Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

December 1, 2014

New NSA Drone!

Filed under: Cryptography,NSA — Patrick Durusau @ 4:58 pm

I don’t pay much attention to the musical chairs game in Washington so I wasn’t aware that the NSA acquired a new drone last April. Code name: Adm. Michael Rogers.

Just in case you need a photograph for identification purposes:

Michael Rogers

Doesn’t look like he gets outside very often does it? Being a cryptographer, what else did you expect?

But that’s makes Rogers a dangerous leader of the NSA.

Consider the latest testimony by Rogers to Congress:

Certain nations are regularly performing electronic “reconnaissance,” Rogers warned, in an effort to be well placed within utility systems in the event that the networks relied on by chemical facilities, water treatment plants and other critical infrastructure components are ordered to be taken offline by a foreign government.

“All of that leads me to believe it is only a matter of when, not if, we are going to see something dramatic,” the NSA chief said.

Leading figures within the American intelligence community and Congress have long warned of potentially catastrophic repercussions if such networks should happen to be penetrated and pulverized by foreign actors with malicious intent, but Rogers’ remarks this week are among the most dire ever from not just individual well placed within the administration, but a person arguably most qualified to testify as much. (From China & others can cripple US power grid, NSA admits for the first time)

Well, except that water treatment plants and chemical facilities aren’t part of any seamless network. Minor detail I know but just because some contractor wants to protect us from a non-existent threat with cost-plus contracting, isn’t a reason to credit their reports.

If the Admiral wants to obsess about something, how about the regional power stations that are too big to be housed and are subject to attack with one person anti-tank weapons that could take such stations out for months. (Each is a custom build so there aren’t spare parts if oil cooling goes out and critical parts melt into slag.) No Internet or hacking required. And major parts of the United States could go dark for the entire time needed for repairs. Does that sound like a potential threat?

Compare that to the Admiral’s fantasy about cyber defense:

The U.S. Cyber Command has three primary missions, Adm. Rogers said. Along with defending DOD networks, the Cyber Command is “generating the cyber mission force, the men and women who are going to be addressing the department’s cyber needs, from the defensive to the offensive.” Lastly, Rogers said he is preparing the emerging DOD cyber force to defend U.S. critical infrastructure.

DOD’s cyber force has been given the responsibility to defend, for example, critical power and other utility, telecommunications and transportation networks—which he said are vulnerable to attacks from China and “one or two other” countries. He said a major attack was likely in the next decade.

The cyber chief estimated that DOD is about halfway toward its goal of organizing a cyber capability to defend U.S. networks. (From: NSA chief details ‘real’ threats to US networks, infrastructure)

Quick points to remember:

The civilian population comes dead last, assuming a threat exists at all.

Attack is “likely” within the next decade. (Courteous of our adversaries to wait for us to tool up to repel the attack.)

The DOD is halfway towards a cyber capacity to defend non-existent U.S. water, chemical plants, etc., networks?

The advantage of being halfway to defend networks that don’t exist isn’t clear. But, the DOD is also said to be halfway to being subject to auditing. Maybe those programs are on the same track?

All news outlets should be calling BS on testimony such as that by Adm. Rogers. Creating disinformation about security issues distorts the policy process and makes for fat contractors and a poorly served civilian population.

Not to mention making security issue topic maps more laborious to construct by re-weeding out false threats such as those being pandered by Adm. Rogers.

November 25, 2014

NSA partners with Apache to release open-source data traffic program

Filed under: NSA,Open Source — Patrick Durusau @ 9:01 pm

NSA partners with Apache to release open-source data traffic program by Steven J. Vaughan-Nichols.

From the post:

Many of you probably think that the National Security Agency (NSA) and open-source software get along like a house on fire. That's to say, flaming destruction. You would be wrong.

[image and link omitted]

In partnership with the Apache Software Foundation, the NSA announced on Tuesday that it is releasing the source code for Niagarafiles (Nifi). The spy agency said that Nifi "automates data flows among multiple computer networks, even when data formats and protocols differ".

Details on how Nifi does this are scant at this point, while the ASF continues to set up the site where Nifi's code will reside.

In a statement, Nifi's lead developer Joseph L Witt said the software "provides a way to prioritize data flows more effectively and get rid of artificial delays in identifying and transmitting critical information".

…

I don’t doubt the NSA efforts at open source software. That isn’t saying anything about how closely the code would need to be proofed.

Perhaps encouraging more open source projects from the NSA will eat into the time they have to spend writing malware. 😉

Something to look forward to!

September 23, 2014

Tor users could be FBI’s main target if legal power grab succeeds

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 6:29 pm

Tor users could be FBI’s main target if legal power grab succeeds by Lisa Vaas.

