Image via CrunchBase

Part of my job involves reading through a lot of documentation, especially if it is security related. I don’t usually come across many mistakes or gaffes, but when I do, 99% of the time they were written by someone at IBM. The following quotes are all taken from IBM’s AIX V6 Advanced Security Features [PDF] redbook.

AES, as standardized by NIST, is not exactly in the form the Rijndael was originally submitted. It has a fixed block size of 128 bits, and has key sizes of 128, 192, and 512 bits.

Whilst a 512 bit key size for AES might be more secure, the standard doesn’t support it. The key sizes are actually 128, 192, and 256 bits. This is a simple mistake to make, so it is more forgivable than the others.

SHA256 is the Secured Hash Algorithm with a 256-bit key.

I’m not sure what the author of this statement was thinking of when writing it. The ’256′ in SHA256 corresponds to the length of the output the hash generates (256 bits). It is possible that the author was confusing a cryptographic hash function like SHA256 with an HMAC, which does involve a key. However, even then the key size is not dictated by the hash function used in the HMAC. Indeed, any length of key can be used, the longer the better. Additionally, the ‘S’ in SHA stands for “Secure” not “Secured”, but that is just a small nitpick.

Typically the owner of the private key encrypts data with their private key, and the receiver or reader of the data decrypts with the public key.

This explanation of how public key cryptography works is completely backwards, quite literally. The public key can safely be known by anyone (hence the name), so it makes no sense to use it to decrypt data. The proper way to use public key cryptography is to encrypt using the public key, and decrypt using the private key. This means that anyone can send encrypted data, but only the private key owner can decrypt it. The other way around, there is practically no security gained by encrypting the data; you are no better off than sending it in plaintext.

The resulting ciphertext was, and still is, impossible to crack with a brute force attack.

This was found in a section discussing Triple DES, which whilst being far stronger than regular DES, is not “impossible” to crack with a brute-force attack. In fact, nothing is impossible to crack with a brute-force attack (apart from properly implemented one time pads), since brute-force attacks generate and test every possible key. Such an attack on Triple DES is unfeasible, since generating the keys and running the attack takes a very long time with current hardware.

Just over a week ago, the High Court in the UK ruled that ISPs in the country must block access to notorious file sharing site The Pirate Bay. Since that ruling, only Virgin Media has complied with the demand, and that resulted in their website getting taken offline after Anonymous targeted it with a DDoS attack. There are more serious problems for ISPs than hacktivist retaliation over the enforcement of this ruling though; blocking access to something on the Internet is very hard indeed.

DNS Filtering

When you type in the web address for The Pirate Bay (https://thepiratebay.se), the first thing your browser does is send a query to a DNS server to translate the domain name (thepiratebay.se) into an IP address (194.71.107.15). Without this vital step, your browser is unable to make any connections to The Pirate Bay at all, so one way to block access would be to have the DNS server respond with a fake or invalid IP address. All ISPs have their own DNS servers, and these are usually set as the default in home routers, so this is easy to do. However, this default can be overridden, sometimes on the router itself, but also on your home computer. To get around this type of block, you would simply have to tell your computer to get The Pirate Bay’s IP somewhere else.

IP Filtering

The other popular method for blocking content is to block connections to the IP addresses themselves. The ISP will collect all IP addresses that correspond to the site that needs to be blocked, and when connections to that IP are detected, they are either dropped, or routed somewhere else. In the case of Virgin Media’s block of The Pirate Bay, it seems that this is the method they are using, with all traffic destined for The Pirate Bay’s IPs being routed to Virgin Media’s servers instead.

The main problem with this type of filtering is that it also blocks any other websites that are hosted at the same IP address. This isn’t an issue with The Pirate Bay, who own and operate their own IP addresses and have dedicated servers, but could be if this type of blocking is widely used in the future. For instance, this blog is hosted on a dedicated server along with several other websites, one of which is my personal site (adrianhayter.com). If some ISP were to decide that cryptogasm.com needed to be blocked, and they blocked its IP address, then access to adrianhayter.com would also be blocked. That’s not good at all.

Although IP filtering is harder to get around than DNS filtering, it is still possible by using proxies.

Proxies

Proxy servers (proxies) are servers dotted around the Internet which allow you to forward requests and receive responses through them. As long as the proxy’s ISP isn’t blocking the content you seek, you will be able to access it. There are many proxy servers out there on the Internet, including ones that have been set up to directly counter the blocks on The Pirate Bay.

