Security (b)log - English edition

2023-12-15

Noise box for 007

Image from author

What do Desmond Llewelyn, John Cleese and Ben Whishaw have in common? Well, they all played the role of Q in James Bond films. You know, that grumpy man who provides Bond with all kinds of technical gadgets, such as shoes with a poisonous blade incorporated into them, a lipstick bomb and a watch with a powerful built-in laser. Not that I'm a big 007 fan or a Q-groupy, but I recently came across something special that wouldn't look out of place in the arsenal of a double-zero agent.

It looks like a sushi box, someone said. But a heavy one, because the case weighs 600 grams (1,3 lb), partly due to the thick bottom and ditto lid. The lid closes hermetically and the round thing on the front says automatic pressure purge. Inside you will see a small switch, plus and minus buttons and a few LEDs. No, this is not a sushi box. This is really something from Q's lab.

If you turn on the device - because that is what it is - and close the lid, you will hear noise. The volume buttons give you six different settings; no matter what setting you select, you can hear the white noise through the closed box, and in the loudest setting it is downright annoying. As soon as you open the lid, the noise stops.

Have you figured it out yet? I'll just tell. This thing is meant to store your phone during confidential meetings. The noise ensures that any eavesdroppers who have hacked your phone to secretly eavesdrop on you will only hear noise. And through the transparent lid you can see when something arrives on your phone, for example a message or a call. That is the advantage of this box over a Faraday cage, which blocks all electromagnetic radiation and actually creates an airplane mode environment - although it cannot be ruled out that malware makes a recording and sends it later. In short, with this box you are accessible and uneavesdropable at the same time. Wow.

I can totally see it. James Bond in M's office, who is about to reveal the next assignment. But first the phones go into a box like the one you see. Because that meeting is, of course, top secret. And officials like those two are by definition a target to the kind of hackers who have the knowledge and resources to plant eavesdropping software (I'm thinking of our beloved state actors). And of course our film heroes must be reachable at all times, because their American colleague Felix Leiter may call with important news.

In real life, the market for this product will also be the world of spies. In addition, top industrialists and other people who know something that others would also love to know will also be among the customers of the Dutch company that developed this thing. You are less likely to encounter it in an online store with nice gift ideas for Christmas, if only because it seems to be quite pricey.

In less exciting ecosystems, they use a poor-man's version of this high-tech device: a preserving jar. You know, one of those glass jars with a rubber ring and a snap closure, intended for preserving fruit and vegetables. Well, you can also put your phone in such a hermetically sealed jar, while it still remains visible (but first remove the food and clean it thoroughly, please). Due to the lack of a preserving jar, I cannot test whether this contraption is soundproof, but I do want to believe that its use is not pointless. If only that awareness about confidentiality gets a boost when there are suddenly preserving jars on the conference table.

Happy holidays from Borsoi, Patrick Borsoi.

The Security (b)log will return next year.

And in the big bad world...

This section contains a selection of news articles I came across in the past week. Because the original version of this blog post is aimed at readers in the Netherlands, it contains some links to articles in Dutch. Where no language is indicated, the article is in English.

2023-12-08

USB condoms

Image from Pixabay

Customs wondered whether they could charge their mobile equipment at public charging points. That question came to our team and when we talked about it, I was looked at favorably: something for a blog?

Of course, we could easily have answered, “No, don't do that!” (And I will definitely do that later on.) But it is of course much better to explain the ins and outs of the matter, and what alternatives there are. And it would also be a shame to only serve my colleagues in the once green uniform, while this is important for everyone - and also for you privately.

This concerns charging via a USB cable. Something you probably do every day with your phone or tablet - even if you have an iThing from Apple, because although the slightly older iPhones and iPads do not have a USB connection, but instead a Lightning connection, which plug is there again on the other side, on the side of the charger? That's right, USB-A! And what's so dangerous about USB? Well, it can do more than just charge: you can also send data through it. Perhaps your printer is connected to your PC via a USB cable, or your laptop is connected to an external screen with such a cable. Here is proof that data is passing through your USB connection. So what? Ah, now we're touching on my area of expertise. If data can flow somewhere, it can do so without you noticing. And that can have consequences for the confidentiality of your data, or that of your employer. Data can of course be anything: photos, contacts, texts, spreadsheets, you name it. All things digital.