From the post:

The US Department of Justice (DOJ) is proposing a power grab that would make it easier for domestic law enforcement to break into computers of people trying to protect their anonymity via Tor or other anonymizing technologies.

That’s according to a law professor and litigator who deals with constitutional issues that arise in espionage, cybersecurity and counterterrorism prosecutions.

Ahmed Ghappour, a visiting professor at UC Hastings College of the Law, San Francisco, explained the potential ramifications of the legal maneuver in a post published last week.

I dislike government surveillance as much as anyone but let’s get the facts about surveillance straight before debating it.

For example, Lisa says:

…make it easier for domestic law enforcement to break into computers of people trying to protect their anonymity via Tor… (emphasis added)

Certainly gets your attention but I’m with Bill Clinton, it depends on what you mean by “easier.”

If you mean “easier,” as in breaking Tor or other technologies, in a word: NO.

If you mean “easier,” as in issuance of search warrants, YES.

The “…power grab….” concerns re-wording of Rule 41 Search and Seizure of the Federal Rules of Criminal Procedure (Herein, Rule 41.).

Section (b) of Rule 41 sets out who can issue a search and seizure warrant and just as importantly, where the person or evidence can be located. The present rules of section (b) can be summarized as:

  1. Person or property located within a district
  2. Person or property outside a district, if located within the district when issued but might move before execution of the warrant
  3. Person or property within or outside a district (terrorism)
  4. Person or property to be tracked within, without a district or both
  5. Person or property located outside a district or state but within (A) US territory, possession, or commonwealth; (diplomatic/consular locations)

(There are other nuances I have omitted in order to focus on location of the person and property to be seized.)

Rule 41 (b) defines where the person or property to be seized may be located.

With that background, consider the proposed amendment to Rule 41:

(6) a magistrate judge with authority in any district where activities related to a crime may have occurred has authority to issue a warrant to use remote access to search electronic storage media and to seize or copy electronically stored information located within or outside the district if:

(A) the district where the media or information is located has been concealed through technological means; or

(B) in an investigation of a violation of 18 U.S.C. Sec. 1030(a)(5), the media are protected computers that have been damaged without authorization and are located in five or more districts.

The issue is whether the same terms of present Rule 41 (b) (3) in terrorism cases should be expanded to other cases where the location of “media or information…has been concealed through technological means.”

Professor Ahmed Ghappour, in Justice Department Proposal Would Massively Expand FBI Extraterritorial Surveillance is concerned that searches for electronic media at unknown locations will of necessity result in searches of computers located in foreign jurisdictions. No doubt that is the case because to “not know the location of media or information” means just that, you don’t know. Could be on a domestic computer or a foreign one. Unless and until you find the “media or information,” its location will remain unknown.

In the interest of cooperation with foreign law enforcement and some lingering notion of “jurisdiction” of a court being tied to physical boundaries (true historically speaking), Professor Ghappour would resist expanding the same jurisdiction in Rule 41 (b)(3) to non-terrorism crimes under proposed Rule 41 (b)(6)(A).

The essence of the “unknown server location” argument is that United States courts can issue search warrants, if the government can identify the location of a target server, subject to the other provisions of Rule 41. But since Tor prevents discovery of a server location, ipso facto, no search warrant.

To be fair to the government, a physical notion of jurisdiction for search and seizure warrants, as embodied in Rule 41, is a historical artifact and not essential to the Fourth Amendment for U.S. citizens:

The rights of the people to be secure in their persons, houses, papers, and effects, against unreasonable searchers and seizures, shall not be violated; and no Warrants shall issue but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

The government’s often flat-footed response to technology is a common topic of conversation. Here an attempt by government to adapt to modern computer network reality is said to be too far and too fast.

Despite my sympathies being with the hare and not the hounds, I don’t think the law should foster an evidentiary shell game based upon antiquated notions of physical jurisdiction. (Leaving it to the government to procure the information it seeks without assistance from innocent bystanders. See Note 1)

Note 1: I don’t see this as contrary to my position in Resisting Tyranny – Customer-Centric-Cloud (CCCl). The issue there was a subpoena to Microsoft for data held in a foreign server. I think Cloud operators have a fiduciary duty to their customers that is prior and superior to the claims of any particular court. If the FBI can obtain the information on such servers with a warrant, on its own, then it should do so. But courts should not be able to press gang others to assist in local law enforcement activities.

Note 2: You may want to review the Advisory Committee on Criminal Rules, New Orleans, April 7-8, 2014 for background materials on the proposed change to Rule 41. Review the Annotated Constitution chapter on Search and Seizure for Fourth Amendment issues.

