JavaScript cryptography considered harmful?

After coming across an article from Matasano Security titled, "JavaScript Cryptography Considered Harmful," I decided to submit a question to the Security Now podcast to get a second opinion on the security of JavaScript cryptography. Here is Steve Gibson's take on the question of secure JavaScript cryptography in episode 365 of his podcast:

Matasano Security seems to be assuming a different use case than I'm interested in. They assume one wants to use JavaScript cryptography as a substitute for SSL/TLS, while I'm more concerned with secure storage of data in the cloud.

Why you should get an iPhone and skip Google Android

Apple is far stricter than Google about what apps can be sold for its smart phone. That lack of freedom has an upside: less vulnerability to malware:

The security of Google Android has once again been called into question after an academic researcher discovered 12 malicious apps hosted in the operating system's official applications market, some that had been hosted there for months and racked up hundreds of thousands of downloads.

Ten of the apps reported last week by North Carolina State University professor Xuxian Jiang contained highly stealthy code that collected users' browsing history, bookmarks, and device information and sent them to servers under the control of the attackers. The professor said they also contained a backdoor largely made possible by a weakness documented at a security conference 12 months ago that allows Android apps to be surreptitiously updated.

The malicious titles also contained functions that allowed the developers to collect login credentials for Facebook, Gmail, and other accounts...

Internet fraud up 33% in 2008

Internet fraud rose by a third last year:

Internet-based rip-offs jumped 33 percent last year over the previous year, according to a report from a complaint center set up to monitor such crimes.

The total dollar loss from those crimes was $265 million. That's $26 million more than the price tag in 2007, the National Internet Crime Center said. For individual victims, the average amount lost was $931.

"This report illustrates that sophisticated computer fraud schemes continue to flourish as financial data migrates to the Internet," said Shawn Henry, the FBI's assistant director of the Cyber Division. ...

Henry said the figures show the need for computer users, in businesses and in homes, to be wary and use sound security practices while using the Internet.

The center said the top three most frequent complaints were about merchandise that wasn't delivered or payment that wasn't received, Internet auction fraud and credit/debit card fraud. Other scams include confidence frauds such as Ponzi schemes, check fraud, the Nigerian letter fraud and identity fraud.

60 Minutes examines airline safety

For more on Bruce Schneier's criticism of TSA, click here.

You can also listen to a 10-minute podcast interview with former FBI agent Mike German, discussing counterterrorism, here.

India terrorist attack lessons learned

Security expert Bruce Schneier lists four lessons learned from the Mumbai terrorist attacks:

• Low-tech is very effective. Movie-plot threats — terrorists with crop dusters, terrorists with biological agents, terrorists targeting our water supplies — might be what people worry about, but a bunch of trained ... men with guns and grenades is all they needed.
• At the same time, the attacks were surprisingly ineffective. I can't find exact numbers, but it seems there were about 18 terrorists. The latest toll is 195 dead, 235 wounded. That's 11 dead, 13 wounded, per terrorist. As horrible as the reality is, that's much less than you might have thought if you imagined the movie in your head. Reality is different from the movies.
• Even so, terrorism is rare. If a bunch of men with guns and grenades is all they really need, then why isn't this sort of terrorism more common? Why not in the U.S., where it's easy to get hold of weapons? It's because terrorism is very, very rare.
• Specific countermeasures don't help against these attacks. None of the high-priced countermeasures that defend against specific tactics and specific targets made, or would have made, any difference: photo ID checks, confiscating liquids at airports, fingerprinting foreigners at the border, bag screening on public transportation, anything. Even metal detectors and threat warnings didn't do any good.

Schneier "cautiously optimistic" about Napolitano as possible head of DHS

Security expert Bruce Schneier likes what he hears from Obama's potential head of the Department of Homeland Security:

New DHS Head Understands Security. This quote impresses me:

Gov. Janet Napolitano, D-Ariz., is smashing the idea of a border wall, stating it would be too expensive, take too long to construct, and be ineffective once completed.

