NSA and Cryptography Attacks

There have been a few excellent articles on the NSA "breaking encryption", as reported in The Guardian and New York Times. In the talk 2 weeks ago Vint Cerf commented that we should use stronger keys - but as per the articles, key length may not be the issue at all. To summarise there are a few ways encryption can be broken:

1. Brute force the keys
2. Bugs in the software/hardware implementation
3. Bugs in the algorithm
4. Interception before encryption (in the case of network encryption specifically)
5. Steal the key

For point 1,  I think the maths of brute forcing the keys still hold out, we may be close - but I don't think we are there yet. But still, the advice of stronger keys always helps.

For point 2, there have been bugs in encryption libraries before and there are potentially still bugs in these libraries. Both Bruce Shneier and Matthew Green comment on the possibility that there are bugs in the Microsoft crypto library (which is closed source) and even Open SSL. Another possible attack vector, as noted by Ed Felten, is buggy components that make up crypto components, such as bad random number generators - which can then lead to weak keys etc. Faulty hardware (including deliberate backdoors) is also a possibility explored by Ed Felten.

For point 3, in most cases the maths in encryption algorithms seem to be right, and strong. But there have been cases were crypto algorithms have been broken (sometimes after years in operation) and cases where weak algorithms have been submitted for consideration in standards. I think most of the modern algorithms, such as AES are strong - but perhaps there are flaws that just haven't been published.

Point 4 raises an interesting attack vector, which I have seen being carried out by pentesters - basically a proxy service where a network call is intercepted at the initiation of a network session, and then network encryption is easily eavesdropped by the middle party. If the NSA is intercepting huge amount of traffic, it is possible to create such an attack - but automating this in a large scale is surely difficult?

The last point, of stealing keys - or rather forcing companies to hand over their keys under Prism is probably the easiest way for the NSA. There is some commentary on the possibility that the NSA had access to compromised keys at certificate authorities - which would assist this type.

Overall, I don't think there has been fundamental break in cryptography - but there has certainly been weak implementations followed by exploitation by the NSA.

 

The best form of defence is active defence

Over the past couple of years, Dave and I have had numerous discussions on various legal concepts around IT. As a noted privacy expert, and a IT professor at UNISA, the topics have been varied, and often straying to the esoteric.

Over the weekend, Dave and I recorded a podcast with Tony Olivier for the DiscussIT Pubcast on IT Security, covering the concept of active defence/hacking back. Dave and I previously presented the topic at a closed forum? And thought it would make it interesting to make it available to a wider audience. Tony is an excellent host, and managed to steer the discussion to additional points we had previously not covered. The podcast is a bit rough - it picks up a bit of the ambient noise, and is mostly unedited so all the umms and stutters are included for special effect :)

Car Guard Insights

When M & I got to my car after lunch at 44 Stanley, we noticed that the car behind us was parked funny; which I commented to the car guard. To that he replied, that the driver ran out of petrol, and thus had to park it as best as he could. 

But it was the ensuing short conversation, that made me think. The guard proceeded to comment  - "Us black brothers just don't seem to plan ahead - after all the petrol station is just there" (pointing to the other end of Stanley road). "He and another guy went to get petrol some time ago - no idea where they are".

"Have you heard about our president and his fight with the media" (pronounced as Med-ia) he continued - "and it's not the media's fault that they are talking about bad things. If Zuma had done good things, they would be talking about good things; instead he fights the media".

Auckland Park is the centre of two of SA's biggest media organisations - SABC and Media24 - so the comment is not completely out of place. But what made me think is, that even the ANC's traditional supporters - such as the car guard - are not accepting the spin. The question is, as with service delivery protests, are the disaffected going to vote for opposition; or are they just going to not bother voting. 

Interesting times ...

Movie: The Mortal Instruments: City of Bones

M wanted to watch the movie based on the trailer - neither of us had read the books, nor did we expect much. Based on a similar premise as Harry Porter and the excellent Night Watch series - there is a hidden world where the supernatural exists, and similar to Night Watch, this is constant fight between good and evil. 