Note 3: If you are looking for an amusing example for parsing, try 18 U.S.C. Sec. 1030. Far clearer than any part of the Internal Revenue Code or its regulations but still complicated enough to be amusing.

August 12, 2014

NPR + CIA = Credible Disinformation

Filed under: Cybersecurity,News,NSA,Security — Patrick Durusau @ 3:46 pm

NPR Is Laundering CIA Talking Points to Make You Scared of NSA Reporting by By Glenn Greenwald and Andrew Fishman.

From the post:

On August 1, NPR’s Morning Edition broadcast a story by NPR national security reporter Dina Temple-Raston touting explosive claims from what she called “a tech firm based in Cambridge, Massachusetts.” That firm, Recorded Future, worked together with “a cyber expert, Mario Vuksan, the CEO of ReversingLabs,” to produce a new report that purported to vindicate the repeated accusation from U.S. officials that “revelations from former NSA contract worker Edward Snowden harmed national security and allowed terrorists to develop their own countermeasures.”

The “big data firm,” reported NPR, says that it now “has tangible evidence” proving the government’s accusations. Temple-Raston’s four-minute, 12-second story devoted the first 3 minutes and 20 seconds to uncritically repeating the report’s key conclusion that ”just months after the Snowden documents were released, al-Qaeda dramatically changed the way its operatives interacted online” and, post-Snowden, “al-Qaeda didn’t just tinker at the edges of its seven-year-old encryption software; it overhauled it.” The only skepticism in the NPR report was relegated to 44 seconds at the end when she quoted security expert Bruce Schneier, who questioned the causal relationship between the Snowden disclosures and the new terrorist encryption programs, as well as the efficacy of the new encryption.

The day after that NPR report, I posted Hire Al-Qaeda Programmers, which pointed out the technical absurdity of the claims made in the NPR story. That three different organizations re-wrote security software within three to five months following the Snowden leaks. Contrary to all experience with software projects.

Greenwald follows the money to reveal that both Recorded Future and ReversingLabs are both deeply in the pockets of the CIA and exposes other issues and problems with both the Recorded Future “report” and the NPR story on the same.

We can debate why Dina Temple-Raston didn’t do a fuller investigation, express more skepticism, or ask sharper questions.

But the question that interests me is this one: Why report the story at all?

Just because Recorded Future, the CIA, or even the White House releases claims about Edward Snowden and national security isn’t a reason to repeat them. Even if they are repeated with critical analysis or following the money trail as did Greenwald.

Even superficial investigation would have revealed the only “tangible evidence” in the possession of Recorded Future is the paper on which it printed its own speculations. That should have been the end of the story.

If the story was broken by other outlets, then the NPR story is “XYZ taken in by a false story….”

Instead, we have NPR lending its credibility to a government and agencies who have virtually none at all. We are served “credible” disinformation because of its source, NPR.

The average listener isn’t going to remember the companies involved or most of the substance of the story. What they are going to remember is that they heard NPR report that Snowden’s leaks harmed national security.

Makes me wonder what other inadequately investigated stories NPR is broadcasting.

You?

PS: You could say that Temple-Raston just “forgot” or overlooked the connections Greenwald reports. Or another reporter, confronted with a similar lie, may not know of the connections. How would you avoid a similar outcome in the future?

July 21, 2014

Deploying Dionaea…

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:45 pm

Deploying Dionaea on a Raspberry Pi using MHN

A complete with screenshots guide to installing Dionaea on a Raspberry Pi.

MHN = Modern Honey Network.

With enough honeypots, do you think a “crowd” could capture most malware within days of its appearance?

I guess the NSA needs to run a honeypot inside its network firewalls. 😉

I first saw this in a tweet by Jason Trost.

July 19, 2014

Government-Grade Stealth Malware…

Filed under: Cybersecurity,Malware,NSA,Security — Patrick Durusau @ 4:36 pm

Government-Grade Stealth Malware In Hands Of Criminals by Sara Peters.

From the post:

Malware originally developed for government espionage is now in use by criminals, who are bolting it onto their rootkits and ransomware.

The malware, dubbed Gyges, was first discovered in March by Sentinel Labs, which just released an intelligence report outlining their findings. From the report: “Gyges is an early example of how advanced techniques and code developed by governments for espionage are effectively being repurposed, modularized and coupled with other malware to commit cybercrime.”

Sentinel was able to detect Gyges with on-device heuristic sensors, but many intrusion prevention systems would miss it. The report states that Gyges’ evasion techniques are “significantly more sophisticated” than the payloads attached. It includes anti-detection, anti-tampering, anti-debugging, and anti-reverse-engineering capabilities.
…

The figure I keep hearing quoted is that cybersecurity attackers are ten years ahead of cybersecurity defenders.

