Schneier on Security

Benni • August 16, 2014 8:59 AM

By the way, I really think that this new reportings from Appelbaum and Poitras over Hacienda, Mugshot, Olympia, ORB should get its own thread

http://www.heise.de/ct/artikel/NSA-GCHQ-The-HACIENDA-Program-for-Internet-Colonization-2292681.html

where they report that NSA/GCHQ and others are breaking into thousands of computers worldwide just to use them as plattforms for their attacks.

“Figure 8 points to a particular role that HACIENDA plays in the spy club’s infrastructure, namely the expansion of their covert infrastructure. The top secret documents seen by Heise describe the LANDMARK program, a program by the Canadian spy agency CSEC which is used to expand covert infrastructure (Figure 17).

The covert infrastructure includes so-called Operational Relay Boxes (ORBs), which are used to hide the location of the attacker when the Five Eyes launch exploits against targets or steal data (Figure 18). Several times a year, the spy club tries to take control of as many machines as possible, as long as they are abroad. For example, in February 2010 twentyfour spies located over 3000 potential ORBs in a single work day (Figure 19). However, going over the port scan results provided by HACIENDA was considered too laborous (Figure 20), so they programmed their OLYMPIA system to automate the process (Figure 21). As a result, the spies brag that they can now locate vulnerable devices in a subnet in less than five minutes (Figure 22).”

“Thus, system and network administrators now face the threat of industrial espionage, sabotage and human rights violations created by nation-state adversaries indiscriminately attacking network infrastructure and breaking into services.

Such an adversary needs little reason for an attack beyond gaining access and is supported by a multi-billion dollar budget, immunity from prosecution, and compelled collaboration by companies from Five Eyes countries. As a result, every system or network administrator needs to worry about protecting his system against this unprecedented threat level.
In particular, citizens of countries outside of the Five Eyes have, as a result of these programs, greatly reduced security, privacy, integrity and resilience capabilities.”

Benni • August 16, 2014 1:02 PM

@Gerard van Vooren:

“If you play with fire you can get burned. Still this is not comparable with the NSA deliberately and targeted wire tap the phone of Merkel.”

No, this is worse that with Merkel’s phone. BND here caught all phone conversations from an aeroplane accidentially, and accidentially all phone conversations to palestinians…..

If you target a politician deliberately, as the NSA did with Merkel’s phone, then this is way better than just creating a net where every phone call in an entire region is monitored, where you by accident find some politician….

This finding just receals that, when it comes to bulk surveillance of phone calls, BND is up to date, and on par with NSA.

If you believe the information that BND intercepted these calls “accidentially”. BND typically lies. And saying “well that was just an accident” could be a rather stupid excuse.
NSA agents still wonder how BND could intercept Hillary, since normally, these politicians talk over NSA encrypted lines. The question is whether Hillary accidentially switched over to an un-encrypted phone (woman on the phone… completely out of control), or whether BND can indeed crack NSA encryption on the fly, or if BND placed Bugs in Hillary’s blackberry to achive this.

There was this statement of the german government, when a parlamentarian asked them whether BND is able to “decrypt encrypted communication like ssh”. The answer was, “the technology of BND is capable of this, depending on the encryption strength”

Benni • August 16, 2014 6:03 PM

was this already mentioned at this blog?

https://citizenlab.org/2014/08/cat-video-and-the-death-of-clear-text/

Where Hacking team used youtube to distribute malware?

@sena kavote
Regarding Ukraine:

Well it all started when large gas fields in western ukraine were found. In 2013, Yakunovitch made the contract with chevron, to exploit the field with 7 billion dollar investments, and he said that this should render Ukraine independent of russian gas until 2020.

http://www.klimaretter.info/energie/nachricht/14980-ukraine-will-gasexporteur-werden

In 2009, the Ukrainian environmental ministry announced that they have found the largest shale gas reservoir that men have discovered in the world. This reservoir is in the Donezk area, at the same spot where these rebels now are…

Germany is currently creating technology to get massive amounts of energy from windmills on the ocean. The german government says that in 2050, the amount of electrical they get from this will be so huge that they can use it to generate heat, and become completely independent of russian gas.

http://www.spiegel.de/wirtschaft/soziales/erdgas-aus-russland-unabhaengigkeit-mit-forcierter-energiewende-a-984265.html

So russia is facing the loss of most of its gas customers.

