Tag Archives: computer security

An Open Reply to Zooko and Jon

Dear LeastAuthority and Silent Circle (aka Zooko and Jon),

I too know and like you both! I too admire your work, have tremendous confidence in your abilities, and it’s been amazing to watch your efforts, both sophisticated and useful, grow over time. I want to be customers of you both when I am less broke. Personally, I enjoy talking and hanging and hiking and all manner of things with you! (Zooko I really must go back to the mountains with you one day) That was a very sweet and erudite discussion of the problems of verifiability and technical trust and Open Source and Descartes and Godel. Seriously, I could totally have that talk with both of you while sipping nice port out of little crystal glasses.

But no one is going to attack the customers of either Silent Circle or Tahoe-LAFS by compelling you to deliver a malicious update. If they want to do it the hard way, they’re going to use an iTunes update or a Skype update or just attach a filed called interesting-shit.jpg.exe to a forged email to your customers. If they want to or can attack your customers the easy way, your customers will end up under fluorescent lighting in an airless room surround by buzzcuts with toothy rictus smiles. Your customers will have the distinct sense that while they’d like to see your customer’s computer/phone or else, they’re cool with or else for a while if your customers want to play that way.

The first way is of course stealthier, which is the real reason they go after hosted services, because that’s a stealthy way of monitoring communications, and gets you a historical record. (Which is also why I’m all like “No encrypted email! Encrypted email baaaad!” all the time.)

But if they’re going to own the endpoint, there’s no point in interfering with your two companies who are loud and skittish and likely to pull a “Ladar”.

They could own the end point any number of ways with off-the-shelf shit, and go home early for the weekend. If they really want to do bulk collection they’ll just send a malicious update of Angry Birds.

Seriously, attacking a target through your apps would be stupid and likely to get out. So they’re not going to. They’re going to use the vast number of easy weaponized apps built on top of the thriving 0day market to scoop not only every bit your targeted customers send you, but everyone else too. And it’s great! They won’t ever get caught for this. I don’t even have to provide links and evidence for what I’m saying because we all, everyone who works vaguely in this field, already know this.* But this is not just your customer’s problem, it’s your problem, too.

This all brings me to my point in my normally circuitous way. And Jon, you made this point in part, but for me, not nearly hard enough. These debates on crypto and code verification are actively beginning to annoy me, because malware/phishing is fucking terrible and the real fucking problem and everyone is ignoring it. I don’t mean you in particular are annoying me, but in general this tendency is. I worry watching two people as respected as you do this continues to distract people from our terrible problem. It’s like watching a couple gentlemen have a lengthy and erudite discussion on the merits of the front door’s lock while the back of the building is actually on fire.

I really do appreciate discussions of verifiability on an intellectual level. If I wasn’t also that kind of dork I would never have made it through the majority of my life hanging out with you people. I can sit around with friends trying to figure out when the halting problem comes into play in game situations. I teach writing with Shannon’s information theory in mind. I understand the dopamine rush of a *solution*. But we don’t have that luxury anymore, because everything and everyone is getting owned like crazy.

The answers to the malware problem are probably not verification. They are probably many answers, messy answers, and not always provable or even always effective. I think that’s why we don’t like them, because they aren’t elegant. And because we like to imagine malware can’t happen to us. It happens to people who don’t know better and live far away, but are also much more likely than us to do the kind of work that gets targeted by hostile actors.

I don’t mean to over-focus on you, because you guys aren’t close to the worst on this. We need to fix the industry’s incredibly broken threat model, because malware is everyone’s problem. You’re trying to protect your users’ data, period. Not just when it’s in your little mathematical garden, but before it gets there an after it leaves, because otherwise your mathematical garden is irrelevant to the real world. This problem is, for our kind, much harder than proving Godel wrong, because it’s tractable but huge and it’s messy and it will never, ever, ever feel right.

If we don’t start focusing some of our attention on malware, crypto is going to be irrelevant in yet another way.

Regards,
Quinn

 

* People who are not the people this is addressed to who would never make this mistake anyway, don’t even talk to me about AV. I mean, don’t even.

Age of Excessions: Part Three, The brief, illegal life of the Scene.

“Everything that’s gone wrong in the news business went wrong first in the music business.” – Brooke Gladstone, On The Media

And before that, in the piracy business.

