January 29, 2008

Rumours of Skype + SSL breaches: same old story (MITB)

Skype is the darling child of cryptoplumbers, the application that got everything right, could withstand the scrutiny of the open investigators, and looked like it was designed well. It also did something useful, and had a huge market, putting it head and shoulders of any other crypto application, ever.

Storms are gathering on the horizon. Last year we saw stories that Skype in China was shipping with intercept plugins. 3 months ago I was told by someone who was non-technical that the German government was intercepting Skype. Research proved her wrong ... and now leaks are proving her right: Slashdot reports on leaked German memos:

James Hardine writes "Wikileaks has released documents from the German police revealing Skype interception technology. The leaks are currently creating a storm in the German press. The first document is a communication by the Ministry of Justice to the prosecutors office, about the cost splitting for Skype interception. The second document presents the offer made by Digitask, the German company secretly developing Skype interception, and holds information on pricing and license model, high-level technology descriptions and other detail. The document is of global importance because Skype is used by tens or hundreds of millions of people daily to communicate voice calls and Skype (owned by Ebay, Inc) promotes these calls as being encrypted and secure. The technology includes interception boxes, key forwarding trojans and anonymous proxies to hide police communications."

Is Skype broken? Let's dig deeper:

[The document] continues to introduce the so-called Skype Capture Unit. In a nutshell: a malware installed on purpose on a target machine, intercepting Skype Voice and Chat. Another feature introduced is a recording proxy, that is not part of the offer, yet would allow for anonymous proxying of recorded information to a target recording station. Access to the recording station is possible via a multimedia streaming client, supposedly offering real-time interception.

Nope. It's the same old bug: pervert your PC and the enemy has the same power as you. Always remember: the threat is on the node, the wire is safe.

In this case, Mallory is in the room with you, and Skype can't do a darn thing about it, given that it borrows the display, keyboard, mike and speaker from the operating system. The forthrightness of the proposal and the parties to the negotiations would be compelling evidence that (a) the police want to infect your PC, and (b) infecting your PC is their preferred mechanism. So we can conclude that Skype itself is not efficiently broken as yet, while Microsoft Windows is or more accurately remains broken (the trojan/malware is made for the market-leading Microsoft Windows XP and 2000 only, not the market-following Linux/MacOSX/BSD/Unix family, nor the market-challenging Vista).

No change, then. For Skype, the dream run has not ended, but it has crossed into that area where it has to deal with actual targetted hacks and attacks. Again, no news, and either way, it remains the best option for us, the ordinary people. Unlike other security systems:

Another part of the offer is an interception method for SSL based communication, working on the same principle of establishing a man-in-the-middle attack on the key material on the client machine. According to the offer this method is working for Internet Explorer and Firefox webbrowsers. Digitask also recommends using over-seas proxy servers to cover the tracks of all activities going on.

MITB! Now, normally we make a distinction between demos, security gossip, rumours and other false signals ... but the offer of actual technology by a supplier, with a hard price, to a governmental intercept agency indicates an advanced state of affairs:

The licensing model presented here relates to instances of installations per month for a minimum of three months. Each installation of the Skype Capture Unit will cost EUR 3500, SSL interception is priced at EUR 2500. A one-time installation fee of EUR 2500 is not further explained. The minimum cost for any installation on a suspect computer for a comprehensive interception of both SSL and Skype will be EUR 20500, if no more than one one-time installation fee are required.

This is the first hard evidence of professional browser-interference of SSL website access. Rumours of this practice have been around since 2004 or so, from commercial attacks, but nobody dared comment (apparently NDAs are stronger than crimes in the US of A).

What reliable conclusion can we draw?

  • the cost of an intercept is 2500 and climbing.
  • the "delivery time" taken is a month or so, perhaps indicating the need to probe and inject into Windows.
  • MacOSX and Linux are safe for now, due to small market share and better security focus
  • Vista is safe today, for an unknown brew of market share, newness and "added security" reasons.
  • Skype itself is fine. So install your Skype on a Mac (if human) or a Linux box (if a hardcore techie).

