonest is that people can’t trust you. In cybersecurity, trust is hard to win and easy to lose — and UMN lost it. The researchers should have understand that “dishonesty” was going to be a problem.
I’m not sure there is a way to ethically be dishonest, so I’m not sure how such useful research can be done without the researchers or sponsors being tainted by it. I just know that “dishonesty” is an easily recognizable issue in cybersecurity that needs to be avoided. If anybody knows how to be ethically dishonest, I’d like to hear it.
Update: This person proposes a way this research could be conducted to ethically be dishonest:

A quick FAQ about NFTs

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/03/a-quick-faq-about-nfts.html

I thought I’d write up 4 technical questions about NFTs. They may not be the ones you ask, but they are the ones you should be asking. The questions:

  • What does the token look like?
  • How does it contain the artwork? (or, where is the artwork contained?)
  • How are tokens traded? (How do they get paid? How do they get from one account to another?)
  • What does the link from token to artwork mean? Does it give copyrights?
I’m going to use 4 sample tokens that have been sold for outrageous prices as examples.

#1 What does the token look like?

An NFT token has a unique number, analogous to:

  • your social security number (SSN#)
  • your credit card number
  • the VIN# on your car
  • the serial number on a dollar bill
  • etc.

This unique number is composed of two things:

  • the contract number, identifying the contract that manages the token
  • the unique token identifier within that contract
Here are some example tokens, listing the contract number (the long string) and token ID (short number), as well as a link to a story on how much it sold for recently.

With these two numbers, you can go find the token on the blockchain, and read the code to determine what the token contains, how it’s traded, its current owner, and so on.

#2 How do NFTs contain artwork? or, where is artwork contained?

Tokens can’t*** contain artwork — art is too big to fit on the blockchain. That Beeple piece is 300-megabytes in size. Therefore, tokens point to artwork that is located somewhere else than the blockchain.

*** (footnote) This isn’t actually true. It’s just that it’s very expensive to put artwork on the blockchain. That Beeple artwork would cost about $5million to put onto the blockchain. Yes, this less than a tenth the purchase price of $69million, but when you account for all the artwork for which people have created NFTs, the total exceeds the prices for all NFTs.

So if artwork isn’t on the blockchain, where is it located? and how do the NFTs link to it?

Our four examples of NFT mentioned above show four different answers to this question. Some are smart, others are stupid — and by “stupid” I mean “tantamount to fraud”.

The correct way to link a token with a piece of digital art is through a hash, which can be used with the decentralized darknet.

hash is a unique cryptographic “key” (sic) generated from the file contents. No two files with different contents (or different lengths) will generate the same hash. A hacker can’t create a different file that generates the same hash. Therefore, the hash becomes the identity of the file — if you have a hash and a file, you can independently verify the two match.

The hash (and therefore unique identity) of the Beeple file is the following string:

QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA

With the hash, it doesn’t matter where the file is located right now in cyberspace. It only matters that at some point in the future, when the owner of the NFT wants to sell it, they can produce the file which provably matches the hash.

To repeat: because of the magic of cryptographic hashes, the artwork in question doesn’t have to be located anywhere in particular.

However, people do like having a live copy of the file available in a well known location. One way of doing this is with the darknet, which is essentially a decentralized version of the web. In much the same way the blockchain provides decentralized transactions, darknet services provide decentralized file sharing. The most famous of such services is BitTorrent. The most popular for use with NFTs is known as IPFS (InterPlanetary File System). A hash contained within an NFT token often links to the IPFS system.

In the $69million Beeple NFT, this link is:

ipfs://ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz

Sharp eyed readers will notice the hash of the artwork (above) doesn’t match the hash in this IPFS link.

That’s because the NFT token points to a metadata file that contains the real hash, along with other information about the artwork. The QmPAg…. hash points to metadata that contains the QmXkx… hash.

But a chain of hashes in this manner is still just as secure as a single hash — indeed, that’s what the “blockchain” is — a hash chain. In the future, when the owner sells this NFT, they’ll need to provide both files, the metadata and the artwork, to conclusively transfer ownership.

Thus, in answer to the question of where the artwork is located (in the NFT? on the web?), the answer is often that the NFT token contains a hash pointing to the darknet.

Let’s look at another token on our list, the $180k AP artwork. The NFT links to the following URL:

https://ap-nft.everipedia.org/api/presidential-2020/1

Like the above example with Beeple, this too points to a metadata file, with a link to the eventual artwork (here). However, this chain is broken in the middle with that URL — it isn’t decentralized, and there’s no guarantee in the future that it’ll exist. The company “Everipedia” could go out of business tomorrow, or simply decide to stop sharing the file to the web, or decide to provide a different file at that location. In these cases, the thing the NFT points to disappears.

In other words, 50 years from now, after WW III and we’ve all moved to the off-world colonies, the owner of Beeple’s NFT will still be able to sell it, providing the two additional files. The owner of this AP NFT probably won’t — the link will probably have disappeared from the web — they won’t be able to prove that the NFT they control points to the indicated artwork.

I would call this tantamount to fraud — almost. The information is all there for the buyer to check, so they know the problems with this NFT. They obviously didn’t care — maybe they plan on being able to offload the NFT onto another buyer before the URL disappears.

Now let’s look at the CryptoPunks #7804 NFT. The contract points to the same hash of an image file that contains all 10,000 possible token images. That hash is the following. Click on it to see the file it maps to:

ac39af4793119ee46bbff351d8cb6b5f23da60222126add4268e261199a2921b

The token ID in question is #7804. If you look in that file for the 7804th face, you’ll see which one the token matches.

Unfortunately, the original contract doesn’t actually explain how we arrive at the 7804th sub-image. Do we go left to right? Top down? or some other method? Currently, there exists a website that does the translation using one algorithm, but in the future, there’s no hard proof which token maps to which face inside that massive image.

Now let’s look at the CryptoKitty #896775 . In this case, there’s no hashes involved, and no image. Instead, each kitty is expressed as a pattern of “genes”, with contracts that specify how to two kittens can breed together to create a new kitty’s genes. The above token contains the gene sequence:

235340506405654824796728975308592110924822688777991068596785613937685997

There are other contracts on the blockchain that can interact with this. 

The CryptoKitty images we see are generated by an algorithm that reads the gene sequence. Thus, there is no image file, no hash of a file. The algorithm that does this is located off-chain, so again we have the problem that in the future, the owner of the token may not be able to prove ownership of the correct image.

So what we see in these examples is one case where there’s a robust hash chain linking the NFT with the corresponding image file, and three examples where the link is problematic — ranging from slightly broken to almost fraudulent.

#3 How are tokens traded?

There are two ways you can sell your NFTs:

  • off the blockchain
  • on the blockchain

The Beeple artwork was sold through Christie’s — meaning off blockchain. Christies conducted the bidding and collected the payment, took its cut, and gave the rest to the artist. The artist then transferred the NFT. We can see this on the blockchain where Beeple transferred the NFT for $0, but we can’t see the flow of money off blockchain.

This is the exception. The rule is that NFTs are supposed to be traded on blockchain.

NFT contracts don’t have auction or selling capabilities themselves. Instead, they follow a standard (known as ERC721) that allows them to be managed by other contracts. A person controlling a token selects some other auction/selling contract that matches the terms they want, and gives control to that contract.

Because contracts are code, both sides are know what the terms are, and can be confident they won’t be defrauded by the other side.

For example, a contract’s terms might be to provide for bids over 5 days, transfer the NFT from the owner to the buyer, and transfer coins from the buyer to the previous owner.

This is really why NFTs are so popular: not ownership of artwork, but on blockchain buying and selling of tokens. It’s the ability to conduct such commerce where the rules are dictated by code rather than by humans, where such transfers happen in a decentralized manner rather than through a central authority that can commit fraud.

So the upshot is that if you own an NFT, you can use the Transfer() function to transfer it to some other owner, or you can authorize some other contract to do the selling for you, which will eventually call this Transfer() function when the deal is done. Such a contract will likely also transfer coins in the other direction, paying you for your token.

#4 What does this all mean?

If you break into the Louvre Museum and steal the Mona Lisa, you will control the artwork. But you won’t own it. The word “ownership” is defined to mean your legal rights over the object. If the legal authorities catch up with you, they’ll stick you in jail and transfer control of the artwork back to the rightful legal owner.

We keep talking about “ownership” of NFTs, but this is fiction. Instead, all that you get when you acquire an NFT is “control” — control of just the token even, and not of the underlying artwork. Much of what happens in blockchain/cryptocurrencies isn’t covered by the law. Therefore, you can’t really “own” tokens. But you certainly control them (with the private key in your wallet that matches the public key of your account/address on the blockchain).

This is why NFTs are problematic, people are paying attention to the fiction (“ownership”) and not the technical details (“control”). We see that in the AP artwork above which simply links to a URL instead of a hash, missing a crucial step. They weren’t paying attention to the details.

There are other missing steps. For example, I can create my own NFTs representing all these artworks and sell them (maybe covered in a future blogpost). It’s a fiction that one of these is valid and my copy NFTs are invalid.

On the other hand, this criticism can go too far. Some people claim the entire blockchain/cryptocurrency market is complete fiction. This isn’t true — there’s lots of obvious value in transactions that are carried out by code rather than by humans.

For example, an oil company might sell tokens for oil futures, allowing people to trade such futures on the blockchain. Ultimately, though, the value of such tokens comes down to faith in the original issuer that they’ll deliver on the promise — that the controller of the token will eventually get something in the real world. There are lots of companies being successful with this sort of thing, such as the BAT token used in the “Brave” web browser that provides websites with micropayment revenue instead of advertising revenue.

Thus, the difference here is that cryptocurrencies are part fiction, part real — tied to real world things. But NFTs representing artwork are pretty much completely fiction. They confer no control over the artwork in the real world. Whatever tie a token has to the artwork is purely in your imagination.

Deconstructing that $69million NFT

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/03/deconstructing-that-69million-nft.html

“NFTs” have hit the mainstream news with the sale of an NFT based digital artwork for $69 million. I thought I’d write up an explainer. Specifically, I deconstruct that huge purchase and show what actually was exchanged, down to the raw code. (The answer: almost nothing).

The reason for this post is that every other description of NFTs describe what they pretend to be. In this blogpost, I drill down on what they actually are.

Note that this example is about “NFT artwork”, the thing that’s been in the news. There are other uses of NFTs, which work very differently than what’s shown here.

tl;dr

I have long bit of text explaining things. Here is the short form that allows you to drill down to the individual pieces.

  • Beeple created a piece of art in a file
  • He created a hash that uniquely, and unhackably, identified that file
  • He created a metadata file that included the hash to the artwork
  • He created a hash to the metadata file
  • He uploaded both files (metadata and artwork) to the IPFS darknet decentralized file sharing service
  • He created, or minted a token governed by the MakersTokenV2 smart contract on the Ethereum blockchain
  • Christies created an auction for this token
  • The auction was concluded with a payment of $69 million worth of Ether cryptocurrency. However, nobody has been able to find this payment on the Ethereum blockchain, the money was probably transferred through some private means.
  • Beeple transferred the token to the winner, who transferred it again to this final Metakovan account
Each of the link above allows you to drill down to exactly what’s happening on the blockchain. The rest of this post discusses things in long form.

Why do I care?

Well, you don’t. It makes you feel stupid that you haven’t heard about it, when everyone is suddenly talking about it as if it’s been a thing for a long time. But the reality, they didn’t know what it was a month ago, either. Here is the Google Trends graph to prove this point — interest has only exploded in the last couple months:

The same applies to me. I’ve been aware of them (since the CryptoKitties craze from a couple years ago) but haven’t invested time reading source code until now. Much of this blogpost is written as notes as I discover for myself exactly what was purchased for $69 million, reading the actual transactions.

