April 2008

World distance reading WiFi and RFID

security, technology / /

From Bruce Schneier’s “Crypto-Gram” (15 August 2005):

At DefCon earlier this month, a group was able to set up an unamplified 802.11 network at a distance of 124.9 miles.

http://www.enterpriseitplanet.com/networking/news/…

http://pasadena.net/shootout05/

Even more important, the world record for communicating with a passive RFID device was set at 69 feet. Remember that the next time someone tells you that it’s impossible to read RFID identity cards at a distance.

http://www.makezine.com/blog/archive/2005/07/…

Whenever you hear a manufacturer talk about a distance limitation for any wireless technology — wireless LANs, RFID, Bluetooth, anything — assume he’s wrong. If he’s not wrong today, he will be in a couple of years. Assume that someone who spends some money and effort building more sensitive technology can do much better, and that it will take less money and effort over the years. Technology always gets better; it never gets worse. If something is difficult and expensive now, it will get easier and cheaper in the future.

World distance reading WiFi and RFID Read More »

Micro-nations

art, history, law, politics, weird / /

From George Pendle’s “New Foundlands” (Cabinet: Summer 2005):

Call them micro-nations, model countries, ephemeral states, or new country projects, the world is surprisingly full of entities that display all the trappings of established independent states, yet garner none of the respect. The Republic of Counani, Furstentum Castellania, Palmyra, the Hutt River Province, and the Empire of Randania may sound fantastical, but they are a far cry from authorial inventions, like C.S. Lewis’s Narnia or Swift’s Laputa. …

Such idiosyncratic nation-building can trace its roots back to the early nineteenth century, when even the mightiest empire had yet to consolidate its grip on the more far-flung regions of the world. The swampland of the Mosquito Coast was just such an untouched area, and it was here that the Scottish adventurer Gregor MacGregor decided to found his new kingdom – the Territory of Poyais.

…

The Territory of Poyais displayed many of the themes that would appear in micro-nations for the next century-and-a-half: Firstly, that the love of money is usually a significant incentive in a micro-nation’s foundation. Secondly, that a micro-nation’s founders will always bestow upon themselves thoroughly dramatic titles. Thirdly, that since all the world’s good spots have been taken, micro-nations are usually gifted with dire and hazardous geography. And finally, should any other country enquire into the status of a micro-nation, it is liable to collapse.

For example, take the Republic of Indian Stream, a self-declared republic in North America that existed from 1832 to 1835. An ambiguous border treaty between Britain and the U.S. had created a 500-square mile legal loophole between Canada and the state of New Hampshire. Three hundred enterprising American citizens, all hoping to avoid federal taxes, quickly established a government and constitution and declared Indian Stream a sovereign state. The Republic went unchallenged, but when one of its members was arrested for unpaid debts and taken to serve time in a debtors’ prison in Canada, the Republic of Indian Stream swiftly planned a counterstrike. Crossing the border into Canada, they shot up a local judge’s house, broke their fellow “Streamer” out of prison, and returned triumphantly home. This bravado did not last for long. By the next morning, doubts about the attack were mustering, British retaliation was feared, and before long the Republic voted to be annexed by the New Hampshire militia. Indian Stream was soon incorporated into the state where its libertarian longing would continue to be nurtured for years to come.

…

One of the major problems in founding a new country, second only to being ignored, is the threat of invasion by a more legitimate nation. As a result, when a group of Ayn Rand disciples tried, in 1969, to set up a new country named Oceana, defense of the realm was paramount. Even though the exact location for Oceana had not been definitely fixed, boot camps were organized for all those who wanted to live there. Most ominously of all, plans were made to steal a nuclear missile, the ultimate deterrent should another country come knocking on their door. Fortunately the group was disorganized and lacking in funds, and when the ringleaders decided to rob a bar to fund their project, the hapless group was promptly arrested and their startling story discovered.

…

The United States Office of the Geographer stresses that five factors are needed to become a country: space, population, economic activity, government structure, and recognition from other countries. Of these, it is the last factor that has always been the hardest to attain. However, one micro-nation has perhaps come closer to fulfilling these requirements than any other. Founded by a former “pirate” radio operator, Paddy Roy Bates, Sealand is situated on an abandoned World War II anti-aircraft tower, seven miles off the British coast. Consisting of 550 square meters of solid steel, it was declared independent by “Prince” Roy in 1967. (The country’s initial economic activity consisted largely of selling passports and minted coins – both common practices amongst modern micro-nations out to make a quick buck).

…

Just as Sealand now plays host to the Internet, it is the Internet that has revealed itself as the host for a whole new generation of fictional state projects. As the libertarian fetish for micro-nations weakens, the virtual geography of the Internet grants a modicum of affordable tangibility to new micro-nations, without any of the traditional perils associated with abandoned anti-aircraft platforms or disputed South Pacific atolls.

…

In comparison, the Royal Kingdom of Elgaland-Vargaland (KREV) has no pull on believability. Although it claims physical territory, it insanely suggests that this consists of all the border frontier areas between all countries on earth. In doing so, the joint kings of KREV (for even these post-modern micro-nations can rarely resist the traditional attraction of a royal title) seem to be taking the artist Gordon Matta-Clark’s “Fake Estates” project – in which Matta-Clark bought small, inaccessible, and unusable lots of land, situated between buildings – to its furthest logical extension. KREV is a country made up of the intersections between real countries, a nation of negative space – a micro-nation that is best to debate rather than to visit.