In this particular series, the good is represented by Shadow Hunters (assisted by werewolves), while the evil is represented by demons (with vampires and a few others). The shadow hunters are constantly hunting demons - thought their ranks are small and dwindling further; and the main plot in the movie revolves around internal conflicts within the shadow hunters; with a character similar to that of Voldemort in Harry Potter.

The movie starts of promisingly; but devolves into cliches, predictability, and illogical plot development. It is visually great, with ok acting, but is not really as compelling a story as Harry Potter or as complex as Night Watch. It's a fun movie - just not a stimulating one; and I doubt I will watch any other future adaptations.

Movie: Elysium

Elysium is effectively set in a world where the current economic and political policies are taken to their extreme, logical conclusion. A world where there is an effective two-class economy - the very rich, and everyone else (extrapolation of the current discrepancies in countries such as South Africa, Brazil and India), where immigration of the poor is controlled with a degree of viciousness (Australia's new immigration policies?), where even basic health care is difficult to get (almost everywhere except Europe), dependence on warlords for safety and security (Hamas in Palestine, Somalia?), over-population leading to vast slums (India, Brazil, South Africa) and a scenario of factories working off effectively slave labour (China). It is a dystopian future that has been on screen and books before - but I just don't think it has been shown in such extreme brutality.

In this setting, the story of Max (Matt Damon) who inadvertently starts a fight against the system is compelling, but ultimately looses out of steam about 70% of the way in - but by then the movie needs to finish a story, and not provide a philosophical parable. Perhaps the most telling point is that ultimately, in the future, it is the android robots that are more humane than the humans.

It is visually stunning, backed up with some great acting - especially by Sharlto Copley as the renegade mercenary Kruger. It is definitely worth watching, on a big screen.

Buskaid 2013

It was yet another sold out event for the annual Buskaid concert at Linder Auditorium last night; which presented yet again an eclectic compilation of music; most of which has probably not been presented on South African stages before. Two pieces also featured German musician Uwe Grosser playing the chitarrone; a strange plucking instrument descendant from the lute - probably another first in South Africa. 

The classical ensemble pieces included selections from Rameau's Suite from Les Indes Galantes, Vivaldi's Ercole su'l Termodonte: Simfonia and selections from Johannes Brahms' Liebeslieder Walzer. Of the three, the Vivaldi piece was the closest to a standard symphonic piece; while the others are shorter works which were often meant to be accompanied by dances (in the case of Rameau) or singing (in the case of the Brahms). Perhaps, for future concerts it would be worthwhile for Buskaid to consider such accompaniments - as it would certainly make the concerts a richer experience.

There seemed to be fewer individual pieces (i.e. featuring soloists), but they were certainly the highlights of the evening for me. Recent graduates from the Royal Academy of Music in London - Kabelo Monnathabe and Tiisetso Mashishi played the first two solo pieces - Nigel Hess' Theme from Ladies in Lavendar (from movie of the same name) and John Woolrich's Ulysses Awakes. Of these two, Ulysses Awakes was the surprising piece - a very somber moving piece for the viola.

The highlight piece was certainly Simiso Radebe (also a current student at the Royal Academy of Music) performing Jenő Hubay's Hejre Kati. In previous concerts, Simiso has often performed the virtuoso violin pieces, and this concert was no difference - this was the flashy piece, showcasing a wide range of what the violin can perform, and Simiso delivered a brilliant performance.

As per other Buskaid performances, the concert ended with a selection of kwela pieces; after a vocal solo piece - Hoagy Carmichael's Lazybones. The kwela pieces were new arrangements, and both the vocal pieces and the kwela pieces differentiate the Buskaid concerts from run of the mill classical concerts with more energy and fun - for both the performers and the audience. 

It was once again, a brilliant Buskaid concert and a great showcase of musical talent. Buskaid is a great initiative that deserves more support and has the potential to be a cultural institution for South Africa.

Vinton Cerf and Re-Imagining the Internet in the 21st Century

WITS Vice Chancellor, Prof. Adam  Habib opened the proceedings of the 62^nd Bernard Price Memorial Lecture, with reflections on Dr Bernard Price - a notable engineer and scientist who straddled a number of scientific disciplines and also had significant input into the development of South Africa's electrical infrastructure. In that sense, Prof. Habib concluded that, Vinton Cerf was similar; as someone who has straddled the development in science, most notably in the sphere of Internet protocols; but has also had a profound impact on the development of the world through his contributions.