So what is it?

My definition: “Something new that can be traded on a blockchain that isn’t a fungible cryptocurrency”.
In this post, I’m going to explain in technical details. Before this, you might want to pause and see what everyone else is saying about it. You can look on Wikipedia to answer that question, or look at the following definition from CNN (the first result when I google it):

Non-fungible tokens, or NFTs, are pieces of digital content linked to the blockchain, the digital database underpinning cryptocurrencies such as bitcoin and ethereum. Unlike NFTs, those assets are fungible, meaning they can be replaced or exchanged with another identical one of the same value, much like a dollar bill.

You can also get a list of common NFT systems here. While this list of NFT systems contains a lot of things related to artwork (as described in this blogpost), a lot aren’t. For example, CryptoKitties is an online game, not artwork (though it too allows ties to pictures of the kitties).

What is fungible?

Let’s define the word fungible first. The word refers to goods you purchase that can be replaced by an identical good, like a pound of sugar, an ounce of gold, a barrel of West Texas Intermediate crude oil. When you buy one, you don’t care which one you get.

In contrast, an automobile is a non-fungible good — if you order a Tesla Model 3, you won’t be satisfied with just any car that comes out of the factory, but one that matches the color and trim that you ordered. Art work is a well known non-fungible asset — there’s only one Mona Lisa painting in the world, for example.

Dollar bills and coins are fungible tokens — they represent the value printed on the currency. You can pay your bar bill with any dollars. 

Cryptocurrencies like Bitcoin, ZCash, and Ethereum are also “fungible tokens”. That’s where they get their value, from their fungibility.

NFTs, or non-fungible tokens, is the idea of trading something unique (non-fungible, not the same as anything else) on the blockchain. You can trade them, but each is unique, like a painting, a trading card, a rare coin, and so on.

This is a token  — it represents a thing. You aren’t trading an artwork itself on the blockchain, but a token that represents the artwork. I mention this because most descriptions about NFTs are that you are buying artwork — you aren’t. Instead, you are buying a token that points to the artwork.

The best real world example is a receipt for purchase. Let’s say you go to the Louvre and buy the Mona Lisa painting, and they give you a receipt attesting to the authenticity of the transaction. The receipt is not the artwork itself, but something that represents the artwork. It’s proof you legitimately purchased it — that you didn’t steal it. If you ever resell the painting, you’ll probably need something like this proving the provenance of the piece.

Show me an example!

So let’s look an at an example NFT, the technical details, to see how it works. We might as well use this massive $69 million purchase as our example. Some news reports describing the purchase are here: [1] [2] [3].

None of these stories say what actually happened. They say the “artwork was purchased”, but what does that actually mean? We are going to deconstruct that here. (The answer is: the artwork wasn’t actually purchased).


What was the artwork?

It’s a piece created by an artist named “Beeple” (Mike Winkelmann), called “Everydays: The First 5000 Days“. It’s a 500-megapixel image, which is about 300-megabytes in size. A thumbnail of this work is shown below.

So the obvious question is where is this artwork? Is it somewhere on the blockchain? Well, no, the file is 300-megabytes in size, much too large to put on the blockchain. Instead, the file exists somewhere out in cyberspace (described below).
What exists on the blockchain is a unique fingerprint linking to the file, known as a hash.
What is a hash?

It’s at this point we need to discuss cryptography: it’s not just about encryption, but also random numbers, public keys, and hashing.

A “hash” passes all the bytes of a file through an algorithm to generate a short signature or fingerprint unique to that file. No two files with different contents can have the same hash. The most popular algorithm is SHA-256, which produces a 256-bit hash.

We call it a cryptographic hash to differentiate it from weaker algorithms. With a strong algorithm, it’s essentially impossible for a hacker to create a different file that has the same hash — even if the hacker tried really hard.

Thus, the hash is the identity of the file. The identity of the artwork in question is not the title of the piece mentioned above, other pieces of art can also be given that title. Instead, the identity of the artwork is its hash. Other pieces of artwork cannot have the same hash.

For this artwork, that 300-megabyte file is hashed, producing a 256-bit value. Written in hex, this value is:

6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017

Hexadecimal results in long strings. There are shorter ways of representing hashes. One is a format called MultiHash. It’s value is shown below. This refers to the same 256-bits, and thus the two forms equivalent, they are simply displayed in different ways.

QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA

This is the identity of the artwork. If you want to download the entire 300-megabyte file, simply copy and paste that into google, and it’ll lead you to someplace in cyberspace where you can download it. Once you download it, you can verify the hash, such as with the command-line tool OpenSSL:

$ openssl dgst -sha256 everdays5000.jfif

SHA256(everdays5000.jfif)= 6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017

The above is exactly what I’ve done — I downloaded the file from cyberspace, named it “everydays5000.jfif”, and then calculated the hash to see if it matches. As you can tell by looking at my result with the above hash, they do match, so I know I have an exact copy of the artwork.


Where to download the image from cyberspace?

Above, I downloaded the file in order to demonstrate calculating the hash. It doesn’t live on the blockchain, so where does it live?

There’s two answers. The first answer is potentially anywhere in cyberspace. Thousands of people have downloaded the file onto the personal computers, so obviously it exists on their machines — you just can’t get at it. If you ever do come across it somewhere, you can always verify it’s the exact copy by looking at the hash.

The second answer is somewhere on the darknet. The term “darknet” refers to various systems on the Internet other than the web. Remember, the “web” is not the “Internet”, but simply one of many services on the Internet.

The most popular darknet services are decentralized file sharing systems like BitTorrent and IPFS. In much the same way that blockchains are decentralized transaction services, these two system are decentralized file services. When something is too big to live on the blockchain, it often lives on the darknet, usually via IPFS.

The way these services identify files is through their hashes. If you know their hash, you can stick it into one of these services and find it. Thus, if you want to find this file on IPFS, download some IPFS aware software, and plug in the hash.

There’s an alternative privacy-focused browser called “Brave” that includes darknet features (TOR, BitTorrent, and IPFS). To download this file using Brave, simply use the following URL:

ipfs://QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA

But an easier way is to use one of the many IPFS gateways. These are web servers that will copy a file off the darknet and make it available to you. Here is a URL using one of those gateways:

https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA

If you click on this link within your browser, you’ll download the 300-megabyte file from the IPFS darknet. It’ll take a while, the service is slow. Once you get it, you can verify the hashes match. But since the URL is based on the hash, of course they should match, unless there was some error in transmission.

So this hash is on the blockchain?

Well, it could’ve been, but it wasn’t. Instead, the hash that’s on the blockchain points to a file containing metadata — and it’s the metadata that points to the hash.

In other words, it’s a chain of hashes. The hash on the blockchain (as we’ll see below) is this one here (I’ve made it a link so you can click on it to see the raw data):

QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz

When you click on this, you see a bunch of JSON data. Below, I’ve stripped away the uninteresting stuff to show the meaningful bits;

title:”EVERYDAYS: THE FIRST 5000 DAYS” 

description:”I made a picture from start to finish every single day from May 1st, 2007 – January 7th, 2021.  This is every motherfucking one of those pictures.” 

digital_media_signature:”6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017” 

raw_media_file:”https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA

Now remember that due to the magic of cryptographic hashes, this chain can’t be broken. One hash leads to the next, such that changing any single bit breaks the chain. Indeed, that’s what a “blockchain” is — a hash chain. Changing any bit of information anywhere on the Bitcoin blockchain is immediately detectable, because it throws off the hash calculations.

So we have a chain: 

hash -> metadata -> hash -> artwork

So if you own the root, you own the entire chain.

Note that this chain seems unbreakable here, in this $69 million NFT token. However, in a lot of other tokens, it’s not. I mean, the hash chain itself doesn’t promise much (it simply points at the artwork, giving no control over it), but other NFTs promise even less.


So what, exactly, is the NFT that was bought and sold?

Here’s what Christie’s sold. Here’s how Christies describes it:

Beeple (b. 1981)
EVERYDAYS: THE FIRST 5000 DAYS
token ID: 40913
wallet address: 0xc6b0562605D35eE710138402B878ffe6F2E23807
smart contract address: 0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756
non-fungible token (jpg)
21,069 x 21,069 pixels (319,168,313 bytes)
Minted on 16 February 2021. This work is unique.

The seller is the artist Beeple. The artist created the token (shown below) and assigned their wallet address as the owner. This is their wallet address:

0xc6b0562605D35eE710138402B878ffe6F2E23807

When Beeple created the token, he did so using a smart contract that governs the rules for the token. Such smart contracts is what makes Ethereum different from Bitcoin, allowing things to be created and managed on the blockchain other than simple currency transfers. Contracts have addresses on the blockchain, too, but no person controls them — they are rules for decentralized transfer of things, with nobody (other than the code) in control.

There are many smart contracts that can manage NFTs. The one Beeple chose is known as MakersTokenV2. This contract has the following address:

0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756

Note that if you browse this link, you’ll eventually get to the code so that you can read the smart contract and see how it works. It’s a derivation of something known as ERC721 that defines the properties of a certain class of non-fungible tokens.

Finally, we get to the actual token being sold here. It is:

#40913

In other words, it’s the 40913rd token created and managed by the MakersTokenV2 contract. The full description of what Christies is selling is this token number governed by the named contract on the Ethereum blockchain:

Ethereum -> 0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756 -> 40913

We have to search the blockchain in order to find the transaction that created this token. The transaction is identified by the hash:

0x84760768c527794ede901f97973385bfc1bf2e297f7ed16f523f75412ae772b3

The smart contract is code, so in the above transaction, Beeple calls functions within the contract to create a new token, assign digital media to it (the hash), and assign himself owner of the newly created token.

After doing this, the token #40913 now contains the following information:

creator : 0xc6b0562605d35ee710138402b878ffe6f2e23807

metadataPath : QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz

tokenURI : ipfs://ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz

This is the thing that Christie’s auction house sold. As you can see in their description above, it all points to this token on the blockcahin.

Now after the auction, the next step is to transfer the token to the new owner. Again, the contract is code, so this is calling the “Transfer()” function in that code. Beeple is the only person who can do this transfer, because only he knows the private key that controls his wallet. This transfer is done in the transaction below:

0xa342e9de61c34900883218fe52bc9931daa1a10b6f48c506f2253c279b15e5bf 

token : 40913
from : 0xc6b0562605d35ee710138402b878ffe6f2e23807
to : 0x58bf1fbeac9596fc20d87d346423d7d108c5361a

That’s not the current owner. Instead, it was soon transferred again in the following transaction:

0x01d0967faaaf95f3e19164803a1cf1a2f96644ebfababb2b810d41a72f502d49 

token : 40913
from : 0x58bf1fbeac9596fc20d87d346423d7d108c5361a
to : 0x8bb37fb0f0462bb3fc8995cf17721f8e4a399629

That final address is known to belong to a person named “Metakovan”, who the press has identified as the buyer of the piece. I don’t know what that intermediary address between Beeple and Metakovan was, but it’s common in the cryptocurrency world to have many accounts that people transfer things between, so I bet it also belongs to Metakovan.

How are things transferred?

Like everything on the blockchain, control is transfered via public/private keys. Your wallet address is a hash of your public key, which everyone knows. Anybody can transfer something to your public address without you being involved.

But every public key has a matching private key. Both are generated together, because they are mathematically related. Only somebody who knows the private key that matches the wallet address can transfer something out of the wallet to another person.

Thus Beeple’s account as the following public address. But we don’t know his private key, which he has stored on a computer file somewhere.

