Posted on

Password Bliss

Ah, the blissful days on my first programming job. We had no passwords. A cipher lock on the employee entrance was enough security. Those days are as gone as last winter’s snow days in August.

Breaking into a password protected system is in the league with hot wiring a 1957 Buick.

I don’t know anyone who likes passwords. The best I can say for them is that they protect computer systems better than nothing and they are relatively easy to implement. The truth is that password protected systems are breached all the time. Passwords are better than no protection, but that’s all. Breaking into a password protected system is in the league with hot wiring a 1957 Buick.

The end of passwords has been predicted for decades and the computer industry is inching closer, but I don’t see the end of passwords in sight.

Why? Because the alternatives also have flaws and most have high implementation costs. There are no sudden changes on the horizon. Any transition away from passwords will be gradual. The most likely change is more and stiffer nudges toward multi-factor authentication, the two-step process that is already insisted upon in many high risk systems. Multi-factor authentication, systems that usually involve your cellphone or email, are annoying but much more difficult to hack than a password alone.

If we are stuck with passwords, we ought to follow practices that increase security and maximize ease of use for users. Fortunately, NIST, the division of the federal Department of Homeland Security that makes recommendations for password security, has noticed that the password policies that annoy users also encourage them to work around the rules, usually in unsafe ways. The most recent recommendations are actually easier to follow than the old rules.

The old rule was to change passwords frequently. That’s out. When people are forced to change their passwords frequently, they resort to common passwords that are easy to remember, use simple spelling variations to reuse passwords, or write them down in obvious places, all of which make password theft easier, not harder.

The old rule about password complexity (a mixture of letters, numbers, symbols, and upper and lower case) is also out. Password crackers know that “$” substitutes for “s” and zero substitutes of the letter “o” and all the rest. Short complex passwords are not much more difficult to crack than an uncommon but short all lowercase password. Passwords over twelve characters are difficult to crack. Planning and executing a trip to Jupiter probably consumes fewer resources than cracking a eighteen character password that is not a common phrase.

Therefore, a long nonsense phrase that sticks in your memory is a strong password, unless the phrase is commonly used. A phrase that gets zero hits on a Google search is very safe. When you have a strong password, DHS recommends that you stick with it unless it gets compromised in some way. That long password will make you a tough customer to break.

The rest of the new guidelines are rules for processing and storing passwords that apply to programmers, not end users.

But there is another catch: password spraying. Hackers know that people tend to use the same password on multiple accounts. As soon as a bad guy gets a password, he sprays (tries) it on all your accounts. Most passwords are not cracked; they are obtained by trickery. For example, a bogus phone call from a fake IT guy asks for your password and you give it to him without thinking. The hacker then tries the stolen password and a hundred variations on your bank account within seconds. In order to limit the damage from such a mistake, never reuse the same password or an easy variant on different accounts.

Unless you are prodigiously organized and blessed with the memory of a crossed mother elephant, password managers are the answer.

Just when you thought the new guidelines made your life easy, it all falls in when you consider the hundreds of accounts you probably have.

Unless you are prodigiously organized and blessed with the memory of a crossed mother elephant, password managers are the answer: One long, strong, and memorable password for a password manager that generates and stores random passwords for all your accounts. Although they are not perfect, most people are safer with a password manager.

Choosing a password managers are a subject for another post.

Posted on

Twitter Annoyances

I have lost all patience with Elon Musk. Up until last week, I could see some rationale and a ray of hope in his Twitter monkeyshines, but renaming Twitter blew away any lingering spell.

I’ve never been a Twitter fan. I have no quarrel with folks who enjoy an adrenaline and dopamine thrill during a hot online exchange, but dashing off few characters and blasting them out to the world does not excite me, nor do I much enjoy reading blurted tweets. However, scientists, journalists, and many others have all appreciated a decade of Twitter’s rapid and live flow of opinion and information. Twitter established its usefulness for many users.

Some folks like to toss spit wads at the Twitter wall to see what sticks. That’s fine too, but it points the way to the downside of Twitter. I’m too old not to have noticed that attention-seeking, greed, and choler is always present in this world. Given the way people are, some of those spit wads will be mean and treacherous fire balls. Some heat improves a dish, but too much ruins it.

If it were easy, or even possible, to distinguish good and bad posts like sorting sheep and goats, I could see that managing a platform like Twitter would be an interesting and satisfying job. But we all have good days and bad days. My notion of good is only to a rough approximation of yours. On most points, we will differ. Sometimes we will differ a lot.

Anyone who has tried to keep peace in a family, lead an elementary classroom, or push a project team toward a goal knows how mind-stretching and frustrating taming the discourse on a platform like Twitter must be.