Is that what you hear?

Whatever the actual gap, what makes me curious is why the gap exists at all? I assume the attackers and defenders are on par as far as intelligence, programming skills, financial support, etc., so what is the difference that accounts for the gap?

I don’t have the answer or even a suspicion of a suggestion but suspect someone else does.

Pointers anyone?

July 10, 2014

FVEY + N

Filed under: NSA,Security — Patrick Durusau @ 8:03 pm

Google Drive security hole leaks users’ files Lisa Vaas.

From the post:

We often repeat this advice from former Naked Security writer Graham Cluley: for a better understanding of how you should approach security in the cloud, simply replace all instances of the words in the cloud with the words on somebody else’s computer.

Google just handed us another opportunity to do just that.

It turns out that Google Drive has been incontinent, dribbling out private data courtesy of a security hole concerning files with embedded URLs.

When someone clicks an embedded hyperlink, they get sent to the website of a third-party website owner.

Unfortunately, the flaw was also letting the website owner – an unauthorized party – view header information, potentially including the original document that included the URL.
…

Personally I would replace on somebody else’s computer with:

FVEY + N, where N = you + people who share your data/document.

FVEY:

The “Five Eyes”, often abbreviated as “FVEY”, refer to an anglophonic alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. [Five Eyes]

Accidental leaks are nothing compared to the legal/illegal flood gates used by FVEY.

Ask yourself, “Do I feel lucky?”

July 7, 2014

Free Airport Chargers for Terrorists

Filed under: NSA,Security — Patrick Durusau @ 4:38 pm

Airlines may start supplying terrorists with free chargers for their electronic gear.

Why the Department of Homeland Security wants that result isn’t clear.

Jeff John Roberts reports in: Security order bans uncharged devices from some US-bound flights:

International air travelers heading to the U.S. now face another potential headache in security lines: they may not be able to board their plane unless they are able to turn on their phones, laptops and other electronic devices.

According to a new order announced on Sunday by the Department of Homeland Security:

“During the security examination, officers may also ask that owners power up some devices, including cell phones. Powerless devices will not be permitted onboard the aircraft. The traveler may also undergo additional screening.”

The new order, which did not specify which particular airports will be subject to the decree, comes after earlier expressions of concern by U.S. concern that devices might be used as a shell to contain a bomb.

…

The new measures may add to already-arduous wait times at the airport, though the security expert cited by the Journal suggested that airlines may rush to provide chargers to passengers who are waiting to board.

If you arrive at an airport with a bomb and its battery is dead, guess what? You can’t detonate it.

Don’t worry though. The airlines will soon be be supplying free chargers so you can charge the battery for your explosive device. Plus you can turn your device on and off for the TSA.

I don’t suppose it ever occurred to the DHS that the extruded shells of carry on baggage could be made to hold a fair amount of explosive plus battery? Hermetically sealed it would have no odors or imagery to betray its owner.

If the only return we get from the war on terrorism is more electrical sockets in airports, I say it hasn’t been worth the effort.

July 1, 2014

Credulity Question for Interviewees

Filed under: NSA,Skepticism — Patrick Durusau @ 2:48 pm

Max Fisher authored: Map: The 193 foreign countries the NSA spies on and the 4 it doesn’t, which has the following map:

nsa authority map

Max covers the history of the authority of the NSA to spy on governments, organizations, etc., so see his post for the details.

A credulity question for interviewees:

What countries are being spied upon by the NSA without permission? Color in those countries with a #2 pencil.

If they make no changes to the map, you can close the interview early. (The correct answer is six, including the United States.)

Clearly a candidate for phishing attacks, violation of security protocols, pass phrase/password sharing, frankly surprised they made it to the interview.

June 26, 2014

Who Needs Terrorists? We Have The NSA.

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 3:45 pm

Germany dumps Verizon for government work over NSA fears by David Meyer.

From the post:

The German government is ditching Verizon as its network infrastructure provider, and it’s citing Edward Snowden’s revelations about NSA surveillance as a reason.

David summarizes and gives pointers to all the statements you will need for “thank you” notes to the NSA or complaints to the current and past administrations.

United States citizens don’t need to worry about possible terrorist attacks. Our own government agencies are working to destroy any trust or confidence in U.S. technology companies. Care to compare that damage to the fictional damage from imagined terrorists?

Are there terrorists in the world? You bet. But the relevant question is: Other than blowing smoke for contracts and appropriations, what real danger exists for average U.S. citizen?

I read recently that “6 times more likely to die from hot weather than from a terrorist attack.” For similar numbers and sources, see: Fear of Terror Makes People Stupid.

Let’s not worry the country into the poor house over terrorism.