0xc6b0562605D35eE710138402B878ffe6F2E23807

To summarize what was bought and sold

So that’s it. To summarize:

  • Beeple created a piece of art in a file
  • He created a hash that uniquely, and unhackably, identified that file
  • He created a metadata file that included the hash to the artwork
  • He created a hash to the metadata file
  • He uploaded both files (metadata and artwork) to the IPFS darknet decentralized file sharing service
  • He created, or minted a token governed by the MakersTokenV2 smart contract on the Ethereum blockchain
  • Christies created an auction for this token
  • The auction was concluded with a payment of $69 million worth of Ether cryptocurrency. However, nobody has been able to find this payment on the Ethereum blockchain, the money was probably transferred through some private means.
  • Beeple transferred the token to the winner, who transferred it again to this final Metakovan account
And that’s it.
Okay, I understand. But I have a question. WHAT IS AN NFT????

So if you’ve been paying attention, and understood everything I’ve said, then you should still be completely confused. What exactly was purchased that was worth $69 million?
If we are asking what Metakovan purchased for his $69 million, it comes down to this: the ability to transfer MakersTokenV2 #40913 to somebody else.
That’s it. That’s everything he purchased. He didn’t purchase the artwork, he didn’t purchase the copyrights, he didn’t purchase anything more than the ability to transfer that token. Even saying he owns the token is a misnomer, since the token lives on the blockchain. Instead, since only Metakovan knows the private key that controls his wallet, all that he possesses is the ability to transfer the token to the control of another private key.
It’s not even as unique as people claim. Beeple can mint another token for the same artwork. Anybody else can mint a token for Beeple’s artwork. Insignificant changes can be made to that artwork, and tokens can be minted for that, too. There’s nothing hard and fast controlled by the code — the relationship is in people’s minds.
If you are coming here asking why somebody thinks this is worth $69 million, I have no answer for you.
The conclusion

I think there are two things that are clear here:
  • This token is not going to be meaningful to most of us: who cares if the token points to a hash that eventually points to a file freely available on the Internet?
  • This token is meaningful to those in the “crypto” (meaning “cryptocurrency”) community, but it’s in their minds, rather than something hard and fast controlled by code or cryptography.
In other words, the work didn’t sell for $69 million of real money.
For one thing, it’s not the work that was traded, or rights or control over that work. It’s simply a token that pointed to the work.
For another thing, it was sold for 42329.453 ETH, not $dollars. Early adopters with lots of cryptocurrency are likely to believe the idea that the token is meaningful, whereas outsiders with $dollars don’t.
An NFT is ultimately like those plaques you see next to paintings in a museum telling people about the donor or philanthropist involved — only this plaque is somewhere where pretty much nobody will see it.

We are living in 1984 (ETERNALBLUE)

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/02/we-are-living-in-1984-eternalblue.html

In the book 1984, the protagonist questions his sanity, because his memory differs from what appears to be everybody else’s memory.

The Party said that Oceania had never been in alliance with Eurasia. He, Winston Smith, knew that Oceania had been in alliance with Eurasia as short a time as four years ago. But where did that knowledge exist? Only in his own consciousness, which in any case must soon be annihilated. And if all others accepted the lie which the Party imposed—if all records told the same tale—then the lie passed into history and became truth. ‘Who controls the past,’ ran the Party slogan, ‘controls the future: who controls the present controls the past.’ And yet the past, though of its nature alterable, never had been altered. Whatever was true now was true from everlasting to everlasting. It was quite simple. All that was needed was an unending series of victories over your own memory. ‘Reality control’, they called it: in Newspeak, ‘doublethink’.

I know that EternalBlue didn’t cause the Baltimore ransomware attack. When the attack happened, the entire cybersecurity community agreed that EternalBlue wasn’t responsible.

But this New York Times article said otherwise, blaming the Baltimore attack on EternalBlue. And there are hundreds of other news articles [eg] that agree, citing the New York Times. There are no news articles that dispute this.

In a recent book, the author of that article admits it’s not true, that EternalBlue didn’t cause the ransomware to spread. But they defend themselves as it being essentially true, that EternalBlue is responsible for a lot of bad things, even if technically, not in this case. Such errors are justified, on the grounds they are generalizations and simplifications needed for the mass audience.

So we are left with the situation Orwell describes: all records tell the same tale — when the lie passes into history, it becomes the truth.

Orwell continues:

He wondered, as he had many times wondered before, whether he himself was a lunatic. Perhaps a lunatic was simply a minority of one. At one time it had been a sign of madness to believe that the earth goes round the sun; today, to believe that the past is inalterable. He might be ALONE in holding that belief, and if alone, then a lunatic. But the thought of being a lunatic did not greatly trouble him: the horror was that he might also be wrong.

I’m definitely a lunatic, alone in my beliefs. I sure hope I’m not wrong.


Update: Other lunatics document their struggles with Minitrue:

Review: Perlroth’s book on the cyberarms market

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/02/review-perlroths-book-on-cyberarms.html

New York Times reporter Nicole Perlroth has written a book on zero-days and nation-state hacking entitled “This Is How They Tell Me The World Ends”. Here is my review.

I’m not sure what the book intends to be. The blurbs from the publisher implies a work of investigative journalism, in which case it’s full of unforgivable factual errors. However, it reads more like a memoir, in which case errors are to be expected/forgivable, with content often from memory rather than rigorously fact checked notes.

But even with this more lenient interpretation, there are important flaws that should be pointed out. For example, the book claims the Saudi’s hacked Bezos with a zero-day. I claim that’s bunk. The book claims zero-days are “God mode” compared to other hacking techniques, I claim they are no better than the alternatives, usually worse, and rarely used.

But I can’t really list all the things I disagree with. It’s no use. She’s a New York Times reporter, impervious to disagreement.

If this were written by a tech journalist, then criticism would be the expected norm. Tech is full of factual truths, such as whether 2+2=5, where it’s possible for a thing to be conclusively known. All journalists make errors — tech journalists are constantly making small revisions correcting their errors after publication.

The best example of this is Ars Technica. They pride themselves on their reader forums, where readers comment, opine, criticize, and correct stories. Sometimes readers add more interesting information to the story, providing free content to other readers. Sometimes they fix errors.

It’s often unpleasant for the journalists who steel themselves after hitting “Submit…”. They have a lot of practice defending or correcting every assertion they make, from both legitimate and illegitimate criticism. This makes them astoundingly good journalists — mistakes editors miss readers don’t. They get trained fast to deal with criticism.

The mainstream press doesn’t have this tradition. To be fair, it couldn’t. Tech forums have techies with knowledge and experience, while the mainstream press has ignorant readers with opinions. Regardless of the story’s original content it’ll devolve into people arguing about whether Epstein was murdered (for example).

Nicole Perlroth is a mainstream reporter on a techy beat. So you see a conflict here between the expectation both sides have for each other. Techies expect a tech journalist who’ll respond to factual errors, she doesn’t expect all this criticism. She doesn’t see techie critics for what they are — subject matter experts that would be useful sources to make her stories better. She sees them as enemies that must be ignored. This makes her stories sloppy by technical standards. I hate that this sounds like a personal attack when it’s really more a NYTimes problem — most of their cyber stories struggle with technical details, regardless of author.

This problem is made worse by the fact that the New York Times doesn’t have “news stories” so much as “narratives”. They don’t have neutral stories reporting what happened, but narratives explaining a larger point.

A good example is this story that blames the Baltimore ransomware attack on the NSA’s EternalBlue. The narrative is that EternalBlue is to blame for damage all over the place, and it uses the Baltimore ransomware as an example. However, EternalBlue wasn’t responsible for that particular ransomware — as techies point out.

Perlroth doesn’t fix the story. In her book, she instead criticizes techies for focusing on “the technical detail that in this particular case, the ransomware attack had not spread with EternalBlue”, and that techies don’t acknowledge “the wreckage from EternalBlue in towns and cities across the country”.

It’s a bizarre response from a journalist, refusing to fix a falsehood in a story because the rest of the narrative is true.

Some of the book is correct, telling you some real details about the zero-day market. I can’t say it won’t be useful to some readers, though the useful bits are buried in a lot of non-useful stuff. But most of the book is wrong about the zero-day market, a slave to the narrative that zero-days are going to end the world. I mean, I should say, I disagree with the narrative and her political policy ideas — I guess it’s up to you to decide for yourself if it’s “wrong”. Apart from inaccuracies, a lot is missing — for example, you really can’t understand what a “zero-day” is without also understanding the 40 year history of vuln-disclosure.

I could go on a long spree of corrections, and others have their own long list of inaccuracies, but there’s really no point. She’s already defended her book as being more of a memoir than a work of journalistic integrity, so her subjective point of view is what it’s about, not facts. Her fundamental narrative of the Big Bad Cyberarms Market is a political one, so any discussion of accuracy will be in service of political sides rather than the side of truth.

Moreover, she’ll just attack me for my “bruised male ego”, as she has already done to other expert critics.


No, 1,000 engineers were not needed for SolarWinds

Post Syndicated from Robert Graham original https://blog.erratasec.com/2021/02/no-1000-engineers-were-not-needed-for.html

Microsoft estimates it would take 1,000 to carry out the famous SolarWinds hacker attacks. This means in reality that it was probably fewer than 100 skilled engineers. I base this claim on the following Tweet:

Yes, it would take Microsoft 1,000 engineers to replicate the attacks. But it takes a large company like Microsoft 10-times the effort to replicate anything. This is partly because Microsoft is a big, stodgy corporation. But this is mostly because this is a fundamental property of software engineering, where replicating something takes 10-times the effort of creating the original thing.

It’s like painting. The effort to produce a work is often less than the effort to reproduce it. I can throw some random paint strokes on canvas with almost no effort. It would take you an immense amount of work to replicate those same strokes — even to figure out the exact color of paint that I randomly mixed together.

Software Engineering

The process of software engineering is about creating software that meets a certain set of requirements, or a specification. It is an extremely costly process verify the specification is correct. It’s like if you build a bridge but forget a piece and the entire bridge collapses.

But code slinging by hackers and open-source programmers works differently. They aren’t building toward a spec. They are building whatever they can and whatever they want. It takes a tenth, or even a hundredth of the effort of software engineering. Yes, it usually builds things that few people (other than the original programmer) want to use. But sometimes it produces gems that lots of people use.

Take my most popular code slinging effort, masscan. I spent about 6-months of total effort writing it at this point. But if you run code analysis tools on it, they’ll tell you that it would take several millions of dollars to replicate the amount of code I’ve written. And that’s just measuring the bulk code, not the numerous clever capabilities and innovations in the code.

According to these metrics, I’m either a 100x engineer (a hundred times better than the average engineer) or my claim is true that “code slinging” is a fraction of the effort of “software engineering”.

The same is true of everything the SolarWinds hackers produced. They didn’t have to software engineer code according to Microsoft’s processes. They only had to sling code to satisfy their own needs. They don’t have to train/hire engineers with the skills necessary to meet a specification, they can write the specification according to what their own engineers can produce. They can do whatever they want with the code because they don’t have to satisfy somebody else’s needs.

Hacking

Something is similarly true with hacking. Hacking a specific target, a specific way, is very hard. Hacking any target, any way, is easy.

Like most well-known hackers, I regularly get those emails asking me to hack somebody’s Facebook account. This is very hard. I can try a lot of things, and in the end, chances are I cannot succeed. On the other hand, if you ask me to hack anybody’s Facebook account, I can do that in seconds. I can download one of the many hacker dumps of email addresses, then try to log into Facebook with every email address using the password “Password1234”. Eventually I’ll fine somebody who has that password — I just don’t know who.