 Vinton Cerf's talk definitely paid homage to that theme; where he charted the development of the Internet, from the initiation of ARPANET itself, all the way to the modern Internet of things, and inter-planetary Internet. His insights into the development of ARPANET itself was interesting - from the considerations that were needed for satellite and radio inter-connectivity, and to more humourous commentary on how the address-space allocation in IP was derived.

He covered some of the coming challenges of the Internet including privacy concerns (something, he believes will only be addressed through trial and error), the promise of Google glass (which will go on sale next year, apparently) and the policy battle for the control of the Internet. 

It is the first time, I have heard a clear and succinct explanation on why ICANN is better than the ITU - ICANN is a multi-stakeholder body that includes corporations, private persons and governments; whereas ITU is purely a government organisation. Thus, ICANN, being more participatory is more likely to uphold the tenets of the Internet, as opposed to ITU which may make it a political football. He did think that ICANN requires more government engagement, especially with regards to cross-border disputes and crimes - but ultimately it should be run without political interference.

He finished with commentary on the challenges of inter-planetary Internet. I had not considered the challenges to be that difficult, beyond the physical constraints - and the actual deployment of relay points via orbiters, probes etc. is something fairly logical IMO. However, when he threw the discussion to inter-stellar Internet, and the challenges posed by the bending of light via gravity, it did make the challenges far more interesting - although the approach was seemingly still similar.

Vint Cerf is an amazing speaker, and it was a great memorial lecture by one of the great scientists of today. You can see the full video on YouTube, though apparently the slides aren't shown.

Mass Hysteria

At over 3 hours, with 8 stand-up comedians, and ticket prices for only R180, Mass Hysteria was definitely one of the best value-for-money shows I have been to in the recent past. And when you consider the line-up, it was an absolute bargain. Themed around government minister (each comedian was a minster of something), it was a brilliant showcase of South African comedy touching all the usual points - race, sex, money, love, politics and general South African life.

The young, Mpho Pops (Minister of Da Youth), started of proceedings with one of the best routines of the evening - with some of the best jokes centred around the early integration of race in Model C schools, and township life. After Mpho, Joey Rashdien (Minister of Religion) was quite flat; and I think was the weakest set of the evening. Ndumiso Lindi (Roosta in Chief) continued the cultural focus, starting with the requirement of jackets for a traditional Xhosa gathering and ending with the complexities of kids with multi-racial friends. 

The best act of the evening was definitely John Vlismas (Minister of Offence, naturally); who did not care much about the line that can't be crossed in comedy. He announced that he was a vegetarian (and still a leather pants wearing hypocrite), took real exception to Gautengers' opposition to e-tolls after they were built (and not protesting during construction) and ended his set on why most miracles are actually rather mundane and not very fortunate in the first place. 

Despite attending many comedy shows over the past 10 plus years, I had not attended a live show featuring the soft spoken, and colourful Casper de Vries (Minister of Mini-series, Internet and other media). His take on the ANN7 bloopers while comparing it to early years of SABC was impressive, as was his various takes on TV shows. 

I have seen Conrad Koch and Chester Missing a few times in the past few months; and sadly there was no new material. While still a laugh, it just wasn't as impressive the first few times. Nik Rabinowitz, the Xhosa Jew (or is it the other way round?) used his multi-lingual skills to great effect - though for whatever reason, I didn't find his performance very memorable. For the final act, Tumi Morake (Minister of Women, Disabilities, Midgets, Aliens etc) showed Miley Cyrus how to twerk, explained the different interpretations of "getting a Brazilian" and explored the impact of non functioning contraceptives. 

It was a long show, and definitely one of the best comedy shows I have been to. Hoping that there are future iterations - with new content off course!

Amazing Biography of Marissa Mayer

It's not often that new media does really in-depth investigative style articles. Business Insider was probably the last place I would have seen such an article - often they just summarise and link to the story. Instead, the unauthorised biography of Marissa Mayer is well written, with sources to boot; and gives some interesting insight to one of the most powerful tech leaders. It's well worth a read!

