Crypto-Gram
January 15, 2023

by Bruce Schneier
Fellow and Lecturer, Harvard Kennedy School schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit Crypto-Gram's web page.

Read this issue on the web

These same essays and news items appear in the Schneier on Security blog, along
with a lively and intelligent comment section. An RSS feed is available.

** *** ***** ******* *********** *************

In this issue:

If these links don't work in your email client, try reading this issue of
Crypto-Gram on the web.

A Security Vulnerability in the KmsdBot Botnet Apple Patches iPhone Zero-Day
As Long as WeΓÇÖre on the Subject of CAPTCHAs How to Surrender to a Drone
Trojaned Windows Installer Targets Ukraine Ukraine Intercepting Russian
Soldiers' Cell Phone Calls Critical Microsoft Code-Execution Vulnerability
Hacking the JFK Airport Taxi Dispatch System LastPass Breach
Arresting IT Administrators
QR Code Scam
Recovering Smartphone Voice from the Accelerometer Breaking RSA with a Quantum
Computer Decarbonizing Cryptocurrencies through Taxation Remote Vulnerabilities
in Automobiles Schneier on Security Audiobook Sale Identifying People Using Cell
Phone Location Data ChatGPT-Written Malware
Experian Privacy Vulnerability
Threats of Machine-Generated Text
Booklist Review of A HackerΓÇÖs Mind Upcoming Speaking Engagements
** *** ***** ******* *********** *************

A Security Vulnerability in the KmsdBot Botnet

[2022.12.15] Security researchers found a software bug in the KmsdBot
cryptomining botnet:

With no error-checking built in, sending KmsdBot a malformed command -- like its
controllers did one day while Akamai was watching -- created a panic crash with
an ΓÇ£index out of rangeΓÇ¥ error. Because thereΓÇÖs no persistence, the bot
stays down, and malicious agents would need to reinfect a machine and rebuild
the botΓÇÖs functions. It is, as Akamai notes, ΓÇ£a nice storyΓÇ¥ and
ΓÇ£a strong example of the fickle nature of technology.ΓÇ¥

** *** ***** ******* *********** *************

Apple Patches iPhone Zero-Day

[2022.12.16] The most recent iPhone update -- to version 16.2 -- patches a
zero-day vulnerability that ΓÇ£may have been actively exploited against versions
of iOS released before iOS 15.1.ΓÇ¥

News:

Apple said security researchers at GoogleΓÇÖs Threat Analysis Group, which
investigates nation state-backed spyware, hacking and cyberattacks, discovered
and reported the WebKit bug.

WebKit bugs are often exploited when a person visits a malicious domain in their
browser (or via the in-app browser). ItΓÇÖs not uncommon for bad actors to find
vulnerabilities that target WebKit as a way to break into the deviceΓÇÖs
operating system and the userΓÇÖs private data. WebKit bugs can be
ΓÇ£chainedΓÇ¥ to other vulnerabilities to break through multiple layers of a
deviceΓÇÖs defenses.

** *** ***** ******* *********** *************

As Long as WeΓÇÖre on the Subject of CAPTCHAs

[2022.12.16] There are these.





** *** ***** ******* *********** *************

How to Surrender to a Drone

[2022.12.19] The Ukrainian army has released an instructional video explaining
how Russian soldiers should surrender to a drone:

ΓÇ£Seeing the drone in the field of view, make eye contact with it,ΓÇ¥ the
video instructs. Soldiers should then raise their arms and signal theyΓÇÖre
ready to follow.

After that the drone will move up and down a few meters, before heading off at
walking pace in the direction of the nearest representatives of UkraineΓÇÖs
army, it says.

The video also warns that the droneΓÇÖs battery may run low, in which case it
will head back to base and the soldiers should stay put and await a fresh one.

That one, too, should be met with eye contact and arms raised, it says.

Incredible.