Hacking is overwhelmingly opportunistic. Hackers go into it not being sure who they’ll hack, or how they’ll hack. They just try a bunch of things against a bunch of targets and see what works. No two hacks are the same. You can’t look at one hack and reproduce it exactly against another target.

Well, you reproduce things a bit. Some limited techniques have become “operationalized”. A good example is “phishing”, sending emails tricking people into running software or divulging a password. But that’s usually only the start of a complete attack, getting the initial foothold into a target, rather than the full hack itself.

In other words, hacking is based a lot on luck. You can create luck for yourself by trying lots of things. But it’s hard reproducing luck.

This principle of hacking is why Stuxnet is such an incredible achievement. It wasn’t opportunistic hacking. It had a very narrow target that could only be hacked in a very narrow way, jumping across an “airgap” to infect the controllers into order to subtly destabilize the uranium centrifuges. With my lifetime experience with hacking, I’m amazed at Stuxnet.

But SolarWinds was no Stuxnet. Instead, it shows a steady effort over a number of years, capitalizing on the lucky result of one step to then move ahead to the next step. Replicating that chain of luck would be nearly impossible.

Business

Now let’s talk about big companies vs. startups. Every month, big companies like Apple, Microsoft, Cisco, etc. are acquiring yet another small startup that has done something that a big company cannot do. These companies often have small (but growing) market share, so it’s rarely for the market share alone that big companies acquire small ones.

Instead, it’s for the thing that the startup produced. The reason big companies acquire outsiders is again because of the difficulty that insiders would have in reproducing the work. The engineering managers are asked how much it would cost insiders to reproduce the work of the outsiders, the potential acquisition candidate. The answer is almost always “at least 10-times more than what the small company invested in building the thing”.

This is reflected by the purchase price, which is often 10-times what the original investors put into the company to build the thing. In other words, Microsoft regularly buys a company for 10-times than all the money the original investors put into the company — meaning much more than 10-times the effort it would take for their own engineers to replicate the product in question.

Thus, the question people should ask Brad Smith of Microsoft is not simply how many skilled Microsoft engineers it would take to reproduce SolarWinds, but also how many skilled Microsoft engineers it would take to reproduce the engineer effort of their last 10 acquisitions.

Conclusion

I’ve looked at the problem three different ways, from the point of view of software engineering, hacking, or business. If it takes 1,000 Microsoft engineers to reproduce the SolarWinds hacks, then that means there’s fewer than 100 skilled engineers involved in the actual hacks.

SolarWinds is probably the most consequential hack of the last decade. There are many eager to exaggerate things to serve their own agenda. Those types have been pushing this “1,000 engineer” claim. I’m an expert in all three these areas, software engineering, hacking, and business. I’ve written millions of lines of code, I’ve well known for my hacking, and I’ve sold startups. I can assure you: Microsoft’s estimate means that likely fewer than 100 skilled engineers were involved.

The deal with DMCA 1201 reform

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/12/the-deal-with-dmca-1201-reform.html

There are two fights in Congress now against the DMCA, the “Digital Millennium Copyright Act”. One is over Section 512 covering “takedowns” on the web. The other is over Section 1201 covering “reverse engineering”, which weakens cybersecurity.

Even before digital computers, since the 1880s, an important principle of cybersecurity has been openness and transparency (“Kerckhoff’s Principle”). Only through making details public can security flaws be found, discussed, and fixed. This includes reverse-engineering to search for flaws.

Cybersecurity experts have long struggled against the ignorant who hold the naive belief we should instead coverup information, so that evildoers cannot find and exploit flaws. Surely, they believe, given just anybody access to critical details of our security weakens it. The ignorant have little faith in technology, that it can be made secure. They have more faith in government’s ability to control information.

Technologists believe this information coverup hinders well-meaning people and protects the incompetent from embarrassment. When you hide information about how something works, you prevent people on your own side from discovering and fixing flaws. It also means that you can’t hold those accountable for their security, since it’s impossible to notice security flaws until after they’ve been exploited. At the same time, the information coverup does not do much to stop evildoers. Technology can work, it can be perfected, but only if we can search for flaws.

It seems counterintuitive the revealing your encryption algorithms to your enemy is the best way to secure them, but history has proven time and again that this is indeed true. Encryption algorithms your enemy cannot see are insecure. The same is true of the rest of cybersecurity.

Today, I’m composing and posting this blogpost securely from a public WiFi hotspot because the technology is secure. It’s secure because of two decades of security researchers finding flaws in WiFi, publishing them, and getting them fixed.

Yet in the year 1998, ignorance prevailed with the “Digital Millennium Copyright Act”. Section 1201 makes reverse-engineering illegal. It attempts to secure copyright not through strong technological means, but by the heavy hand of government punishment.

The law was not completely ignorant. It includes an exception allow what it calls “security testing” — in theory. But that exception does not work in practice, imposing too many conditions on such research to be workable.

The U.S. Copyright Office has authority under the law to add its own exemptions every 3 years. It has repeatedly added exceptions for security research, but the process is unsatisfactory. It’s a protracted political battle every 3 years to get the exception back on the list, and each time it can change slightly. These exemptions are still less than what we want. This causes a chilling effect on permissible research. It would be better if such exceptions were put directly into the law.

You can understand the nature of the debate by looking at those on each side.

Those lobbying for the exceptions are those trying to make technology more secure, such as Rapid7, Bugcrowd, Duo Security, Luta Security, and Hackerone. These organizations have no interest in violating copyright — their only concern is cybersecurity, finding and fixing flaws.

The opposing side includes the copyright industry, as you’d expect, such as the “DVD” association who doesn’t want hackers breaking the DRM on DVDs.

However, much of the opposing side has nothing do with copyright as such.

This notably includes the three major voting machine suppliers in the United States: Dominion Voting, ES&S, and Hart InterCivic. Security professionals have been pointing out security flaws in their equipment for the past several years. These vendors are explicitly trying to coverup their security flaws by using the law to silence critics.

This goes back to the struggle mentioned at the top of this post. The ignorant and naive believe that we need to coverup information, so that hackers can’t discover flaws. This is expressed in their filing opposing the latest 3-year exemption:

The proponents are wrong and misguided in their argument that the Register’s allowing independent hackers unfettered access to election software is a necessary – or even appropriate – way to address the national security issues raised by election system security. The federal government already has ways of ensuring election system security through programs conducted by the EAC and DHS. These programs, in combination with testing done in partnership between system providers, independent voting system test labs and election officials, provide a high degree of confidence that election systems are secure and can be used to run fair and accurate elections. Giving anonymous hackers a license to attack critical infrastructure would not serve the public interest. 

Not only does this blatantly violate Kerckhoff’s Principle stated above, it was proven a fallacy in the last two DEF CON cybersecurity conferences. These conferences bought voting machines off eBay and presented them at the conference for anybody to hack. Widespread and typical vulnerabilities were found. These systems were certified as secure by state and federal governments, yet teenagers were able to trivially bypass the security of these systems.

The danger these companies are afraid of is not a nation state actor being able to play with these systems, but of teenagers playing with their systems at DEF CON embarrassing them by pointing out their laughable security. This proves Kerckhoff’s Principle.

That’s why the leading technology firms take the opposite approach to security than election systems vendors. This includes Apple, Amazon, Microsoft, Google, and so on. They’ve gotten over their embarrassment. They are every much as critical to modern infrastructure as election systems or the power grid. They publish their flaws roughly every month, along with a patch that fixes them. That’s why you end up having to patch your software every month. Far from trying to coverup flaws and punish researchers, they publicly praise researchers, and in many cases, offer “bug bounties” to encourage them to find more bugs.

It’s important to understand that the “security research” we are talking about is always “ad hoc” rather than formal.

These companies already do “formal” research and development. They invest billions of dollars in securing their technology. But no matter how much formal research they do, informal poking around by users, hobbyists, and hackers still finds unexpected things.

One reason is simply a corollary to the Infinite Monkey Theorem that states that an infinite number of monkeys banging on an infinite number of typewriters will eventually reproduce the exact works of William Shakespeare. A large number of monkeys banging on your product will eventually find security flaws.

A common example is a parent who brings their kid to work, who then plays around with a product doing things that no reasonable person would every conceive of, and accidentally breaks into the computer. Formal research and development focuses on the known threats, but has trouble of imagining unknown threats.

Another reason informal research is successful is how the modern technology stack works. Whether it’s a mobile phone, a WiFi enabled teddy bear for the kids, a connected pacemaker jolting the grandparent’s heart, or an industrial control computer controlling manufacturing equipment, all modern products share a common base of code.

Somebody can be an expert in an individual piece of code used in all these products without understanding anything about these products.

I experience this effect myself. I regularly scan the entire Internet looking for a particular flaw. All I see is the flaw itself, exposed to the Internet, but not anything else about the system I’ve probed. Maybe it’s a robot. Maybe it’s a car. Maybe it’s somebody’s television. Maybe it’s any one of the billions of IoT (“Internet of Things”) devices attached to the Internet. I’m clueless about the products — but an expert about the flaw.

A company, even as big as Apple or Microsoft, cannot hire enough people to be experts in every piece of technology they use. Instead, they can offer bounties encouraging those who are experts in obscure bits of technology to come forward and examine their products.

This ad hoc nature is important when looking at the solution to the problem. Many think this can be formalized, such as with the requirement of contacting a company asking for permission to look at their product before doing any reverse-engineering.

This doesn’t work. A security researcher will buy a bunch of used products off eBay to test out a theory. They don’t know enough about the products or the original vendor to know who they should contact for permission. This would take more effort to resolve than the research itself.

It’s solely informal and ad hoc “research” that needs protection. It’s the same as with everything else that preaches openness and transparency. Imagine if we had freedom of the press, but only for journalists who first were licensed by the government. Imagine if it were freedom of religion, but only for churches officially designated by the government.

Those companies selling voting systems they promise as being “secure” will never give permission. It’s only through ad hoc and informal security research, hostile to the interests of those companies, that the public interest will be advanced.

The current exemptions have a number of “gotchas” that seem reasonable, but which create an unacceptable chilling effect.

For example, they allow informal security research “as long as no other laws are violated”. That sounds reasonable, but with so many laws and regulations, it’s usually possible to argue they violated some obscure and meaningless law in their research. It means a security researcher is now threatened by years in jail for violating a regulation that would’ve resulted in a $10 fine during the course of their research.

Exceptions to the DMCA need to be clear and unambiguous that finding security bugs is not a crime. If the researcher commits some other crime during research, then prosecute them for that crime, not for violating the DMCA.

The strongest opposition to a “security research exemption” in the DMCA is going to come from the copyright industry itself — those companies who depend upon copyright for their existence, such as movies, television, music, books, and so on.

The United States position in the world is driven by intellectual property. Hollywood is not simply the center of American film industry, but the world’s film industry. Congress has an enormous incentive to protect these industries. Industry organizations like the RIAA and MPAA have enormous influence on Congress.

Many of us in tech believe copyright is already too strong. They’ve made a mockery of the Constitution’s statement of copyrights being for a “limited time”, which now means works copyrighted decades before you were born will still be under copyright decades after you die. Section 512 takedown notices are widely abused to silence speech.

Yet the copyright-protected industries perceive themselves as too weak. Once a copyrighted work is post to the Internet for anybody to download, it because virtually impossible to remove (like removing pee from a pool). Takedown notices only remove content from the major websites, like YouTube. They do nothing to remove content from the “dark web”.

Thus, they jealously defend against any attempt that would weaken their position. This includes “security research exemptions”, which threatens “DRM” technologies that prevent copying.

