Schneier on Security

Time 2020-09-19 08:03:10

Web Name: Schneier on Security

WebSite: http://www.schneier.com

ID:51919

Keywords:

Schneier,on,Security,

Description:

Friday Squid Blogging: Nano-Sized SQUIDS SQUID news:Physicists have developed a small, compact superconducting quantum interference device (SQUID) that can detect magnetic fields. The team l focused on the instrument s core, which contains two parallel layers of graphene.As usual, you can also use this squid post to talk about the security stories in the news that I haven t covered.Read my blog posting guidelines here. Posted on September 18, 2020 at 6:09 AM • 8 Comments New Bluetooth Vulnerability There s a new unpatched Bluetooth vulnerability:The issue is with a protocol called Cross-Transport Key Derivation (or CTKD, for short). When, say, an iPhone is getting ready to pair up with Bluetooth-powered device, CTKD s role is to set up two separate authentication keys for that phone: one for a Bluetooth Low Energy device, and one for a device using what’s known as the “Basic Rate/Enhanced Data Rate” standard. Different devices require different amounts of data and battery power from a phone. Being able to toggle between the standards needed for Bluetooth devices that take a ton of data (like a Chromecast), and those that require a bit less (like a smartwatch) is more efficient. Incidentally, it might also be less secure.According to the researchers, if a phone supports both of those standards but doesn’t require some sort of authentication or permission on the user’s end, a hackery sort who’s within Bluetooth range can use its CTKD connection to derive its own competing key. With that connection, according to the researchers, this sort of erzatz authentication can also allow bad actors to weaken the encryption that these keys use in the first place which can open its owner up to more attacks further down the road, or perform man in the middle style attacks that snoop on unprotected data being sent by the phone’s apps and services.Another article:Patches are not immediately available at the time of writing. The only way to protect against BLURtooth attacks is to control the environment in which Bluetooth devices are paired, in order to prevent man-in-the-middle attacks, or pairings with rogue devices carried out via social engineering (tricking the human operator).However, patches are expected to be available at one point. When they ll be, they ll most likely be integrated as firmware or operating system updates for Bluetooth capable devices.The timeline for these updates is, for the moment, unclear, as device vendors and OS makers usually work on different timelines, and some may not prioritize security patches as others. The number of vulnerable devices is also unclear and hard to quantify.Many Bluetooth devices can t be patched.Final note: this seems to be another example of simultaneous discovery:According to the Bluetooth SIG, the BLURtooth attack was discovered independently by two groups of academics from the École Polytechnique Fédérale de Lausanne (EPFL) and Purdue University. Posted on September 17, 2020 at 6:18 AM • 7 Comments How the FIN7 Cybercrime Gang Operates The Grugq has written an excellent essay on how the Russian cybercriminal gang FIN7 operates. An excerpt:The secret of FIN7’s success is their operational art of cyber crime. They managed their resources and operations effectively, allowing them to successfully attack and exploit hundreds of victim organizations. FIN7 was not the most elite hacker group, but they developed a number of fascinating innovations. Looking at the process triangle (people, process, technology), their technology wasn’t sophisticated, but their people management and business processes were.Their business… is crime! And every business needs business goals, so I wrote a mock FIN7 mission statement:Our mission is to proactively leverage existing long-term, high-impact growth strategies so that we may deliver the kind of results on the bottom line that our investors expect and deserve.How does FIN7 actualize this vision? This is CrimeOps:Repeatable business processCrimeBosses manage workers, projects, data and money.CrimeBosses don’t manage technical innovation. They use incremental improvement to TTP to remain effective, but no moreFrontline workers don’t need to innovate (because the process is repeatable) Posted on September 14, 2020 at 9:15 PM • 3 Comments Interesting Attack on the EMV Smartcard Payment Standard It s complicated, but it s basically a man-in-the-middle attack that involves two smartphones. The first phone reads the actual smartcard, and then forwards the required information to a second phone. That second phone actually conducts the transaction on the POS terminal. That second phone is able to convince the POS terminal to conduct the transaction without requiring the normally required PIN.From a news article:The researchers were able to demonstrate that