There are some problems with using proxies though; the main one being that they tend to be much slower than accessing the site normally. However, this is a small price to pay to avoid censorship. The good thing about proxies is that they can be based anywhere, and so blocking access to them becomes almost impossible, as new ones will emerge all the time. The one thing that ISPs can do to counter the use of proxies is to use deep packet scanning.

Deep Packet Scanning

When handling the packets of data that you have either sent or have requested, your ISP typically scans the headers in order to send them on to the correct locations. However, they do have the ability to scan the bodies of the packets as well, and with the right analysis could be able to detect whether the content inside came from The Pirate Bay. Luckily, this technique is easily mitigated by using HTTPS, which means that all data transmitted between yourself and The Pirate Bay (or the proxy) encrypted.

So, if you are using a proxy to gain access to The Pirate Bay, or another blocked website, make sure that the proxy itself supports HTTPS (usually denoted by a padlock or green tick in your address bar). The two proxies I listed above both support it, so they should be fine to use.

Solving Piracy

Don’t get me wrong, I don’t condone piracy, but I also don’t think the solution to it lies with blocking good websites (The Pirate Bay has a lot of legal content, as do other torrenting sites). In my opinion, the main reason people pirate things is because it is easy to do so. People do not mind paying for things, but they want to pay for things on their terms, which is why services like Spotify and Netflix are so popular.

The solution to piracy is for the copyright owners to embrace change, and to start services of their own, which allow their customers to buy a single song rather than the entire album, or a few episodes of their favourite TV show and not the box set. This popular cartoon by The Oatmeal lays the argument out quite neatly.

Update (25/5/2012): The Pirate Bay recently announced a new IP address which they can be reached at: 194.71.107.80.

I found this video today featuring Dr Yan Wong from the BBC. Whilst it is very short, the video does provide a nice simple introduction to some of the ideas behind public key cryptography, which secures most of e-commerce on the web. Definitely worth a watch if you don’t want to get into the messy details.

However, if you do want to get into the messy details of public key cryptography, I suggest perusing the Wikipedia article on the subject.

Yesterday I attended Infosecurity Europe 2012 and had a brilliant time. This was my first time going, but it will hopefully be the first of many. During the day I saw quite a few exhibits, talked with (and grilled) a few people about security, and of course grabbed as many freebies as possible.

The highlight of the day for me was meeting Bruce Schneier and getting a signed copy of his new book Liars & Outliers, which I look forward to reading and possibly reviewing on this blog.

I also met up with a couple of people from WhiteHat Security to talk about their business and what new things they were doing in the industry. They were very interested in my blog, and hopefully in the future we may share content, as they are looking to include guest writers on their own blog (which I highly recommend).

Infosecurity Europe is definitely a great place to go if you want to meet up with interesting people and stay on top of advancements in the industry, so be sure to mark it in your diaries for next year!

These are just a few quick updates to explain what I am doing with the blog.

Firstly,  regular readers may notice that I have a new blog banner image, which was kindly designed for me by a friend who wishes to remain anonymous for now. I think it looks a lot better than the old styled header, and it makes the template I’m using a bit more unique.

Secondly, I’m going to change the format of the blog somewhat. Until now, I’ve mostly focused on long detailed articles, from explaining security concepts, to creating lists of recommended browser add-ons, to even attempting to refute academics and professionals. The problem is that these articles take a lot of time to research and write, and my free time for doing them is limited by both my work and my university studies.

On the other hand, I subscribe to a lot of security feeds and mailing lists, and will occasionally tweet about various things that I come across. So I’ve decided to adapt this habit, and instead of just tweeting about something, I will give it a short write-up on this blog. Sometimes I may just put a link and a short comment, other times I may write a couple of paragraphs. Whatever I do, you’ll still get to read some good content that you may have missed elsewhere on the web. I tried a similar thing back in January and February with “Cryptogasm Quickies”, but instead of doing a single post with multiple items, you’ll get a post per item.

This isn’t to say that I will never write in-depth articles again; on the contrary, I have a few that I am working on, but instead of the blog feeling inactive for days (and sometimes weeks) on end whilst I work on them, I will provide small amounts of content to keep you all up to date with various pieces of security news and views.

Thirdly and finally (and nothing to do with the blog), I am attending the Infosecurity Europe 2012 convention on Wednesday 25th April. If anyone else is going, let me know via twitter and perhaps we can meet up for a drink.