One fear is of security researchers themselves, that in the process of doing legitimate research that they’ll find and disclose other secrets, such as the encryption keys that protect DVDs from being copied, that are built into every DVD player on the market. There is some truth to that, as security researchers have indeed publish some information that the industries didn’t want published, such as the DVD encryption algorithm.

The bigger fear is that evildoers trying to break DRM will be free to do so, claiming their activities are just “security research”. They would be free to openly collaborate with each other, because it’s simply research, while privately pirating content.

But these fears are overblown. Commercial piracy is already forbidden by other laws, and underground piracy happens regardless of the law.

This law has little impact on whether reverse-engineering happens so much as impact whether the fruits of research are published. And that’s the key point: we call it “security research”, but all that’s meaningful is “published security research”.

In other words, we are talking about a minor cost to copyright compared with a huge cost to cybersecurity. The cybersecurity of voting machines is a prime example: voting security is bad, and it’s not going to improve until we can publicly challenge it. But we can’t easily challenge voting security without being prosecuted under the DMCA.

Conclusion

The only credible encryption algorithms are public ones. The only cybersecurity we trust is cybersecurity that we can probe and test, where most details are publicly available. That such transparency is necessary to security has been recognized since the 1880s with Kerckhoff’s Principle. Yet, the naive still believe in coverups. As the election industry claimed in their brief: “Giving anonymous hackers a license to attack critical infrastructure would not serve the public interest”. Giving anonymous hackers ad hoc, informal access to probe critical infrastructure like voting machines not only serves the public interest, but is necessary to the public interest. As has already been proven, voting machines have cybersecurity weaknesses that they are covering up, which can only be revealed by anonymous hackers.

This research needs to be ad hoc and informal. Attempts at reforming the DMCA, or the Copyright Office’s attempt at exemptions, get modified into adding exemptions for formal research. This ends up having the same chilling effect on research while claiming to allow research.

Copyright, like other forms of intellectual property, is important, and it’s proper for government to protect it. Even radical anarchists in our industry want government to protect “copyleft”, the use of copyright to keep open-source code open.

But it’s not so important that it should allow abuse to silence security research. Transparency and ad hoc testing is critical to research, and is more and more often being silenced using copyright law.

Why Biden: Principle over Party

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/10/why-biden-principle-over-party.html

There exist many #NeverTrump Republicans who agree that while Trump would best achieve their Party’s policies, that he must nonetheless be opposed on Principle. The Principle at question isn’t about character flaws, such as being a liar, a misogynist, or a racist. The Principle isn’t about political policies, such as how to handle the coronavirus pandemic, or the policies Democrats want. Instead, the Principle is that he’s a populist autocrat who is eroding our liberal institutions (“liberal” as in the classic sense).

Countries don’t fail when there’s a leftward shift in government policies. Many prosperous, peaceful European countries are to the left of Biden. What makes prosperous countries fail is when civic institutions break down, when a party or dear leader starts ruling by decree, such as in the European countries of Russia or Hungary.

Our system of government is like football. While the teams (parties) compete vigorously against each other, they largely respect the rules of the game, both written and unwritten traditions. They respect each other — while doing their best to win (according to the rules), they nonetheless shake hands at the end of the match, and agree that their opponents are legitimate.

The rules of the sport we are playing is described in the Wikipedia page on “liberal democracy“.

Sport matches can be enjoyable even if you don’t understand the rules. The same is true of liberal democracy: there’s little civic education in the country so most don’t know the rules game. Most are unaware even that there are rules.

You see that in action with this concern over Trump conceding the election, his unwillingness to commit to a “peaceful transfer of power”. His supporters widely believed this is a made-up controversy, a “principle” created on the spot as just another way to criticize Trump.

But it’s not a new principle. A “peaceful transfer of power” is the #1 bedrock principle from which everything else derives. It’s the first way we measure whether a country is actually the “liberal democracy” that they claim. For example, the fact that Putin has been in power for 20 years makes us doubt that they are really the “liberal democracy” that they claim. The reason you haven’t heard of it, the reason it isn’t discussed much, is that it’s so unthinkable that a politician would reject it the way Trump has.

The historic importance of this principle can be seen when you go back and read the concession speeches of HillaryMcCainGore, and Bush Sr., and Carter, you see that all of them stressed the legitimacy of their opponent’s win, and a commitment to a peaceful transfer of power. (It goes back further than that, to the founding of our country, but I can’t link every speech). The following quote from Hillary’s concession to Trump demonstrates this principle:

But I still believe in America and I always will. And if you do, then we must accept this result and then look to the future. Donald Trump is going to be our president. We owe him an open mind and the chance to lead.

Our constitutional democracy enshrines the peaceful transfer of power and we don’t just respect that, we cherish it. It also enshrines other things; the rule of law, the principle that we are all equal in rights and dignity, freedom of worship and expression. We respect and cherish these values too and we must defend them.

If this were Trump’s only failure, then we could excuse it and work around it. As long as he defended all the other liberal institutions, then we could accept one aberration.

The problem is that he’s attacking every institution. He’s doing his best to act like a populist autocrat we see in non-democratic nations. Our commitment to liberal institutions is keeping him in check — but less and less well as time goes on. For example, when Jeff Sessions refused to politicize the DoJ, Trump replaced him with Barr, who notoriously has corrupted the DoJ to serve Trump’s political interests. I mean this only as yet another example — a complete enumeration of his long train of abuses and usurpations would take many more pages than I intend for this blogpost.

Four more years of Trump means four more years of erosion of our liberal democratic institutions.

The problem isn’t just what Trump can get away with, but the precedent he sets for his successor.

The strength of our liberal institutions to hold the opposing Party in check comes only from our defense of those institutions when our own Party is in power. When we cross the line, it means the opposing party will feel justified in likewise crossing the line when they get power.

We see that with the continual erosion of the Supreme Court over the last several decades. It’s easy to blame the other Party for this, but the reality is that both parties have been been going back and forth corrupting this institution. The Republicans refusal to confirm Garland and their eagerness to confirm Barrett is egregious, but justified by the Democrats use of the nuclear option when they were in power. When Biden gets power, he’s going to try to pack the court, which historically has been taught to school children as a breakdown of liberal democratic institutions, but which will be justified by the Republican’s bad behavior in eroding those institutions. We might be able to avert court packing if Biden gets into power now, but we won’t after four more years of Trump court appointments.

It’s not just the politicization of the Supreme Court, it’s the destruction of all our institutions. Somebody is going to have to stand for Principle over Party and put a stop to this. That is the commitment of the #NeverTrump. The Democrats are going to be bad when they get into power, but stopping them means putting our own house in order first.

This post makes it look like I’m trying to convince fellow Republicans why they should vote against Trump, and I suppose it is. However, my real purpose is to communicate with Democrats. My Twitter feed is full of leftists who oppose liberal democratic institutions even more than Trump. I want evidence to prove that I actually stand for Principle, and not just Party.

No, that’s not how warrantee expiration works

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/10/no-thats-not-how-warrantee-expiration.html

The NYPost Hunter Biden story has triggered a lot of sleuths obsessing on technical details trying to prove it’s a hoax. So far, these claims are wrong. The story is certainly bad journalism aiming to misinform readers, but it has not yet been shown to be a hoax.

In this post, we look at claim the timelines don’t match up with the manufacturing dates of the drives. Sleuths claim to prove the drives were manufactured after the events in question, based on serial numbers.

What this post will show is that the theory is wrong. Manufacturers pad warrantee periods. Thus, you can’t assume a date of manufacture based upon the end of a warrantee period.

The story starts with Hunter Biden (or associates) dropping off a laptop at a repair shop because of water damage. The repair shop made a copy of the laptop’s hard drive, stored on an external drive. Later, the FBI swooped in and confiscated both the laptop and that external drive.

The serial numbers of both devices are listed in the subpoena published by the NYPost:

You can enter these serial numbers in the support pages at Apple (FVFXC2MMHV29) and Western Digital (WX21A19ATFF3) to discover precisely what hardware this is, and when the warrantee periods expire — and presumably, when they started.

In the case of that external drive, the 3-year warrantee expires May 17, 2022 — meaning the drive was manufactured on May 17, 2019 (or so they claim). This is a full month after the claimed date of April 12, 2019, when the laptop was dropped off at the repair shop.

There are lots of explanations for this. One of which is that the drive subpoenaed by the government (on Dec 9, 2019) was a copy of the original drive.

But a simpler explanation is this: warrant periods are padded by the manufacturer by several months. In other words, if the warrantee ends May 17, it means the drive was probably manufactured in February.

I can prove this. Coincidentally, I purchased a Western Digital drive a few days ago. If we used the same logic as above to work backward from warrantee expiration, then it means the drive was manufactured 7 days in the future.

Here is a screenshot from Amazon.com showing I purchased the drive Oct 12.

Here is a picture of the drive itself, from which you can read the serial number:

The Date of Manufacture (DOM) is printed right on the device as July 31, 2020.

But let’s see what Western Digital reports as the end of warrantee period:

We can see that the warrantee ends on Oct 25, 2025. According to Amazon where I purchased the drive, the warrantee period is 5 years:

Thus, if we were to insist on working back from the expiration date precisely 5 years, then that means this drive was manufactured 7 days in the future. Today’s date is Oct 16, the warrantee starts Oct 23. 

The reality is that Western Digital has no idea when the drive arrives, and hence when I (as the consumer) expect the warrantee period to start. Thus, they pad the period by a few months to account for how long they expect the device to be in the sales channel, the period between manufacture and when they are likely to arrive at the customer. Computer devices rapidly depreciate so are unlikely to be in the channel more than a few months.

Thus, instead of proving the timeline wrong, the serial number and warrantee expiration shows the timeline right. This is exactly the sort of thing you’d expect if the repair shop recovered the files onto a new external drive.

Another issue in the thread is about the “recovery” of files, which the author claims is improbable. In Apple’s latest MacBooks, if the motherboard is damaged, then it’s impractical to recover the data from the drive. These days, in the year 2020, the SSD drive inside notebooks are soldered right on the motherboard, and besides, encrypted with a TPM chip on the motherboard.

But here we are talking about a 2017 MacBook Pro which apparently had a removeable SSD. Other notebooks by Apple have had special connectors for reading SSDs from dead motherboards. Thus, recovery of files for notebooks of that era is not as impossible as a it sounds.

Moreover, maybe the repair shop fixed the notebook. “Water damage” varies in extent. It may have been possible to repair the damage and boot the device, at least in some sort of recovery mode.

Conclusion

Grabbing serial numbers and looking them is exactly what hackers should be doing in stories like this. Challenging the narrative is great — especially with regards to the NYPost story, which is clearly bad journalism.

On the other hand, it goes both ways. We should be even more concerned about challenging those things that agree with us. This is a great example — it appears we’ve found conclusive evidence that the NYPost story was a hoax. We need to carefully challenge that, too.

No, font errors mean nothing in that NYPost article

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/10/no-font-errors-mean-nothing-in-that.html

The NYPost has an article on Hunter Biden emails. Critics claim that these don’t look like emails, and that there are errors with the fonts, thus showing they are forgeries. This is false. This is how Apple’s “Mail” app prints emails to a PDF file. The font errors are due to viewing PDF files within a web browser — you don’t see them in a PDF app.

In this blogpost, I prove this.

I’m going to do this by creating forged email. The point isn’t to prove the email wasn’t forged, it could easily have been — the NYPost didn’t do due diligence to prove they weren’t forged. The point is simply that that these inexplicable problems aren’t evidence of forgery. All emails printed by the Mail app to a PDF, then displayed with Scribd, will look the same way.

To start with, we are going to create a simple text file on the computer called “erratarob-conspire.eml”. That’s what email messages are at the core — text files. I use Apple’s “TextEdit” app on my MacBook to create the file.

