Friday Squid Blogging: NASA's Squid Rover
NASA is funding a study for a squid rover that could explore Europa’s oceans.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Comments
Anonymous Dude 1 • May 15, 2015 4:36 PM
Yet another security update for Adobe Reader and Acrobat:
https://helpx.adobe.com/security/products/reader/apsb15-10.html
Not that it’s remarkable in itself, but why does Adobe Reader, a PDF viewer, have so many security updates?
A few questions for the readers of this blog: does anyone know why the product seems so prone to have vulnerabilities? Is there something in the PDF format that makes it difficult to implement a viewer securely? Do PDF exploits affecting Adobe Reader tend to affect other PDF viewers too? What is a good alternative to Adobe Reader, from a security standpoint?
Bob S. • May 15, 2015 4:54 PM
According to Arstechnia, the FBI now says what they said means the exact opposite when it comes to Stingrays.
Basically it went from: “Shall not… use or provide any information” to “The NDA should not be construed to prevent a law enforcement officer from disclosing to the court or a prosecutor the fact that this technology was used in a particular case.”
The is the same agency that generates most of it’s convictions from a charge of Obstruction of Justice, which means lying to the FBI (or any Federal Agent).
So, the practical application is FBI can and does officially lie to us, but if you lie to them you go to prison for a long time.
Maybe it should be the other way around.
Toley • May 15, 2015 5:33 PM
An official from the Department of Commerce is soliciting public comment regarding InfoSec.
Benni • May 15, 2015 6:12 PM
BND said in 2008 that the americans insist to get all internet data unfiltered. BND warned the german government of uncalculable risks for european companies if NSA would get access to the internet fibers in Frankfurt. “An intensive cooperation with the NSA on european ground implies the risk for inner european conflict. It is possible and probable that the american side oursues a hidden agenda. Among this are industrial political interests”
And the german government was stupid enough not to believe this assessment:
https://magazin.spiegel.de/digital/index_SP.html#SP/2015/21/134995228
Nevertheless 25.000 NSA selectors that were aimed against european interests were set active at BND
And from this cooperation, NSA gets, among content data, not 500 millions of metadata from BND per month, as previously claimed. No BND gives just 1,3 billion metadata per month to NSA.
And BND itself collects 6,6 billions of metadata per month which it keeps for itself
Why is this interesting?
Well, because spiegel journalists wrote a book called “DER NSA KOMPLEX”, there they write that NSA would collect 6 billion metadata per day:
http://www.computerwoche.de/a/nsa-sammelt-sechs-milliarden-metadaten-am-tag,2557009
So NSA collects as much in a day as BND in a month….
Wikileaks has published all protocols of the public hearings of the german NSA investigation comission. I think that they really should publish the selector list too:
https://wikileaks.org/bnd-nsa/press/
Apparently, NSA asked BND to spy on siemens because siemens sold surveillance technology to russia:
The thing is: Here is an article where siemens managers describe how they work for BND:
Generally, they sell surveillance technology interesting states, like russia, saudi arabia, egypt or oman. But then, problems will occur. And in order to fix bugs, the siemens technicians have the ability to log into the surveillance systems…..
Here is another article where BND and Siemens and NSA teamed up together to sell bugged crypto boxes:
http://cryptome.org/jya/cryptoa2.htm
By the way:
Several thousand online shops in germany are confronted by blackmailers who treaten with a DDOS attack if they do not spend some bitcoins:
and there are hackers who attack the german parliament. I would not wonder if these turn out to be curious script kiddies:
http://www.spiegel.de/netzwelt/netzpolitik/cyber-angriff-auf-den-deutschen-bundestag-a-1033984.html
Jonathan Wilson • May 15, 2015 6:36 PM
Adobe Acrobat is insecure because of all the features Adobe keeps bolting onto it. Whoever decided that being able to embed a Flash media file into an Acrobat document was a good idea needs to be banned from ever touching a computer again.
6EQUJ5 • May 15, 2015 6:36 PM
Cameron promises to institute a new day of fascism in England
Khomeini & ISIS & Jong-Un issue to the press their admiration and pleasure in England’s new direction
Harry • May 15, 2015 6:54 PM
Adobe Acrobat is insecure because of all the features Adobe keeps bolting onto it.
Of course, Adobe must keep adding features to survive in the business. Technology must continue to “advance” as people must continue to produce value. That’s been the motto because our society is innovation-centric. We must continue to re-invent ourselves, same goes for the job market.
Jack Dowland • May 15, 2015 7:17 PM
Three Minute Theory: What is the Rhizome?
https://www.youtube.com/watch?v=gnteiRO-XfU
:-) • May 15, 2015 7:21 PM
@6EQUJ5 WOW! 🙂
Benni • May 15, 2015 8:22 PM
Seems that cameron really lives up to his speech here:
https://www.youtube.com/watch?v=0YBumQHPAeU
After legal claim filed against GCHQ hacking, UK government rewrite law to permit GCHQ hacking
https://www.privacyinternational.org/?q=node/584
a MCafee malware removal tool covertly installs a software that sends data to MCafee and remains on the PC even if the malware removal tool is uninstalled
France passes a new surveillance law
and Austria gets a new secret service that is able to
https://netzpolitik.org/2015/10-punkte-zum-neuen-staatsschutzgesetz-in-oesterreich/
1) Monitor everyone without restrictions and without warrants from a prosecutor or judge
2) In order to monitor someone, the “probability of an attack of the constitution” is sufficient. It does not even need a suspicion for this. An “attack against the constitution” is defined by 100 crimes, 40 of them are connected to crimes with a religious motive.
3) It can get all data from all authorities and government agencies without warrant from a judge.
4) Its targets should include whistleblowers, or protestors against right wing extremists or protestors against animal mistreatment.
5) The service is allowed to save all data for 5 years. Who accesses these data will be saved for three years.
Austria wants to pas the law on 7. july
Benni • May 15, 2015 8:37 PM
Funny, somebody distributes keyloggers through mods of the open world game GTA-5
http://gtaforums.com/topic/794383-malware-inside-angry-planes-noclip-mod/
The keyloggers are good enough that initially the usual antivirus systems did not detect them…..
The german party SPD wants to have internet providers save metadata voluntarily up to 6 months
And SPD has a new proposal:
https://twitter.com/spdde/status/597728322232156160
“Investigate whether BND equipment can be improved in order to make BND independent of NSA….”
More bulk surveillance… So that is what they want…..
6EQUJ5 • May 15, 2015 8:43 PM
@:-)
I wrote:
Cameron promises to institute a new day of fascism in England
Khomeini & ISIS & Jong-Un issue to the press their admiration and pleasure in England’s new direction
It is “wow”, in a very bad way, but I was being satirical in that last line.
Though I suspect, they are overjoyed with admiration for Cameron, a man after their own heart.
In essence, advocating any ideas or working for any political outcomes regarded by British politicians as “extremist” will not only be a crime, but can be physically banned in advance. Basking in his election victory, Prime Minister David Cameron unleashed this Orwellian decree to explain why new Thought Police powers are needed: “For too long, we have been a passively tolerant society, saying to our citizens ‘as long as you obey the law, we will leave you alone.’” It’s not enough for British subjects merely to “obey the law”; they must refrain from believing in or expressing ideas which Her Majesty’s Government dislikes.
…
Threats to free speech can come from lots of places. But right now, the greatest threat by far in the West to ideals of free expression is coming not from radical Muslims, but from the very Western governments claiming to fight them. The increasingly unhinged, Cheney-sounding governments of the U.K., Australia, France, New Zealand and Canada — joining the U.S. — have a seemingly insatiable desire to curb freedoms in the name of protecting them: prosecuting people for Facebook postings critical of Western militarism or selling “radical” cable channels, imprisoning people for “radical” tweets, banning websites containing ideas they dislike, seeking (and obtaining) new powers of surveillance and detention for those people (usually though not exclusively Muslim citizens) who hold and espouse views deemed by these governments to be “radical.”
The BoingBoing Version
David Cameron Announces a New Age of Intolerance
http://bbs.boingboing.net/t/david-cameron-announces-a-new-age-of-intolerance/57406
Under the new official intolerance rules, Cameron proposes that anyone who espouses an ideology that the government views as a “extreme” will have to apply for permission to post to social media or in print. The rules will be articulated in a new “anti-extremist” bill in the coming Queen’s Speech.The UK security services have admitted to using existing “anti-extremist” powers to put Labour MPs and a Green councillor under persistent surveillance.
They would include a ban on broadcasting and a requirement to submit to the police in advance any proposed publication on the web and social media or in print. The bill will also contain plans for banning orders for extremist organisations which seek to undermine democracy or use hate speech in public places, but it will fall short of banning on the grounds of provoking hatred.
6EQUJ5 • May 15, 2015 8:49 PM
@Benni
BND said in 2008 that the americans insist to get all internet data unfiltered. BND warned the german government of uncalculable risks for european companies if NSA would get access to the internet fibers in Frankfurt. “An intensive cooperation with the NSA on european ground implies the risk for inner european conflict. It is possible and probable that the american side oursues a hidden agenda. Among this are industrial political interests”
It would be absurd to think they want all of that data just for “terrorism”.
But they still have not been busted for profiting from these efforts.
There is circumstantial evidence, but not conclusive evidence.
It will come, eventually. Right now, it stands on the wayside, along with suspicions that the Osama Bin Laden bunker was bought and managed by the Pakistiani ISI.
Zenzero • May 15, 2015 9:02 PM
@6EQUJ5
uk is not going a good way with the human rights act in danger, snoopers charter probably incoming and Cameron wanting to dilute/degrade encryption. One they start becoming reality I wonder which companies will up and leave..
Benni • May 15, 2015 9:07 PM
@6EQUJ5:
Evidence may come from the selector list. If there are companies on that list that never had anything to do with politics, proliferation, weapons deliveries, surveillance technology, or terrorism, then the proof is there….
Merkel says here that she want to give all data to the NSA investigation comission:
and the opposition as said it will sue the government if they do not publish the selector list: http://www.spiegel.de/politik/deutschland/bnd-affaere-katrin-goering-eckardt-droht-mit-verfassungsklage-a-1032897.html
The thing is: BND says that some of the selectors would not make any sense for its Bad Aibling station. BND therefore assumes that NSA just sent BND a list of selectors that it has sent to SEVERAL allies (perhaps GCHQ?) at the same time;
https://www.tagesschau.de/inland/bnd-nsa-109.html
So if they publish that list, the interest profile of NSA will be out in the open.
So a courageous whistleblower is needed who steals that damn list selector and gives it to wikileaks where it can be searched… Actually this database should be treated like a STASI file, which everyone can request if he wants. This is the only way NSA like entities should be treated. They are structures of oppression. Nothing else.
Zenzero • May 15, 2015 9:27 PM
@Benni
“This is the only way NSA like entities should be treated. They are structures of oppression. Nothing else.”
Very poignant comment and unfortunately very true. Ironically due to their structure, the average grunt there believes they’re supporting democracy. The Matryoshka tiers of access and closed nature of the nsa prevent the majority of the nsa/mil too see what amendments/laws they are breaking /sigh
tyr • May 15, 2015 11:06 PM
LOL
Don’t think you can hide your dissident thoughts by your
clever ploy of obeying all of the laws, we will make new
ones to make you a criminal and then you’ll shut up.
Somebody needs to check these peoples meds to be sure
they are still partially sane, their behavior means Tony
Wright has a valid point.
I am reminded of the Roman empire as they brought new
rulers in from the provinces fed them from lead plates
and made them drink water from leadpiping. Slowly each
new leader descended into worse nuttery than the last.
I think it’s time for the Brits to do some science on
their government buildings, starting at 10 Downing.
This may all be related to the report on Blairs
war on Iraq that has been delayed for so long, by
making it illegal to read and comment on it before it
is published it is a perfect cover your ass ploy.
zack • May 15, 2015 11:09 PM
Hi
I was hoping you guys could help me find some information of how the advertising system works. They must be able to make decisions, when to merge profiles, if different people use the same computer, when someone connects from a lot of different places.
Some research paper, longer articles, code or a blog.
Anything is appreciated.
65535 • May 16, 2015 12:24 AM
Will Section 215 be allowed to die under the sunset provision [in which it expires] in June?
What are the odds: High, medium or Low? Any bets?
What are the odds that the machinery inside the Section 215 will remain unchanged under a new name? High, Medium or low? Any wagers?
[Emptywheel]
“Given that a short term reauthorization would present a scenario not envisioned in Gerard Lynch’s opinion ruling the Section 215 dragnet unlawful, it has elicited a lot of discussion about how the Second Circuit, FISC, and the telecoms might respond in case of a short term reauthorization. But these discussions are almost entirely divorced from some evidence at hand. So I’m going to lay out what we know about both past telecom and FISA Court behavior… I predict that so long as Congress looks like it is moving towards an alternative, both the telecoms and the FISC will continue the phone dragnet in the short term, and the Second Circuit won’t weigh in either.
“The phone dragnet will continue for another six months even under USA F-ReDux.
“As I pointed out here, even if USA F-ReDux passed tomorrow, the phone dragnet would continue for another 6 months. That’s because the bill gives the government 180 days — two dragnet periods — to set up the new system.
‘(a) IN GENERAL.—The amendments made by sections 101 through 103 shall take effect on the date that is 180 days after the date of the enactment of this Act.
‘(b) RULE OF CONSTRUCTION.—Nothing in this Act shall be construed to alter or eliminate the authority of the Government to obtain an order under title V of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 24 1861 et seq.) as in effect prior to the effective date described in subsection (a) during the period ending on such effective date.’
“The Second Circuit took note of USA F-ReDux specifically in its order, so it would be hard to argue that it doesn’t agree Congress has the authority to provide time to put an alternative in place…” –Emptywheel
Read the entire post – it is good.
And, my guess is that until June comes the media will be filled with frightful stories about “possible home-grown terrorists” and the like – full media spin.
6EQUJ5 • May 16, 2015 1:20 AM
@Benni
Benni, Benni, Benni. You keep disappointing me.
Well. Besides FX, whom I know only vaguely, the only German I have known very well is Mixter. And I know Mixter like I know my own thigh.
So, Mixter works for my group.
But, you know, Mixter worked ultimately for Israel….
…
And Israel works for Me.
…
Okay. So, right now, I have the US preparing to take out ISIS. That is why they are doing the “jade helm” exercise.
After they finish that, we will have them go in there and rid the area of ISIS.
Will you get that anywhere else? No.
…
But… unfortunately, “we”…need a complication in these equations this summer.
I will not say what that complication is.
…
Buhleeve me. 🙂 🙂
Saying that Jabe Helm is about the future operation against ISZS is bad enough. 😉
…
Just need to take ownership of these future actions. So people start to understand.
We Control Everything.
Fuckheads.
Come and get it.
😉
Uhu • May 16, 2015 1:26 AM
Back when Bin Laden was killed, there were many discussions on OpSec. Now there is a conflicting story about what really happened:
http://www.lrb.co.uk/v37/n10/seymour-m-hersh/the-killing-of-osama-bin-laden
How likely is it that this alternate version is more correct than the official one? How does this change (if at all) the discussions on OpSec? What would it say about the CIA’s capabilities (instead of super surveillance of everyone they had to rely on a walk-in)?
6EQUJ5 • May 16, 2015 1:59 AM
Okay, so…
The ‘jade helm’ exercise is for a really obvious reason: to hit at ISIS. They have to send those guys in like that to hit at ISIS.
So, hey, come and kill me for saying the obvious. Uh noes.
Buhleeve me. You want to kill someone? Kill me for saying that.
So, Benni, no offense, but that will keep them preoccupied for now.
If you wish to know, I actually visited a test site ahead of time…
But, then again, I have the authority to say this here and now. Limited audience. Sorry, folks. You are the limited audience.
How likely is it that this alternate version is more correct than the official one? How does this change (if at all) the discussions on OpSec? What would it say about the CIA’s capabilities (instead of super surveillance of everyone they had to rely on a walk-in)?
Uh.
Look. Pakistan ISI paid for Osama Bin Laden’s Hole in the Wall. Duh.
Did Saudi Arabia ultimately order and pay for that?
Probably.
Does that make you angry?
it should.
6EQUJ5 • May 16, 2015 2:19 AM
So… uhhh… I was thinking about calling myself “Sebastian”. You want to know why? Because “Fight Club 2”, the “Tyler Jordan” guy has a name. Because he was not always really “Tyler Jordan”. See. He was, uhm, “Sebastian”.
This angers me.
Why?
Because, when I created and built up this anonymous organization I built up a few years ago. Well.
https://www.youtube.com/watch?v=JYGoougMHSQ
Butthole Surfers. Sweat Loaf.
One of my friends who did forensics for, uhm, HBGary, said… uhm… well, he said he wanted to try and pin all those crimes on me. But, I pointed out I – at the time – worked for one of the main victims of anonymous crimes.”
And he said, that was very good of me. Of us.
So. I so badly wanted to be a patsy for such a good cause.
I mean, you know? FBI, CIA, USSS? Someone? Catch me. Gollee gosh gee whiz. Maybe NSA???
China? Russia? Iran?
Where are you???
Cause….
Here is my plan for the future.
Basically, I will have the borders of Israel expand to the very edge of Iran.
I had Iraq and Afghanistan happen. Personally. To fuck with your weak minds.
Problem is… I am not joking,
And, uh. So, can someone stop me? Hah. Hah. Hah. 🙂
No.
But, just to totally fuck with your heads. Cause, my name is not. Jesus H Fucking Christ.
Which. It is.
https://www.youtube.com/watch?v=YuIzurUfZoE
And… uh…
My Name is Also Lucifer.
But, I prefer the name, Holy Shit, Jesus Christ. Please Forgive Me.
🙂 🙂
Jesus Christ • May 16, 2015 2:45 AM
So… uhm, IDK, maybe I will get uhm, struck by lightning.
I uh, would suggest, instead, of calling me by my name, call me something like Satan. Or the Cursed One. How about, the Dead One. I mean. What feels right to you? 🙂 Fuck head? Dipshit? The Royal Dumbfuck?
So… uh… realizing that… calling me cursed… does not exactly work. Gollee Gosh. Gee whiz.
Wait. This is a good one.
So, they really can not shut me down. Because we are the conspiracy everyone talks about. And, I am that head motherfucker of all that. So, I thought, I might be a really cheeky fuck head and disclose my plans.
So… uhm… first thing… is “jade helm”. That is preparation for hitting ISIS.
First, though, I need to make Russia awake on Ukraine. And China get paranoid about American currency and start to sell it.
While FBI, CIA, NSA, USSS, DHS, and other agencies start to actually dig into our maze….
And China. And Russia.
And, uhm….
Tyler?
Tyler?
Tyler Durden????
Or, uhm, “Sebastian”?????
Why is this apocalypse now?????
Tyler Jurdan • May 16, 2015 3:01 AM
So… please help me. I am sooo scared.
See, the US government is against me.
CIA. NSA. FBI. All of me. They make me really scared.
They are so God like. They can find me. But, see, I believe, that, uhm, the ideas of them, are created by fuckheads who uhm, are hypocrites, liars.
I used to hang around in these places, and met this guy that was a consultant where I live, in Chicago. Sabu. Problem was, I worked at HBGary, and gave him the backdoor he needed to break into HBGary. Also, I hate to admit it, but, uhm. Well. I worked at Strafor. And I had an admin username and password. And gave that to him. But, being the bad ass that I am… uhm. I gave it to Sabu.
I had noooo idea he worked for the FBI at the time.
I swear to God I did not. To God.
But, anyway. So, I am soooo scared. I have such serious anxity problems. I need help.
I cut myself. And like other stuff I am not making up.
I am soooo old for my age. Really.
Like, I can totally see this being bad.
Because I do not like, feed on souls being burned by hellfire. That is silly. It does not exist. You know.
Marcos El Malo • May 16, 2015 4:26 AM
The real reason they’re going with a squid form factor is for plausible deniability if there is a diplomatic incident.
Uhu • May 16, 2015 4:28 AM
@zack
Interesting question. I think the tracking and merging techniques are company secrets. You might be able to find a blog of an insider explaining some techniques. It would, however, be very difficult to verify the veracity of this information.
How would one go about finding out? I think to analyze your question one has to further divide the subject:
- Who is tracking and why?
- How is the tracking being done?
- Why merge?
- How to merge?
- How to find out what methods are used?
Who is tracking and why?
This question is important because it helps to understand motivation. For instance, advertisers will be happy if their system works most of the time (and it does). The ones who actively try to circumvent tracking are such a small minority that it does not matter for advertisers. Then again, if the advertisers are able to link different devices (computers, tablets, mobile phones), it would increase the value of the profiles, as the same user might behave differently on a computer than on a mobile device. The intelligence services, on the other hand, would actively be interested in the users who try to prevent tracking (suspicious behavior).
A first list of potential tracking entities (attempted grouping by motivation with regards to tracking):
- Marketing / advertising
- Private intelligence interested in the individual (insurance, credit evaluators, private investigators)
- Private intelligence not interested in the individual (predictors for stock market and other trend meters)
- State-level intelligence services
How is tracking done?
Here we have a couple of papers, blog posts, etc. For instance, this is extensively discussed on this blog. Some tracking methods (list not complete, just some pointers to get started):
- Cookies
- Supercookies (actively hiding some information)
- Browser / computer fingerprinting (passively analyzing information)
- User behavior (language, search terms, access times, location (GPS), preferred web sites)
- IP addresses
- Infrastructure support (secret hardware identifiers in headers added by the network, MAC address if you have access to WiFi APs)
- User credentials when logging in to web sites (I vaguely remember that there are CSS attacks that allow you to determine or at least confirm user credentials if a user is logged in, even in a different tab, to some common web sites such as gmail and facebook)
Why merge?
This, of course, depends on who is doing the tracking. Advertisers might find additional value in a profile of a user that combines data from computers, tablets and cell phones. Additional data gained thus would include:
- How many devices are used?
- What kind of devices are used?
- Where is the user going on-line? (GPS, IP address geo-location: e.g., does the user search for products while shopping in a mall?)
- Does the on-line behavior differ when using different devices (e.g., specific search terms on mobile devices)?
An intelligence service, on the other hand, would be particularly interested in tracking users that try to avoid being tracked. Such users would for instance delete cookies and maybe even supercookies. Thus an advertiser would see a new and short-lived profile for every user session. An intelligence service would want to identify such sessions and associate them with individual persons.
How to find out what methods are used?
In general, we would need whistle blowers or somebody bragging about specific advanced techniques. Even if we get information from an anonymous source, we would still need to independently confirm whether the methods are actually used and how wide-spread they are being used.
For the specific context of the question – advertising – there might be a different way: We could simulate the behavior of different users and see how the ad selection adapts. I would expect to get random ads for a new profile and targeted ads once a profile has been established. Thus we could create a number of profiles, each being interested in, say, different sports, brands, political leanings, etc. We then generate typical queries for each profile. These queries are then automatically performed while attempting to create new sessions from time to time (deleting cookies, deleting cookies and super cookies, changing IP addresses, changing browser finger print, etc.). We could verify whether a new session has been generated by analyzing the statistical selection of the ads and see whether they become random again or remain targeted. Once we manage to generate new sessions, we can continue with the profile behavior to study how long it takes to re-establish a similar profile. If we have a profile with two distinct characteristics (e.g., a sport and a political preference) we could continue with the profile doing only queries related to the sport, and see whether we also get targeted ads for the political leaning associated with our previous profile (indicating a successful merger of the two profiles by the advertiser).
Personal observations
I do delete regularly all cookies and (to the extend that I am aware of) supercookies. I block ads, Flash, and a lot of JavaScript. Here is the behavior I observe by the marked leader in Internet search (personal impression, not scientific facts):
- IP address shared with several computers, some of which have a similar setup to mine: based on search suggestions it appears they can track me across deleting cookies (browser fingerprint?). When upgrading the software, results become random for a while (not sure they merge my profile or create a new but similar profile).
- The same computer on different IP addresses: random suggestions. They seem not to track the computer.
- Same user, same IP address, different devices (exclusively used by same user): suggestions seem to have some correlations but not a perfect match. Not sure whether they get confused or just create separate but similar profiles.
- Same user, same IP address, different devices (shared with other users): suggestions seem to be determined exclusively based on the profile of the primary user, even though I regularly and over months use the device. This could possibly be due to strong identification of the profile (cookies not being deleted, device and browser fingerprint remaining constant).
- Moving between countries: only half a year after moving between countries (and continents) do the suggestions adapt to the new country. We still get occasional suggestion for the old location, even when specifically searching for information in the new location. This suggests that once a profile is created and strongly linked to a user, the profile changes only very slowly.