At the same time, Ukraine even could want to get incorporated into Nato. For russia this is a strategic problem. Nato has encircled russia with a missile defense system. It makes not much sense that this is deployed against iran, since it would become known if that country tests large intercontinental missiles. One reason for bringing this system up could be that there is a danger of a terrorist in chechnya, going to a russian rocket base, and firing a shot. Or there are other countries near russia that developed short range missiles who would want to attack western countries. The problem with this nato system is that it would also forbid russian missiles to start if the nato did not allow this previously.

Now many parts of russias intercontinental weapons, the motors of its army ships, and the motors of its helicpoters are made in ukraine.

If Ukraine gets into nato, then russia can a) not start any missile without nato allowing it, and b) russia would get much of its military gear from nato. At that point, it could basically “surrender” and it would be forced into nato since there would not be any alternatives left…

Nato does not take instabile countries as its members. That is one reason why russia tries to destabilize Ukraine.

And it wants to take most of Ukraines oil and gas fields, since russia has to fear to be cut off from its main financial income, with ukraine replacing russia as gas exporter for europe.

Even without the ukrainian gas fields, the technology that is currently developed in germany implies a severe reduction in gas imports. The only way to get around this for russia would be to get every friendly help from europe it can get to develop its industrial society. It should have tried to get contracts with the ukrainian gas fields in a peaceful manner through bidding.

It seems russias government has chosen the short sighted, aggressive path instead (following the example in georgia where russia staged a war and invented the non recognized state abchasia, with which rosneft then made its oil contracts two years later). Now russia will face sanctions, lose any part of the largest gas fields in the world, lose the service for many of its atomic weapons and army gear, and in 2050, it has to face that europe will not want its gas anymore…

As from an IT perspective, the war in Ukraine shows that one does not need any surveillance.

Nato has its disguised warships there, they are equipped with rockets, as a disguise, but they do not shoot. Instead these ships probably have huge signals intelligence antennas, probably monitoring every radio call…

But why need this, when russian agents put their gps coordinates on instagram: http://arstechnica.com/tech-policy/2014/08/opposite-of-opsec-russian-soldier-posts-selfies-from-inside-ukraine/
or when they tell to social media that they shoot down an aeroplane:
http://www.businessinsider.com/igor-strelkov-comments-on-malaysia-mh17-2014-7 or when they just tell everyone on youtube from where they get their “1200 fighters along with 150 vehicles from which 30 are tanks”…..

The spying business comes from the middle age, where people rarely communicated, and decisions were made in silent castles, without connection to the world around.

Recently, the rules for the resolution of commercial satellites were lifted. It can be assumed that we will get real live streams of the world in 50 years or so. Perhaps in 50 years, tank movements can then be watched by everyone in realtime on google maps.

The secret services were not able to predict the invasion at crimea. As they were not able to predict 9/11 or the collapse of the GDR.

So at the moment, the only real use of these secret services for governments is their ability to monitor battle fields in real time from their spy satellites.

And soon even this ability will become obsolete. As did their monitoring of phone calls, that apparently can well be replaced by watching youtube and reading twitter….

Benni • August 16, 2014 6:45 PM

In fact, real live video of objects 30cm in diameter is the future of google maps:

http://www.independent.co.uk/life-style/gadgets-and-tech/news/skybox-google-maps-goes-realtime–but-would-you-want-a-spy-in-the-sky-staring-into-your-letter-box-9553934.html

Benni • August 16, 2014 9:52 PM

german officials begin to use weaseley language:

Merkel said: Spying among friends, this is unacceptable.

Now german officials say:
http://www.spiegel.de/politik/deutschland/bnd-affaere-regierungskreise-rechtfertigen-ueberwachung-der-tuerkei-a-986508.html

“In recent years we never said that such statements can be applied to all Nato countries”. “Turkey is not comparable to France, Great Britain or the US.” “Additionally it is known that Turkey tries to achive political goals over turkish clubs and associations in germany…” (implying that turkey would have its own spies in germany….