When anyone claims we are in danger from terrorism, press them for facts. What data? What intelligence? Press for specifics.

If they claim the details are “secret,” know that they don’t know and don’t want you to know they don’t know. (Remembering the attack that was going to happen at the Russian Olympics. Not a threat, not a warning, but was going to happen. Which didn’t happen, by the way.)

June 20, 2014

Friends of the NSA

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 2:10 pm

Governments let NSA tap cables on their territory, latest Snowden revelations show by David Meyer.

David has a great summary of recent Snowden leaks that make it clear that multiple governments were cooperating with the NSA tapping efforts.

From the post:

Who’s in? Some of these “third-party”, non-Five Eyes partners, as listed in other Snowden documents: Algeria, Austria, Belgium, Croatia, the Czech Republic, Denmark, Ethiopia, Finland, France, Germany, Greece, Hungary, India, Israel, Italy, Japan, Jordan, Macedonia, the Netherlands, Norway, Pakistan, Poland, Romania, Saudi Arabia, Singapore, South Korea, Spain, Sweden, Taiwan, Thailand, Tunisia, Turkey and the United Arab Emirates.

Assuming that the storage issues could be solved, the NSA could at the very least support itself by selling copies of intercepted conversations, email, etc. On the open market with eBay style bidding.

How much would you pay to hear a conversation between Obama and Putin?

Would not solve the privacy issue but would make the NSA less of a drain on US taxpayers.

June 18, 2014

Lock Maker Proclaims Locks Best For Security

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 4:43 pm

The best defense against surveillance in the cloud is strong locks, says Amazon CTO Werner Vogels by Mathew Ingram.

From the post:

Although fear of government surveillance has made Amazon’s job more challenging when it comes to selling the benefits of cloud data storage, Amazon’s chief technology officer Werner Vogels told attendees at the Structure conference in San Francisco that the company continues to see strong growth in demand both inside and outside the United States, and it is responding to customers concerns about surveillance by stressing two things: strong encryption and the control that Amazon and its AWS infrastructure give to users.

Vogels described how Neelie Kroes, digital commissioner for the European Commission, said in a recent speech that no matter what regulations countries have around privacy or surveillance, hackers and spies will always try to get around them, and so the best defense isn’t a good lawyer, it’s a good lock — and Amazon “has the best locks,” Vogels said. “The point is that the customer needs to be in control of their data, and we give them full confidence that no one is going to access their data but themselves.”
…

You may enjoy the interview if you are looking for reassurance. If you are looking for security advice, drive on.

One example to rebut the “strong lock” argument. The NSA no doubt has pages of protocol about sysadmins changing their passwords, etc. So from a lock standpoint, the NSA had some rocking locks!

Except, some of the key holders to the locks decided to share their keys. Oh.

Locks are only one part, an important one but still just one, of a complex of measures that define “security” for an entity.

Anyone who says differently, is selling you a partial solution to your security problems.

June 14, 2014

Access To Information Is Power

Filed under: Information Theory,NSA — Patrick Durusau @ 4:52 pm

No Place to Hide Freed

From the post:

After reading No Place to Hide on day of release and whipping out a review, now these second thoughts:

We screen shot the Kindle edition, plugged the double-paged images into Word, and printed five PDFs of the Introduction, Chapter 1 through 5, and Epilogue. Then put the 7Z package online at Cryptome.

This was done to make more of Edward Snowden’s NSA material available to readers than will be done by the various books about it — NPTH among a half-dozen — hundreds of news and opinion articles, TV appearances and awards ceremonies by Snowden, Greenwald, Poitras, McAskin, Gellman, Alexander, Clapper, national leaders and gaggles of journalist hobos of the Snowden Intercept of NSA runaway metadata traffic.

The copying and unlimited distribution of No Place to Hide is to compensate in a small way for the failure to release 95% of the Snowden material to the public.

After Snowden dumped the full material on Greenwald, Poitras and Gellman, about 97% of it has been withheld. This book provides a minuscule amount, 106 images, of the 1500 pages released so far out of between 59,000 and 1.7 million allegedly taken by Snowden.

Interesting that the post concludes:

Read No Place to Hide and wonder why it does not foster accelerated, full release of the Snowden material, to instead for secretkeepers of all stripes profit from limited releases and inadequate, under-informed public debate.

I would think the answer to the concluding question is self-evident.

The NSA kept the programs and documents about the programs secret in order to avoid public debate and the potential, however unlikely, of being held responsible for violation of various laws. There is no exception in the United States Constitution that reads: “the executive branch is freed from the restrictions of this constitution when at its option, it decides that freedom to be necessary.”

I have read the United States Constitution rather carefully and at least in my reading, there is no such language.

