Advogato blog for Chicago

Media Bashing - Electronic Passports, and why should we care?

Wed, 6 Aug 2008 23:09:40 GMT

Todays link that popped up - and I don’t search for these , I just notice them on the tech feed of Google, is Guardian talking about how easy it is to clone an electronic passport (full link here and also the Times Online) and throughout the day popping up on other sources. The story is always basically the same - given a new passport, this guy has managed to create a “copy” of the passport but edited some of the data on the clone - to be precise he’s swapped the digital image of the person (and he’s used Osama and another terrorist to get the point across).

So what’s that these articles are getting at? Basically, this (And this applies to all smart-card technologies irrelevant of they are contactless or not) - a smart card uses a standard interface to talk over, which your reader calls function calls on the processor on the other side. Now, the functions it can call, even if they’re secret, eventually will be leaked or someone will work out how they work, and publish that info.

What happens then is this - people are able to read off the smart card a whole heap of information - for example, in a credit card, the reader is able to get the card number and the name on the card, as well as other useful information about the type of card etc - this is the whole point of the card. If it wasn’t possible to get this information off, then the card wouldn’t be any use in a merchant’s terminal - a passport which you could never get the details off, would be, well, about as useful as a brick.

The way the security often works however, is that a secret piece of data on the card is used to manipulate some other data - some transaction specific data. So the banks and the passport issuers put this secret on the card which can’t be retrieved (without going into discussions here about side channel attacks). Often this is in the form of a simple hashing algorithm. The Bank/Passport office know what this secret is, and the card does - so when the merchant (or if a passport, the border guard) passes the hash up, it can be confirmed by the computers.

So what is the media raving about? Basically, they’ve got a guy who’s created his own copy of the Passport’s chip - that is he’s taken an off the shelf chip and programmed it with a program which mimics the official program.

He’s then read a copy of the real passport, and read all the “public” data from it - that is he’s called each of the functions in turn and read back the data that the official program sends. He’s then plopped that data into his own version, and changed a bit here and there. Now, this is all very good apart from he can’t clone the secret - he can either do one of two things.

1) try and get by with the same data being returned every time (which the smart card app designers will have written guards in against hackers doing that), or

2) pick a random secret and use that to generate the data that he doesn’t know.

So what he’s done is that second one. And this (in my opinion) is what the news stories should really be focusing on:

According to the news results, whilst 44 countries have signed up to the Electronic Passport scheme, and have agreed to implement it to the same standards, only 5 of them have actually implemented the electronic checks which will confirm if the secret on the card is the correct secret. The message that being sent out by the media should not be “Can we create forged cards” - that, as always, is yes, but instead, it should be “Why haven’t the other 39 countries got their systems ready yet?”. Then the question is much simpler - “Can we spot the forged cards” - with the systems that have been specified in place, the answer will be yes.

So Smart Cards are the answer to All Security Problems. Ever.

I’m not saying that. There are a lot of situations where Smart Card security based solutions don’t quite work, for instance offline transactions where you can’t verify “on the spot” if the details inside the card are genuine. There is a lot of skill and a lot of time and effort being spent by Smart Card programmers to provide very good and very secure programs - if you create a smart card program and algorithm in an afternoon, its not going to be as secure as one that has been well researched, and analysed and so forth. But, they add an extra layer of security on top of the already difficult to forge documents.

Audio and the Old Man

Tue, 5 Aug 2008 22:07:06 GMT

Dave and me are trying to build an audio project, which is all about sound manipulation. Dave’s the musician of the two of us, and I know nothing about sound whatsoever. We’ve got a primitive system using a Arduino that will produce sounds out of an R2R Digital to Analog Converter, but we’ve got no real idea about generating the wave form. If only we could sample…

About ten years ago, my dad mentioned in passing a short story… Before I was born, and we’re talking about the mid 70’s here, or maybe even possibly early 70’s. Either way, the styles where much different to now. He was helping a friend of his build an Digital Audio project. Sound familiar? Time to pick the old man’s brains.

