« Give me liberty or give me GIANT ROBOTS!!! | Main | Antisocial Networking »

Halting State moments ...

MMO operator MindArk has been granted a banking license for its virtual world Entropia Universe, by the Swedish Financial Supervisory Authority.

This is an exciting and important development for the future of all virtual worlds being built using the Entropia Platform," commented MindArk CEO, Jan Welter Timkrans.

"Together with our partner planet owner companies we will be in a position to offer real bank services to the inhabitants of our virtual universe."

Entropia Universe acts as a platform from which partners can launch virtual worlds within, with the focus being on microtransactions and virtual currency monetisation.


Tracking GhostNet: investigating a cyber Espionage Network
Researchers at the Information Warfare Monitor uncovered a suspected cyber espionage network of over 1,295 infected hosts in 103 countries. This finding comes at the close of a 10-month investigation of alleged Chinese cyber spying against Tibetan institutions that consisted of fieldwork, technical scouting, and laboratory analysis.

Close to 30% of the infected hosts are considered high-value and include computers located at ministries of foreign affairs, embassies, international organizations, news media, and NGOs. The investigation was able to conclude that Tibetan computer systems were compromised by multiple infections that gave attackers unprecedented access to potentially sensitive information, including documents from the private office of the Dalai Lama.

Chinese government denies everything

China, via the China Daily, quotes military and security analysts in denying the reports, claiming that they are an attempt to paint China as a threat and are in any case "exaggerated".

BT 21CN Network vulnerable to Chinese attack

Spy chiefs have reportedly briefed ministers that Huawei hardware bought by BT could be hijacked by China to cripple the UK's communications infrastructure.

At a meeting in January, Alex Allan, chairman of the Joint Intelligence Committee, told the Home Secretary that while BT had taken steps to secure its network, "we believe that the mitigating measures are not effective against deliberate attack by China", the Sunday Times reports.

Huawei, led by former People's Liberation Army (PLA) research chief Ren Zhengfei, is a major supplier to BT's ongoing multi-billion-pound 21CN network upgrade. It will see all voice and data traffic carried by the same packet-switched equipment. In 2005 the Chinese firm won contracts to provide access nodes and optical equipment for the core of the new network.

I hereby declare HALTING STATE obsolete, eight years ahead of schedule!

My work here is done.

|


49 Comments

1:

When I read the story about GhostNet I immediately thought of Halting State.
Now could we just get the cool AR shades and cute LARPers?

2:

Soooo, when is Spies 3.0 being rolled out?

3:

I really wish the Chinese government denied everything. "The sun? No, just a capitalist myth. Capitalists? Just a capitalist myth. Communism? Just a capitalist myth."

user-pic
4:

One reason this should be even scarier to the Chinese is that it promotes protectionism. Can anyone doubt that, with this news in mind, most national governments - huge IT customers - will be highly reluctant to purchase computing hardware from China?

And, what effect will this news have on the constant decline in prices in IT?

Just shows how virtually every form of totalitarianism eventually sows the seeds of its own destruction.

user-pic
5:

Hmmm. When I first read Halting State, I took the character who was a registered sex offender because he had incautiously kissed his girlfriend in view of monitoring cameras and then said the wrong thing when interrogated to be a brutal satiric exaggeration of current attitudes, in the spirit of "If This Goes On—". Only later did it occur to me to wonder if it was already true.

user-pic
6:

You totally forgot the kids being charged with child porn, because they sent nude pictures to each other, sort of like the sex offender in the book.

Also, does this mean that we'll be getting wicked cool computer glasses with in a couple months?

7:

Mr. Stross, I demand you turn over the keys to your time machine at once. A subversive like yourself cannot be trusted with such power to expose the workings of legitimate business/government.

8:

... denying the reports, claiming that they are an attempt to paint China as a threat and are in any case "exaggerated".

Reminds me of the indicted mayor of Providence, Rhode Island, giving a press conference on City Hall steps: "Some of the allegations against me are false."

More broadly: great prophecy, Mr. Stross. It will be that much harder no to deny this role for Science Fiction.

9:

All of the USB stick modems that are used for wireless internet access in Australia are made by Huawei. When I got wireless internet service, I was wondering what was the connection between the company and the Chinese government.
I was told that Chinese made computers are not allowed to be connected to sensitive government computer networks in the U.S.

On a related note, here is an interesting article about the
"Farewell Dossier", which was about how a Trojan program was put in software used for managing a gas pipeline. Activation of the program resulted in the largest non-nuclear explosion ever.

http://www.damninteresting.com/?p=829

Speaking of "Halting State", the only thing missing now is a working quantum computer.