The answer for Glenn Greenwald is even easier. What should be the basis for a public debate over privacy and what government measures, if any, are appropriate when defending itself against a smallish band of malcontents into a cash cow for Glenn Greenwald. Because Greenwald has copies of the documents stolen by Snowden, he can expect to sell news stories, to be courted and feted by news organizations, etc., for the rest of his life.

Neither the NSA nor Greenwald are interested in a full distribution of all the documents taken by Snowden. Nor are they interested in a fully informed public debate.

Their differences on the release of some documents is a question of whose interest in being served rather than a question of public interest.

Leaking documents to the press is a good way to make someone’s career. Not a good way to get secrets out for public debate.

Leak to the press if you have to but also post full copies to as many public repositories as possible.

Access to information is power. The NSA and Greenwald have it and they are not going to share it with you, at least voluntarily.

June 11, 2014

NSA Playset…

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 4:17 pm

NSA Playset invites hackers to ‘play along with the NSA’ by Violet Blue.

From the post:

Inspired by the NSA’s ANT Catalog of spyware and surveillance tools, The NSA Playset project invites hackers to reproduce easy, at-home versions of the NSA’s spy-tools arsenal — and NSA-style silly names are required.

The NSA’s ANT Catalog was among documents leaked by Edward Snowden. It revealed 49 different software and hardware tools used for espionage on civilian targets. For hackers, it’s an irresistible Pandora’s Box.
…

What item from the NSA ANT Catalog do you want to help build?

PS: Remember the NSA ANT Catalog dates from 2008 so adjust prices for commercial licensing accordingly.

June 7, 2014

Sin of Omission

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 12:43 pm

Barb Darrow interviews IBM’s Lance Crosby (SoftLayer CEO within IBM) and at or about time mark 27:00, asks about trusting data to U.S. based companies:

Crosby responds:

My response is protect your data against any third party — whether it’s the NSA, other governments, hackers, terrorists, whatever…” he noted. “I say let’s stop worrying about the NSA and start talking about encryption and VPNs and all the ways you can protect yourself. Yes the NSA got caught but they’re not the first and won’t be the last.

Who did Crosby omit?

Your U.S.-based vendor..

How do you protect your data from your own vendor? That’s the question that Crosby so neatly ducks.

Crosby is speaking at Structure 2014. If you are attending, be sure to ask him,

“How do we protect our data from IBM if IBM is our cloud vendor?”

In all fairness, please revise and ask the same question of other cloud vendors as well.

Today, all of your data held by a U.S.-based vendor is just one court order away from being in the possession of the United States government. Who can use it, share it with competitors, etc.

Governments who want to promote the cloud will create exempt from government process mechanisms for data centers, their owners and staff, to be free from all government requests for data.

Governments who don’t want to promote the cloud and economic growth, well, they won’t have such mechanisms.

This could be the golden moment when multi-national vendors to become truly multi-national as opposed to being surrogates for the United States government.

Quotes from and commentary based on: Why we need to stop freaking out about the NSA and get on with business.

June 5, 2014

New SSL Issues

Filed under: Cybersecurity,NSA,Privacy,Security — Patrick Durusau @ 2:35 pm

OpenSSL Security Advisory [05 Jun 2014]

Seven new SSL bugs have been documented. See the advisory for details.

Given how insecure the Net is at present, I have to wonder at the effectiveness of Reset The Net at stopping mass surveillance?

I agree with ending mass surveillance but mostly because storing all that data is contractor waste.

I first saw this in a tweet by Nick Sullivan.

June 2, 2014

Congress Glowers At NSA(?)

Filed under: Cybersecurity,NSA — Patrick Durusau @ 4:12 pm

The NSA Is Put on Notice Over Encryption Standards by Justin Elliott.

I was pretty excited until I read:

The amendment adopted last week by the House Committee on Science, Space, and Technology would remove an existing requirement in the law that NIST consult with the NSA on encryption standards.

In case you want to be uber precise, the amendment reads as follows:

AMENDMENT OFFERED BY MR. GRAYSON OF FLORIDA TO THE AMENDMENT IN THE NATURE OF A SUBSTITUTE

Page 101, after line 9, insert the following new section:

SEC. 411. INFORMATION SYSTEMS STANDARDS CONSULTATION

Section 20(c)(1) of the National Institute of Standards and Technology Act (15 U.S.C. 278g—3(c)(1)) is amended by striking “the National Security Agency,”.

You can imagine that the NSA wonks are rolling around on the floor after reading this news. Not out of frustration over congressional interference but gut-busting laughter that even members of Congress could be this dumb.

