RFID blockers have very limited use

I keep seeing these “RFID blockers”.

Anti RFID skimm device
Anti RFID skimm device

RFID blockers improve your security only a bit as contactless skimming is a high-risk/low-reward attack for the attacker: Contactless credit cards and electronic IDs reading distance is max ±25cm so about ±10 inches in lab conditions with 500+Watt amplifiers (this is the kind of power that causes sparks to fly!).
If you can get reading distance up to half that reliably in real world situations, you we can make a lot of money selling your skills in the reader market.

For this attack to work, someone needs to be basically rubbing up to you to talk to your card.
In the case of electronic IDs (eIDs) like passports, driver’s licenses, ID cards, that follow international ICAO norms (i.e. any European one, Americans only since a few years), that still doesn’t get the attacker anything: to talk to the chip requires some information from the front side of the card: the 3-4 lines of computer-readable text at the bottom of your passport. (In case you want to know, this is called the Machine Readable Zone (MRZ)).
Basically: you need to optically read the eID before you can electronically read it, i.e. you are already handing it over to them (ID checks at airports, rentals, hotels).

In the case of contactless credit cards, the story is a bit more complex, as it depends on what your issuing bank has configured the card for (they have a dozen or so parameters they can choose).
In general, transactions up to $25-ish to an overal total of $150-ish don’t require a PIN (for the tap-and-go payment of coffees).
As the electronic transactions with these credit cards are one-time and only-with-that-shop, a pair of attackers would need to pull of the following to pay with your card, in what I call a “contactless extension cord” attack or is often called “virtual pickpocketing”:

  1. Attacker A dry-humps you to get his card reader within those ±5 inches of your card, and
  2. Attacker B, at that exact same time, is physically at a shop with a card emulator, and about to pay to max that limit that we are talking about (i.e. max 5x$25-ish product).

This exposes both Attacker A and B to being physically caught, for $25-150 of stuff that still needs to be fenced at a much lower return value.
There are lower-risk and higher-reward kind of attacks you can do as a criminal :-). 

That said, if you want to get protection, consider adding a layer of aluminum foil in your existing wallet (reduces the read distance to 1-2 inches) or combine with the practicality of a compact wallet like Secrid.

With kind regards,
Wouter

Japan: Suica travel card

Something that has me proud as I have some background and connections in the domain, and happy because I just love Japan:
It is now possible to use any iPhone 7 or higher for most of the public transport in Japan (this is called “Suica”, a FeliCa technology solution). If you are travelling in Tokyo, this is great!

Transfer to iPhone

If you already have a Suica card, you can transfer the balance (including deposit!) to your iPhone 7 or higher. Apple has a walkthrough that is easy to follow (only attention point is that you have to change the region to Japan under General -> Language & Region -> Region).
Simply put, set your region to Japan and add a Suica card to your wallet.

Use is easy


Use is easy: just hold your iPhone on the turnstile readers. With the excellent reader technology and powered iPhone, reading distance and speed is really good. Your phone will vibrate and you are done.

My practical (air)travel trips

I travel quite a bit for work and pleasure, and have for a few decades. Here are some practical tips I have for you.

Preparation (weeks-days before travel)

  • Invest in the best active noise cancelling earphones you can afford and that fit you best. I love my Bose 20i. I prefer in-ear earplugs, but the over-ear Bose 35i and Sony WH1000XM3 work really well too (they are a bit hot to wear, and the Sony one’s Bluetooth handling is less elegant as it will not easily switch between two users. The reduction of the onslaught on your ears and the resulting stress on your system is worth more than any class upgrade if you are in a bind. I can’t emphasis this enough: invest in a good noise cancelling headphone.
  • Consider buying passive earplugs for sleeping: if you cover the microphones of the active noise cancellers they will typically give you a high screeching tone. Plus I don’t like having wires around my throat when I’m sleeping: I prefer not to garrotte myself. I like 3M’s 1100 Orange rounded earplugs or more recently my custom made earplugs from Alpine.nl.
  • Go into the travel with enough sleep. Going in with a sleep-debt will make the effects of jetlag much worse, and it will take longer to recover from it. Plus with low sleep you’ll be more tempted to eat crap food.

