Angels of security » cryptography

Football signals and security models

admin — Fri, 22 Oct 2010 18:28:10 +0000

Rarely do I encounter situations where two completely disparate interests in my life – for example security and football – intersect as they recently did. This article describes how the University of Oregon football team was upset because it seemed to them that other teams were stealing their signals and knew what plays they were calling. Usually a team’s quarterback will have a radio in his helmet. The coach will relay in the play from the sidelines, and the QB tells the rest of the team in the huddle. In football, if the defense knows what play is being called, they have a significant advantage. The Ducks decided to take a new approach. Instead of simply trying to make their communications secret, they actually make them public. Someone on the sideline holds up a giant sign with four images on it. The team knows the system, and that tells everyone, at the same time, what the play is. Removing the extra step (QB telling the whole team in the huddle what the play is), also sped up the team’s offense. Effort were made to ensure that usability did not suffer do to their new security:

The Ducks couldn’t elaborate on the meaning of the images for obvious reasons, but Asper said it’s not rocket science. “It’s just like the signals – each thing stands for different things,’’ Asper said. “We’re simple creatures. If a guy has a cap, it’s a cap. It’s real simple, real basic. Clover? OK, lucky, Irish – something like that. “It’s not, ‘OK, I have to add the top square and the bottom square.’ We’re not dividing matrices out there. And you can immediately see what’s there, as opposed to going through the dance of all the formations.’’

There is also some sort of defense against replay attacks

tonight Oregon used the same signal boards multiple times and ran different plays each time.

This is a great example of security being an enabler instead of a hindrance:

Seems like this is a big reason why the Ducks are averaging around 15 seconds in between the end of a play and the next snap.

wildcard certificates security

admin — Sun, 25 Jul 2010 19:21:54 +0000

In the previous post I mentioned multi-domain certificates but not wildcard certificates as a solution to the problem. The reason I didn’t mention wildcard certificates is because they have their own inherent security risks. If one subdomain is compromised, all subdomains may be compromised. (Verisign even states this clearly on their page on wildcard certificates.)

You forgot the encryption

admin — Thu, 17 Dec 2009 16:17:19 +0000

Apparently the drones that the US has been using in Iraq and Afghanistan have no encrypted their video feeds, and pentagon officials have revealed that insurgents have been eavesdropping on the video transmissions. According to the WSJ:

Senior defense and intelligence officials said Iranian-backed insurgents intercepted the video feeds by taking advantage of an unprotected communications link in some of the remotely flown planes’ systems. Shiite fighters in Iraq used software programs such as SkyGrabber — available for as little as $25.95 on the Internet — to regularly capture drone video feeds, according to a person familiar with reports on the matter.

U.S. military personnel in Iraq discovered the problem late last year when they apprehended a Shiite militant whose laptop contained files of intercepted drone video feeds. In July, the U.S. military found pirated drone video feeds on other militant laptops, leading some officials to conclude that militant groups trained and funded by Iran were regularly intercepting feeds.

Think that’s astounding? Wait till you see this:

The potential drone vulnerability lies in an unencrypted downlink between the unmanned craft and ground control. The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn’t know how to exploit it, the officials said.

They’ve known about this for nearly two decades and haven’t done anything? C’mon guys – encryption isn’t exactly a new technology. As for assuming that insurgents wouldn’t know how to take advantage of the flaw, don’t even get me started. You should never underestimate your adversary, especially in war. In the modern information age knowledge is easy to come by, so assuming any large group of people will not have certain knowledge is a perilous assumption.

200 year old cipher broken

admin — Thu, 02 Jul 2009 19:52:56 +0000

A 200 year old ciphered message sent to Thomas Jefferson has been broken (with the help of a computer of course).

Drug smuggling codes

admin — Wed, 24 Jun 2009 02:19:45 +0000

I recently finished “High: Confessions of an International Drug Smuggler“. The author, Brian O’dea, is a former (and now reformed) drug smuggler and addict who pulled off a few very large smuggling operations. In one of his largest ones he tried to bring in huge quantities of drugs from Asia via boat without being picked up by the feds who had been tipped off to his activities by an informant. They also needed to communicate with boats as far away as the South China sea and Alaska from the US mainland. They decided to use Single-sideband radio, which was used by licensed amateurs. They set up an antenna in a campground powered by a mobile home. It had the power they needed for communications, but the government knew about single-sideband, and was constantly monitoring for people using it for illicit purposes.

Since it was 1985, they didn’t have access to modern cryptography. To avoid the feds, they needed something which not only encoded their information, but also sounded innocuous. Here’s what they did. They all bought copies of Websters dictionary. When they wanted to send a sentence, they looked up each word in the dictionary, noted the page number, and the entry it was on the page. If the word appeared on page 795, and was the 23rd word on the page then he would call the ship (or the home base in the other direction) and ask them to check part number 795-23. Doing this over and over again any eavesdropper would think it was just a ship requesting information on a list of parts.

Analyzing this, it is actually surprisingly good. At first I assumed that because it’s a basic substitution cipher, usually the easiest type of cipher to break, it would crumble quickly. However, substitution ciphers are usually broken because they don’t hide the distribution of letters, and their distribution can be easily matched to the distribution of English letters. In this case they’re not substituting letters, but words. There are only 26 letters in English, but far more words. Given the extremely small amount of ciphertext, it is unlikely that a proper distribution could ever have been discovered. While a straight substitution cipher has very little entropy, and the ciphertext is still going to be highly structured, the limited amount of ciphertext would make cryptanalysis very hard. Someone trying to attack the system would probably only break it if they managed to get a person to talk or captured a boat and noticed the dictionary lying conspicuously close to the radio equipment.

1024 bit RSA key circumvented

admin — Thu, 19 Jun 2008 02:05:42 +0000

The gpcode virus has been making news of late. It’s ransom-ware that encrypted the infected machine’s files with a 1024 bit RSA key, demanding a monetary payment in exchange for the decryption key. Kaspersky labs announced that they would try to brute force the key if people would just loan them some spare CPU cycles. They took some flak for even trying this, including a rebuke from the master cryptographer himself, Bruce Schneier.

Now it appears they’ve found a solution. No, they haven’t cracked a 1024 bit RSA key this quickly, they’ve discovered that the files can be undeleted, and released a utility to assist in the endeavor. This is another example of Shamir’s third law of security. For those of you who don’t know, Adi Shamir, recipient of the turing award and the S in RSA once delivered his 3 laws of security:

Absolutely secure systems do not exist
To halve your vulnerability you need to double your expenditure
Cryptography is typically bypassed, not penetrated

This is about as good an example of law number three as I can think of. Kaspersky would have found it nearly impossible to break the key in a meaningful amount of time, however circumventing the cryptography proved itself to be much easier.