The section in question, presently reads:

(c) Development of standards and guidelines

In developing standards and guidelines required by subsections (a) and (b) of this section, the Institute shall–

(1) consult with other agencies and offices (including, but not limited to, the Director of the Office of Management and Budget, the Departments of Defense and Energy, the National Security Agency, the Government Accounting Office, and the Secretary of Homeland Security) to assure–

The amendment takes out the mandatory requirement that NIST consult with the NSA. Or does it?

The really funny part comes when you read “…subsection (b) of the section…”

(b) Minimum requirements for standards and guidelines

The standards and guidelines required by subsection (a) of this section shall include, at a minimum—

…..

(3) guidelines developed in coordination with the National Security Agency for identifying an information system as a national security system consistent with applicable requirements for national security systems, issued in accordance with law and as directed by the President.

Assuming you would credit an agency with the intent to obey any law passed by Congress with the record of the NSA, note that NSA will still be around to slap NIST around on “national security systems.”

I don’t doubt the good faith of the folks at NIST but when talking about encryption with the NSA, they are simply out of their league. As are members of congress.

There are any number of possible solutions to government surveillance issues, but administrative slights isn’t one of them.

May 22, 2014

Everything is Broken

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 7:06 pm

Everything is Broken by Quinn Norton.

From the post:

Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and started playing with it. In the process, he figured out how to get total administration access over a network. He put it in a script, and ran it to see what would happen, then went to bed for about four hours. Next morning on the way to work he checked on it, and discovered he was now lord and master of about 50,000 computers. After nearly vomiting in fear he killed the whole thing and deleted all the files associated with it. In the end he said he threw the hard drive into a bonfire. I can’t tell you who he is because he doesn’t want to go to Federal prison, which is what could have happened if he’d told anyone that could do anything about the bug he’d found. Did that bug get fixed? Probably eventually, but not by my friend. This story isn’t extraordinary at all. Spend much time in the hacker and security scene, you’ll hear stories like this and worse.

It’s hard to explain to regular people how much technology barely works, how much the infrastructure of our lives is held together by the IT equivalent of baling wire.

Computers, and computing, are broken.
…

Your reaction may be different but I took Quinn’s essay as a breath of fresh air.

Seriously. The predictions of a computer assisted nirvana emerging from big data, graphs, participation, etc. are tiresome. Not to mention false.

Quinn does a great job of outlining the current problems with computers and computing as well as fixing the blame for the same.

Take a look in the mirror.

Yep, it isn’t some evildoer lurking behind a tree.

True, evildoers may take advantage of the system we have allowed to happen, but that’s a symptom and not a cause.

Read Quinn’s essay and decide how your participation is going to change in what we have wrought.

I first saw this in Nat Torkington’s Four short links: 21 May 2014.

May 18, 2014

Lying to the Supreme Court?

Filed under: NSA,Security — Patrick Durusau @ 7:50 pm

Everyone should know just how much the government lied to defend the NSA by Trevor Timm.

From the post:

If you blinked this week, you might have missed the news: two Senators accused the Justice Department of lying about NSA warrantless surveillance to the US supreme court last year, and those falsehoods all but ensured that mass spying on Americans would continue. But hardly anyone seems to care – least of all those who lied and who should have already come forward with the truth.

Here’s what happened: just before Edward Snowden became a household name, the ACLU argued before the supreme court that the Fisa Amendments Act – one of the two main laws used by the NSA to conduct mass surveillance – was unconstitutional.

In a sharply divided opinion, the supreme court ruled, 5-4, that the case should be dismissed because the plaintiffs didn’t have “standing” – in other words, that the ACLU couldn’t prove with near-certainty that their clients, which included journalists and human rights advocates, were targets of surveillance, so they couldn’t challenge the law. As the New York Times noted this week, the court relied on two claims by the Justice Department to support their ruling: 1) that the NSA would only get the content of Americans’ communications without a warrant when they are targeting a foreigner abroad for surveillance, and 2) that the Justice Department would notify criminal defendants who have been spied on under the Fisa Amendments Act, so there exists some way to challenge the law in court.

It turns out that neither of those statements were true – but it took Snowden’s historic whistleblowing to prove it.
…

See Trevor’s piece for the details.

There is one upside to this outrage.

Would you want to be representing the Justice Department the next time it appears before the Supreme Court?

Whatever semantic games the Justice Department want to play with whether it “lied” or simply didn’t reveal classified information, the bottom line is that the Justice Department deliberately lied to the Supreme Court.

You do know Rule #1 is to never knowingly suborn perjury. Right? Well, Rule #2 is to never lie to a judge. If you lose credibility with the court, that ends any effective representation on your part.