** *** ***** ******* *********** *************

Trojaned Windows Installer Targets Ukraine

[2022.12.20] Mandiant is reporting on a trojaned Windows installer that targets
Ukrainian users. The installer was left on various torrent sites, presumably
ensnaring people downloading pirated copies of the operating system:

Mandiant uncovered a socially engineered supply chain operation focused on
Ukrainian government entities that leveraged trojanized ISO files masquerading
as legitimate Windows 10 Operating System installers. The trojanized ISOs were
hosted on Ukrainian- and Russian-language torrent file sharing sites. Upon
installation of the compromised software, the malware gathers information on the
compromised system and exfiltrates it. At a subset of victims, additional tools
are deployed to enable further intelligence gathering. In some instances, we
discovered additional payloads that were likely deployed following initial
reconnaissance including the STOWAWAY, BEACON, and SPAREPART backdoors.

One obvious solution would be for Microsoft to give the Ukrainians Windows
licenses, so they donΓÇÖt have to get their software from sketchy torrent sites.

** *** ***** ******* *********** *************

Ukraine Intercepting Russian Soldiers' Cell Phone Calls

[2022.12.21] TheyΓÇÖre using commercial phones, which go through the Ukrainian
telecom network:

ΓÇ£You still have a lot of soldiers bringing cellphones to the frontline who
want to talk to their families and they are either being intercepted as they go
through a Ukrainian telecommunications provider or intercepted over the air,ΓÇ¥
said Alperovitch. ΓÇ£That doesnΓÇÖt pose too much difficulty for the Ukrainian
security services.ΓÇ¥

[...]

ΓÇ£Security has always been a mess, both in the army and among defence
officials,ΓÇ¥ the source said. ΓÇ£For example, in 2013 they tried to get all the
staff at the ministry of defence to replace our iPhones with Russian-made Yoto
smartphones.

ΓÇ£But everyone just kept using the iPhone as a second mobile because it was
much better. We would just keep the iPhone in the carΓÇÖs glove compartment for
when we got back from work. In the end, the ministry gave up and stopped caring.
If the top doesnΓÇÖt take security very seriously, how can you expect any
discipline in the regular army?ΓÇ¥

This isnΓÇÖt a new problem and it isnΓÇÖt a Russian problem. HereΓÇÖs a more
general article on the problem from 2020.

** *** ***** ******* *********** *************

Critical Microsoft Code-Execution Vulnerability

[2022.12.22] A critical code-execution vulnerability in Microsoft Windows was
patched in September. It seems that researchers just realized how serious it was
(and is):

Like EternalBlue, CVE-2022-37958, as the latest vulnerability is tracked, allows
attackers to execute malicious code with no authentication required. Also, like
EternalBlue, itΓÇÖs wormable, meaning that a single exploit can trigger a chain
reaction of self-replicating follow-on exploits on other vulnerable systems. The
wormability of EternalBlue allowed WannaCry and several other attacks to spread
across the world in a matter of minutes with no user interaction required.

But unlike EternalBlue, which could be exploited when using only the SMB, or
server message block, a protocol for file and printer sharing and similar
network activities, this latest vulnerability is present in a much broader range
of network protocols, giving attackers more flexibility than they had when
exploiting the older vulnerability.

[...]

Microsoft fixed CVE-2022-37958 in September during its monthly Patch Tuesday
rollout of security fixes. At the time, however, Microsoft researchers believed
the vulnerability allowed only the disclosure of potentially sensitive
information. As such, Microsoft gave the vulnerability a designation of
ΓÇ£important.ΓÇ¥ In the routine course of analyzing vulnerabilities after
theyΓÇÖre patched, Palmiotti discovered it allowed for remote code execution in
much the way EternalBlue did. Last week, Microsoft revised the designation to
critical and gave it a severity rating of 8.1, the same given to EternalBlue.

** *** ***** ******* *********** *************

Hacking the JFK Airport Taxi Dispatch System

[2022.12.23] Two men have been convicted of hacking the taxi dispatch system at
the JFK airport. This enabled them to reorder the taxis on the list; they
charged taxi drivers $10 to cut the line.

** *** ***** ******* *********** *************

LastPass Breach

[2022.12.26] Last August, LastPass reported a security breach, saying that no
customer information -- or passwords -- were compromised. Turns out the full
story is worse:

While no customer data was accessed during the August 2022 incident, some source
code and technical information were stolen from our development environment and
used to target another employee, obtaining credentials and keys which were used
to access and decrypt some storage volumes within the cloud-based storage
service.