The structure of an email is simple. It has a block of “metadata” consisting of fields separated by a colon “:” character. This block ends with a blank line, after which we have the contents of the email.

Clicking on the file launches Apple’s “Mail” app. It opens the email and renders it on the screen like this:
Notice how the “Mail” app has reformatted the metadata. In addition to displaying the email, it’s making it simple to click on the names to add them to your address book. That’s why there is a (VP) to the right on the screen — it creates a placeholder icon for every account in your address book. I note this because in my version of Mail, the (VP) doesn’t get printed to the PDF, but it does appear in the PDF on the NYPost site. I assume this is because their Mail app is 3 years older than mine.
One thing I can do with emails is to save them as a PDF document.

This creates a PDF file on the disk that we can view like any other PDF file. Note that yet again, the app has reformatted the metadata, different from both how it displayed it on the screen and how it appears in the original email text.

Sometimes web pages, such as this one, wants to display the PDF within the web page. The Scribd website can be used for this purpose, causing PDFs to appear like below:

Erratarob Conspire by asdfasdf

How this shows up on your screen will change depending on a lot of factors. For most people, though, they’ll see slight font problems, especially in the name “Hunter Biden”. Below is a screenshot of how it appears in my browser. You can clearly see how the ‘n’ and ‘t’ characters crowd each other in the name “Hunter”.

Again, while this is a fake email message, any real email message would show the same problems. It’s a consequence of the process of generating a PDF and using Scribd. You can just click through on Scribd to download the original PDF (either mine or the one on the NYPost site), and then use your favorite PDF viewing app. This gets rid of Scribd’s rendering errors.

Others have claimed that this isn’t how email works, that email clients always show brackets around email message, using the < and > characters. Usually, yes, but not in all cases. Here, Apple’s “Mail” app is clearly doing a lot more work to make things look pretty, not showing them.

There are some slight difference between what my 2020 MacBook produces and what the original NYPost article shows. As we can see from the metadata on their PDF, it was produced by a 2017 MacBook. My reproduction isn’t exact, but it’s pretty darn close that we don’t need to doubt it.
We would just apply Occam’s Razor here. Let’s assume that the emails were forged. Then the easiest way would be to create a text document like I’ve shown above and open it in an email client to print out the message. It took me less than a minute, including carefully typing an unfamiliar Russian name. The hardest way would be to use Photoshop or some other technique to manipulate pixels, causing those font errors. Therefore, if you see font problems, the most likely explanation is simply “something I don’t understand” and not “evidence of the conspiracy”.
Conclusion

The problem with conspiracy theories is that everything not explained is used to “prove” the conspiracy.
We see that happening here. If there are unexplained formatting errors in the information the NYPost published, and the only known theory that explains them is a conspiracy, then they prove the conspiracy.
That’s stupid. Unknown things may simply be unknown, that while you can’t explain them doesn’t mean they are unexplainable. That’s what we see here: people are have convinced themselves they have “proof” because of unexplainable formatting errors, when in fact, such formatting can be explained.
The NYPost story has many problems. It is data taken out of context in an attempt to misinform the reader. We know it’s a garbage story, even if all the emails are authentic. We don’t need to invent conspiracy theories to explain it.

Yes, we can validate leaked emails

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/10/yes-we-can-validate-leaked-emails.html

When emails leak, we can know whether they are authenticate or forged. It’s the first question we should ask of today’s leak of emails of Hunter Biden. It has a definitive answer.

Today’s emails have “cryptographic signatures” inside the metadata. Such signatures have been common for the past decade as one way of controlling spam, to verify the sender is who they claim to be. These signatures verify not only the sender, but also that the contents have not been altered. In other words, it authenticates the document, who sent it, and when it was sent.

Crypto works. The only way to bypass these signatures is to hack into the servers. In other words, when we see a 6 year old message with a valid Gmail signature, we know either (a) it’s valid or (b) they hacked into Gmail to steal the signing key. Since (b) is extremely unlikely, and if they could hack Google, they could a ton more important stuff with the information, we have to assume (a).

Your email client normally hides this metadata from you, because it’s boring and humans rarely want to see it. But it’s still there in the original email document. An email message is simply a text document consisting of metadata followed by the message contents.

It takes no special skills to see metadata. If the person has enough skill to export the email to a PDF document, they have enough skill to export the email source. If they can upload the PDF to Scribd (as in the story), they can upload the email source. I show how to below.

To show how this works, I send an email using Gmail to my private email server (from gmail.com to robertgraham.com).

The NYPost story shows the email printed as a PDF document. Thus, I do the same thing when the email arrives on my MacBook, using the Apple “Mail” app. It looks like the following:

The “raw” form originally sent from my Gmail account is simply a text document that looked like the following:

This is rather simple. Client’s insert details like a “Message-ID” that humans don’t care about. There’s also internal formatting details, like the fact that this is a “plain text” message rather than an “HTML” email.

But this raw document was the one sent by the Gmail web client. It then passed through Gmail’s servers, then was passed across the Internet to my private server, where I finally retrieved it using my MacBook.
As email messages pass through servers, the servers add their own metadata.
When it arrived, the “raw” document looked like the following. None of the important bits changed, but a lot more metadata was added:

The bit you care about here is the “DKIM-Signature:” metadata.

This is added by Gmail’s servers, for anything sent from gmail.com. It “authenticates” or “verifies” that this email actually did come from those servers, and that the essential content hasn’t been altered. The long strings of random-looking characters are the “cryptographic signature”. That’s what all crypto is based upon — long chunks of random-looking data.

To extract this document, I used Apple’s “Mail” client program and selected “Save As…” from the “File” menu, saving as “Raw Message Source”.

I uploaded this this document to Scrib so that anybody can download and play with it, such as verifying the signature.
To verify the email signature, I simply open the email document using Thunderbird (Firefox’s email client) with the “DKIM Verifier” extension, which validates that the signature is indeed correct. Thus we see it’s a valid email sent by Gmail and that the key headers have not been changed:

The same could be done with those emails from the purported Hunter Biden laptop. If they can be printed as a PDF (as in the news story) then they can also be saved in raw form and have their DKIM signatures verified.

This sort of thing is extraordinarily easy, something anybody with minimal computer expertise can accomplish. It would go a long way to establishing the credibility of the story, proving that the emails were not forged. The lack leads me to believe that nobody with minimal computer expertise was involved in the story.
The story contains the following paragraph about one of the emails recovered from the drive (the smoking gun claiming Pozharskyi met Joe Biden), claiming how it was “allegedly sent”. Who alleges this? If they have the email with a verifiable DKIM signature, no “alleging” is needed — it’s confirmed. Since Pozharskyi used Gmail, we know the original would have had a valid signature.

The lack of unconfirmed allegations that could be confirmed seems odd for a story of this magnitude.

Note that the NYPost claims to have a copy of the original, so they should be able to do this sort of verification:

However, while they could in theory, it appears they didn’t in practice. The PDF displayed in the story is up on Scribd, allowing anybody to download it. PDF’s, like email, also have metadata, which most PDF viewers will show you. It appears this PDF was not created after Sunday when the NYPost got the hard drive, but back in September when Trump’s allies got the hard drive.

Conclusion

It takes no special skills to do any of this. If the person has enough skill to export the email to a PDF document, they have enough skill to export the email source. Instead of “Export to PDF”, select “Save As … Raw Message Source”. Instead of uploading the .pdf file, upload the resulting .txt to Scribd.
At this point, a journalist wouldn’t need to verify DKIM, or consult an expert: anybody could verify it. There a ton of tools out there that can simply load that raw source email and verify it, such as the Thunderbird example I did above.

Factcheck: Regeneron’s use of embryonic stem cells

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/10/factcheck-regenerons-use-of-embryonic.html

This week, Trump’s opponents misunderstood a Regeneron press release to conclude that the REG-COV2 treatment (which may have saved his life) was created from stem cells. When that was proven false, his opponents nonetheless deliberately misinterpreted events to conclude there was still an ethical paradox. I’ve read the scientific papers and it seems like this is an issue that can be understood with basic high-school science, so I thought I’d write up a detailed discussion.

The short answer is this:

  • The drug is not manufactured in any way from human embryonic tissues.
  • The drug was tested using fetal/embryonic cells, but ones almost 50 years old, not new ones.
  • Republicans want to stop using new embryos, the ethical issue here is the continued use of old embryos, which Republican have consistently agreed to.
  • Yes, the drug is still tainted by the “embryonic stem cell” issue — just not in any of the ways that people claim it is, and not in a way that makes Republicans inconsistent.
  • Almost all medical advances of the last few decades are similarly tainted.
Now let’s do the long, complicated answer. This starts with a discussion of the science of Regeneron’s REG-COV2 treatment.
A well-known treatment that goes back decades is to take blood plasma from a recently recovered patient and give it to a recently infected patient. Blood plasma is where the blood cells are removed, leaving behind water, salts, other particles, and most importantly, “antibodies”. This is the technical concept behind the movie “Outbreak“, though of course they completely distort the science.
Antibodies are produced by the immune system to recognize and latch onto foreign things, including viruses (the rest of this discussion assumes “viruses”). They either deactivate the virus particle, or mark it to be destroyed by other parts of the immune system, or both.
After an initial infection, it takes a while for the body to produce antibodies, allowing the disease to rage unchecked. A massive injection of antibodies during this time allows the disease to be stopped before it gets very far, letting the body’s own defenses catch up. That’s the premise behind Trump’s treatment.
An alternative to harvesting natural antibodies from recently recovered patients is to manufacture artificial antibodies using modern science. That’s what Regeneron did.

An antibody is just another “protein”, the building blocks of the body. The protein is in the shape of a Y with the two upper tips formed to lock onto the corresponding parts of a virus (“antigens”). Every new virus requires a new antibody with different tips.