10:

The earlier commenters are missing the point. Charlie said "My work here is done." He isn't predicting these thigns. He's causing them. Think back to the discussions concerning "419". Suddenly Madroff, etc. Now then. Do you REALLY want another Laundry novel?

11:

Of course. We need a survivor's manual, after all. Also, just maybe, we may need to make deals with the Clan to evacuate people.

12:

I just printed this diary post and will stick it into my copy of Halting State. It's always nice to have books connected to real life. Or maybe not so nice in this case.

user-pic
13:

...Charlie, did the British Joint Intelligence Committee JUST figure out that certain governments with extremely tight control over commerce and citizenry might, um, back door the firmware as well as the software? I...uh....who....where is their infosec consultant all this time? Is BT ISO qualified to run a the nationwide backbone infrastructure without someone holding its hand when they cross the street? Rhetorical question, mind. But I have little doubt that Huawei was the lowest bidder.

Adapting the maxim of my father's business (construction) to networks: You can have two of these three: Fast, Secure, or Cheap. Whichever you don't chose - is going to be horrid.

As for USA secure networks: You're only one kid with BitTorrent on mommy or daddy's work laotop away from security lapse. Not to mention the risks of information sharing multidirectionally between security-purposed military and intelligence community networks and their more 'porous' bretheren at the DEA, ATF, and National Guard levels.
If does help that most of the military and intelligence community spent hideous amounts of money for domestic military industrial contract code.

14:

TechSlave: .Charlie, did the British Joint Intelligence Committee JUST figure out that certain governments with extremely tight control over commerce and citizenry might, um, back door the firmware as well as the software?

Maybe. But it's also possible that they've been having a full-dress panic over this for 18 months to 2 years behind closed doors, and have finally reached the point at which they are reasonably confident that the government's core communications systems are now semi-safe, and are trying to discreetly warn the public and industry.

BT's security arm was boosted about two years ago by the acquisition of Counterpane, Bruce Schneier's company. Unless I'm out of date Bruce is still doing stuff there.

I am not drawing any dotted lines between these two observations.


15:

Huawei are taking over the world of telecomms. Probably the most aggressive competitor out there. I highly doubt that there are government-sponsored backdoors in their kit.

However, as an employee of one of their main competitors if people could keep spreading those rumours it'd be much appreciated. Thanks :)

16:

The Huawei thing is almost certainly US nationalist-driven nonsense (there are mouthbreather congressmen who are obsessed by this and well paid for it by US vendors), and you wonder why if this is so they haven't made any visible effort to verify the security characteristics of equipment which sells to all kinds of other network operators other than BT. After all, we know it's possible to hack core telco infrastructure because of the Vodafone Greece case. But that was an Ericsson AXE10 from Ericsson - you know, the company with the white people. I'd be far more worried regarding 21CN about whether some of the fancy network entities it involves actually work.

Frankly, we know that Windows systems get hacked all the time, and the Chinese/Tibetan thing is exhibit A; but we're apparently delighted to have every bit of the government running on Windows PCs. Because y'know we can trust the Americans. 'Course we can. And whoever built Storm, Conficker and friends.

user-pic
17:

What I wonder is: How is this different from any other hardware manufactured in China? Most electronics get assembled there; switching out a few components here and there would be very easy to do for them.

Also, it should be noted that most governments also heavily suspect that the US is doing exactly the same - and has been for a while. NSA backdoors in US-manufactured crypthographic hard- and software are something that one cannot dismiss easily. The NSA is one of the biggest employers for mathematicians worldwide for a reason.

If you think the US would never do such a thing, google 'echelon "industrial espionage"'.

18:

There's plenty of Alcatel-Lucent kit out there. Have you met HERISSON yet? It's like Echelon...but French. Actually it looks to be more like Total Information Awareness, but French, if you click through.

Also, the Huawei contribution to 21CN is this strange beast the "i-node", which is a Layer 2 Ethernet entity which switches encapsulated higher layer protocols (IP, steam voice, MPLS, weird old telco stuff, L2TP etc, WBC Ethernet pipes). I would think there might be some significant barriers to exploiting such a thing from the public Internet. (Mind you I've also heard suggestions that it might be secure in the sense that a computer that's been buried in the Marianas Trench is secure...)

So you'd need a malformed packet exploit that lets you break out of the encapsulated IPv4/v6 riding on the private IPv4 network and then have at the admin interface, or else break out of the Layer 3 traffic and generate a special Ethernet frame. Also, IIRC the IP core network's border routers come from someone else, and I *hope* the firewalling/filtering appliances are non-Huawei. The Multi-Services Access Node is Ericsson, and I think the voice core is as well, and NEC had a big chunk of the job too. So there is a fair amount of vendor diversity...but that might just mean the Forsvarets Radioanstalt and the Japanese are in there as well.