Create a new technology, and you invariably create a new culture with it. Every great invention of mankind is accompanied by fans, detractors, designers, bureaucrats, leaders, celebrities, and criminals. Computers alone weren’t enough to do this, but once they could talk to each other over phone lines, human roles began to coalesce around them. Computer criminals arose in the 80s, using PCs and modems to reach out and touch other computers.

Back in those paleointernet days, long before online piracy became something anyone could do, it was the exclusive realm of sophisticated users. Pirates, hackers, and phreakers were rarely solitary, stereotypes aside. They were vibrantly social among their own, creating a social system with all the normal features common to companies, governments, tribes, etc. Being an illegal underground, it went deliberately unnoticed as much as possible. It was the canary in the coal mine for what the internet could do to those institutions, but its death passed unnoticed and uninterpreted.

A very simple break down of the computer underground runs something like this: hackers, generally enabled by modems, got into computers they weren’t supposed to be in. Pirates made infringing copies of software, and often shared these around, again, by modem. The modems gave rise to a new form of criminal, focused on getting telephony resources without paying for them, called a phreaker. (Phreakers had an intrinsic fascination for Ma Bell that exceeded that purpose, but I’ll maintain most started phreaking after their first shocking phone bill.) Before long hackers and pirates often themselves became phreakers, to deal with both what could be huge phone bills and dangerous traceability. All of this intruding, copying, and messing with Ma Bell required a lot of social infrastructure. Within a few years the Scene was born, an underground community of people involved with illegal or unsanctioned computer or telephony activity.

Both “pirate” and “hacker” have changed meaning over time, and both of these terms have been reclaimed as points of pride. But the acts of pirates and hackers are, regardless of their inherent morality, generally illegal in some important jurisdiction. Hackers and pirates were not impressive additions to the criminal underworld. Most of them were people who had gotten interested in computers and just didn’t know or care that learning and doing more could slip quickly over the line of legality. Few of them saw themselves as criminals, they happened to break laws they saw as silly or insulting. Some of those laws were pretty silly, basic legislative misunderstandings of the technology that to this day prove incoherent when applied to sophisticated computer use.

I became involved with the piracy end of the Scene in 1995, after many of its key figures had been rounded up and jailed in the 1990 Operation Sundevil. My entré was down to dumb luck. I visited the house of a co-worker one evening. He and his friends were talking about something called God’s Realm, a successor to something called RIP. God’s Realm, it turned out, was the biggest piracy BBS in North America at the time. RIP was the board they’d run before, but when things got too hot with police they’d taken it down, waited a bit, and reinvented it. They were in piracy groups that competed to release mainly Windows software. The three groups I spent the bulk of my time over the next 18 months with were Razor 1911, PWA (Pirates with Attitudes), and DOD (Drink or Die). I met most of the people I would eventually interview on IRC.

Most of the pirates I met in that period were middle aged family men, with the exception of a couple younger guys that came up after Sundevil. I spent my time on IRC, lived with the pirates, and interviewed many of them. I openly took notes, so they taught me how to encrypt my notes. I found that the best way to learn about computer security and even lawbreaking was simply to ask and listen willingly. The Scene was mostly made up of people that didn’t see themselves as the bad guys, and were genuinely happy to have someone listen to their side of the story.

One of the younger guys (we’ll call him S) lived with God’s Realm in the house in front of an guest house I eventually rented a room in. He had a huge bundle of phone lines coming in, but they paid for themselves. S switched long distance carriers every few months without actually ever having an outgoing call, and the instant rebates covered the basic line costs with a few dollars to spare. The board was 15 nodes*, each node representing a phone line and a computer, with those computers networked together. The board boasted 80 gb of data- in 1995. It was an unfathomable amount of data back then. The majority of that 80gb was kept in tape backup. Only the index of the tapes and the most popular and newest downloads were kept live on the board, the rest you had to request and wait a week while the archivist got around to uploading it, so you could dial back in and download it over your modem. Some things required special access, for instance “cookies,” lists of credit card numbers used for long distance dialing, and stolen proprietary source code. I first saw the game Descent and Microsoft’s NT 3.51 in source code form. NT 3.51, I was told, had a check for the Utah teapot. If it saw the teapot running, it would turn off error checking, to deceive benchmark tests. I didn’t know what that meant at the time, and frankly, never had anyway to verify it anyhow, but I was shown the code where it supposedly happened.