Preparation (just before the trip)

I have a check-in/carry-on suitcase (currently Samsonite B-Light 3 with 2 wheels) ready for travel nearly all the time. The week before a trip I have it open in my bedroom and fill it with the specific items I need for an upcoming trip as I bump into them (Getting Things Done style inbox filing ;-)).

I also have my daily-carry/designated carry-on backpack (currently North Face Kaban (older model)) which is always ready for day to day meetings and for air travel (fluids only in an external pouch, no sharps, etc).

That carry-on backpack also contains a change of clothes, just in case my check-in goes missing for a few days (rare) or I get caught in rain/manage to dirty my clothes (less rare). I’ve packed, in waterproof ziplock bags, wrinkle-free business casual clothes:

  • 1 Mizzen and Main shirt (doesn’t wrinkle, looks professional, does not sweat, does however love to absorb coloured liquids spectacularly).
  • 1 Nike Golf pants (looks like formal pants, stretches and dries like sport clothes, hard to get dirty and easy to clean)
  • 2 changes of underwear
  • 2 pairs of socks (with my Vibram 5fingers I get wet feet easily)
  • 1 waterproof trenchcoat from Patagonia (if I’m not wearing it)
  • Take a biggish (1 or 3 liter) ziplock bag, and put the items you need available at your seat in there. This allows you to quickly and without fuss settle into your seat. If you practice putting your stuff back in after using, you also won’t lose items as you leave again. As an added bonus, that bag probably is also exactly the electronics that you have to pull out at the security screening anyway, making that process much less stressful (and more efficient for other travellers like me too ;-)).
  • Consider packing:
    • Apple travel Adapter Kit (or equivalent), with the plugs of all your stops on the way. Consider to add the UK one too: I’ve found that the power plugs often don’t hold power supplies with US prongs at all, and poorly with the European ones. This is the one place where I really like the massive UK power prongs: they keep the power supply nice and snug even in turbulence.
    • Short USB charge cables for your phone, tablet and noise cancelling headset.
    • A good eye mask.
    • A small pen, and if you like that, a note pad.
  • Pack any item that is a liquid/gel in a good ziplock back of max 1l. Not only will that allow you to efficiently pull it out if it is in your carry-on luggage, but it will also save you much grief should it accidentally open/leak in your check-in luggage.

During the trip

  • Drink plenty of water: Simply accept every offer of water.
  • Stay away from alcohol: Alcohol dehydrates you, and degrades the sleep quality significantly. You might feel a bit better dulling yourself from the travel stress with the alcohol, but you are paying a heavy price for this after the flight. I advise meditation and binaural beats as an alternative for handling the stress of the travel.

Professional-paranoid tips

  • Consider putting a 3M privacy shield on your laptop. It severely reduces how much your neighbours can see and how much they are disturbed by your laptop’s light. (Disadvantage: it is glossy, especially the gold side, so it makes the screen a bit less clear. A privacy shield also interferes with a blue-filtering screen. Do install F.lux.)
  • Consider the environment and prefer seats with no people behind you. People do look on your screen. I know I can’t help but notice that presentation or business plan…
  • As usual, always lock your computer when you are away from it. Don’t leave it unattended in waiting rooms and such of course.
  • Put some TSA approved locks on the zippers of your backpack, and connect them together.

Flying business class: decadent waste of money or cost-efficient use of time?

I’m writing this half-way between Europe and the US. Decadently in business class.
I used to consider this was an extravagant decadence, a waste of money. Money was scarce, not mine to spend, or both. A typical ticket from Europe to the US costs about €400-600 per leg. The upgrade costs to business class is typically €300-600 per leg extra. That is a lot of money to spend on more personal space for ±8-10 hours.

And now that money isn’t scarce, but my time is, I’ve come to the conclusion that business class is actually cheaper for me financially. This surprised me (pleasantly ;-)). Below is my reasoning.

Yes: Getting work done

Flying in business class gives me room to put my laptop in an ergonomically ok distance (display is still too low, but there is not much to do about that), without fights for my elbow space or visibility on my screen.
As a result, I typically get a solid 4-6 hours of work done (no distractions), which pays for the upgrade costs. So this is money-cost neutral from just the work I can do on the plane.