[...]

To date, we have determined that once the cloud storage access key and dual
storage container decryption keys were obtained, the threat actor copied
information from backup that contained basic customer account information and
related metadata including company names, end-user names, billing addresses,
email addresses, telephone numbers, and the IP addresses from which customers
were accessing the LastPass service.

The threat actor was also able to copy a backup of customer vault data from the
encrypted storage container which is stored in a proprietary binary format that
contains both unencrypted data, such as website URLs, as well as fully-encrypted
sensitive fields such as website usernames and passwords, secure notes, and
form-filled data.

ThatΓÇÖs bad. ItΓÇÖs not an epic disaster, though.

These encrypted fields remain secured with 256-bit AES encryption and can only
be decrypted with a unique encryption key derived from each userΓÇÖs master
password using our Zero Knowledge architecture. As a reminder, the master
password is never known to LastPass and is not stored or maintained by LastPass.

So, according to the company, if you chose a strong master password -- hereΓÇÖs
my advice on how to do it -- your passwords are safe. That is, you are secure as
long as your password is resilient to a brute-force attack. (That they lost
customer data is another story....)

Fair enough, as far as it goes. My guess is that many LastPass users do not have
strong master passwords, even though the compromise of your encrypted password
file should be part of your threat model. But, even so, note this unverified
tweet:

I think the situation at @LastPass may be worse than they are letting on. On
Sunday the 18th, four of my wallets were compromised. The losses are not
significant. Their seeds were kept, encrypted, in my lastpass vault, behind a 16
character password using all character types.

If thatΓÇÖs true, it means that LastPass has some backdoor -- possibly
unintentional -- into the password databases that the hackers are accessing. (Or
that @CryptopathicΓÇÖs ΓÇ£16 character password using all character typesΓÇ¥ is
something like ΓÇ£P@ssw0rdP@ssw0rd.ΓÇ¥)

My guess is that weΓÇÖll learn more during the coming days. But this should
serve as a cautionary tale for anyone who is using the cloud: the cloud is
another name for ΓÇ£someone elseΓÇÖs computer,ΓÇ¥ and you need to understand how
much or how little you trust that computer.

If youΓÇÖre changing password managers, look at my own Password Safe. Its main
downside is that you canΓÇÖt synch between devices, but thatΓÇÖs because I
donΓÇÖt use the cloud for anything.

News articles. Slashdot thread.

EDITED TO ADD: People choose lousy master passwords.

** *** ***** ******* *********** *************

Arresting IT Administrators

[2022.12.27] This is one way of ensuring that IT keeps up with patches:

Albanian prosecutors on Wednesday asked for the house arrest of five public
employees they blame for not protecting the country from a cyberattack by
alleged Iranian hackers.

Prosecutors said the five IT officials of the public administration department
had failed to check the security of the system and update it with the most
recent antivirus software.

The next step would be to arrest managers at software companies for not
releasing patches fast enough. And maybe programmers for writing buggy code. I
donΓÇÖt know where this line of thinking ends.

** *** ***** ******* *********** *************

QR Code Scam

[2022.12.28] An enterprising individual made fake parking tickets with a QR code
for easy payment.

** *** ***** ******* *********** *************

Recovering Smartphone Voice from the Accelerometer

[2022.12.30] Yet another smartphone side-channel attack: ΓÇ£EarSpy: Spying
Caller Speech and Identity through Tiny Vibrations of Smartphone Ear
SpeakersΓÇ£:

Abstract: Eavesdropping from the userΓÇÖs smartphone is a well-known threat to
the userΓÇÖs safety and privacy. Existing studies show that loudspeaker
reverberation can inject speech into motion sensor readings, leading to speech
eavesdropping. While more devastating attacks on ear speakers, which produce
much smaller scale vibrations, were believed impossible to eavesdrop with
zero-permission motion sensors. In this work, we revisit this important line of
reach. We explore recent trends in smartphone manufacturers that include
extra/powerful speakers in place of small ear speakers, and demonstrate the
feasibility of using motion sensors to capture such tiny speech vibrations. We
investigate the impacts of these new ear speakers on built-in motion sensors and
examine the potential to elicit private speech information from the minute
vibrations. Our designed system EarSpy can successfully detect word regions,
time, and frequency domain features and generate a spectrogram for each word
region. We train and tes
t the extracted data using classical machine learning algorithms and
convolutional neural networks. We found up to 98.66% accuracy in gender
detection, 92.6% detection in speaker detection, and 56.42% detection in digit
detection (which is 5X more significant than the random selection (10%)). Our
result unveils the potential threat of eavesdropping on phone conversations from
ear speakers using motion sensors.

ItΓÇÖs not great, but itΓÇÖs an impressive start.

** *** ***** ******* *********** *************

Breaking RSA with a Quantum Computer

[2023.01.03] A group of Chinese researchers have just published a paper claiming
that they can -- although they have not yet done so -- break 2048-bit RSA. This
is something to take seriously. It might not be correct, but itΓÇÖs
not obviously wrong.

We have long known from ShorΓÇÖs algorithm that factoring with a quantum
computer is easy. But it takes a big quantum computer, on the orders of millions
of qbits, to factor anything resembling the key sizes we use today. What the
researchers have done is combine classical lattice reduction factoring
techniques with a quantum approximate optimization algorithm. This means that
they only need a quantum computer with 372 qbits, which is well within whatΓÇÖs
possible today. (The IBM Osprey is a 433-qbit quantum computer, for example.
Others are on their way as well.)

The Chinese group didnΓÇÖt have that large a quantum computer to work with. They
were able to factor 48-bit numbers using a 10-qbit quantum computer. And while
there are always potential problems when scaling something like this up by a
factor of 50, there are no obvious barriers.

Honestly, most of the paper is over my head -- both the lattice-reduction math
and the quantum physics. And thereΓÇÖs the nagging question of why the Chinese
government didnΓÇÖt classify this research. But...wow...maybe...and yikes! Or
not.

ΓÇ£Factoring integers with sublinear resources on a superconducting quantum
processorΓÇ¥

Abstract: ShorΓÇÖs algorithm has seriously challenged information security based
on public key cryptosystems. However, to break the widely used RSA-2048 scheme,
one needs millions of physical qubits, which is far beyond current technical
capabilities. Here, we report a universal quantum algorithm for integer
factorization by combining the classical lattice reduction with a quantum
approximate optimization algorithm (QAOA). The number of qubits required is
O(logN/loglogN ), which is sublinear in the bit length of the integer N , making
it the most qubit-saving factorization algorithm to date. We demonstrate the
algorithm experimentally by factoring integers up to 48 bits with 10
superconducting qubits, the largest integer factored on a quantum device. We
estimate that a quantum circuit with 372 physical qubits and a depth of
thousands is necessary to challenge RSA-2048 using our algorithm. Our study
shows great promise in expediting the application of current noisy quantum
computers, and paves the way to fact or large integers of realistic
cryptographic significance.

In email, Roger Grimes told me: ΓÇ£Apparently what happened is another guy who
had previously announced he was able to break traditional asymmetric encryption
using classical computers...but reviewers found a flaw in his algorithm and that
guy had to retract his paper. But this Chinese team realized that the step that
killed the whole thing could be solved by small quantum computers. So they
tested and it worked.ΓÇ¥

EDITED TO ADD: One of the issues with the algorithm is that it relies on a
recent factoring paper by Claus Schnorr. ItΓÇÖs a controversial paper; and
despite the ΓÇ£this destroys the RSA cryptosystemΓÇ¥ claim in the abstract, it
does nothing of the sort. SchnorrΓÇÖs algorithm works well with smaller moduli
-- around the same order as ones the Chinese group has tested -- but falls
apart at larger sizes. At this point, nobody understands why. The Chinese paper
claims that their quantum techniques get around this limitation (I think
thatΓÇÖs whatΓÇÖs behind GrimesΓÇÖs comment) but donΓÇÖt give any details -- and
they havenΓÇÖt tested it with larger moduli. So if itΓÇÖs true that the Chinese
paper depends on this Schnorr technique that doesnΓÇÖt scale, the techniques in
this Chinese paper wonΓÇÖt scale, either. (On the other hand, if it does scale
then I think it also breaks a bunch of lattice-based public-key cryptosystems.)