"You show me a 50-foot wall and I'll show you a 51-foot ladder at the border. That's the way the border works," Napolitano told the Associated Press.

Instead of a wall, she said funds would be better utilized on beefing up Border Patrol manpower, technology sensors and unmanned aerial vehicles.

I am cautiously optimistic.

Government uses scare tactics in recent terrorist attack warning

Security expert Bruce Schneier is critical of the recent warning that terrorists might target the New York City subway system:

An internal memo obtained by The Associated Press says the FBI has received a "plausible but unsubstantiated" report that al-Qaida terrorists in late September may have discussed attacking the subway system. ...

"We have no specific details to confirm that this plot has developed beyond aspirational planning, but we are issuing this warning out of concern that such an attack could possibly be conducted during the forthcoming holiday season," according to the warning dated Tuesday.

Got that: "plausible but unsubstantiated," "may have discussed attacking the subway system," "specific details to confirm that this plot has developed beyond aspirational planning," "attack could possibly be conducted," "it's plausible, but there's no evidence yet that it's in the process of being carried out."

I have no specific details, but I want to warn everybody today that fiery rain might fall from the sky. Terrorists may have discussed this sort of tactic, possibly at one of their tequila-fueled aspirational planning sessions. While there is no evidence yet that the plan in the process of being carried out, I want to be extra-cautious this holiday season. Ho ho ho.

What I find deeply troubling is that the government issued this warning about this "plausible but unsubstantiated" threat, while at the same time they were oblivious of the upcoming terrorist attack that occurred the very next day in India. It reminds me of just prior to September 11, 2001, when the government warned of possible terrorist attacks somewhere in Asia, but completely missed the actual attack that would occur days later in the U.S.

Barack Obama and counter-terrorism

The Foreign Policy Association's terrorism blog critiques Barack Obama's anti-terrorism stances:

Here is what I know of Obama’s view of the ‘War on Terror’ and International Conflict.

1. He has opposed the War in Iraq from the on-set, yet now hails the surge as a success and will defer further judgments on troop deployment to ‘commanders on the ground’.
2. While opposing the War in Iraq, he has frequently advocated intervention of some sort in troubled Darfur.
3. He opposes the torture or mistreatment of military detainees.
4. Obama would like to see an increased American presence in Afghanistan.
5. He is willing to launch military strikes within other nations should they be unable or unwilling to respond to terror-specific intelligence.
6. He views an unstable Pakistan and a nuclear-armed Iran as grave dangers to the international community and the United States.
7. In broad terms he views terror as an issue of law enforcement, not military engagement, although some military intervention is necessary.

All of this is sensible, rational, and pragmatic. However, like the Clinton years, it lacks a cohesiveness and clarity that is beneficial when launching a renewed terror strategy. Clinton’s biggest flaw was his lack of an over-arching principle. Bush the elder had his ‘new world order’, yet Clinton took every issue on a case-by-case basis. Engage in Africa for one conflict, yet ignore the other. Attack bin Laden for one bombing, yet ignore other atrocities. For better or worse, the Bush administration understood their position and was able to execute their policy with effectiveness. The American people too, understood the actions taken by their leaders.

Obama runs the very real risk of having to explain every single action he takes, defend each and every decision, and waste time explaining to a weary world why America has gone down her specific path.

Terrorist behavior

How terrorists prepare and where they strike, by Prof. Brent Smith of the University of Arkansas:

Research has shown that traditional criminals are spontaneous, but terrorists seem to go to great lengths preparing for their attacks — and may commit other crimes while doing so. How long does this planning take? And do different types of terrorist groups vary in preparation time? ...

According to our analysis, almost half (44 percent) of all terrorists examined lived within 30 miles of their targets. ... When the types of terrorist groups are examined separately, however, the findings are much different.