Yes: less travel stress, more availability

Meanwhile, I travel much more comfortably, resulting in much less stress on my body and mind. I also get a good 2-3 hours of nap/meditation. The result is that I arrive in a much better physical state, with much less recovery time and energy costs. This saves me a good 1-2 days of crappy recovery from jetlag at the destination.
The improvement in my quality of life is totally worth it as a person, and me being immediately fully functional for work alone pays for the business class ticket in the 1-1.5 days of productivity that comes from that. Let alone the much deeper impact I can make from being resourced.

Conclusion: Heck yes!

So, now I decadently enjoy both the time saving and money making travel in business class.

Jet-setting and working hard,
Wouter

P.S. Regardless of the travel class, I have some tips that make travel much easier.

99Designs logo design experience

As you early readers of my blog know, I had a design “contest” using 99Designs for a new logo. I’ll have another post on how the economics of 99Designs lead to some less desirable results.

This post however, is about how selection of the logo happened.

Setting context: The brief I gave

Title: “Create a clearly personal, yet elegant logo and FB header” by Wouter.org.

The tone I want to convey is me (Wouter, my first name, masculine) talking to you (the reader), one on one, person to person, not with a lot of attention on me but also not shrinking that it is me you are talking to. I’d love the logo to be very similar to my own handwritten Wouter, or quite different but inspired. The total domain name “Wouter.org” has to be quickly understandable, with .org clearly part of it.
I’ve also attached some pictures of me for possible inspiration on the header files. All are mine in terms of copyright and can be used for this.

Lessons learned

Cross cultural experiences

An important practical detail for me was that the total domain name “Wouter.org” would be immediately clear. This brought up interesting multi-cultural perspectives. As the logo was based on my (arguably not so readable) handwriting, I found out that the t is crossed differently in the US for example. I did not know that cursive writing varied that much!

Voting isn’t that distinctive

I set out a poll with friends to ask for feedback.
It turned out that the actual voting itself wasn’t as useful to me as I expected, as the voting results were pretty close to each other:

Screen Shot 2016-09-07 at 10.49.23Screen Shot 2016-09-07 at 10.49.38Screen Shot 2016-09-07 at 10.49.56Screen Shot 2016-09-07 at 10.50.13Screen Shot 2016-09-07 at 10.50.30Screen Shot 2016-09-07 at 10.50.48

Interestingly there was quite a bit of “love or hate”, i.e. designs having lots of votes in both the “1: hate it” and the “5: love it”. My conclusion: this design does stir things with the viewer. 😉

Text remarks are most actionable

Getting specific comments from people turned out to be the most useful. I could spot common themes in what worked and did not work for people, and those who had experience in graphic design gave detailed feedback.

However, quite often that feedback was completely contradicting the previous feedback in impressively new ways. The first feedback would say some aspect of the logo was very unclear, the other immediately saw me and my name in it, the third said it wasn’t me and the ‘t’ should be different.

In the end I, Wouter, make the decision

So, with conflicting signals, ultimately this was my decision to make and hold. Not much different from my technical work and other leadership positions 😉

So I decided for the one that felt the most authentically me.

Wouter.org logo
Wouter.org logo

It looks really good on shirts and a business card!

With gratitude (and a new logo),
Wouter

In business, you outsource your shadow work

In the self-improvement world, there is a strong bias towards healing any wounds/shadow/reactive behavior. You see a weakness, you work on it. You struggle with it, finally heal yourself, and make yourself an even more perfect person. You learn to love being in that painful healing state.

In the business-world, you don’t. You see your weakness, you figure out what needs to be done to have that weakness resolved, and you outsource doing that – to a contractor, a piece of software, a system, a trusted employee. But not you. There is no value in struggling with your demons in business.

In business, you focus on doing what is so obvious to you and brilliant to others, what is so much your superpower, that it is simple to do that seems super-human to everyone else, what is your 10x value add.

Now stop delving deep in your shadows, just hire that accountant to do your taxes, and bring your actual gifts to the world!

With efficient passion,
Wouter

Flip Feng Shui: Perturbation attacks made it to VMs

I’ve been reading up on the Flip Feng Shui: Hammering a Needle in the Software Stack paper, and I’m enjoying that the common smart card attack considerations are coming to more mainstream software considerations.

