Chip hacking; ain't just for ninjas at the Lays factory

Chip hacking you say? That's right. This was quite a surprise to me but apparently some folks have started to explore the concept of making malicious semiconductors. The concept here is that a specially designed chip would be able to function just as the standard chip but would also allow back doors and access to data that would be undetectable from software. Of course, if you can access someone's physical computer, security has already been compromised. The danger here is not that someone will do a 'sneak and peek' and replace a systems microprocessors (though in theory this could happen; in reality it is far more likely that someone would take a copy of the hard drive to look at; install spy-ware or just plug in a key logger to be retrieved at a latter date).

What is of concern is that someone would put these chips into the commercial stream (or even target it at specific customers). If that sounds outlandish; you may be in for a surprise that some of the computer communications routers (the devices that send messages around the net) have already been hit by counterfeit chips. Indeed; in this case the routers that were purchased went to the US military. Although there is no proof at the moment that these chips were compromised (in terms of having a back door installed) no-one really knows. This has sent the Department of Defense scrambling to inspect all of it's routers for these phony chips (for those who think this sounds like overkill; it may be given that the US (and Chinese) governments have already insisted that communications equipment makers design their equipment to be able to allow transmission monitoring (Cisco documentation).

The interesting part here is that this is forcing government agencies to flip the usual "privacy for security" trade-off" discussion on its head. In this case, the way they can ensure the security of their populations, is though increased privacy (this is the same argument that people make about anonymity being important to avoid governmental tyranny). Although governments are likely to do a two-step about how what's good for them is bad for you; the real danger here is that chips coming from unidentified sources (say Fabs (fabrications facilities) outside of the US) and then put in products to be resold could have back doors waiting to be unlocked (or have the machines disabled at a critical time). The fear for governments here is obvious but the impact to business and users is also important. I'd love to see a solution for how to protect against malicious hardware (somewhat akin to the challenge of sending secret messages across monitored channels that encryption faced until public key encryption was discovered).

PEN registers don’t sell PENs

So to grasp the way that some internet data is traced today (issues for a later posting) it is important that we look at the past (and as it turns out, the present). The past part is the PEN register. A PEN register is a device that was attached to phone company switches and used to record the numbers called and the times those numbers were called. These devices were able to be set up without a warrant as they do not record the contents of the call. This was a wonderfully effective tool against phone harassers and organized crime as well as phone phreakers who would use other people’s calling cards to call all around the world to connect to BBSs (Bulletin Board Systems (the precursor to today’s internet communities)). Since courts found that PEN registers were legal as they didn’t invade on the content of the communications, it can naturally be extrapolated that the same is true for internet traffic (although the courts seem to have been selective in their decisions of what “old” technology relates to the internet (in almost all cases, ruling that your internet communications have far less protections than traditional means of personal speech, land line phone calls, or US mail.

From a privacy standpoint, the connection of the call (or internet traffic) may still contain information that a user might not want to have made available (say if you are a whistle blower calling a reporter or govt. agency or you’re someone calling an AIDS clinic or planned parenthood might strongly insinuate things, even if those assumptions are incorrect). Because of this, many folks in organized crime (and phone phreaks) began using public phones which they could always go to another one and this made tracing much more difficult (the equivalent today would be pay as you go cellular phones though these are monitor-able and the records of their calls are kept so there is still a record (the users of this technology rely on the “security though obscurity” model which we’ll discuss in the future why this isn’t a great way to protect your privacy)). On the internet people use programs like tor to obscure who they are connecting to. This may be of additional concern to people since Congress passed a bill this week increasing the government’s eavesdropping, and snooping, abilities.

In other news: Dateline associate producer Michelle Madigan was outed this week while attending the hacker convention Defcon. Apparently she had gone undercover and the organizers didn’t seem to like the idea of someone trying to get attendees to admit to felonies on camera to shock the “folks in Kansas”. Welcome to a strange turn of the previous topic of the conflict between free speech/free press and privacy.

Cordless Phones: All your base (stations) belong to us

Everyone knows that eavesdropping isn’t polite. We’ve also all had the experience of accidentally overhearing something in a conversation (in many cases out of context). Since we can hardly hold people accountable for hearing what others say within earshot, we are usually on our own to protect our privacy in such situations. This becomes a bit more complicated when you put a phone into the mix. The transmission of a phone conversation across the telephone lines is a protected form of confidential speech and recording such conversations is illegal without consent (in some states you need one party (or a judge’s order) in others, like California, you need both parties consent (or a judge’s order)). These wiretapping provisions also applied to wireless phone transmissions. What is interesting is although the government may need a warrant to listen in to your wired phone call conversations (called land lines) they (eavesdroppers) do not to listen in to your wireless calls (http://caselaw.lp.findlaw.com/casecode/uscodes/18/parts/i/chapters/119/sections/section_2510_notes.html). This is because the law says so but from a practical matter it is because wireless calls are broadcast and thus anyone who can receive that broadcast can listen in to what you are saying. Since you are broadcasting, you have no reasonable expectation of privacy (well talk more about this in another posting).

In the 80s and 90s this meant not only government listening to people’s phone calls became much easier, but that private parties could listen in with greater ease (note, there is a distinction between what people.govt. can do, and what they can do legally. Recording something might put you (or the govt. afowl of some laws, but it doesn’t stop information gathering, legal or otherwise). In many cases people would take a cordless phone handset and walk around their neighborhoods (a radio scanner would work as well) and just switch channels until they tuned into someone’s conversation. The handset method also allowed people to pickup unused base stations (where your phone rests to recharge) and use their line to make long distance calls for free (or local calls that were much harder to trace to the person making the call). Several advancements over the years have made this more difficult. Phones have moved to new frequencies (higher frequencies mean people need newer equipment to listen in but the greater range for your phone, the farther away an eavesdropper can be). Phones also started blocking the base station if the phone was in the charger (a modest improvement). Another improvement was frequency hopping (exactly what it sounds like). Perhaps the biggest change was the move to spread spectrum technology.

Spread spectrum technology spreads the conversation out over the entire frequency band. This prevents traditional monitoring tactics as any one frequency doesn’t show enough signal to make it appear that there is anything being transmitted. This technology was used by the military in WWII and only in the 90s became civilian use technology.

What is of note of all of these changes is that all of them are still able to be intercepted (though private parties have to go through more, and more expensive, loops to continue to eavesdrop government surveillance still has the ability to listen in without the burdens of a warrant that land lines require. What is also worthy of note, is that although the technology has evolved, the one thing that would seem to be the most effective way to protect the privacy of phone users (encryption) has never been offered (Another article will discuss encryption of communications).

From the user’s perspective, the critical thing here is that you are most protected from privacy invasion in your phone calls by using traditional land line communications. When you add the convenience of wireless, you are giving up some of the potential privacy of your conversation.