Criminals know that too. On the pretext of 'data is the new oil' (in other words: you can make a lot of money with it) they like to explore new paths. And what does that have to do with those public charging points that Customs asked about? Well look, such a public charging point is a USB socket on the train, the bus, in a hotel room, you name it; you see them everywhere these days. Or it's a USB cable dangling somewhere. Sometimes you’ll run into those small lockers for charging your phone (I even saw them once at a security conference...). The problem with all those generous electricity suppliers is that you don't know what – and who – is behind them. And here's the thing: you can add something to those sockets and cables, or plug something in it that is more than just a charger. There are even cables available with plugs that transmit information to their owner via WiFi. All this outlines the risk scenario at stake here: that someone steals data from your device via a seemingly innocent, free charging option. This phenomenon even has a name: juice jacking. Your data is being kidnapped via the power cable.

However, in more than nine out of ten cases, such a public charging point will not be a problem at all. I don't see a hacker easily taking a train apart, hiding something in a USB port and then hoping that one day someone with important information will connect their phone to exactly that charging point. With a power cord dangling from a well-intentioned pole in the city, or in one of those charging lockers, it’s a different story, because they are much easier to manipulate. The majority of victims of these attacks, however, are targeted, because they possess specific information. When I talk about targeted attacks to my primary audience, I always mention two organizations: Customs and the FIOD (the Dutch Fiscal Information and Investigation Service). Both have information that is interesting for criminals, and for sure Customs officers sometimes make their appearance abroad, and that sometimes makes things a little more exciting.

What can you do to avoid the use of public charging points? Leave home with a full battery, and if you know you won't make it, be prepared: bring your own charger and cord. Going somewhere where you won't find an electrical outlet? Then put a power bank in your bag. Preferably a slightly more expensive one, that charges your device quickly. If you really cannot avoid a public charging point, use a USB condom (or a juice-jack defender, if you don’t like the former term). That’s a plug that goes into your device and takes that public charging cable in the other end. USB condoms only allow electricity to pass through, not data. Never use a charging cord or charger that you found somewhere; they may not have ended up there by accident. And if your device lets you choose between data transfer and 'charging only', choose the latter option.

Well, as predicted above, it comes down to this: just don't use public charging points. Nowhere, never, even if you are 'not important'. If you apply that principle, you will never have to think about it again.

And in the big bad world...

2023-12-04

Quantum pathfinder

Photo Petra Wevers

The Dutch word ‘kwantum’ easily translates into the English quantum, meaning quantity, although I mainly think of large quantity. This is probably due to the term quantity discount: buy a lot of something and it becomes cheaper. There is also something orange in my mind's eye, and that is due to that Dutch home furnishings store chain with its orange logo, which once started under the name Kwantum Hallen (‘Quantum Halls’).

For some time now, the word has been buzzing around the international IT community in its English spelling. It's all about the quantum computer, that strange machine that came straight from the film set of Back to the future, with its system of elegant pipes that provide cooling. Because the quantum computer likes it cold: in the heart of the machine the temperature is only ten milliKelvin (a tiny bit colder, 0 K or rounded off -273 °C, is absolute zero: it can't get any colder). 'Quantum' in this context depicts not at lot, but rather revolves around minimal quantities.

In addition to its bizarre appearance and the conditions required to function, the quantum computer has another peculiar property. As long as computers have existed, we have been used to the bit: a value that can be 0 or 1 and with which the computer can do calculations. But that crazy quantum computer works with qbits, which can be 0 and 1 at the same time, and everything in between. Until you look at it, because then the qbit has to show its colour. Sort of like Schrödinger's cat, which is in a closed box and is therefore simultaneously dead and alive to an observer, until the moment he opens the box and determines the state of the animal. With those qbits you can perform some calculations very quickly, because you can follow multiple paths at the same time. While ordinary computers work according to the pattern 'if this is true, then do this, else do that', the quantum computer simply does both and ultimately sees where it ends up. As a result, it makes many mistakes, but because it performs the calculations very often, a winning outcome emerges.