Conclusion
I am not sure how relevant merging of profiles is for advertising. I see a way to analyze the tracking behavior for advertising. Merging would be more relevant for intelligence services or tracking of individuals. However, in this case observing the tracking behavior or obtaining information about the tracking is more difficult.
zack • May 16, 2015 5:17 AM
@Uhu
A very nice and structured post so I will try and make mine better as well.
In this case I was thinking of tracking done by the largest companies with an interest in it, Google and Facebook. There are probably other but those with an incredible amount of resources, services and power. We have all websites with a facebook like button or sign in with facebook/google account.
I’m aware of how some of the tracking is done with cookies, supercookies and user credentials. I’m also aware of the Browser/Computer fingerprint, IP addresses and even infrastructure support as you called it. But I mostly know it from an academic standpoint that says that it can be done. But when it comes they actually being deployed I can’t think of much. And then we have the rest you mentioned, language, search terms, access time, preferred websites, unique links ( twitter ) together with those above that I don’t even know if they are used.
At this point it seems like a fairly big mess to me that need to be tangled out by some form of program that can do crosschecks and make decisions.
So it’s here that I wished to have a source for how it’s done and by who, maybe some researcher have tried finding out. Maybe some whistle blower have said something about it, just slipped my radar. Maybe some overconfident engineer blogging about it, what do I know. But some source with some thing substantial and examples to grab onto.
My personal experiences have been with google services, more precise youtube. After I’ve formatted the computer and not used any user-credentials on anything that I was aware of that was connected to them. Or much else for that matter, but they soon started showing me what was previously on my “recommended for you” and there were some pretty unique things that think that it had been merged with my old profile. So a computer fingerprint + looking at my searches maybe. But still they must be pretty sure before that make a leap and connects them.
I see that Tor browser bundle warns against re-sizing the window to avoid being tracked, they have also warned about Canvas fingerprinting on occasions. Maybe it’s just something it misinterprets from the websites or maybe they are actually trying.
CabbageControl • May 16, 2015 5:46 AM
@Nick P
Thank you for the link to the old capability book you posted half a year ago. It got me then to finally understand OS/400 pointer behavior.
@Anybody who still thinks they have nothing to hide
I want to post an old story from here in Romania.
In early 2012 the prime minister resigned. Most media moguls had been at war with this physically unimposing man for years, but they had not yet found any convincing compromat to attack him with.
These moguls were the completely unscrupulous sort that sometimes released fake news, with footage that was photoshopped or created by amateur actors.
A week after the resignation, the most watched prime time news bulletin showed, for no apparent reason, a hidden camera film of the prime minister in a gym locker room. Stark naked, of course, and doing nothing else other than changing his clothes.
So given enough time and resources one can usually find some kind of compromat about anyone, and it would be a great day indeed, not when the NSA finally respects the constitution, but at least a certain well-known kindergarten rule…
BoppingAround • May 16, 2015 9:52 AM
65535,
What are the odds: High, medium or Low? Any bets?
My bet is usual: low.
Seems to me the whole world slowly, one by one, dives into the full ~~retard~~ authoritarian stance (just from the comments section here: UK, France, Austria, Australia, Russian Federation, Belarus — the latter three did so a bit earlier). So even should the 215 die, probably there’ll be several other contenders to take its place.
What are the odds that the machinery inside the Section 215 will remain unchanged
under a new name? High, Medium or low? Any wagers?
Remember the infamous, allegedly shot down TIA programme? From Snowden docs it quite seems that it has survived and is thriving. Go figure.
winter • May 16, 2015 9:59 AM
Camerons new ideas about freedom of speech have remarkable parallels to those of that champion if freedom Vlad Putin.
name.withheld.for.obvious.reasons • May 16, 2015 10:03 AM
There appears to be a new logical data layer, converging to a transactional layer, by way of broadband service providers. Supercookies and proxies on ISP gateways log and characterize all kinds of data (think the great firewall of China), additionally application layer SaaS (Software as a Service) will provide application/performance/management services that provide the ISP, not you, a “managed” or curated experience… I see this in set top boxes, entertainment, gaming, smart phones, tablets, computing hosts, access controls, security, cameras, and IoT pieces of junk.
ISP’s and NAP’s may see aggregating these gateways to do something akin to what the NSA does, building big data by occupying the pipe/stream on your street. There may be a trend to consolidate your data profile, a method to trap the “value” that is your activity. I don’t see the commensurate conversation about data policies that come close to addressing what is going to be non-negotiated capture of all kinds of “device” enabled data. It seems to be a com-modification of data and device networks.
JonKnowsNothing • May 16, 2015 11:05 AM
ht tp://www.theregister.co.uk/2015/05/12/
that_drm_support_in_firefox_you_never_asked_for_its_here/ht tps://support.mozilla.org/en-US/kb/enable-drm
(url fractured to prevent autorun, remove space from the header)
The Register.co.uk posted a story about an DRM update to Firefox what is not exactly “voluntary”. It seems that Mozilla “reluctantly” inserted Encrypted Media Extensions (EME) into their v38 build. It’s enabled by default and rolling out on 32bit versions.
The deal is that if you disable it or uninstall it, the EME uninstaller will scan your hard drive to remove any “offending material”.
You have the choice to globally opt out of HTML5 DRM playback. Once you opt out, Firefox will delete any downloaded CDMs from your hard drive, cease all future CDM downloads and disable DRM playback. This affects only DRM-controlled HTML5 audio and video … more
Mozilla is “offering” a non-EME version if you want to go download it separately … but but but.. how do you know they didn’t just back door a nice hard drive scanner in that version too? What end-user has time or knowledge to scan for a back door that’s just dormant?
And since they were sooooo reluctant to install this to begin with, they put all those resources into the 32 bit version? I wonder why??? Not hard to guess.
- Many, Lots, Most, Some run 32bit browser even in 64 bit O/S.
- Maybe Vista is still sooooo popular that even though M/S pulled the plug the targets for hard drive scanning still run the 32 bit O/S.
- Maybe NSA+Hollywood paid Mozilla enough bitcoins to embed their back door with it’s own encryption routines that users “voluntarily” install so it’s not “hacking” but they can scan your drive just the same….
The Update is Live Now (v38.2).
Jimmy • May 16, 2015 11:25 AM
@ name.withheld
Just how much more stuff do they expect to sell by doing all this? is it really worth the fuss?
Benni • May 16, 2015 12:18 PM
In 2008, there existed a law in germany that forced all providers to store IP adresses much longer than now.
Deutsche Telekom, germany’s leading provider now admitted that in 2008, it gave 71.932 IP-adresses to police and 2.095.304 ip adresses from filesharers to copyright lawyers.
This is what the metadata collection is for.
Soon the practice to save this data so long was forbidden in germany but the politicians want this legislation back:
An early version of the prepared law on metadata savings in germany is leaked
Initially, the german government announced that they only wanted to go after terrorists, but in the legislation draft, the german government plainly admits that the metadata saving has the main purpose to catch filesharers.
They explicitely say that law enforcement agencies should be able to access the metadata not only for severe crimes like terrorism, but in order to investigate crimes that were done by using telecommunication services.
The only crime that can be done using a telecommunication service is the sharing of copyrighted material between peers.
And they say that the current legislation has a problem, because it does not say how long the metadata should be stored. Therefore, some providers delete this data early and then they can not catch all filesharers and piratebay users as they possibly could.
Probably the metadata savings by NSA in the united states have a similar purpose.
In the united states, not only the RIAA, but also privately hired copyright lawyers are responsible for catching filesharers. And the numbers of lawsuits against them are continually on the rise:
http://arstechnica.com/tech-policy/2010/06/the-riaa-amateurs-heres-how-you-sue-p2p-users/
As in germany, they would use software that masquerades as bittorrent peer in order to collect the ip adresses.
But how do these lawyers get the real name of a filesharer?
Well they can ask a provider. But any provider will say that it only gives data with a warrant from a judge. But any judge, if confronted by say, 6000 requests for ip adresses from college students, will complain after some time, that he became judge to prosecute criminals, and not 6000 college students who shared their windows 95 cd over bittorrent.
So a legislation must be made that allows to access metadata without the warrant of a judge. And that was done in the united states:
http://en.wikipedia.org/wiki/Telecommunications_data_retention#United_States
“if a company is based in the United States the Federal Bureau of Investigation (FBI) can obtain access to such information by means of a National Security Letter (NSL). The Electronic Frontier Foundation states that “NSLs are secret subpoenas issued directly by the FBI without any judicial oversight. These secret subpoenas allow the FBI to demand that online service providers or ecommerce companies produce records of their customers’ transactions.
The FBI can issue NSLs for information about people who haven’t committed any crimes.
NSLs are practically immune to judicial review. They are accompanied by gag orders that allow no exception for talking to lawyers and provide no effective opportunity for the recipients to challenge them in court.
This secret subpoena authority, which was expanded by the controversial USA PATRIOT Act, could be applied to nearly any online service provider for practically any type of record, without a court ever knowing”
This is an ideal mechanism to deal with filesharers without leaving too much paper on the desk. But then, a second problem arises:
Confronted by thousands of copyright violation requests, the providers will say that they do not keep metadata at all, especially not for copyright lawyers.
So another agency has to collect the data, and this agency has to share its metadata with the FBI.
And that is where the NSA comes into play. The copyright henchmen gets the IP of a bittorrent user and then they have to ask the police, which asks the FBI. The FBI asks the NSA, and then the copyright lawyers get the postal address of their filesharers.
With this legislation, NSA is basically playing the henchmen of copyright lawyers.
This is certainly not what this agency wants. Therefore, people like James Clapper support the idea that metadata should be stored directly at the providers:
http://www.spiegel.de/politik/ausland/nsa-reform-kampf-im-us-kongress-um-freedom-act-a-1033533.html
If this legislation will be passed, the copyright lawyers are guaranteed that the data will be stored at the provider and they just have to ask the police to deliver the postal adress that belongs to the ip of a filesharer. The police then gets the data from the provider (without a judge) directly and the copyright henchmen have what they want.
They are just reducing bureocracy here.
They are after filesharers, not terrorists. To this picture it fits that the canadian service is monitoring download sites
https://firstlook.org/theintercept/2015/01/28/canada-cse-levitation-mass-surveillance/
That makes only sense if the canadian services too play the henchmen for copyright lawyers.
One should note that the riaa never said that it had stopped its lawsuits against filesharers completely.
Instead they will complain at the provider who should send a warning to the filesharer. The ria says “If you fail to heed this warning and continue to illegally download and share copyrighted material then you do expose yourself to being sued for damages arising from copyright infringement.”
But according to this:
http://arstechnica.com/tech-policy/2010/06/the-riaa-amateurs-heres-how-you-sue-p2p-users/
the lawsuits have brought bad press for the riaa, and so much of the lawsuits against filesharers are now being undertaken by other private lawyers
Certainly all this activity is only possible if there is a large metadata collection somewhere…..
The connection between metadata savings of NSA, FBI access to that collection and filesharers were never really covered by media.
But I think it is an important aspect. Certainly, filesharers are criminals. But one could also plaster the streets full of videocameras, and then one would find every car thief, since one could follow him with the cameras. So is it worth it, to make such an intrusion, like placing videocameras everywhere, in order to resolve all car thefts?
Similarly it is with metadata collections: Are hundreds of college students sharing music and windows 95 cds over bittorrent worth it, to save all metadata of every american, or german?
Such a discussion must be publicly decided in a democratic process. Not in secret courts.
How intrusive copyright lawyers can be can be seen very explicitely in germany. In one year, just one provider gave 2.095.304 ips of germans to copyright lawyers. And this is not enough money for the german copyright industry. From youtube, the german version of the riaa, the gema, wants so much money, that google says it can not pay
Therefore many videos you can see in america over youtube are not viewable from germany, with a lock screen appearing. In germany, copyright lawyers are using big data in various ways:
“It can not be excluded that the partially demented woman have violated copyright law with their singing”
said the lawyers and demanded only 24,13 Euro from a circle of elderly woman who have met regularly in order to sing. Because the old woman did perhaps not know the subtleties of german copyright law, it was really just 24,13 Euro and not 100% more, as the lawyers usually demand.
How the copyright lawyers found them?
Yes, in germany, copyright lawyers have employees who scan “thousands of announcments in newspapers” they say. If they find an announcement for a private singing circle, the lawyers ask them to pay a fee, because singing in public, if it is not a song you wrote on your own, violates copyright in germany.
This example makes crystal clear that these copyright lawyers are damaging essential freedoms, at least in germany.
gordo • May 16, 2015 12:54 PM
@ name.withheld.for.obvious.reasons
RE: “a new logical data layer”
That kind of aggregate data should, at worst, be de-anonymized before/if its sold/shared. At best it should not be sold/shared at all.
I would think that it would be in the interest of device/app manufacturers/service-providers to not have their, yours, and our SIGINT communication data made available for sale, reproduction or aggregation by any MITM, that is, if I understand you correctly, by carrier service utilities and their data trapping arms, or what one might call LASSO’s (Legal Aggregation System Service Operations); LASSO my data for dollars! Potential ISP/NAP views of customer activity, is much greater than that gleaned from any search provider alone.
The apps, services, IoT devices, etc., are programmed to phone home, etc., maybe opt-out, or not, provide you a better experience, etc, That’s between me, my device, app, their maker and our agreement.
Separate from that, except for ISP and NAP business purposes, e.g., managing the traffic for through-put and bad actors, only government warrants should allow for drill-downs, mining or surveillance of “individual box behaviors” or sharing with third parties.
This “retail SIGINT utility capture market” you seem to be describing appears to be an offshoot, if not consequence of net neutrality smacking some imagined, if not throttled bottom lines (and may, none-the-less, have come about regardless).
NGI • May 16, 2015 1:23 PM
@zack, while torbrowser discourages screen-sized windows, noscript stops enough javascript to thwart fingerprinting (at least on panopticlick, where a maximized browser window does not change your entropy at all.)
Figureitout • May 16, 2015 1:54 PM
“Secure yourself, Part 1: Air-gapped computer, GPG and smartcards”
Article that takes a small linux board, yubikey, and a GPG set-up. We need more and more articles like this, even though they eventually become technically obsolete (but methods remain pretty similar).
Nitpick, apparently Yubikey Neo has capacitive touch button, which is susceptible to EMSEC attacks (depends on design on how much). I don’t know how their, what looks like Mifare-based solution works. There’s been lots of firmware/hardware advances to deal w/ a lot of the noise issues, but they’re more power intensive and cause more “delay” in registering which is annoying; it’s complicated to explain what all happens in microseconds and competing interrupts in a chip that cause mind-bending behavior/bugs, always best to read datasheets and application notes and then test their claims. Even these relatively “simple” smaller chips (compared to the biggest integrated CPU’s) have 5-7 clocks and complicated startup procedures you just have to trace. Still, I’d rather have an awkward length shielded cable w/ ferrite beads and just a touch button since this plugs into USB port, if we’re talking eliminating a potential side channel here (maybe making others, probably will). Also, having NFC-compatible comms w/ smartphones, guys, you’re shooting yourself in the foot. I know, I know, “$money$”. Maybe have different versions for people who don’t want another side channel for the sake of “oh that’s neat!”.
So that’s just that little sensor there, haven’t touch the java smart card firmware/hardware picture, which is going to be a pig-sty like usual. So still juicy targets and not hard enough. Write-once firmware is good though.
http://viccuad.me/blog/secure-yourself-part-1-airgapped-computer-and-GPG-smartcards/
Hacker News thread, noting top comment: I would enjoy a “pragmatic security” article about how individuals could adopt enterprise-standard security without too much technical knowledge or additional hardware.
–If we want security to be widespread, the procedures need to be step-by-step and clear. Gerbers babyfood spoon feeding. Otherwise it’s a circle jerk saying people can’t secure themselves and they’ll eventually become infection or launch pad vectors.
https://news.ycombinator.com/item?id=9550094
Attacks at Penn State force school to shut down internet
http://recode.net/2015/05/15/penn-state-engineering-school-cuts-off-internet-after-hacking-attacks/
Figureitout • May 16, 2015 1:56 PM
Whoops, Yubikey do offer non-NFC product.
tyr • May 16, 2015 2:40 PM
Here’s the future of IoT, security warnings should be
listened too.
http://gawker.com/fbi-and-homeland-security-respond-to-shocking-goatse-bo-1704768347
Internet of Things indeed.
Benni • May 16, 2015 3:08 PM
This news article shows a figure how the metadata collection is used in the US:
https://torrentfreak.com/100000-p2p-users-sued-in-us-mass-lawsuits-110130/
it shows an exponential increase of lawsuits that could only be filed with the help of extensive domestic metadata collection. The numbers rise and rise…
http://www.wired.com/2011/05/biggest-bittorrent-case/
And this here shows the companies which request so many metadata:
And this shows how much money there is in from a proper metadata collection:
https://www.eff.org/deeplinks/2012/09/appeals-court-upholds-penalty-in-filesharing-case
“The damages provisions of copyright law – up to $150,000 per infringed work without any proof of harm, are insane”
The terrorist of today seems to be the average college student filesharer…..
Thousands of “crimes” worth $150.000 per infringed case….
If one assumes that the providers, the data hoarders and the collectors get some of the money because they nurture and service such a metadata collection, then collecting metadata is quite a good business.
Does NSA or the ISP’s get money from copyright lawyers and filesharing lawsuits for their metadata collection?
I do not see any article on this but it should be investigated….
BoppingAround • May 16, 2015 4:15 PM
gordo,
That kind of aggregate data should, at worst, be de-anonymized before/if its
sold/shared. At best it should not be sold/shared at all.
That’s a nice typo you have made there 🙂
@ BoppingAround
Thank you, and yes, “anonymizing” such data, especially as some of it is no doubt medical in nature, should its release after catch come to pass, is not an extremist position. :-b
gordo • May 16, 2015 6:47 PM
…in American football, “release after catch” is either a trick play by design, or a fumble. Doh!
…de-anonymising fumblers, I say! (which is not to say that anonymisation is easy, let alone possible!)
gordo • May 16, 2015 7:03 PM
Information-sharing-release-from-liability regimes are fumbles waiting to happen.
k12 • May 16, 2015 7:05 PM
Why are there giant, deliberate gaps in citizen security? Is it because no one citizen matters very much, that society can afford to slough off a few at the edges?
gordo • May 16, 2015 7:11 PM
The State is considered greater than sum of its parts?
@Figureitout
That GPG + Yubikey is a nice article and a good combination. Here’s the official Yubikey + GPG guide (https://www.yubico.com/2012/12/yubikey-neo-openpgp/).
EMSEC is always a huge problem with most electronics and probably the most efficient means of handling such an attack vector is the use of whitebox cryptography techniques (http://www.whiteboxcrypto.com) which breaks cryptographic components into small components and mix them up. If you can scramble your components, anyone trying to capture your emission to try and reconstruct your keys via your emission would have to first know how you break the algorithm down and scramble the algorithm. This type of technique is part of the DPA/SPA protection suite from Cryptography Research Inc. as the software-based protection/logic protection components. Payment to use protection suites might be necessary unless you are capable of coming up with your own from papers and formulaes lying around and coding them into applets.
If you are going to hold keys in a smartcard for cryptographic purposes, you can consider those keys semi-compromised and never load the master key into the smartcard or your root key of trust (you have a main PGP key sitting somewhere signing your sub PGP keys in the old CA-style fashion).
Like most smartcard, you dont have full control over who is using your keys once you plug the smartcard/token into the slot and have the GPG program running. Maybe some low intelligence malware from some MSA or LSA have been successfully infected a computer and it detects you launching the GPG app and have a smartcard in place. Once you key in the PIN to unlock and use the smartcard, it’s pretty much gone. The malware could capture the PIN and listen to the card APDU (protocol) and control the APDU signals.
One advise to add a little more challenge is to setup a per-command HOTP (Hashed One Time Password) so even if it captures the PIN, it needs the OTP. If you want to stop a HSA which could intefere with the APDU traffic by halting it, collecting the HOTP with the PIN, changing the command APDU and then re-using the HOTP/PIN (since it has not been sent into the card), this would require another level of protection by having a Secure PIN Entry Device or a token with a screen to display incoming request and approval button.
@Figureitout, Nick P
Not to mention, I wonder if the Yubikey is using SCP02, SCP03 (secure channel between card and computer) or raw channel just in case someone attacks the cable.
Either way, the most secure would be to setup a key counter (one time use key) and have an exit node messaging guard (proxy for messages). You send the message to the card to use the key and the guard would inspect the encrypted message. Maybe think of it as a TFC setting scenario in a modified version. If the message would somehow be inspected by the guard and if it seems to look like an automatic/malware sent message, it could be rejected and alerted. U have not fully thought of how it should work but that’s a rough idea.
StungByStingray • May 16, 2015 7:55 PM
FBI now claims its stingray NDA means the opposite of what it says
So, that probably means that any oranization that hid behind the non-disclosure, can now be taken to court for failing to follow the non-disclosure. Lots of cases cold be re-opened here or turned over. What a legal quagmire.
How long before the FBI once again claims the non-disclosure protects information about the device?
Flip-flop…whatever it takes for CYA.
J on the river Lethe • May 16, 2015 8:01 PM
If this is true, he has earned his jail sentence. Security endeavors like this hurt the profession, lots of smacking of foreheads. Supposedly, he admits to actually changing plane operation. Duh. Again, if it turns out to be true. Hmm, did some idiot interfere with Amtrak?
Security testing should be in controlled environment. I have heard it said that the difference between hacking and pen testing is permission. That and controlled tests is why pen testers have such detailed contract, etc. before testing.
http://www.wired.com/2015/05/feds-say-banned-researcher-commandeered-plane/
The stupidity is strong in this one! Should have tested on Tarmac with permission! Or lab set up of plane system.
JonKnowsNothing • May 16, 2015 10:34 PM
Has anyone noticed that some recent news articles regarding misbehavior on the part of some police officers (and others) involves: emails, text messages, photos, a variety of social media, and occasionally linked-in? Additionally GPS data maybe involved (not being where they are supposed to be or being somewhere they are not supposed to be) and other data coming from sites like chat rooms.
What’s interesting is this: no one is complaining.
Some of the information would come directly from employer files like “internal” emails or GPS data from squad cars or even smartphone trackers. But a lot of the data is coming from Google Search, tracking Facebook Buddy lists and Twitter feeds/accounts. Some of this certainly comes from off-duty type activities and is not directly within the databases of the employers.
Even so: no one is complaining.
So, how did they get all the data? Who provided this to the city officials? Where is the search warrant? How did the city know to check Twitter Account XYZ? Where did they get the chat logs from and how did they know to even ask for the chat logs?
Still: no one is complaining.
What’s interesting here is that the apparatus of the surveillance state is being turned against some of its most ardent supporters.
No one is complaining … yet. Perhaps it’s schadenfreude?
ht tp://www.theguardian.com/uk-news/2015/may/15/five-met-police-officers-sacked-for-posting-pictures-of-public-online
ht tp://www.theguardian.com/us-news/2015/may/15/miami-beach-police-racist-pornographic-emails
ht tp://www.washingtonpost.com/blogs/the-switch/wp/2015/05/14/some-companies-are-tracking-workers-with-smartphone-apps-what-could-possibly-go-wrong/?tid=hpModule_88854bf0-8691-11e2-9d71-f0feafdd1394
Benni • May 16, 2015 11:46 PM
A german newspaper claims that a BND agent found the hideout of Bin Laden and then BND informed the americans….
Is that true?
It would fit into the picture that BND paints from itself as a dumb agency which knows nothing and does nothing. But then it was BND which started the iraq war.
In the 80’s it was german companies that delivered weapons of mass destruction to iraq. And they did that with the active help of BND agents. “At least three traders of poisson gas were connected to BND, said BND itself: http://www.spiegel.de/spiegel/print/d-13501235.html
Iraq would later use this for use for massacres and to attack israel with the same gas that BND helped to produce http://www.spiegel.de/spiegel/print/d-86109219.html
This was the reason that germany delivered nuclear capable submarines to Israel. Interesting is that germany also delivered technology for the build of nuclear weapons to iraq:
http://www.spiegel.de/spiegel/print/d-13498060.html
And then after 9/11, a “refugee” told BND hilarous stories about weapons of mass destruction which BND forwarded to the americans.