The SARS-COV-2 virus has these “spike” proteins on it’s surface that allow it to invade the cells in our lungs. They act like a crowbar, jamming themselves into the cell wall, then opening up a hole to allow the rest of the virus inside. Since this is the important and unique protein of the virus, it’s what most antibodies will want to lock onto.
Proteins are created from genes. A new protein, like an antibody with tips identifying a new virus, needs a new gene to create it. In other words, we need new DNA.
This happens in “white blood cells”. Inside these cells, the gene that makes antibodies can easily mutate. When the white blood cell encounters a new object, it mutates that gene slightly, makes some new antibodies, and tests them against the foreign object. The cell then divides, and the child cells do the same thing. Each generation gets better and better and better at creating antibodies. Those tips of the antibody become better and better at locking onto the infecting virus.
Before we go down into Lamarck genetics, we should point out that these genes are not passed down to children. Only a few white blood cells change their DNA, but this doesn’t affect any other cells, especially not the ones in your gonads.
The way Regeneron makes its treatment is to harvest the white blood cells, extract the gene that makes the antibody, then sticks that gene inside some hamster cells to produce copious amounts of the antibody. (Yes, hamsters, but we’ll get to that).
Sometimes human subjects aren’t available as a source of white blood cells. For example, let’s consider a disease that hasn’t infected humans yet, but which has a potential to do so. In that case, you need a factory for white blood cells that isn’t human.
Regeneron has a solution for this: transgenic mice that have the important parts of the human immune system grafted in. This allows them to inject things into the mice to cause this hypermutation of the antibody gene, which they can then harvest.
In the case of their REG-COV2 treatment, Regeneron used both mice and men. They gathered about 200 candidate antibody genes from both sources.
Remember: each time white blood cells mutate to create an antibody, they’ll do it differently. That means everybody’s antibodies are different even though the disease is the same. Even a single patient will have multiple strains of white blood cells mutating in different directions, creating different antibodies, for the same thing.
Thus, from 32 mice and a few human patients, Regeneron got around 200 candidate antibody genes. They then reduced this number down to 4 really good candidates, and then 2 (one from a human, one from a mouse) that they decided to use for manufacturing. These were sent to the hamster factory.
It’s at this point we need to talk about hamsters and immortalized cell lines.
You can keep tissues alive outside the body by bathing them in a nutrient bath, but they won’t grow on their own. But in some cases, you can cause them to grow without end, in which.case, you’ll have an endless supply of those cells. The cell line has then become immortal. This is especially true if the original cells came from a cancer — that’s what cancer is, when the thing that prevents cells from dividing has been broken, and they grow out of control.
Of the many immortalized cell lines used by researchers, some come from adults who consented, some from adults who were never asked (such as the famous HeLa line), some from animals, and of course, some from embryos/fetuses.
One important cell line comes from a Chinese hamster ovary (CHO) that was smuggled out of China. It’s become the preferred source for producing mammal proteins that can’t be produced from yeasts or bacteria. In other words, simple proteins like insulin can be produced from yeast, but complex proteins like antibodies can only be produced within mammals. They insert a human gene into the cell, then encourage it to start dividing into billions of cells containing a copy of that gene.
Note that while the CHO cell line is used for about 50% of the time in this sort of case, about 20% of the time, human cell lines are used. The two human cell lines for doing this are known as HEK293 and PER.C6. Once Regeneron decided upon which genes it wanted to manufacture, it inserted those genes into Chinese hamster ovary (CHO) cells to mass produce the drug. The fact that it was CHO and not the human cell lines is pretty important to this story.
Immortalized cell lines appear in other places in our story. When selecting which of the 200 candidate antibodies it wanted to mass produce, Regeneron tested them for efficacy. It tested against tissues in vitro (a test tube using immortalized cell lines) rather than in vivo (inside a human body). One cell line is “Calu-3“, derived from a 25-year-old lung cancer patient in 1975. Another cell line is “Vero“, derived from the kidney’s of an African green monkey in 1962.
A third test uses proteins made from the “HEK293” cell line from the kidney of a human fetus aborted around 1972-1973 in the Netherlands. This the center of the current controversy.
This test wasn’t necessary to the creation of REG-COV2. It was included with the tests because other researchers used the technique, and that’s what science does, replicates the work of other researchers.
I mention this because while people have reluctantly agreed that REG-COV2 isn’t manufactured from embryos (from the HEK293 or PER.C6 cell lines), they insist that because of this test, it couldn’t have been made without embryonic cells. This is not true, the test wasn’t necessary. In addition, the test could’ve been done in different way, using a different source for the proteins involved. Vaccines are tested in similar ways, some using the ethically questionable cell lines, some not.
But the results are still ethically tainted. The point here isn’t to excuse this taint, but to simply point out it’s different type of taint. There’s a range of ethical questions here. The issue is being politicized to make this one ethical question, when it’s a different ethical question.
This is a good time to talk about the ethics of embryonic stem cells. There are a lot of different technical issue here.
The major issue that upsets Republicans is the harvesting of new material from blastocysts, embryos, and aborted fetuses. This is a wholly separate question of continuing to use old material from 50 years ago.
When President George Bush was elected in 2000, he instituted rulings forbidding harvesting new material, but which allowed the continued use of old material (within the United States). The continued use of HEK293 was explicitly allowed. Likewise, Trump issued an executive order limiting stem cell research. It explicitly targeted harvesting new embryonic cells, while at the same time, explicitly allowed existing lines like HEK293.
Thus, if you are trying to show that Republicans are hypocrites, that their rules change when their own life is at stake, then the evidence doesn’t support your conclusion. Even if the HEK293 cell line was used for manufacturing instead of testing, it still would be consistent with Republican positions. Their concern is to stop the use of exploitation of new embryos.
Now for Catholics, things might be different. The Vatican has repeatedly come down against using old material like HEK293 [a] [b]. They view it along the same lines as using research from Nazi medical experiments on Jews in concentration camps. People ask the ethical question whether the event was so offensive that the medical knowledge can’t be used, even if it saves lives. Even here, though, Catholics have a more nuanced view, allowing just things to be used in practice when there is no alternative.
From that perspective, then all medical research is tainted. For example, our knowledge from all vaccines comes from Edward Jenner’s testing on an unwitting 8 year old boy. Ethics have been continually changing throughout history, if we reject all knowledge from what we now consider to be unethical sources, then we wouldn’t have any medicine. 50 years ago when the HEK293 was acquired, it was under a different understanding of ethics than we have today.
Cell lines like the 50 year old HEK293 are used to test almost every drug. Google those letters and any of the other drugs Trump took in response to his infection, and you’ll find they are all tainted. Moreover, many of the upcoming vaccines will also use these such cell lines to test their efficacy. This may still be an ethically important question, but it’s not the politicized question at stake here.
This piece has tried to avoid getting into the technical weeds. For example, the HEK293 line aren’t “stem cells” but “kidney cells”. But HEK293 still comes from an aborted fetus, and thus, has the same ethical issue as what people understand by “embryonic stem cells”. Instead, I tried to look at the technical issues I feel do matter, like whether this is researchers using a 50 year old line that Republicans have consistently agreed to, versus newly harvested material which they vehemently oppose. Theoretically, somebody could have an issue with “stem cells” even when they come from bone marrow or cord blood, in which case, this article is not for you. I’m pretty sure no such people exist, except those who misunderstand the science. If you feel I’ve glossed over a technical issue (or gotten it wrong), please tell me https://twitter.com/ErrataRob.
Conclusion
This piece is not a defense of Trump but of science. Please vote for Biden on November 3. European countries with leaders to the left of Biden are nonetheless still prosperous. Conversely, when otherwise prosperous democracies have failed, it’s because of leaders as unfit and corrupt as Trump.
This issue started when people gleefully believed they had caught Trump in a trap. When this was proven a misconception, they went searching for other ties to stem cells, and found them. This is still a gross distortion of science — every modern medical treatment can be found to be tainted if you look hard enough. Trying to rescue your misconception by jumping through hoops like this makes you look worse, not better.
The MIT Technology Review article cited above is a particularly egregious example of the politicization of science. It cites Trump’s order on embryonic stem cells while knowingly avoiding what the order actually said, that it was about new vs. old embryos. They knowingly distorted the information to make it look like the consistent position was inconsistent. They knowingly distorted the science to make political points.
There are important areas where science is entangled with politics (e.g. climate change). But it seems like everyone takes the opportunity to irresponsibly distort science to further their politics, as seen here.
Frankly, I’m freaked out by planting a human immune system into mice into order to drive hypermutation, to extract a gene that you then place into an immortal line of hamster ovary cells to produce a crafted protein. I’m sure when somebody makes a movie based on this, it won’t be anything other than dystopic.

Cliché: Security through obscurity (yet again)

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/09/cliche-security-through-obscurity-yet.html

Infosec is a largely non-technical field. People learn a topic only as far as they need to regurgitate the right answer on a certification test. Over time, they start to believe misconceptions about that topic that they never learned. Eventually, these misconceptions displace the original concept in the community.

A good demonstration is this discussion of the “security through obscurity fallacy”. The top rated comment makes the claim this fallacy means “if your only security is obscurity, it’s bad”. Wikipedia substantiates this, claiming experts advise that “obscurity should never be the only security mechanism”.

Nope, nope, nope, nope, nope. It’s the very opposite of what you suppose to understand. Obscurity has problems, always, even if it’s just an additional layer in your “defense in depth”. The entire point of the fallacy is to counteract people’s instinct to suppress information. The effort has failed. Instead, people have persevered in believing that obscurity is good, and that this entire conversation is only about specific types of obscurity being bad.

Hypothetical: non-standard SSH

The above discussion mentions running SSH on a non-standard port, such as 7837 instead of 22, as a hypothetical example.

Let’s continue this hypothetical. You do this. Then an 0day is discovered, and a worm infecting SSH spreads throughout the Internet. This is exactly the sort of thing you were protecting against with your obscurity.

Yet, the outcome isn’t what you expect. Instead, you find that the all your systems running SSH on the standard port of 22 remain uninfected, and that the only infections were of systems running SSH on port 7837. How could this happen?

The (hypothetical) reason is that your organization immediately put a filter for port 22 on the firewalls, scanned the network for all SSH servers, and patched the ones they found. At the same time, the worm runs automated Shodan scripts and masscan, and thus was able to nearly instantaneously discover the non-standard ports.

Thus you cleverness made things worse, not better.

Other phrases

This fallacy has become such a cliche that we should no longer use it. Let’s use other phrases to communicate the concept. These phrases would be:

  • attackers can discover obscured details far better than you think, meaning, obscurity is not as beneficial as you think
  • defenders are hindered by obscured details, meaning, there’s a greater cost to obscurity than you think
  • we can build secure things that don’t depend upon obscurity
  • it’s bad to suppress information that you think would help attackers
  • just because there’s “obscurity” involved doesn’t mean this principle can be invoked
Obscurity less beneficial, more harmful than you think

My hypothetical SSH example demonstrates the first two points. Your instinct is to believe that adding obscurity made life harder for the attackers, and that it had no impact on defenders. The reality is that hackers were far better than you anticipated at finding unusual ports. And at the same time, you underestimated how this would impact defenders.
It’s true that hiding SSH ports might help. I’m just showing an overly negative hypothetical result to counteract your overly positive result. A robust cost-vs-benefit analysis might show that there is in fact a benefit. But in this case, no such robust argument exists — people are just in love with obscurity. Maybe hiding SSH on non-standard ports is actually good, it’s just that nobody has made an adequate argument for it. Lots of people love the idea, however.
We can secure things

The first two points are themselves based upon a more important idea: we can build secure things. SSH is a secure thing.
The reason people love obscurity is because they have no faith in security. They believe that all security can be broken, and therefore, every little extra bit you can layer on top will help.
In our hypothetical above, SSH is seen as something that will eventually fail due to misconfiguration or an exploitable vulnerability. Thus, adding obscurity helps.
There may be some truth to this, but your solution should be to address this problem specifically. For example, every CISO needs to have an automated script that will cause all the alarms in their home (and mobile) to go off when an SSH CVE happens. Sensitive servers need to have canary accounts that will trigger alarms if they ever get compromised. Planning for an SSH failure is good planning.
But not planning for SSH failure, and instead just doing a bunch of handwaving obscuring things, is a bad strategy.
The fact is that we can rely upon SSH and should rely upon SSH. Yes, an 0day might happen, but that, too, should be addressed with known effective solutions, such as tracking CVEs and vulnerability management, not vague things like adding obscurity.
Transparency good, suppression bad

The real point of this discussion isn’t “obscurity” at all, but “transparency”. Transparency is good. And it’s good for security for exactly the same reason it’s good in other areas, such as transparency in government so we can hold politicians accountable. Only through transparency can we improve security.
That was the point of Kerckhoffs’s principle from the 1880s til today: the only trustworthy crypto algorithms are open, public algorithms. Private algorithms are insecure.
It’s the point behind the full-disclosure debate. Companies like Google who fully disclose in 90 days are trustworthy, companies like Oracle who work hard to suppress vuln information are untrustworthy. Companies who give bounties to vuln researchers to publish bugs are trustworthy, those who sue or arrest researchers are untrustworthy.
It’s where security snake oil comes from. Our industry is rife with those who say “trust us … but we can’t reveal details because that would help hackers”. We know this statement to be categorically false. If their system were security, then transparency would not help hackers. QED: hiding details means the system is fundamentally insecure.
It’s like when an organization claims to store passwords security, but refuses to tell you the algorithm, because that would reveal information hackers could use. We know this to be false, because if passwords were actually stored securely, knowing the algorithm wouldn’t help hackers.
Instead of saying the “security through obscurity fallacy” we should instead talk about the “security through suppression fallacy”, or simply say “security comes from transparency”.
This doesn’t apply to all obscurity

