October 1, 2023

DOUG.  Crocodilian cryptocrime, the BWAIN streak continues, and a motive to be taught to touch-type.

All that, and extra, on the Bare Safety podcast.

[MUSICAL MODEM]

Welcome to the podcast, all people.

I’m Doug Aamoth; he’s Paul Ducklin.

Paul, a really comfortable day to you, my good friend.


DUCK.  And a really comfortable day to you, Doug.

I do know what’s coming on the finish of the podcast, and all I’m saying is…

…cling in there, as a result of it’s thrilling, if mildly alarming!


DOUG.  However first, let’s begin with Tech Historical past.

This week, on 07 August 1944, IBM offered the Automated Sequence Managed Calculator to Harvard College.

You might higher know this machine because the Mark I, which was a Frankenputer of kinds that blended punch playing cards with electromechanical parts and measured 51 toes lengthy by 8 toes excessive, or roughly 15.5 metres by 2.5 metres.

And, Paul, the pc itself was nearly out of date earlier than they acquired all of the shrink-wrap off of it.


DUCK.  Sure, it was achieved in the direction of the tail finish of the Second World Conflict…

…in fact, American laptop designers at the moment didn’t know that the British had already efficiently constructed excessive efficiency digital digital computer systems utilizing thermionic valves, or vacuum tubes.

And so they had been sworn to secrecy after the warfare (for causes we didn’t perceive final time we spoke about it!), so there was nonetheless this sense within the States that valve or tube computer systems could possibly be extra hassle than they had been value.

As a result of thermionic valves run actually sizzling; they’re fairly massive; they require massive quantities of energy.

Would they be dependable sufficient, although they’re masses and masses quicker than relays (hundreds of instances quicker in switching)?

So there was nonetheless that feeling that perhaps there was time and house for electromagnetic relays.

The man who designed the Colossus computer systems for Bletchley Park within the UK was sworn to silence, and he wasn’t allowed to inform anyone after the warfare, “Sure, you *can* make a pc out of valves. It can work, and the rationale I do know that’s I did it.”

He wasn’t allowed to inform anyone!


DOUG.  [LAUGHS] That’s fascinating…


DUCK.  So we did get the Mark I, and I suppose it was the final mainstream digital laptop that had a driveshaft, Doug, operated by {an electrical} motor. [LAUGHTER]

It’s a factor of absolute magnificence, isn’t it?

It’s Artwork Deco… in case you go to Wikipedia, there are some actually high-quality pics of it.

Just like the ENIAC laptop (which got here out in, what, 1946, and did use valves)… each these computer systems had been in a bit little bit of an evolutionary dead-end, in that they labored in decimal, not in binary.


DOUG.  I ought to have additionally talked about that, though it was out of date the second it hit the ground, it was an essential second in computing historical past, so let’s not low cost it.


DUCK.  Certainly.

It may do arithmetic with 18 important decimal digits of precision.

Up to date 64-bit IEEE floating-point numbers solely have 53 binary digits of precision, which is slightly below 16 decimal digits.


DOUG.  All proper, nicely, let’s discuss our new BWAIN.

That is one other Bug With An Spectacular Title, or BWAIN as we prefer to name them.

That is three weeks in a row now, so we’ve acquired streak going!

This one is known as Downfall, and is attributable to reminiscence optimisation options in Intel processors.

Inform me if that sounds acquainted, that some kind of optimisation function in a processor is inflicting cybersecurity issues.


DUCK.  Properly, in case you’re an everyday Bare Safety podcast listener, you’ll know that we touched on Zenbleed simply a few brief weeks in the past, didn’t we?

Which was an analogous kind of bug in AMD Zen 2 processors.

Google, which was concerned in each the Downfall and the Zenbleed analysis, has simply printed an article during which they discuss Downfall alongside Zenbleed.

It’s an analogous kind of bug such that optimisation contained in the CPU can inadvertently leak details about its inner state that’s by no means supposed to flee.

In contrast to Zenbleed, which may leak the highest 128 bits of 256-bit vector registers, Downfall can leak all the register by mistake.

It doesn’t work in fairly the identical method, nevertheless it’s the identical kind of concept… in case you bear in mind Zenbleed, that labored due to a particular accelerated vector instruction known as VZEROUPPER.

Zenbleed: How the hunt for CPU efficiency may put your passwords in danger

That’s the place one instruction goes and writes zero-bits to the entire vector registers concurrently, multi function go, which clearly means you don’t must have a loop that goes across the registers one after the other.

So it will increase efficiency, however reduces safety.

Downfall is an analogous kind of drawback that pertains to an instruction that, moderately than clearing knowledge, goes out to gather it.

And that instruction is known as GATHER.

GATHER can truly take an inventory of reminiscence addresses and gather all these things collectively and stick it within the vector registers so you are able to do processing.

And, very like Zenbleed, there’s a slip twixt the cup and the lip that may enable state details about different folks’s knowledge, from different processes, to leak out and be collected by someone operating alongside you on the identical processor.

Clearly, that’s not imagined to occur.


