Explore 360! Explorations of the World and Mind

Aug 22nd Coolest Patent Ever Granted

Sensor Privacy Mode, Granted the Day After the Eclipse

Today the United States Patent Office granted one of the coolest patents ever: Sensor Privacy Mode, on which I am the first inventor. It is a relatively simple yet powerful technique to put the control of privacy back into the hands of the users. Basically, it prevents your own phone, computer, mobile device or anything with a sensor from spying on you on behalf of someone else. And it does this in a way that is undetectable to the party attempting to spy.

Link to patent is here.

Do you know how to determine if a patent is of high value? One way is that you find there is a huge high-level corporate fight by people trying to get named on the patent as an inventor because the idea is so powerful. Yes, that happened with this patent.

Jun 24th Sharing “Cyber Secrets” with Russia?

Is There A Problem with This?

Yesterday Reuters had a headline article about how western tech firms share cyber secrets with Russia in order to sell their products in Russia. You can read the article here.

In my opinion: This is a sensationalized story written to fit in with the times. Here’s why:

• Western tech firms are not intentionally “sharing” cyber secrets.
• Tech companies will do essentially anything it takes to gain entry into a lucrative market. Always have, always will.
• Security functionality should only depend on a small set of secrets, such as a key that cannot be examined by anyone. Encryption algorithms, authentication techniques and security functions should not rely on being secret and as a matter of fact, if they are it is viewed as a bad implementation.

The Reuters story focuses on the current boogeyman country Russia, and mentions China. The Chinese government has an arguably tighter grip on the Chinese economy, is far more paranoid than Russia and is at least as aggressive in cyber spying. The Chinese market is so large that western companies will bend over backward to get into it. Here is an example:

All PCs have a little crypto processor called a Trusted Platform Module, or TPM. If you’ve ever used Microsoft Bitlocker, you’ve used the TPM on your machine. The TPM implements security algorithms developed by open standards committees, everyone knows what goes on in a TPM (or could know if they wanted).

China doesn’t like the TPM because they either don’t trust westerners to develop secure algorithms, and probably because the TPM has no backdoors, or ways for the government to get around the encryption. More specifically, the Chinese don’t like the security algorithms in the TPM.

Ok, now a PC maker doesn’t want to make a special motherboard for China only, or change their software to operate differently in China. You know what the solution was?

China devised their own TPM algorithms and had western PC makers put those algorithms in the Chinese market TPM instead of the open standards algorithms. The suspicion in the security community is that these algorithms have backdoors that only the Chinese government is aware of.

Western PC manufacturers will happily follow the Chinese government rules and implant spy devices on PCs meant for China. Most companies would be staunchly opposed to this suggestion from the U.S. government, arguing that they don’t exist to manufacture spy devices for the government. Yet that is what happens in China.

What is going on in Russia is nothing new, except apparently importing to Russia becoming more strict. You really can’t blame the Russians (or anyone else) for worrying about backdoors in western-built products, the stories about the NSA implanting secret access have been all over the internet. Companies are usually open to having a “trusted third party” examine their code and products to ensure no backdoors are present. This is not “sharing secrets” as the third party is severely limited in what they can disclose.

The Reuters article pointed out that Symantec ceased allowing code inspections because they did not trust the trusted third party, probably for good reason. The fear is that the third party was actually looking for security vulnerabilities as an agent for the Russian government. Indeed, if the third party is not trusted, the procedure does not work.

BUT, the interest of western companies is heavily weighted to protecting intellectual property rather than worrying about vulnerabilities in code. That is more likely the reason Symantec dropped out of the program. They are, after all, in the software security industry and if their code was broken well then their business is ruined. So in their case, hidden vulnerabilities are, in a sense, intellectual property to be protected.

Personally, I’d be happier if the U.S. government required such code inspection on imported products. We know spyware is implanted in Chinese-made items. This would simply become consumer protection, hey you can spy on your customers but at least disclose it. I doubt it’s practical, though, given the vast number of imported products to the U.S. and the dearth of interest in the government to seriously protect cyber infrastructure.