This leads to my last point: that just because “obscurity” is happening doesn’t mean we can automatically apply this concept.
Closed-source code is a good example. Why won’t they company share their source code? If they say “because it helps hackers”, then that’s a clear violation of this principle. If they say “because trade secrets”, then it’s not a violation of this principle. They aren’t saying obscurity is needed for security, they are saying obscurity is needed because they don’t want people copying their ideas.
We can still say that the security of closed-source is worse than open-source, because it usually is. The issues are clearly related. It’s simply that the vendor isn’t, in this hypothetical, violating the fallacy by claiming closed-source means their code is more secure.
The same is true in the blogpost above of adding decoy cars to a presidential motorcade. I guess you could use the word “obscurity” here, but it has nothing to do with our principle under discussion. For one thing, we aren’t talking about “suppressing” information. For another thing, presidential motorcades are inherently insecure — this isn’t a crypto algorithm or service like SSH that can be trusted, it’s a real crap system that is inherently insecure. Maybe handwaving with half-assed solutions, like varying travel routes, cellphone jammers to block IEDs, using decoy cars, is the on the whole the best compromise for a bad situation.
Thus, stop invoking this principle every time “obscurity” happens. This just wears out the principle and breeds misunderstanding for the times when we really do need it.
Conclusion

The point of this blogpost is unwinding misconceptions. A couple years from now, I’m likely to write yet another blogpost on this subject, as I discover yet new misconceptions people have developed. I’m rather shocked at this new notion that everyone suddenly believes, that “obscurity” is bad as the only control, but good when added as a layer in a defense-in-depth situation. No, no, no, no … just no.
These misconceptions happen for good reasons. One of which is that we sometimes forget our underlying assumptions, and that people might not share these assumptions.
For example, when we look at Kerckhoffs’ Principle from the 1880s, the underlying assumption is that we can have a crypto algorithm that works, like AES or Salsa20, that can’t be broken. Therefore, adding obscurity on top of this adds no security. But when that assumption fails, such as a presidential motorcade that’s always inherently insecure (just lob a missile at them), then the argument no longer applies.
When teaching this principle, the problem we have is that a lot of people, especially students new to the field, are working from the assumption that everything is broken and that no security can be relied upon. Thus, adding layers of obscurity always seems like a good idea.
Thus, when I say that “security through obscurity is bad”, I’m really using this cliche to express some underlying idea. Am I talking about my political ideas of full-disclosure or open-source? Am I talking about vendor snake-oil? Am I talking about dealing with newbies who prefer unnecessary and ineffective solutions over ones proven to work? It’s hard to tell.
The original discussion linked on Hacker News, though, discussed none of these things. Going through the top ranked responses seemed list a list of people who just heard about the thing yesterday and wanted to give their uninformed hot take on what they think these words mean.
Case Study: ASLR (Address Space Layout Randomization) (Update)
After posting, some have discussed on Twitter whether ASLR is just “security through obscurity”. Let’s discuss this.
The entire point of this post is to raise the level of discussion beyond glibly repeating a cliché. If you have an argument to be made about ASLR, then make that argument without resorting to the cliché. If you think the cost-vs-benefit analysis means ASLR is not worth it, then argue the cost-vs-benefit tradeoff.
The original cliché (from Kerckhoffs principles) wasn’t about whether the algorithm added obscurity, but whether the algorithm itself is obscure.
In other words, if Microsoft was claiming Windows is secure because of ASLR, but that they couldn’t divulge details how it worked because this would help hackers, then you have a “security through obscurity” argument. Only in this instance can you invoke the cliché and be assured you are doing so correctly.
I suppose you could argue that ASLR is only “obscurity”, that it provides no “security”. That’s certainly true sometimes. But it’s false other times. ASLR completely blocks certain classes of attacks on well-randomized 64-bit systems. It’s such a compelling advantage that it’s now a standard part of all 64-bit operating systems. Whatever ASLR does involving “obscurity”, it clearly adds “security”.
In short, just because there’s “obscurity” involved doesn’t mean the cliché “security through obscurity” can be invoked.

How CEOs think

Post Syndicated from Robert Graham original https://blog.erratasec.com/2020/07/how-ceos-think.html

Recently, Twitter was hacked. CEOs who read about this in the news ask how they can protect themselves from similar threats. The following tweet expresses our frustration with CEOs, that they don’t listen to their own people, but instead want to buy a magic pill (a product) or listen to outside consultants (like Gartner). In this post, I describe how CEOs actually think.

The only thing more broken than how CEOs view cybersecurity is how cybersecurity experts view cybersecurity. We have this flawed view that cybersecurity is a moral imperative, that it’s an aim by itself. We are convinced that people are wrong for not taking security seriously. This isn’t true. Security isn’t a moral issue but simple cost vs. benefits, risk vs. rewards. Taking risks is more often the correct answer rather than having more security.
Rather than experts dispensing unbiased advice, we’ve become advocates/activists, trying to convince people that they need to do more to secure things. This activism has destroyed our credibility in the boardroom. Nobody thinks we are honest.
Most of our advice is actually internal political battles. CEOs trust outside consultants mostly because outsiders don’t have a stake in internal politics. Thus, the consultant can say the same thing as what you say, but be trusted.
CEOs view cybersecurity the same way they view everything else about building the business, from investment in office buildings, to capital equipment, to HR policies, to marketing programs, to telephone infrastructure, to law firms, to …. everything.
They divide their business into two parts:
  • The first is the part they do well, the thing they are experts at, the things that define who they are as a company, their competitive advantage.
  • The second is everything else, the things they don’t understand.
For the second part, they just want to be average in their industry, or at best, slightly above average. They want their manufacturing costs to be about average. They want the salaries paid to employees to be about average. They want the same video conferencing system as everybody else. Everything outside of core competency is average.
I can’t express this enough: if it’s not their core competency, then they don’t want to excel at it. Excelling at a thing comes with a price. They have to pay people more. They have to find the leaders with proven track records at excelling at it. They have to manage excellence.
This goes all the way to the top. If it’s something the company is going to excel at, then the CEO at the top has to have enough expertise themselves to understand who the best leaders who can accomplish this goal. The CEO can’t hire an excellent CSO unless they have enough competency to judge the qualifications of the CSO, and enough competency to hold the CSO accountable for the job they are doing.
All this is a tradeoff. A focus of attention on one part of the business means less attention on other parts of the business. If your company excels at cybersecurity, it means not excelling at some other part of the business.
So unless you are a company like Google, whose cybersecurity is a competitive advantage, you don’t want to excel in cybersecurity. You want to be average, or at most, slightly above average. You want to do what your peers are doing.
It doesn’t matter that this costs a lot of money due to data breaches. As long as the cost is no more than your competitors, then you are still competitive in your markets.
This is where Gartner comes in. They are an “analyst” firm. They send analysts to talk to you and your competitors to figure out what all of you are doing, then write up reports about what your industry average is.
Yes, yes, it’s all phrased as “best” practices, but it’s really “average” practices. CEOs don’t want to be the best in their industry at cybersecurity, they all want to be slightly above average.
When things hit the news, like this week’s Twitter hack, CEO’s look for a simple product to patch the hole precisely because they don’t want to excel at it. A common cliche in cybersecurity is that “security is not a product, but a process”. But CEOs don’t want a process they have to manage. This would requiring competent leadership, and excelling at cybersecurity, and all the problems with this approach that I describe above. They want to either plug the hole with a quick fix, or let the hole keep leaking. As long as everyone else in their industry has the same problem, it doesn’t need to be fixed.
What CEOs really want to know is “What are our peers doing?”. This is where Gartner comes in, to tell the CEOs what everyone else is doing about the Twitter hack.
It’s not just the Gartners of the world, who are primarily “analysts”, but Big Consulting in general. CEOs listen to cyber consultants from the big accounting companies (e.g. Ernst and Young) and the big tech companies (e.g. IBM). Since the consultants work for a wide variety of clients, they are therefore trusted barometers of what peers are doing in the industry.
They are also trusted because they are outside of internal corporate politics. Outside consultants often end up saying the same thing you do, but are trusted whereas you are not. CEOs listen to the outsiders because they have no hidden political agenda.
There is a flaw in how CEOs think here.
One flaw is that “outside” consultants are steered by those skilled at corporate politics. The consultants know which faction hired them, and thus, tilt their “unbiased” advice toward that faction. Having been a consultant myself, it’s the hardest ethical question I face: how do I maintain my own integrity in the face of the client trying to spin/tilt my reports?
The second flaw is that CEOs are measuring their companies against equally conservative peers. All of them resist some innovation that could reduce costs because none of them have tried it yet. Thus, there’s obvious things that all the techies can see, and yet, the organization resists because none of their peers have tried it yet. Yes, CEOs don’t want to excel at cybersecurity, to be the leader in their industry with the best cybersecurity, but this thinking stops them from being even slightly above average.
The third flaw is that consultants are dumb as rocks. They are just random people who have gone through some training who don’t have to be responsible for the long term consequences of what they do. They don’t reflect the best practices that the industry is doing so much as the dumbest. Most times an organization hires outside consultants there’s smarter people inside the organization fighting against the dumb things the consultants are doing.
All this means that instead of getting the “average” or “slightly above average” out of these outside consultants, CEOs are getting the “below average”. Their IT (and cybersecurity) is slowly sinking, except for the insiders who fight against this.
Thus, we have the fight the tweet describes above. The CEO has an extraordinarily broken view of cybersecurity.
A case study of this is Maersk being nearly destroyed by notPetya. What we techies could see several years ago is that ransomware has become an “existential risk” to the entire business. I saw a business destroy by mass ransomware two years before notPetya, so that such things can happen is not a surprise.
What most organizations see is that occasionally a desktop computer here and there gets ransomwared. They simply wipe it and restore from backup. It’s a cost, but a small cost, and not one worth getting concerned about.
The problem they don’t see is the difference between average users getting infected and domain admins. When a domain admin gets infected, then it can take down the entire enterprise. This means all the desktops and all the servers get infected. It means a massive loss of data and operation, as you realize that not everything was backed up, and that not all servers can be restored to their same operating condition.
That’s what happened to Maersk — all their computers got infected because a domain admin got infected. EVERYTHING got infect, except for one server in Africa that happened to be turned off at the time. That’s what happened to the cities of Atlanta and Baltimore. That’s what’s happened to numerous companies that haven’t hit the news. 
The solution is fairly simple. Microsoft has good guidance on this. It means changing how “domain admin” works so that one person doesn’t hold the keys that’ll wreck the kingdom. Lots of organizations follow Microsoft’s advice and are fairly secure against mass ransomware. Yet still the average for most conservative industries is to not follow this advice — none of their peers have, so why be the first? They are all basically waiting for one of their peers to be destroyed by ransomware, hoping it’s not them, before they take action.
So as an average techy in the industry, I appreciate the above tweet. CEOs and their reliance on magic pills and outside consultants is a pox on our industry. At the same time, their thinking is sound from the point of view of running a business. To fix this, we have to understand their thinking, which hopefully I’ve communicated in this document.
As for CEOs reading this document, well, learn to listen to your techies. Yes, they are also broken in their thinking. But at the same time, they can help you be slightly above average for your industry, and make it so you are the last to be mass ransomwared in your industry rather than the first. If you want to know more about this Twitter incident, then find a techy in your own organization to explain it to you rather than an outside consultant or product vendor.