I am much less worried that this technique will work now. But this is something
the IBM quantum computing people can test right now.

EDITED TO ADD (1/4): A reporter just asked me my gut feel about this. I replied
that I donΓÇÖt think this will break RSA. Several times a year the cryptography
community received ΓÇ£breakthroughsΓÇ¥ from people outside the community.
ThatΓÇÖs why we created the RSA Factoring Challenge: to force people to provide
proofs of their claims. In general, the smart bet is on the new techniques not
working. But someday, that bet will be wrong. Is it today? Probably not. But it
could be. WeΓÇÖre in the worst possible position right now: we donΓÇÖt have the
facts to know. Someone needs to implement the quantum algorithm and see.

EDITED TO ADD (1/5): Scott AaronsonΓÇÖs take is a ΓÇ£noΓÇ¥:

In the new paper, the authors spend page after page saying-without-saying that
it might soon become possible to break RSA-2048, using a NISQ (i.e.,
non-fault-tolerant) quantum computer. They do so via two time-tested strategems:

the detailed exploration of irrelevancies (mostly, optimization of the number of
qubits, while ignoring the number of gates), and complete silence about the one
crucial point. Then, finally, they come clean about the one crucial point in a
single sentence of the Conclusion section:

It should be pointed out that the quantum speedup of the algorithm is unclear
due to the ambiguous convergence of QAOA.

ΓÇ£UnclearΓÇ¥ is an understatement here. It seems to me that a miracle would be
required for the approach here to yield any benefit at all, compared to just
running the classical SchnorrΓÇÖs algorithm on your laptop. And if the latter
were able to break RSA, it wouldΓÇÖve already done so.

All told, this is one of the most actively misleading quantum computing papers
IΓÇÖve seen in 25 years, and IΓÇÖve seen ... many.

EDITED TO ADD (1/7): More commentary. Again: no need to panic.

EDITED TO ADD (1/12): Peter Shor has suspicions.

** *** ***** ******* *********** *************

Decarbonizing Cryptocurrencies through Taxation

[2023.01.04] Maintaining bitcoin and other cryptocurrencies causes about 0.3
percent of global CO2 emissions. That may not sound like a lot, but itΓÇÖs more
than the emissions of Switzerland, Croatia, and Norway combined. As many
cryptocurrencies crash and the FTX bankruptcy moves into the litigation stage,
regulators are likely to scrutinize the cryptocurrency world more than ever
before. This presents a perfect opportunity to curb their environmental damage.

The good news is that cryptocurrencies donΓÇÖt have to be carbon intensive. In
fact, some have near-zero emissions. To encourage polluting currencies to reduce
their carbon footprint, we need to force buyers to pay for their environmental
harms through taxes.

The difference in emissions among cryptocurrencies comes down to how they create
new coins. Bitcoin and other high emitters use a system called ΓÇ£proof of
workΓÇ£: to generate coins, participants, or ΓÇ£miners,ΓÇ¥ have to solve math
problems that demand extraordinary computing power. This allows currencies to
maintain their decentralized ledger -- the blockchain -- but requires enormous
amounts of energy.

Greener alternatives exist. Most notably, the ΓÇ£proof of stakeΓÇ¥ system
enables participants to maintain their blockchain by depositing cryptocurrency
holdings in a pool. When the second-largest cryptocurrency, Ethereum, switched
from proof of work to proof of stake earlier this year, its energy consumption
dropped by more than 99.9% overnight.

Bitcoin and other cryptocurrencies probably wonΓÇÖt follow suit unless forced
to, because proof of work offers massive profits to miners -- and theyΓÇÖre the
ones with power in the system. Multiple legislative levers could be used to
entice them to change.

