Open
Opened by hellekin @hellekin 0 of 3 tasks completed 0/3 tasks

Meeting 2016-08-15

  • hellekin
    hellekin @hellekin ·

    Snowden Narrative Update

    snowden-bunnie.md

    Follow the White Rabbit

    On July, 21st, 2016, Andrew "bunnie" Huang, and Edward Snowden published Against the Law: Countering Lawful Abuses of Digital Surveillance .

    When one of the most prominent hardware hackers, known for hacking the XBox in the 1990s (ref) to bring awareness on creativity in the chinese hacker scene, and more recently for suing the U.S. Government against DRM that jeopardize legitimate research and reverse engineering, teams up with the whistleblower who brought awareness to the world of the illegal, immoral, unethical, and systematic abuse of the intelligence community, and especially the U.S. NSA , curious minds want to peek into the rabbit hole and follow Alice to see where it goes.

    Unlike classical Hollywood heroes, Edward Snowden is a very articulate person who knows how to promote an argument convincingly: he makes in smarts what he doesn't in violence. No wonder that the Press loves him so much: heroic, bold, handsome, nuanced if not radical, he projects an image difficult to dismiss by the establishment.

    Andrew "bunnie" Huang made a habit to kick the anthill and put the finger where it hurts, denouncing year after year and stunt after stunt the one-size-fits-all lack of thought the major electronics vendors and technologies producers want to shove down our throats: technologies are not pre-packaged goods in the hands of the powerful, generously granted to unknowing and grateful consumers who can eat one product after the next, in awe and wonder.

    Neo, wake up!

    Instead, we at Neo900, and among tinkerphones , and in hackerdom in general, share the idea that indeed, technologies can be and should be created by whoever has the determination to make them happen, not only corporate designers blessed by infinite capital, greedy patent lawyers, and manipulative marketers, but we, the people, who better know what's best for the interest of the commons. When technologies are provided by biased interests, consequences abound: from programmed obsolescence to privacy invasion, and the silly idea that you do not own what you buy, consumerist ideology wants us to believe that technologies come pre-packaged from the supermarket, and what they are is what you need.

    Countering Lawful Abuses of Digital Surveillance

    What is the paper about, how it was viewed in the Press...

    Both bunnie and Snowden are used to frown at such pre-chewed, pre-digested contemporary myths propelled by grinning models and bullying office suits. Among techies, we're used to call this FUD , from the 1950s sneaky marketing tactics pushed on their unsuspecting customers by the then superpower IBM , consisting in instilling fear, uncertainty and doubt in potential buyers, leading them to get the goods before their competitors would.

    George Orwell in his book 1984 , and Yevgeny Zamyatin before him in his: We , described societies where the powerful would lie to the public in order to keep them obedient and convinced of the genuine nature of their political agenda. Maybe both science fiction writers were inspired by the alarms sent by Lord Ponsonby to the United Kingom's Parliament in 1910, only four years before the large scale butchery known later as World War I. Belgian historian XXX recomposed and expanded upon Lord Ponsonby's warning to his fellow citizens in a book titled: 10 Rules of War Propaganda with the subtitle: to consume in case of war, hot or cold.

    Since Snowden's revelations about the NSA , and their british partner in crime CGHQ , the public knows about techniques used by the Five Eyes to locate, track, and obliterate people--in military parlance: "to terminate targets"--using their smartphone. Such news alone should provoke a worldwide indignation and destitution of the democratic leaders in charge of the monopoly of violence. Yet, no such thing happened.

    Instead, Snowden and other whistleblowers, and hackers such as bunnie, keep hitting nails to insist, and insist again on the injustice, and the necessity to revolt against such evil behaviors. If showing the truth doesn't work to mobilize consciousness, maybe working around people's rationalization might. This is what the Against the Law paper, and underlying technique is trying to do, taking on the global surveillance narrative from another, specific perspective: journalist's protection.

    Objective: Awareness

    Abstract of Against the Law :

    Front-line journalists are high-value targets, and their enemies will spare no expense to silence them. Unfortunately, journalists can be betrayed by their own tools. Their smartphones are also the perfect tracking device. Because of the precedent set by the US's \xe2\x80\x9cthird-party doctrine,\xe2\x80\x9d which holds that metadata on such signals enjoys no meaningful legal protection, governments and powerful political institutions are gaining access to comprehensive records of phone emissions unwittingly broadcast by device owners. This leaves journalists, activists, and rights workers in a position of vulnerability. This work aims to give journalists the tools to know when their smart phones are tracking or disclosing their location when the devices are supposed to be in airplane mode. We propose to accomplish this via direct introspection of signals controlling the phone's radio hardware. The introspection engine will be an open source, user-inspectable and field-verifiable module attached to an existing smart phone that makes no assumptions about the trustability of the phone's operating system.