Too many dimensions! I am Jim Angleton!

19:

Amusingly, my immediate thought on seeing the GhostNet write-up was "hm, I wonder if Charlie has seen this?".

Likelihood of backdoors in Huawei kit? Low, but non-zero. From memory, Huawei try REAL HARD to make Cisco-compatible kit, to the point that they take Cisco port adapters and can run IOS, so any backdoor needs to be in the firmware. Likelihood of backdoors in IOS? Low, but non-zero. If Huawei now provide their own router OS images, I'd rank them as being somewhat less unlikely to have backdoors.

user-pic
20:

Bruce Schneier is the Chief Security Technology Officer at BT.

I'm with Charlie on how the JIC is likely to operate on this matter; they wouldn't be talking about this stuff (even at second hand and plausibly deniable) if they weren't reasonably confident that the issue was contained. These are the institutions who were selling ENIGMA machines up until the late 60s - I find it very hard to believe that they are wide-eyed naifs when it comes to the matter of backdoors into critical comms infrastructure.

Regards
Luke

21:

Dude! You're the man!

22:

When I heard the story on the radio about chinese hackers (tuned in half way thought), I thought for a moment they were reviewing Halting State.

23:

So why isn't Scotland using the Euro? Or does the pound have to drop a bit further yet?

24:

This kind of thing is pretty hard to lock down. It'd take the deal including source code in compilable form - not so uncommon in big deals. Then the hard part would be BT actually auditing said code, a ton of effort. Now, Schneier would no doubt point out that randomizing the audit would give it more power to catch things after being acquired IF asked about it AND listened to. But we're still talking about alot of effort to get to a reasonable level of comfort.

Interestingly, the Chinese gummint seriously pushed standardization of a wireless standard that included the ability of the Chinese gummint to read all packets written in it. They were terribly hurt and didn't understand when it went over in standards committees like a bag of lead....

The American crypto standards can probably be relied on because they're looked at by many, researchers, including many outside the US, who can and will help their careers by raising a stink if they find a weakness.

Windows' vulnerability is for a different reason - at the very least, MS doesn't care about its customers; their leadership's often even shown signs of looking on them as there to be exploited. That's why they didn't mind doing whatever their NSA deal was. But the NSA's deal's likely small potatoes next to Windows' ActiveX, which might as well've been designed by crackers for their convenience.

25:

JDC #10:
You mean, like in the way Neal Stephenson's "Snow Crash" became industry bible/business model/ inspiration for web companies following its publication, "Halting State" has been the same?

Charlie, could you make "419" a near-future utopian story please? With flying cars. And ninjas in spaaaaace!

user-pic
26:

Charlie @14:
That definitely help to have Bruce Scheiner & Co doing a good measure of it.

Alex @16:
While some of the issue can be nationalism of a stripe, an attempt to frame this as an issue of race and nationalism rather than security isn't valid. Having security discussion regarding a company and the government which has the ability to execute any member of said company for failing to toe the party line and claiming this is an issue of skin color isn't too valid, but that is my opinion.

I'm not saying all of Huawei's products, or any of them, have a backdoor, but I AM saying that the Chinese government has shown quite an interest in being on the front lines with 'cyberwar' capabilities. Additionally, their attitude regarding the source code of others [http://www.pcpro.co.uk/blogs/2008/09/24/china-no-source-code-no-sales/]. Other examples include the VoiP backdooring, which not just the Chinese government but British, American, Japanese, ad nauseum all push for because the ability to tap and monitor information is vital for intelligence agencies .... though the uses said information is put to vary, the urge for control is much the same.

When you look at the GhostNet issue, be they 'patriotic hackers' or actual Chinese intelligence services, I think there is definitely a validity to questioning whether or not a specific government, or persons acting it said government's interest, would take the opportunity to backdoor equipment or software.

As for Windows...or Apple....or any major software vendor: Damn right you should worry about the backdoors built in. Because they're handing them out not just to intelligence agencies, but local enforcement agencies. Many of us are FAR from delighted about the prevalence of Windows products in corporate and government settings. Even the unintentional security fails are horrid enough, and as was already mentioned here - ActiveX alone is a security nightmare.