The most blunt solution is to ban cryptocurrency mining altogether. China did
this in 2018, but it only made the problem worse; mining moved to other
countries with even less efficient energy generation, and emissions went up. The
only way for a mining ban to meaningfully reduce carbon emissions is to enact it
across most of the globe. Achieving that level of international consensus is, to
say the least, unlikely.

A second solution is to prohibit the buying and selling of proof-of-work
currencies. The European ParliamentΓÇÖs Committee on Economic and Monetary
Affairs considered making such a proposal, but voted against it in March. This
is understandable; as with a mining ban, it would be both viewed as
paternalistic and difficult to implement politically.

Employing a tax instead of an outright ban would largely skirt these issues. As
with taxes on gasoline, tobacco, plastics, and alcohol, a cryptocurrency tax
could reduce real-world harm by making consumers pay for it.

Most ways of taxing cryptocurrencies would be inefficient, because theyΓÇÖre
easy to circumvent and hard to enforce. To avoid these pitfalls, the tax should
be levied as a fixed percentage of each proof-of-work-cryptocurrency purchase.
Cryptocurrency exchanges should collect the tax, just as merchants collect sales
taxes from customers before passing the sum on to governments. To make it harder
to evade, the tax should apply regardless of how the proof-of-work currency is
being exchanged -- whether for a fiat currency or another cryptocurrency. Most
important, any state that implements the tax should target all purchases by
citizens in its jurisdiction, even if they buy through exchanges with no legal
presence in the country.

This sort of tax would be transparent and easy to enforce. Because most people
buy cryptocurrencies from one of only a few large exchanges -- such as Binance,
Coinbase, and Kraken -- auditing them should be cheap enough that it pays for
itself. If an exchange fails to comply, it should be banned.

Even a small tax on proof-of-work currencies would reduce their damage to the
planet. Imagine that youΓÇÖre new to cryptocurrency and want to become a
first-time investor. YouΓÇÖre presented with a range of currencies to choose
from: bitcoin, ether, litecoin, monero, and others. You notice that all of them
except ether add an environmental tax to your purchase price. Which one do you
buy?

Countries donΓÇÖt need to coordinate across borders for a proof-of-work tax on
their own citizens to be effective. But early adopters should still consider
ways to encourage others to come on board. This has precedent. The European
Union is trying to influence global policy with its carbon border adjustments,
which are designed to discourage people from buying carbon-intensive products
abroad in order to skirt taxes. Similar rules for a proof-of-work tax could
persuade other countries to adopt one.

Of course, some people will try to evade the tax, just as people evade every
other tax. For example, people might buy tax-free coins on centralized exchanges
and then swap them for polluting coins on decentralized exchanges. To some
extent, this is inevitable; no tax is perfect. But the effort and technical
know-how needed to evade a proof-of-work tax will be a major deterrent.

Even if only a few countries implement this tax -- and even if some people evade
it -- the desirability of bitcoin will fall globally, and the environmental
benefit will be significant. A high enough tax could also cause a
self-reinforcing cycle that will drive down these cryptocurrenciesΓÇÖ prices.
Because the value of many cryptocurrencies rely largely on speculation, they are
dependent on future buyers. When speculators are deterred by the tax, the lack
of demand will cause the price of bitcoin to fall, which could prompt more
current holders to sell -- further lowering prices and accelerating the effect.
Declining prices will pressure the bitcoin community to abandon proof of work
altogether.

Taxing proof-of-work exchanges might hurt them in the short run, but it would
not hinder blockchain innovation. Instead, it would redirect innovation toward
greener cryptocurrencies. This is no different than how government incentives
for electric vehicles encourage carmakers to improve green alternatives to the
internal combustion engine. These incentives donΓÇÖt restrict innovation in
automobiles -- they promote it.

Taxing environmentally harmful cryptocurrencies can gain support across the
political spectrum, from people with varied interests. It would benefit
blockchain innovators and cryptocurrency researchers by shifting focus from
environmental harm to beneficial uses of the technology. It has the potential to
make our planet significantly greener. It would increase government revenues.

Even bitcoin maximalists have reason to embrace the proposal: it would offer the
bitcoin community a chance to prove it can survive and grow sustainably.