DOUG.  In contrast to Zenbleed, the place you may simply flip that function off…


DUCK.  …the mitigation will countermand the efficiency enhancements that the GATHER instruction was imagined to deliver, particularly accumulating knowledge from throughout reminiscence with out requiring you to do it in some sort of listed loop of your individual.

Clearly, in case you discover that the mitigation has slowed down your workload, you sort of must suck it up, as a result of in case you don’t, you may be in danger from another person on the identical laptop as you.


DOUG.  Precisely.


DUCK.  Typically life is like that, Doug.


DOUG.  It’s!

We’ll control this… that is, I take it, for the Black Hat convention that we’ll get extra information about, together with any fixes popping out.

Let’s transfer on to, “In terms of cybersecurity, we all know that each little bit helps, proper?”

So if we may all simply take up touch-typing, the world would truly be a safer place, Paul.

Severe Safety: Why studying to touch-type may defend you from audio snooping


DUCK.  This in all probability may have been a BWAIN if the authors wished (I can’t consider a catchy identify off the highest of my head)…

…however they didn’t give it a BWAIN; they only wrote a paper about it and printed it the week earlier than Black Hat.

So I suppose it simply got here out when it was prepared.

It’s not a brand new matter of analysis, however there have been some attention-grabbing insights within the paper, which is what minded me to put in writing it up.

And it principally goes across the query of if you end up recording a gathering with a lot of folks in it, then clearly there’s a cybersecurity threat, in that folks might say issues that they are not looking for recorded for later, however that you simply get to file anyway.

However what concerning the individuals who don’t say something that’s controversial or that issues if it had been to be launched, however however simply occur to sit down there on their laptop computer typing away?

Can you determine what they’re typing on their keyboard?

After they press the S key, does it sound totally different from after they press the M key, and is that totally different from P?

What in the event that they resolve, in the course of a gathering (as a result of their laptop’s locked or as a result of their display screen saver kicked in)… what in the event that they resolve all of a sudden to sort of their password?

May you make it out, say, on the opposite facet of a Zoom name?

This analysis appears to counsel that you could be nicely be capable of do this.


DOUG.  It was attention-grabbing that they used a 2021 MacBook Professional, the 16 inch model, they usually discovered that principally, for probably the most half, all MacBook keyboards sound the identical.

When you and I’ve the identical sort of MacBook, your keyboard goes to sound similar to mine.


DUCK.  In the event that they take actually rigorously sampled “sound signatures” from their very own MacBook Professional, beneath supreme circumstances, that sound signature knowledge might be adequate for many, if not all different MacBooks… no less than from that very same mannequin vary.

You possibly can see why they’d are usually far more related than totally different.


DOUG.  Fortunately for you, there are some issues you are able to do to keep away from such malfeasance.

In response to the researchers, you possibly can be taught to touch-type.


DUCK.  I feel they meant that as a barely humorous notice, however they did notice that earlier analysis, not their very own, has found that touch-typers are usually far more common about the best way that they sort.

And that signifies that particular person keystrokes are a lot more durable to distinguish.

I’d think about that’s as a result of when somebody is touch-typing, they’re typically utilizing loads much less power, in order that they’re prone to be quieter, they usually’re in all probability urgent all of the keys in a really related method.

So, apparently touch-typing makes you far more of a transferring goal, in case you like, in addition to serving to you sort a lot quicker, Doug.

It appears it’s a cybersecurity ability in addition to a efficiency profit!


DOUG.  Nice.

And so they famous that the Shift key causes hassle.


DUCK.  Sure, I suppose that’s as a result of if you’re doing Shift (except you’re utilizing Caps Lock and you’ve got a protracted sequence of capital letters), you’re principally going, “Press Shift, press key; launch key, launch Shift.”

And it appears that evidently that overlap of two keystrokes truly messes up the info in a method that makes it a lot more durable to inform keystrokes aside.

My pondering on that’s, Doug, that perhaps these actually annoying, pesky password complexity guidelines have some goal in spite of everything, albeit not the one which we first thought. [LAUGHTER]


DOUG.  OK, then there’s another issues you are able to do.

You should use 2FA. (We discuss that loads: “Use 2FA wherever you possibly can.”)

Don’t sort in passwords or different confidential data throughout a gathering.

And mute your microphone as a lot as you possibly can.


DUCK.  Clearly, for a sound-sniffing password phisher, figuring out your 2FA code this time isn’t going to assist them subsequent time.

After all, the opposite factor about muting your microphone…

…do not forget that doesn’t assist in case you’re in a gathering room with different folks, as a result of considered one of them could possibly be surreptitiously recording what you’re doing simply by having their telephone sitting upwards on the desk.

In contrast to a digital camera, it doesn’t must be pointing instantly at you.

However in case you’re on one thing like a Zoom or a Groups name the place it’s simply you in your facet, it is not uncommon sense to mute your microphone everytime you don’t want to talk.

It’s well mannered to all people else, and it additionally stops you leaking stuff that you simply would possibly in any other case have thought fully irrelevant or unimportant.