The source codenamed Curveball says now that BND threatened him to separate him from his pregnant wife if he does not tell interesting stories:
And till today, BND pays him for his lies http://www.taz.de/!62168/
Before it could get to war in Iraq, the us government needed a plausible reason to make congress vote apropriately. And that was why the lying BND agent was so important to them. Without the lies of the BND agent, the US government could not achive an approval for the Iraq war in congress:
Similarly with iraq, the BND was involved in letting syria and libya have their poisson gas:
http://www.sueddeutsche.de/politik/giftlieferungen-nach-syrien-der-bnd-sah-zu-1.1917573
http://www.spiegel.de/spiegel/print/d-131463439.html
Most poisson gas of syria was probably destroyed by the UN, and much of the libyan poisson gas was perhaps destroyed by Nato in its war on libya. But not everything:
http://en.wikipedia.org/wiki/Libya_and_weapons_of_mass_destruction#Chemical_Program
“On September 2014, OPCW said Libya still has around 850 tonnes of industrial chemicals that could be used to produce chemical weapons.[31]. On 21 February 2015, Asharq Al-Awsat reported that an anonymous Libyan army official stated extremists had seized large amounts of Muammar Gaddafi’s chemical weapons from multiple locations. The official warned that the targeted caches included mustard gas and sarin.[9][33][34] The North Africa Post later reported that chemical weapons were stolen by armed men who stormed the chemical factory in the Jufra district where the weapons were stored. Military sources reportedly stated that among the chemical weapons are mustard gas and sarin”
The russians also say they worry about the poisson gas in Libya that is now in terrorists hands http://tass.ru/en/world/757077
It was therefore the russians who first proposed to the security council an anti terrorist mission and a sea blockade for libya http://tass.ru/en/world/779784
Suddenly, after this statement, german warships appeared close to the lybian coast
(just to stop migrants, of course. Therefore this man has such a nice anti-ebola suit when he deals with refugees: http://www.focus.de/politik/ausland/einsatz-nordoestlich-von-tripolis-bundeswehr-rettet-im-mittelmeer-knapp-300-fluechtlinge_id_4683328.html )
Russia said it would not block it, if european military is engaged on the ground in libya, neither does china block this: http://www.spiegel.de/politik/ausland/ukraine-krise-nato-und-russland-versuchen-die-annaeherung-a-1033785.html
The americans informed russia last summer that syria produces nuclear weapons on terrorist infested ground. They also gave that to spiegel afterwards:
Then, the russians started to develop a missile detection system http://tass.ru/en/russia/786746 and suddenly they want to cooperate with the US with respect to a missile shield: http://tass.ru/en/russia/769512
Because syria develops its nukes with the help of north korea, the russians brought the chinese to train with them in the mediteranian sea http://tass.ru/en/russia/794708 and they now consult with the americans about syria: http://tass.ru/en/world/794546
(Probably this talk contains an item about who should wipe syria of the map if the IS gets its plutonium…)
In the second world war, russia expanded its territory after the hilter stalin pact. This gave russia some time, and probably one goal of this pact was that hitler had to move a longer way towards moscow. Putin says he thinks the hitler stalin pakt was a good idea: http://www.spiegel.de/politik/ausland/putin-verteidigt-hitler-stalin-pakt-a-1001613.html
It maybe that russias behavior in ukraine and georgia had to do with the fact that there is a secret defense protocol in russia, which says that whenever russia sees a military buildup close to its borders, russia will expand its territory in order to ensure the enemy has a longer way to walk into russia.
Perhaps russia saw nato as a threat because they observed a military buildup, and no one told them why this happened.
Probably, their secret service was domestically oriented and they did simply not know or could not imagine that west germany’s intelligence agency BND provided iraq, syria and lybia with large stockpiles of chemical weapons and machinery for nuclear weapons. It is reasonable that the russians simply did not know about all these chemicals and technology which is now cooming close to terrorist’s hands and is the reason for the buildup of US military structures in that region.
The fact that BND has given weapons of mass destruction into crisis regions may also explain why the US are so reluctant to led germany into the 5 eyes, and why NSA is so interested to spy on german arms manufacturers like eads….
It seems that BND did not learn from that experience in the past.
Currently, BND seems to be involved into illegal arms exports to Myanmar, Kongo and Sudan….
http://www1.wdr.de/daserste/monitor/extras/monitorpresse-bundesnachrichtendienst-bnd-100.html
Really, an intelligence service like BND is what the world needs in these times.
If there are terrorists with weapons of mass destruction, the answer who armed them is almost always: the german intelligence agency BND.
This is how an agency can demonstrate a good sense for security, peace and stabilisation.
23n • May 16, 2015 11:55 PM
@JonKnowsNothing “Has anyone noticed that some recent news articles…”
Since Snowden it has become obvious that the news is controlled by the CIA.
You could try to integrate it, but that would be like taking snapshots of a mobius strip in an attempt to find the other side.
There is no other side.
gaikokumaniakku • May 17, 2015 12:36 AM
He obtained physical access to the networks through the Seat Electronic Box, or SEB. These are installed two to a row, on each side of the aisle under passenger seats, on certain planes. After removing the cover to the SEB by “wiggling and Squeezing the box,” Roberts told agents he attached a Cat6 ethernet cable, with a modified connector, to the box and to his laptop and then used default IDs and passwords to gain access to the inflight entertainment system. Once on that network, he was able to gain access to other systems on the planes.
Reaction in the security community to the new revelations in the affidavit have been harsh. Although Roberts hasn’t been charged yet with any crime, and there are questions about whether his actions really did cause the plane to list to the side or he simply thought they did, a number of security researchers have expressed shock that he attempted to tamper with a plane during a flight.
“I find it really hard to believe but if that is the case he deserves going to jail,” wrote Jaime Blasco, director of AlienVault Labs in a tweet.
http://www.wired.com/2015/05/feds-say-banned-researcher-commandeered-plane
I think this didn’t really happen. Is this a hoax?
name.withheld.for.obvious.reasons • May 17, 2015 12:48 AM
@ gordo
This “retail SIGINT utility capture market” you seem to be describing appears to be an offshoot, if not consequence of net neutrality smacking some imagined, if not throttled bottom lines (and may, none-the-less, have come about regardless)
Good catch, rumblings from within the monopolistic telco, ISP, and NAP network in trade press suggest such a thing…it makes sense if you are engaged in a market (abrogating customer privacy) where a logical layer would transactional-ize the customers network comms BEFORE the data aggregators (thieves), app services (fb, and gobble), and the liars (government). A fair amount of market entropy/impedance could result from a “capture the flag” view of individuals data acquisition “product”.
Buck • May 17, 2015 1:21 AM
@name.withheld & @gordo
So, it’s like having your own personal shopping bubble/buddy in the cloud..? How quaint!! I wonder what they’ll call it.. Raindrops? No, snowflakes are probably better. It could even be like having your own personal (shopping) assistants!! Now, just who wouldn’t want that; it sounds almost like what the Jones’ have!! No doubt, I must have that 😛
gordo • May 17, 2015 2:33 AM
@ name.withheld.for.obvious.reasons
An example not of so-called disruptive technology per se, but more precisely new found motivation or opportunities to apply disruptive uses of existing technology to already largely captive markets.
This seems to accord well with Mr. Schneier’s democratization-of-surveillance thesis. As you’ve noted, “a com-modification of data and device networks”, its anti-competitive, and anti-innovative entropy in pursuit of “capture the flag” “product”; “tag ’em, n’ bag ’em.”
Whether the potential, i.e., not necessarily eventual, complete submission of you, me, and society, to unwieldy coercions of predictive analytic big data behavior modification campaigns comes to pass, who knows.
Like how advertising turned Western culture into the consumer culture we’ve come to know and love, now, as both “product” and “resource”, on ever-more granular scales, I’m not sure what the word for this condition might be.
Serfs of Silicon Valley Meet the Analysands.
@ Buck
I just downloaded some shopping bags for my copter totes. The catchphrase is Come Surveil with Me.
[I wish I could do strikehroughs on words for proper effect!]
Figureitout • May 17, 2015 3:23 AM
Thoth
–EMSEC is just a thing I’m into, there’s lots of crude everywhere all the time and signal integrity and noise are very common issues that involve just physics not some malicious individual behind it. But it’s really disturbing when you realize you were hacked remotely (worse than the “oh sh*t, I got owned” feeling from an internet virus, the attacker is much closer to you…).
Yes there’s some design guidelines to quell these emissions, there’s similar things in many “application notes” dealing w/ the lovely noise from crappy switching regulators to keep certain component packed together (if you got a bad one, you have to just unplug it as it’ll screw up all your precise measurements b/c the noise gets on oscilloscope wires, so messed up, it’ll get on all wires, have to rely on protection circuits and more regulators to filter that crap out) but they’re not perfect…So I’ve heard that CR Inc. went out and sued anyone trying to research DPA/SPA. Not cool, I’d still need some way to verify what they’re selling isn’t bull, which I don’t know how.
As far as smart cards, I’m not sure, don’t know what to say lol. I’d want some sort of dev. environment for it (it could still of course be compromised, or just inject malware in every binary and then give me false confidence) where I can isolate things a bit. I was wanting a more simple “pin” for my PC, basically a hex keyboard or dip switches and a push button. It’s just, I want to be sure that something like an interrupt can only come from that 100%. Ugh don’t know how to deal w/ malware if it just keeps spreading…
Some gal • May 17, 2015 4:03 AM
Re QUOTE (re Firefox DRM): “The deal is that if you disable it or uninstall it, the EME uninstaller will scan your hard drive to remove any “offending material”.
- You can disable this feature and not have the offending scan take place
- What luck will the scan have against offending materials already deposited into a Cryptkeeper vault?
- How is Firefox going to scan you computer when you have tied it up in ropes with AppArmor and Firejail at the kernel level such that whole directories appear empty or are denied access?
Re: Copyright issues. Until one-hop VPNs are completely infilitrated by the Stasi (well on their way), they will keep picking the low-hanging fruit e.g. bittorent not protected with a VPN tunnel.
Phase 2 will be the complete stripping of VPN privacy, in the name of terrorism of course as the usual get-out-of-democracy-free card.
Clive Robinson • May 17, 2015 4:24 AM
@ Figureitout,
…So I’ve heard that CR Inc. went out and sued anyone trying to research DPA/SPA
Yeah well the guy is at best a “one trick poney” and as I’ve said a number of times before, both he and I know, he was told by me by EMail how to do some of the tricks, long before he went down the patent road… (which is only valid in the US any way even if it was not provable as IP theft).
If he’s stupid enough to make claims that can be disproved then the evidence is there to hold him up to the light….
65535 • May 17, 2015 6:08 AM
@ BoppingAround
“What are the odds: High, medium or Low? Any bets? My bet is usual: low.”
Given that Obama seemed to like the program and he is the last line of defense [ the republicans have enough votes to push it through] I am inclined to agree with you.
It’s odd that the ACLU and the EFF don’t want the program and are Obama supporters; one would think they would lobby him to shut it down with a stroke of a pen. Some organization(s) are his pulling the strings in the background.
Winter • May 17, 2015 7:00 AM
I have two topics I would like to bring up:
1) Will Bruce digital sign eBook versions of Data and Goliath?
2) Just last week I noticed that Orbot (Onion Router Bot on Android) will now work on unrooted phones and also allows to VPN all (standard?) internet traffic of the phone through Tor.
https://guardianproject.info/apps/orbot/
How much protection would that give me? That is, what parties will it protect me against?
I understand there are parties that can deanonymize Tor, but most parties cannot. E.g, the police in my country cannot.
@Figureitout
You can consider DPA/SPA protection by obscurity of sorts. I have a thought that these static algorithms they use would sooner or later be invalid as “attacks get better” (quoting our @Bruce Schneier).
@Clive Robinson
Correct me if I am wrong regarding emission handling. Using static algorithms (and probably whitebox crypto techniques) to handle emissions (e.g. splitting an operation into simpler parts like trying to do 1+2 and now it becomes 1+1+1 instead) for masking of signals and under a NDA to specify the exact algorithm being used would be like security via obscurity ? One example is to break down a XOR between A and B, it could be broken much more simpler to confuse attackers if the attacker is oblivious to how the static algorithm works thus most DPA/SPA chips and softwares have mandatory NDA contracts so that revelation of the static algorithm might allow attackers to reconstruct some sort of signal normalizer to compensate for the static signal confusing algorithm.
My thought is to make the signal confusing algorithm into a dynamic algorithm which also includes dynamic dummy rounds and data, dummy table lookups and everything else on-the-fly including dummmy key generation if needed to confuse attackers listening for significant increase in power consumption during keys being written into the EEPROM. But all these requires chip level cooperation and software cooperation to have dynamic and versatile dummy operations so that NDA is not required and algorithms can be reviewed openly. The resources and circuit designs need to be sustainable due to more resources allocated to dynamic operations and resources.
Jacob • May 17, 2015 9:52 AM
Penn State College of Enginnering had been penetrated, and personal as well as research admin data may have been affected:
“Details: Penn State was tipped off by the FBI on Nov. 21, 2014, of suspicious cyber activity directed at computers in the College of Engineering. An investigation revealed two threat actors on the network, and later analysis by Mandiant revealed that one threat actor is based in China. Analysis revealed the earliest known date of attack in September 2012. The threat actors used custom malware and other tactics to infect the College of Engineering’s network and computer systems. Evidence shows that a number of College of Engineering-issued usernames and passwords were compromised, and that a small number of the accounts were used by the attackers to access the network.”
What I wonder about is how the FBI discovered the hack. Do they continuously monitor the academic systems of US colleges for suspicious activity?
Did the NSA stumbled upon this and notified the FBI? Had government-sponsored research been going there, thus the FBI routinly monitors any related computer activity? and what about the campus wifi system – monitored too?
Nick P • May 17, 2015 10:11 AM
@ Jacob
I’m seeing two likely possibilities:
-
FBI was monitoring a hacking group (eg botnet) and saw it connecting there.
-
NSA was monitoring everything, saw patterns of hacking, and tipped off the FBI.
herman • May 17, 2015 11:11 AM
What I find interesting is how pathetic the university security system is that the FBI had to inform them about it and how pathetic the FBI and NSA information scanning is if this has been going on since 2012.
albert • May 17, 2015 11:20 AM
@Nick P, Jacob
- The FBI concentrates on China (or Chinese students in the US)
- The FBI monitors all universities engaged in govt/defense research
etc.
.
…
required • May 17, 2015 11:36 AM
Or it was an FBI informant who hacked them, or the NSA/CIA and nobody told the FBI to look the other way. I don’t trust anything about any hack with information coming out from a governmental agency FBI/GHCQ/BND/NSA.
But I’m probably not the target audience but my point is that it feels silly to even guess how or if they got tipped of when we don’t even know who did it.
albert • May 17, 2015 11:48 AM
@benni
.
The MPAA and RIAA have been at this since the beginning of internet file sharing. First, they totally missed the boat in the emusic/emovies business, due no doubt, to their old Mafia tactics, and ancient and clueless douchebag executives. They missed millions in sales from that business, which they could have taken over easily. When CD sales took a nosedive*, they blamed illegal downloading, and introduced DRM. They have used the FBI as tools from the beginning. They tried to get search providers like Google to do the DCMA work. They don’t want to spend money going after violators, they want US (citizens) to pay for it.
.
This is a load of bull. Let’s make private crime private, and let the ‘Entertainment’ Industry pursue copyright violators in civil cases, where they belong.
.
The ‘entertainment’ industry execs are poster boys for everything that’s wrong with Corporate America. /rant
.
* due to overpriced, crappy product.
Andrew Wallace • May 17, 2015 12:10 PM
“Safety blunders & security lapses” at Faslane
http://www.snp.org/media-centre/news/2015/may/safety-blunders-security-lapses-faslane
Andrew
Jacob • May 17, 2015 2:05 PM
@Nick P, Albert
Penn State says that Mandiant, the contract security company they hired after getting the FBI tip, is the one who found out that one of the 2 actors was a Chinese (group):
“An investigation revealed two threat actors on the network, and later analysis by Mandiant revealed that one threat actor is based in China. Analysis revealed the earliest known date of attack in September 2012”
So the speculation that the FBI tip came after it either followed a Chinese hacking group or monitored Chinese entities is not a compelling argument in this case.
anonymous coward • May 17, 2015 2:25 PM
4096 RSA key in the strongset factored.
http://trilema.com/2015/full-disclosure-4096-rsa-key-in-the-strongset-factored/
Buck • May 17, 2015 2:37 PM
@Jacob
Well, the speculation that Mandiant monitors Chinese entities is now further reinforced… I’m not too sure I’ve heard them talk about much else — but then again — I don’t follow their reporting too closely.
Enough • May 17, 2015 3:07 PM
Spread misinformation…
Devalue the corporate and governmental surveillance…
Figureitout • May 17, 2015 3:38 PM
Clive Robinson
–Why were you telling him tricks and what did he do to piss you off so much?
Thoth
–I consider it, something along the lines of programmable DDS modules (which I unplug and program repeating random transmission spurts, these may be arduino’s or at328’s first for PoC w/ like PWM, maybe one connected to 8ohm speaker too for ultrasonic) spewing noise off little wires in the “no man’s land” inbetween shields, the computer would be housed beneath another shield. Either that or some different HWRNG circuits w/ separate power supplies running, that noise may be subject to “signatures” if we’re talking long-term close-up surveillance. I’m just not 100% preventing noise riding in on power lines and maybe affecting the circuit or if I’d do ventilation screens which I may need w/ heavy duty linear regulators. I’m stuck on those design aspects (assuming it’s feasible, which I believe it is) and won’t be satisfied easily, so I keep waffling on it.
Andrew Wallace • May 17, 2015 4:24 PM
Does anyone think that DuckDuckGo is any safer than Google? I do not believe it is any defence.
Anything you do online is recorded and held against you if you are suspected of crimes retrospectively.
“The search engine that doesn’t track you.” duckduckgo.com
Even if you use it in conjunction with dark web tools such as TOR you are still tracable.
Andrew
gordo • May 17, 2015 4:51 PM
When attributing attribution attributers, plugins like this usually come in pretty handy: http://sony.attributed.to/
Andrew Wallace • May 17, 2015 4:58 PM
I believe TOR makes you more tracable and draws more attention to you than your actual IP address.
TOR is simply smoke and mirrors. http://idioms.thefreedictionary.com/smoke+and+mirrors
Any investigator with enough time and resources can find you.
Andrew
Anthony Sand • May 17, 2015 5:12 PM
@ name.withheld.for.obvious.reasons
“it makes sense if you are engaged in a market (abrogating customer privacy) where a logical layer would transactional-ize the customers network comms BEFORE the data aggregators (thieves), app services (fb, and gobble), and the liars (government).”
@ Buck
“So, it’s like having your own personal shopping bubble/buddy in the cloud..?”
@ Benni
“This is an ideal mechanism to deal with filesharers without leaving too much paper on the desk.”
If this type of activity is done for the very purpose of advertising, I really wonder how much it can impact sales revenue. Are you going to buy more stuff just from flashing ads at you while you read the new york times online? How much money can they extract out of flashing ads they think you like to see?
If this were done for other nefarious purposes as Benni claims, then what is the telco’s cut in profits? I’ve not heard anywhere indicating that telco’s get a cut or kickback from these type of lawsuits.
Buck • May 17, 2015 6:03 PM
@Anthony Sand
Advertising isn’t only about immediately impacting sales revenue… It’s also about the influence of perceptions to ensure a constant flow of future prospects.
Any kickbacks would be highly dubious and hard to prove.
Anthony Sand • May 17, 2015 6:16 PM
@ Buck
“Advertising isn’t only about immediately impacting sales revenue… It’s also about the influence of perceptions to ensure a constant flow of future prospects.”
Let me rephrase the question then. How much future sales revenue does it expect to increase?
I just don’t see any benefit for telcos to do this bidding for nefarious purposes unless they are also copyright holders.
As for advertising, I remain skeptical on how much new money can be generated from this.
If I walk into a grocery story and everything I’d ever wanted to buy is already placed into a shopping cart for me waiting at the doors. Great! but so what? I was going to buy them anyways.
Andrew Wallace • May 17, 2015 6:17 PM
FBI claims security researcher took control of plane
http://www.cnet.com/uk/news/fbi-claims-security-researcher-took-control-of-plane/
Andrew
Anthony Sand • May 17, 2015 6:28 PM
“Nick P • May 17, 2015 10:11 AM
@ Jacob
I’m seeing two likely possibilities:
- FBI was monitoring a hacking group (eg botnet) and saw it connecting there.
- NSA was monitoring everything, saw patterns of hacking, and tipped off the FBI.”
Where does a firm like Mandiant come in play?
Nick P • May 17, 2015 6:34 PM
@ Benni
Re P2P
There are two ways for them to get the information: at the protocol level from downloaders; metadata from ISP’s. If metadata, it was likely collected due to the constant threats by entertainment industry to sue carriers for facilitating or not stopping it. They’ve gone back and forth over the issue. It’s likely another compromise that they may make money on.
It’s mostly just avoiding liability from entertainment industry’s lawyers. That’s almost always the case.
Buck • May 17, 2015 6:36 PM
@Anthony Sand
What if it’s not just about extracting more revenue, but about keeping the company alive..?
To extend your metaphor — what if the grocery store you went to had food that wasn’t shipped in from a thousand miles away and had no need to advertise itself on television — instead, it comes from your friends and neighbors who grow/raise it themselves; and through trade with their trusted partners, you could also get certain types of food that don’t grow well in your region..?
Benni • May 17, 2015 6:43 PM
New chinese malware gets its commands over posts from microsoft tech net forums:
https://www2.fireeye.com/WEB-2015RPTAPT17.html
With Linux, this would not have happened
tyr • May 17, 2015 6:49 PM
Here’s a nice followup to the Seymour Hersh piece and
it’s aftermath.
http://www.cjr.org/analysis/seymour_hersh_osama_bin_laden.php
Remember this is the same “conspiracy theorist” who exposed
the My Lai mess in Vietnam and the lovely Iraqi Abu Ghraib
prison episode. I’m sure there were a lot of people who don’t
want to hear about such things, but an informed populace is
what makes for reasonable governance.
If you routinely lie then the only way to have a shred of
input into the debate is to attack those who point out your
lies.
There has been a vast cloud of smoke and mirrors around OBL
from the days when he was an obscure loon working against
the Rus. The picture hasn’t gotten any clearer since then.
Most of it is far too convenient for an agenda to have much
truth in it. Lies are neatly packaged, truth has all kinds
of loose ends, odd bits, and weird connectivities. That’s
why science is such a demanding way to discover some value
of true nothing is neatly packaged into a sudden eureka of
discovery. If you work in comp this isn’t always transparent
unless you work with hardware and the newer test equipment
cleans up the mess before you see it. So it’s easy to buy
in to a simple clean narrative of good versus evil, that’s
an epistemological cartoon and does not equip you for engaging
with the real world. Discarding the illusions of childhood
is hard, but surviving a world ruined by childishness is a
lot harder.
@ Andrew Wallace
If you think there’s something wrong with Duck Duck Go
do the research, show us what’s wrong, publish your findings.
That’s what adults do. You will gain a lot more with results.
@Benni
I always appreciate your take on BND. Given the nasty habit
of collusion with CIA over the years I think part of the
WMD sales was cooked up by this collusion. Saddam used to
be a treasured asset used against the Rus. The spooks have
no loyalties only connections of convenience and it makes
them dangerous to enemies and friends alike. Plausible use
of others for deniability occurs far too often to be mere
coincidence. The only real questions are who is using who
and for what.
Anthony Sand • May 17, 2015 6:50 PM
@ Buck
“what if the grocery store you went to had food that wasn’t shipped in from a thousand miles away and had no need to advertise itself on television”
what does it have to do with analyzing my shopping behavior?
how will buying my shopping behavioral data from telcos help this store at all?…? in all likelyhood that it’ll cost more than a place on the local interstate billboard….?
If I went to it, I went there specifically to buy what it offers. Placing stuff into a cart for me won’t make any new money out of me than what I’ve already decided to spend.
@Figureitout
Yes that’s what I meant. You can’t 100& proof it against ever attack. It just needs to be able to spew something confusing for attacks snooping in on a distance but once your HW devices get captured, it should be preferably be in a destroyed state long time ago. The smaller and delicate the device, the better and easier to destroy on a moment’s notice but it should not be too delicate to make daily handling a chore (like handling a glass cup in your pocket). Something the size of a microSD would have been easy to destroy with a sharp object and a good amount of brute force sending the sharp end right into the center of the chip or a card size for easy convenience. Dongles like those in the size for the Bluetooth mouse would be a bit harder to destroy as you have to remove the cover but if you have a good amount of time, you should be able to remove the plastic with a screw driver and send the screw driver blade into the chip a couple of times like beating up something in anger 🙂 to make it so much dead-er than not.