This essay was written with Christos Porios, and previously appeared in the
Atlantic.

** *** ***** ******* *********** *************

Remote Vulnerabilities in Automobiles

[2023.01.06] This group has found a ton of remote vulnerabilities in all sorts
of automobiles.

ItΓÇÖs enough to make you want to buy a car that is not Internet-connected.
Unfortunately, that seems to be impossible.

** *** ***** ******* *********** *************

Schneier on Security Audiobook Sale

[2023.01.06] IΓÇÖm not sure why, but Audiobooks.com is offering the audiobook
version of Schneier on Security at 50% off until January 17.



EDITED TO ADD: The audiobook of We Have Root is 50% off until January 27 if you
use this link.

** *** ***** ******* *********** *************

Identifying People Using Cell Phone Location Data

[2023.01.09] The two people who shut down four Washington power stations in
December were arrested. This is the interesting part:

Investigators identified Greenwood and Crahan almost immediately after the
attacks took place by using cell phone data that allegedly showed both men in
the vicinity of all four substations, according to court documents.

Nowadays, it seems like an obvious thing to do -- although the search is
probably unconstitutional. But way back in 2012, the Canadian CSEC -- thatΓÇÖs
their NSA -- did some top-secret work on this kind of thing. The document is
part of the Snowden archive, and I wrote about it:

The second application suggested is to identify a particular person whom you
know visited a particular geographical area on a series of dates/times. The
example in the presentation is a kidnapper. He is based in a rural area, so he
canΓÇÖt risk making his ransom calls from that area. Instead, he drives to an
urban area to make those calls. He either uses a burner phone or a pay phone, so
he canΓÇÖt be identified that way. But if you assume that he has some sort of
smart phone in his pocket that identifies itself over the Internet, you might be
able to find him in that dataset. That is, he might be the only ID that appears
in that geographical location around the same time as the ransom calls and at no
other times.

ThereΓÇÖs a whole lot of surveillance you can do if you can follow everyone,
everywhere, all the time. I donΓÇÖt even think turning your cell phone off would
help in this instance. How many people in the Washington area turned their
phones off during exactly the times of the Washington power station attacks?
Probably a small enough number to investigate them all.

** *** ***** ******* *********** *************

ChatGPT-Written Malware

[2023.01.10] I donΓÇÖt know how much of a thing this will end up being, but we
are seeing ChatGPT-written malware in the wild.

...within a few weeks of ChatGPT going live, participants in cybercrime forums
-- some with little or no coding experience -- were using it to write software
and emails that could be used for espionage, ransomware, malicious spam, and
other malicious tasks.

ΓÇ£ItΓÇÖs still too early to decide whether or not ChatGPT capabilities will
become the new favorite tool for participants in the Dark Web,ΓÇ¥ company
researchers wrote. ΓÇ£However, the cybercriminal community has already shown
significant interest and are jumping into this latest trend to generate
malicious code.ΓÇ¥

Last month, one forum participant posted what they claimed was the first script
they had written and credited the AI chatbot with providing a ΓÇ£nice [helping]
hand to finish the script with a nice scope.ΓÇ¥

The Python code combined various cryptographic functions, including code
signing, encryption, and decryption. One part of the script generated a key
using elliptic curve cryptography and the curve ed25519 for signing files.
Another part used a hard-coded password to encrypt system files using the
Blowfish and Twofish algorithms. A third used RSA keys and digital signatures,
message signing, and the blake2 hash function to compare various files.

Check Point Research report.

ChatGPT-generated code isnΓÇÖt that good, but itΓÇÖs a start. And the technology
will only get better. Where it matters here is that it gives less skilled
hackers -- script kiddies -- new capabilities.

** *** ***** ******* *********** *************

Experian Privacy Vulnerability

[2023.01.12] Brian Krebs is reporting on a vulnerability in ExperianΓÇÖs
website:

Identity thieves have been exploiting a glaring security weakness in the website
of Experian, one of the big three consumer credit reporting bureaus. Normally,
Experian requires that those seeking a copy of their credit report successfully
answer several multiple choice questions about their financial history. But
until the end of 2022, ExperianΓÇÖs website allowed anyone to bypass these
questions and go straight to the consumerΓÇÖs report. All that was needed was
the personΓÇÖs name, address, birthday and Social Security number.