International terrorists lived relatively near their targets, whereas right-wing terrorists lived in rural areas but selected targets reflecting the “pollutants of urban life” in nearby cities. Terrorists most commonly prepared for their attacks with surveillance and intelligence gathering, robberies and thefts to raise funding for the group, weapons violations, and bomb manufacturing. ...

Although the terrorists studied committed most of their preparatory offenses near their homes, they conducted robberies, burglaries and thefts much farther away — an average of 429 miles from home. This suggests that most environmental and international terrorists live near the selected target and conduct surveillance and other general preparation near their homes and the eventual location of the attack. Major crimes to procure funding for the group — like thefts, robberies and burglaries — however, are intentionally committed many miles away to avoid drawing attention to the group’s location and target choice. ...

We found that preparations generally began less than six months before the attack and ended with a flurry of actions a day or so before. This pattern varied by group type. Single-issue and right-wing terrorists engaged in substantially less preparatory crime over a shorter period... The planning cycle of international terrorists tended to be longer. ...

International terrorists, on the other hand, engaged in nearly three times as many preparatory acts per incident as their environmental counterparts. This may be due to the larger number of people usually involved in international incidents, the size and scope of the planned incident or simply a longer planning cycle. Comparing the 10 international terrorist incidents that occurred on American soil, we found that the average planning cycle for international terrorists was 92 days, as opposed to 14 days for environmental terrorists. Averages can be misleading, however, because of significant outliers...

For law enforcement agencies, the implications of these patterns are significant. Committing an act of terrorism will usually involve local preparations. Although much of this conduct will not necessarily be criminal, early intelligence may give law enforcement the opportunity to stop the terrorists before an incident occurs. Knowledge of the threat — for example, understanding how long environmental or international terrorists prepare for their attacks — will affect the manner in which local officials respond. Identifying preparatory actions by environmental extremists may signal that an attack is imminent, whereas similar behavior by an international group might suggest that an attack is still several months away.

Understanding that most terrorists “act locally” can be important to know as investigative agencies seek to prevent terrorism and arrest perpetrators. These local patterns may be used by agencies to more efficiently patrol known, high-risk target areas and gather intelligence on suspected actions within a specific distance from potential targets.

The truth about biological weapons

From Stratfor:

While there has been much consternation and alarm-raising over the potential for widespread proliferation of biological weapons and the possible use of such weapons on a massive scale, there are significant constraints on such designs. The current dearth of substantial biological weapons programs and arsenals by governments worldwide, and the even smaller number of cases in which systems were actually used, seems to belie — or at least bring into question — the intense concern about such programs.

While we would like to believe that countries such as the United States, the United Kingdom and Russia have halted their biological warfare programs for some noble ideological or humanitarian reason, we simply can’t. If biological weapons were in practice as effective as some would lead us to believe, these states would surely maintain stockpiles of them, just as they have maintained their nuclear weapons programs. Biological weapons programs were abandoned because they proved to be not as effective as advertised and because conventional munitions proved to provide more bang for the buck.

In some ways, the psychological fear of a “super weapon” — undetectable, microscopic, easily delivered and extremely deadly — shapes assessment of the threat, more so than an objective understanding of actual capability and intent (not to mention the extreme difficulties of ever creating some sort of a super bug). Conventional weapons systems, and unconventional tactics, continue to be the most cost-effective and proven methods of warfare, whether between state actors or between state and nonstate actors. Nuclear weapons have also been shown to have true weapons of mass destruction power.

To help keep the cost-benefit calculation of a biological warfare program in perspective, consider that Seung-Hui Cho, the man who committed the shooting at Virginia Tech, killed 32 people — more than six times as many as were killed by the 2001 anthrax letters. John Mohammed, the so-called “D.C. Sniper,” was able to cause a considerable amount of panic and kill twice as many people (10) by simply purchasing and using one assault rifle. Compare Mohammed’s effort and expenses to that of the Aum Shinrikyo anthrax program that took years of work by a huge team and millions of dollars to develop but infected no one.

