Schneier on Security

Clive Robinson • November 20, 2019 8:58 AM

@ Bruce,

What ever the --political-- reason is, I've been expecting this for a while now.

Russia plans to shut it's self behind what will become another "Great China Firewall" supposadly as a test in the very near future. No doubt if it works it will become permanent if the test gors well.

And there is a growing que of other nations that want to do the same or similar.

The simple fact is the early days of the Internet are now long gone digital surveillance is not optional it's a requirment not for just for the national jurisdictional network entities, but extra jurisdictional entities in other nations as well.

Up untill a decade ago the basic network topology followed that of the older telephone network but the even older the telex network before it.

Since then there have been ever increasing signs that national governments want rather more autonomy than they have been given. Things came to a head at the 2014 Doha meeting of the UN ITU World Radio Conference. Which the US only just managrd to scrap a maybe status quo on.

Now half a decade later at the current WRC that is due to end this week it's become clear the status quo can not be maintained.

Amongst other things driving the split is the US behaviour over 5G which they may paint as an "Evil China" issue publically but is actually a pissing contest over who controls the digital future.

Because few Western Governments have put the required resources into their communications industry, like so much before it from colout TV's and Transistor Radios in the 1960's the inovation in the market has moved to where it is better resourced, which has been to the likes of the Far East, and more recently the BRIC countries.

Now the game is effectively lost and there is no clear incentive from the First World Western Nations for keen minds to stay, they are following the provided resources.

It's not as though there have not been abundently clear warnings this was going to happen from the early 1990's but despite the warnings being made clear as would be the consequences large Corporate managment have been seduced over to the Far East by cheap labour, only to find they are now effrctively stuck there, and now many "locals" know their yrade secrets have set themselves up in competition.

So the dark clouds of what could well be a "Perfect Storm" have crossed well over the horizon. Do we in the West maintain the same course to even more troubled seas or do we change course and put the effort into avoiding the storm?

Clive Robinson • November 20, 2019 1:18 PM

@ Impossibly Stupid,

Good. All I ever see coming from them (and about 50 other countries, including Iran) on my servers is wave after wave of attack.

Well... It might not be good.

If as many claim the criminal element that frequents the Internet outside of Russia but are from Russia, are sanctioned by the Russian Government. Then it is highly unlikely that the Russian Government will "bottle them up".

As the old saying has it, if you have to have them in the boat you would rather they p155ed out of the boat than p155 in...

Clive Robinson • November 20, 2019 2:15 PM

@ WayOk, ALL,

Something that is affordable? Wouldn't a few distributed satellite links work (Or are com satellites far too locked down now)?

This Government lock down may only work out to be "one way" at best...

Because there are "no fee to connect and recieve" satellites pumping education weather and some news information out.

Othernet used to be on L-Band but have since moved to Ku-Band where the antenna can be quite small, amd hidden quite easily.

https://othernet.is

https://en.wikipedia.org/wiki/Othernet

Whilst the do sell receivers for less than 60USD, they also have published designs by a number of people. Whilst others use their own designs to receive and process the information (most 10-12GHz LNB's output a signal that an RTL SDR dongle previously used for L-Band will work with),

https://m.youtube.com/watch?v=KCewB_PuvDk

However if you want "interactive Internet" the rapid deployment of high bandwidth entertainment systems on transportation such as planes and cruise ships means that access through other satellite providers like Inmarsat are dropping in price. Whilst not cheap you can get upload and download bandwidth suitable for sending "broadcast TV".

Clive Robinson • November 20, 2019 9:26 PM

@ Impossibly Stupid,

And? Just because a defense isn't perfect doesn't mean it isn't worth doing, especially if it forces the attacker to be more exposed on the "outside".

What "defence"?

If the Russian Government blocks packets originating in Russia getting out how do you see that as a defence?

Because it is not defending anything Russian inside it's blocking perimiter is it?

It is in effect either imprisoning Russian criminals inside the Russian jurisdictional networks which does not solve the criminal problem, only "bottles it up". Or it effectively blocks those non Russian criminals who are currently using Russian jurisdictional networks to hide their point of origin.

It would only become a defence in the second case. As @SpaceLifeForm has implied with,

Are you certain that those packets really originated from where you think they did?

That is, when the closed perimiter stops criminals outside of Russia using Russian jurisdiction networks as a relay to hide their actuall point of origin. The attackers would have to fake their origin in a different way.

One of the big mistakes "insider attackers" make is having the point of origin of their attack "inside" any perimiter security. It's a common basic OpSec error that leads to them being identified, something I've pointed out since the 1990's[1].

If you follow the logic of you calling it a "defence" through, you will see that you will not be "politically popular" in these days of stage managed cries of "It's Russia wot dunit". Because implicitly you are saying that Russia is not the origin of the attacks, mearly a staging post and thus they are dropping off of the Internet to defend not just those inside their jurisdictional networks from attack by outsiders, but also their international name...

And you might well be right in that respect. It's part of the reason I indicated it might not be good. That is if those who attack you are using Russian jurisdictional networks as staging posts, then that current convenience will be denied to them when Russia throws the switch. Thus the attackers will have to find another way to hide their origin, thus they might well make mistakes by which they may be identified.

Let's put it this way, if I were an attacker, I would already have a number of mitigation plans not just in place, but up and running and I would be slowly migrating my fake point of origin to some other jurisdictions networks.

So whilst you might see the number of attacks from Russia decline, you will potentially see them rise from some other "apparent" point of origin.

But the reason I indicated it might actually be worse for you is that if forced to make one set of changes, the attackers might well make several changes... That is in effect "upgrading their attacks" which would mean you would be facing a changed landscape requiring you to make changes to your defence strategies as well. As that is likely to be a "reactive not proactive" set of changes it implies that there will be a learning curve which might also give rise to a "window of opportunity" or advantage to the attackers.

It's not something that worries me on a "personal" basis. As I've indicated before my personal network is not connected to the Internet or any other external communications. That is to attack me they would have to have "hands on physical access", which implies a whole different level of attacker with resources to match, not a run of the mill cyber-criminal.

[1] I can still remember the realy supprised looks on peoples faces when I gave a talk in summer 2000 to students and their proffessors from all over Europe --which included Russian's as well-- when I pointed it out. You could "see the penny drop" in not just the students eyes. Something I still see today when I mention "Outsiders should look like insiders, and insiders should look like outsiders" as "Basic OpSec" which is why you have to be caitious with attribution getting on for a third of of a century now... The reason I remember that particular talk well was, because of an answer I gave to a question from one of the proffessors, it was about another security issue and I replied "When Bill Gates says, I have to put a five pin DIN socket in the back of my head, I know it's time for me to retire". A point that is getting perilously close nearly two decades later. It was one of those pivotal moments, where subconcious thoughts crystallized whole and shockingly clear in my mind, and as part of it it "hit me in the gut" hard.

Though these days I suspect it won't be anything as secure as five pin DIN socket we used to have last century for "user input". No it will be something more like an RFID or NFC embedded with realy flawed or backdoored security (by command) that just can not be patched...