And then we have conserative german parlamentarians who say: “automatic deletion of accidentially monitored phone calls from politicians, this would be way too nice”….

Meanwhile, the german federal tv says in its news that Hillary and Kerry would not be single exceptions but BND “accidentially” monitored several american politicians when they went into its large surveillance network….

http://www.tagesschau.de/inland/spionage-123.html

Perhaps they should announce that “from now on, Kerry is no longer monitored, but that exception does not hold for any other politician in america or elsewhere”

By the way, the russians installed a large unserwater cable to connect russia with crimea.
http://www.heise.de/newsticker/meldung/Neues-Unterseekabel-verbindet-die-Krim-mit-Russland-2293510.html

the german computermagazine c’t writes that before this, crimean internet connection to russia went over Ukraine, then to De-Cix in Frankfurt germany and finally to russia…..

(as admitted by the german government in an answer to a parlamentarian, all providers with a foreign bridge head have to “provide a complete copy of all communications to BND and it was admitted by de-cix that it is among these)….

Crimea, de-cix, russia, that was fine trafficshaping by BND…..

If the russians now cut that route then BND does not get its fulltake anymore from Crimea.

However, the germans have submarines that can dive in waters of only 17 metres depth. Unfortunately, these submarines have no equipment to tap fibers, like this american submarine Jimmy Carter. Perhaps NSA wants to help their colleagues some equipment….

Benni • August 17, 2014 9:08 AM

Now the authorities from turkey get angry about germany’s BND

http://www.spiegel.de/politik/ausland/bnd-spionage-in-der-tuerkei-ankara-veraergert-ueber-deutschland-a-986528.html

“This is unbelievable how germany threats turkey” and the turkish politicians think about upgrading their own intelligence in germany

Benni • August 17, 2014 12:54 PM

@Ukrainian:

“We have had a massive influx of dross pro-russian propaganda on forums & other www resources alike here. Crude and obvious, at the same time naughty and very obnoxious, trying to propagate their ideas, to deceive and disinform, to smear someone they don’t like etc.”

In german forums and comment sections of news sites this is the same.

It is completely stupid propaganda, sometimes one thinks that these sockpuppets do not have brains. Spiegel online has a facebook page there. On every Ukraine posting it gets masses of comments. But Ukrainians do similar things. Look at the facebook page of poor angela merkel:
https://www.facebook.com/AngelaMerkel

now the comments are more intelligent than before, where it was flooded with comparisons of merkel and nazis

http://www.spiegel.de/netzwelt/netzpolitik/ribbentrop-vergleiche-ukrainer-beschimpfen-merkel-bei-facebook-a-981222.html

In 2011 the guardian revealed that the united states have a sockpuppet software that generates pro american comments in social media and comment sections and forums:

http://www.theguardian.com/technology/2011/mar/17/us-spy-operation-social-networks

the russians apparently thought, “hey, that is good” and then sueddeutsche revealed that these pro russian comments which appear on all german forums massively, are being made by paid propaganda companies paid by fsb and kremlin.

http://www.sueddeutsche.de/politik/propaganda-aus-russland-putins-trolle-1.1997470

This means that the internet, these days, is not only getting militarized in secrecy from various intelligence agencies, but it is also used for psychological warfare in the open, as a plattform to massively spread propaganda, from many countries. With deliberate “leaks” on youtube, intelligence agencies even have used the internet to destroy political careers:

http://www.youtube.com/watch?v=6RxSzSWbcxo

When tymoshenko here says that she wants to kill russians with atomic bombs, one should imagine these fsb analysts hearing this, knowing that ukraine repairs russian intercontinental weapons:
http://www.washingtonpost.com/world/europe/ukraine-factories-equip-russian-military-despite-support-for-rebels/2014/08/15/9c32cde7-a57c-4d7b-856a-e74b8307ef9d_story.html?tid=pm_world_pop

But of course they cut off the transcript then, nevertheless at the end of the recording it still comes clear that tymoshenko just said this in anger, and the ukrainian politicians in the phonecall really just agreed that they want to go to international court, which is an entirely different thing than throwing atomic bombs…

So the internet is even used by intelligence services to destroy unwanted politicians….