Did pre-Musk Twitter meet that difficult challenge? Not especially well. They were in trouble with the European Union and the FTC. Both the right and the left accused them of bias.

As a service system management product developer who has seen outfits like Twitter both succeed and fail, up to the last few weeks, I didn’t think Musk did too badly.

Musk always struck me as a little too hot for everyday consumption, but Tesla and Starlink are undeniable accomplishments. Unfortunately, massive layoffs at Twitter made sense.

Twitter has all the marks of a company that has struggled and failed to address issues. Instead of fixing problems with solutions, Twitter took the last century MBA route and hired more staff, thinking held over from the era when a coal shortage could be solved by hiring more miners.

Technology does not work that way. Typically, adding more staff delays a technical project. Twitter appears to have added bodies instead of engineering and administrative discernment, and that led to a flailing technical organization. They desperately needed trimming. Musk’s judgement was correct. A massive layoff, however cruel and harsh, was the only choice.

I’ve gone through the process of trimming a bloated staff and know how hard it is, akin to a brain surgeon extracting a tumor, but instead of a scalpel, you are stuck with a sledgehammer and pickaxe. If the result of your effort is vaguely in the direction of your goal, you haven’t done so bad.

There’s no question that Musk paid far too much for Twitter. At first, I was willing to give him a pass on that. The world’s richest man can tap his bulging piggybank and survive. Wasting money is a gazillionaire’s prerogative. Accumulating vast wealth offers experience on how much extravagance one can bear. One would assume.

The last few weeks have been bad for Twitter. It appears to have fallen into a descending spiral. Stiffing critical suppliers like landlords and cloud providers has affected operations, which decreases revenues, which further curtails resources. This is the way corporations die.

Yet another nail in the coffin: rumor says some employees still cash in vesting stock options at Musk’s inflated price of $54 per share. That will end soon. I wonder if those employees will continue to work for Musk when that fountain of gold turns into trickle of dry sand?

I expected that naming an advertising executive as CEO would inject some reality into Musk’s advertiser management and stabilize revenues, but the last change, renaming Twitter to X looks like another round of playground gags instead of advertising management skill.

Which brings me to my point: I’m an old Unix hand. X, for me, is the X Windows system developed at MIT that was the foundation for distributed graphic interfaces. Graphic user interfaces (GUIs) opened computing to a wide swathe of users. Without GUIs, computers would be impossible for most people to use.

And now, venerable X has been permanently tied to Elon Musk driving his Twitter Tesla into a bridge abutment.

 

 

Posted on

Cyber War In Ukraine

I’ve added an update for May 9th below.

The hacktivist war against Russia has been dismissed as ineffective, but my own reading indicates that it is unprecedented and formidable. The final results are not yet visible, but something exciting is happening.

History

Russia has been a center of excellence for cybercrime since the dissolution of the Soviet Union in 1991 when the centrally planned and controlled Soviet economy shattered and became a kleptocracy. The accepted story is that trained software and computer engineers lost their jobs in the broken system. In desperation, they turned to cybercrime. The narrative goes on to say that the line between cybercrime and government sanctioned intelligence operations is vague in the former Soviet Union. Rumors abound that Russian cybercriminals have a free hand to demand ransom and steal data and cash in return for cooperation with Russian intelligence services. The truth of this narrative is hard to evaluate, but it’s the backdrop for the current cyber war in the Ukraine.

Scope

I went on alert for a major Russian cyber attack on February 24, 2022 when the war in Ukraine started. When I wake up in the morning on the Pacific Coast, it’s mid-afternoon in Moscow and Kyiv. The workday has barely started in New York. By the time I finish my first cup of coffee, I’ve checked for cyber attacks, assuring myself that the European and North American power grid is intact, European and U.S. oil refineries are not burning, and the international financial system is still functional.

The Ukraine war has brought many surprises. I, among many others, thought a precision blitzkrieg invasion would engulf and obliterate key targets bringing down the Ukraine in days. Ten weeks later, the Ukrainians have halted the assault on Kyiv, taken back territory, sunk a Russian naval flagship, killed several high-ranking Russian generals, and hit targets inside Russia. The damage to Ukraine is huge, but the Russian attack has faltered. We now know that the Russian army is not as war-ready as we thought.

The Russian cyber war is harder to measure. Microsoft has provided an extensive report on cyber attacks against Microsoft software in Ukraine. There have been attacks, but not the smoking mess I anticipated. The cyber war is not over and could still intensify, but it is not the dismal defeat of Ukraine that I expected.

What Happened?