From the paper:

We describe Flip Feng Shui (FFS), a new exploitation vector that allows an attacker to induce bit flips over arbitrary physical memory in a fully controlled way. FFS relies on two underlying primitives: (i) the ability to induce bit flips in controlled (but not predetermined) physical memory pages; (ii) the ability to control the physical memory layout to reverse-map a target physical page into a virtual memory address un- der attacker control.

This first item we call “perturbation attacks” in smartcard domain. We do those attacks all the time, by giving our poor smartcards power spikes it really shouldn’t be exposed to, prodding it with probing needles too small for the human eye, shooting it with freaking lasers, … you know: standard Monday morning stuff in the office*.

Because we’ve been doing this for ±20 years now in this domain, it takes a while for me to understand a statement like the following is not a joke:

existing cryptographic software is wholly unequipped to counter it, given that “bit flipping is not part of their threat model”.

Because in my world, bit flips are a given, considering that there is an attacker playing with the smartcard. Monday morning remember?

So how does this attack work?

The attack (mis)uses memory de-duplication, i.e. a feature in the host hypervisor that sees that the page of memory of one VM is identical to another one VM’s. When this is enabled, the host hypervisor then maps both these pages to the same page (to reduce actual used physical memory by 40-70%!). If the attacker was the one who created that page originally, he now owns the actual physical page. As long as the host software thinks this page’s content has not changed, the victim VM will read the attacker’s physical page.

So the attacker then does a Rowhammer attack to cause a bit to flip in the part of “his” page. As Rowhammer is a physical side-effect that ‘should not happen’, the host hypervisor does not see the page as changed, even though it is. So now the attacker has just caused a bit flip in his own and, more importantly, this victim’s memory.

Flipping a bit in say a RSA public key allows the attacker to factor that modified key, and generate the appropriate secret key to match. If the attacker does this with the RSA key say used to authenticate root access for SSH, or the signature key for package updates of Linux, he now has full control over that machine.

Neat! (In smartcard world we usually attack the secret key, because of how the protocols are used.)

Theory or practice?

Now, to successfully pull off this attack, several things have to be possible for the attacker:

  • predicting the memory content (this excludes attacks on confidential information such as secret keys),
  • memory de-duplication must be active (so disabling that, or setting it to “only zero pages”, seems prudent),
  • the attacker must be running his VM on the same physical machine as the victim’s VM (I don’t know if this is a realistic scenario. More on it below)
  • the memory must be sensitive to something like Rowhammer (so ECC memory is yet again a good idea, it will reduce the chances of this significantly)

Realistic to be the neighbour of your victim VM?

This attack depends on being able to run the attack VM on the same hardware as the victim VM. I have no well-founded grounds to guess if this is a realistic assumption.

I can think of the following situations where that is possible:

  • The pool of actual hardware is pretty small compared to the amount of VMs, because the hardware is very beefy or the VMs are small.
  • The amount of instances of the victim VMs is pretty big, because it is a standard VM replicated many, many times. I think about situations like massively parallel computing or streaming (Netflix?).
  • Or the targeted page is very common, and here I’m thinking of the signature files for updates for example, or company wide backup root accounts.

My conclusion: stay calm and …

Considering all the complexity of this attack, I don’t see it worm all over the Internet soon. It is however a cool warning that attack can and do cross over from these various fields.

I wonder when they’ll realise they can also apply this attack to modify the running code of say the password check routine

Financial growth to freedom

Lately, I’m getting questions on “how to invest” income beyond direct living costs.
Just like with GTD systems, I find it very important to have a financial system that one can relax into fully. Not having concerns about money frees up a lot of mental and emotional energy, and can shift one from a scarcity to abundance mindset.

My advice and practice is go implement this once the daily living costs have been covered, in the below stated order:

  1. Put an amount of at least 6 months of living costs + one big unforeseen cost (e.g. suddenly needing a new car due to an accident) aside in a savings account as buffer for hard times.
    Taking out a loan is very expensive, both in money (interest) and in energy (loss of abundance mindset).
  2. Invest at least 15% in a financial freedom fund, some form of savings that does not easily lose value but is accessible if you need it within half a year, relative to the way you live.
    In my case it is my own house and office, as I don’t likely need to move anytime soon. If you are like a lot of my friends and you want to stay more mobile for a while, consider an investment fund that has the same distribution as the Dow Jones, but mind the costs and risks!! I highly advise reading Tony Robbins’ “Money, master the game” on this topic. Management costs above 0.5% annually of your investment will kill any value accrued.
  3. Invest 10-30% in development of skills and contacts that make you more valuable, more productive and widely skilled, so that you upgrade your market value by at least one order every two years. Examples include workshops that really stretch you beyond what you think you could do or mastermind groups at a level you think is beyond your stature.