NSA whistleblower Binney says that these american generals, Petraeus and Allen, criticised Obama for his belief that the terrorists would have been defeated after the death of Osama bin Laden. This was part of Obamas election strategy. Binney says that then suddenly the NSA databases were searched for compromising emails. These mails then were leaked and the unwanted generals were fired:
http://derstandard.at/2000004396198/Ex-NSA-Agent-Bill-Binney-Wenn-die-Sie-kriegen-wollen

This is not the internet anymore that I like.

You say something on the phone or in an email and then this is used by worldwide agencies to destroy your career….

Newspapers are flooded with propaganda made from paid agents..

And intelligence agencies try to get into as many computers of innocents as they can (see the comment above on Haicienda), just in order to find a host from where they can attack their real targets.

They hack into civillian infrastructure (see the snowden interview at wired)

And on top of that they develop systems that can attack computers automatically (see the snowden interview on wired about monstermind)….

Benni • August 17, 2014 5:46 PM

this gets off topic, but this nonsense what skeptical says here is easy to debunk:

@Skeptical:
“The importance of Ukraine to Russia is only partially captured by implications for the natural gas market in Europe. Most of the importance of Ukraine to Russia is a result of history: certain influential Russians, including Putin, regard the collapse of the Soviet Union as a monstrous defeat enabled by the mistakes of weak leadership; they view Ukraine as properly part of Russia, and former Soviet republics generally as areas that Russia rightly ought dominate and control.”

That is history bla bla….

Putin has a phd, which is mainly a copy of someone else’s thesis. But it is not in history, but in mining of natural resources (how to properly mine coal, oil, gas and so on). Somewhere his hobby collecting “geological cards” was mentioned…

Please note Putin’s own words. He said “The collapse of the Soviet Union was the largest geopolitical catastrophe”….

He does not say “social catastrophe” or just “political catastrophe”. So this is not just about politics (as a mere influence sphere would be). It is about geology and politics. And from the perspective of russia, it certainly IS a catastrophe that with the blink of an eye, large oil and gas fields, including one of the pipelines that controls most of the worldwide oil resources (that is this line in georgia), where just next to russias border now. Today oil ang das make up russias income. And Putin also said that he thinks the primary function of the state is that it should prevent people to get poor. So yes, if you loose most of your income resources with a blink of an eye, that is a catastrophe, at least from the view of someone who did his phd in natural resources, like putin. Would it not have collapsed, the soviet union would control the world’s largest shale gas field, the worlds most important pipeline and so on….

It was the same with georgia. An independent european commission found georgia to be the initial aggressor.
http://www.ceiig.ch/pdf/IIFFMCG_Volume_I.pdf
http://www.ceiig.ch/pdf/IIFFMCG_Volume_II.pdf
http://www.ceiig.ch/pdf/IIFFMCG_Volume_III.pdf
But it also noted that russia overreacted. After its intervention, russia then recognized “abchasia”. One year later, rosneft was exploring the 2500 square kilometres large oil field in “abchasia”… so much on russias interest in history or some nonsense:

http://de.ria.ru/business/20090812/122673652.html

If russia would not have “over reacted”, that contract would have been given to an american oil company, because at that time, a corrupt US president, george w. bush, a former oil company employee, was in charge, and bush massively invested in the military and government of georgia…..

It should be noted that I think oil fields should at best be explored by domestic oil companies, not by some foreign company from far away, which bribes politicians with financial support, in order to create the necessary social network for buying an oil field.

That behavior of america probably was not of the russians liking. For similar reasons, russia strongly opposed Bush’s intervention in Iraq. Formerly, Iraq used to be a russian oil trade partner.