I had not thought much about hacks against Russia until I read a piece in the Washington Post about the Ukraine IT Army recently. Russian computing culture is notoriously vicious. Prudent folks have shied away from hacking a such a formidable foe, but the Washington Post Article reports that since the Ukrainian invasion, more hacked Russian credentials have released on the open web than from any other country.

Usually, the U.S. is the helpless victim bleeding hacked data and Russia is presumed to be the biggest and ugliest culprit. The tables have turned. Russian businesses and institutions have been hacked and doxed— their credentials, private messages, and data have been accessed and published. Even pro-Putin Russian criminal hacking organizations are victims. If you’d like to peruse some stolen Russian data and creds from Russian residential electrical contractors, banks, the Ministry of Culture, the State Nuclear Energy Corporation, and tons more, look here. Russian cybersecurity is weak, not the impenetrable citadel we thought it was.

Some analysts downplay the significance of these attacks. I don’t, if only because they deflate the reputation of Russian cybersecurity.

Hacking Russia from Home

U.S. and European state actors, government agencies like the National Security Agency and the European Union Agency for Cybersecurity, are undoubtedly at work, but we probably won’t know their role until long after the war is over.

The great hack of Russia is a “working from home” operation.

Cyber war is not kinetic war. Launching kinetic weapons— missiles, bombers, tanks, and troops— is costly and requires large and well-established organizations at the right time and place.

But kids with smartphones can launch cyber attacks from anywhere, if they know how, and many of them do.

Professional cyber attacks use more sophisticated equipment and methods, but large organizations are not necessary and the equipment is not hard to get. Computer professionals with all the knowledge they need have adequate equipment and connections in their home offices. Nothing like the cash, trained experts, and on the ground presence required to launch a $200K Javelin missile or even a cheap $6K Switchblade drone.

For example, here is an interview with a group called AgainstTheWest. The group is secret and the assertions in the interview are unverified, but I find them plausible. They say their goal is to collect intelligence on threat actors (security jargon for instigators of risks with the capability to do harm) from Russia, Belarus, and North Korea. The group says they are five people who are certified information security professionals who work together. They have an impressive list of data on their targets that they have acquired. They say they work with various official agencies, but they are independent.

To support groups like these, the Ukrainian government has set up a Telegram list with information on potential hacking targets and the progress of the cyber war. The list has close to 280,000 members.

Impacts

The Ukrainian volunteer cyberwar is unprecedented and startling. I’ve feared a cyberwar for several years, but I anticipated a war between state actors like the U.S. Cyber Command leading the action, nothing like Ukraine’s leaderless foreign volunteer army, which is akin to guerilla warfare, but the partisans are far from the kinetic battle. Is the IT Army a spontaneous gush of altruistic support for democratic institutions? Or a destructive, undisciplined, and chaotic mob without a chain of command? Or some ungovernable mixture that will challenge order for decades to come?

We will see.

Update for May 9th

May 9th is a major holiday in Russia, commemorating the triumph of Russian troops over Nazi Germany in 1945. Both Russia and Ukraine celebrate that victory. The U.S. used to celebrate May 8 as VE Day (Victory in Europe Day) although it is no longer a national holiday. In Moscow, military parades and exhibitions of weaponry are May 9 staples.

Many experts were expecting trouble, perhaps a doubled down bombardment in eastern Ukraine or the long awaited Russian cyber attack on the West. I was up early, doom-scrolling for trouble. Nothing much happened. Reports say that the Moscow parades were, perhaps, a bit subdued but typical.

Putin attempted to connect attacking Ukraine with defeating Nazi Germany. The war in Ukraine was business-as-usual, but Russian social media platforms were hacked, according to the Washington Post. “The blood of thousands of Ukrainians and hundreds of murdered children is on your hands,” appeared on Russian television and computer screens. Internal propaganda convincing the Russian people that Putin is fighting a just war is critical if the Russian is ever to succeed. If today’s hack can be repeated and amplified, the hacktivists, whom I assume were behind the hack, will strike a powerful blow for the Ukraine.

Posted on

Stop Using Software Built in Russia

The war in Ukraine that broke out in late February 2022 forces me to tell you to shut down, uninstall, and replace any software built in Russia that is on any computer you control. I am not the only one saying this. The caution applies especially to anti-virus and malware utilities and Virtual Private Network (VPN) tools.

Anti-virus and malware tools must have access to everything on a computer and they are remotely updated almost every day, which makes them dangerous if they are subject to unscrupulous interference. Virtual Private Networks are used to make network traffic harder to snoop on and more secure. They can be dangerous because their manufacturer may have access to all your network traffic. Most apps only access their own network traffic.