Cirque de la Symphonie

After a few acts, the conductor of the evening, Theodore Kuchar, turned to the audience to say a few words - most of which were difficult to hear, given that he spoke without a microphone. The gist, I gathered, was that about 7 years ago, he was approached to create a spectacle combining circus acts and a Symphony orchestra playing classical music. He didn't think it would work, but was proven wrong, as orchestras that took on the concept had sell-out shows; and became a vital way to bolster orchestra's finances. And thus, Cirque de la Symphonie, came to become a global touring phenomenon featuring local orchestras. Last night, it was the turn of the Johannesburg Philharmonic Orchestra to host the show at the Teatro, followed by Cape Town next week.

The circus acts feature a combination of acrobatics, a clown juggler and a short magic skit - and some of the acrobatics were spectacular - especially the last act featuring two bronzed men, doing some gymnastics requiring impressive amount of strength, coordination and balance. The accompanying musical pieces were all popular pieces (although I couldn't name them all - and the lack of a program was disappointing in this regard).

Although the event was billed as a combination of circus and orchestra; in most cases it was the circus acts that took precedence in terms of applause and appreciation. But a full house, featuring an audience that was most unlike a regular JPO concert, did support Theodore Kuchar's statement that this was a great means to get new audiences. 

And it is in that regard that the JPO missed an important opportunity to do some simple market research. I would have been most interested in asking the audience some of the following questions:

• Did the audience members know that there was a JPO?
• Did the audience members know when the JPO concerts were?
• Were they more interested in the music or the circus acts?
• Were they more likely to go to a pure musical event?
• What type of music were they more likely to want to hear?
• What day of the week would they more likely want to attend a concert?
• Where would it be a more convinient place to attend a concert?

 I think it is the latter questions that are necessary to be answered before the JPO can truly become sustainable. A show like Cirque de la Symphonie suggests that there are people, of all ages, who would attend a musical concert featuring classical music. And that there is a market for classical music - but without actually tapping this market the JPO is bound to remain in the current financial quagmire.

Beethoven Flash Mob

Partly an advertising campaign, but still a very cool flashmob; where a lone musician (double bass) introduces the choral part of Beethoven's 9^th Symphony, and slowly an entire orchestra and choir joins in. The expression of the crowd, especially the kids, is fun to watch.

Odd Spam Mail

I usually go through my spam folder to check for incorrect identification; and once in a while I come across really weird emails. Weird in that, there is no obvious phishing attempt, attempt at selling me something or just plain malware. 

A few days ago, I came across this one - allegedly from the United Nations, looking for potential employees. At best it would be a CV harvest, which I suppose could be used for identity theft - but given the proliferation of job sites, this seems to be a strange way to harvest CVs. There are no attachments, and apart from being sent from a non UN email address (sent from a university in Bangladesh - possibly from a botnet); there isn't much going for this. Still rather strange ...

The Human Resources!

The United Nations Secretariat is looking for competent and motivated persons in all
fields of human studies and career, with a strong belief in its purpose and mandates,
who are willing to dedicate themselves to a rewarding international career in different
locations around the world.  The United Nations provides an opportunity to serve in a
dynamic, multicultural environment in a variety of jobs in the support of global
causes.

United Nations staff uphold the principles and core values of the Organization,
including integrity, professionalism, efficiency and respect for diversity.  The United
Nations welcomes applications from nationals of all Member States and strongly
encourages women to apply. Applicants with disabilities are considered by the United
Nations for employment under all types of contracts in full compliance with the United
Nations Charter. The United Nations offers a variety of ways to join its workforce. It
also offers university students opportunities to serve as interns.

We want people with integrity from all works of life. People who are fair, impartial,
honest and truthful. We want dynamic and adaptable persons who are not afraid to think
creatively, to be proactive, flexible and responsive. If you think you embody these
values then this is the place for you and your career. The UN Jobs is open to all
varieties of your human careers, so anyone can apply, but not anyone will be selected!
Applicants with satisfactory requirement as outlined in their curriculum Vitae will be
contacted directly by the relevant divisions for deployment.

In Global Service!