Markus @17:
Hence PGP moving international. While there was a major victory with the overturn of the laws within the US regarding encryption legality, I agree - the US government is definitely neck deep in the informational espionage game, both governmental and corporate. So does this leave BT in a 'lesser of two evils' situation, or is there another option?
And there are fun other options, such as the hardlines running from major telecomm data centers directly to intelligence agency data centers. Gotta love data mining.

Jon @23:
I agree, and I don't know enough about the deal with BT/Huawei to determine if they did provide compilable source code. That's the problem. Not to mention being able to confirm that the equipment source code and compiled code is the same as the code you were provided, as well as the audits to ensure its security.

27:

Actually, I just checked, and the situation with Huawei is different than I thought; they are doing the MSAN and some optical splitter stuff. The Metro and iNode and core routing elements come from Ericsson, Cisco, Juniper, Siemens and pals. I think my points hold, especially as the MSANs shouldn't be visible on the public Internet.

28:

When the next major crash of the world economic system happens, probably between 2028 and 2032 (because by then it will have been forgotten why it would be bad to forget any lessons learned from the current crash*), I predict that it will be triggered by some form of massive real-world currency speculation based on virtual-world/game currencies.

People will say "How could this have happened? Why didn't anyone warn us? And why would anyone be allowed to risk real-world money on something so stupid?" When people say this to you, please point those people to Halting State and to this post.

* As apparently everyone in finance or government had worked hard to successfully forget the 1980s S&L collapse, junk bond fiascos, and the October 1987 crash, in time for most of it to repeat in slightly altered form over the last few years.

29:

Dunno if you all saw this?
It made me think more of The Laundry, than Halting State...

SCORPION STARE, GAME ANDES REDSHIFT & CASE NIGHTMARE GREEN seem to be getting closer...

http://www.theregister.co.uk/2009/03/15/raytheon_lightweight_raygun_tech_deal/

user-pic
30:

NSA backdoors in US-manufactured crypthographic hard- and software are something that one cannot dismiss easily.

Even in the mid-80s, it was assumed that they had a way to read stuff encrypted via the DES algorithm. The crypto class I was in tended to believe they had a backdoor into it at the least, and maybe had it well and truly broken. (IIRC, there were some features that didn't make sense otherwise.)

31:

Adding to 28, I think that Charlie's credentials are already impeccable. Headline "USAF to unleash 'Gorgon Stare' sensor in 2010"

http://www.flightglobal.com/articles/2009/01/28/321732/usaf-to-unleash-gorgon-stare-sensor-in-2010.html

32:

Talking of "back doors into Cisco IOS", Ingvar@18 might want to consider that a lot of IOS development is done in / run from Edinburgh...

http://www.talentscotland.com/jobs.aspx?item_id=228

user-pic
33:

The reports show that whoever's doing this is really good at social engineering. Perhaps they have something like gold farms, but for English Lit. graduates? You can do a lot with cheap labor. For instance, you could set up a "man-in-the-middle" attack by redirecting all their mailing lists so that they only see edited versions. It might not pay off *now*, but down the track you might influence their views or harm them by making them seem ill-informed. Heck, you could simply redirect all their outgoing email to your own data farm, edit it, then relay it with forged headers. Who would notice?

34:

P J Evans @ #29:

There's some circumstantial evidence that NSA actually strengthened DES against differential cryptanalysis, showing that they did know of the technique in the late 70s.

35:

James @22: the Tories have to win the next general election for that to happen. (More seriously: the SNP also have to not screw up running their first minority government in Holyrood. And they're not making many friends right now, because they're proving themselves to be in hock up to the eyeballs to the dour presbyterian constituency -- even more blue-nosed than New Labour were.)

Joe @32: not so difficult to spoof; if you're targeting an organization with a social engineering attack, all you need is an org chart and the right names/email addresses to stick in the headers. How often is the CEO of a company not going to click on an email purportedly from the CFO with a subject line like "Projection of revenue from product X: next four quarters" (where X is some current legacy product) and an attached Excel spreadsheet full of malware loveliness? To be followed ten seconds later by their machine BSOD'ing and the email in question mysteriously vanishing from their inbox after the reboot?

If you're targeting a specific executive in a specific organization (rather than running a drift-net 419 scam) the phishing hook can be made very sharp indeed with relatively little research ...

36:

PJ @29, Ingvar @34:
Yes: the NSA has split priorities: protecting the US (meaning secure crypto, computers, etc) but cracking "the enemy", which means discovering weaknesses and cracking the same algorithms and OS's.

It was presumed for a long time that they knew backdoors into DES. After Differential cryptanalysis was discovered, and it was realized the NSA had strengthened DES against it (compared to the original IBM 80-bit (?) lucifer algorithm), most people settled on the idea that the NSA decided to go with the one advantage it had: size. It created the strongest 64 (really 56)-bit DES it could, knowing it had the brute force but no-one else had at the time.