    Consistent with previous work by both bunnie and Snowden, Against the Law wants to promote awareness to the public. Awareness of the dire situation faced by journalists, activists, rights workers exposed to unprecedented amounts of suveillance and retaliation for their work informing the public of dangerous and often illegal activities of increasingly repressive regimes around the world, thanks to pervasive communicaiton technologies turned into surveillance dispositives. According to RSF , deadly attacks on journalists have increased dramatically in the last decade. [citation needed].

    Snowden and bunnie describe in their paper a technical development they're exploring in their attempt to respond to the question: "what is the shortest path to giving awareness to people risking their lives to save others', whose enemies are determined to see them dead rather than facing an informed public?"

    trusting a phone that has been hacked to go into airplane mode is like trusting a drunk person to judge if they are sober enough to drive.

    Their response consists in a simple and attractive solution, a "hardware plugin" to existing Apple smartphones pervasive among front-line journalists. The focus on a specific model aims at reducing time-to-market for a solution that is otherwise adaptable to other devices.

    we aim to provide field-ready tools that enable a reporter to observe and investigate the status of the phone's radios directly and independently of the phone's native hardware. We call this direct introspection.

    Reception in the Press

    TBD: skippable. So far nothing really interesting came from there.

    The One Rogue Chip

    About the secrecy of the baseband chip and why it's indeed important to keep it tied up.

    ... One ring to rule them all, one ring to bind them, in the land of Mordor, where the shadows lie.

    In our previous article we recalled that the baseband chip (the modem) design is a proprietary, undisclosed black box. Any cryptographer will refer you to [Kerckhoff's Principle][4] that states any cryptographic system should work even if the attacker knows its design: in fact, the secrecy surrounding the 'baseband' is technically spurious, and there's no reason why the modem should be a black box, unless it's not doing what it's advertised to do.

    In Neo900, we abide by Kerckhoff's principle and thus distrust the hardware parts we fail to understand because their design is not public. The modem, indeed, is the one rogue chip that fails to pass our criteria for transparency.

    In practice, each device has a unique identifier called IMEI , like a MAC address for an Ethernet network device. Phone can be sold "naked", or come with a subscription. The SIM card is used to uniquely identify the user of this device. The combination of IMEI and SIM is unique, like the combination of the serial number of a car's chassis and its license plate.

    The difference between a car and a smartphone lies in the capacity of the latter to serve as a live location tracker. Triangulation of the radio signal emitted by the phone to the cell towers already provides a location with a few meters precision, but as GPS chips became ubiquitous on smartphones that do not enforce clean separation of the different subsystems, a rogue chip can communicate the precise location of the device to an attacker, as was probably the case with XXX, gunned down by Syrian artillery, and mentioned in Snowden's & bunnie's paper.

    It is a well-known fact, also coming from Snowden leaks, that the Five Eyes, and probably many governments around the world, can activate smartphone functions remotely, without the user's consent or knowledge, including the microphone, and probably other sensors. This explains in part why the "direct introspection engine" introduced by the paper tries to address more than just the modem's activity.

    Direct Radio Introspection

    Technical aspects developed in the paper: threat model, and how B&S are tackling the problem, in more details. TBD: this is the technical part describing the approach.

    Difficulties

    • device complexity means a porous attack surface (more components, more software)
    • no secure hardware design: "rogue chip problem"
    • no sure way to prevent malware from entering a journalist's device

    Assumptions

    • "this work starts with the assumption that a phone can and will be compromised." -> Kerckhoff's principle

    Our work proposes to monitor radio activity using a measurement tool contained in a phone-mounted battery case. We call this tool an introspection engine. The introspection engine has the capability to alert a reporter of a dangerous situation in real-time. The core principle is simple: if the reporter expects radios to be off, alert the user when they are turned on.