If you are sympathetic to the plight of the Ukraine, getting rid of Russian software is a way to place your own economic sanction on the invaders. Giving up Russian vodka and caviar is another way.

If you don’t care about Ukraine, you have still have another critical reason to act.

You must understand that your computing systems depend on the honesty and integrity of the manufacturers of the software running on your computer. Vulnerabilities, security weaknesses, are discovered in software from reputable software houses all the time. Most of these are mistakes, but some are software features, functionality that makes us want to buy software. But some of these features give manufacturers extraordinary power over systems.

This is not all bad. Software design frequently trades off between security and efficiency or convenience. A classic book on software design, Design Patterns, describes building blocks for designing reusable software modules, including patterns for making data and processes accessible throughout a system. These accessibility building blocks make a system more efficient, but less secure because a tiny breach can open up an entire system. The security of well-designed systems depends on the integrity and care taken by their manufacturers to strike the right balance. A careless or unscrupulous manufacturer can release scandalously insecure applications that the market will lap up, until the disastrous insecurity is discovered and a crisis ensues.

For example, a password reset provision in an application is a great convenience, and nearly a requirement for any commercial product. Yet password reset is a gaping security hole when the wrong hands are able to invite unauthorized actors into a system by changing passwords. Remote access for support is another required feature for most systems that becomes a weapon when a criminal uses it to take over.

Backdoors—routes into an application known only to developers—used to be common. Backdoors are now considered extremely bad practice, but some developers still use them to save time during development. But the last few weeks before release are often the most hectic of the entire software development cycle. Unless management insists, removing backdoors can be neglected by busy developers working long hours. The software user’s only protection from secret backdoor access is the integrity and honesty of the software manufacturer.

This is why I continually tell folks to be careful about what they install on their computers. Only install apps from reputable vendors. Don’t just assume a vendor is reputable; actively check them out.

Some, perhaps most, Russian software companies are honest and do not intend to exploit their customers. However, all businesses operating in Russia are subject to coercion by their government. That’s the way business now works in that country. If the Russian government wants a backdoor into an application, they can compel a Russian company to put one in. Since the war in Ukraine started, the pressures can only have increased.

Doing business in Russia differs from business in western countries like the United States, Canada, and the European Union. Government and private abuses do occur here, but we have a free press, whistle blower protection, and a tradition of following laws that are scrutinized by the public and changed when enough people oppose them. Maybe not fast enough, often enough, or exactly the way each of us might agree with, but the public eventually is heard in western governments.

With the Ukraine war, public oversight and rule of law in Russia has disappeared. You may argue that it was never present, but your computer is still in jeopardy if you are running Russia-built software. Your home computer could conceivably become an instrument in a cyberattack on western or Ukrainian infrastructure. Compromised home computers have played roles in criminal attempts to shut down servers by overwhelming them with traffic.

I don’t like blacklists and I will not publish a Russia blacklist here. I urge everyone to add checking for Russian involvement as part of their due diligence for installing software on their computer. As much as I admire Chinese traditional culture, I have also added the People’s Republic of China to my due diligence list. North Korea goes without saying, but I’ve never seen a North Korean software product.

For example, Kaspersky Internet Security is a popular and powerful anti-virus tool. Run a Google Search on “Kaspersky Internet Security Russia” and see dozens of items on the dangers of Kaspersky. Wikipedia has a “Software companies of Russia” page. These provide useful hints.

Ultimately, in this age of misinformation, you have to rely on research and judgement.

I am a cautious person by nature and do a lot of research. Along with reading software reviews, I go to the website of software houses I suspect and check their corporate pages.

Is their stock publicly traded? I tend to be less suspicious of companies traded on the Nasdaq or New York stock exchanges. The Securities and Exchange Commission (SEC) and the Federal Trade Commission help keep them honest, although foreign investment is allowed. Privately held corporations and those on foreign exchanges get more scrutiny from me.

Where is their company headquarters? Where do their officers and members of their board of directors live? Where are their development labs? Most large software companies now have labs all over the world, but a company with most of their developers in Russia attracts my suspicion. Check their jobs listing. Where are they recruiting? What does the trade press say about the company?

Triangulate multiple sources. The fact-checker’s rule of thumb is that any point not supported by three independent sources requires more examination. Be extra cautious when a piece “just sounds right.” That may be your preconceived bias speaking to you, a frequent source of bad decisions.

When my suspicions are aroused, I must have a good reason to install or continue to use the company’s software on my systems.

Be careful, folks.

A note of thanks to my friend from the Whatcom County Library System, Neil McKay, for edits and useful comments.