But they still have this problem. They need to crack windows, etc. on demand for their clients, but protect US systems. I strongly suspect there is an office in MS and NSA that spots / creates backdoors on a weekly / monthly basis, and produces "black box" hacking tools for FBI, etc. using these. Then fixes these backdoors in the next months security roll-out, so expiring the tools in case they leak out onto the net, etc.

37:

Alastair McKinstry @ #36:

Yep, strengthening protection for own comunications while trying to subvert those of others.

Looking into the IBM Lucifer history, it seems to have started as a 48-bit key, operating on 48-bit blocks, but the version that eventually turned into DES was a 128-bit key and operated on 128-bit blocks (though subceptible to differential analysis).

I wouldn't be surprised if at least a few of the infosec firms have back channels to US federal agencies, feeding data back. I'd be utterly surprised if there aren't multiple, somewhat competing, US federal agencies with exploit factories churning out things.

user-pic
38:

Charlie,

Here's another one for you:
http://www.google.com/intl/en_us/landing/cadie/tech.html

They're claiming "Strong AI". Thoughts?

user-pic
39:

Sorry about 38. I really should read more before I start linking.

40:

@38/39

TLDR but saw this at the end:

The CADIE Team
March 31st, 2009
11:59pm

You need to reboot your bullshit detector.

41:

My correct opinions about everything, to channel Leszek Kolakowski for a moment, are here.

user-pic
42:

@36, I strongly suspect there is an office in MS and NSA that spots / creates backdoors on a weekly / monthly basis, and produces "black box" hacking tools for FBI, etc. using these.
This is a common and tempting theory, but I rather suspect that a small army of unwitting volunteers are writing the security holes. If this is the case, then the office would be a purely-NSA office, perhaps buying information about bugs on the black market as well, and the trick would be deciding which bugs to tell MS about, and which to keep as blackdoors.

43:

That's not the only one of your books to be frighteningly prescient. Check this out: http://lambda-the-ultimate.org/node/3259

I think it's time to switch to another universe before the singularity hits. It's probably already too late, actually...

44:

Here's another Halting State moment, from the website of 3DV Systems (who, according to The Register, are getting bought out by Microsoft):

"3DV's technology can also form the basis for developing a new intuitive user interface for mobile phones. As an example, instead of touching the keypad, one could use fine finger gestures recognized by a 3D camera to dial, create SMSs etc."
45:

Obsolete eight years early?

If it's still relevant when the paperback sales come to a peak, that's good timing.

Perfect timng is just after the natural peak, a big news item makes it up-to-the-minute and redoubles your sales.

There's still time.

Also: the difference in hindsight between 'prescient' or 'prophetic', and just plain old 'dated', is the quality of the writing.

46:

@42: I agree; I find it difficult to believe that NSA would share anything with another agency, especially FBI.

Re DES: I worked with it briefly for a while in the early '80s (evaluating a chip with the DES algorithm running in firmware), and came to the conclusion that even if there wasn't a backdoor as the rumors insisted, that the key was short enough for NSA to crack it by semi-brute-force techniques. It was similar to a cryptosystem I'd worked eith in the 60's that had a 56-bit key, that had been cracked by knowing the algorithm and looking for stretches of cyphertext at least as long as the key in which the clear text was null. Trial and error could find the key that way in a relatively short time.

user-pic
47:

Techslave @ 13, bit off-topic but you are talking about the time-cost-quality triangle?

Perpetual problem with public sector procurement, is an obsession with cost and a total unwillingness to see that low cost always ends up shafting the quality.

You then realise this mid-project (because what you are getting is a pile of sh&t), and change your requirements so the supplier has you over a barrel. Lots of variations to contract, supplier charges you cost+, with no incentive to reduce the amount of work they are doing.

Add in people who don’t have the technical knowledge to understand what they are buying and you complete the picture...

48:

Charlie, you really nailed the threat to the power grid thing in Halting State. Still, until NATO calls a special conference to evaluate the security threat and then invites you as a keynote speaker, I won't believe the State acknowledges your prescience and agrees to act accordingly. It could still happen. In fact, NASA did organize a conference in the early 1990s to investigate Vernor Vinge's warnings about a Singularity Event and the potential rise of superhuman intelligence; they had guest after guest from the scientific community come in and say, well, sure, it could happen, and make Terminator look like a nostalgic memory of the good old days. The official government report was awesome. What we need is an official government inquiry into all predictions made in Halting State: how much of a threat is all this?
:-)