Mr. Steiner Cobla
Executive Director: United Nations Employment Unit
Email: dfid@careceo.com
Phone/fax: +44-7010-051-797
+44-703-187-7882

Movie: Of Good Report

Already famous for being banned, and then unbanned; the local movie definitely has an uncomfortable storyline. Parker Sithole, a quiet (save for laughing, grunting and screaming - he doesn't speak a word), but apparently quite bright and well qualified English teacher, inadvertently starts an affair with a young schoolgirl. Initially, the story has a generous portrayal of his good side - be it his shock when he finds the truth about his sexual partner's age, or his caring of his sickly grandmother. But as the story continues, it becomes increasingly darker and more sinister - concluding in some very violent murders.

The performances are amazing - from every key member of the cast. Mothusi Magano's performance as the silent protagonist is particularly impressive; and is well supported by the rest of the cast members. Stylistically, a modern movie filmed entirely in black in white provides an interesting set of contrasts; especially when the blood starts flowing. The bleakness, in some respects, is also a commentary on the subject matter - the pervasiveness of sexual predators and violence in SA; the education system; the family constructs headed up by grandmothers; the lack of decent living conditions and the criminal justice system.

It's a modern South African movie, warts and everything - a drama that does not have throwback to apartheid or racial politics. It is a clever story; where the lead character manages to communicate a lot, without saying anything; and certainly worthy of the attention it has received. And it is not a pornographic movie condoning or promoting child pornography that should have been banned.

JPO's Tchaikovsky Celebration

After almost a year of financial turmoil, the JPO did get new funding from the Lotteries board, which has allowed it to get back on its feet. The funding does not solve the JPO's debt problem - but at least it gives an opportunity to get back to a functioning organisation. 

Given the time of the year, the JPO has sensibly decided to put on a proper symphony season in October. In the meantime, there are a few one off shows - with the Tchaikovsky Celebration being one of them; and the only one that just features the JPO. 

The program started with Capriccio Italien, which is described in the program as ".. the Russian has written us a postcard from Italy". It is a fairly long piece - more of a letter than a postcard - with quite a few easily identifiable Italian themes, but still a piece that one could identify as being a  Tchaikovsky piece.

Pallavi Mahidhara returned to play with the JPO once again, this time Piano Concerto 1, one of my favourites.  It is quite interesting (and sometimes amusing) to see how different soloists behave during the orchestral only parts of the performances. Some stare into the crowd, some into their instrument - but Pallavi is one of the rare soloists I have seen that just close their eyes and sway to the music; as if playing along with the orchestra in their heads - and seemingly just in time, open their eyes, nod at the conductor and carry on!

The Romeo and Juliet Fantasy Overture after the break, felt too long for an overture - and more of a summary of the whole story instead of an opening introduction to the story. It seems from Wikipedia, that it is supposed to cover the whole play - but it did feel weird when listening to it - to go from peace, to fun, to sadness and finally the dramatic end - but at the same time, unlike many other pieces, it did capture the essence of the story so well.

The 1812 Overture, finished off the evening. It is a very popular piece, and this is the first time I have heard it live. It is famous for its boisterous ending, but it is great piece throughout; and was superbly timed and played by the orchestra and conductor Robert Maxym.

All in all, one of the most enjoyable JPO concerts I have been to.

Movie: The Wolverine

I had gone to see The Wolverine, thoroughly expecting a bad movie - and was pleasantly surprised. The movie features the usual superhero movie requirements - a reluctant hero with "issues", the beautiful lady that requires protection, the sidekick who pitches up in time, betrayal, twists on who the villain is, and off course amazing fight sequences. 

The storyline hangs together (most of the time at least), and Hugh Jackman's acting as the lone, reluctant superhero is superb. It was a thoroughly enjoyable movie, and far better than I expected - even if it is due to low expectations in the first place.

Movie: Pacific Rim

Visually, Pacific Rim is absolutely amazing. But the 3D movie, has very one dimensional plot, character development, acting, script, dialogue, and almost every other aspect of movie making. All the comments in support talk about the fact that this is supposed to be a movie about monsters vs robots - but that does not make it a movie. If the purpose was simply to showcase fights between large monsters and large robots, in different settings - shorts would have been far more effective.