Anyways, it turns out, back in the day, they built a device which sampled audio from a microphone by converting its voltage into a number, then saving it to memory, then, synchronized, retrieving the elements from memory and playing them back. Yes yes, it’s an echo box. Primitive but worked. If his memory serves him right (and we’re talking my entire life span here, and he’s had a lot of stress in that time - he’s my Dad after all) he thinks that they only sampled at about 50 times a second. Apparently, even cooler, whilst it was a digital system, they didn’t use any form of micro controller - they did the entire lot in Digital Electronics, making the controlling circuits using just logic chips. Thats hardcore. Anyways, back to the point of this.

Why couldn’t I have worked this out? My mind is stuck in this world of high tech digital quality sampling on one side, and on the other, using really high frequencies which sampling at 50hz seriously won’t cut it but that doesn’t matter does it! Either way, I’m now set to sample data on the analog port, and then shove it out again on the R2R DAC on the other side.

Ok, time for some diagrams about what I’m talking about.

Ok that was the worlds most boring diagram, but it gets the point across I guess. Sorry about the ? with the other side of the microphone. I have no idea what this should plug into, and actually, I have very little idea where I’m going to get one from. I have a suspicion I’ll be plugging it into a computers line out or headphones port into a jack there. For those of you who don’t have a clue what a R2R Dac is, then check out this page and erm, I guess thats it for now until this has actually been built.

Breaking Advogato with my RSS Feed…

Tue, 5 Aug 2008 15:11:36 GMT

So I set up a wordpress account to do some blogging in with more features the Advogato - I have a need to present a slightly more formal view of what I’m doing, and as this will also be very techincal related, instead of cross posting, I thought I would set the Advogato account to synch with the WordPress.

Little did I think that it would break Advogato, and indeed, it seems to have done so - the feed being generated by wordpress has (as far as I can tell) correct formatting, but Advogato must be reformatting the sequence that causes the Vimeo video to be embedded in a bad way - it is missing a single quote on the end of its line which is causing a large chunk of HTML to be ignored by Firefox, primarily half of my post and the switch over to the start of the next one.

Is there likley to be a successful fix or am I too hopeful? Is there anything I should change about the way I add the video’s? (all I did was div align=”center” then the vimeo paste code… Gah… if only systems wern’t this easy to break in 2008…

Starting… NOW!

Tue, 5 Aug 2008 09:12:30 GMT

Hello, starting this new blog to talk about work that I’m doing and involved with. This is also a test for the WordPress because I’ve not ever used WordPress before (really - I used it a little bit but don’t really know). Anyways, ignorance is not an excuse, just lack of time.

In this blog I hope to talk about a lot of the things that I’m working on at work and at home, especially a bit of Arduino hackery and some micro electronics, not to mention some side projects I’m working on (namely secret plans of world domination).

Also, I’ve signed up with vimeo to help me produce a bunch of better quality videos about the stuff I’m working on, and I’ve got my hands on a couple of good quality web-cams which I can use to make some basic videos and also, timelapse videos of me making stuff. It’s very handy and might be of use when I am rushed to hospital and the Doctors say “he did what???”.

So this is a couple of hours at 1 frame every 10 seconds. Its a short introduction to me not setting fire to things. Which brings me to the title of this blog. I havn’t yet come up with a good name for it - so instead I set it to something that I need to remember. Nearly every time I do a long build, at some point I will try to pass the soldering iron from one hand to the other, and invariably do so by picking it up at the hot end with my left hand. This title, is in fact a reminder for me.

3 Aug 2008

Sun, 3 Aug 2008 17:45:51 GMT

Maplins Dodgy Service

For an amateur micro-electrician I struggle to find the parts that I need for my electronics. Recently, Dave and myself have been working on a Digital Synth, and our abilities have been foiled by the terrible status of Maplins.

To buy over the counter parts in Norwich, we're really limited - we have two Maplins. The website says that there is a particular item, that there are 5 of them at both of the stores. When we visit the said store, they tell us the items been discontinued and there arn't any such items anywhere in the region or head office.

So now we're doing a mail delivery order from RS - 4*£0.50 items and then £5 pnp. I dont mind this - apart from if I had known on wednesday that this would be the case, we would have done all our purchases this way, and have had them all ready to go for our build session yesterday.

Not. A. Happy. Bunny. Damn you Maplins. Damn you and your stupid online stock system.