This american intervention to secure Iraq’s oil fields made russia very sceptic of NATO. Whereas Putin asked the american president, to further stay in Afghanistan, the russians probably see many NATO operations very skeptical and view it sometimes like an armed helper force which tries to “secure” oil fields in Iraq, or Libya, and in a way which brings these countries close to failure. This seems to have some truth because recently, Libya authorities said at some UN panel that libya was becoming a failed state…

However, russia does not see the nato entirely as some threat. In 2009, russian officials said that russia itself could once join nato: http://euobserver.com/defence/27890 In 2000, even Putin himself said so: http://en.wikipedia.org/wiki/NATO%E2%80%93Russia_relations#Current_relations

It makes not much sense to say you want, someday, be part of Nato, and on the other hand, claim to see Nato as a threat and to fear Nato warships close to your border at the black sea.

Russia recently bought helicopter carriers from France. Such ships must be serviced, which russia can not do properly. It makes no sense, to buy warships and their service from an enemy.

The fact that Ukraine, which serviced the intercontinental rockets of Russia might join Nato, could of course, have raised concerns in russia, as with any nuclear power whose strategic missiles suddenly would get manufactured by another military block.

But since russia even started to buy its war ships from nato, this is a bit unconvincing. Why be in sorrow from Nato ships at your border, when you just buy some of them?

If one recognizes this, then, suddenly, the gas fields at crimea remain as the only reason for russias recent behavior.

The russians probably fear to loose any part in the economic opportunities that these large shale gas fields in eastern europe represent. And they think that the nato ships in the black sea are helping americas oil companies with that.

Many of these gas fields are at Crimea and in the sea of Azov. With the annexion of Crimea, Rosneft overtook them all.

Russia also announced sanctions to the republic Moldowa some years ago in 2012. But why? Well they said:

http://www.euractiv.com/europes-east/russia-moldova-chose-cheap-gas-e-news-514769

“Russia told impoverished Moldova yesterday (12 September) to choose between low-priced gas from Russia and its pledge to adopt European energy liberalisation measures opposed by Moscow, which is girding for a conflict with Europe over natural gas.” The energy minister from russia said: “First of all, we propose that Moldova denounce the protocol on entering the Europe energy community agreement. This is a precondition for us to discuss the issue of gas price cuts and the relief of debt, which at the moment amounts to $4.1 billion [€3.17 billion],” Russian Energy Minister”

By liberating the energy market in Moldowa, foreign companies from us and europe could buy Moldowan energy companies. Thereby they would put russia further out of the european energy market, because in Moldowa, there is shale gas too, and oil, and much of it, if you see at these presentations:

http://canyonoilandgas.com/Presentations/Canyon%20December%202012%20Presentation.pdf
http://canyonoilandgas.com/Presentations/Canyon%20August%202013%20presentation.pdf

“Canyon will begin to develop the East Valeni Field in 2014”

Apparently, the russians carefully studied their geological cards. This is not just simple aggression, of people who want to dominate their surroundings. What the russians are doing here is that they just react in the most stupid way when they have to fear to loose all their current income, which is currently from oil and gas.

Putin’s eurasian union contains Kazakhstan. There too, are large gas and oil fields: http://de.wikipedia.org/wiki/Gasfeld_Karatschaganak

Benni • August 18, 2014 9:46 AM

This should be interesting for Edward Snowden:

http://www.spiegel.de/netzwelt/web/cyber-bankraub-ercan-findikoglus-anwalt-im-interview-a-986061.html

The germans captured a hacker, who robbed 40 million dollars from US banks.

In the US the hacker is facing a sentence of 250 years. Now the hacker’s lawyers go to germany’s highest court to prevent the extradition to the United States. They say that germany’s highest court has argued before that german authorities have to be extremely cautious with extraditions to the US, because of the known low juridical standards in america, and since a sentence of e.g. 250 years would be against human rights….

If the german government is not even allowed to extradite someone who robbed 40 millions of a bank to the United States, then extradition of Snowden, should he touch german ground, is entirely off the table, given that extraditions because of political crimes are forbidden by german law.

