Russian Federal Guard Service "Upgrades" To Electric Typewriters

Razgorov Prikazka writes "The Russian Federal Guard Service (FSO), who are in charge of protecting high level politicians like president Putin (amongst others), are 'upgrading' to electric typewriters for writing sensitive documents. They have found out that computers pose a security risk and this is their answer to it. On first sight this seems like a very pragmatic and cost-efficient thing to do. However, the FSO has its roots in the KGB and those were the ones who placed keystroke loggers on the popular IBM Selectric electric typewriter 40 years ago! So how much safer does this make them?"

Comments

How much safer

[schneidafunk]

I suspect having a device that has only one purpose, as compared to a computer, it is much less likely to be compromised and much easier to detect.

Re:How much safer

[kimvette]

Radio shack still sells parts?

Are you sure you mean Radio Shack? The place where their motto is apparently "You've got questions, we've got blank stares?" THAT Radio Shack?

Re:How much safer

[hawguy]

I don't think they got seriously more secure than using a computer with physically destroyed USB and ethernet ports.

I think it's hard to reliably destroy the USB ports for someone that has physical access to the machine and is motivated to get data off - USB is integrated into the core logic chips on the motherboard, so even if you destroy the actual ports, someone could tap into the traces on the motherboard to access the port. Though I guess if he has that much access to the machine, he'd just find a way to write it unencrypted to the hard drive and would take the hard drive with him. (I know there are operating system controls that make it hard to use USB ports or write data where it shouldn't go, but those controls can be bypassed)

If he can find a way to run a binary on the machine, then it's even easier to get data off -- he can just have his app flash QR codes on the screen at 15 frames per second and record it with a camera to get a 45kbyte/sec stream of data. With a good camera and a high res screen he can probably achieve much higher bitrates.

cost.

[gandhi_2]

It's probably cheaper than trying to out-bid American hipsters for old Remington typewriters.

Safer than an Internet Connected Computer?

[Anonymous Coward]

To place a keylogger on a typewriter you need physical access to the typewriter... to place a keylogger on a computer you need the internet...

I can see the advantage...

Nothing is safe

[Anonymous Coward]

When your opponent has access to your hardware, you've already lost. That's true whether its a mechanical typewriter, electric typewriter, or a computer.

Keep it simple

[fustakrakich]

No written communications. This whole writing and reading thing is overrated, and apparently can be dangerous.

Here's the NSA historical document

[Anonymous Coward]

http://www.nsa.gov/public_info/_files/cryptologic_histories/Learning_from_the_Enemy.pdf

Re:Here's the NSA historical document

[plover]

Thanks, AC, for the link. Very interesting story!

In an ironic twist, I present this paragraph from page 23 of the report:

"Eight months after the GUNMAN discovery, the story broke in the press. By highlighting the damage, press coverage helped to focus the attention of the U.S. government on improving the security of its information."

Perhaps Ed Snowden or Bradley Manning can present this in their trials.

So Awesome

[Sparticus789]

I was driving by Fort Meade today and I heard a collective scream of "PUUUUUTTTTTIIIIINNNNNNNNNNNNN!!!" coming from the NSA headquarters. Every single PRISM employee screamed in agony.

Sound

[Dan East]

I remember reading a slashdot story years ago where researchers were able to determine which keys on a computer keyboard were pressed just by the sound they produced mechanically. I would think it would be even easier to use this technique against a typewriter.

Re:Sound

[Dan East]

Wow, I'm citing 8 year old Slashdot stories.
http://it.slashdot.org/story/05/09/13/1644259/keyboard-sound-aids-password-cracking

Not all typewriters are ball-type

[davidwr]

The Ball-type IBM Selectric typewriters had a flaw that made it easy to tell what was being said just by the sound and delay between characters. You didn't even have to have the listening device in the typewriter, it could be across the room if it was "directional" enough.

While you could probably decode a lever-type typewriter's activity from just a good sound recording, it's probably much harder.

Oh, and as for trying to decode an inkjet- or thermal- electric typewriters just by the noise, "good luck with that."

Of course, today, if you can plant spy equipment in the room where the person is typing and you are good and well-funded, you don't need to rely on the noise the typewriter makes. Or, to put it another way, if you have a determined adversary who is significantly better than you, it's probably "game over" before the game even begins.

Easy to answer

[Idarubicin]

However, the FSO has its roots in the KGB and those were the ones who placed keystroke loggers on the popular IBM Selectric electric typewriter 40 years ago! So how much safer does this make them?

"Somewhat".

If your adversary has physical access to any piece of hardware, it's impossible to secure. Period. One can install a keystroke logger on a modern computer keyboard as well. Switching to non-networked, 'dumb', electric typewriters doesn't block this avenue for attack.

On the other hand, depending on the typewriter's features, it will be very difficult or impossible to remotely compromise, or to compromise using non-hardware approaches. Entire classes of attacks are rendered irrelevant.

To be fair, this does introduce some new potential avenues for attack--increased physical document handling means additional risks related to moving and securing bits of paper.

Anyone else remember...

[TheCarp]

A while back someone did some research and published it on keystroke logging via audio capture. They found they were able to reliably determine what someone was typing just from the sound of their typing. I have to imagine that would work here.

http://www.berkeley.edu/news/media/releases/2005/09/14_key.shtml

Though, maybe they also run white noise generators in the office?

Protect the ribbons

[T.E.D.]

In this modern era many people forget that typewriters had a *huge* security hole. The ink ribbons they used, in the right hands, were practically a "tape backup" of everything typed at that typewriter.

Re:Physical access?

[Bill, Shooter of Bul]

Stuxnet jumped the air gap just fine via jump drives and other sneakernet tech.

The ultimate vulnerability

[gmuslera]

... is always people. Even if is just by stupidity (like going to one of those meetings with a cellphone), but could be plain malice, double agents or blackmailed "safe" people (and with all the data of the world you have plenty of material to blackmail anyone).

And thats the most worrying thing about NSA and associates snooping, you are getting 5 millon extra vulnerabilities in everything that surrounds all your data.

Now all you need are two typewriters that are...

[aristotle-dude]

joined by quantum entanglement and you can send messages across vast distances like they do in Fringe across universes.