Andrew Wallace • May 17, 2015 7:05 PM
tyr
I do not post findings or research publicly.
I’m against the full disclosure ideology, hence why I gave the Full Disclosure Mailing List a hard time that led to its demise in the United Kingdom.
I contact vendors and or the government directly when I discover a vulnerability or have comment to make.
I miss out the middle man.
I also do not believe in being paid and the use of bounty programmes or people who go public for fame and fortune like Mr Chris Roberts is doing at the moment with in flight security of airlines.
I’m 34 years old so your ‘That’s what adults do.’ comment is inappropriate.
Andrew
Nick P • May 17, 2015 7:08 PM
@ Anthony Sand
Mandiant is a security management company. They handle consulting, offloading of security services, investigating breaches, and tracking down hackers/botnets. They’re one of the few companies that have enough presence and contracts to see all kinds of active malware. They use their visibility to try to act as a private intelligence agency of sorts to report on and combat malware. This report was one of their most publicized.
If they’re on the scene, they were called in to collect evidence, figure out what happened, who might have done it, how to prevent the next one, and so on. Going through the motions is how I look at it. They work with the Feds on this stuff a lot, too. So, no surprise that Penn chose them.
@ Jacob
I disagree. There’s two ways the FBI likely found out about the attack: NSA’s collection which has plenty of eyes on Chinese ops; FBI’s own intelligence gathering on hacker (esp Chinese) activity where they saw the target. Either way, they would tip them off without revealing how they found the information. That leaves a significant probability that the FBI got their information monitoring hacking groups or Chinese entities.
Now, how Penn got it was Mandiant and they probably got it through their own teams as I references above.
Clive Robinson • May 17, 2015 7:23 PM
@ Thoth,
Using static algorithms (and probably whitebox crypto techniques) to handle emissions for masking of signals and under a NDA to specify the exact algorithm being used would be like security via obscurity ?
Yes it’s security by obscurity, in a smilar way to “whitening” of CPU clock via psudonoise to “spread” signal energy across a wider bandwidth to get it under the EMC masks is. That is the signal energy is still there, you’ve not removed it or actually reduced it.
The question then falls to how predictable the whitening signal is, or if it is sufficient or not to mask the energy such that an enemy can sync up to it and remove it.
Take the simple case of a Direct Sequence Spectrum Spreading (DSSS) system, it takes the charecteristic EMC frequency spurs and spreads them across a wide bandwidth. If however you know the sequence, offset and chip rate, you can easily deconvolve the combined signal and strip off the DSSS sequence. But what if you have several computers generating EMC noise and using DSSS to spread it around?
Well it’s just like a CDMA system, the act of deconvolving the “wanted signal” has the effect of further spreading the other signals thus effectivly “tune them out”…
Whilst it is not impossible to make an algorithm with a very very long –past the end of the universe– sequence, the question is can it also be secure?
Well the answer is should be “yes” just as it is with any stream cipher of sufficient quality… However there is a catch you have to generate the sequence and this process could be vulnerable to it’s own attack by power analysis etc. Thus you end up with the old “On a dogs back are fleas that bite, and upon these fleas lesser fleas and so ad infinitum”.
@ Figureitout,
Back in the last century the DPA paper was published and it upset quite a few Smart Card designers that had been using various tricks to mask the power spectrum etc.
Prior to that Ross J. Anderson had been looking at “self timed logic” to get around the “Smartcard issue” and I had told him by Email that the problem was you could “injection lock” the self timed logic, and also use the EM carrier that forced the lock to work just as well if not better than DPA because amongst other things it did not need to connect to the Smartcard or the reader. I explained that work I had done a decade before that showed you just needed to illuminate the circuit of interest with a 10GHz CW signal and the chip would modulate the carrier just like the “great seal bug” or “Theramins thing” and carry the information out. It was the same work I had demonstrated to part of the UK IC back in the early 1980’s.
Having told Ross and a couple of other European researchers this, I thought it only fair to let PK know that people were ahead of his research in some respects and he should try the EM fault injection and illumination to enhance his work.
However appart from acknowledging the EMail I had no further contact from him. He however then went on to patent DPA and included enough of the existing EM method information to in effect stifle research in that area in the US. That is he in effect stole the method, why the NSA or other US IC agency let the patent go through I don’t know as they had been told via MI5 (as Tony Sale later confirmed). If you remember back RobertT and myself discussed the method and it was clear that I was not the only one to have worked on the idea at one point or another…
So whilst I may not have been the first I can show that it had been done considerably prior to five years before his patent application… and the USPO should have been aware of it.
Buck • May 17, 2015 7:36 PM
@Anthony Sand
What is the goal of analyzing one’s shopping behavior? Is it just to better understand the buyer, or is it also about drawing in new customers..?
So, say you had a really great experience at store A, and maybe you want to blog about it or tell your friends through some form of social media… Unfortunately, and unbeknownst to you, company B has bought a subscription to all the data feeds about their industry and competitors — for an extra fee, they were able to have ISPs and service providers send your magnanimous review to the bottom of all search results, where very few will ever see it (if any).
Perhaps the B corporation would even go so far as to leverage their friendly relationship with advertiser X and service provider Y, to make it look like your family and friends all love and support B when they really don’t…
Nick P • May 17, 2015 7:52 PM
@ Clive
My memory is foggy but I think U.S. patent law requires it published in a certain way to count as prior art. Trade secrets certainly don’t count as prior art as they’re not published. I doubt emails count. I think you would’ve had to turn it into a product or put it into an academic journal. If any I.P. experts are on the blog, I’d love for you to chime in at this point.
Andrew Wallace • May 17, 2015 8:44 PM
My comment on CNET:
Mr Chris Roberts,
You’re going to have to start behaving yourself.
You may want fame and fortune but this isn’t the way to do it.
To be a successful and respected researcher you need to have the authorities ‘on side’.
At the moment your intent seems to be maximum publicity while being a pest.
It will only end one way if you do not have the authorities on side.
They will find any way to turn public opinion against you and then throw you in jail.
There is no Twitter in jail.
http://www.cnet.com/news/fbi-claims-security-researcher-took-control-of-plane/#lf_comment=312582771
Buck • May 17, 2015 8:46 PM
@Nick P
(I think you meant to address me)
Look, I’m not saying those folks don’t know what they’re doing, but aside from APT1 and Sony, I’m hard pressed to find a mention of Mandiant without China being uttered in the same breath.
site:schneier.com mandiant
There’s probably good reason for that… I’m just stating my observations here.
@Clive Robinson
My thoughts were to include something like a range of elements which also includes the actual elements to do calculation.
Say you are trying to do something like 22 + 40.
An element list randomly generated: {12, 44, 50, 32, 10, 22, 40} which includes the actual elements you want to process. Another element list of operations like { + , / , – , * }. You go to each element in the numerical element list and random a second number. Say we have 12 and 50 being chosen. We use either all the operations in the operations element or at least enough operations element but should include the necessary operation which is the ‘+’ operator since that is the main target. The results would be discarded after computation and only the ’22 + 40′ operation would be stored into some memory cell after operation.
Maybe something more to add to the confusion would be to do 22/2 + 40/2 and the same for all the elements { 12/2, 44/2, 50/2, 32/2, 10/2, 22/2, 40/2} and then go about it’s random operations ?
This way, it will create a very complex and huge list of operations very quickly and whoever listening to it would likely have to search through every operation possible and the implementer must really have that sort of resource to handle it.
Indeed as you mentioned all these operations can come back to bite and we never know exactly what would happen as I don’t really see a lot of research spent on this area of dynamic operations or maybe I am missing something somewhere ?
@Clive Robinson
It’s also rather disappointing to hear someone snatch other people’s ideas given out of good will and simply patent it. It’s a very bad manners on their part ?
Figureitout • May 17, 2015 10:00 PM
Thoth
can’t 100% proof it
–Yeah, I know for sure 1st few revisions will fix some flawed assumptions and it’s always likely “I’ll get it wrong somehow”. The purpose of having something like the DDS is to be able to go from something like 0-60MHz, and more importantly to make different modulation and amplify it to such levels to make it as big a pain as possible to filter out. A massive CW rig may work good too (just keep switching it up though for different signatures), I’d just need my own power plant for the amount of watts I’m envisioning lol. Also there’s lots more surprising sources of really annoying noise, like DC motors, I may test these servo/stepper motors.
To be clear, I just want a PC like this only when I need it in emergency recovery procedures or secured file exchange where a stalker on the 1st order or some really bad malware would be needed to corrupt it. I’ll mostly be using insecure PC’s (going to purge this batch eventually when I can afford it, or just use for malware testing) bringing in files from internet, no shield, expose to other PC’s, etc. b/c I can’t operate like that all the time.
easy to destroy with a sharp object and a good amount of brute force […] send the screw driver blade into the chip a couple of times like beating up something in anger
–Why do you always want to destroy your electronics?! What happened? Did something happen to you, you want to speak about? It’s ok, we’re in the “tree of trust” lol :p
Clive Robinson
–Ok, thanks. Shady move, definitely would be wary if doing business w/ him. Sounds like you did a lot of emailing and I beg and beg for an email and nothing, bloody hell mate?
RE: injection locking (such an evil phenomenon)
–Know if this technique would work really well on something like a “frequency locked loop”? That would be bad for me. I have a suspicion it will, really badly. Wouldn’t it screw up all the clock signals and cause chaos too?
Buck • May 17, 2015 10:04 PM
@Anthony Sand
Placing stuff into a cart for me won’t make any new money out of me than what I’ve already decided to spend.
And that’s how we know the advertisements are really working! Our only choice is to go with either A or B; and as consumers, we’re implicitly choosing to subsidize the cost of all those banner-ads, billboards, etc. for those other customers who may still be on the fence…
Jason Stokely • May 17, 2015 10:19 PM
@ Nick P, “Going through the motions is how I look at it. ”
This sorta goes back to some postings about “proxies” in some discussion threads back (I forgot which one.) The bad guys may use “proxies” to do their biddings, but so can the good guys!
gordo • May 17, 2015 10:39 PM
@ Buck, a mention of “filter bubbles” is in the second-to-last sentence, below, and
@ name.withheld.for.obvious.reasons, another example of entropy is in the last sentence.
For all of these reasons, a critique of surveillance as privacy invasion “does not do justice to the productive character of consumer surveillance.” Modulation is a mode of privacy invasion, but it is also a mode of knowledge production designed to produce a particular way of knowing and a mode of governance designed to produce a particular kind of subject. Its purpose is to produce tractable, predictable citizen-consumers whose preferred modes of self-determination play out along predictable and profit-generating trajectories. Yet to speak of networked processes of surveillance and modulation in the industrial era vernacular, as systems for “manufacturing consent,” would be too crude. Rather, in a much more subtle process of continual feedback, stimuli are tailored to play to existing inclinations, nudging them in directions that align with profit-maximizing goals. So too with political inclinations; particularly as search and social networking become more seamlessly integrated, networked citizen-consumers move within personalized “filter bubbles” that conform the information environment to their political and ideological commitments. This is conducive to identifying and targeting particular political constituencies, but not necessarily to fostering political dialogue among diverse constituencies in ways that might enable them to find common ground.
(p. 1917, para. 1) [footnote numbers removed]
Cohen, Julie E., What Privacy Is For (November 5, 2012). Harvard Law Review, Vol. 126, 2013. Available at SSRN: http://ssrn.com/abstract=2175406
@Figureitout
“Why do you always want to destroy your electronics”
Don’t leave it to chance for an electronic not being treated properly before disposal. I have past jobs in certain agencies and the cultural habit of basic levels of sanitization and security is very careful and I have somehow had that habit rubbed off onto me now it has turned into a habit of sorts to sanitize stuff.
“What happened? Did something happen to you, you want to speak about?”
Sorry, can’t talk about past employers 🙂 .
Hard disk … use disk wiping algorithm and then wrap in newspaper and bring in a hammer. A little more paranoid ? Bring in a couple plastic bags and split them. Chips would require something like a drill or screw driver (if it is small). Workbench to sand down electronics are bulky and not available so the hammer also does the trick but unclean. if a drill is on hand, drill the chip in the center and if it still has space for the drill bit to fit in, you need a bigger drill bit or drill them in overlapping fashion. Paper letters with names and addresses need to be sanitize with a few strokes of black marker until the ink soak into the back and then shred it with machine or scissors or if you can use a properly controlled fire, it would be even better. Those are very basic security that can still be defeated if more efforts are dumped in but nevertheless better than nothing.
65535 • May 17, 2015 11:49 PM
@ Benni
“this shows how much money there is in from a proper metadata collection:
https://www.eff.org/deeplinks/2012/09/appeals-court-upholds-penalty-in-filesharing-case”
[and]
“Thousands of “crimes” worth $150,000 per infringed case… Does NSA or the ISP’s get money from copyright lawyers and filesharing lawsuits for their metadata collection?”
That is a good question. I would suspect so.
Due to the amount of money involved in the “metadata” game and the need to get Section 215 of the Patriot Act renewed before June, I would guess the NSA and its minions at the ISP’s and phone companies would pass “metadata” to RIAA copyright lawyers for continued support for Section 215.
This has nothing to do with “Terrorism” and everything to do with money.
Those are good links and good questions. I would conjecture the “metadata” is collected by the major phone companies and Internet Service Providers [the phone companies usually are also ISPs].
The linchpin to the section 215 [business records collection] is the ISP/phone companies being shielded with immunity from lawsuits dealing with Fourth Amendment and privacy violations. Without the legal shield they will be in trouble.
[NYT]
“What is the legal basis for the program?”
“Section 215 of the 2001 Patriot Act amended the “business records” section of the Foreign Intelligence Surveillance Act and made it easier to obtain a court order demanding business records… A 2008 law amending FISA shielded companies from civil lawsuits for complying with court orders.
“Officials said the program’s legal basis was the 2008 FISA Amendments Act, which was reauthorized in 2012 and allows the government to obtain an order from a national security court to conduct blanket surveillance of anyone “reasonably believed” to be outside the United States without individualized warrants even if the interception takes place on American soil. The law also shields companies from civil lawsuits for complying with court orders.”
See 75% down page:
http://www.nytimes.com/interactive/2013/06/07/us/comparing-two-secret-surveillance-programs.html?_r=0
Without Section 215 the whole metadata and blanket surveillance program breaks down – apparently due to the legal shield form customer lawsuits [I am not a lawyer. A legal expert from the ACLU or EFF could better explain the situation]
That is why it is very import to the NSA/government/corporate collectors of metadata to ensure Section 215 is re-authorized – in some form before June. Without re-authorization of 215 their “metadata” tracking program will be in shambles mostly due to privacy lawsuits.
Here is a look at an actual argument in court regarding Section 215:
[Lawfare]
“…Klayman told the court that the Founding Fathers would have been arrested and executed if King George had been fortunate enough to possess bulk surveillance capabilities like those challenged by Klayman’s lawsuit. Ditto when Klayman decried Section 215 as the greatest assault on freedom in the history of the country… the burden is on the plaintiffs, under the Amnesty v. Clapper ruling, to demonstrate standing—and they haven’t done that, according to Byron. All the more so, considering their allegation that the government not merely collects metadata associated with their telephone calls, but also uses it in a nefarious fashion–to build dossiers on plaintiffs and the like.
“So is it the collection of call data that triggers the protected legal interest, or the use? Senior Judge David Sentelle asks, and Byron acknowledges that the plaintiffs claim both. But the lawyer also stresses that there’s no legally protected interest in business records produced voluntarily to telephone companies, something clearly mandated by the Supreme Court’s decision in Smith v. Maryland…”
http://www.lawfareblog.com/2014/11/recap-of-yesterdays-argument-in-the-section-215-case/
@ Nick P
“There are two ways for them to get the information: at the protocol level from downloaders; metadata from ISP’s. If metadata, it was likely collected due to the constant threats by entertainment industry to sue carriers for facilitating or not stopping it. They’ve gone back and forth over the issue. It’s likely another compromise that they may make money on.”
My guess is the most promising way to the metadata is from the ISPs/Phone companies. Remember how the Sally Beauty credit card skimming was investigated by Verizon. I would say that Verizon has some unusually secretive methods of deep packet inspection/marking that makes it easy to track all communications to and from their customers.
It’s not to say that some TLA did not do some parsing of the data for the exact P2P downloader’s address – but the ISPs/phone companies have the base metadata.
Tangentially, this leads back to the re-authorization of Section 215 in June. Without Section 215 I believe the ISPs/phone companies would be wide open to invasion of privacy law suits. Keep you eye of the re-authorization of Section 215 – a lot of people have a stake in it.
[Excuse all of the grammar and other errors]
Wael • May 18, 2015 12:32 AM
@Thoth,
It’s also rather disappointing to hear someone snatch other people’s ideas given out of good will and simply patent it. It’s a very bad manners on their part ?
It happens more often than you’d think. It’s not only bad manners, it’s also equally an indication of lack of academic integrity and lack of self respect. I had my share of these incidents.
@Clive Robinson,
and the USPO should have been aware of it.
In an infinite universe, the USPTO (you forgot the “T” for “Trademark”) would be aware of it 🙂 You just have to travel far enough to see it.
A Nonny Bunny • May 18, 2015 12:54 AM
@Benni
The only crime that can be done using a telecommunication service is the sharing of copyrighted material between peers.
Err, no?
What about blackmail, fraud, distributing child pornography, distributing malware, extortion, scams, hacking retailers for credit card numbers, selling credit card numbers, selling drugs, stalking, mass invasion of privacy by storing everyone’s metadata, etc.
There are quite a lot of crimes that use telecommunications as a vector.
gordo • May 18, 2015 2:07 AM
@ name.withheld.for.obvious.reasons
…rumblings from within the monopolistic telco, ISP, and NAP network in trade press suggest such a thing…
The rumblings looks to have hit more mainstream press:
ISPs really, really want to be able to share your data
As your personal data becomes more valuable your ISPs want permission to share more of it.
Stacey Higginbotham | Fortune Magazine | APRIL 28, 2015
The FCC regulates how the ISPs share this data — and for the most part — ISPs can’t. However, with the new network neutrality rules, the FCC is eyeing how it wants to enforce privacy on ISPs. There is also a law called the Data Security and Breach Notification Act of 2015 recently made its way out of a House committee that could limit the FCC’s ability to oversee how ISPs share that information. This has consumer advocates worried that ISPs might suddenly use that treasure trove of data they have to offer more intrusive marketing campaigns or share the information with data brokers. (para. 7)
https://fortune.com/2015/04/28/isps-share-your-data/
Topics touched upon/covered include: “entity based regulation” [e.g., HIPAA]; deep packet inspection; perma-cookies; tiered privacy plans; CPNI data (Customer Proprietary Network Information); PEW Research Center 2014 privacy survey.
Winter • May 18, 2015 3:36 AM
“@Thoth,
It’s also rather disappointing to hear someone snatch other people’s ideas given out of good will and simply patent it. It’s a very bad manners on their part ?
It happens more often than you’d think. It’s not only bad manners, it’s also equally an indication of lack of academic integrity and lack of self respect. I had my share of these incidents.”
It is SOP.
European patent offices have an 18 month confidentiality period after you apply for a patent. That period is there only to prevent US entities from taking the patent application and getting a USA patent under the one year prior invention rule.
Patenting other people’s ideas is the bread and butter of the US patent system. See Neem tree patent, Enola bean patent, Basmati rice patent.
steve37 • May 18, 2015 4:43 AM
Navy whistleblower on the run after exposing alleged Trident safety failings
Able Seaman William McNeilly, 25, a newly qualified engineer, claimed that Britain’s nuclear deterrent was a “disaster waiting to happen” in a report detailing 30 alleged safety and security breaches.
Czerno • May 18, 2015 5:50 AM
@anonymous coward (May 17 2:25 PM)
4096 RSA key in the strongset factored.
… twas possibly a false alert.
According to :
https://blog.hboeck.de/archives/872-About-the-supposed-factoring-of-a-4096-bit-RSA-key.html
tl;dr News about a broken 4096 bit RSA key are not true. It is just a faulty copy of a valid key.
Prinz van de Schemering • May 18, 2015 6:01 AM
@tyr
Don’t feed the troll! It’s been sent to Conventry, hopefully back in time to that day in 1940 …
Andrew Wallace • May 18, 2015 6:22 AM
Bruce,
I wonder what you think of the latest news about Chris Roberts and the FBI.
Andrew
Andrew Wallace • May 18, 2015 6:29 AM
steve37,
William McNeilly will be arrested under The Official Secrets Act.
He has been very silly. Obviously wants his five minutes of fame.
A lot of the stuff in the document are personal rants.
Andrew
Clive Robinson • May 18, 2015 8:20 AM
@ Wael,
In an infinite universe, the USPTO (you forgot the “T” for”Trademark”) would be aware of it 🙂 You just have to travel far enough to see it.
Opps the lack of a T would make them “travel far enough” as they go postal as they deliver your papers and parcels far and wide 😉
Getting back to the Patent&Trademark Office, once upon a time they were supposed to get “military” and similar technology checked out by the likes of the NSA to check if it should be kept secret or conflicted with an already secret patent.
However now I think further on it the RSA patent should not have been issued for the same reason as it was system originaly developed by GCHQ some years befor that likewise the NSA et al knew all about under “The Special Relationship” which has always been very one sided as far as I can tell…
@ Nick P,
The US patent system has always been at variance with the rest of the world, and granted patents on ideas that no other country would even look at (see debate on SW patents). They also over turn other nations patents without good cause (I was involved with a patent on the use of multiple hard drives quite a while before “RAID” was –supposedly– independently thought up. Somebody I used to be friends with was involved with Liquid Crystal technology patent which a US court overturned without anything close to good cause… From this side of the puddle most people in technology have given up on the US patent system and tend to go for first Swiss then EU, Non US Pacific, ME&A and then finally US.
As for the CR patents themselves they are worthless outside of the US (and of questionable value in the US). Would be ignored by the rest of the world if it was not for the fact of US centric research symposia where academics present papers. Various previous oddities involving non US researchers (rember the Russian researcher and Adobe) in various ways have had a chilling effect.
@ Figureitout,
–Know if this technique would work really well on something ike a “frequency locked loop”? That would be bad for me. I have a suspicion it will, really badly. Wouldn’t it screw up all the clock signals and cause chaos too?
In some ways injection locking can be seen as both frequency and phase locking, which is why it’s main use was in NTSC and PAL chroma decoding and stereo audio decoding.
In essence you have a free running usually stable or very stable oscillator, and you just give it quite gentle nudges to lock onto what can be an increadibly noisy signal (think 12db or more down signal) especialy if augmented with a variable bandwidth tracking loop.
Back in the early 80’s it was playing around with this and seeing issues of RF getting into low power CMOS (1802) computer boards that gave me the idea of “Active EM Atacks”. If you think about it you can force oscillators to lock into a sync signal hidden in what looks like random noise bursts that you might expect from a noisy motor etc, which would in nearly all –non paranoid– investigations for bugs, etc, etc be ignored. They can with a little ingenuity on the attackers behalf come from different directions again apparently randomly.
As for effecting existing electronics, it’s the oscillator and any circuit that relies on threshold / level crossing time such as data regenerators etc that are vulnerable to manipulation. However only by relativly small amounts well within the tank Q of an oscillator and a few percent of the nominal threshold / level crossing time.
Thus if you had a plastic cased watch on your wrist, I might be able to move it forward in time by a few seconds a day with moderate EM signal levels.
Provided you have a good reliable clock source with a low impedence output and tracks you probably have little to worry about.
However if your design calls for free running unsnable oscillators for some security function then you could be in big trouble. The most notable such circuits are various classes of TRNG.
The reason that Ross Andersons system would be vulnerable was that he was hoping that the instability of the self clocking logic would be such that an external observer would not be able to get a sufficient sync for the likes of a passive DPA to work. I simply pointed out that the desired instability opened up the system to being externaly synced by an active attack, thus defeating the defence.
@ Thoth,
With regards spliting operations like addition up, I’ve talked here before about using a similar idea for splitting key info into two or more fragments that get put into memory to provide security. Think of it like the OTP where you use the key stream byte to split a data byte into two parts that when added together with the key stream byte provide the original byte in the CPU register only.
I’ve discused it with RobertT in the past here and he mentioned he had seen a hardware system based around a Lorenze Attractor.
The other thing to think about is all logical and arithmetical functions in the ALU (XOR / AND / OR / INV, ADD / SHIFT / COMP / SUB / MUL / DIV etc) can be done with the repeated use of the NAND function and a single internal register. In the case of multiplication it does not matter if you do the shift&adds sequentially or apparently randomly as long as they are all added effectivly only the once to get the final multiplication value.