I talked about this with our brand new team member Petra Wevers, who calls herself a pathfinder in the field of quantum security. Quantum computers threaten the current way we protect our data which is, to a very important extent, based on a complex mathematical problem. To encrypt files you need keys, which are created by multiplying very large prime numbers. An attacker who wants to obtain the key does have the outcome of that calculation, but finding the two prime numbers (factorization) is extremely difficult. At least, for regular computers. For quantum computers, however, it is a piece of cake. The quantum computer therefore poses a major threat to the confidentiality of our data.

Current quantum computers cannot yet do that. Predictions vary widely, but you often hear that it will take somewhere between 7 and 10 years. Elsewhere I learned that from 2030 there is a real but small chance of breaking cryptography. Breaking RSA 2048 (a certain cryptographic algorithm, with a key length of 2048 bits) is expected to require a quantum computer with a million qbits, while the most powerful known (!) computer has only 433. Oh, you think, so we're not in a hurry. Think again. A lot of information that is confidential now will still be confidential in ten years. Long-term attackers, such as certain countries, are already stealing that information, even though they can't do anything with it yet. But if they can read that information a decade later, it will still be useful to them. Steal now, decrypt later, is their motto. Petra calls the situation we are in now the quantum squeeze. Others talk about Qday or even the Quantum Apocalypse, but it all comes down to the same thing: we have to do something before it's too late. And we have to act now.

We do not yet have quantum-safe cryptography, and the route to it has not yet been crystallized, says Petra. There are stopgap measures. Making keys longer, for example, so that even it will even take a quantum computer a while to figure them out. And – allow me to get specific for a moment – switching to TLS 1.3, because previous versions, which are still in full use, cannot handle hybrid algorithms (an accumulation of different algorithms). In addition, we can also be quantum annoying by frequently changing keys, so that the quantum computers choke in a tremendous workload. And if you as an organization purchase items, include quantum safety in your requirements. Ask your suppliers about their plans in this area.

Governments and science are serious about our safety, says Petra. Such as in the Dutch Quantum secure Cryptography Gov program. Next year, NIST (the American Standards Institute) will publish standards in this area, which are expected to be incorporated into commercial products three years later. According to Petra, it is generally overlooked that soon everyone will be able to work on quantum computers via some website, including criminals. Just as we can now all use artificial intelligence. It is not all doom and gloom: quantum computers, for example, will also help in the development of new medicines and batteries, it is expected. Let's fight to ensure that the positive use of this groundbreaking technology wins.

And in the big bad world...

2023-11-17

Kafka's Castle

Image from Pixabay

Remember that castle I wrote about last week? Where they didn't trust anyone, because they assumed the enemy was already within the walls of the castle? I went for a walk around the area, and guess what? There is another castle just down the road. And they do things in a completely different way there.

Not so long ago I heard this statement at a conference: we must move from 'low trust, high tolerance' to 'high trust, low tolerance'. That’s one of those statements to which the audience mumbles in agreement, without yet understanding exactly what it means. I make a note of those kinds of statements to think about them later. Writing a blog is an excellent way to hatch an egg like that one. Buckle up, dear reader, because at this point I don't know yet where the story is going.

The statement contains the assumption that many organizations work from a kind of non-trust (which is different from distrust), much like in last week's castle. There are many rules that you have to adhere to, because you probably won't do the right thing on your own. Not because you don't want to, but because you can't know them all. And because there are so many rules, it is very difficult to adhere to them all. If only because you do not know all the rules, but also because some rules are not feasible, or because it is sometimes inconvenient. You know, that word 'actually'. Whenever someone says that something shouldn’t actually be done in that way, you already know that a rule will be worked around. The lord of the castle knows this too, and therefore turns a blind eye to many things: he is very tolerant, as long as the rules are not broken deliberately and with malicious intent.