Jun 20th Need for Federal Laws Regarding Handling of Personal Data

Are you worried about government agencies spying on you?

Well, that isn’t the only problem you should be concerned about in this area:

“Detailed information on nearly every U.S. voter — including in some cases their ethnicity, religion and views on political issues — was left exposed online for two weeks by a political consultancy which works for the Republican National Committee and other GOP clients.”

Read this.

Less than a century ago, this kind of information could land someone in a concentration camp, thus the EU has fairly strong data privacy laws today. Not so in the U.S.

It can be done. Laws have been made in the past, such as HIPAA laws that protect medical data. Unfortunately, the most powerful corporations in the world are dead set against such laws so there is a huge barrier to overcome.

May 18th Dark Foreboding of “WannaCry” Malware (Part 2)

Incoming! Ahhhhh! (From the movie WarGames)

The pic above is the display at NORAD of incoming ICBMs as dramatized in the best hacker movie ever made: WarGames. The underlying theme was that a high school student hacks into a government supercomputer and nearly starts a nuclear war by accident. I love this movie, the hacker is using old pre-IBM and pre-Apple microcomputers and a phone modem to explore and hack the digital telecom of old: the landline phone system. He also used his skills in non-computer ways to keep one step ahead of his government pursuers, like opening an electronic lock by tape recording the keypad tones and playing them back, and by hacking a pay-phone system by reproducing clicks to bypass the pay box. Just about everything he does (sans the beautiful girlfriend of course) is classic hacker. And this was 1983!

An interesting piece of trivia: President Reagan saw this movie and asked his staff if it could happen in reality. They investigated and reported back that it was far worse than portrayed (!) which led to the first cyber-security National Security directive to be issued by a president.

The WannaCry event should be a wakeup call (really one of many) to the government. At a minimum, some sort of agency should become responsible for cyber security infrastructure defense. I also believe the USG should enact laws that require at least a minimum amount of security be built into all computing devices sold in the country. We do it for radio emissions (the FCC label you see on all computers) and power safety. For healthcare it’s the FDA certs, for airplanes it is the FAA. The FAA is now regulating toy drones, seems like cyber security could be regulated at least a bit. Having been in the computer industry for decades I can say it will hardly make a dent in manufacturers profit, even though they are certain to complain of any new regulation in this area. Example: Some of the best smartphone security exists in iPhones. Apple is wildly profitable.

The Shadow Brokers are now saying in their fake broken-english writing that they will release more leaked code like a “…wine of month club[SIC].” They also claim to have nuclear program secrets that makes the WarGames reference above apropos. So we are looking at possibly larger hacking attacks and maybe even a nuclear hacking attack. Oh boy. And we haven’t seen the worst of the Internet of Things problems yet…

Stay tuned…. If you can!

May 18th Dark Foreboding of “WannaCry” Malware (Part 1)

This Can Be Made into a Powerful Little Cyberweapon

The WCry malware, also called “WannaCry,” has made headlines since last Friday for causing computer problems around the world. It is now probably the most infamous virus ever due to the breadth of its effect, and effectiveness. There is a multitude of malware “in the wild” that behaves in a similar fashion, so why is WCry so bad?

WCry operates by invading computers through vulnerabilities in certain operating systems, primarily Microsoft WindowsXP and later versions of Windows that have not been updated with patches (small fixes to the operating system software). Attacking a computer in this manner is nothing new, it happens quite often.

What is bad now: This vulnerability is newly revealed (a zero-day), it is in many older systems (millions), and step-by-step instructions on how to exploit this zero-day were released by the Shadow Brokers. Modern systems are not affected by this virus but there are many older systems out there not properly managed, including in critical infrastructure as the hospital in Great Britain and the Russian government.

WCry is ransomware, encrypts your data and demands ransom to be paid in Bitcoin currency to decrypt your computer. Bitcoins are nearly impossible to trace and therefore used famously for money laundering. Ransomware is again not new but…

What is bad now: The use of ransomware is growing and the scale of this attack is an unprecedented use of ransomware. Ransomware is bad, if your drive gets encrypted it’s all over. Even if you pay the ransom, there is no guarantee the drive will get encrypted. So far the U.S. government has said no one who has paid the ransom has gotten their data decrypted.

