The Daily Parker

Politics, Weather, Photography, and the Dog

How to destroy democracy through bad software

Via Bruce Schneier, last week the hacker convention DefCon hosted an event at which every single electronic voting machine tested got pwned within minutes:

Also, organizers revealed that many of these machines arrived with their voter records intact, sold on by county voting authorities who hadn't wiped them first.

While many people at the Voter Hacking Village zeroed in on the weak mechanical lock covering access to the machine's USB port, Synack worked on two open USB ports right on the back. No lock picking was necessary.

The team plugged in a mouse and a keyboard -- which didn't require authentication -- and got out of the voting software to standard Windows XP just by pressing "control-alt-delete." The same thing you do to force close a program can be used to hack an election.

Remember, Russian interference in the 2016 election wasn't designed to throw the election to Trump (though that was a "nice to have" for them), it was designed to reduce the public's faith in the entire Democratic system. I'm glad American voting machine manufacturers are helping them.

Where did the day go?

Usually when I work from home, I get a lot done. Today...not as much. I've run errands, had two meetings outside the house, and (to Parker's horror) vacuumed.

Now I'm off to another meeting, with half the house un-vacuumed and many emails unread.

Articles also unread:

Now, time for a board meeting.

Maybe someday the U.S. will catch up to Europe and Canada

Specifically today, I'm talking about chipped credit cards, which the rest of the world has had for years longer than we have, and they're a lot less annoying. Bloomberg's Ben Steverman explains why:

It's an awkward and irritating experience, and payment companies are aware of the problems. "Some places, it's seamless and beautiful," said Robert Martin, North American vice president of security solutions at Ingenico Group, the second-largest maker of payment terminals in the U.S. "Other places, not so much. But we're learning." 

Unfortunately, there are no easy fixes. To connect to card networks, retailers use a countless array of software providers and payment processors. Payments can also be linked to more than a dozen other applications controlling store operations, from coupons to inventory. If not configured perfectly, this tangle of systems and vendors can slow chip transactions to a crawl. 

Customers' experience with chip cards should improve gradually, one upgrade at a time, as the systems become more standardized, industry experts say. Slow transactions and confusing interfaces will disappear, or retailers risk losing customers to rivals with more pleasant checkout experiences.

Once again, the U.S. is way behind the rest of the world. In the U.K. and Canada, about 40 percent of Visa's transactions are contact-less, the payment network says. In Australia, the number is 85 percent.

And let's not forget: in the rest of the world they use chip and PIN systems, which are far more secure than chip and signature. Maybe someday...

Don't do this. Just don't.

It's a general rule of software security that, if I have physical access to your computer, I own it.

I'm analyzing a piece of software so that I can transfer its data to another application. The software runs on a local machine and is written in .NET, with a SQL Express back-end. I have administrator access to the SQL database, the machine, and therefore, to the software.

It took me all of an hour to find the master encryption key in one of the DLLs that make up the software, and another hour to build an applet—using the software's own assemblies—that can read and decrypt every byte in the database.

Good thing I'm covered by a confidentiality agreement and the owner of the data has engaged my company to do exactly what I'm doing. But wow, we really need to migrate this stuff quickly, and get it the hell off this computer.

Google's Project Zero for laypeople

Via Bruce Schneier (again), Fortune takes a look at Google's security project:

Google officially formed Project Zero in 2014, but the group’s origins stretch back another five years. It often takes an emergency to drive most companies to take security seriously. For Google, that moment was Operation Aurora.

In 2009, a cyberespionage group associated with the Chinese government hacked Google and a number of other tech titans, breaching their servers, stealing their intellectual property, and attempting to spy on their users. The pillaging outraged Google’s top executives—enough so that the company eventually exited China, the world’s biggest market, over the affair.

The event particularly bothered Google co-founder Sergey Brin. Computer-forensics firms and investigators determined that the company had been hacked not through any fault of Google’s own software, but via an unpatched flaw in Microsoft Internet Explorer 6. Why, he wondered, should Google’s security depend on other companies’ products?

Says Schneier,

I have mixed feeling about it. The project does great work, and the Internet has benefited enormously from these efforts. But as long as it is embedded inside Google, it has to deal with accusations that it targets Google competitors.

On the other hand, as Schneier's commenters point out (and as he has suggested in the past), better Google exposing the bugs than the NSA losing control of them.

The women who broke Nazi codes

Via Bruce SchneierTech Republic tells the story of the women who worked at Bletchley Park during World War II:

Because [Alan] Turing's individual achievements were so momentous, it's sometimes forgotten that more than 10,000 other people worked at the Government Code and Cypher School, of whom more than two-thirds were female. These servicewomen played a pivotal role in an operation that decrypted millions of German messages and which is credited with significantly shortening the war.

