Security – Page 39 – a sibilant intake of breath

Attacking encrypted bitmaps

Just because your photos are encrypted, it doesn’t seem that you can count on them to be totally unreadable to someone without the key. The attack only seems to work against bitmap images, so those secret JPGs, PNGs, and GIFs should be safe for now. This is because most types of files contain significantly more entropy than bitmaps. That is to say, there is a lot more redundant information in a BMP file than there is in something compressed. Even in the case of the vulnerable images, the technique can only produce “the outline of a high-contrast image.”

Once again, it proves the statement that ‘you can’t hide secrets from the future with math.’ Cryptographic attacks – and the resources available to attackers – will only keep increasing over time.

Video explaining runaway climate change

I have often spent time thinking about the danger of a tipping point into runaway climate change – particularly about the ways in which the concept can be conveyed to non-experts in a comprehensible manner. This eleven minute video does a good job. The script, with peer-reviewed references and additional information is at wakeupfreakout.org.

Here are some related prior posts:

I discovered the video linked above through this Gristmill post.

[Update: 4 February 2009] Here is a post on the danger of self-amplifying, runaway climate change: Is runaway climate change possible? Hansen’s take.

Hackers in the Large Hadron Collider

Apparently, hackers managed to take control of a website related to the Compact Muon Solenoid Experiment: one of the five detectors within the Large Hadron Collider (LHC). This isn’t terribly surprising, since high profile websites get vandalized reasonably frequently. What is rather more disturbing is that the hackers were apparently “one step away” from the control system of the detector itself. While I don’t know the details of the design, not connecting the computers that control the machine to the internet would seem like an elementary precaution. Not connecting them to publicly accessible web servers, even more so.

Apparently, the beams circulating in the LHC will eventually have as much kinetic energy as an aircraft carrier going 12 knots – all concentrated into bunches circling the accelerator 11,000 times per second. Preventing outside access to the control systems for the sensors that will make sense of all the data seems like common sense, even if the output from those sensors is getting sent around the world for analysis.

Naomi Oreskes, climate science, and the JASON group

The JASON Defense Advisory Group consists of top-notch American scientists who carry out requested research on behalf of the American government during the summer months. Past areas of research have included adaptive optics of the kind used to remove atmospheric distortions from telescope images, a system for communicating with submarines using very long radio waves, missile defence, and more.

Back in 1979, the JASONs looked into the issue of climate change – concluding that the atmospheric concentration of carbon dioxide could double by 2035, causing an increase in the mean temperature of the oceans and atmosphere. Despite not having any climatological background, they constructed their own mathematical model to approximate the relationships between greenhouse gas emissions, atmospheric concentrations, temperature changes, sea level rise, and other phenomena. Unlike many of their other non-classified reports, “The Long Term Impact of Atmospheric Carbon Dioxide on Climate” doesn’t seem to be readily available online. Nonetheless, some information on both the report and the JASONs is included in this Times article by Naomi Oreskes: the woman most famous for her 2004 Science article “Beyond the Ivory Tower: The Scientific Consensus on Climate Change,” in which she demonstrated that disagreement about the fundamentals of climate change existed in the media, not within the scientific literature.

The Times article, the Science paper, and the available JASON reports all make for informative reading.

RFID tinkering kit

Radio frequency identification tags are not the most secure things in the world. Indeed, they are probably the last thing you want in your credit card or passport. That being said, they do look as though they could have interesting tinkering applications. No doubt, people will dream up all sorts of cool applications for households and offices.

The Tikitag kit from Alcatel-Lucent should help with that, since it eliminates the need to actually configure hardware. Personally, I would use it to do something along these lines: Attach tags to three or four everyday objects in concealed locations. Hide readers in an equal number of places around my house. Then, when you put the candlestick on the right part of the bookshelf, the clock on the correct segment of the mantle, and the vase on the correct floor tile, a bookcase swings open revealing the entrance to one’s hidden lair…

For added security, one might put the last reader in the bookshelf itself, and the last tag in a radio-shielded pouch around one’s neck.

The world’s most extensive data centres

In an article for Nature, Cory Doctorow, co-editor of Boing Boing, describes some of the world’s most colossal data centres. These include facilities for gene sequencing, particle physics, internet archiving, and so forth. The article includes some vivid descriptions of the massive scale at which data is being interacted with, as well as some of the technologies associated. Describing the ‘PetaBoxes’ that contain copies of much of the web, he explains:

[H]oused in these machines are hundreds of copies of the web — every splenetic message-board thrash; every dry e-government document; every scientific paper; every pornographic ramble; every libel; every copyright infringement; every chunk of source code (for sufficiently large values of ‘every’, of course).

They have the elegant, explosive compactness of plutonium.

Far from being static repositories, many of these places have been designed for a near-constant process of upgrading. They maintain spare capacity into which 1 terabyte drives can be installed when the 500 gigabyte drives become dated (and then 2 terabyte drives, and then 4 terabyte drives). The ones with the greatest capacity use huge arrays of magnetic tapes, archived and accessed by robotic arms. The data centre at CERN (where the Large Hadron Collider will soon begin collecting data) includes two robots, each of which manages five petabytes of data. That’s five million gigabytes: equivalent to more than 585,000 double-sided DVDs.

One of the most interesting issues described is heat and the mechanisms through which it is addressed. The section describing how emergency shutdowns need to occur in the event of a cooling failure definitely comes across powerfully. Describing a facility in the Netherlands, it says:

The site manager Aryan Piets estimates that if it broke down and the emergency system didn’t come on, the temperature in the centre would hit 42 °C in ten minutes. No one could cleanly bring down all those machines in that time, and the dirtier the shutdown, the longer the subsequent start-up, with its rebuilding of databases and replacement of crashed components. Blow the shutdown and stuff starts to melt — or burn.