The statement from the second paragraph implies that that attitude is not good, because well, we 'must' move towards that other model: high trust, low tolerance. This lord of the castle assumes that everyone who works for him understands very well what is and is not possible, because many things are obvious. When you enter somewhere, you close the door behind you. Not only because otherwise it would be draughty, but also because someone might slip in who shouldn't be there. If you’re in charge of the lady's jewelry, you probably understand that you are not supposed to lend them to your girlfriend for an evening. So there are far fewer formal rules, but woe betide you if you betray trust and they find out. Then you'll be in the dungeon on bread and water in no time. There is little tolerance.

Do you know Franz Kafka's novel Der Prozess (The Trial)? That story revolves around Josef K., who is arrested and ultimately convicted without ever knowing why. Apparently he sinned against rules that he did not know – even could not have known. We could easily end up in such a Kafkaesque situation if we work on the basis of 'high trust, low tolerance'. Not a nice place to live, that castle.

What about a middle ground? I call it 'some trust, some tolerance'. It is probably true that we have too many rules, which no one knows anyway. Every citizen is supposed to know the law, they say. But how realistic is that, if taken literally? Even without knowledge of the law, you know that you are not allowed to puncture car tires, right? Likewise, there are numerous security rules that people adhere to anyway. Or where a little more tolerance wouldn't hurt. It annoys me every time when the app, in which I can see my daughter's class schedule, kicks me out if I haven't checked the app for a few weeks. Then I have to log in again, and then I always have to figure out how that works, because it works differently than elsewhere. How exciting is what's in that app? Let it piggyback on the security of my phone. Even my bank's app is easier (after an initial strict admission procedure).

So we can probably get by with fewer rules, but we also have to learn to be less tolerant. Still too often someone does something in a way that they know perfectly well is not the way it should be, but – of course with the best intentions, no doubt – they still manage to do it in that way. It works, but there are too many risks involved that may have been overlooked. Tolerance should not be taken, it should be given. From the person who is responsible.

So we need a new castle, at an appropriate distance from Kafka's. With residents who reasonably adhere to rules that mainly regulate what is not obvious to everyone. That model will only work for people, by the way. Let’s stick to zero trust for systems.

Next week there will be no Security (b)log.

And in the big bad world...

2023-11-10

The leaking castle

Image from Pixabay

Assume breach – you can safely assume that your systems have been compromised; hackers have already managed to gain access to your IT resources without you noticing. Of course this isn’t a very joyful assumption. It means something like: my security will fail and I can't stop it. It sounds like you're putting your head down, like a capitulation. However, it is not intended that way. No, the assume breach mindset is pointing out that your opponents have so many opportunities to penetrate your castle that it is simply impossible to always adequately protect all holes.

Let me deepen the castle metaphor a little further using the age-old parable as we know it in information security, with the castle moat, the drawbridge and the crown jewels in the robust keep. That comparison emphasizes how well we are doing with our layered security. What I want to talk about is that those layers all have their weaknesses.

Let's start with the moat. That’s easy: in winter you can sometimes just walk over it (yes, you young people, it used to get so cold in winter that all bodies of water in the country would freeze). I think many proud medieval castle lords were surprised when it turned out that their ingenious water barrier could easily be overcome without boats, as long as the enemy waited for the right moment. We have the drawbridge for normal crossing of that water. What happens if the chains or ropes used to raise the bridge snap? Then the bridge deck falls down and everyone can cross it. From a security perspective, if something is broken you don't want the unsafe situation to become the default.

But fortunately we still have the portcullis, which closes the opening in the castle wall. If its chains snap, it will fall and access will be blocked. That is, if it doesn't go askew due to the uncontrolled fall and become stuck. Then it remains open again and the enemy can still enter.

Finally, there is the donjon, or keep, the sturdy residential tower of the lord of the castle. It has thick walls and narrow windows. Valuables and important people would stay on the top floor, I imagine, furthest away from an intruder. I'm just afraid they wouldn't have anywhere to go if the enemy started a fire.