    Our introspection engine is designed with the following goals in mind: Completely open source and user-inspectable (\xe2\x80\x9cYou don't have to trust us\xe2\x80\x9d)

    Introspection operations are performed by an execution domain completely separated from the phone's CPU (\xe2\x80\x9cdon't rely on those with impaired judgment to fairly judge their state\xe2\x80\x9d)

    Proper operation of introspection system can be field-verified (guard against \xe2\x80\x9cevil maid\xe2\x80\x9d attacks and hardware failures)

    Difficult to trigger a false positive (users ignore or disable security alerts when there are too many positives)

    Difficult to induce a false negative, even with signed firmware updates (\xe2\x80\x9cdon't trust the system vendor\xe2\x80\x9d \xe2\x80\x93 state-level adversaries with full cooperation of system vendors should not be able to craft signed firmware updates that spoof or bypass the introspection engine)

    As much as possible, the introspection system should be passive and difficult to detect by the phone's operating system (prevent black-listing/targeting of users based on introspection engine signatures)

    Simple, intuitive user interface requiring no specialized knowledge to interpret or operate (avoid user error leading to false negatives; \xe2\x80\x9cjournalists shouldn't have to be cryptographers to be safe\xe2\x80\x9d)

    Final solution should be usable on a daily basis, with minimal impact on workflow (avoid forcing field reporters into the choice between their personal security and being an effective journalist)

    This work is not just an academic exercise; ultimately we must provide a field-ready introspection solution to protect reporters at work.

    Choice of Device

    Keep this quote:

    The choice of model is driven primarily by what we understand to be the current preferences and tastes of reporters.

    Although the general principles underlying this work can be applied to any phone, reducing these principles to practice requires a significant amount of reverse engineering, as there are no broadly supported open source phone solutions on the market. Thus we focus on a single phone model, the 4.7\xe2\x80\x9d iPhone 6 by Apple Inc., as the subject for field deployment. The choice of model is driven primarily by what we understand to be the current preferences and tastes of reporters.

    It has little to do with the relative security of any platform, as we assume any platform, be it iOS or Android, can and will be compromised by state-level adversaries.

    Monitored Systems

    • Cellular modem \xe2\x80\x93 2G/3G/4G
    • Wifi / BT
    • GPS
    • NFC (Apple Pay)

    we restrict our exploration to only RF interfaces that can directly betray a user's location.

    the final physical design of our battery case will likely include a feature to selectively obscure the rear camera lens.

    => Neo900 doesn't have physical protection against the "selfie cam"... To consider?

    How it works

    From the outside, the introspection engine will look and behave like a typical battery case for the iPhone 6. However, in addition to providing extra power to the iPhone 6, the case will contain the introspection engine's electronics core. The electronics core will likely consist of a small FPGA and an independent CPU running a code base completely separate from the iPhone 6's CPU. This physical isolation of CPU cores minimizes the chance of malware from the phone infecting the introspection engine.

    Pros and Cons of DRI

    Benefits

    • creates awareness about the insecurity of smartphones
    • field-ready addon
    • potentially enables multiple SIM cards

    Limits of This Approach

    • "when the devices are supposed to be in airplane mode." -> only addresses one feature.

    • only gives awareness, doesn't prevent the abuse: if the artillery is shooting at you, it's probably too late.

    "Methods that Do Not Meet our Criteria"

    semi-intrusive countermeasures

    Numerous semi-intrusive countermeasures were considered along the way to our current solution, including but not limited to RF spectrum monitoring, active jamming, and the selective physical isolation or termination of antennae. Semi-intrusive countermeasures would require minimal modification to the phone itself, which is desirable as it simplifies field deployment and could even enable reporters to perform the modifications without any special tools. Unfortunately, all of these methods were deemed to be inadequate, as discussed in the following paragraphs.

    • RF spectrum monitoring consists of building an external radio receiver that can detect transmissions emanating from the phone's radios.

      The problems with this approach is thatl

        1. it can only reliably detect active transmissions from the radio, and
        1. malware that passively records the user's position and delivers it as a deferred payload when the radios are intentionally activated cannot be detected.

      • Furthermore, this approach is subject to spoofing; false positives can be triggered by the presence of nearby base stations. Such false alarms can confuse the user and eventually lead the user to be conditioned to ignore real alerts in hazardous situations.

    • Active jamming consists of building an external radio transmitter that attempts to inject false signals into the radios. Thus, even if malware were to activate the radios and listen for position-revealing signals, it would, in theory, report largely bogus position information. This is particularly effective against GPS, where GPS signals are very weak and thus even a weak local transmitter should be able to overpower the GPS satellites. However, active jamming was ruled out for several reasons.

      • The jammer's emissions could create a signal that can be traced to locate the reporter;

      • the jammer will require substantial battery power, and the user is left vulnerable once the jammer's power is exhausted.

      • Furthermore, nearby base stations may still be detected by the receivers, as modern radio protocols have sophisticated designs to protect against unintentional jamming.

