Ride The Lightning

OF MD5 COLLISIONS AND TRAIN WHISTLES

Why train whistles? Today we had two “firsts” on the lecture circuit.

We were in Winchester, Virginia – a charming place, home to the annual Apple Blossom Festival, and a warm, wonderful audience. This was the first time we have ever given a CLE presentation in a “brew pub.” Super idea, except that there was nary a sip of suds to quench the thirst of the presenters. Sad to say, the bar was scheduled to open for the afternoon session. We had the singular disadvantage of being booked for the morning session. Timing is everything.

Greatly to our amusement, we were right beside the train tracks. As a result, we were intermittently forced to shout over the blast of the train whistles. As you can see, the lecture circuit is a series of novel adventures. . .

And on to MD5 collisions – in a previous post, I mentioned that all MD5 collisions which have thus far been documented have been “forced” and have not occurred in the wild. A reader wrote with a follow up question – and I must apologize because I seem to have “misfiled” (never say lost) his e-mail, so I cannot tip my hat and thank him by name.

To answer his question, the likelihood of two naturally occurring differing files having identical MD5 hash values has been calculated by experts to be 340 billion, billion, billion, billion. In short, you are not likely to ever see it. Just for grins, the exact number is 340,282,366,920,938,463,463,374,607,431,768,211,456.

You could be struck by lightning and win the lottery many times over before you would see this in real life.

To my reader who asked, I dimly recall a second question being in your note. If you should see this post, please ask the second question again and I, for my part, will try not to “misfile” it a second time.

E-mail: snelson@senseient.com    Phone: 703-359-0700

CRIME AND PUNISHMENT: PALIN'S HACKER CHARGED

It has just been reported that David Kernell (20), of Knoxville, TN has been charged with accessing Governor’s Palin’s Yahoo! e-mail account without authority. See my previous blog post for details of the hack. Kernell is an economics student at the University of Tennessee. I’m sure he now wishes he had been studying rather than trying to engineer his way into Palin’s account.

He pled not guilty. The court released him without bail, but forbid him to own a computer and restricted his Internet use to checking his e-mail and class work.

Kernell's father is longtime state Rep. Mike Kernell of Memphis, chairman of Tennessee's House Government Operations Committee and a Democrat. David Kernell was indicted Tuesday by a federal grand jury in Knoxville and faces a maximum of five years in prison, a $250,000 fine and three years of supervised release. Trial is set for Dec. 16th.

As I tell my precociously bright daughters, no one is as bright as they think they are when they set out to commit an electronic crime. In spite of the old comic adage, sometimes on the Internet, they do know when you’re a dog.

Hat tip to Debbie Knapp for sounding the alarm on this one.

E-mail: snelson@senseient.com        Phone: 703-359-0700

COMPARING APPLES AND ORANGES: THE COST OF E-DISCOVERY

The price of e-discovery is making law firms and their clients crazy. Everyone bemoans not only the high costs, but the unpredictability of the costs. Orange Legal Technologies is not the first EDD company to try to come up with a cost estimator (Sensei also has one, albeit in simplified form). However, one member of the Orange team is my friend Rob Robinson, whose work I’ve had great respect for. And the upcoming webinar features another friend and fellow lecturer whose advice I find valuable, Tom O’Connor.

So . . . although I don’t usually mention specific webinars, you might want to check out this one. Rob was kind enough to send me a beta version of the estimator. I took a look, pumped in some real case data, and frankly still found it quite expensive. Mind you, the comparison between Orange and other companies is a sales tool. Though I admire the effort to provide a true estimator, I am always wary of comparisons.

I am most curious to hear what readers might think after attending this seminar. Should you choose to write me afterwards, please disclose any affiliations with the EDD world that you may have. That way I can genuinely compare apples to apples, or oranges to oranges – pick the fruit of your choice.

The free webinar is on October 23rd, 2008, 12:00pm - 1:00pm CST (1:00pm EST, 10:00am PST). You may register here.

E-mail: snelson@senseient.com   Phone: 703-359-0700

MD5 COLLISIONS – ARE THEY REAL? A PRACTICAL THREAT?

There seems to be a lot of confusion over the validity and use of MD5 hashes, especially as it relates to electronic discovery. In a previous post, I mentioned that identical files will have the same hash value. What about the reverse? Can a single MD5 hash value represent two different files? The scientific answer is yes.

In March 2005, Xiaoyun Wang and Hongbo Yu of Shandong University in China published an article in which they describe an algorithm that can find two different sequences of 128 bytes with the same MD5 hash. This is commonly termed an MD5 collision in the computer forensics field. Does this negate the usage of MD5 hash values as an authenticity mechanism? Certainly not. There have been several examples of different files having the same MD5 values. Generally, these examples are just a grouping of electronically stored information that have no useful purpose other than proving that an MD5 collision is possible. These sample files are contrived in order to prove the point. Since the original discovery, several enterprising individuals have actually created usable files to demonstrate the collision. As an example, there are samples of two different PDF files (with the same MD5 hash value) that have different contents. All of these collision examples use the same 128 bit technique used by Xiaoyun Wang and Hongbo Yu.

There has yet to be a documented case in real life where two “naturally occurring” files of different contents have the same MD5 hash. All of the samples so far have been forced demos. Don’t throw away the MD5 hash as a validation mechanism just yet. Understand what the MD5 can and can’t show. You’ll certainly want your expert to be able to explain an MD5 collision.  If your expert tells you it can never happen, it’s probably time to look for another expert.

Hat tip to Don Lewis, a forensic computer analyst from the Lakewood Police Department in Colorado, for suggesting the post.