The onion model is based on the hope that if one layer is broken, the next layers will still stop the attacker. But is it really so inconceivable that all layers are leaking at the same time? The moat is frozen, the portcullis is rusted and the enemy, who marches in unhindered, smokes out the lord of the castle. But you forgot the archers! Well, that is a matter of attacking with a sufficiently strong and well-equipped army.

So assume that the attacker is already inside, the assume breach mindset tells us. Maybe he isn't at the top of the keep yet, but he is already walking around within the walls of your castle. He is in disguise and waiting for a good moment to make his move. What do you do when you think you know that the enemy in disguise is already inside? Then you don't trust anyone anymore. In security terms: zero trust. You assume that no one can be trusted and that every time someone wants something, you have to check whether that is allowed. Not: “Hi Pete, come in,” but: “Hi Pete, let's check whether you are still allowed in.” This in turn presupposes that it is perfectly clear what is allowed and what isn’t. Can it be true that so many employees have access to that important system? Or can you maybe reduce that attack surface through a better authorization structure? The more people can do something, the more people an attacker can try to deceive through, for example, phishing. Another important measure in this context is two-factor authentication: you say that this is your user ID and password, but that alone is not good enough to gain access.

In the physical castle, zero trust only works up to a point. Ultimately, the lord of the castle will have to be able to trust his bodyguards and his cook. He can take extra measures: remove the jewelry from the display cabinet and store it in a locked chest, for example. Thus making it a bit more difficult for an attacker. And that is what our profession is all about.

And in the big bad world...

2023-11-03

Betrayed by your phone

Image from Pixabay

Last Tuesday I was in the auditorium of a hotel in Venlo. Standing on the presenter’s side in a lecture hall is a bit intimidating, but after four presentations to groups of colleagues about the risks of their online existence, it fit me like a glove.

An important part of those risks has to do with your privacy. While you can use all kinds of apps for free, most apps also do something on their own: they collect data about you. And they sell that information to advertising companies, who use this information to create profiles. Your name is not necessarily linked to this: mobile devices work with an advertising ID that is linked to your device. Is your privacy well protected by this feature? Meh.

As is often the case in information security, it is all about who you are, or sometimes also what you are. Take phishing for example. This can be done in two ways: the criminals use a dragnet and are fine with whatever they catch, or they use a spear to catch exactly the one fish they want. For example, because they know that that person has access to the company's money and is therefore a good target to receive an email 'from the CEO', stating that he must immediately transfer a nice amount of money to a certain bank account. This form of phishing is called spear phishing; you now understand why.

Back to the advertising world. As we saw, profiles are created for advertising purposes, but who says those profiles can only be used for that purpose? Suppose you have a collection of profiles. You could then create a map showing all the devices in a certain area. You don't know who they belong to, you just see the advertising IDs. Then you could single out one of those IDs and turn the question around, so to speak: where has this device been? That may provide a clue of places where the device is often found. And that in turn offers the opportunity to find out where someone works and where he lives.

For most of us, that's not a threat – we're not interesting enough for that. But what if you’re a criminal and therefore the police are looking for you? By using information, which is actually intended for placing advertisements, they may be able to get close to you. Unfortunately, it also works the other way: what if you’re in law enforcement and you have to deal with criminals that also have access to that kind of information? Of course either side also needs specialized software for this. Reputable companies that could make something like this would probably only supply such a product to law enforcement. Unfortunately, organized crime is also becoming smarter and moreover, they have plenty of money to have something like that built. That could be a serious threat. In the context of personnel care, the Dutch financial crimes unit kindly requested this blog post on the matter. But of course it can also be relevant for other colleagues and for people outside our organization.

You can do something about this quite easily. The advertising ID of your device can be turned off. This makes you invisible on the map, and your device will not appear if someone asks the question: which devices are present around this office building around eight in the morning and five in the afternoon? Advertising companies such as Google and Meta will inform you that you will then see 'less relevant' advertising. So what! I brush aside the advertising for strollers as easily as I would the advertising for running shoes. And remember, if you also have your private phone in your pocket while at work, you want to kill the advertising ID on that device as well. Here is a brief description of how to do this in iOS/IpadOS and in Android. And in this video, John Oliver explains again how trading your data works. The entire video is interesting; fast forward to 10:10 if you just want to see the part about phone location.