Whilst grossly inefficient in terms of execution speed it will mess considerably with anybody trying to rebuild what you are doing.
As all crypto primatives likewise devolve down to just the NAND function you have a lot of opportunity to do such messing all be it oh so slow…
BoppingAround • May 18, 2015 10:19 AM
tyr,
If there’s something that might be ‘wrong’ with DDG so far, it is one of the founder’s former ventures, Names Database. This one had been criticised for ‘being too extortionate of “friend” references’.
Such a thing has evoked suspicion in some people and made them wary of DDG.
gordo,
Thanks for the paper.
re: ISPs and people’s data
or pay $99 per month for the same service without the snooping
And the guarantees are… what?
Gerard van Vooren, all other pro-peace
Seen you mentioning War is a Racket book the other day. If you are into books and have some time to spare, perhaps Aldington’s Death of a Hero might interest you, if you haven’t read it already.
Brilliant work, not only about the war but also about the certain attitudes of bourgeosie and the ‘artist elite’ which, it seems, haven’t changed that much after almost a hundred of years.
Charles • May 18, 2015 10:23 AM
@ Andrew Wallace
“I believe TOR makes you more tracable and draws more attention to you than your actual IP address.”
That’s why I don’t bother using TOR. I’m not going to insult you or anyone else but if someone were to insult you then using TOR would keep defamation lawsuit trolls at bay alteast until investigators catch up to the insulter which I’m sure you know quite a few. On the other hand, if you’re already watched then using TOR up the ante just a tiny little bit… right?
Charles • May 18, 2015 10:52 AM
@ required
“But I’m probably not the target audience but my point is that it feels silly to even guess how or if they got tipped of when we don’t even know who did it.”
True. Everything at this point is based on what’s reported. Visibility is low for average joes like us. Thus I wont put too much stock into these statements at this point.
Gerard van Vooren • May 18, 2015 11:28 AM
@ BoppingAround
Don’t get me wrong. I am not a ‘pro-peace’ kinda guy. I am, among a lot more, against hypocrisy, lack of accountability and rackets. It is just that war is a racket.
Marcos El Malo • May 18, 2015 12:51 PM
@Gerard van Vooren
I came across an interesting passage this morning. It’s from David Mamet in Three Uses of the Knife.
“Our Defense Department exists neither to “maintain our place in the world” nor to “provide security against external threats.” It exists because we are willing to squander all—wealth, youth, peace, honor, everything—to defend ourselves against feelings of our own worthlessness, our own powerlessness.”
If war is a racket, it is because we (collectively) are willing dupes unable to face our own human weakness.
Gerard van Vooren • May 18, 2015 1:43 PM
@ Marcos El Malo
That is way too philosophical. I would suggest you to read War is a Racket.
name.withheld.for.obvious.reasons • May 18, 2015 2:09 PM
@ Clive Robinson
I have been toying with a dual (FPGA for prototyping) DSP analog GPU computing architecture that performs “split” operations–one operation performed in the analog slice and one performed in the digital slice. The primary design criteria is audit and tamper detection which can provide sufficient performance characteristics. The design is reminiscent of the Transputer architecture that originated out of Silicon-Fen if I am not mistaken…
Could be the basis for a secure compute platform–but not in an FPGA package.
Bystander • May 18, 2015 2:35 PM
Re secure computing:
Asynchronous DSPs with sufficient computing power are available, asynchronous processors are also available – interesting article (thesis) here (pdf):
A Network-based Asynchronous Architecture for Cryptographic Devices by Ljiljana Spadavecchia
This combined with variation of the supply voltage could reduce the possibilites of side-channel attacks aiming supply and emissions.
Just a thought…
name.withheld.for.obvious.reasons • May 18, 2015 3:00 PM
@ Nick P, @ Anthony Sand
Mandiant is a security management company.
I believe one of the board members/executives is the U.S. Presidential cyber security czar, he was interviewed about cyber insurance schemes several years back…
BoppingAround • May 18, 2015 4:17 PM
Gerard van Vooren,
No problem, my bad making wild-ass guesses.
Clive Robinson • May 18, 2015 4:44 PM
RE : Mandiant
I have a considerable degree of suspicion about them.
As some know it’s founder had his own blog “Tao” and he indicated on it he had a military background to do with signals intelligence.
One thing that became clear was he had a very distinct “bee in his bonnet” about the Chinese and what later became APT.
He was thus a natural “drum banger” for those with what became the War Hawks “China APT”. Which for various reasons became not just an embarrassment but a humiliation for the executive.
Now whilst I can not attest to the quality of Mandiant’s abilities it quickly became clear that there was a distinct “Chinese APT above all else” in their press relations. If this was deliberate or not and by whom is not realy relevant now, as they have been tarred with a red brush and appear to see the world through red tinted glasses.
I like a number of others on this blog pointed out long before Snowden that the “China APT drum bang” was at best unhelpfull as it was evident from research that various other nations such as Britain France Israel Russia and many other nations were all doing the same thing.
Thus the US and Mandiant painted themselves into a corner over China and misled the public into thinking China was the only nation practicing APT etc.
Thus whilst I have no clue as to if Mandiant find APT and cyber attacks from other nations in their investigations, how they have been quoted and reported sugests that “they are blind to all else” and quite a few others have commented as such.
Unfortunatly for Mandiant and the US executive, Ed Snowden happened and it became clear to other nations that the US were very very hypocritical over APT to say the least, and desperatly tried to cling to some nonsense about not carrying out “economic espionage” and trying to claim some nonsensical moral high ground in their own minds. Well other whistleblowers have more recently shown that the “We don’t do economic espionage” is very much a compleate lie.
Unfortunately for the workers at Mandiant, their owner and senior staff tied their boat to the sinking ship of US credibility which now has sunk and dragged them down as well.
Whilst I suspect we have not seen the last of Mandiant I suspect it will be a long time before their credibility recovers in quite a few peoples eyes.
However whilst Madiant did make a rod for it’s own back, spare a thought for all the workers in other US tech companies that did not and now find they have uncertain times ahead due to the behaviour of the NSA making US products unwelcome in quite a few former lucrative market places.
Clive Robinson • May 18, 2015 4:52 PM
@ Marcos El Malo,
History has shown us that the “defence” by standing armies has served a usefull “social purpose” in that all to frequently it has been used as a dumping ground, for those who would these days be the recipients of other social systems (prison, welfare, mental health and even physical diability).
Benni • May 18, 2015 5:06 PM
News from the BND:
It said it only transfers 500 reports a year to NSA.
However, internal documents show that it gives 1,3 billion metadata per month to NSA. Furthermore, BND copies entire fibers directly to NSA and it does not look at the content of the data.
How BND justifies its old statement about only transferring 500 reports?
Well it says, giving NSA full access to all data on a fiber is not a “data transfer”….
The thing is that this is obvious nonsense. German law forbids such weasely language since it defines data transfer as “making avaliable saved or by electronic means collected data which contain personal information to a third person in a way that either the data is given to the third person or that the third person accesses or obtains the data…”
And now they are in very very big trouble….
Clive Robinson • May 18, 2015 5:35 PM
@ Name.Witheld…, Bystander,
DSP chips have an interesting history as “general computing engines”. Back many moons ago the early TMS chips were sufficient to put a minimal Forth interpreter on and also ended up doing service for PostScript laser printers and some network translation gateways where 68K processors could “not quite cut the mustard”. For my sins I was involved with a project to put a P-Code interpreter on one, which thankfully did not make it into mainline production.
I have looked at using the MicroChip PIC24 with inbuilt DSP to act as a “baseband” controler for a GSM unit for a secure external memory device with “panic button” voice channel.
I also used the DSP on PIC to act as a “hypervisor” that tracked the execution signiture of the PIC core as part of my experiments in my “prison architecture”. I also used the on chip high performance serial interface for chip to chip communication, which is what the Transputer was designed to do, way back when I waz a mad keen cyclist….
Silicon-Fen was also home to Herman Hauser’s Acorn Computers that used their own custom silicon in the “BBC Home Computer” which eventually changed to having it’s own high performance RISC CPU. Which eventually was “spun off” as “Acorn RISC Machines” which became an international success in it’s own right and most now just call the company and it’s CPU designs “ARM” with some current SoC systems having four or more ARM cores and memory on a single chip.
Any way enough wandering down “memory lane” 🙂
name.withheld.for.obvious.reasons • May 18, 2015 6:34 PM
An article posted to AP today by STEVE PEOPLES and KEN DILANIAN appeared in several news outlets today (Huffington Post, Fox News) and included a quote from the governor of New Jersey, Chris Christie, regarding the Patriot Act;
“When Edward Snowden revealed our intelligence secrets to the world in 2013, civil liberties extremists seized that moment to advance their very own narrow agenda,” Christie said. “They want you to think that there’s a government agent listening in every time you pick up the phone or Skype with your grandkids.”
I am sick and tired of the political class, media, and other sources that continue to lie–it reminds me of the gin up before the Iraq war…
People have to call out these idiots that provide uneducated quips on topics they know nothing regarding the subject matter. Or worse, deliberately spewing party line BS. Where are the Republicans on defending the constitution? I guess Republicans are nothing more than “2nd Amendment” constitutionalists, skipping the 1st and unable to count beyond two.
Justin • May 18, 2015 6:36 PM
@ Andrew Wallace
“I believe TOR makes you more tracable and draws more attention to you than your actual IP address.
“TOR is simply smoke and mirrors. http://idioms.thefreedictionary.com/smoke+and+mirrors
“Any investigator with enough time and resources can find you.”
I thought I had replied to you but I guess not.
Yes, you are quite correct about TOR. The authorities would probably just as soon you didn’t point out how ineffective it is, but well, that news is out anyways, and meanwhile there are still plenty of criminals who think they can buy and sell illegal drugs and such with Bitcoin on the “dark web” and not get caught. Until they do get caught.
When you think about it, there are many ways to break TOR without actually breaking TOR. For one thing there is browser fingerprinting, if the same computer is ever used to browse with and without TOR. You can’t very well completely hide the fact that you are using TOR—you have to connect more or less directly to a TOR proxy after all, and that right there puts you in a pretty small subset of users. Another thing is the final link between the TOR exit node and the site you are visiting. That link is probably either in the plaintext or encrypted with https with hopelessly insecure x.509 authentication. So a man-in-the-middle is feasible, and a browser zero-day can be used to uncloak your identity. See http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity
If the TOR people really cared about anonymity, they would design and build a highly secure privacy-oriented browser from the ground up, however primitive such a browser might be. Instead they bundle Firefox which is a sitting duck for the NSA with all its vulnerabilities. Well, I guess otherwise you are taking candy from children and no one will use your product.
gordo • May 18, 2015 6:41 PM
RE: Mandiant
These are from last year when Mandiant became part of FireEye:
FireEye Computer Security Firm Acquires Mandiant
Nicole Perlroth and David E. Sanger | The New York Times | Jan. 2, 2014
Mandiant is best known for sending in emergency teams to root out attackers who have implanted software into corporate computer systems. Much of its work focused on attacks from China, and last year it made headlines with a detailed study of a hacking group known as “Comment Crew” that provided the strongest evidence yet that the hackers were closely linked to a unit of China’s People’s Liberation Army, outside Shanghai. (par. 5)
[…]
The documents [Snowden revelations] have made it evident to companies that the United States monitors allies as well as adversaries, including friendly governments, international organizations and the networks of some Internet companies. Some could turn to companies like FireEye and Mandiant for protection, an interesting twist since many of Mandiant’s employees come from the American intelligence world. (par. 8)
http://www.nytimes.com/2014/01/03/technology/fireeye-computer-security-firm-acquires-mandiant.html
Cybersecurity Deal: FireEye Buying Mandiant for About $1 Billion
Acquired Computer Security Firm Is Known for Exposing Chinese Hackers
Danny Yadron | The Wall Street Journal | Jan. 2, 2014
Mandiant has become famous for its investigators that act like a cyber-SWAT team for companies that have been hacked. They focus on figuring out how hackers got in and removing them from corporate systems. (par. 6)
http://www.wsj.com/articles/SB10001424052702303370904579296723638611610
A look at FireEye’s Mandiant buy: Game changer or not?
FireEye needs to quickly meld malware mitigation with threat detection and forensic technology then gain customer acceptance
Ellen Messmer | Network World | Jan. 6, 2014
In announcing the $1 billion cash-stock deal last week to acquire Mandiant, FireEye indicated its intent to further integrate its virtual machine execution engine used to dynamically detect zero-day malware threats with Mandiant’s endpoint software for threat detection, response and forensics. FireEye had already done some work in this direction with Mandiant as a partner, just as it also has Bit9, Blue Coat’s Solera and Guidance Software as partners (par. 2)
Will FireEye’s Acquisition Strategy Work?
Richard Stiennon | Security Currents | Jan. 5, 2014
Mandiant is a breach response services company, arguably the best. The conference call slide deck on the acquisition states that its compound annual growth has been 50% for three years. Its best year was 2012 when it grew 76% according to the New York Times. Which implies that 2013, the year when its now famous APT1 report was published, saw a decline in growth. Mandiant had tapped out its market of high profile accounts that had suffered breaches, among them the New York Times, and Washington Post. Like other vendors in the counter-Chinese-espionage business they were running into long sales cycles, and no ability to go down market to the thousands of manufacturers, law firms, and think tanks, which are also targeted for industrial and political espionage but do not have the IT budgets to do anything about it. (par. 11)
http://www.securitycurrent.com/en/news/ac_news/will-fireeyes-acquisition-strategy-work
Nick P • May 18, 2015 6:42 PM
All right. Finally away from work long enough to fire off some significant replies. Huge backlog. I’ll knock it out in one post.
@ Buck
Oops. Good catch.
re Mandiant
I typed their name into Google to get funny results. They had a report on China’s main malware and their parent company did one on Russia’s. They do focus on China in media coverage. This might be for political reasons (eg M.I.C. mouthpiece) or just one of their main focus areas. The report indicates they found these in vast majority of breaches. Busting such a group is worth focusing on by reputation alone. Nonetheless, it’s quite in line with U.S. targets and so it’s only safe to assume they hand-hold plenty. People targeted by Five Eyes also shouldn’t do business with them.
Aside from that, the first page of Google showed something funny: one search result mentioned a sabotaged version of their PDF infecting computers with malware; a few links down was a guide to removing the Mandiant Security Virus or something. Malware authors often try to trojan things that are popular on the web. Epic that one group made people afraid to download Mandiant’s proudest work on malware by making it malware. Lol.
@ Jason Stokely
“but so can the good guys!”
Yeah: they’re called contractors. 😉 The FBI tips we might call friends in high places or just luck since FBI help is so rare.
@ 65535
It’s not as sneaky as you think: I swear that I’ve read somewhere that most have terms of service allowing this sort of thing. I know a local Tier 1 ISP or datacenter uses DPI equipment for security purposes ranging from protecting them to protecting customers to protecting them from customers.
Anyway, the ISP’s cooperation on copyright isn’t exactly secret: this article in 2012 and this report in 2015 say it explicitly. If anything, it’s surprising just how many groups (eg Google) are supporting these efforts.
@ Bystander
I appreciate the link. I’ll read it later.
@ name.withheld
re mandiant
It’s very possible. I couldn’t get Google to give me the list of their board members. Interestingly, the CEO is Dewalt of McAfee fame.
re secure architecture
What’s the advantage of splitting between analog and digital other than obscurity that our hardware advisor used to promote? If digital hardware is done right, then they attack it through subversion of design, subversion of production, interdiction swapping out chip with identical function, and/or EMSEC attacks. A digital device and a mixed device seem to offer same level of security with these attacks.
My recent forrays into analog design showed many of the functional blocks are simple circuits in terms of transistors but complex in funciton. Digital circuits from synthesis tools for common I.P. blocks are many fold larger. If reverse engineer knows both styles, I wonder which would be harder to reverse engineer? That question is for hardware people in general.
@ Clive Robinson
Yeah, that is disturbing. They might do it just to keep tight with the Five Eyes, get specialist assistance, defense contracts, media attention, and so on. The reason I slightly disagree with your damage assessment is that so many companies do this and are quite successful. Even with Snowden losses, most are making plenty of money and can also afford PR. Mandiant is no exception: they were successfully acquired by FireEye, which is doing quite well.
Currently, they seem to be the consulting and reporting arm of FireEye with products being merged together. FireEye’s website is plastered with all the usual security industry stuff. Hard to tell exactly what they can or can’t do against real attackers lol.
Benni • May 18, 2015 6:58 PM
Funny leak the safety of british submarines:
Clearly these things need mor whistleblowers…
Daniel Sa • May 18, 2015 7:07 PM
@ Clive Robinson
One thing that became clear was he had a very distinct “bee in his bonnet” about the Chinese and what later became APT.
Time to throw NKs into the mix? From their reportings it seems to me that theme is consistent with the use of “proxies” and secondary hacking(?) by use of coerce, guile, money, power, proxy boxes, bots(?), etc. What is so interesting is how they reach the “Chinese” as the origin of these patterns of behavior. May have some truth to it.
I like a number of others on this blog pointed out long before Snowden that the “China APT drum bang” was at best unhelpfull as it was evident from research that various other nations such as Britain France Israel Russia and many other nations were all doing the same thing.
Could it be that China is the only nation that does not cooperate with USA on cyber? It seems that Russians are at least semi-cooperative given ‘kaspersky’ etc. It’s good that we have experts to worry about that type of thing.
As some know it’s founder had his own blog “Tao” and he indicated on it he had a military background to do with signals intelligence.
I’ve not read his blog but I can imagine that to be so true and interesting. I will start reading it regularly. Thanks.
Zenzero • May 18, 2015 7:43 PM
@ Daniel Sa
“What is so interesting is how they reach the “Chinese” as the origin of these patterns of behavior. May have some truth to it.”
Not really so interesting as too fuel an arms based economy you need an enemy. Also the us know China has eyes on them, nut America is spying on everyone. It could be said its within all nations rights to spy back at them.
“Time to throw NKs into the mix?” you don’t reference this again, can you explain what you mean?
“Could it be that China is the only nation that does not cooperate with USA on cyber? It seems that Russians are at least semi-cooperative given ‘kaspersky’ etc.”
No, thankfully other nations don’t also cooperate with the us. Kaspersky is Russian based but there are many Chinese based security/networking/software providers, I don’t see your angle, can you elaborate?
gordo • May 18, 2015 7:49 PM
@ Clive Robinson
As some know it’s [Mandiant’s] founder had his own blog “Tao”
You’re thinking of Richard Bejtlich: http://www.bejtlich.net/index.html
Chief Security Strategist, FireEye, Inc., January 2014 – Present
Chief Security Officer, Mandiant, April 2011 – January 2014
https://www.linkedin.com/in/richardbejtlich
Kevin Mandia is Mandiant’s founder:
SVP & COO, FireEye, Inc., January 2014 – Present
CEO and Founder, Mandiant Corporation, 2004 – 2013
https://www.linkedin.com/pub/kevin-mandia/3/717/a0
Zenzero • May 18, 2015 8:05 PM
and Richard Bejtlich’s blog is really not a blog but just another sales page.
“Know your network before an intruder does” is the title of the blog, where is he CSO again…
gordo • May 18, 2015 8:15 PM
Zenzero, the TaoSecurity blog is here: http://taosecurity.blogspot.com/
Zenzero • May 18, 2015 8:28 PM
@ Justin
don’t feed the troll
Also, please remember TOR is only as good as a mix of the sites you visit, the precautions you take and the connections you make it over. If you do nothing but just connect to TOR then yes you could be tracked back, if you use good OPSEC then it’s a hell of a lot harder. Tor has it’s use, and it helps people around the world gain access to the interwebs they might not have access to because of their government.
When your working on the edge and you need internet to send a mail or blog, then TOR is a hell of a lot better then nothing
Zenzero • May 18, 2015 8:33 PM
@ Gordo
ah I was looking at http://taosecurity.com/ he appears to have multiple blogs, all with an agenda 🙁
gordo • May 18, 2015 8:59 PM
@ Zenzero,
Yeah, blogs are blogs! Mr. Bejtlich, like Mr. Schneier, is considered an expert in his field. Whether one agrees with a given bloggers views on whatever topic they’re posting or writing about is a separate issue.
Paperkey:
Link: http://www.jabberwocky.com/software/paperkey/
Simply put, a way to archive keys on paper. It should include a secret sharing mechanism (M/N) and also include a encrypted secret with password (Serpent cipher or AES cipher).
@Nick P
Maybe the better approach is an FPGA with base functionality of EMSEC confusion features backed into the metal layer circuits and the rest which are the crypto algorithms are not programmed until when needed and can be wiped in a moment’s notice.
Again, so much blackboxes which raises lots of eyebrows on how “clean” they are.
tyr • May 18, 2015 11:16 PM
offtopic:
Interesting take on current political looneyness.
http://www.antipope.org/charlie/blog-static/2015/05/thoughtcrime.html#more
William • May 19, 2015 12:27 AM
@Zenzero
All blogs have an agenda. That’s not saying much, whether it’s Mr Mandia or Mr Bejtlich. They both have some military background experience. What matters is what you can learn from it as an individual of free will.
Figureitout • May 19, 2015 12:52 AM
Thoth
–Ok, just sounded like you had some other…urges lol :p
Gotta make sure you take each piece of the HDD and dispose of it in separate waste bins, otherwise investigators will find the crumbs all in one place at the landfill.
Clive Robinson
In some ways injection locking can be seen as both frequency and phase locking
–Yeah, didn’t know if it mattered; they “can” be same thing, kinda; commercially, “digital frequency/phase locked loops” are showing up now. Thing is, we got an ADC that relies on a “reference voltage” which appears to be a pretty standard implementation; this reliance on another source I’m not sure of how or where it comes from exactly makes me nervous. It should correct itself, I wonder if a reset would “shake the fleas off” “good enough”.
Provided you have a good reliable clock source with a low impedence output and tracks
–I don’t think it’s super ultra mega reliable, but I’m real familiar w/ the chip by now. Guess I’ll find out, we need years of testing as that’s it’s expected lifespan. I like seeing the crystal at least w/ my eyes, it’s in the chip…
Markus Ottela RE: HWRNG from Mr. Vazzana
–Built it on breadboard and got it synced (it was funny seeing the oscilloscope give me ???’s literally once it was synced lol), going to be looking into some more RF analysis and some layout issues and finish up a module in due time (I have some other things I have to finish too, so I don’t have an exact time frame). I’ll probably describe it here and email you pictures and if I find issues w/ some light testing. I recommend anyone interested to get the components (should not be more than $15 or you’re doing something seriously wrong, unless you include powersupply and ‘scope) and build this as it’s pretty cool.
Some pointers to add to your manual though (I know you know this, but this is for your audience, which may include non-engineers who want to build but don’t know) that would be nice to know beforehand.
ONLY look at numbers on op-amps for pin outs, they’re mostly not needed otherwise. WATCH OUT for U1, it’s printed twice to limit spacing on the paper, it’s the same op-amp; only 2 op-amps needed. Any arrow you see on transistors (Q’s), that’s the emitter. The 2N3904 and 2N3906 has the same “physical” pinout, ie: w/ the flat side facing you, it’s EBC from left to right. Just look for the arrows, it’s confusing on the schematic how he flips it but it’s facing same-way (it’ll make sense what I’m saying once you build it). VREF is a VIRTUAL GROUND, I was confused on schematic it says VREF = VCC / 2; it does not equal that, at least don’t supply that to VREF. Where it says “T2 Digital Out”, that’s the 10K potentiometer, look up the pin out for whatever version you use, if there’s just 3 straight pins, the middle one is the “wiper” which is where you will be connecting the oscilloscope. Just start building circuit from left to right on a breadboard w/ plenty of the good jumper wires (don’t use the cheap arduino things except for power, those things make bad connections sometimes).
I may be forgetting some things. I suggest adding something to that effect to your manual, it’ll make it more user friendly for non-engineers who want to build TFC. Note it’s suggestion, if you feel people should know or find out the hard way, that’s up to you.
Curious • May 19, 2015 2:53 AM
With me not being a security researcher or mathematician or anything, after having read about the story of the debunking of broken 4096bit RSA mentioned abovce, it looks to me as if maybe a single bit or number value off the real and proper key could be terrible, because the key value then can be easily factored.
This have me wonder whether crypto solutions are so robust, that they can learn, know or check and see, if a ‘key’ is proper or not (and not simply a proper value + – some value).
