Category: Security Theater

A praise of Folly – Security Theater and the OSI layers 8 and above

Early in February 2018 I was happy to give a speech at FOSDEM, in Brussels. They booked me after Howard Chu and right before the closing keynote – awesome, and there were a few thousand geeks in the audience – I guess that was the largest crowd I ever spoke to.

And I told them about “A praise of Folly: Security Theater – The mostly unknown OSI Layer 8 and above” – see References. Here’s my ongoing collection.

Here’s the video

Schneier on Security and Feelings at TED

Here’s an old but great video at TED: Bruce Schneier on the feeling of Security. BIAS, Feeling and our nature prevent true security. Awesome, also the section on “news”. And of course about Security Theater.

Bruce Schneier on feeling secure

DIVSI – a matter of Trust ?

Welcome to the DIVSI, the “German Institute for Trust and Security on the Internet”. This is what the website looks like in my browser, with Javascript, Cookies and all Trackers turned off. Would you trust them? It’s a government project, but still: Would you trust such a website? For once, working with experts would be nice. #sigh. I know, I am using wordpress here, but at least I am not pretending. #plonck.

DIVSI

NetzDG – well, that didn’t quite work out, did it?!

Good intentions and their real life effects – that’s sometimes a whole other story.

In Germany NetzDG, a new law, passed the legislative process with best intentions: against cyber bullying, against hate speech, against fake news. Website owners and companies such as Twitter and Facebook are to be held responsible for what is published under their watch. At least, that was the idea.

Only three weeks into its existence the law, however, has had several severe impacts on free speech. Afraid of being punished social media platforms started to delete numerous postings and content..

More: https://netzpolitik.org/2018/csunet-netzdg-verstoesst-gegen-die-verfassung/

ePrivacy – Keynote at 34th Chaos Communication Congress

At the 34th CCC meeting – the legendary Chaos Communication Congress – Ingo Dachwitz held an interesting speech about a highly controversial topic: We all want our data to be safe. But what is really necessary for a well informed understanding of data security of individual users? Can we declutter ePrivacy?

Watch here: https://netzpolitik.org/2018/34c3-eprivacy-macht-der-datenschutz-das-internet-kaputt/

Best voice recognition? No, it’s not Apple, Google or Microsoft – the NSA does the best job.

A recent Intercept post once more shows great insight into history and state of NSA technologies. This time it’s about voice recognition and recognizing “who’s speaking” within very little time. Things have changed since the cold war, but I was not aware of secret services creating so-called voiceprints of all of us – including and focusing on non-US citizens. There’s an NSA program called Voice RT (link), but also China and Europe are involved:

In November, a major international speaker recognition effort funded by the European Union passed its final test, according to an Interpol press release. More than 100 intelligence analysts, researchers, and law enforcement agents from over 50 countries — among them, Interpol, the U.K.’s Metropolitan Police Service, and the Portuguese Polícia Judiciária — attended the demonstration, in which researchers proved that their program could identify “unknown speakers talking in different languages … through social media or lawfully intercepted audios.”

The Intercept

NSA documents reviewed by The Intercept outline the contours of a similarly expansive system — one that, in the years following 9/11, grew to allow “language analysts to sift through hundreds of hours of voice cuts in a matter of seconds and selects items of potential interest based on keywords or speaker voice recognition.”

Last week the US senate agreed on extending these surveillance measures, and the NSA’s goal is clear, not only since the 2010 conference where its directors clarified:

“It is all about locating, tracking, and maintaining continuity on individuals across space and time. It’s not just the traditional communications we’re after — It’s taking a ‘full arsenal’ approach.”

#Meltdown-#Spectre: I Guess the NSA knew about it since 1995…

The Intel 80x86 Platform should never be used in environments that need security... Here is a study from 1995 which was paid for by the NSA (I guess that is what “under the auspices” means?) and that comes to very frightening findings. Well, at least if you’re in security and IT:

“An in-depth analysis of the 80×86 processor families identifes architectural properties that may have unexpected, and undesirable, results in secure com-

puter systems. In addition, reported implementation errors in some processor versions render them undesirable for secure systems because of potential security and reliability problems.”