Now, just because biological weapons are not all they are cracked up to be does not mean that efforts to undermine the biological warfare plans and efforts of militant groups such as al Qaeda should not continue or that programs to detect such agents or develop more effective treatments and vaccines should be halted. Even though an anthrax attack probably will not kill huge numbers of people, as we saw in the case of the anthrax letters, such an attack can be quite disruptive. Cleaning up after such an attack is expensive and takes considerable time and effort. Like a dirty bomb, an anthrax attack will more likely serve as a weapon of mass disruption and not a weapon of mass destruction.

Due to the disruption and the potential for some deaths as a result of an anthrax attack, the threat against the United States does remain a significant concern. However, the threat it represents is not as great as that of conventional attacks using firearms and explosives against soft targets, and it certainly does not rise anywhere near the level of a threat posed by a terrorist attack using a nuclear weapon.

Homeland security resources are very limited and have been shrinking as we move further from 9/11 and as other items begin to take precedence in the federal budget. This means that an array of different programs is being forced to scramble for an ever-shrinking piece of the funding pie. In such an environment, it is often a temptation to overstate the threat. Such overstatements are harmful because they can sometimes prevent a rational distribution of resources and prevent resources from being allocated to where they are needed most.

Hat tip: Bruce Schneier

Advice for improved national security, a balanced budget, and a cleaner environment

Here is timeless advice from 2006 by Harvard economist Greg Mankiw:

Here's a wacky idea you won't often hear from our elected leaders: We should raise the tax on gasoline. Not quickly, but substantially. I would like to see Congress increase the gas tax by $1 per gallon, phased in gradually by 10 cents per year over the next decade. Campaign consultants aren't fond of this kind of proposal, but policy wonks keep pushing for it. Here's why:

The environment. The burning of gasoline emits several pollutants. These include carbon dioxide, a cause of global warming. Higher gasoline taxes, perhaps as part of a broader carbon tax, would be the most direct and least invasive policy to address environmental concerns.

Road congestion. Every time I am stuck in traffic, I wish my fellow motorists would drive less, perhaps by living closer to where they work or by taking public transport. A higher gas tax would give all of us the incentive to do just that, reducing congestion on streets and highways.

Regulatory relief. Congress has tried to reduce energy dependence with corporate average fuel economy standards. These CAFE rules are heavy-handed government regulations replete with unintended consequences: They are partly responsible for the growth of SUVs, because light trucks have laxer standards than cars. In addition, by making the car fleet more fuel-efficient, the regulations encourage people to drive more, offsetting some of the conservation benefits and exacerbating road congestion. A higher gas tax would accomplish everything CAFE standards do, but without the adverse side effects.

The budget. Everyone who has studied the numbers knows that the federal budget is on an unsustainable path. When baby-boomers retire and become eligible for Social Security and Medicare, either benefits for the elderly will have to be cut or taxes raised. The most likely political compromise will include some of each. A $1 per gallon hike in gas tax would bring in $100 billion a year in government revenue and make a dent in the looming fiscal gap.

Tax incidence. A basic principle of tax analysis -- taught in most freshman economics courses -- is that the burden of a tax is shared by consumer and producer. In this case, as a higher gas tax discouraged oil consumption, the price of oil would fall in world markets. As a result, the price of gas to consumers would rise by less than the increase in the tax. Some of the tax would in effect be paid by Saudi Arabia and Venezuela.

Economic growth. Public finance experts have long preached that consumption taxes are better than income taxes for long-run economic growth, because income taxes discourage saving and investment. Gas is a component of consumption. An increased reliance on gas taxes over income taxes would make the tax code more favorable to growth. It would also encourage firms to devote more R&D spending to the search for gasoline substitutes.