Benni • August 18, 2014 10:58 AM

Here is an interesting comment about FinFisher:

https://netzpolitik.org/2014/gamma-finfisher-gehackt-werbe-videos-von-exploits-und-quelltext-von-finfly-web-veroeffentlicht/#comment-1569882

“33,2 GB from the hacked files are encrypted with a pgp key from “afons.rauscher@vervis.de”. Apparently this is an employee from FinFisher. But according to Wikileaks, Vervis GmBH has licensed surveillance software 2010 from Gamma International. Vervis Comint Services GMBH are based in Rosenheim, this is only 10 kilometers away from Bad Aibling, where BND operates its large listening station. Finfisher itself is developed by GammaGroup international which has its headquaters in Munich, only 10 suburb train minutes away from Pullach, where BND has its headquaters. Are the FinFisher GMBH as well as the companies licensing this technology really front companies of the BND? That BND owns numerous front companies from which it earns money is long known….”

Yep that definitely sounds like BND. Offering spyware to Bahrain, with BND backdoors included, would enable BND to get data on Bahrain dissidents, possibly islamists, and if the Finfisher software is backdoored well enough, BND would have an entry door to hack Bahrein…

BND similarly went to selling products before. I have explained before how BND tried to sell its partially stolen database software to europol:

https://www.schneier.com/blog/archives/2014/06/more_details_on_1.html#c6672979

You want to buy the “Langenscheidt t1” translator software?

http://langenscheidt-t1-englisch-pro.softonic.de/

that was the only product sold by the BND company GMS, which acquired the language software metal from siemens. That way BND could let GMS be swallowed by Learnout and Hauspie, which they then over-hyped at the stock market so that BND could get its hands on the american language companies dictaphone and dragon….

http://www.heise.de/ct/artikel/Die-Bayern-Belgien-Connection-284812.html
In this link there is even a video where learnout admits of working for BND
https://netzpolitik.org/2013/deutsche-forschungen-zu-spracherkennung-fuer-us-geheimdienste-erinnern-an-lernout-hauspie-den-bnd-und-europol/

So the BND selling the surveillance software FinFisher to Bahrein, that would be quite the typical BND style of operations….

Hacking team is an italian company. With BND even running the management of crypto hardware manufacturers in switzerland for introducing backdoors http://cryptome.org/jya/cryptoa2.htm it would not be a surprise when they also run italian malware manufacturers. But today there is no information confirming this. Although distributing malware over youtube would be of their liking…..

Benni • August 19, 2014 8:23 PM

The US Nuclear Regulatory Commission was hacked

http://www.nextgov.com/cybersecurity/2014/08/exclusive-nuke-regulator-hacked-suspected-foreign-powers/91643/

And in fact this seems to be one of the rare cases where hacking was a reasonable thing.

This comission is responsible for creating reports of nuclear accidents.
And one is interested in these especially, if one buys US nuclear reactors.

In fact china is currently buying large amounts of american nuclear reactors:

http://www.reuters.com/article/2014/04/21/china-nuclear-idUSL3N0ND1GS
20140421

“China seen buying Westinghouse reactors for $24 billion nuclear
energy projects”

Nuclear accidents are often kept secret by plant owners. The chinese apparently have doubts on the official reports on safety of these reactors and so they hack into the authority that monitors the accidents of these plants.

The sad thing is that this is a very reasonable concern.

Currently two belgian reactors are offlinbecause the steal of their reactor pressure vessels had severe defects. The belgish investigation comission found that the reason for these defects were problems that occured during production of these vessels.

The problematic thing is that these reactors were assembled according to american standards. 18 reactors in America and Europe were manufactured in the same way.

However, their operators seem to have a another idea of security. Therefore they do not shut these plants down in these countries http://www.spiegel.de/wissenschaft/technik/rsk-deutsche-akw-nicht-von-materialfehlern-in-belgien-betroffen-a-867595.html

Apparently, in america, it is quite OK if a nuclear reactor is manufactured in a way that it will develop, after 30 years of regular use, thousands of fissures (that is why the belgian plants have been shot down)…..

If I would be a government who wanted to buy reactors from an american company, I would hack into the nuclear regulatory comission too, just to ensure that I am not being lied at by the manufacturers, when it comes to safety issues.

And I urge the government, or who ever hacked into the US Nuclear Regulatory Commission, to release all data on nuclear accidents and safety issues of US nuclear plants in full to the public on the internet.

Any data regarding safety problems of nuclear power plants should be in public domain. Only if the people living around these plants are knowing exactly how secure they are, can they chose to move somewhere else if a reactor has permanent accidents.