I have next to no knowledge about these things, but it seems obvious to me that if the keys for use in crypto solutions were to not be guaranteed somehow to be proper, then hardware quirks, intended or not, might perhaps interfere with the “proper” math and eventueally lead to catastrophical crypto failure.
I guess the answers might be obvious to a lot of people, but I am wondering, what safeguards are there for crypto solutions to function properly in hardware, so that keying material doesn’t end up twisted and flawed?
@Curious
Your concerns of proper keys are pretty legitimate but most security-inflitrating systems and techniques do not place priority on how good your keys are (in terms of whether the keys are strong) or how good the cipher is. Most attacks work around ciphering systems instead of trying to go against the ciphering system due to the many holes in cryptographic implementations.
There are some self-test functionalities inside such systems but most of them are very limited functions which cannot be taken at face value and maybe close to worthless for that mere few seconds of Power-On Self-Test. In fact, many of them don’t do POST operations regarding the RNGs as these are only required in higher assurance systems.
A good ton of cryptosystems are naively created so that’s another point which can be attacked.
In fact, most TRNG/PRNGs simply spew a bunch of randoms and then use it for key materials or probably just do some manipulations on the randoms to fit into the required parameters or check for duplicates for unique keys and then use them right off.
There is no easy answer to ensure the robustness of key materials. One factor would be to test every random generated for key material but that is going to be painfully slow. The key materials generated is one thing but the other side of the picture is how the key material going to be deployed into the cryptosystem is yet another problem by itself.
Curious • May 19, 2015 4:07 AM
@Totoh
I understand that there might be this consensus in thinking that one better attack the implementation than attacking the crypto, because doing that would be cheaper, however what I find intersting is not so much getting around security, as the notion of crypto security not being real, because of how unintended glitches maybe have keying material being really weak.
Czerno • May 19, 2015 4:14 AM
@Curious :
«…having read about the story of the debunking of broken 4096bit RSA mentioned above, it looks to me as if maybe a single bit or number value off the real and proper key could be terrible, because the key value then can be easily factored.»
What the debunking showed actually is nowhere terrible. Noone’s public key was ever “broken”,
instead what happened was that, due to errors in transmission or storage, /invalid/ junk, /unusable/ for encryption puproses, found its way into keyserver records.
Absolutely no harm could result, but for people relying on public keyservers data to (try to) achieve an (initial) encypted contact with the owner of such an improperly recorded key.
Emphasis : the bad records found are /unusable/ junk, they /will/ be detected as such by any proper crypto app when trying to use one of them for RSA encryption.
Possible solutions : affected parties who have been warned should renew their keyserver records. Meanwhile people who tried to use incorrect records, and failed, would have tried to contact the addressee directly using other channels (possibly unencrypted) or to obtain the correct public key indirectly, from other persons e.g.
Anyway, a tempest in a tea-pot. All this underlines is anyone sharing their pub keys to a server should carefully check the record, and possibly re-verify that it is correct from time to time…
Benni • May 19, 2015 4:48 AM
Transit contract between the german service BND and the provider Deutsche Telekom:
http://download.krone.at/pdf/VertragWZschwarz.pdf
The contract says that Deutsche Telekom is forced to deliver to BND all internet traffic that has germany neither as destination nor as origin.
Additionally, Deutsche Telekom should get information from publicly available and internal sources (probably how BND can listen on fibers of other providers). Then, Deutsche Telekom should probably spy on the foreign providers themselves (the contract says, they should “implement planning consistent contract intentions in technically feasible applications ”
Additionally, Deutsche Telekom is forced to coach and train the BND agents and it should not say anything about the contract for at least ten years after its end. The cooperation began before the contract was signed, the agreement holds retroactively.
Now you would ask how much money deutsche telekom gets for doing all this:
Well they do this for 6500 Euros monthly.
Additionally, BND pays the surveillance hardware and necessary building projects…
And Deutsche Telekom does not want to tell BND anything about its own network infrastructure if this is against telekom interests. But that does not restrict the monitoring of Deutsche telekom itself. And BND should not give any surveillance data to the competitors of Deutsche Telekom. But it is not prohibited to harm the customers of Telekom or other network providers…
Bob S. • May 19, 2015 6:50 AM
Now, when I run TOR I see constant extraneous contacts by “isi.edu” at the TOR server level, mostly from California, but sometimes from Japan.
I am thinking, “that ain’t right”.
I found this:
“NSA and DHS Recognize USC/ISI for Academic Excellence in Data Protection Research and Education”
It appears to me NSA started vandalizing the internet from the moment it was born and has never stopped. Despite the Snowden Revelations, I think we know very little about how deep they go.
It seems they have vandalized, infiltrated, co-opted and corrupted virtually every aspect of the internet including hardware, software, standards organizations, carriers and even educational institutions.
Mitch McConnel says it’s needed for security.
I wonder however, whose security he is talking about.
Andrew Wallace • May 19, 2015 8:04 AM
Wake up TOR is compromised.
If you are using it for even slight nefarious purposes you may as well hand yourself into a police station now.
Andrew
@Bob S
Not surprising of NSA/Warhawk Agencies interests in trying to manipulate resources for themselves.
Before Internet came about, NSA had involvement in cipher machines and probably had meddling in them and one example of NSA’s touch is the Hagelin cipher. Albeit not a direct meddling, it still had an impact.
The security of the so-called upper echelon’s interest or to put it in plain words, the so-called National Security. The National Security agenda has many conflicting points against Personal Security and is always assumed that Personal Security must be weak enough for National Security to execute without much trouble but good enough for Personal Security to withstand day to day attacks. As we know, attacks always gets better (quote @Bruce Schneier) and we also know that Govt Agencies do misbehave themselves and are dishonest even to their superiors about their activities and information.
So what is National Security ? If you put it in a viewpoint where National Security works without the hypocritical strings and the misbehaviours, it is suppose to protect the “population”. Fact is, things don’t work out as intended and misuse is always something that lurks in the shadows just within arm’s reach.
Let’s move a little back into human history. We can observe from historical accounts of multiple civilisations to have some form of Witch Hunt events where the upper echelons of society decides to prosecute people who are either more knowledgeable or capable (mostly ancient philosophers and inventors who are labeled as heretics) and tortured in inhumane fashions and then executed in the name of certain believe systems or in the name of certain laws of the state. They were supposed to be executed to “protect the rest of society” but are they what they seem to be ?
We have to question the intentions of these so-called National Security agendas vs. Personal Security agendas. These two agendas clashes. Personal Security agendas invest the individuals in the ability to know clearly, make rationale decisions and self-defend against anyone. National Security agendas requires weaknesses in Personal Security so as to be able to subdue an individual. Both National Security and Personal Security are legitimate ideas and could co-exist as long as National Security doesn’t go crazy and Personal Security can allow self-defense and yet allow National Security to subdue problematic individuals.
The current state of National Security is that it has totally gone out of control, misusing it’s positions and trusts and simply just gone rogue. We have seen NSA/GCHQ/BND..etc.. doing mass poisoning of secure standards, mass surveillance and interceptions without authorizations from their countries and people, huge overreactions from these agencies and many other forms of activities that simply make us want to distance ourselves from them. The failure of National Security mechanism of the US, UK, EU and other nations who followed are mostly due to the population not being able to trust their Governments anymore.
Clive Robinson • May 19, 2015 11:53 AM
@ Gordo,
You’re thinking of Richard Bejtlich
You are right, I can even remember reading the post he made to say he was off to join them…
So the question arises why did I think otherwise… hmm.
gordo • May 19, 2015 2:17 PM
@ Clive
I, too, tend to take questions like that up with my webmaster 😉
George • May 19, 2015 3:33 PM
@ Clive Robinson
“Unfortunately for the workers at Mandiant, their owner and senior staff tied their boat to the sinking ship of US credibility which now has sunk and dragged them down as well.”
Err, welp, according to its founder the business wasn’t sinking but went global thru the acquisition. They’ve become the go-to guys for the most notorious breaches.
http://fortune.com/2014/02/13/kevin-mandia-why-selling-mandiant-made-sense/
Benni • May 19, 2015 3:36 PM
The recent cyber attack on the german parliament targeted computers of government members and the NSA investigation comission. The hackers started their infiltration with computers of the former SED and the green party (who are both a strong opposition in the NSA investigation comission. From there, the hackers went up in the german government network, which does not have localized all infected computers until now and they investigate whether the office of Merkel is infected…
Simple suggestion: 1) Use linux. 2) every workingplace should have 2 computers. One as a dumb internet machine, the second pc should come without internet connection as a workstation where one can write documents. But apparently, the german government thinks that computers on the internet are safe
Nick P • May 19, 2015 4:21 PM
@ CabbageControl
re capability book and OS/400 pointer behavior
You’re welcome! I’m glad the old guard wisdom helped someone out for a change. 🙂
@ Buck
“meant to address me”
I was too sleep-deprived to double check. Looking back now, it was a reply to Jacob’s comment. I just saw your comment now.
Buck • May 19, 2015 4:41 PM
@Nick P
Ahhh, likewise! 😛
Looking back now, I see that I missed @Anthony Sand‘s comment at 6:28…
@Benni
It is not like the Germans can’t afford high assurance computing. In fact they made a few. Wonder why it was not deployed … oh … it’s locked in the BND office so they can’t use it … I guess ?
Nick P • May 19, 2015 8:59 PM
Brief, academic research update for IT and INFOSEC
Draining the Swamp: Micro Virtual Machines as Solid Foundation for Language Development
Description: Modern languages are struggling over hard, core implementation issues. Three that stick out are garbage collection, architectural details, and concurrency. Plus, many implementations are just too big and hard to maintain. This work aims to create a micro virtual machine called Mu that takes care of the hardest stuff so language designers can focus on other stuff. It uses an LLVM-like instruction set. Language features, optimizations, etc are implemented as client libraries that interact with the VM. They’re currently targeting RPython to it and have the source here.
Building Efficient Query Engines in a High-level Language
Description: Applies staged or generative programming to database queries. Queries are written in high-level Scala, along with the engine itself. However, the Scala code generates highly-optimized, low-level C. It also continuously optimizes the query engine. The result is a query engine that outperforms a commercial, in-memory RDBMS and existing query compilers without tons of low-level code. Cool stuff.
Prototyping a Concurrency Model
Description: Uses Maude to create executable, formal specifications for the SCOOP concurrency model. The original SCOOP specification is tested against the model along with two extensions. This resulted in finding and fixing 16 errors. Rather than a summary, this is a detailed thesis showing how the author used Maude to model and test each aspect of SCOOP. It has plenty of educational value for people learning formal specifications or wanting to check protocols. This author’s team improves its speed here.
Verdi: A Framework for Implementing and Formally Verifying Distributed Systems
Description: A Coq framework for building verified, distributed systems. The tool lets developers formalize how the network works under various fault models. They prototype in an ideal fault model then convert that to realistic one’s using verified transformations. They show the tool works with a proof of Raft state machine replication, a verified primary-backup replication scheme, and a verified key-value store. These all perform similar to unverified software. I think this work and extensions of it are important given many security schemes I’ve posted are distributed systems who implementation needs to be correct. Could be combined with other work in protocol generation or security checking of protocols.
Improving Wireless Privacy with an Identifier-Free Link Layer Protocol
Description: Essentially, this is a WiFi-like protocol that “obfuscates all transmitted bits to increase privacy… includes… MAC addresses, the content of management messages, and other protocol fields” that WiFi sends in the clear. SlyFi associates with networks faster than 802.11 WPA-PSK. It has 10% throughput reduction compared to 3% for WPA-CCMP encryption. I haven’t thorough reviewed it but stuff like this helps against wardrivers and script kiddies.
Digital circuits in Clash – Functional Specifications and Type-directed Synthesis
Description: Author previously worked on Clash, a hardware description language in Haskell. Unlike embedded DSL languages, Clash uses Haskell directly to the point that it even allows normal Haskell libraries to model circuit behavior. Clash models the system in such a way that it can type-check the circuits for numerous correctness properties, including synchronization between clock domains. The Haskell circuits are synthesized into VHDL using a correct-by-construction method. Case studies showed the resulting circuits had performance comparable to hand-written VHDL with similar area and propagation delay. This work is good because it raises the abstraction and correctness level of hardware design (esp open source) without compromising much on performance. ASIC vendors can input the VHDL into their existing tools for gate-level synthesis and verification. Download links are here.
Beyond the PDP-11: Architectural support for a memory-safe C abstract machine
Description: Much of C’s lack of memory safety comes from the fact that implementations keep close to the PDP-11’s memory model. It’s hard to change because of assumptions in legacy code. Their attempt to implement a memory-safe C on the capability-secure CHERI processor helped them spot specific issues. They give detail on these. Then, they refine CHERI and their C model into a softcore CPU that can run legacy C code with strong memory protection. A quick glance at their graphs indicates single-digit, percentage performance impact. So, you get the benefits of C, strong memory protection, and the capability model of CHERI. Nice work.
Practical Covert Channels for WiFi Systems
Description: Authors note that most studies on WiFi covert channels are more theoretical. They’re more concerned with practical channels. They analyze physical layer at frame and symbol level. They then invent, implement, and profile two covert channels. They analyze and improve two known channels. Then, they compare performance and limitations on all four. I’m always happy to see new work to find or root out these insidious vulnerabilities.
Nick P • May 19, 2015 9:12 PM
Just found this good read.
How Amazon Web Services uses formal methods
Good to see a big player using formal methods and using them well. More might follow. I also liked the story about how their engineer came to use it and how their team evaluated it. It’s clear these people think like true engineers more than typical developers. I’m impressed. Might be a good place to work for programmers that don’t care for “code cutting” attitude that’s typical of many places.
Nick P • May 19, 2015 9:30 PM
@ Benni, Thoth
They have a third option: use medium-assurance technology developed by TU Dresden, Sirrix, and others in Germany. They could always invest in combining what they have with approaches developed by academia. The results only trust the hardware and firmware while allowing security-critical and legacy code to run side-by-side. They’ve already applied this to desktops, VPN’s, and phones. The next step will be licensing and/or customizing processors to be fabbed in Germany. That covers much of the risk, esp againt non-nation-state threats.
Nick P • May 19, 2015 9:42 PM
@ Thoth, all
re defense contractor gear like this
A General Dynamics spokesperson emailed me today. I just saw the message. It said that all of their INFOSEC products with strong assurance are for government customers only. They won’t sale to individuals looking to protect themselves from nation states. I’m going to see if they’ll clarify if that means they can’t legally sell it (my suspicion) or they won’t sell it due to policy. If the former, maybe they’ll tell me what specific laws or regulations apply.
@Nick P
To be a bit more granular, are they refusing sales to non-US Govt related customers ? What if a representative of a foreign Govt’s (non-UKUSA/FiveEyes) contractor agency is interested in such a product for use ?
For Govt contractors like GD and even for small security companies who sell low assurance technologies and pretends that they are working for the better of their Govt, they might just refuse sales of their products unless you have some kind of connection to pull some serious strings. Defense contractor gears with backdoor …
If they sell it to you eventually, you need to properly contain it and predict GD attempting to intrude you and might use your physical location addresses against you.
Regarding the BSI and German Govt’s who are trying to protect themselves against their fellow agency (BND), they could as you mentioned, produce their own medium assurance equipments with the help of local fabs and academia. I can imagine how Merkel’s team, the BSI, European Parliament and Merkel’s friends in Europe are flinching at BND’s revelation and BND might (my speculation) try to betray their own owners (German/Merkel Govt) as a last ditch effort to threaten Merkel/Germans so as to make themselves less culpable in their actions of aiding NSA to tap Europe illegally while German/Merkel tries hard to use some form of assurance to keep BND in check and also to protect themselves against BND and NSA since Merkel might have figured that BND have turned rogue and close to uncontrollable.
@Markus Ottela, Nick P
Are there thoughts of adding VOIP or some form of voice and video security via TFC ? If that is going to take place, the encoded voice and video data needs to be compact enough for limited OTP keystreams exchanged via SD cards.
@Nick P –only–
Just a little personal thing for you to know. I have a client using a Thales HSM and it had to be RMA (sent back) due to the chipset failure. The client is entitled for a couple years support and the level of details Thales asked before allowing the service is rather … discomforting. They wanted to know the end-user, business of the end-user, cryptographic usage, addresses of end-user and so forth. Not sure if that detail of information is required but Thales asked anyway before allowing RMA. Some of the clients might be from sensitive sectors and you can imagine how uncomfortable it is.
Wael • May 19, 2015 11:21 PM
@Nick P,
They won’t sale to individuals looking to protect themselves from nation states …
I respect that! Better than selling to civilians a tweaked version.
I’m going to see if they’ll clarify if that means they *can’t* legally sell it …
Why waste your energy? End result is the same: You won’t get it. Wait until they have it in a surplus store 😉
name.withheld.for.obvious.reasons • May 20, 2015 12:15 AM
Recently, over the past two months, the logged events on an exterior firewall (outside, beyond the exterior proxy server) appear to be originating from the feudal overlords (gobble, ass-book, nitwit, and double-dip) networks and include scans to port 23, 80, 443, 445, 808, 8080, and others. Sequence, timing, and flags indicate a programmatic probe. It used to be when a client application called an external host resource (a website, graphics, etc.) several simple call back strategies could be noticed…the new behavior is more aggressive than previous systems.
I’m sure I am not alone on this one and am interested in hearing about what others may be experiencing…
@name.withheld.for.obvious.reasons
Very likely someone is using these networks to leverage themselves to do their scanning work or these networks implicitly are running spy programs too !!!
@Nick P, JackPair et. al., Markus Ottela
I wonder if a single flow design using JackPair units would be useful for secure conversations but you will need 2 phone numbers per user with one number for RxM and another for TxM.
Btw it seems like JackPair is moving towards shipping off the first batch pretty soon.
Link: https://www.kickstarter.com/projects/620001568/jackpair-safeguard-your-phone-conversation/posts
So the idea of using JackPair for TxM and RxM would be phone number X set for Party A to receive and Party B to send while phone number Y set for Party B to receive and Party B to send. Using two phone numbers can be problematic so it can be reduced to a single phone number. To achieve a single phone number to be used as a uni-direction protocol, 2 pairs of shared/agreed keys have to be used.
We logically emulate phone number X now as key pair X and phone number Y as key pair Y. We know that key pair X is used for Party B to send to Party A and key pair Y is used for Party A to send to Party B. Initially it seems like asymmetric keys could be used as uni-directional controls due to how asymmetric keys work as a public-private keypair but encryption and decryption via asymmetric algorithms are heavy and cumbersome so a mini code stub that enforces a send/receive only program code with a one time symmetric key wrapped into the code logic is encrypted and propagated to all parties.
Assuming JackPair is programmable and fully open sourced as they have promised in their KickStarter project page, each party needs a pair of programmable JackPair modules with one module loaded with key pair X program code and the other remaining module loaded with key pair Y program. The modified JackPair would not do the usual Diffie-Hellman and Salsa crypto but would use the encoded program codes and keysets. The hardware also needs to enforce one way physical flows as well.
Now the problem would be how to route these one way traffic into the usual 3.5mm cables for the send and receive. Maybe a special splitter might be required of sorts and how to ensure the receiving JackPair modules on both ends cannot send but can receive encrypted voice from the other party. Multi-party encrypted calls are also challenging.
To ensure that the smartphone does not spy on the conversation, a bluetooth module acting as a gateway can be paired with a smartphone and the smartphone can be left in another locked room.
You might have a data diode + encrypting voice module.
Curious • May 20, 2015 1:59 AM
I guess the following is a little premature, but I wanted to ask a question:
What does the following mean? (It is from a recent article about LogJam attack or somesuch.)
“Breaking the single, most common 1024-bit prime used by web servers would allow passive eavesdropping on connections to 18 per cent of the Top 1 Million HTTPS domains. ”
I don’t get it, do web servers use the same prime numbers in their crypto?
I thought there were endless amounts of prime numbers to choose from.
In my brain, I am thinking, well if they all use the same prime number, that number is a known number, how is there any security in that?
Jacob • May 20, 2015 5:09 AM
Government on full throttle.
Intrusion software and hardware and any other software or system that might circumvent AV and firewall filtering or detection (including testing or research of computer or netwrok vulnerabilities and exploitation) will soon fall under the Controlled Export List and will be restricted under the Wassenaar agreement.
https://s3.amazonaws.com/public-inspection.federalregister.gov/2015-11642.pdf
J on the river Lethe • May 20, 2015 9:54 AM
Several thoughts come to mind. The applications could easily include cryptography as well as testing pure math theorems. Umm, pure math might apply to crypt. 🙂
https://www.quantamagazine.org/20150519-will-computers-redefine-the-roots-of-math/
Testing software and looking for chip/firmware problems. This is interesting to me at least. Analyze silicon, I still think CPUs are a place to look. The complexity is keeping anybody from doing it at least from what I can tell. But, would simple economics explain why nation states are making their own chips?
There must be more going on. Security breaches, lots, but an equilibrium must exist otherwise the actions in reaction would be much stronger. Just a thought.
The arena is always easier with social engineering but I do think silicon compromise is where the cutting edge of research is hiding. If things are hidden in firmware, how much more can be hidden in millions of unneeded transistors. Use of microcode.
Well, step off soapbox. Selling it the hard way. 😉
Benni • May 20, 2015 9:55 AM
Why does this flaw in the TLS protocol not surprise me…. https://weakdh.org/
Logjam Attack against the TLS Protocol. The Logjam attack allows a man-in-the-middle attacker to downgrade vulnerable TLS connections to 512-bit export-grade cryptography. This allows the attacker to read and modify any data passed over the connection. The attack is reminiscent of the FREAK attack, but is due to a flaw in the TLS protocol rather than an implementation vulnerability, and attacks a Diffie-Hellman key exchange rather than an RSA key exchange. The attack affects any server that supports DHE_EXPORT ciphers, and affects all modern web browsers. 8.4% of the Top 1 Million domains were initially vulnerable.
……
When they have agents in the standard commissions….
In 2004, a random number generator that was deliberately weakened by NSA made its way into a NIST standard: http://goo.gl/NW2ZnJ In short time, academics raised concern that this algorithm was deliberately backdoored. This turned out to be true but at first the claims were dismissed by NIST, with “NIST mathematician” Elaine Baker stating: “We do not have evicence for a […] backdoor. [..] For this reason we are not withdrawing the algorithm”: http://goo.gl/rXnwXz
It now turnes out that Mrs. Elaine Baker has the following biography, with the most worrisome detail that she was not only an NSA employee but also worked in international standard comissions, not just american, national ones:
http://goo.gl/o2UaCb “Elaine Barker received a B.S. in Mathematics from Central Michigan University. She has been extensively involved in cryptographic activities, beginning at the National Security Agency (NSA) as a mathematician in 1964. […] In 1983 she came to NIST as a mathematician and is currently acting as a supervisor for the development of cryptographic standards and guidelines in the Security Technology Group of the Computer Security Division. She has been involved with the development of a number of Federal Information Processing Standards (FIPS), American National Standards Institute (ANSI) and International Standards Organization (ISO)”
@Benni
Do we need a Open Community Cipher Suite list ?
It might include restricting modern cryptography implementations to remove all export grade algorithms and weak or possibly backdoored algorithms and use trusted community made ciphers ?
Markus Ottela • May 20, 2015 11:34 AM
@ Thoth:
Both VoIP and video conferencing are a technical possiblity, however they’re currently not planned features. I think the CEV version would be much more practical (assuming there’s enough computing power) for these applications (the features will naturally be also included in OTP version if ever added).
RE: JackPair
Just as you described, the main two issues are implementing the unidirectional data channel between the phones and JackPair device and ensuring microphones are removed from the tightly packed phone(s).
Diffie-Hellman is technically possible. But the longer the keys get, the larger the public DH value becomes: typing it manually to TxM device is anything but convenient, especially if it has to be done for each session instead of cycling the key through PRF after it has been generated.
For asymmetric crypto, you’d have to generate key-pair on TxM. Moving your private key to RxM is not a problem. However, you need to place the recipient’s public key to your TxM. This is not a problem if you can trust your friend: The keys are exchanged between clean TxM devices and private keys are copied unidirectionally to RxM. However, if any of your contacts is malicious, the TxM is compromised when you copy the public key to TxM. Using guards will help but you lose a lot of the assurance.
I’m almost certain the symmetric key generated by TxM, transferred unidirectionally to local and recipient’s RxM devices is the only secure and practical way to share keys. However I’m curious if any ideas are presented in Crypto 2015 paper #4: Cryptography with One-Way Communication (Sanjam Garg; Yuval Ishai; Eyal Kushilevitz; Rafail Ostrovsky; Amit Sahai (UC Berkeley; Technion; Technion; UCLA; UCLA))
Benni • May 20, 2015 11:38 AM
Why does this not surprise me:
Vulnerability overview/description:
NetUSB suffers from a remotely exploitable kernel stack buffer overflow.