Less reliably, we can suggest:

  • All major police forces in rich countries will have access to this technology.
  • Major commercial attackers will have access, as well as major criminal attackers.
  • Presumably the desire of the police here is to not interfere with ordinary people's online banking, which they now can do because most banking systems are still stuck on dual factor (memo to my bank: your super-duper advanced dual factor system is truly breached by the MITB).
  • Nor, presumably, do they care about your reading of this blog nor wikileaks, both being available in cleartext as well. Which means the plan to install *TLS/SSL everywhere to protect all browsing* is still a good plan, and is only held up by the slowness at Apache and Microsoft. (Guys, one million phishing victims every year beg you to hurry up.)
  • Police are more interested in breaching the online chat of various bad guys. So, SSL email and chat forums, Skype chat and voice.

Of course the governance issue remains. The curse of governance says that power will be used for bad. When the good guys can do it, then presumably the bad guys can do it as well, and who's to say the good guys are always good? People who have lots of money should worry, because the propensity for well-budgetted but poorly paid security police in 1st world countries to manipulate their pensions upwards is unfortunately very real. Get a Mac, guys, you can afford it.

In reality, it simply doesn't matter who is doing it: the picture is so murky that the threat level remains the same to you, the user: you now need to protect your PC against injection of trojans for the purpose of attacking your private information directly.

Final questions: how many intercepts are they doing and planning, and did the German government set up a cost-sharing for payoffs to the anti-virus companies?

Posted by iang at 05:46 PM | Comments (2) | TrackBack

January 26, 2008

When the SLippery SLope beckons

Second Life takes another step onto the slippery slope. They have previously banned gambling, and now they are banning finance.

Please read this if you operate, or have transferred L$ to, an in-world “bank” or financial company.

As of January 22, 2008, it will be prohibited to offer interest or any direct return on an investment (whether in L$ or other currency) from any object, such as an ATM, located in Second Life, without proof of an applicable government registration statement or financial institution charter. ...

This is the slippery slope. By putting a blanket ban on the operation of financial services (or, passing the buck to the old-world regulators, which amounts to the same thing), they have exited from a large sector of commerce. Expect others to follow.

The reason? In short, it is not economic for them. Linden Labs have no economic / libertarian background to understand the theory, so they cannot see a forward path. Nor do they have the necessary regulatory background or friends, so they have inherited a big and powerful enemy (or more precisely, a horde of enemies who all look the same on first glance) with no way to deal with a war.

Also, it has been recently shown by one similar venture (eBay/Paypal) that taking the slippery slope has a quid pro quo: no financial downside, indeed success and profits. Other than a lot of noisy press ("traitors to the cause"), what's the problem? The process looks on track according to modern marketing theories (ditch the early adoptors as you move to the mainstream).

Under this cloud of exit stories, sad to some, there is at least a silver lining. We extract one data point from the experiment that confirms the theories developed in the 1990s for unregulated finance providers:

You probably haven’t heard of Joshua Zarwel (Second Life’s ‘Teufel Hauptmann’), but he was the very first person I thought of when Linden Lab banned banking last week. ‘Hauptmann’ doesn’t get a lot of press. He’s never been accused of insider trading or blackmail in the Second Life Herald, he doesn’t spend much money on his avatar, he SL Bank Logodoesn’t issue cringe-inducing press releases, and he doesn’t have his name in diamonds above his virtual door. In short, he’s the kind of guy you want managing your money.

Sounds like a scam already, right? Call the Feds? The USSS should be hovering as we speak? Read on...

The fund’s web site is plain, and its entire in-world presence consists of one tiny, unremarkable virtual building. ... When Linden Lab ended banking in Second Life last week, Zarwel did something I’ve not heard of any other banker doing: he quietly announced that every single Linden Dollar in his customers’ accounts was available for immediate withdrawal. ...

For those who have memories of the unregulated gold and dollars economy:

... we tried to be as transparent as possible. If you check our website and/or in world note card you will see that we provide our real world names, addresses, backgrounds, profitability, fund allocation, etc. We had nothing to hide, nor did we ever wish to be anonymous.