After the above, you can put the remainder into further tweaking of your financial growth and stability, with your choice of:

  • Extending your safety buffer to 12-24 months (I aim for 18+ months, allowing for a safety margin to abort ventures)
  • Reducing any costs you have (e.g. paying off outstanding credit card, loan or mortgage costs)
  • Investing in quality products and services that require reduced upkeep costs and make you much more productive
  • More investment in financial freedom capital
  • More investment in totally different skills and contacts

And whatever you have left and are entirely ok with losing completely, gamble that by:

  • Paying it forward to a personally worthwhile social goal. Ideally, this could be bootstrapping someone you personally care about towards their self independence, their growth, while expecting nothing in return (and probably getting a lot from that in feeling good).
  • Trying an investment in a start-up you believe in will work financially (with a return of at least 10x) and do your kind of good in the world. Then don’t touch or even look at that investment for at least 5, preferably 10+ years. Don’t expect it to return anything, be positively surprised when it does.
  • If you really must learn that lesson yourself: lose it by gambling on the stock market, stepping into or out of the latest crypto coin hype too late, or other such “I can beat the system” delusions.

I hope this view helps you decide wisely where to put your money.

For the growth!
Wouter

NSA Equation Group’s exploits for sale?

There is a persistent and fairly believable rumor going around that a significant amount of the NSA exploits are for sale. To convince potential buyers that they have the goods, the sellers have apparently dumped a ±250MB package of 3-year old exploits and implants for firewalls.
Looking at the descriptions Mustafa Al-Bassam extracted from the dump, it seems plausible that at least these firewall exploits are from a government outfit like the NSA or GCHQ based on the terminology and the typical codenames like “WOBBLYLLAMA”, and the kind of firewalls targeted.

Regardless whether this is the real deal (and whether more than just these firewall exploits are up for grabs), this, in my view highlights the main problems with seeing offensive hacking as as the best defence:

  • Backdoors and exploits are often single-use: using them as attacker is risky, as your target may be recording network traffic and recover the attack. This was also explicitly mentioned by Rob Joyce, the head of the NSA’s Tailored Access Operations (TAO) group, i.e. the NSA hackers whose toys are apparently now for sale. Or mishandling a spearfish and lose your nation state quality three 0-days on iOS to Apple, an expensive mistake as a full weaponised remote rooting of iOS is easily $100.000+ value.
    As an aside, their 2007 hardware toy catalogue leaked some time ago, a fun read for people like me.
  • Amusingly, the NSA actually does this eavesdropping to get other organizations’ offensive hacking tools. There are some convincing theories that this ‘leaked exploits sale’ is actually one of the other organisations (China and Russia have been mentioned) getting back at them.
  • Somewhere in these offensive organizations there is a weapons cache of these exploits, and it just takes is one disgruntled employee with access to it and the desire to leak it. After all, it is these hackers’ full-time job and passion to break in and out of highly secure environments, and they have all the tools for this. (This is the most likely explanation).
  • Once the attacks are out, others can also use it against you! The NSA has the story that “NObody But US” (NOBUS) can exploit these things, and use that as an argument not to inform the American companies whose products are at risk in this way. So now, Cisco (and other) firewall vendors are scrambling to make a bug fix (which takes a few days to weeks), and actually may impact other products too.
    Then the users of these firewalls have to actually deploy the bug fix (which they’ll be reluctant to do for reliability reasons, if the users even know that the bug fix exists, taking another few days to many months), and all the while savvy and assertive attackers can hack these firewalls at their leisure.

I still have this naive hope that these blowups will change policy for these organizations to lean to the defensive more. Realistically though, they’ll double down: both hide their exploit development better and come down even harder on leakers and whistleblowers.

And of course thus continues the arms race, making us all less secure in the long term for a short term gain. Sigh.

Your friendly professionally paranoid,

Wouter

P.S. this may of course just be a disinformation campaign or a fundraiser. One never knows… (until ±30-50 years later when the documents get declassified)