WCry was developed by cyber criminals and possibly North Korea. It was not developed by the NSA. The NSA used the vulnerability for years (not as ransomware but presumably to spy) and never told Microsoft, so it could not be fixed. Now it turns out that the NSA apparently secretly told Microsoft about it after the NSA discovered that it had “leaked” to the Shadow Brokers. Microsoft raced to fix the bugs just weeks prior to the Shadow Brokers releasing the exploit to the public.

Why this is bad now: It originated from our own government. We know the NSA, CIA, FBI, and you-name-it-three-letter-got-agency “hoard” these vulnerabilities, probably independent of each other. Where is the government agency responsible for protecting the United States from attacks on these vulnerabilities? An independent cybersecurity researcher in Great Britain discovered a way to temporarily stop WCry. Why isn’t there a government agency at least trying to do protect our cyber systems in real-time? We have an enormous agency looking for and preventing terrorism, what about cyber crime?

Why this is really bad! It’s not over, already two other exploits have been discovered using the same NSA-leaked exploit.

By the way, the pic at the top of the post is my latest project: It is a low-cost single-board computer with a powerful processor and operating system used by hobbyists. It includes built-in wifi and bluetooth radios. It is the size of a credit card. More devices than you can imagine can be connected to this hardware, think cameras, microphones, location detectors, etc. You might imagine that it could be used in nearly unlimited “less than honorable” ways.

Apr 27th Real, and Disturbing News

Cyber Intelligence is NOT Limited to These Two Agencies

While you were being distracted by inane presidential posts and accusations of fake news, real news was being made in the government intelligence organizations. Since last September there have been two major releases of secret cyber weapons leaks. The National Security Agencies tools were released by a mysterious group calling themselves “The Shadow Brokers,” which I initially wrote about here. Then, several weeks ago Wikileaks published tools lost by the Central Intelligence Agency which I wrote about here.

So the two leading cyber spying agencies of the most powerful nation in the world had many of their cyber weapons exposed in less than a year. If that isn’t deeply concerning to you as an American citizen or even more broadly, as a citizen of the “Five Eyes” intelligence-cooperative countries, then you should more closely examine what the mission of these agencies are: They are not here to spy on citizens, they exist to keep the United States safe and further the interests of the country you live in.

The CIA and NSA leaks are not the only rumblings currently rocking nation-state intelligence organizations. This article describes some of the back-and-forth of a cyber cold war. It enumerates many recent events surrounding these leaks and other activity such as arrests and “official” revelations of the cyber-spying ability of the US. The article contains lots of speculation and guessing about what is secretively going on between the US an possibly Russia. Make no mistake, this is definitely an attack on the US. Have you seen any Russian cyber weapons leaks? Chinese? Israeli? Nope.

I find this stuff fascinating, especially the fact that with the vast access to public information today, you can piece together a lot of very different sources and come up with a highly plausible scenarios of this secretive cyber war.

I have to agree with the author that there is something big going on and the public won’t know for sure for a long time how the hacking tools were leaked or who specifically is “attacking” the US by releasing these tools. That Russia is behind the leaks is a good guess, however I disagree with the author that Russia is the only country that has both the ability and motivation to attack the US like this.

As I have stated in the past, building cyber weapons is not that difficult in comparison to physical weapons like nuclear bombs. To get away with building a nuke today, you need an army of PhD scientists and engineers, significant industrial capacity and need to expend extreme effort to keep the program under wraps. All a cyber weapon program requires is a few hackers, computers and the internet. No PhD required, many of the best hackers in the world had not graduated high school.

So, North Korea has built nuclear weapons. Do you think they can build cyber weapons? And why limit our guesses to our most notorious enemies, really any nation can do this.

Oh, and so can many big corporations, which have exactly the same talent, have the money and are producing a myriad of spy devices that you carry around in your pocket every day.