** *** ***** ******* *********** *************

Threats of Machine-Generated Text

[2023.01.13] With the release of ChatGPT, IΓÇÖve read many random articles about
this or that threat from the technology. This paper is a good survey of the
field: what the threats are, how we might detect machine-generated text,
directions for future research. ItΓÇÖs a solid grounding amongst all of the
hype.

Machine Generated Text: A Comprehensive Survey of Threat Models and Detection
Methods

Abstract: Advances in natural language generation (NLG) have resulted in machine
generated text that is increasingly difficult to distinguish from human authored
text. Powerful open-source models are freely available, and user-friendly tools
democratizing access to generative models are proliferating. The great potential
of state-of-the-art NLG systems is tempered by the multitude of avenues for
abuse. Detection of machine generated text is a key countermeasure for reducing
abuse of NLG models, with significant technical challenges and numerous open
problems. We provide a survey that includes both 1) an extensive analysis of
threat models posed by contemporary NLG systems, and 2) the most complete review
of machine generated text detection methods to date. This survey places machine
generated text within its cybersecurity and social context, and provides strong
guidance for future work addressing the most critical threat models, and
ensuring detection systems themselves demonstrate trustworthiness through fa
irness, robustness, and accountability.

** *** ***** ******* *********** *************

Booklist Review of A HackerΓÇÖs Mind

[2023.01.14] Booklist reviews A HackerΓÇÖs Mind:

Author and public-interest security technologist Schneier (Data and Goliath,
2015) defines a ΓÇ£hackΓÇ¥ as an activity allowed by a system ΓÇ£that subverts
the rules or norms of the system [...] at the expense of someone else affected
by the system.ΓÇ¥ In accessing the security of a particular system,
technologists such as Schneier look at how it might fail. In order to counter a
hack, it becomes necessary to think like a hacker. Schneier lays out the
ramifications of a variety of hacks, contrasting the hacking of the tax code to
benefit the wealthy with hacks in realms such as sports that can innovate and
change a game for the better. The key to dealing with hacks is being proactive
and providing adequate patches to fix any vulnerabilities. SchneierΓÇÖs
fascinating work illustrates how susceptible many systems are to being hacked
and how lives can be altered by these subversions. SchneierΓÇÖs deep dive into
this cross-section of technology and humanity makes for investigative gold.

The book will be published on February 7. HereΓÇÖs the bookΓÇÖs webpage. You can
pre-order a signed copy from me here.

** *** ***** ******* *********** *************

Upcoming Speaking Engagements

[2023.01.14] This is a current list of where and when I am scheduled to speak:

IΓÇÖm speaking at Capricon, a four-day science fiction convention in Chicago. My
talk is on ΓÇ£The Coming AI HackersΓÇ¥ and will be held Friday, February 3 at
1:00 PM.
The list is maintained on this page.

** *** ***** ******* *********** *************

Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries,
analyses, insights, and commentaries on security technology. To subscribe, or to
read back issues, see Crypto-Gram's web page.

You can also read these articles on my blog, Schneier on Security.

Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and
friends who will find it valuable. Permission is also granted to reprint
CRYPTO-GRAM, as long as it is reprinted in its entirety.

Bruce Schneier is an internationally renowned security technologist, called a
security guru by the Economist. He is the author of over one dozen books --
including his latest, We Have Root -- as well as hundreds of articles, essays,
and academic papers. His newsletter and blog are read by over 250,000 people.
Schneier is a fellow at the Berkman Klein Center for Internet & Society at
Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School; a
board member of the Electronic Frontier Foundation, AccessNow, and the Tor
Project; and an Advisory Board Member of the Electronic Privacy Information
Center and VerifiedVoting.org. He is the Chief of Security Architecture at
Inrupt, Inc.

Copyright © 2023 by Bruce Schneier.

--- BBBS/Li6 v4.10 Toy-5
 * Origin: TCOB1 - binkd.thecivv.ie (618:500/14)