    • Selective physical isolation or termination of the antennae consists of inserting an electronic switch between the connectors of the logic board and the antenna. The switch, when activated, would shunt the antenna to a matched resistive load, which would greatly reduce the transmission power and receive sensitivity of the radios.

      • However, experimental verification on the WiFi subystem indicated that removing the antenna connection and permanently terminating with a shunt resistor still leaked sufficient RF into the receivers for local base stations (e.g., within the same room) to be detected, which could be sufficient information to betray a reporter's location.
    "Methods that meet our criteria"

    (too long to reproduce here, please see paper)

    What's on the market to address that or similar problems?

    cryptophone's cell tower misconduct monitoring (only a software solution, assumes phone not hacked into disabling that feature)

    How Neo900 design addresses the Rogue Chip problem?

    split RAM, power segregation

    Can this design benefit Neo900, and 

    are there plans to integrate it?

    If you consider the CPU can go rogue, an extra layer of security is always fine.

    Nevertheless, Neo900 has a different approach to the RC problem: not only it provides awareness, it also prevents the rogue chip from accessing power: no antenna monitoring, but upstream, straight into the chip's capacity to abuse its status.

    The techniques developed in this work should also be applicable to other makes and models of phones. Pervasive deployment of radio introspection techniques could be assisted with minimal cooperation of system vendors. By grouping radio control test points together, leaving them exposed, and publishing a terse description of each test point, direct introspection engines can be more rapidly deployed and retrofitted into future smartphones.

    @wpwrak : what is the status of the highlighted part in Neo900?

    Furthermore, direct introspection may be extendable beyond the radio interfaces and into the filesystem layer. We theorize an introspection engine attached to the mass storage device within a phone; for example, an FPGA observing the SD bus between the CPU and the eMMC in a typical Android phone implementation. This introspection engine could observe, in real time, file manipulations and flag, or even block, potentially suspicious operations. With further system integration, the introspection engine could even perform an off-line integrity check of the filesystem or disk image. The efficacy of filesystem introspection is enhanced if the system integrator chooses to only sign OS-related files, but not encrypt them. As core OS files contain no user data or secrets, baring (sic) them for direct introspection would not impact the secrecy of user data while enabling third-party attestation of the OS's integrity.

    @wpwrak , @joerg_rw : anything useful to comment here?

    A Faraday Cage Cautionary Tale

    **Conclusion:

    \xe2\x80\x9cSecurity in itself is useless... The upside is always somewhere else. The security is never the thing that you really care about.\xe2\x80\x9d -- Linus Torvalds

    About expectations and reality, and how Maxwell got it right, but was ignored, while Feynman got it wrong, and nobody noticed.

    Credits

    The quotes come from Bunnie & Snowden, 2016 , CC-BY-4.0-Intl, unless specified.

    [4]: "Kerckhoff's Principle"

  • hellekin
    hellekin @hellekin ·

    About Corvin's assassination, from Dana Priest. Washington Post. [ http://wpo.st/5W2l1 ]

    Based on information from high-level defectors and captured government documents, the 32-page complaint alleges that the military was able to electronically intercept Colvin's communications from a clandestine media center operating out of an apartment in the densely populated Baba Amr neighborhood in Homs. Syrian officials paired the intercepts with detailed information from a female informant to pinpoint the location of the reporter

    Means there's nothing like technical usage of on-board chip to locate the target precisely.

  • Amer
    Amer @mad_dev ·

    Notable mentions of the SB System

    The new tool addresses a need among journalists and others for an honest representation of what their devices are doing, and no smartphone currently on the market provides that.

    Notable Comments and Mentions of neo900 in the wake of SB proposal

    Didn't one of the founders run away with everyone's money?

    OUCH!!

    UPDATE:

    Edited by Amer
  • Joerg Reisenweber
    Joerg Reisenweber @joerg_rw ·

    In german | @joerg_rw responded http://www.heise.de/forum/heise-online/News-Kommentare/Snowden-lehrt-iPhones-das-Whistleblowing/Neo900/posting-28948727/show/

    rather http://www.heise.de/forum/heise-online/News-Kommentare/Snowden-lehrt-iPhones-das-Whistleblowing/Re-Neo900/posting-28950025/show/ and in reply to wpwrak http://www.heise.de/forum/heise-online/News-Kommentare/Snowden-lehrt-iPhones-das-Whistleblowing/Greift-etwas-kurz/posting-28949392/show/ in http://www.heise.de/forum/heise-online/News-Kommentare/Snowden-lehrt-iPhones-das-Whistleblowing/Re-Greift-etwas-kurz/posting-28949526/show/