DOUG.  OK, final however not least…

…you might know her as Razzlekhan or the Crocodile of Wall Road, or in no way.

However she and her husband have been ensnared within the jaws of justice, Paul.

“Crocodile of Wall Road” and her husband plead responsible to giant-sized cryptocrimes


DUCK.  Sure, we’ve written about this couple earlier than a few instances on Bare Safety, and spoken about them on the podcast.

Razzlekhan, a.ok.a. the Crocodile of Wall Road, in actual life is Heather Morgan.

She’s married to a chap known as Ilya Lichtenstein.

They dwell, or they lived, in New York Metropolis, they usually had been implicated or related to the notorious Bitfinex cryptocurrency heist of 2016, the place about 120,000 Bitcoins had been stolen.

And on the time, everybody sais, “Wow, $72 million gone similar to that!”.

Amazingly, after a couple of years of very intelligent and detailed investigative works by US legislation enforcement, they had been tracked down and arrested.

However by the point of their arrest, the worth of Bitcoins had gone up a lot that their heist was value near $4 billion ($4000 million), up from $72 million.

Plainly one of many issues that they hadn’t banked on is simply how tough it may be to money out these ill-gotten positive aspects.

Technically, they had been value $72 million in stolen cash…

…however there was no retiring to Florida or a Mediterranean island within the lap of luxurious for the remainder of their lives.

They couldn’t get the cash out.

And their efforts to take action created a enough path of proof that they had been caught, they usually’ve now determined to plead responsible.

They haven’t been sentenced but, however it appears that evidently she faces as much as 10 years, and he faces as much as 20 years.

I consider he’s prone to get a better sentence as a result of he’s far more instantly implicated within the authentic hacking into the Bitfinex cryptocurrency alternate – in different phrases, getting maintain of the cash within the first place.

After which he and his spouse went out of their method to do the cash laundering.

In a single fascinating a part of the story (nicely, I assumed it was fascinating!), one of many ways in which she tried to launder a few of the cash was that she traded it out for gold.

And taking a leaf out of pirates (Arrrrr!) from a whole lot of years in the past, she buried it.


DOUG.  That begs the query, what occurs if I had 10 Bitcoins stolen from me in 2016?

They’ve now surfaced, so do I get 10 Bitcoins again or do I get the worth of 10 Bitcoins in 2016?

Or when the bitcoins are seized, are they routinely transformed to money and given again to me it doesn’t matter what?


DUCK.  I don’t know the reply to that, Doug.

I feel, in the intervening time, they’re simply sitting in a safe cabinet someplace…

…presumably the gold that they dug up [LAUGHTER], and any cash that they seized and different property, and the Bitcoins that they did recuperate.

As a result of they had been capable of get again about 80% of them (or one thing) by cracking the password on a cryptocurrency pockets that Ilya Lichtenstein had in his possession.

Stuff that he hadn’t been capable of launder but.

What can be intriguing, Doug, is that if the “know your buyer” knowledge confirmed that it was truly your Bitcoin was the one which acquired cashed out for gold and buried…

…do you get the gold again?


DOUG.  Gold has gone up too.


DUCK.  Sure, nevertheless it hasn’t gone up wherever close to as a lot!


DOUG.  Sure…


DUCK.  So I’m wondering if some folks will get gold again, and really feel fairly good, as a result of I feel they’ll have made a 2x or 3x enchancment on what they misplaced on the time…

…however but want they acquired the Bitcoins, as a result of they’re extra like 50x the worth.

So very a lot a query of “watch this house”, isn’t it?


DOUG.  [LAUGHS] It’s with nice pleasure that I say, “We’ll control this.”

And now it’s time to listen to from considered one of our readers.

Strap in for this one!

On this text. Hey Helpdesk Man writes:


“Razzlekhan” was the reply to a query throughout a cybersecurity class I took.

As a result of I knew that I gained a $100 hacker present card.

Nobody knew who she was.

So, after the query, the teacher performed her rap tune and all the class was horrified, haha.


Which prompted me to go lookup a few of her rap songs on YouTube.

And “horrified” is the proper phrase.

Actually unhealthy!


DUCK.  You know the way there are some issues in social historical past which can be so unhealthy they’re good…

…just like the Police Academy motion pictures?

So I all the time assumed that there was a component of that in something, together with music.

That it was attainable to be so unhealthy that you simply got here in on the different finish of the spectrum.

However these rap movies show that’s false.

There are issues which can be so unhealthy…

[DEADPAN] …that they’re unhealthy.


DOUG.  [LAUGHING] And that is it!

All proper, thanks for sending that in, Hey Helpdesk Man.

In case you have an attention-grabbing story, remark or query you’d prefer to submit, we’d like to learn it on the podcast.

You possibly can e-mail [email protected], you possibly can touch upon any considered one of our articles, or you possibly can hit us up on social: @nakedsecurity.

That’s our present for right this moment; thanks very a lot for listening.

For Paul Ducklin, I’m Doug Aamoth, reminding you till subsequent time to…


BOTH.  Keep safe!

[MUSICAL MODEM]