In fact, almost every morsel of good ideas that could have made this a great movie was seemingly spurned. The backstory of why the monsters want to attack earth - a short snippet by perhaps the most irritating character on any super-hero movie - and then left to rot. The back story on why building a wall is a better way - never explored. The political machinations on the closure of the giant robot fighting apparatus - mostly ignored. Instead, what you have left with is substandard acting, really horrible scripts and plot holes larger than the monsters and robots that are the subject matter.

Ultimately this is a disaster movie, and has the expected ending of the saving of the human race. It played a lot like Armageddon (so much so, I think there are direct parallels that can be drawn between the various characters) - less the brilliant sound track. Armageddon was just far better.

Great Phishing Email (target - Standard Bank)

I love great phishing emails - the ones where the phishers have made the effort to make the email look legitimate. Earlier this week, I got this one from Standard Bank - an email that actually strikes the right notes in many ways. In fact, it is very difficult to state that it is illegitimate, and I doubt most normal users would be able to spot it as a phishing email.

Firstly, I am ex-customer - so asking details for further screening is not a "bad" message. The grammar, the notes on the opening times of the customer contact centre, the disclaimers are all perfect. I did open the HTML attachment, but not on a browser - and even the stylesheets are perfect (using a legitimate Standard Bank stylesheet). They even have the right anti-phishing messages

"Important security alert! Standard Bank will never ask you to access internet banking through a link in an email. Don't fall victim to fraud!"

And lastly, all the HTML code seems to point to Standard Bank website - unless a domain itself is compromised, I couldn't spot an incorrect domain. But perhaps, I didn't look hard enough.

So, why do I think it is a phishing email?

1. The attachment asks for your ATM pin and Internet Banking password (to be reset)
2. Asks for "Zip Code"
3. Asks for other personal data, such as ID numbers
4. Asks for email password
5. And lastly, the email headers give it away

Received: from exchange.szlonghao.com ([113.98.251.13])
        by mx.google.com with ESMTPS id q66si27264684yhl.395.2013.07.29.03. 

48.06
        for 
        (version=TLSv1 cipher=RC4-SHA bits=128/128);
        Mon, 29 Jul 2013 03:48:47 -0700 (PDT)
Received-SPF: softfail (google.com: domain of transitioning 

ibsupport@standardbank.co.za does not designate 113.98.251.13 as permitted 

sender) client-ip=113.98.251.13;

Happy End

This is the first crowdsourced initiative that I have backed, and got all the rewards. A 96 page hardcover photo book, covering remote plane crashes where all on board survived. Some of the stories of the miraculous landings are impressive - the photos of crahsed planes, where nature has reclaimed them, even more so. His website has many more abandoned initiatives - the Olympic Spirit covering abandoned Olympic games venues is particularly poignant - especially the ones covering Athens.

Turbine Art Fair

Set in Johannesburg's iconic Turbine Hall, the 1^st Turbine Art Fair, was a show case of young artists and gallery art in a single location. There was a wide variety of art, most for sale - and probably the best way to see a wide variety in a single location. A very nice way to spend an afternoon in the city ...

Big Top Burlesque

According to the Wikipedia article, Burlesque is a musical or theatrical parody, although it later morphed into more of a variety show, and in American settings, with a tilt towards featuring strip-tease. I have been to two burlesque shows before - and both featured a significant amount of parody - mostly with sexual innuendo. 

Big Top Burlesque is a South African production, featuring an amazing singer (singing a variety of pop hits), and dancers effectively exhibiting wares from one of the sponsors - Lola Montez. That is not to say that the show was bad - the individual performances were actually quite good, including a great acrobatic show. But, I don't really think it should be called burlesque ...

However the disappointment was not the show - but the food. One of the selling points of the show, is the 3 course meal from the restaurant The Blue Feather, on whose grounds the show takes place. Considering that the restaurant features a R500 per person tasting-menu one would have thought that the food would be of the quality of a fine dining restaurant. Instead, it was, at best, the same quality as a chain restaurant at a shopping mall (and I am not referring to Tashas) - hardly the advertisement for a fine dining venue.

Individually the components of the show were not bad - but the overall package just didn't live up to the billing, and I wouldn't really call it value for money.