Because of insufficient input validation, an overly long computer name can be
used to overflow the “computer name” kernel stack buffer. This results in
memory corruption which can be turned into arbitrary remote code execution.
Furthermore, a more detailed summary of this advisory has been published at our
blog: http://blog.sec-consult.com
Proof of concept:
Below is an excerpt from the vulnerable run_init_sbus() function (pseudo code):
int computername_len;
char computername_buf[64];
// connection initiation, handshake
len = ks_recv(sock, &computername_len, 4, 0);
// …
len = ks_recv(sock, computername_buf, computername_len, 0); // boom!
A proof of concept “netusb_bof.py” has been developed which exploits the
vulnerability. The PoC DoS exploit will not be published as many vendors
did not patch the vulnerability yet.
Example use that results in denial-of-service (kernel memory corruption that
results in a device reboot):
./netusb_bof.py 192.168.1.1 20005 500
Vulnerable / tested versions:
The vulnerability has been verified to exist in most recent firmware versions
of the following devives:
TP-Link TL-WDR4300 V1
TP-Link WR1043ND v2
NETGEAR WNDR4500
Furthermore we’ve identified NetUSB in the most recent firmware version of the
following products (list is not necessarily complete!):
D-Link DIR-615 C
NETGEAR AC1450
NETGEAR CENTRIA (WNDR4700/4720)
NETGEAR D6100
NETGEAR D6200
NETGEAR D6300
NETGEAR D6400
NETGEAR DC112A
NETGEAR DC112A (Zain)
NETGEAR DGND4000
NETGEAR EX6200
NETGEAR EX7000
NETGEAR JNR3000
NETGEAR JNR3210
NETGEAR JR6150
NETGEAR LG6100D
NETGEAR PR2000
NETGEAR R6050
NETGEAR R6100
NETGEAR R6200
NETGEAR R6200v2
NETGEAR R6220
NETGEAR R6250
NETGEAR R6300v1
NETGEAR R6300v2
NETGEAR R6700
NETGEAR R7000
NETGEAR R7500
NETGEAR R7900
NETGEAR R8000
NETGEAR WN3500RP
NETGEAR WNDR3700v5
NETGEAR WNDR4300
NETGEAR WNDR4300v2
NETGEAR WNDR4500
NETGEAR WNDR4500v2
NETGEAR WNDR4500v3
NETGEAR XAU2511
NETGEAR XAUB2511
TP-LINK Archer C2 V1.0 (Fix planned before 2015/05/22)
TP-LINK Archer C20 V1.0 (Not affected)
TP-LINK Archer C20i V1.0 (Fix planned before 2015/05/25)
TP-LINK Archer C5 V1.2 (Fix planned before 2015/05/22)
TP-LINK Archer C5 V2.0 (Fix planned before 2015/05/30)
TP-LINK Archer C7 V1.0 (Fix planned before 2015/05/30)
TP-LINK Archer C7 V2.0 (Fix already released)
TP-LINK Archer C8 V1.0 (Fix planned before 2015/05/30)
TP-LINK Archer C9 V1.0 (Fix planned before 2015/05/22)
TP-LINK Archer D2 V1.0 (Fix planned before 2015/05/22)
TP-LINK Archer D5 V1.0 (Fix planned before 2015/05/25)
TP-LINK Archer D7 V1.0 (Fix planned before 2015/05/25)
TP-LINK Archer D7B V1.0 (Fix planned before 2015/05/31)
TP-LINK Archer D9 V1.0 (Fix planned before 2015/05/25)
TP-LINK Archer VR200v V1.0 (Fix already released)
TP-LINK TD-VG3511 V1.0 (End-Of-Life)
TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-VG3631 V1.0 (Fix planned before 2015/05/31)
TP-LINK TD-W1042ND V1.0 (End-Of-Life)
TP-LINK TD-W1043ND V1.0 (End-Of-Life)
TP-LINK TD-W8968 V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-W8968 V2.0 (Fix planned before 2015/05/30)
TP-LINK TD-W8968 V3.0 (Fix planned before 2015/05/25)
TP-LINK TD-W8970 V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-W8970 V3.0 (Fix already released)
TP-LINK TD-W8970B V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-W8980 V3.0 (Fix planned before 2015/05/25)
TP-LINK TD-W8980B V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-W9980 V1.0 (Fix already released)
TP-LINK TD-W9980B V1.0 (Fix planned before 2015/05/30)
TP-LINK TD-WDR4900 V1.0 (End-Of-Life)
TP-LINK TL-WR1043ND V2.0 (Fix planned before 2015/05/30)
TP-LINK TL-WR1043ND V3.0 (Fix planned before 2015/05/30)
TP-LINK TL-WR1045ND V2.0 (Fix planned before 2015/05/30)
TP-LINK TL-WR3500 V1.0 (Fix planned before 2015/05/22)
TP-LINK TL-WR3600 V1.0 (Fix planned before 2015/05/22)
TP-LINK TL-WR4300 V1.0 (Fix planned before 2015/05/22)
TP-LINK TL-WR842ND V2.0 (Fix planned before 2015/05/30)
TP-LINK TL-WR842ND V1.0 (End-Of-Life)
TP-LINK TX-VG1530(GPON) V1.0 (Fix planned before 2015/05/31)
Trendnet TE100-MFP1 (v1.0R)
Trendnet TEW-632BRP (A1.0R)
Trendnet TEW-632BRP (A1.1R/A1.2R)
Trendnet TEW-632BRP (A1.1R/A1.2R/A1.3R)
Trendnet TEW-634GRU (v1.0R)
Trendnet TEW-652BRP (V1.0R)
Trendnet TEW-673GRU (v1.0R)
Trendnet TEW-811DRU (v1.0R)
Trendnet TEW-812DRU (v1.0R)
Trendnet TEW-812DRU (v2.xR)
Trendnet TEW-813DRU (v1.0R)
Trendnet TEW-818DRU (v1.0R)
Trendnet TEW-823DRU (v1.0R)
Trendnet TEW-MFP1 (v1.0R)
Zyxel NBG-419N v2
Zyxel NBG4615 v2
Zyxel NBG5615
Zyxel NBG5715
Based on information embedded in KCodes drivers we believe the following
vendors are affected:
Allnet
Ambir Technology
AMIT
Asante
Atlantis
Corega
Digitus
D-Link
EDIMAX
Encore Electronics
Engenius
Etop
Hardlink
Hawking
IOGEAR
LevelOne
Longshine
NETGEAR
PCI
PROLiNK
Sitecom
Taifa
TP-LINK
TRENDnet
Western Digital
ZyXEL
name.withheld.for.obvious.reasons • May 20, 2015 11:58 AM
What is it with government control freaks? Weren’t the Maoist, Stalinist, Hitler purges enough? Mention of on article on Slashdot suggests that knowing integer division, let alone long, is enough to rise the ire of the state.
I am headed towards the bin to toss my 41CV…
name.withheld.for.obvious.reasons • May 20, 2015 1:02 PM
Rand Paul, the only citizen to be elected to the senate, has taken the floor to filibuster the Patriot Act renewal.
I SUGGEST ALL SUPPORT THIS SENATOR, ONE OF THE FEW IN CONGRESS WITH THE GUTS TO STAND ON PRINCIPAL…NOT ON THE PUBLIC’S THROAT. CALL WASHINGTON DC CONGRESSIONAL SWITCHBOARD…
Benni • May 20, 2015 2:55 PM
That’s great: 5 eyes attack the german parliament and the opposition in the NSA investigation comission: http://www.spiegel.de/netzwelt/netzpolitik/bundestag-ermittler-vermuten-geheimdienst-hinter-cyberangriff-a-1034790.html
Thats great, go NSA, go….
This way, there is some hope that they will become angry enough that they will finally publish the real NSA selector list on wikileaks..
Gerard van Vooren • May 20, 2015 3:19 PM
@ Benni
I wonder what Angela Merkel is saying this time on the phone with Obama.
XX10 • May 20, 2015 4:07 PM
US Charges Academics for Industrial Espionage
http://www.dw.de/us-charges-chinese-academics-with-industrial-espionage/a-18462377
Tech spies from the inside David Johnson, FBI special agent in charge in San Francisco, called the scheme a “methodical and relentless effort by foreign interests to obtain and exploit sensitive and valuable US technology” by using people inside the country. Hao Zhang, who appeared in front a Los Angeles magistrate on Monday, is facing up to 50 years in prison. All the other suspects, in case they are arrested, could also be convicted to decades behind bars.
tyr • May 20, 2015 4:50 PM
Here’s the latest existential threat.
Given todays population levels, a major fail in the
pollination rates could put us all back into another
dark age. The trouble with the biosphere is that its
hard to notice when it begins to move in a direction
that poses a threat. See a few less bees most will
assume it just means less people getting stung they
don’t make the connection to less food.
New Zealand had a 23 foot squid wash ashore.
Marcos El Malo • May 20, 2015 4:55 PM
@Zenzero
I hope I’m wrong and just being hypersensitive, but I suspect AW is using sock puppets in the Chris Roberts/avionics thread to talk to himself. Is it just me?
Justin • May 20, 2015 5:27 PM
@ Marcos El Malo
I for one am not Andrew Wallace and I have no idea who he is. If his comments aren’t interesting to you, don’t respond to them. It’s going a bit far to accuse everyone who talks to him of being a sock-puppet. I don’t agree by any stretch with everything Andrew Wallace says. I just try my best to keep my disagreements with him civil, and sometimes comment on points of agreement.
I suspect there are folks from the FBI, NSA, etc. who lurk or even post here, and they feel somewhat affronted by folks who claim everything they do is evil. One of the points I try to make is that they should respect a plain reading of our rights in the Constitution. At the same time I feel we have a need for these organizations to protect our freedom. Not everyone who disagrees with you or me or somebody else is a troll or a sock-puppet, and such accusations and digging up dirt on people do not make for very interesting conversation.
Justin • May 20, 2015 5:48 PM
@name.withheld (fake or not)
Good for Rand Paul. Let’s return to the Constitutional rights our nation was founded upon.
Zenzero • May 20, 2015 6:05 PM
@ Marcos El Malo
He has been using the same tactics for trolling for years now. searching duckduckgo.com for N3td3v and a quick peruse of the contents shows the same language, threats and style of writing as he did does here. He’s either a troll, chemically confused or medically sick, its quite hard to say.
Only organisation he’s mentioned he was in is MI7 which ceased to exist in the 40’s
name.withheld.for.obvious.reasons • May 20, 2015 6:46 PM
@ all
FROM THE WELL OF THE UNITED STATES SENATE, CAPITAL BUILDING 20 MAY 2015 7:40 EDT
United States Senator, Rand Paul, has argued for the expiration of the Patriot Act; a MUST have requirement is the elimination of bulk collection under section 215 and 702. The senator is taking the existing authorities and statutues in a nearly stepwise fashion describing the legal precedence and relavent constitutional issue. A specific issue that was highlighted in Smith V. Maryland case, the third part doctrine and cited by the FISC as the rational and legal basis for bulk collection, is the difference between the nature, type, scope, and extent of communication with technology available in the 1970’s and contemporary technologies.
Senator Paul references a number of NSA programs (MUSCULAR, XKeyScore, UPSTREAM, etc.), explaining the program and how it comports with what has been disclosed in public by officials, the PCLOB, and others. The senator sees the issues surrounding the abuse of the citizenry; citing multiple instances of abuse and illegality by the IC, the willful ignorance of government officials to the spirit and language of the law–by any intterpritation–and the complete lack of push back by individual citizens. Paul suggests that the level of harm requires an uprising (non-violent).
The senator’s rhetoric is cogent and sound, keeping with history and in line with the intenet of the framer’s (not the living document theory). Proposiitions, suggestions, and actions related to the Patriot Act and what can and should be done is well thought out, there is little to disagree with what the senator proffers. The argument that there is a need for a debate cannot be dismissed–Paul suggests that the Patriot Act has been re-authorized mulitple times without substantive debate or congressional scrunity. One of the amendments that Paul suggesting the elimination of immunity from liability by entities that have customer agreements. The senator is pushing for the senate to bring up the authorization to allow for amendments–unlike the last minute, have to pass it now, strategy that McConnell wants to employ.
Paul’s response to the question that others have if the act expires “What will we do?” Paul’s response, “Maybe we could live with the Constitution for a while.”
Justin • May 20, 2015 6:46 PM
“searching duckduckgo.com for N3td3v”
That was already well covered in another thread, if I recall correctly. And that thread was closed because the subject was quite exhausted. Bringing it up again seems suspiciously like trolling to me.
Anura • May 20, 2015 6:48 PM
@name.withheld.for.obvious.reasons
Rand Paul is not filibustering the bill, since the vote isn’t scheduled to be voted on today. This seems more like just a bit of attention-grabbing for the upcoming Republican primaries.
Nick P • May 20, 2015 6:52 PM
@ Thoth, Wael
re secure equipment availability
Here was the response of why they won’t sell the high assurance stuff: “Not by “law” but by policy determined by the National Security Agency for Type 1 security cryptographic equipment. They are the governing authority.” Apparently stretches to non-Type-1 and non-CCI items that are NSA certified. Probably use about the same process and techniques minus some to reduce costs or inconvenience.
So, the questions:
Is there a law that makes NSA’s policy enforceable on cryptographic equipment made by a defense contractor? By any commercial entity in general? Or under certain conditions (esp actual security level)?
Or is it merely a combination of contractual agreement with NSA and parts of it being classified information? Such a voluntary agreement would let NSA dictate the policies about such devices so long as DOD continued buying them.
@ Thoth
re TFC
I’ve already posted that it could be modified to do voice and video. The slow diodes must be swapped for faster ones, although voice can use serial. It’s not high quality voice after crypto squeezes out time and space. Options: one-way, higher-speed serial; one-way IR; one-way Ethernet; one-way Fiber; custom protocol on microcontroller with plenty I/O; each connects to a fast guard. Those are your options.
re JackPair
I’m not sure that you need two phone numbers: you need two JackPair-style devices instead with smartphone as the transport. One physically connects to earphone. One to microphone. That’s the TFC model. They might have to sync somehow or use preloaded keys tied to specific callers. The setup would be too inconvenient. It’s better to simply implement the JackPair device in a robust way: either good implementation on CPU supporting strong security or a dedicated ASIC with critical properties done by hard I.P. blocks. Likewise, such an implementation might even emulate a TFC-style separation with several, inexpensive chips.
name.withheld.for.obvious.reasons • May 20, 2015 7:01 PM
@ Thoth
Your description of “National Security” and “Personal Security” leaves little to the imagination…it is more subtitle than the Maoist purges but no more reassuring than being in Poland in 1938.
Grauhut • May 20, 2015 7:04 PM
@Benni: I place a bet they will try to sell us a story about “russian cyber troopers” in the case of the Geman parliament hack! 😀
http://ca.reuters.com/article/topNews/idCAKBN0O01ON20150515
If its 5eyes they will cry a litte, if we never hear any attribution, look near east.
But i am shure some CSC consultant will find russian evidence! 😉
Zenzero • May 20, 2015 7:04 PM
@ Justin
not trolling ,responding to a question with relevant information for someone to do their own research on something so its not just my word, hardly trolling methinks. Some other peoples comments were obviously trolling but you made no comment.
Maurice_G • May 20, 2015 7:18 PM
@ Zenzero
He has been using the same tactics for trolling for years now. searching duckduckgo.com for N3td3v and a quick peruse of the contents shows the same language, threats and style of writing as he did does here. He’s either a troll, chemically confused or medically sick, its quite hard to say.
Only organisation he’s mentioned he was in is MI7 which ceased to exist in the 40’s
From wikipedia:
MI7, the British Military Intelligence Section 7 (now defunct), was a department of the British Directorate of Military Intelligence. Part of the War Office, MI7 was set up to work in the fields of propaganda and censorship.
disclosure: I duckduckgo’d it.
zenzero • May 20, 2015 7:31 PM
@ Maurice_G
Exactly “Military Intelligence Section 7 (now defunct)”, quite a feat for someone who says they were born in the 80s.
Full disclosure is good 🙂 And yes keep it out of google’s hands and remember, google have the takedown order, so not really the best place to solely use for research.
@Nick P
That’s exactly what I proposed later inside the same JackPair suggestion where instead of two phone numbers, it uses two pairs of symmetric keys wrapped into program stubs so you effectively only need 1 phone and 2 JackPair devices. Two symmetric keys used so that in the event somehow the data from either lines cross into each other, it would not be able to decipher or so to keep a logical control over the flow. Of course a more modified version would be to reduce everything to 1 JackPair with 1 phone and 1 phone number. That would include creating multiple physical and logical security domains with a sending red-black separation unit and a receiving red-black separation unit (using at least 2 sets of chips with 1 for sending and 1 for receiving) which are further divided to red and black segments so that instructions and data/keys for sending and receiving can be separated.
Regarding the sales of IP products that have the touches of NSA in it (Type 1 or non Type 1), I think it’s simply a defensive mechanism by NSA to prevent reverse engineering by the end-usrs whom they don’t trust.
If you scroll up this post, you will notice me and @Clive Robinson discuss about dynamic and static algorithms and tactics to defend IP chips and thinking about that particular discussion, I am pretty sure the NSA and their contractors employ pretty static means of defense due to the heavy performance cost a dynamic defense method would incur on their IP chip. NSA simply does not want their IP to be revealed or subjected to research.
Maurice_G • May 20, 2015 7:53 PM
@ zenzero
It’s (defunct) or it may just have gotten brand new alphanumerics. Nobody really know for sure. The last thing Ministry of Truth wants is to call itself just that.
disclosure: I know that the guy who operates duckduckgo used to push that site on various internet comments sections. Frankly, I like that because I’d rather he not be buying and sold to adverts.
Justin • May 20, 2015 9:37 PM
@ Zenzero, Maurice_G
“disclosure: I duckduckgo’d it.”
What a bunch of baloney! You’re all trolls!
Figureitout • May 20, 2015 9:52 PM
In fact, most TRNG/PRNGs simply spew a bunch of randoms
Thoth
–Yes, that’s the purpose of an RNG lol, personally I call every RNG a PseudoRNG since we don’t have a definition of what random is. The one in TFC takes a common approach of using the PN-junction avalanche breakdown where we can’t predict well w/ current circuit analysis (which I personally think is still at a very basic level and can get much better, but the basic analysis methods are pretty solid IMO).
and then use it for key materials or probably just do some manipulations
–Depending on how much work one wants to do to basically separate the sources from one another and mix them together. I don’t think the mixing is the problem, but the input and full function of the system.
There is no easy answer to ensure the robustness of key materials.
–Nope, you have to do it yourself quite frankly. If it’s important enough info, you shouldn’t skimp on this.
how the key material going to be deployed into the cryptosystem is yet another problem by itself
–Yep, b/c no cryptographers can enunciate what “properly implemented” actually is. So someone else is going to have to find out.
Nick P
–Interesting papers, I’d rather see some manuals to build them in a weekend project though b/c I read datasheets all day.
RE: GD chips
–Who cares, they probably aren’t that much better than what you can make. We can always play the reverse psychology game too, call their product a bunch of sh*t (General Dynamic’s product sucks ass guys). Then their rep. pops up “No it’s not! Here take these chips!” lol, and they’re backdoored…If the company doesn’t want your money, then just move on; just get on another list…
Bystander
–Not bad thesis, made it thru ~100 pages til I passed out last night, probably finish it before next week. There were some parts that are hilariously relevant to this thread and I think Clive Robinson should read thru the first few pages for some chuckles (or rage lol)…
name.withheld.for.obvious.reasons
–Too little too late. It’s over. No self-respect in that area so I left; anyone tries will get the stasi on them. We have to wait ’til the next Hitler and then we’ll kill and implement changes and care about our civic duties, but only after millions of citizens are killed.
Huawei’s 10KB tiny IoT Kernel
Links:
– http://www.theregister.co.uk/2015/05/21/huawei_announces_tiny_10_kb_iot_kernel/
– http://wiki.oiotc.cc/index.php?title=Liteos#.E5.B8.B8.E8.A7.81.E9.97.AE.E9.A2.98FAQ
– http://pr.huawei.com/en/news/hw-432402-agilenetwork3.0.htm#.VV1H7Ua555M
If the 10KB kernel (usable on ARM cores) can be made into secure proven microkernels (some sort of seL4/OKL4) and can be flashed onto a large variety of ARM cores with very little efforts, it would be very useful.
@Jacob
To expand on US attempts to clamp down on 0-day exploits as munitions and export controlled items.
Link: http://www.theregister.co.uk/2015/05/20/us_export_controls_0days/
It is simply a US strategy for NOBUS operations and to incriminate anyone other than them who can have the privilege (thus solidifying NOBUS activities and privileges). If NObody But USa can have 0-days exploit in a loose sense, the Cyber-Warfare capabilities of USA would be much more advantageous but such an export control would not go well as offense would gain an advantage over defense.
Either this will end up as another cyber policy disaster being forcefully fast tracked and approved with full effects and good receptions amongst friendly allied nations or it would be fast tracked, fast difficulties and have bad reception or it would be shot down.
Either way it’s a disaster.
Figureitout • May 20, 2015 10:35 PM
Thoth RE: LiteOS
–Useful indeed if it’s ARM compatible and does what it claims. Took me a minute to find the source (I think, someone was about to put it up on github but nope). They use this little trick w/ GCC which may cause security problems but it can be nice, which I didn’t know before lol w/ header files with GCC.
#include “../blahblah/string.h” You can then just drop the files you need in the directory and it should work as compiler searches for the files there but sometimes still some funky IDE bugs requires a little more tinkering.
Kernel code could use some more commenting and a little clean up to be “more perfect”. Not bad so far, does look a little hacky though…(no stranger to that, just takes time…and I wouldn’t call it secure b/c bugs…).
Link to source “I think” as it means more than news articles: http://liteos.googlecode.com/svn/trunk/SourceCode/LiteOS_Kernel/
Gerard van Vooren • May 21, 2015 2:01 AM
@ Marcos El Malo
“I hope I’m wrong and just being hypersensitive, but I suspect AW is using sock puppets in the Chris Roberts/avionics thread to talk to himself. Is it just me?”
You are right. I suspect “Justin” (well the guy admitted it), “Vulnerability Researcher” and one more.
According the 19 page 2006 Krawetz paper N3td3v is a 3 or 4 person group.
Looking at their past they have a lot of shite.
Bob Paddock • May 21, 2015 7:11 AM
“Penn State College of Engineering had been penetrated…
Had government-sponsored research been going there…”
I can affirm that is the case as I interviewed for a position once:
“The Penn State University Electro-Optics Center (EOC) was established
in 1999 as the Navy’s Center of Excellence for Electro-Optics. The
center is located in Freeport, Penn., utilizing two facilities with a
total of 63,000 square feet of laboratory and office space. The EOC’s
vision is to be the national resource for the advancement of
electro-optics and related technology for the primary benefit of
national security…”
Zenzero • May 21, 2015 7:46 AM
Has anyone used openocd before?
http://opensource.com/life/15/5/open-source-on-chip-debugger
Could it feasably be used to detect implants/malware living in some hardware I wonder
Jacob • May 21, 2015 12:28 PM
@Nick P
I don’t know if you have plans to purchase such high-assurance comm equipment or it is just an academic curiousity of yours, but have you looked at equipment sold by foreign countries which surely will not contain restricted NSA stuff in it?
Mike (just plain Mike) • May 21, 2015 1:27 PM
From the BBC (via Krebs):
mSpy admits hacking and data theft
A company offering software that allows people to spy on others has admitted it has been hacked and had thousands of customer records leaked online…
Apparently it is fine for parents to put spyware on their kids’ phones and computers – and it’s maybe even fine for employers to put spyware on their employees’ devices too and – maybe – it’s even fine for people to put spyware on the phones and computers of their adult significant others – because – presumably – if you’ve got nothing to hide, you’ve got nothing to worry about.
However…
Katherine Till, one of the customers contacted by Mr Krebs, confirmed to him that she and her husband had paid mSpy to monitor the mobile device of their 14-year-old daughter. She told the security expert that she was unaware of any breach. “This is disturbing, because who knows what someone could do with all that data from her phone,” she told Mr Krebs.
So, who could have imagined that something like this could go wrong in this way?
Who would have thought it possible that data being collected and stored with the best of intentions could, were it to fall into the wrong hands, actually present a threat to the very people it was intended to protect?