National security. Alan Greenspan called for higher gas taxes recently. "It's a national security issue," he said. It is hard to judge how much high oil consumption drives U.S. involvement in Middle Eastern politics. But Mr. Greenspan may well be right that the gas tax is an economic policy with positive spillovers to foreign affairs.

Is it conceivable that the policy wonks will ever win the battle with the campaign consultants? I think it is. Even after a $1 hike, the U.S. gas tax would still be less than half the level in, say, Great Britain, which last I checked is still a democracy. But don't expect those vying for office to come around until the American people recognize that while higher gas taxes are unattractive, the alternatives are even worse.

The truth behind Chinese cyber attacks

This comes from the excellent computer and homeland security blog Schneier on Security:

The popular media conception is that there is a coordinated attempt by the Chinese government to hack into U.S. computers — military, government, corporate — and steal secrets. The truth is a lot more complicated.

There certainly is a lot of hacking coming out of China. Any company that does security monitoring sees it all the time.

These hacker groups seem not to be working for the Chinese government. They don't seem to be coordinated by the Chinese military. They're basically young, male, patriotic Chinese citizens, trying to demonstrate that they're just as good as everyone else. ...

This is not to say that the Chinese military ignores the hacker groups within their country. Certainly the Chinese government knows the leaders of the hacker movement and chooses to look the other way. They probably buy stolen intelligence from these hackers. They probably recruit for their own organizations from this self-selecting pool of experienced hacking experts. They certainly learn from the hackers.

And some of the hackers are good. Over the years, they have become more sophisticated in both tools and techniques. They're stealthy. They do good network reconnaissance. My guess is what the Pentagon thinks is the problem is only a small percentage of the actual problem. ...

If anything, the fact that these groups aren't being run by the Chinese government makes the problem worse. Without central political coordination, they're likely to take more risks, do more stupid things and generally ignore the political fallout of their actions. ...

So while I'm perfectly happy that the U.S. government is using the threat of Chinese hacking as an impetus to get their own cybersecurity in order, and I hope they succeed, I also hope that the U.S. government recognizes that these groups are not acting under the direction of the Chinese military and doesn't treat their actions as officially approved by the Chinese government.

Is waterboarding torture? A journalist undergoes the treatment

Is waterboarding torture? Christopher Hitchens of Vanity Fair underwent the process and gives us his firsthand account:

Arms already lost to me, I wasn’t able to flail as I was pushed onto a sloping board and positioned with my head lower than my heart. (That’s the main point: the angle can be slight or steep.) Then my legs were lashed together so that the board and I were one single and trussed unit. ...

You may have read by now the official lie about this treatment, which is that it “simulates” the feeling of drowning. This is not the case. You feel that you are drowning because you are drowning—or, rather, being drowned, albeit slowly and under controlled conditions and at the mercy (or otherwise) of those who are applying the pressure. The “board” is the instrument, not the method. You are not being boarded. You are being watered. This was very rapidly brought home to me when, on top of the hood, which still admitted a few flashes of random and worrying strobe light to my vision, three layers of enveloping towel were added. In this pregnant darkness, head downward, I waited for a while until I abruptly felt a slow cascade of water going up my nose. Determined to resist if only for the honor of my navy ancestors who had so often been in peril on the sea, I held my breath for a while and then had to exhale and—as you might expect—inhale in turn. The inhalation brought the damp cloths tight against my nostrils, as if a huge, wet paw had been suddenly and annihilatingly clamped over my face. Unable to determine whether I was breathing in or out, and flooded more with sheer panic than with mere water, I triggered the pre-arranged signal and felt the unbelievable relief of being pulled upright and having the soaking and stifling layers pulled off me. I find I don’t want to tell you how little time I lasted. ...