it is possible to exploit the vulnerability in practice, although it is a fairly complex process. They first developed an Android app and installed it on two NFC-enabled mobile phones. This allowed the two devices to read data from the credit card chip and exchange information with payment terminals. Incidentally, the researchers did not have to bypass any special security features in the Android operating system to install the app.To obtain unauthorized funds from a third-party credit card, the first mobile phone is used to scan the necessary data from the credit card and transfer it to the second phone. The second phone is then used to simultaneously debit the amount at the checkout, as many cardholders do nowadays. As the app declares that the customer is the authorized user of the credit card, the vendor does not realize that the transaction is fraudulent. The crucial factor is that the app outsmarts the card s security system. Although the amount is over the limit and requires PIN verification, no code is requested.The paper: The EMV Standard: Break, Fix, Verify. Abstract: EMV is the international protocol standard for smartcard payment and is used in over 9 billion cards worldwide. Despite the standard s advertised security, various issues have been previously uncovered, deriving from logical flaws that are hard to spot in EMV s lengthy and complex specification, running over 2,000 pages.We formalize a comprehensive symbolic model of EMV in Tamarin, a state-of-the-art protocol verifier. Our model is the first that supports a fine-grained analysis of all relevant security guarantees that EMV is intended to offer. We use our model to automatically identify flaws that lead to two critical attacks: one that defrauds the cardholder and another that defrauds the merchant. First, criminals can use a victim s Visa contact-less card for high-value purchases, without knowledge of the card s PIN. We built a proof-of-concept Android application and successfully demonstrated this attack on real-world payment terminals. Second, criminals can trick the terminal into accepting an unauthentic offline transaction, which the issuing bank should later decline, after the criminal has walked away with the goods. This attack is possible for implementations following the standard, although we did not test it on actual terminals for ethical reasons. Finally, we propose and verify improvements to the standard that prevent these attacks, as well as any other attacks that violate the considered security properties.The proposed improvements can be easily implemented in the terminals and do not affect the cards in circulation. Posted on September 11, 2020 at 4:05 PM • 110 Comments Ranking National Cyber Power Harvard Kennedy School s Belfer Center published the National Cyber Power Index 2020: Methodology and Analytical Considerations. The rankings: 1. US, 2. China, 3. UK, 4. Russia, 5. Netherlands, 6. France, 7. Germany, 8. Canada, 9. Japan, 10. Australia, 11. Israel. More countries are in the document.We could and should argue about the criteria and the methodology, but it s good that someone is starting this conversation.Executive Summary: The Belfer National Cyber Power Index (NCPI) measures 30 countries cyber capabilities in the context of seven national objectives, using 32 intent indicators and 27 capability indicators with evidence collected from publicly available data.In contrast to existing cyber related indices, we believe there is no single measure of cyber power. Cyber Power is made up of multiple components and should be considered in the context of a country s national objectives. We take an all-of-country approach to measuring cyber power. By considering all-of-country we include all aspects under the control of a government where possible. Within the NCPI we measure government strategies, capabilities for defense and offense, resource allocation, the private sector, workforce, and innovation. Our assessment is both a measurement of proven power and potential, where the final score assumes that the government of that country can wield these capabilities effectively.The NCPI has identified seven national objectives that countries pursue using cyber means. The seven objectives are:Surveilling and Monitoring Domestic Groups;Strengthening and Enhancing National Cyber Defenses;Controlling and Manipulating the Information Environment;Foreign Intelligence Collection for National Security;Commercial Gain or Enhancing Domestic Industry Growth;Destroying or Disabling an Adversary s Infrastructure and Capabilities; and,Defining International Cyber Norms and Technical Standards.In contrast to the broadly held view that cyber power means destroying or disabling an adversary s infrastructure (commonly referred to as offensive cyber operations), offense is only one of these seven objectives countries pursue using cyber means.

TAGS:Schneier on Security 

<<< Thank you for your visit >>>

Hot Websites