E-mail: snelson@senseient.   Phone: 703-359-0700

HE’S BAAACK! MITNICK DETAINED BY FEDS

On September 16th, former famed hacker and social engineer Kevin Mitnick was detained by customs agents in Atlanta after returning from a trip to Columbia. Since his release from prison eight years ago, Kevin has been squeaky clean, but for a few parking tickets and driving without a front license plate.

You know you’re in trouble when the customs agent swipes your passport, turns to you smiling, and says "Kevin, guess what? There are some people downstairs who want to have a word with you, but don't worry. Everything will be OK." Mitnick, no stranger to the ways of law enforcement, believed he was being set up for something.

Now Kevin doesn’t carry around the ordinary sort of luggage. He speaks at security conferences a lot (who knows security better than one skilled at breaching it?) and had in fact landed in Atlanta for a security conference. In his luggage, agents found a MacBook Pro, a Dell XPS M1210 laptop, an Asus 900 mini-laptop, three or four hard drives, numerous USB storage devices, some Bluetooth dongles, three iPhones, and four Nokia cell phones (with different SIM cards for different countries).

They also found a lock-picking kit and an HID proximity card spoofer that can be used to snag data stored on physical access cards by swiping it in front of them. The data can then be used to enter locked doors without having to make a forged access card. Mitnick says he used the device in a demonstration about security in his speech in Bogota, but that the customs agents' eyes lit up when they saw it, thinking it was a credit card reader.

So the agents had a field day inspecting his laptop, cell phone, etc. In case Kevin thought his day couldn’t get worse, his girlfriend in Bogota called saying that the police there wanted permission to open up a package of computer equipment and souvenirs he'd mailed back to the U.S. a few days earlier because they said they found traces of cocaine on the package.

Mitnick told the agents why he was in Atlanta, to moderate a panel at the security conference. Asked for proof, he fired up a laptop to show them the itinerary in his e-mail. But when he clicked "yes" to have Firefox clear his private data--an automatic response to a default setting--the agents grabbed the laptop away from him, thinking he was deleting evidence. In a move that certainly must have irked the agents, Mitnick reached over and powered off his machine, not wanting the agents to have his password.

Fortunately for Kevin, one of the members of the panel he was to moderate works for the FBI, and customs agents were able to reach him to verify Kevin’s story. Meanwhile, conference organizers, worried about Mitnick's non-arrival for his waiting airport ride, had also called the director of security at the airport and helped straighten things out. The FBI in Atlanta cleared Mitnick of any wrongdoing, and he was finally released with apologies.

And what about the Bogota package?  Police there tore open the box, took the electronic equipment apart, and destroyed the hard drive trying to open it by drilling a hole in it, but didn't find any drugs. The two incidents were, apparently, completely unrelated and coincidental. Sometimes everything goes wrong everywhere, all at once.

Kevin shared his story with the press as a cautionary tale for anyone coming through Customs with computer equipment. The government can, and does, detain anyone (and their equipment) at will. Even if someone is detained and released, the government currently asserts that it has right to hold on to electronic media to investigate what is on it.

To protect his privacy and that of his clients, Mitnick routinely encrypts all the confidential data on his laptops, transmits it over the Internet for storage on servers in the U.S., and wipes it from the computer before returning from any international trips, just in case officials decide to search or seize his equipment. He also encrypts his hard drive. And now, he says he is going to keep a "clone" of his MacBook at home so he will have an exact duplicate of it if it is ever seized.

So, for those of you who have queried whether John and I are “over-reacting” when we preach taking some of the steps that Mitnick takes regularly, re-read this posting. It can happen to anyone. George Orwell is no doubt nodding vigorously. Don’t say he – and we - didn’t warn you.

E-mail: snelson@senseient.com   Phone: 703-359-0700

NOT WITH MY LAPTOP, YOU DON’T: SENATOR FEINGOLD LEADS THE CHARGE

Most Americans would be appalled to know that a Department of Homeland Security (DHS) agent can explore your laptop at will and without probable cause, having it confiscated if it pleases the agent so the laptop can be explored by the government at its leisure.

Senator Russ Feingold has had enough. He has authored S. 3612, the Travelers' Privacy Protection Act of 2008, which would ensure that American citizens and legal residents returning to the U.S. from foreign countries would not have the laptops, cell phones or other electronic media searched without reasonable suspicion. It would also ban profiling based on travelers' race or ethnicity, allow people detained to witness the process of their laptop being examined, limit the time officials can hold a traveler's hardware and provide compensation for damage to a traveler's computer.

"There is a compelling and immediate need for this legislation," said Feingold, in introducing his bill last Friday. "Travelers have been forced to wait for hours while customs agents reviewed and sometimes copied the contents of the electronic devices. In some cases, the laptops or cell phones were confiscated, and returned weeks or even months later, with no explanation."

The DHS is so arrogant that when Feingold chaired a Senate Judiciary Committee hearing on the issue in June, the DHS refused to send a witness for the hearing and did not comply with the committee's request to produce answers to the questions previously submitted to DHS Secretary Michael Chertoff before the hearing.

The Travelers' Privacy Protection Act is strongly supported by the American Civil Liberties Union as well as business trade groups such as the Association of Corporate Travel Executives (ACTE), which represents the global business travel industry and has members in 82 countries.

I have never seen so many lawyers and citizens this angry about an invasion of privacy. If they could speak up in a single voice, they would no doubt echo the words of Peter Finch in Network. “I’m mad as hell and I’m not going to take it anymore!”

Bravo Senator – it won’t be easy sailing, but I wish you fair winds. You’re clearly steering by the right star.

E-mail: snelson@senseient.com      Phone: 703-359-0700