This is rhyme. Indeed, it's as close to repeat as you can get, to challenge Mark Twain. We can see everything, as indeed it should be in open governance:

  • provide transparent access to account balances
  • show the governance arrangements (a.k.a. 5PM)
  • describe the business model fully
  • describe who the controllers really are (Ivan the Honourable)
  • allow the public to regulate (the fifth party)

The long and the short is that if Linden Labs had implemented the lessons of open governance, they would have likely knocked out (over time) the scams and been left with the gems (again, over time). This does not change the question of whether it would have been economic of them to pursue Austrian approaches to commerce (Hayek's open money, etc), but it does show that there was a forward path, and the place at the end of that path will stand up to scrutiny.

While we are on the finance business, let's check in to see where the regulated world are at in governing their activities:

The UK's HSBC is to use Identrust's Internet authentication network to enable its corporate customers to digitally sign electronic payments files. Identrus provides a secure digital certificate-based infrastructure for business-to-business e-commerce transactions and corporate-to-bank communications....

A select number of HSBC corporate banking clients will be issued with Identrus digital certificates so that their staff can electronically sign payment files.

Identrust-backed digital signatures are used to guarantee non-repudiable and legally binding electronic communications between banks and their corporate clients. Only one Identrus digital identity per user is needed to interact with all of a corporate client's banks, which simplifies the transaction authentication process.

(Imagine here comments about Ricardian contracts, x.509 failings, x9.59 designs, transaction economics, and a whole host of lessons that simply can't be learnt at any price.)

Posted by iang at 05:18 PM | Comments (0) | TrackBack

January 20, 2008

How to improve the Standards Process: the Prisoner's Dilemma

As you know, this blog does not like the over-deification of standards that many encourage. So when Mitchell asks:

The goal of is the discussion is to think about whether we can improve the setting. It's because this is so important that I want to focus on it.

For example, can we encourage more openness and transparency in the creation of web standards? We've proved that openness and transparency work well for code: they encourage discussions to focus on technical merit; they allow everyone who is interested to understand the details; they encourage participation. Why not do this with the creation of web standards?

you can expect some less than positive responses. Still, much as we don't like it, it's a fair question, because whichever way you look at it, Mozo is stuck in the standards game.

Why is Standards so hard? We are up against many things here, but one view is that it is a battle of the worst of the small against the worst of the large.

Firstly, the small. Human nature is to operate in closed groups. Even in so-called open groups, most work gets done in private, and people are adept at creating motives, processes, and excuses to push things more to the closed end of the scale.

For example, many Internet security projects claim to run an open security process, but operate a closed process. They do this by various tricks: invite-only policy, closed archives, hidden names, no communications. In practice such a process reduces to a closed group, and the result of such dissonance is stagnation and mistrust, often needlessly because the people working in these groups are trying their damnest to get the job done.

What are the human processes here? People all want to be with the winning side, and for the last 10 years, "open" is the winning side. So the "open" is essential, and security groups are not immune to that.

But, when push comes to shove, being open is such a complete change for the psyche that most people can't deal with it. One minor example: how does the security director can say "I don't know" on a public list when breaches are in the air and the press is looking for blood? It's hard enough to be uncertain before your own team, not to mention that it is hard to sort things out when too many people are able to speak at once.

The business of security has more than its fair share and historical wisdom, excuses and complexities, so, human nature being what it is, we end up with a facade of openness, and real work gets done in closed session. Even in the open groups...

In between the large and the small is the economics. These might be considered to the rules of warfare in Standards. The top three influences in Standards Setting are economics, economics and economics. In that order.

Luckily, the economics is well known! By agreeing to a common standard, we achieve a benefit in common. We each individually face a higher cost. However, some of us don't have to pay the individual higher cost, and may still win from the others, because the benefit is in common.

If this sounds familiar, it is because it is a widely studied thing called The Prisoner's Dilemma.

What's the big thing about the Prisoner's Dilemma? Cheating: everyone has the incentive to cheat, but hold the other guys to honesty. If I cheat, and you all do the right thing, I win. Unfortunately if we all cheat, we all lose, which is why it is called a dilemma.

