Category Archives: Technology

Confidential data and P2P

Posted on by
Reply

Last year, Pfizer had a serious security breach. Personal records of 17,000 employees and previous employees were available on a peer-to-peer (P2P) network. The wife of a Pfizer employee installed a file sharing software on her husband’s company laptop. The configuration was badly set and confidential information leaked. This type of leakage is rather common. In Security Newsletter n°4, I reported a virus using P2P software to distribute random file of a hard disk. Japanese defense plans leaked!

The first-thought recommendations would be to ban P2P software from company’s computers. This recommendation has limits:

  • P2P software may be useful in some context (and probably will become more prevalent in the future)
  • There is no serious way to avoid user to install such software and use it outside the fire walled environment of the company. In fact, it is possible to block installation of software by users, but it becomes quickly a problem for the IT department (cost of installing new software, upgrades, patches, …). It is often not practical excepted in highly secure environment. In any case, in most case, IT aware users will bypass the control.

Thus, the best recommendation I would give is to encrypt all confidential files on the laptop. This answers this threat, because what is shared is encrypted data, i.e. useless, and answers many other threats such as theft of laptops. Obviously the choice of the encryption tool is important (We will report on the latest hack on encryption tools in next security newsletter to be published in a fortnight)

It is also important to remember that you are also at risk at home with your private data. If ever you, or your relatives, use P2P software on your personal computer, check carefully its configuration to strictly sandbox the sharing space. Hoping that there is no backdoor that allows changing it  :Wink:

In the referenced article, I found also interesting the data mining performed on queries on P2P network. Privacy is even leaking on P2P network usage :Amazed:

Some thoughts about RFID and passports

Posted on by
Reply

Last week, I discussed with a well known cryptographer: JJQ. We were exchanging about RFID security, last mifare hack, and security of RFID-based passports. During the discussion, we went through a new threat.
Let us now assume that the RFID passport is largely used, and even that one country requires RFID-based passport for entering. We assume that forging a RFID-based passport is extremely difficult (it will never be impossible, law 1). We may assume that forging the paper part of the passport will be easier (else why replacing them with more expensive passports). But the forgery would be detected by mismatch between the information in the passport and the RFID.
The obvious attack would be to blast the RFID of the passport. Then the border guard would check only the paper part. Nevertheless, this may not be sufficient because we may assume that the border guard will be watchful because he faces an exceptional case.
Let us now assume that the attacker was able to build a gimmick that blasts all the RFID of every passports in a plane before leaving it. You will have several hundreds of exceptional cases. In other words, the border guards will be overwhelmed by the situation. Furthermore, if the attacker will present itself among the last ones, then his probability to go through with the forged passport will significantly raise.
Here it is a nice example of combined attacks: technique to blast the RFID and social engineering by creating an exceptional situation to stress the border guards.
Thus, for such type of applications, Denial of Services attacks should be carefully studied and prevented.

DVD Jon launches doubleTwist

Posted on by
Reply

doubleTwistJon Lech JOHANSEN, together with Monique FARANTOS launched doubleTwist, a controversial software and service. Jon is better known as DVD Jon. In 1999, he wrote DeCSS, the software decrypting protected DVDs. DeCSS spread over the Internet despite the efforts of studios to stop it. The source code was even available on printed T-shirts. In 2006, he authored software defeating Apple’s DRM FairPlay. DoubleTwist seems to be a sequel of this early hack.

DoubleTwist allows sharing your contents on all your devices and sharing your contents with your friends on social networks such as FaceBook. Currently, doubleTwist supports a limited number of devices through iTunes synchronization: Nokia phones, Sony Walkmans, Sony PSP and Windows Mobile 6.0 platforms. Nevertheless, traditional USB download is valid. DoubleTwist is only available for Windows. The Mac version is under way.

Does doubleTwist infringe copyright laws? According to Electronic Frontier Foundation (EFF), it does not. To by pass FairPlay, doubleTwist uses the analog hole, i.e. it records content while played by iTunes. Thus, EFF claims that it does not circumvent any protection scheme and thus falls out of the scope of DMCA. Will this argument hold in front of a court?

Nevertheless, doubleTwist limited the duration of the shared video to ten minutes and the duration of shared audio to twenty minutes per file. This policy reminds the limitations of User Generated Content sites.

The launch of doubleTwist on 18th February raised a flurry of news. The personality of DVD Jon is probably one explication of such media interest. Since then, no news. Surprisingly, there is no known public reaction of Apple. Would a negative reaction be coherent with Steve Jobs advocating DRM-free content?

NXP enhances the security of its chip

Posted on by
Reply

NXP, the RFID manufacturer, has announced the launching of new generation of mifare RFID chips: mifare plus. This new version has enhanced the security comared to previous mifare classic. For instance, it implements 128-bit AES, and more diversity for the identification. Mifare Plus seem to have an easy migration path from mifare clasic.

For memory, it was the NXP mifare classic that was recently hacked. This is a nice timely answer to this hack. How long will the new generation resist?

RFID and weak security

Posted on by
Reply

NXP Mifare Classic RFID chips are widely used in transportation or access control in Europe. NOHL Karsten, a researcher, publishes a cryptanalysis of this chip (the paper). His analysis demonstrates that the design was extremely weak. The cipher uses a LSFR and a 48-bit key.

It is obvious that the design was weak. Nevertheless, the main design constraint was probably to have a small number of gates for the implementation to reduce the cost. The security assumed that this algorithm would stay secret, in other words violating the principle of Kerckoffs. Furthermore, using a 48 bit key was inadequate. Currently, it is recommended to have at least a 90 bit key. With 48 bit key, it is easy to have a brut force attack.

Is it a problem? It depends on the application using the chip and its security assumptions. If the hypothesis is that the chip is extremely secure, than the answer is that it is an error. If the goal is to protect low cost assets, then the answer is right solution. As always, security is not simple and Manichean.

Forecasts: RFID will spread. Due to this massive use, cost constraints will be such that we will anticipate that many RFID chip will implement weak algorithm but with low cost. I will surely report many such events.