Micro-nations listed in the article:

  •   the Republic of Counani  
  •   Furstentum Castellania  
  •   Palmyra  
  •   the Hutt River Province  
  •   the Empire of Randania  
  •   the Territory of Poyais  
  •   the Territory of Poyais  
  •   the Republic of Indian Stream  
  •   the Principality of Outer Baldonia  
  •   Oceana  
  •   Sealand  
  •   the Republic of Howland, Baker and Jarvis  
  •   the Royal Kingdom of Elgaland-Vargaland (KREV)  

Micro-nations Read More »

Chinese attacks on government and business networks

business, security / /

From Foreign Policy‘s interview with Richard A. Clarke, “Seven Questions: Richard Clarke on the Next Cyber Pearl Harbor” (April 2008):

I think the Chinese government has been behind many, many attacks—penetrations. “Attacks” sounds like they’re destroying something. They’re penetrations; they’re unauthorized penetrations. And what they are trying to do is espionage. They’re engaged in massive espionage, not only in the U.S. government, in the U.S. private sector as well, but also around the world. The British security service, MI5, sent a note to the 300 largest corporations in England a few months ago, telling them that the Chinese government had probably penetrated their networks.

…

What’s happening every day is that all of our information is being stolen. So, we pay billions of dollars for research and development, both in the government and the private sector, for engineering, for pharmaceuticals, for bioengineering, genetic stuff—all sorts of proprietary, valuable information that is the result of spending a lot of money on R&D—and all that information gets stolen for one one-thousandth of the cost that it took to develop it.

…

I’m also concerned about penetrations of U.S. research-and-development firms, everything from pharmaceuticals to genetics to aerospace engineering—all the things we have to sell in our knowledge-based economy. We are a post-industrial, knowledge-based society. That’s what we sell to the world. If other people can steal it readily, then we won’t have much of a margin.

Chinese attacks on government and business networks Read More »

The NSA’s cryptographic backdoor

security / /

From Bruce Schneier’s “The Strange Story of Dual_EC_DRBG” (Crypto-Gram: 15 November 2007):

This year, the U.S. government released a new official standard for random number generators, which will likely be followed by software and hardware developers around the world. Called NIST Special Publication 800-90, the 130-page document contains four different approved techniques, called DRBGs, or “Deterministic Random Bit Generators.” All four are based on existing cryptographic primitives. One is based on hash functions, one on HMAC, one on block ciphers, and one on elliptic curves. It’s smart cryptographic design to use only a few well-trusted cryptographic primitives, so building a random number generator out of existing parts is a good thing.

But one of those generators — the one based on elliptic curves — is not like the others. Called Dual_EC_DRBG, not only is it a mouthful to say, it’s also three orders of magnitude slower than its peers. It’s in the standard only because it’s been championed by the NSA, which first proposed it years ago in a related standardization project at the American National Standards Institute.

…

Problems with Dual_EC_DBRG were first described in early 2006. The math is complicated, but the general point is that the random numbers it produces have a small bias. The problem isn’t large enough to make the algorithm unusable — and Appendix E of the NIST standard describes an optional workaround to avoid the issue — but it’s cause for concern. Cryptographers are a conservative bunch; we don’t like to use algorithms that have even a whiff of a problem.

But today there’s an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation at the CRYPTO 2007 conference this past August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described as a backdoor.

…

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

…

My recommendation, if you’re in need of a random number generator, is not to use Dual_EC_DRBG under any circumstances. If you have to use something in SP 800-90, use CTR_DRBG or Hash_DRBG. Or Fortuna or Yarrow, for that matter.

The NSA’s cryptographic backdoor Read More »

Graveyard shifts and torpedo coffins

commonplace book, history, science, security / /

From Atul Gawande’s “Final Cut: Medical arrogance and the decline of the autopsy” (The New Yorker: 19 March 2001):

… in the nineteenth century … [some doctors] waited until burial and then robbed the graves, either personally or through accomplices, an activity that continued into the twentieth century. To deter such autopsies, some families would post nighttime guards at the grave site – hence the term “graveyard shift.” Others placed heavey stones on the coffins. In 1878, one company in Columbus, Ohio, even sold “torpedo cofins,” equipped with pipe bombs designed to blow up if they were tampered with.

Graveyard shifts and torpedo coffins Read More »

The Ellsberg Paradox: People prefer definites over ambiguity

commonplace book / /

From Nicholas Lemann’s “Paper Tiger” (The New Yorker: 4 November 2002):

Ellsberg devoted a good portion of his life to decision theory, and made quite a significant contribution for somebody so young. People are still publishing comments on his best-known idea, the so-called “Ellsberg paradox.”

The paradox arises from a series of games involving colored balls in urns. Let’s say there are two urns, each of which contains a hundred balls, which are either red or black. One urn contains fifty red balls and fifty black balls. The proportion of red and black in the other urn is unknown. You can draw one ball from one of the urns, without looking, and if you draw a red ball you win a hundred dollars. Which urn will you choose?

There is no good reason to think that the chance of getting a red ball is any better in one urn than in the other, but Ellsberg found that people overwhelmingly chose the urn known to have fifty balls of each color. The person running the game would then say, “O.K., you think that urn is likelier to have a red ball; now I’m going to offer you a hundred dollars if you draw a black ball.” If you turned to the fifty-fifty urn for the red ball, it would seem you had a hunch that the other urn contained more black balls, and therefore you should try to draw your black ball from it. But, overwhelmingly, people chose the fifty-fifty urn again. The Ellsberg paradox is that people so strongly prefer definite information over ambiguity that they make choices consistent neither with the laws of probability nor with themselves.

The Ellsberg Paradox: People prefer definites over ambiguity Read More »