The above tips are of course only intended for people on the right side of the law. It is advisable for criminals not to follow the tips, because that could have all kinds of unpleasant consequences.

And in the big bad world...

2023-10-27

Tech support scam

Image from Pixabay

Cry for help from the audience: “Help, I've been fooled!” In such a case I listen to both ears: the left one listens to hear how I can help, the right one listens to see if there’s a story that could be useful to others. Both ears got their money's worth. In this case, the person in question (let's call him Bert) already asked if I wanted to write a blog about it, otherwise I would have asked if he was okay with that.

Let me paint the picture. Bert had an old, slow PC at home on which he wanted to install the new version of his virus scanner. That didn't work out. That's why he wanted to go to the supplier's site and find a solution. He googled the name of his virus scanner, clicked on the top result and ended up at the requested site. Shortly afterwards a chat popped up: we have noticed a problem on your computer and we would like to help you.

Yes please, Bert replied; After all, he was on that site because he indeed had a problem. In order to be helped, he had to install a program (GoToAssist) to let the friendly helper look at Bert's computer. That's what Bert did. A viewing program (remote support) like that often lets the helper take over the computer, allowing him to get things done; You probably know that from your work. A moment later, the directory tree of Bert's computer scrolled across the screen, and suddenly everything turned red. Oh dear! A few thousand Trojan horses had been found!

A Trojan horse is a specific type of computer virus. Bert rightly asked why they had not been intercepted by his virus scanner. That's because the company's standard scanner doesn't detect Trojan horses at all, the helpdesk employee replied. But luckily she was able to offer Bert an extra program that would fill in the gap. They had subscriptions available for 1, 2 and 5 years, for just a few hundred euros.

At this point – about half an hour into the chat – Bert smelled a rat. He asked the helpdesk how he could be sure he was really chatting with someone from the antivirus company. There was no clear answer, after which Bert terminated the connection and, on the advice of his sister, who he was now on the phone with, pulled the network cable from the PC.

What had happened here? To begin with, Bert had not ended up on the real site of his supplier at all. Criminals recreate websites and ensure that they end up at the top of the search results. Almost no one looks closely at the address (URL) in a search result, so if it says you're going to virusscanner.com, it's easy to miss that you're actually going to viruscanner.com. When Bert ended up on the fake site, the criminal started a chat and tricked Bert into installing that remote support program. Once inside, he put some windows on the screen, made lines turn red and put a fake message about Trojans on the screen. His goal was to scare Bert and trick him into buying a "solution".

It is nonsense that Bert's virus scanner would not recognize Trojan horses. The idea that his computer would be home to an entire cavalry: just the same. But in the meantime, Bert felt bad. What has that criminal done? Maybe he stole files? Bert stores his photos and other important files on an external hard drive, which fortunately he disconnected at the beginning of the chat.

I discussed a number of scenarios with Bert. Perhaps the criminal copied Bert's email address book in order to present himself to Bert's contacts with insider knowledge or perhaps even to pose as Bert. Bert was smart enough to inform his closest contacts about this immediately after the incident and to impress on them that they should be on guard for strange messages. Another possibility is that the criminal wanted to copy photos and documents and then threaten Bert with publication. Fortunately, those files were inaccessible on the disconnected external drive. But the most likely scenario for me is that the criminal was only looking to make Bert pay for the Trojan horse killer offered. It came with a hefty price tag and is the easiest way to get money. The other scenarios require more from the criminal.

It makes sense that Bert is still not completely comfortable with the situation. I advised him to first run his old virus scanner on the disconnected PC. Step two is to re-connect the PC to the internet and run a free online virus scan (google 'online virus scan'). If that is all negative, Bert can also connect his hard drive and give it the same treatment. Finally, I suggested using a search engine other than Google, for example Startpage or DuckDuckGo . But to be honest, that is mainly for privacy reasons. Whichever you use: I prefer not to click on the sponsored search results, but to scroll through to the web results. Good luck, Bert!