“This analysis is being performed under the auspices of the National Security Agency’s Trusted Product Evaluation Program (TPEP).”

I think this study sheds a strange light on the following quote from the Washington post:

“Rob Joyce, White House cybersecurity coordinator, said, “NSA did not know about the flaw, has not exploited it and certainly the U.S. government would

never put a major company like Intel in a position of risk like this to try to hold open a vulnerability.”

Oh really? A #Meltdown?

Media is going crazy about #Meltdown and #Spectre. Should you panic, too?

Here are some of my thoughts on that recent security desaster:

Don’t worry. Your systems have been damaged for twenty years, probably. A hardware vendor (probably more, maybe all of them) sold buggy chips, and they have been broken since 1995 or so.
It became known during the summer of 2017. At least, but surely not only since then a realistic chance of exploits was around, which became imminent some weeks ago and led Google/Intel to withdrawing from deadline and going public.
Yes, your systems are most likely affected. If you were not asked recently (i.e. since last Wednesday) to upgrade your kernel, then you have a problem. You are not affected if you are running hardware older than 1995 or some ARM stuff. Your kernel should now be 4.14.11 or newer – or contain backported code if it is an older version.
The patches deployed by all major OS vendors last week will make your systems significantly slower. However they will fix most of the problems, but not the ones that are so deep into hardware that no software can fix. Yes there are. But if you are only gaming, sending mails, writing office documents and browsing the web, you won’t even notice. However, if you are a database admin or running DNS servers or Enterprise Clouds – anything with many “context switches” between userland and kernel space, then you’re likely to suffer from performance loss..
The whole story may even become an #intelgate, because rumors have it that Intel had prior knowledge and some strange things going on with testing. Rumors, nothing more, except for a CEO selling most of his Intel stock in November and a flaw that makes systems 30-50% faster, but for what a price?

Justmy2cents.

Really Safer? Or just a feeling?

security theater meets bike

What people feel and what is actually true – that’s often not quite the same. Expecially when it comes to security, merely feeling safe sometimes seems to be more important than reality. As the blog “Erich sieht” shows that is true cycling as well. The British National Health Service NHS puts it in a very short sentence:

“Official figures taken from the NTS suggest that the general risk of injury from cycling in the UK is just 1 injury per 19,230 hours of cycling.”

“Erich sieht” does the math for you: A typical bycicle courier would need to work for ten years, 40 hours per week to suffer his first injury – statistically.

https://erichsieht.wordpress.com/2018/01/04/so-ungefahrlich-ist-radfahren/

Videomitschnitt »Twittwoch Spezial Datenschutz« in München (2013)

Having a fine debate – it’s just the best thing to do on a wednesday, right?!

In 2013 I was invited to “Twittwoch” (literally a combination of “twitter” and “Mittwoch”, meaning wednesday in German) talking about data security in Munich. On the panel such interesting fellas as Jerzy Montag, then member of German parliament, Daniel Duda, an expert on cyber security, Tanja Gabler from Internet World Business, Stefan Gröner and Dr. Guido Brinkel (1&1 Internet AG, Expert Government Relations).

Watch to the interesting discussion presented by our host the amazing blogger Thomas Pfeiffer.

http://www.twittwoch.de/videomitschnitt-twittwoch-spezial-datenschutz-in-muenchen/

(In German only.)

The Twitter-Controversy: Titanic and Beatrix von Storch

It’s abut freedom of speech, so the stakes are rather high.

It may sound a little overwhelming, but the tide is high in the controversy about the newest data (security) and privacy laws in Germany and Twitter. Because of the new legislation, mainly done by Heiko Maas (social democrats), that was supposed to stop digital harrasment and racism, kicked fully in: but not in the way it seemed designed for. The satirical magazine “Titanic” got shut down on Twitter (by Twitter) for its parody on altright politician Beatrix von Storch.