An interval was ordered, and then I felt the mask come down again. Steeling myself to remember what it had been like last time, and to learn from the previous panic attack, I fought down the first, and some of the second, wave of nausea and terror but soon found that I was an abject prisoner of my gag reflex. The interrogators would hardly have had time to ask me any questions, and I knew that I would quite readily have agreed to supply any answer. I still feel ashamed when I think about it. Also, in case it’s of interest, I have since woken up trying to push the bedcovers off my face, and if I do anything that makes me short of breath I find myself clawing at the air with a horrible sensation of smothering and claustrophobia. No doubt this will pass. As if detecting my misery and shame, one of my interrogators comfortingly said, “Any time is a long time when you’re breathing water.” I could have hugged him for saying so, and just then I was hit with a ghastly sense of the sadomasochistic dimension that underlies the relationship between the torturer and the tortured. I apply the Abraham Lincoln test for moral casuistry: “If slavery is not wrong, nothing is wrong.” Well, then, if waterboarding does not constitute torture, then there is no such thing as torture.

I issue a challenge to anyone who thinks waterboarding is not torture to undergo the process. After all, if it isn't torture, what are you afraid of?

How the FARC hostages were rescued: a classic man-in-the-middle attack

From Schneier on Security:

Last week's dramatic rescue of 15 hostages held by the guerrilla organization FARC was the result of months of intricate deception on the part of the Colombian government. At the center was a classic man-in-the-middle attack.

In a man-in-the-middle attack, the attacker inserts himself between two communicating parties. Both believe they're talking to each other, and the attacker can delete or modify the communications at will.

The Wall Street Journal reported how this gambit played out in Colombia:

"The plan had a chance of working because, for months, in an operation one army officer likened to a 'broken telephone,' military intelligence had been able to convince Ms. Betancourt's captor, Gerardo Aguilar, a guerrilla known as 'Cesar,' that he was communicating with his top bosses in the guerrillas' seven-man secretariat. Army intelligence convinced top guerrilla leaders that they were talking to Cesar. In reality, both were talking to army intelligence."

This ploy worked because Cesar and his guerrilla bosses didn't know one another well. They didn't recognize one anothers' voices, and didn't have a friendship or shared history that could have tipped them off about the ruse. Man-in-the-middle is defeated by context, and the FARC guerrillas didn't have any.

Bruce Schneier goes on to explain the implications for internet security. However, I'd like to mention the implications for the war on Al-Qaeda. More so than the FARC, Al-Qaeda is a disperse, loosely-linked organization where members don't know each other. That makes it the perfect target for a man-in-the-middle attack. If the CIA isn't already using it, they could really learn something from the FARC hostage rescue.

Ridiculous airport security

From Schneier on Security:

"You ain't takin' this through," she says. "No knives. You can't bring a knife through here."

It takes a moment for me to realize that she's serious. "I'm ... but ... it's ..."

"Sorry." She throws it into a bin and starts to walk away.

"Wait a minute," I say. "That's airline silverware."

"Don't matter what it is. You can't bring knives through here."

"Ma'am, that's an airline knife. It's the knife they give you on the plane."

Senate Democrats sacrifice our liberties

From The Register:

The Senate today passed the revised Foreign Intelligence Surveillance Act (FISA), offering blanket immunity to the telecoms giants for whatever spying activities they conspired in, smothering ongoing litigation against the companies and for all intents and purposes burying forever whatever unconstitutional surveillance activities the Cheney administration embraced.

The bill, in fact, expands authority for unsupervised domestic surveillance while offering somewhat expanded protection for Americans living abroad. The oversight role of the FISA court itself is diminished, inasmuch as the bill requires markedly less specificity for obtaining a FISA surveillance warrant than is currently required.

Although the new bill does not quite permit blanket wiretaps, it does give authority to the Director of National Intelligence or the Attorney General to authorize surveillance on individuals or those connected to them without designating exactly what they're hunting. The court merely signs off on this type of surveillance in a kind of procedural flourish – as long as sufficient "minimization" procedures are in place to avoid accidental surveillance of Americans. You can expect the National Security Agency (NSA) or the Department of Justice (DOJ) to push the envelope.