God’s Realm was part of an ecosystem. It started with Suppliers, generally people who worked at software and game companies that snuck their software out to the Scene. Suppliers were carefully guarded resources. They usually got all-you-could-eat leech privileges on the boards, and didn’t spend too much time with the plebs on IRC. Their identities were hidden, often from everyone but the very heads of the groups. From Suppliers software was courried to the the Crackers, who used decompiling software like SoftICE to hack out the copy protections within hours. Only once did I get to see the SoftICE team work, three youngish guys huddled over their computers muttering to one another in some primitive, addled, and illegal version of pair programming. They were ripping bits out of games and rebuilding them, at the time trying to get the soundtrack to work after taking out the serial check. Once they were satisfied they passed it to a packager, it was approved by the leadership (who often, but not always, doubled as the packagers) and handed to couriers to spread to the BBSes like God’s Realm. From there the privileged and the lucky had access to huge stores of software in addition to those zero day warez. The process was focused on speed, but quality mattered too. A group would “win” on a title if their version got to a board first, but they could lose quickly too, if that version was buggy or broken. That would cost them download credits.

Couriers were the lowest rung of the ladder, and the most at risk. They used phreaking and carding to pay the enormous phone bills of passing data around the system of boards, and most of them weren’t very good at phreaking and carding. Couriers were the youngest, most likely to get caught, least in the loop people in the Scene. But even they had their legends, like a pair of twins known as the Thrust Brothers. They had two computers and four modems. They’d download from one board, hand the disks between them, and start uploading to the next without ever disconnecting.

There were people who maintained the channels of communication and coordination, those that recruited suppliers, people that acted as advocates, negotiators, spies, more roles than I ever fully understood. The scene had lawyers, landlords, archivists, and even me, their new pet amateur anthropologist.

The center of this social space, the boards, were becoming harder to justify. Everyone met up on IRC, communicated over email, increasingly worked for ISPs, web companies, or did networking for their real jobs. Running an FTP server was much easier than running a board. But most people didn’t want to move online; they complained that the net was more dangerous and less exclusive. And for the most part, that was the prevailing thought in the Scene. You joined an underground to be separate, and the net was the least separate thing in the world.

But it was so damn easy.

S, whose house played host to God’s Realm, got a job at a game company that was once quite famous, but has since gone out of business. At the time it was doing well out of a game called Descent. The local group of Razor 1911, of which he was a member, sat S down to tell him not to fuck this up. This was a good job, and winning on his company’s titles wasn’t worth risking it. But he was too tempted by the chance to win and gain status on popular game titles. Soon enough he bounced a large pgp file mailed from his work address to his outside email right after an internal release of the Descent 2 beta. No one had any doubts what was in the mail.

He was fired and escorted from the building. The next day he was asked to come down to the local PD for questioning, and brought along a scene lawyer. Somewhere in the course of questioning he was arrested, and the lawyer left and called the guys who ran God’s Realm to tell them to take down the board. The police had a warrant to search S’s house for the pgp key. The crew of God’s Realm swung into action to take the board down before the police got there, and destroy S’s key if they could find it. (Coincidentally, the whole 80 gig mess of tapes was in my car trunk that day, along with the archivist’s server.) Four or five people descended on S’s house and ripped up masses of computer equipment, carrying all of it to another house down the street, hoping like hell they wouldn’t be caught. The police arrive hours later, after the board had been destroyed and mourned. The police were looking for computers or a disk, what they found was a huge trunk of telephone lines terminating nowhere, and 15 square clean spots on the carpet. They were absolutely pissed, but totally powerless. They’d screwed up the investigation, and the guys got away with it.

There was some talk in the next couple of weeks about reviving the board, but nothing ever happened. The search warrant had administered the fatal hit to an already terminal patient. Other boards were dying too, or migrating on to FTP and web sites.

The internet was already destroying phreaking. It did this two ways. First via flat rate isp access that let you reach any node in the world. No more shocker phone bills, no more specific need to phreak. The second was how its inner workings were documented. The net was open and built by standards bodies amenable to question and comment. If you wanted to know how the whole magic system worked, you read the docs, maybe even mail the creators with question, to which most of them would respond cordially. If you found a way to break something, likewise, they might mail you and ask you to help fix it. What was phreaking Ma Bell internet architecture made not only socially acceptable, but a marketable job skill.