Who would have thought that, even if you have nothing to hide, harm can still come to you if the wrong kind of people are able to find out everything about you?
There is one source of comfort though – a heart-warming graphic from mSpy which helps to show how spying on people can be a caring, nurturing kind of activity.
Bystander • May 21, 2015 3:11 PM
@Figureitout
I am not that far with reading the thesis. My occasional interest in asynchronous computing led me to it. I just saw that some of it could serve for the discussion.
There are quite powerful asynchronous DSPs available, some are used for live video transcoding.
Re RNG:
Long time ago I was involved in research for a hardware RNG for a cryptographic module.
The underlying principle is simple – you need a good noise source and you have to generate a digital signal from the analogue noise. Practically there are a few things which make the implementation a little more difficult…
A good hardware RNG that works reliably and is not susceptible to EMI is not the worst solution…
Verification is necessary and the NIST Statistical Test Suite is one way to do it, but there are certainly others.
Benni • May 21, 2015 3:27 PM
The german parliament can’t get rid of the malware, which it describes as an “advanced persistent threat”.. I think that does not sound like russians:
BND finds additional selector lists that it was given by NSA. Now it has 459.000 selectors directed against german interests. Only 400 of them were sorted out by BND.
BND also says that in 40% of all the selectors from NSA it can not assess whether this concerns german interests since they can not identify the person targeted by a selector….
And we have two new protocols from the NSA investigation comission:
“2013 the list of refused selectors increased because I was ordered to search after european governments.
You did not search after that before?
No.
How do you check that? Ip adresses, e-mails, messenger?
Only the email adresses
Nothing else because it was too complex?
Yes
Did you check the selectors against german interests?
We have not checked that
“We wanted to learn from the Snowden documents whether we can do that, too” “BND has capabilities like never before”…
@Jacob, Nick P, Clive Robinson
Good idea that Jacob have brought up. Why not look into those overseas Type-1 grade comms. Another thing is you can try to purchase from Xilinx’s 7 Series FPGAs or Zynq-7000 AP SoCs that have red-black separation, passes NSA tests and have a unique design to load both red and black into the programmable FPGA transistors next to each other.
Altera has about the same design as Xilinx as well and passes NSA tests for use in Type-1 equipments similar to Xilinx.
Maybe you could try to cook up something with these Type-1 capable chips ?
@Benni
Who will be on the receiving end of the sentences if the German and European courts find BND guilty of treason and aiding foreign spies ? Will it be the BND chiefs and ex-chiefs ?
What will the sentences of treason be like in Germany and Europe if BND is found guilty ?
Will the BND be dismantled due to it’s disgrace by the German parliament ?
I wonder how Germany and Europe are going to tighten their gripes on their spy agencies after this episode ?
For the infected German computers, they should think of a way to bring it off-line without causing national catastrophe and swap in more secure systems made directly under BSI control and validated by independent and also open reviews from external and internal security experts and groups. Once these newly made secure computers are made, they can replace the infected computers and the infected computers move to a secure Government lab for full analysis of every single strain / variant of malware and published online on their working internals openly without exception so that more defenses against nation state attacks can be formulated.
Figureitout • May 21, 2015 8:52 PM
Zenzero
–No, but if xobs made it it’s probably pretty good. It’d be great b/c live debugging in embedded is necessary.
Bystander
I just saw that some of it could serve for the discussion.
–No it’s very interesting, thanks. Same w/ asynchronous circuits, different way to do final goal.
RE: rng
–Finding a good noise source is hard though, that can’t be tampered w/. Generating a digital signal w/ analog noise, just an ADC correct?–They’re kinda tricky to initialize. There are other ways I’m sure, but they’ll probably be silly.
@Figureitout, Nick P
Another One Time Pad (so-called Quantum) Cryptography company. If I am not wrong, they use so-called Quantum key generation techniques using light beams as sources of randomness.
Figureitout • May 21, 2015 10:10 PM
Thoth
–Not even https for a security company…”One-time Pad Encryption with Automatic Zeroization”– https://julieamarxhausen.files.wordpress.com/2014/03/what-does-that-even-mean-jackie-chan.jpg
Found this randomly today, too much features I’d want to cut out, but hoping please, please… be open source…”BUY IT NOW”–Damnit! http://www.rowebots.com/products/unison_rtos
@Figureitout
A list of commonly known defense contractor websites not doing HTTPS:
- General Dynamics:
- http://www.gdc4s.com/Documents/Products/Embedded/AIM%20II/GD-AIM2-w.pdf (General Dynamic’s AIM II brochure)
- http://www.gdc4s.com/advanced-infosec-machine-%28aim%29.html ( AIM II website)
- Harris
- http://rf.harris.com/capabilities/communications-security/embeddable-encryption.asp (Harris’ Crypto Chip)
- Lockheed Martin
- http://www.lockheedmartin.com/us/products/c4isr.html (C4I website)
- Boeing
These are huge contractors …
Now let’s look at Thales …
- Thales:
It does use HTTPS. At least there are some of them that uses HTTPS.
Is there a reason why they don’t want to use HTTPS ? Maybe it’s to allow NSA to figure whose going to whose site or to make visitors highly visible to both the contractor and NSA ?
Who knows.
Benni • May 22, 2015 1:36 AM
Here are the articles with the additional selector lists:
http://www.zeit.de/digital/datenschutz/2015-05/bnd-affaere-selektoren-nsa-liste
The number of selectors now stands by 8,2 million that target 1,267 million people and companies….
The bnd boss says he did not know anything about all that….
Curious • May 22, 2015 2:14 AM
@Thoth
I was thinking just now, well maybe the ceo’s of those companies had heard somewhere that having “https” connections to their websites “really aren’t that secure after all”.
Clive Robinson • May 22, 2015 6:32 AM
@ Figureitout,
Finding a good noise source is hard though, that can’t be tampered w/. Generating a digital signal w/ analog noise, just an ADC correct?–They’re kinda tricky to initialize. T
Hmm where to start 😉
I guess the best thing is to actually work backwards and figure out what it is you are actually measuring to produce your raw digital output.
For instance is it amplitude, time/frequency/phase or even sequency of your analog signal. Then try and ensure you have as near a flat charecteristic as you can of that measure.
Look at it this way, let us assume you have a WGN source, that you then examine with a spectrum analyser. You will see that the energy in each frequency block is the same, thus the average amplitude of the signal. But what about the “rate of change”?
Logic dictates that at twice the frequency you have twice the number of cycles, thus the rate of change is twice as well. If what you are measuring is in any way based on the rate of change then you are going to get more changes in the high frequency content not the low frequency content… You can see this by using an oscilloscope and a narrow band tunable filter. Put the raw signal into one channel, and into the filter, take the output from the filter and display it on another channel and watch.
Similar issues arise for all measures, thus at some point you have to have measure dependent equalization in the system. Not fun but can be done.
But how do you actually measure the analog signal, whilst all can be regarded as some type of ADC what do you actually mean. For instance a “zero crossing detector” actually measures an aproximation of the analog signal and is without care is both amplitude and frequency selective and tends towards higher energy lower frequency signals. Similar issues arise with all amplitude measuring devices with a single determaning point, such as slicers, also Schmit triggers, window comparitors etc.
One way around this issue is to use the analog signal to frequency modulate a high frequency oscillator via the likes of a varicap diode. The oscillator output is then compressed / limited and put into a mixer down converter and the output then used either directly as a digital signal or put through a zero crossing detector etc to produce a digital signal. However their are issues to do with the anolog signal to frequency linearity, also the frequency of the down convertor oscillator as it ages effecting how frequencies are converted. Then there is the issue of “microphonics” in the VFO tank circuit, powersupply noise rejection etc… before you consider if an attacker can get some control by injection locking the oscillator via an active EM attack.
Likewise the actual noise source… do you take it’s output as a single ended signal or differential signal. How do you deal with DC offsets and galvanic isolation without imposing unwanted frequency/amplitude filtering effects, opto couplers look good only from some perspectives… the list goes on.
As RobertT observed TRNG’s are very difficult to design and harder to test and most would fail the Diehard or Dieharder tests. Which is why most “on chip” RNGs are not directly available, only after they have had some “magic pixie dust” treatment via a couple of crypto functions.
Which brings us to the sailient question of “are you testing the source or the crypto?” If it’s the crypto –and it usually is– then why bother mucking about with the TRNG at all, use a couple of CS-PRNGs mixed together in some manner. Which is a conclusion I came to back last century, I ended up using a free runing micro controler with two fast stream ciphers running as fast as they could, the user computer would raise an interupt on the micro controler which would output the current mixed value to the host. In effect this “roulette wheel” behaviour gave sufficient True Random Input to the microcontroler…
As has been observed, “sometimes there are easier ways to skin a cat than by puting your hand down it’s throat, to grab the tip of it’s tail and shake it out”.
Nick P • May 22, 2015 2:28 PM
(Darnit, the comment I submitted last night didn’t go through. Round 2.)
@ Jacob
My last search included North American, Nordic, European, and Israeli companies’ products. Only a few appeard to have strong security. They weren’t available for civilians. The only one’s I haven’t checked are Asian, esp Russian and Chinese. At the time, they were in the threat model and their stuff had high likelihood of backdoors. Heck, I figured it probably wouldn’t even be in English. However, for combatting NSA, I’d be interested in any Asian (esp Russian and Chinese) products that look as assured as General Dynamics, Harris, etc.
@ all
Anyone from Asia that knows of military-grade communications, networking, or storage gear that appears to have strong crypto?
@ Thoth
re JackPair
Oops. I guess I stopped reading on first part of JackPair post. The 1 phone and JackPair concept is the one to focus on. Anything with too much hardware or difficulty will straight up not be used.
re Type 1 restrictions
That’s part of it. The main reason is that the devices contain hardware, firmware, and software that eliminates all kinds of vulnerability. The reverse engineering of such tech would teach talented opponents a lot. The second benefit is obfuscation of any flaws those products have. Strong engineering plus obfuscation is a proven approach to defeating High Strength Attackers. For a while, anyway.
re static methods of defense
The strongest COMSEC gear appears to combine preventative methods, simple circuitry for tamper-detection/response, and recovery methods. They’re mostly static but effective against most attacks. A HSA with a few dozen of them will eventually bypass the security. Might happen more quickly where much COTS hardware or methods are used. Imho, academia and commercial sector (cutting edge) have long exceeded the NSA et al in both preventative and tamper-detection technologies. NSA and defense contractors are just good at combining tech that works into products with good security. Almost any COTS offering, outside smartcard industry, leaves stuff off for various reasons. That’s why Type 1 and other high assurance equipment are more interesting than commercial products.
re Huawei kernel
A SKPP, separation kernel usually takes 9-12kloc to do a few simple functions with high assurance. Given all it does, I doubt it comes close or can even be made to. Two of these… ” zero configuration, auto-discovery, and auto-networking…” sound like PhD projects for INFOSEC students. Auto-networking, depending on what it includes, might take several Ph.D.’s and years of work. Supporting this is that one researcher at NRL spent considerable time implementing the simpler protocols in separation kernel form.
re Type 1 FPGA
Holy shit, you’re right: they did pass with this FPGA. Might be backdoored given how close Xilinx and probably Altera are to NSA. Yet, would be great against other threats combined with the right I.P.. The problem: the XQ models aren’t available from any of the FPGA board vendors’ websites. The only Xilinx distributor that recognized the product has zero stock, a 144-day lead time, and unknown minimum volume at $300+ each. Price is nice, though, given what defense grade usually costs. Of course, you’ll need to add the cost of a custom board and its components.
So, maybe we need to contact sales to see if (a) they sell to non-military, (b) at what volume, and (c) if there’s partners that will handle the boards + logistics at what cost. My guess is this product is out of individual budget.
re quantum encryption
That’s one of the older labs doing quantum encryption. Most of their stuff probably does what it says it does to who knows what quality or security. The only thing I find questionable is their OTP encryption where it’s encrypted, the key is zeroized, and then it recovers it somehow. How do they do that without a copy of the key? Does it all reduce to a symmetric cipher or trusted storage at some point? Too many questions on that. More interesting is their optical ASIC research. More research needs to be done in general on leveraging optical tech for security in ways that reduce risk vs electronic. eg side channels
The one thing that’s for sure is the risk of backdoors given they’re Australian (Five Eyes). The other aspect applies to all these quantum encryption and key distribution vendors: they focus on protecting the strongest link. Overall security will probably not be improved by those using this. Bruce has repeatedly called bullshit on these vendors’ promises.
name,withheld.for.obvious.reasons • May 22, 2015 4:46 PM
@ Nick P
Holy shit
My concern is at two levels in FPGA’s; one is the fabric and the other is the tool chain/synthesis component.
First, fabrics on many FPGA (pick your own OEM) include proprietary “boot strapping” code. Some of these behavior is described by the manufacturer, some is not, but for the most part the vendor “controls” this behavior. Replacing or circumventing the “boot” phase is oft times supported but is no guarantee as very few can examine the RTL and the actual masks/gate/PLD.
The tool chain is another issue that I have covered in the past so I won’t repeat it–just to say that this can be as problematic (many of the vendors have gone to “always on-line” version of their IP databases).
Nick P • May 22, 2015 5:23 PM
@ name.withheld
“My concern is at two levels in FPGA’s; one is the fabric and the other is the tool chain/synthesis component.”
There’s definitely black boxes. That open-source synthesis exists and academics continue cranking out partial solutions indicates we can eliminate these with an open FPGA. There’s even pieces of how to do that in academia and documentation on production FPGA’s. I think that, with the right structure, the open FPGA company could avoid the patent issues. Might even make the default EDA toolset a Xilinx toolchain with them making the money on it. Open, but for-profit, toolchain that the open company licenses. Maybe dual-licensed (eg Trolltech Qt) with any contributions being similarly dual-licensed. Academics are encouraged to contribute to it with funding available through government grants or the company’s own money.
Also, we need one that’s flash, one that’s antifuse, and both easy to port to S-ASIC. Can build them in that order. Hell, maybe get a rich fatcat to buy a company such as eASIC then change licensing and open-ness where possible. Sell it as a public benefit investment bringing blah to the masses. Also, could license an architecture from a company such as Achronix (my favorite) with promise that it will be used on lower process nodes and avoid direct competition. Need a high-level synthesis tool from FPGA or EDA vendor regardless for uptake.
Far as online tools, that is a real concern. I always thought the whole concept was ridiculous. If I were them, I’d offer the benefits of that with a differentiator being some I.P. protection technique and contractual promise to always use one. Might be as simple as making my EDA/IP tools a VM image and/or hardware appliance sitting behind a verifiable* guard. It only receives binary data from outside (updates/features), allows ack’s in careful way (see Pump), and with an administrative console sending textual requests for whatever is sent. We use text for the latter so they can verify those interactions. Optional, inexpensive, VPN for link between supplier and consumer companies.
This gives most of the benefits of moving tools offsite with optional verification of I.P. protection. Whole thing would cost almost nothing on top of existing tooling costs. Especially if EDA/IP vendor’s side of things combined cheap servers with FPGA acceleration. I imagine that could be done at cost for four companies in particular. 😉
- Our software, their compatible hardware.
name,withheld.for.obvious.reasons • May 22, 2015 6:21 PM
@ Nick P
There’s definitely black boxes. That open-source synthesis exists and academics continue cranking out partial solutions indicates we can eliminate these with an open FPGA.
This is near what I suggested with RobertT…an open source fabrication facility with domestic basing. For example, a global open source hardware fabrication consortium that supports (technically; specifications and standards) local facilities; a European body/group, an Asian, and America’s could go a long way to bring trust to the industry. The hard part is getting some organization to fund the organization to the degree that was done with the SEMI group (a consortium of hardware fabs). The hardware group should have the following charter:
1.) Technical and Financial Support to Locally Licensed Facilities
2.) Standards Group (adoption and operational)
3.) Secured Open Standards (Toolchains, Modeling, Synthesis)
4.) Certification, Verification, Testing, and Compliance
The group would not need to execute on these elements, more over act as a governing body that could attract both investors and technologists.
Nick P • May 22, 2015 6:45 PM
@ name.withheld
My discussions with RobertT indicated that owning or even running the fab itself wouldn’t buy you much. I agree that the location is important. Preferably a country that protects data rather than exploitation. Past that, the whole process is a series of black boxes involving so much esoterica that verification isn’t that meaningful. With his help, I identified that the main risks were the hand-off of the design to the maskmakers, the maskmaker itself (with equipment), the hand-off of the mask to the fab, and whether the fab used the mask. The fab’s modification opportunities at that point were in a narrow range. Hence, the security should focus on the mask and ensuring that it was used.
I have conceptual schemes to handle both. I’m not ready to publish them yet. Doing both takes a considerable amount of money. Yet, the schemes handle security for as many fabs as you want while costing no more than a single, older fab plus some overhead for each fab added. I also have ways to verify the optical, correction algorithm implementations without sharing them.
name.withheld.for.obvious.reasons • May 22, 2015 10:17 PM
@ Nick P
I have conceptual schemes to handle both. I’m not ready to publish them yet.
Sorry to beat you to it Nick, I sent along a copy to Bruce for review. It is a comprehensive technology business process that works from the fab level to the software and application layer. The framework is centered around the informatics of technology/engineering business…I had to come up with a solution that could survive an LEA style attack. As a small R&D company, I’ve had to survive not only the efforts of corporate giants–but now I must be able to handle the threat to my business from government(s).
Businesses today don’t understand the due diligence risk associated with research and development in an environment that is under extreme pressure. With the knowledge that government(s) are engaged in both subversion and theft of intellectual property, share holders and board members will be asking if their organization is “managing” the threat (perceived or not) to their business and intellectual property. The Sony incident is the most relevant–now change the name from Sony to Xilinx, MicroSemi, or Altera…
Figureitout • May 23, 2015 12:40 AM
Thoth
–They may be honeypots.
Clive Robinson
I guess the best thing is to actually work backwards
–That’s generally what I do when I get in over my head, which is often lol. It’s my sh*tty scattered way of learning that works for me but screws others…
I was hoping I could sample this PRNG simply w/ Arduino lol, b/c it’d be easier for people and be isolated from any TFC node. I’ll have to see. Definitely need to save and plot them at the least b/c it was reading what looked like scattered but repeating values w/ simply a wire on the pin (so picking up RF..?) and not sure off the PRNG.
There’s apparently a lot of ways to sample, which is crazy and some of them I’m wondering what’s the actual benefit of doing it that way lol. I’ve just used one like in this past month (you know what I mean) and already on to another “big” area where we will need a scope to verify and I’m stuck lol, but we’ll get it. It was a standard chip implementation taking minimal samples b/c constraints and there’s small errors (quantatization errors), we didn’t need a scope for this, a debugger could give us values that were “in the ballpark” but still there was unavoidable error (even though it works good enough for us). And needed a scope for something else, and again…always need a frickin’ scope! My analog one sucks besides being an antique, starts smelling like burnt dust in 20 minutes.
Yeah, I’m staring at varicap diodes all day, haven’t needed to use them yet though.
Besides injection locking, I’m wondering something similar to altering a reference voltage will of course, like a clock signal, screw the measurement by a factor of how much you affect the voltage since it needs that reference or it will return garbage 100%.
No don’t trust “magic pixie dust” at all, in fact when I hear that I know people don’t know what’s happening. Shortly I’m going to test our little PRNG we use and graph it out, etc. b/c I was thinking it may need to be replaced even though it’s protecting not super important info lol. You could “ride the eye of london” too if you hold on long enough (such a tough riddle lol).
RE: skinning cats
–Well I was never real fond of cutting open fetal pigs and hearing the cracks of their ribs as we split them open reeeaalll good spilling their guts everywhere like jack the ripper…But w/ metals and electricity there’s no blood and gushy, so yeah I want all up in that.
Figureitout • May 23, 2015 1:25 PM
Clive Robinson
–So, yeah I don’t have the “credentials” or the wrinkles and grey neckbeard yet to competently analyze an ADC or some of the DSP math yet behind gaussian noise (at least some of the “boring” math). We didn’t need to develop an ADC inhouse though, it was software initialization (space constraints are an issue for us too, so less components the better); I’ll make it sound worse than it is b/c I’m hard on myself and others, but it ultimately makes better final product. I find it weird you can set some “series resistance” values as a setting in firmware now…I’m assuming routing signals thru pre-set resistors via transistor switches. What I’m finding is, you got issues that need doing, you dig in, document tricky spots, and move on. While doing it you have to rely on other parts of the system to not catastrophically fail or you’re going to be building a sandcastle in a tidal zone indefinitely…
My replies in the latest squid thread.
Nick P • May 23, 2015 8:56 PM
@ name.withheld
“Sorry to beat you to it Nick. I sent along a copy to Bruce for review.”
December 2013 was when I put together the last of my main, fab-security scheme. So, maybe you beat me to it and maybe not. You’ll probably beat me to publishing as I’m holding off on that: I’ve only posted pieces on here. Putting the whole thing up would give them a head start on the subversion and attack processes on my methods. Hopefully, yours doesn’t have that problem.
Note: Even sending it to Bruce would do so for Five Eyes given we must assume they can see what he can. He’s too high priority for TAO to ignore at least in terms of targeted surveillance. That’s why I haven’t sent any schemes that need to be secret. Expect that NSA has yours now.
” It is a comprehensive technology business process that works from the fab level to the software and application layer. ”
Sounds great! I’d love to see it some time. Unfortunately, signficant parts of mine were outside his expertise. Finding the right person to review while maintaining secrecy is always tricky. So, I broke it into components with independent contexts, set each up to be reviewed by different people, and will integrate the results when I can. Some things still need review as the skills are very rare. Constantly evolving my fab schemes along different cost-benefit, security, and legal tradeoffs while I wait to see a clear path to making one happen.
Others in the field are working on the more technical schemes. I’m not sure how I’d even do that given it really boils down to major personnel problems plus some minor to major technical problems. Most of my solutions focus on the personnel side.
“With the knowledge that government(s) are engaged in both subversion and theft of intellectual property, share holders and board members will be asking if their organization is “managing” the threat (perceived or not) to their business and intellectual property. ”
Yeah… they’re asking for sure. Thing is, how much do they actually care? For instance, major I.P. holders have been doing R&D in China even after getting robbed by their people. What are they still in China? Organizations keep getting hit through weak Internet security. Yet, why do they still use that crap or even connect R&D to Internet? I’m not sure most businesses, even with billions in I.P., care to the degree that we do. They seem to think it’s a cost of doing business and aim for a certain ROI before the competition catches up.
So, you should certainly work on solid arguments that convince clients your method is worth the investment, all the way up to the boardrooms. That’s more important than any technical factor. My tip is focusing on control. It’s a proven method to sell on security as control is a positive thing you’re adding rather than a negative thing you might be stopping. Management are usually control freaks. Visually show them how (a) systems are subverted, (b) networks, and (c) an example of cloned, swapped chip with identical features + backdoor. This hard-hitting demo, contrasted with your offering, might create the right effect. Best tip I can give you.
Of course, be sure to try a bunch of methods as usual. What sells one product doesn’t another. Good luck and I look forward to reading your methodology.
Bob Paddock • June 1, 2015 8:20 AM
“The Use Of SQUIDS (Super Conducting Quantum Interference Devices) In Satellite Based Mind Control Technology” article doesn’t present Dr. Begich work in a good light. Take a look at the referenced articles at the bottom of the book’s web page:
Controlling the Human Mind : The Technologies of Political Control or Tools for Peak Performance
For full disclosure Dr. Begich sent me a gratis review copy of the book when it first came out.
Subscribe to comments on this entry
Leave a comment
← Microbe Biometric United Airlines Offers Frequent Flier Miles for Finding Security Vulnerabilities →
Sidebar photo of Bruce Schneier by Joe MacInnis.
renke • May 15, 2015 4:30 PM
It seems BND (German foreign intelligence angency) and the carrier Deutsche Telekom are Best Buddies. According to a leaked mail the carrier restructured parts of the network so one fibre routes only non-domestic traffic, so the BND can legally eavesdrop.
Interesting times.
News articles (in German): http://derstandard.at/2000015856486/E-Mail-belegt-wie-BND-Leitungen-der-Telekom-Austria-ausspionierte https://netzpolitik.org/2015/interne-e-mail-bnd-und-deutsche-telekom-haben-auch-oesterreich-tschechien-und-luxemburg-abgehoert/
Two years ago (shortly after the Snowden leaks) Deutsche Telekom proposed a “Schengen routing” (like Iran’s national intranet, but for all Schengen Agreement member countries), to hinder NSA’s snooping. Guess who would be (one of) the biggest network providers and transit carriers?