The code-breaking operation was spread over teams working in various huts around the manor house at Bletchley, with the bombe machines situated in outstations nearby. There were about 8,000 people involved in the code-breaking—what was known as the factory—and 4,000 support staff. Each team generally knew no more than was necessary about what the other groups were doing.

Teams worked in different huts on breaking the Enigma codes, focusing on the army and air-force ciphers in one and the tougher naval encryption in another. Unscrambled messages were then sent on to linguists for translation and officials who would decide how the information should be used and, more importantly, whether it could be used without revealing that the Allies had cracked Enigma.

This history is hinted at, however minimally, by Kiera Knightly's character in The Imitation Game.

Europe's worst case scenario

We have a child in the White House. And European leaders are saying they can no longer rely on the United States:

Trump’s speech alone is likely a sufficient explanation. But I suspect there’s an additional element. Most of the major European and NATO leaders had already met Trump in Washington – Merkel, May, Gentiloni, Trudeau and others. But I suspect in meeting as a group, over a more extended period and in a context specifically focused on Europe and NATO there was a further realization that what they are watching from across the Atlantic is no act. Indeed, Trump appears more impulsive and erratic in person than on TV. Rather than growing into the job he’s growing into the role of aggressor.

Another, perhaps more critical realization, is suggested in this Twitter thread by Max Fisher of the Times: That is, it’s not just that Trump is greedy or impulsive or unreliable, indifferent to the North Atlantic alliance but that he is positively against it. He and Vladimir Putin are in a de facto alliance against ‘Europe’ or to put it less geographically, the liberal internationalist state system which has rested on and built out from the United States and Western Europe.

I've imagined the damage that Trump can do to the world, and I am seeing how what I've imagined is coming to pass. I hope Europe is stronger than they have seemed so far.

Don't push that button!

British Airways cancelled all of its flights out of its two biggest hubs in London today because of a power-supply failure:

The airline hoped to be able to operate some long haul inbound flights on Saturday, landing in London on Sunday, Mr Cruz added.

The GMB union has suggested the failure could have been avoided, had the airline not outsourced its IT work.

BA refuted the claim, saying: "We would never compromise the integrity and security of our IT systems".

All passengers affected by the failure - which coincides with the first weekend of the half-term holiday for many in the UK - will be offered the option of rescheduling or a refund.

The airline, which had previously said flights would be cancelled until 18:00 BST, has now cancelled all flights for Saturday and asked passengers not to come to Gatwick or Heathrow airports.

Some things never change.

Mueller appointed special counsel

Surprising everyone in Washington last night, Deputy Attorney General Rod Rosenstein appointed former FBI director Robert Mueller as special counsel to investigate the Trump campaign's possible ties to Russia. The Washington Post sees this as really bad news for the president:

“The risk is that you lose control of your agenda,” added Robert Luskin, a Washington white-collar attorney who represented Karl Rove in the Plame investigation, as well as a pair of Clinton senior officials during Whitewater. “It’s an enormous distraction. It’s an energy suck. As long as the clouds hang over a presidency it becomes much more difficult to get anything else done.”

This is why White House officials and GOP leaders in Congress have so strongly resisted a special counsel until now.

The FiveThirtyEight blog has a balancing view:

Although the simple case is that Mueller’s appointment is not welcome news for Trump — the White House was surprised by the announcement — it does have some plausible benefits for the president, especially in the near term. The Russia investigation had been dogging the Trump administration, and his firing of Comey had turned into a debacle.

Trump can now say there is an independent investigation going on, by someone he did not personally appoint and who is not beholden to his party. And Mueller has very strong credentials. The president and his team, in theory, can turn the focus to governing, while deferring questions about the investigation. And maybe Comey, who appears to have notes of every conversation he has had with the president, will share them with Mueller and not The New York Times.

But:

Mueller’s appointment ensures that the Russia controversy won’t just go away — at least not anytime soon. And he could gravely threaten Trump’s presidency if he finds clear, improper connections between the president’s campaign and Russian officials. There was a reason that Republicans on Capitol Hill and the Trump administration were trying to stop the appointment of a special counsel. Prosecutors with broad authority to investigate can cause major problems. Just ask Bill Clinton.

Greg Sargent simply says "Trump is totally delusional about what’s happening to him right now."

On the other side, Fox News is downplaying the appointment, reporting that Mueller and Comey have had a "long, close relationship." Otherwise they seem more preoccupied with Roger Ailes' death ("and his legacy of free speech"). And I'm not going to look at the far-right reactions just now.

So is this a good development? We'll see.