Dave, cryptography is irrelevant if it is bypassed.
There is always, always some level of DB admin that can get beyond the certificates. That's all that's needful here. Some emergency or general utility, perhaps. That would be downright classic.
But, suppose there is no such code? I still don't care what is encrypted by whom. Once you breach a server, eventually, you can get underneath the cryptography. There is some level where the code has to work and work on data in the clear. Such code gets the relevant keys. Once someone breaks in, all bets are off in terms of access to said keys and the code that accesses said keys and whether it behaves as expected.
It could be as simple as a one byte patch to the code that has full access to the DB and simply believes that all presented LOTW certificates are valid thanks to said patch. It is the very same code otherwise. That code will have access to the relevant encryption keys -- it must -- and so it will make the relevant changes to the data base it is told to do. This is but one attack of hundred of attacks that might work.
I'm not suggesting that any of this will be easy -- or easy to discover even if there is a breach. I am suggesting that it happens every day and while cryptography can help, it is no magic wand once your attacker gains sufficient authority to essentially look at anything and change anything. Which is exactly what all too many breaks do.
Since there would be no financial benefit, what adversary would be motivated to spend lots of time and big money in order for forge QSOs or just trash LoTW? A forged QSO with a highly-sought-after DXCC entity would be quickly detected.
1. A lot of people out there do hacking "just because they can". It's a sicko form of showing off. It's depressing but true. They are probably more likely to trash the DBs than to forge QSOs. It's easier and fits many of their sick profiles. Heck, they probably are more interested in whatever credit card information they can glean. But any sort of attack would damage the league to some degree. And, they might look at the baroque system and delight in working around it, who knows? Hacker psychology is not something one can make very many assumptions about.
2. If we take your argument seriously, there should have been
no security to start with. Clearly, people inside the league think that attacking this system is important. It's just that the ARRL may have neglected the most obvious path for it.
I've done a small amount of professional work in this area. What I learned:
1. The amount of resources devoted to security must be assumed to be small compared to the resources of the attacking community. One's only advantage is that they are disjointed, but one can't count on that. Also, every dime spent on security is begrudged by management in the end, especially as the potential expenditure gets higher and higher for more marginal returns. And you have to do a lot of things perfectly. One bad password, one inadequate procedure renders the rest irrelevant.
2. You may as well proceed
as if there are multiple attackers attacking multiple things. Serious security analysis, then, looks for the neglected trap door. Because while the attackers are busying their security tools, trying to breach certificate passwords, and failing, the same attackers (or some separate set of them) will have much leisure to try other things. If they find the shorter path, they abandon the cert attack and the league loses.
3. If a forged QSO is so easily detected, you are again undermining the argument for the other security to begin with. Presumably, outfits like Clublog, with no
apparent security, rely on stuff like this. So do my own suggestions, for that matter. The 2m EME crowd, for instance, is sufficiently small that anyone who fakes, from scratch, a 2m EME WAS is certainly going to get found out if anyone notices the award was granted to start with.
Accordingly, whatever resources the league has probably need to be focused on things beyond the certs. The certs are doing a bang up job. General crypto of DBs help also. But all they may assure is that more attention is focused on easier paths where none of it matters.
I wish you joy of your assumption that ransomware would be easily detected. There are far too many victims of it to assume that. Those that engage in ransomware seem to have a lot of success. There are a lot of companies out there with inadequate or no backup facilities. I know this from my professional work. As the saying goes "you'd be surprised". Those guys surely get "caught" by such attacks. But, backups could get compromised any number of ways without necessarily being detected. The devil is in the details and each company is its own adventure.
Here's a challenge: see if you can connect to the LoTW Server.
My failures tell nothing whatever about the system's vulnerabilities. Nor would it change my opinion in the least.
Besides, I don't engage in that sort of behavior. And, real attackers fight dirty. They are not above dumpster diving, compromising personal computers all over the world and having
them trying out nefarious attacks in great numbers, and much, much else.
The biggest problem in all of these things is that it is
very difficult to know what you can do in the face of inspired guessing. Maybe I can't guess how to access the server. But a miscreant with much experience? That could be a different story.
For instance, some of the cipher messages in WW II were broken simply because it was possible to assume that they all or mostly all ended "Heil Hitler". Those composing the messages almost certainly never gave it a second thought. A lot of inspired attacks are only retrospectively obvious.
Author
Topic: Response to the ARRL CEO's Editorial on page 9 of the December 2021 issue of QST (Read 853 times)