Schneier on Security

Clive Robinson • December 6, 2017 1:49 PM

@ Tatütata, Wael,

to make all dark like licorice

In the UK it’s not pronounced as “lick-or-ice” but “lick-or-ish”

So a new line,

to make all as sinfull vice

Clive Robinson • December 8, 2017 5:15 PM

@ Schwartenmagen,

Since the early 90s, all encryption software from Germany feature backdoors. Moreover, this also applies to secure file wiping software.

It’s not that difficult to do…

The first thing you need to remember is that to “securely wipe” / delete a file is you don’t actually delete it. What you do is “overwrite it” multiple times with supposedly “random” data.

To actually overwrite it in many cases the file is read into a buffer, this is then overwritten and then written back to the storage device in the same place.

There are verious reasons given for the read then write. The primary one is it supposadly stops low level operations from just writing to a new available sector from the free list rather than hit the actual HD platter sector or Flash ROM row.

However if you know what the original data is you can simply encrypt it instead then write that back rather than random data. The point is you would not be able to tell unless you had the crypto key. In fact the crypto algorithm can be a very weak key stream and XOR or ADD function.

The thing is it does not matter how often you encrypt with the XOR or ADD function, you can “short circuit” them back to a single key stream.

The next question is how to get around the “overwrite with ones” and “overwrite with zeros”. Obviously if this is done at the file level the data will be gone. The issue is how to make as though it has been done. The easiest way is to not do it at all and instead do various tricks with the free list, so it looks as though it has been done.

The thing is that on most modern drives they are of such a size that you are not going wrap the free list around any time soon if at all. Thus you can pull sectors off the top of the free list that you can overwrite with ones and zeros, whilst actually tucking the encrypted sectors in at the other end of the free list…

Whilst this works it will be detectable by anyone taking more than a simplistic look at the storage device. The thing is that the way commodity OS’s like those from MS is that there are many places you can hide an encrypted set of sectors in the equivalent of swap/page space and in parts of the journaling system.

Then there are curious tricks of using Forward Error Correcting (FEC) codes to make file systems where a file can be lost or destroyed but can still be recovered. Known as “Erasure Code”[1] put overly simply three data files can be made to be difference files of each other with a fourth file being a difference of differences file. Thus if any one of the four files is damaged or deleted it can be reconstructed from what is the difference between the other files. Thus the three data files are recoverable even if you deleat one of them entirely by writing it all to zeros or all to ones etc. Whilst this trick can still be spotted by someone who knows what they are looking for most people will miss it.

There are other such tricks that are harder to spot, but none of them require force balance SEMs etc to recover the data of a deleted file or many files…

Whilst I know one or two tricks, to do this off the top of my head I’d be prepared to bet there are quite a few others I don’t know of immediately. But also if I was given good cause to think up another new one I probably could in fairly short order.

Modern hard drives by the way for reliability reasons actually have way more storage on them than you can see at the SATA etc interface… Which means that if your wipe program has sufficient privileges and knows the right storage device commands it could tuck away between 20-25% of the total declared space at the interface level. Which with data compression means that between 30-50% of the advertised storage could be hidden away… Out of sight of all but a few specialized tools…

Which is possibly the reason I still like individual file encryption at the application level and the old technology of floppy disks and big magnets, and CD-RW/DVD-RW with a fifty dollar microwave oven. When it comes to storing files I’m going to need to securely erase at some point…

[1] https://en.m.wikipedia.org/wiki/Erasure_code

Clive Robinson • December 9, 2017 2:00 PM

@ Tatütata,

And you get good exercise practicing the famed Rose Mary Woods Stretch.

Ahhh back when aerobic excercise was only muttered by the more radical members of the medical profession, as it was considered dangerous for young women to perform. Let alone the new fangled hippy tie dye yoga thing, bound to inflame not just the senses but the passions as well in those staid[1] times… Remember a certain book had finaly just come out[2] to the horror of all Republicans and Conservative preachers, with other attempts made to avoid if not suppress the issues of certain medical papers behind it to do with “nerve nexuses” all very seditious etc.

The US was already on the downward slope, as some claim 1969 was the last time the US showed it was great…

Speaking of the 60/70s and computer parts,

I also tried juicing them, connecting pins 1-14 to one rail, and 15-28 to the other one, and power the lot from a beefy power source.

In the late 1970’s London’s Edgware Road was famous for emporiums selling off old Military Radios and second hand computer bits and electronic components.

A friend and I were very much into Pirate Radio from the electronics side and accumulated vast quantities of electrolitic capacitors and LEDs from kit we stripped down for parts that we then sold on.

The question was what to do with the blasted electrolitics, mainly they had gone leaky which was why the equipment they were in got scrapped in the first place. The domestic refuse guys would not touch them so we had box after box of the darn things. After having one expload during testing as it got reverse volted for some reason that is lost to memory, and having my friends parents come rushing into the garage due to the noise, they saw us gasping in the acrid smoke as we managed to escape with red rimed eyes and burning coughs.

We were told the caps would have to go… After his parents went off shopping I joked it had gone off like a thunderflash and explained how we used thunderflashes as phoney mortars. The idea occured… Less than half an hour later two fully charged car batteries a four foot section of plastic overflow pipe and some jump start leads were pressed into service for an experiment. These electrolitics were quite large at just under a couple of inches diameter they just snuggly fit the overflow pipe. So we screwed the ends of the jump leads under the terminals of the first cap put it in the end of the pipe and pressed it at around 30 degs from vertical into the ground. Roger connected the two leads to the batteries and just a second or so later there was a loud bang and to our amazement the aluminium can flew maybe ninety to a hundred feet in the air on a trail of what looked like confetti it shot over the garden wall over the road and hit the roof of the house the otherside close to the ridge tile…

With in a few minutes we had the firing rate down to a couple a minute and were getting them over the house on the otherside of the road where the occasional tinkle told us we had found the range of their green house…

But what of the LEDs like you we found that a high voltage produced a very very intense but extreamly brief flash of red light befor it exploded in a brief orange ball of flame and red plastic shrapnel… I will let you guess what 150 leds soldered onto two copper wires that had been U-pin stapled to a plank fed by a 100watt 10ohm vitrious enamle wire wound power resistor and a big meaty 20amp bridge rectifier fed from a big switch and 240V AC…

All I can say is that as we did it in the dark it took around five minutes to be able to see again. One of the neighbour who’s house was around five hundred feet down the road reported to Rogers dad that there had been a blinding red light flash off the backs of all the houses down the road…

Oh with regards,

I couldn’t take the HDD with me, but I was allowed to destroy on the spot. I must have banged on the thing with a hammer for 20-30 minutes, until the cover was off, the electronics destroyed, and the disks scratched and warped.

Another reader of this blog who still drops by from time to time tells a story of a more fun way of making a hard drive unreadable… It involves a gun range and a magnum hand gun and a large box of amunition…

As this post is getting a bit long remind me at some time to tell you the story of how a local farmer got an unexpected new duck pond in a field and stories of WWII bombs going off. Oh and another about angry poltergists dropping inch diameter pebbles from the sky (or that’s the story that appeared in the local rag 😉 The 1970’s were way more relaxed than we are today… Oh and another story from “down on the farm” of coitus interruptus by shotgun on the up stroke very early one sunday morning…

[1] Remember whale bone was still very much in demand back then for a core set etc.

[2] https://en.m.wikipedia.org/wiki/Masters_and_Johnson