Now we get to the large: if we then add competitive pressures to this mix, we have an explosive combination that is called "cartels" in economic terms (c.f., Gary Hamel and C. K. Prahalad, who studied the economics of standards, joint ventures and industry associations). Harken back to the old Netscape days, and consider how Microsoft and others fought over the "web standard". Blackbird, W3C etc. As there's real money involved here, the end result is that people take cheating seriously, and deception is the rule, not the exception.

In such a circumstance, the Standards Business is best modelled as a battle between large corporations under Prisoner's Dilemma economics. (Other things might sound nicer, but remember that deception is the rule...) If you want to get anywhere in that battlefield, the only way is to break the economics of the Prisoner's Dilemma, and that means ... to change the reward structure. But because the Standards group is supposed to be unpaid, it has to be done with non-monetary payoffs.

Which leaves one thing: reputation.

To put the other guy's reputation on the line, you have to show that he is breaking the rules. Which means: we need rules, tough ones, and the fiercer rules the better. Here's some ideas:

  • All archives should be public.
  • All decisions should be made in the public list.
  • Rough consensus should rule.
  • The group can be joined by anyone.
  • All conflicts of interest should be declared.

For yourself,

  • become an adept at negotiation, as that is the practice of how to deal with the theory of PD.
  • Always remember that before anything, standards setting is an economics process, not a political or moral process.
  • Always be ready to withdraw.

Knowing all this doesn't mean we can avoid the Prisoner's Dilemma, as some dilemmas can't be saved. But it does put you in a better position to realise when the process is stalled through deadlock, and to spot who is really unable to contribute because deception is the only way they know. As it is an economic process, withdrawal is the ultimate defence, as your time is better spent elsewhere.

Posted by iang at 01:10 PM | Comments (2) | TrackBack

January 08, 2008

UK data breach counts another coup!

The UK data breach a month or two back counted another victim: one Jeremy Clarkson. The celebrated British "motormouth" thought that nobody should really worry about the loss of the disks, because all the data is widely available anyway. To stress this to the island of nervous nellies, he posted his bank details in the newspaper.

Back in November, the Government lost two computer discs containing half the population's bank details. Everyone worked themselves into a right old lather about the mistake but I argued we should all calm down because the details in question are to be found on every cheque we hand out every day to every Tom, Dick and cash and carry.

Unfortunately, some erstwhile scammer decided to take him to task at it and signed him up for a contribution to a good charity. (Well, I suppose it's good, all charities and non-profits are good, right?) Now he writes:

I opened my bank statement this morning to find out that someone has set up a direct debit which automatically takes £500 from my account. I was wrong and I have been punished for my mistake.

Contrary to what I said at the time, we must go after the idiots who lost the discs and stick cocktail sticks in their eyes until they beg for mercy.

What can we conclude from this data point of one victim? Lots, as it happens.

  1. Being a victim of the *indirect* nature continues to support the thesis that security is a market for silver bullets. That is, the market is about FUD, not security in any objective sense.
  2. (writing for the non-Brit audience here,) Jeremy Clarkson is a comedian. Comments from comedians will do more to set the agenda on security than any 10 incumbents (I hesitate to use more conventional terms). There has to be some pithy business phrase about this, like, when your market is defined by comedians, it's time for the, um, incumbents to change jobs.
  3. Of course, he's right on both counts. Yes, there is nothing much to worry about, individually, because (a) the disks are lost, not stolen, and (b) the data is probably shared so willingly that anyone who wants it already has it. (The political question of whether you could trust the UK government to tie its security shoelaces is an entirely other matter...)

    And, yes, he was wrong to stick his neck out and say the truth.


  4. So why didn't the bank simply reverse the transaction? I'll leave that briefly as an exercise to the reader, there being two good reasons that I can think of, after the click.



a. because he gave implied permission for the transactions by posting his details, and he breached implied terms of service!

b. because he asked them not to reverse the transaction, as now he gets an opportunity to write another column. Cheap press.

Hat-tip to JP! And, I've just noticed DigitalMoney's contribution for another take!

Posted by iang at 04:13 AM | Comments (2) | TrackBack