16 Jul 2008

Wed, 16 Jul 2008 21:55:17 GMT

Work Demonstration Complete

My Arduino board was being used for a demonstration at work, but it enabled me to get a lot of use out of it and work bought me a couple of bits that I wanted to play with, notably a network interface and a Mifare reader module.

Anyways, its back to being used for what I want to do things with, notably robot building. However, this time I am being distracted by a different use, which is sound generation - or should I say Noise generation.

I have had my imagination sparked by the prospect of using the Arduino plus some knowledge I have gained from my ham stuff to generate a synth. It's been done before, but not by a lot of people.

There seem to be a couple of routes to go down - This page documents the different ones. The main ones seem to be this:

Use the Arduino to control a synth or other noise making source.
Use the Arduino *as* the synth.

I've not yet completly decided which route I'm going down, I know that the sounds generated by the first method might be... better, but I have an aweful lot to learn about generating noises...

15 Jul 2008

Tue, 15 Jul 2008 22:02:51 GMT

More posts about things which are not-quite-work
Its increasingly difficult to talk about things which are work related because, well, I'm not allowed to. Because the work is what I'm interested in and takes up so much of my time, it does mean that some blogs being to dry out.

Arduino java.lang.StackOverflowError
It seems obvious if you know, but there isn't that much in the Google results for a search with those keywords. Basically, this happens if you do something silly with strings and quote marks... for example, compiling the following (in Arduino 0011):

Serial.print("rar);

Ok, now, its not immediately obvious without good syntax highlighting that the " is missing from this, and compiling won't give you a line number where it all goes wrong.

I Think The Stack Overflow Error is caused when the distance between this typo and the next " is so big that it would cause a StackOverflow... I think. Im now not sure. Eitherway, look for missing quotemarks or similar typo's.

15 Apr 2008

Tue, 15 Apr 2008 16:40:16 GMT

Visual Studio, HttpModules and compiling for IIS6

Things are becoming a little tricky. Because Windows 2008 has only just been released, the migration to that is going to be relatively slow (I can't realistically suggest that we have our production server as a 2008 box ... yet). So we're stuck with using Windows 2003 and IIS6 for our .Net hosting.

However, we're programming on Vista boxes, which of course, are running IIS7 and all its finery. Now, having a test platform which is a different version to the deployment platform is never a good idea, and right now, its a royal pain in the ass. And why? Well, randomly, the way I add headers:

Good

response.AddHeader("Content-type", "text/html");

Bad

response.Headers.Add("Content-type", "text/html");

The first one works, the second one ...

System.PlatformNotSupportedException: This operation requires IIS integrated pipeline mode. at System.Web.HttpResponse.get_Headers() at ...

Go figure.

6 Apr 2008

Sun, 6 Apr 2008 21:54:38 GMT

MS SSMSE 2005 Error on Installation on Vista

Ok, if you're an indie developer for the Microsoft platform, then you might have SQL Server (Express) then you might also want to install MS SSMSE (Microsoft Sql - Server Management Studio Express).

The Good

Ok, so you've downloaded the SSMSE install package, and it doesn't install and the MS reference for it is about permissions on the Data Directory. There might be one single file which has the wrong permissions, but I couldn't find one. Installations continue to fail no matter what the install user is.

The Ugly

To install, there is a very simple solution - Turn UAC off - its in the user panel of the control panel. Then installing SSMSE is painless. Just remember to turn UAC back on again after you've done it, oh and pray that you dont need UAC's protection for the few minutes that you had it turned off... (Why do you think this section is entitled "The Ugly"?)

The down-right-Bad

If you decided to go with MS Sql Server 2008 Express because, well, why not... (think of all those new features) then you have a bigger problem. At the moment, SSMSE is only available in the 2005 variant, which does not allow connections to a 2008 Express service.

3 Mar 2008

Mon, 3 Mar 2008 14:13:55 GMT

A good workman never blames his tools

This weekend for me has been a near disaster. I started work on my SpokePov and USBTinyISP. Then my Solder Iron melted. Not the plastic hand wrap, no, the nib. Thats it for soldering - no more soldering being done without a soldering iron.

I now need to go and buy a nice soldering iron which is temperature controlled - if you use one thats too hot, you end up having problems, if you use one thats too cold or does daft things (like the cold solder one) then you have problems.

So now I have a fully built USB dongle, and a half-built SpokePov, and a not very happy monster.