The main system being discussed is actually surprisingly climate friendly, since it uses cool lake water and pumps rather than air conditioning equipment to keep the drives and servers at an acceptable temperature. Hopefully, it is something that other firms with massive server farm needs are paying attention to. The article mentions Google several times.

For the geeky and the curious, the whole article deserves a read.

India and the Nuclear Suppliers Group

Today, the 45-nation Nuclear Suppliers Group decided to approve a nuclear deal between the United States and India (which is not part of the Nuclear Non-Proliferation Treaty (NPT), and which tested bombs between 1974 and 1998). The decision is one about which I feel ambivalent. One the one hand, it might promote the relatively responsible use of nuclear technologies in India. Despite how we could probably do better by spending our money in other ways, more nuclear power is a likely consequence of concerns about both energy security and climate change. On the other hand, the deal demonstrates that it is possible states can test bombs, remain outside the NPT, and still get access to internationally-provided nuclear fuels and technologies. The lesson to other states may be that the best long-term course of action is to ignore international efforts aimed at preventing the spread of nuclear weapons.

Thinking about how many states are likely to have reactors and bombs by the end of the next century is pretty worrisome.

More comprehensive reporting on the decision:

Generation Kill

Written by a journalist embedded with the 1st Reconnaissance Battalion of the Marine Corps, Evan Wright’s Generation Kill describes the experience of invading Iraq alongside them in 2003. The book provides a graphic account of what transpired among the men of the Battalion and its subsidiary units, as well as on battlefields between Kuwait City and Baghdad.

Some of the more notable elements of the first person account include the lack of coordination between different units, poor logistics and intelligence, near-total lack of translators, wide variations in competence and attitude between officers, and the force with which the sheer terror and agony of the experience is recounted. While large portions of the invading army may have had tents, cots, and warm meals, the recon Marines operate for the entire war on pre-packaged food and holes laboriously pick-axed into the ground. They spent much of the war in bulky chemical protection suits, fearing gas attacks that never came. The Marines are intentionally sent into ambush after ambush, receiving massive amounts of fire from within open-topped Humvies, as a feint to confuse Iraqi forces about the overall American strategy. The book certainly does a good job of conveying the brutality of it all: for the Marines, their Iraqi opponents, and for the civilians all around. The most interesting aspects of the narrative are definitely the characters of the individual Marines, as effectively illustrated through quoted statements.

The book does reinforce some broader conclusions that can be drawn about the war: particularly in terms of how the treatment of the civilian population has been mismanaged. What is less clear is whether the lesson to be drawn is that much more attention needs to be paid to post-occupation planning in future conflicts, or whether expectations of anything other than absolute carnage following a ‘regime change’ are misguided. Probably, the answer lies somewhere between.

The book has also formed the basis for an HBO mini-series of the same name. The series and the book parallel one another very closely. Indeed, given the arguably greater capacity of film to depict the majority of the events described, just watching the series may be a superior option to just reading the book.

Barack Obama on oil imports

Compared with his 2004 performance, Barack Obama’s speech at the Democratic National Convention the day before last seemed a bit lackluster. That being said, it was a more specific about the priorities of a potential Obama administration. Energy issues were touched upon a few times – the environment hardly at all – but that is probably not surprising, given that winning the election is the over-riding priority for him now, and talk of effective climate change policies is (sadly) likely to lose more votes than it wins. The speech only mentions climate change once, as one of the “threats of the 21st century” along with “terrorism and nuclear proliferation, poverty and genocide, climate change and disease.” The lack of elaboration demonstrated both the degree to which this speech was aimed at a domestic audience primarily concerned with the state of the US economy and the desire to avoid the mention of polarizing specifics when enumerating challenges – a tactic that was also used in relation to a number of domestic social issues.

One line struck me as ambiguous and potentially problematic:

[F]or the sake of our economy, our security, and the future of our planet, I will set a clear goal as president: In 10 years, we will finally end our dependence on oil from the Middle East.

If this just means shifting American imports from Middle Eastern states to those elsewhere in the world, this won’t be much of a solution for either climate change or energy security. Let’s say the US buys all of its oil from outside the Middle East. Even so, the world price of oil will largely be set by developments there: particularly expectations about output in volatile areas, as well as confidence in the ability of Saudi Arabia to moderate oil price shocks through reserve capacity. Since the price of Alaskan or Albertan oil moves along with developments in Kuwait and Iran as much as oil
anywhere else, the source of the imports isn’t hugely important when it comes to price or security of supply. If the non-Middle Eastern producers selling to the US can get a better price in Europe or Japan, the oil will follow the money.

A more ambitious and effective plan would focus on ending dependence on oil altogether, regardless of source. That can begin in areas where oil can be easily replaced at present – such as powering urban vehicles – and can progressively move into areas where fewer alternatives now exist. The pledge in the speech to devote $150 billion to developing alternative energy sources hints at an appreciation of the importance of a renewable energy economy. Achieving that requires altering the mechanisms through which energy is generated, transmitted, and used – not just changing the flags on incoming supertankers.

Steganography challenge

In the past, I have posted a few cipher challenges for the cryptographically inclined. Here is a new one:

The above is an example of steganography rather than cryptography, though the two can be easily combined. Indeed, the same approach used above could be applied in a far more subtle and effective fashion. To save people some trouble, I can tell you that the hidden message is in the actual text shown, not hidden somewhere in the data file.

Here is a hint, weakly enciphered using ROT13: Guvf sbez bs frperg jevgvat jnf vairagrq ol Senapvf Onpba.