Way to ruin the party, net.

As for piracy, all the roles but cracking vanished. Supplying was no longer a zero day affair because download quotas made little sense on warez websites. Couriers, always the least safe, made no sense at all in an end to end network. Archivists, packagers, none were really needed anymore. The cost of disk was coming down, the bandwidth was going up. The need for massive groups and hierarchies dissolved. It now took one person to release, and he or she didn’t need to be part of the in-group. With the exclusivity gone, there was nothing to stop anyone from becoming a pirate.

The true death-stroke came with P2P, and what had been leeching became the central role in piracy. Intentionally anonymous, technically easy, socially vacuous, digital piracy could no longer support its little society. No one was part of the 415 or the 212 anymore, what would that mean online? Rootkits were even making hacking something any shlub could do, and the shlubs in old world organized crime were starting to take notice. With nothing to compete over the members of Razor, PWA, and DOD blew to the four winds, generally to computer jobs that paid well for skills gotten as part of life in the Scene.

And with its social structure destroyed, piracy itself was unstoppable.

The difference between piracy and the music business, or publishing, is that because the scene was never legit, no one saw or mourned its passing. It happened faster because no one could plead the Scene’s case as a social institution, and no one could praise the network for making piracy democratized to the point of social incoherence. But everything that happened to the music industry happened to the piracy scene first, and, importantly, as a prerequisite for disrupting the music business. The Scene was never going to scale to threaten music and software the way P2P has. Instead, the story of its passing is an example of the de-cohered future for whatever institutions the net touches. Because there was little institutional resistance to the effects of the net on the Scene, it gives us an accelerated view of how the net eventually comes to transform institutions. Also, a slightly inaccurate one, because conflict changes the outcome in some ways. But we see the fundamental post network effect. Today’s piracy represents the new stable state of a post-net institution, more etherial than corporal, more smoke than body. This is what all the other institutions the network disrupts will eventually look like, unless they succeed in destroying a network that is mathematically incapable of compromise.

It’s hard for most people to understand and identify with the experience of digital piracy, even though at this point, most people online do it. But what about librarians? Everyone loves librarians, including librarians.

Next: Part Four, Two non-profits you’ve never heard of, fighting over a catalog you didn’t know you were using.

* Possibly 11. My notes are unclear.

How to take advantage of #Amazonfail

I’ve been watching the story of (probably) accidental censorship on Amazon with interest, and I think there’s a valuable sociological lesson in it. In short: Amazon de-ranked books with GLBT themes as adult over Easter weekend. People were outraged by the apparent moral prescribing censorship, a Bantown prole called Weev claimed he did it with a cross site reference forgery, and then Amazon said it was a cataloging error.

What’s interesting is that all these answers are pretty much equally possible. That’s just weird though- because it suggests that there’s not so much of an entry barrier anymore to the kind of book burning mind controlling corporate/state master propaganda stuff that the ruling class can use to dictate our punch clock existences. Is technology democratizing the tools of fascism? Why not? What’s so different about them? Here comes everybody indeed, whether they like it or not. We’re all going to be shooting mind control rays at each other, obeying Markov chain commands issued by our zombie army computers, living in an anarchist/fascist quasi state of cultural strange attractors, capable of free will only in topics of obscurity and total market failure.

Good times.

Then, just when I thought I’d mentally explored/perverted the scenario to its fullest, I received this ad: #powellswin: a 20% off book sale capitalizing on Powell’s not having (accidently) censored their search results. I like Powell’s, if I wasn’t in debt to my eyeballs (hey….) I’d be tempted to buy something. In the mean time, I’ll just have to let my phished cc do my opinion expressing for me.

Tab dump

…And yes, I wept. There was a lot about Lincoln at the moment, the moment being the 150th anniversary of his death on Good Friday. W.E.B. DuBois in two short passages explains best why Lincoln is one of my favorites of history, and my favorite president. Spoiler: Turns out he was flawed.

Robert Moses’ response to Robert Caro. I have not read all of it, just as I have not read the Power Broker, the book to which it responds. I like shorter books with more pictures.

UNITED STATES, v. NATIONAL CITY LINES – court docs on the group that shut down the world’s best public transit system – formerly in my hometown of LA.

Chatting with a botmaster. A security researcher at Cisco befriends a botmaster after tracing his command and control on IRC, and talks to him about how the botnet world works.