Of all the damage that the national security mania that started under Bush II and continued under Obama has done, destroying the minimal standards of decency and trust between the three branches of government has been the most damaging. Certainly the three branches can disagree and that is part of the checks and balances system. But to lose trust in one or more of the other branches, that is a very serious loss indeed.

It may not be too late for Congress, along with the Supreme Court to find and excise the national security cancer that lies at the heart of the executive branch of government. Here’s to hoping they don’t wait too much longer.

May 15, 2014

Metadata Can Be Deadly

Filed under: Metadata,NSA,Security — Patrick Durusau @ 12:39 pm

‘We Kill People Based on Metadata’ by David Cole.

From the post:

Supporters of the National Security Agency inevitably defend its sweeping collection of phone and Internet records on the ground that it is only collecting so-called “metadata”—who you call, when you call, how long you talk. Since this does not include the actual content of the communications, the threat to privacy is said to be negligible. That argument is profoundly misleading.

Of course knowing the content of a call can be crucial to establishing a particular threat. But metadata alone can provide an extremely detailed picture of a person’s most intimate associations and interests, and it’s actually much easier as a technological matter to search huge amounts of metadata than to listen to millions of phone calls. As NSA General Counsel Stewart Baker has said, “metadata absolutely tells you everything about somebody’s life. If you have enough metadata, you don’t really need content.” When I quoted Baker at a recent debate at Johns Hopkins University, my opponent, General Michael Hayden, former director of the NSA and the CIA, called Baker’s comment “absolutely correct,” and raised him one, asserting, “We kill people based on metadata.”
…

I am sympathetic to many of David’s points, such as the illegitimacy of distinguishing between citizens of the United States and “others,” his suspicions about the USA Freedom Act and its shortcomings.

However, given the readiness of the NSA to break existing laws and then to lie to Congress about having done so, gives me little faith in “reform” type legislation.

Moreover, the debate should not be on the proper limits of government surveillance of its citizens and the citizens of other countries to combat terrorism.

Once the debate is framed to presume some legitimate reason for surveillance, such as terrorism, those who oppose government surveillance have already lost the war. They may win some minor points to support future fund raising but government surveillance will controlled only by those using it. Not a good outcome in my view.

Before reaching the debate on government surveillance, our representatives should be challenging the talisman of terrorism which is offered to justify anti-terrorism measures. How many people died from terrorism last year in the United States? How many similar deaths will be prevented by program X? We may well decide that deaths at lower than the Atlanta metro area traffic accident rate aren’t worth government surveillance.

Sounds to me like we need more metadata about government surveillance programs and their details, not glowing summaries by those most interested in them continuing.

May 8, 2014

Hello, NSA

Filed under: Cybersecurity,Humor,NSA,Security — Patrick Durusau @ 11:05 am

Hello, NSA

Motherboard has a web app that generates random sentences laced with words of interest to the NSA. I saw this in Researchers find post-Snowden chill stifling our search terms by Lisa Vaas at nakedsecurity.

The about page for the app reads:

Turns out Uncle Sam is more of a peeping Tom than we even thought.

Now we know that the US government keeps our personal phone records, and can in certain cases access our emails, status updates, photos, and other personal information. We’re still not exactly sure how they sift through all this data.

But last year, the Department of Homeland Security released a list of over 370 keywords that served as trip-wires amidst the flow of conversation that pours through social media.

The operation—which is just one of an untold number of government programs keeping tabs on our tabs—flagged a variety of hot terms related to terrorism (dirty bomb), cyber security (Mysql injection), infrastructure (bridge, airport), health (pandemic), places (Mexico), and political dissent (radical), as well as more banal verbiage like ‘pork’ and ‘exercise.’

So let’s play a word game! Use our handy phrase generator to come up with pearls of keyword-loaded Twitter wit and perhaps earn you a new follower in Washington. Tweet it out, email it to a friend, share it around, you know the drill—and remember that the NSA and other government agencies might be reading along. And don’t forget to say hello.

Read more about government surveillance programs:

How to Build a Secret Facebook

The Motherboard Guide to Avoiding the NSA

Privacy’s Public, Government-Sponsored Death

A Majority of Americans Believe NSA Phone Tracking Is Acceptable

‘Going Dark’: What’s So Wrong with the FBI’s Plan to Tap Our Internet?

All the PRISM Data the Tech Giants Have Been Allowed to Disclose So Far

Sorry, NSA, Terrorists Don’t Use Verizon. Or Skype. Or Gmail

Please make Hello, NSA your browser homepage and forward that link to friends as a pubic service announcement.

Finding subjects is hard enough with “normal” levels of semantic noise. Help validate the $billions being spent scooping and searching the Internet. Turn the semantic noise knob up a bit.

April 30, 2014

DHS Warning on Internet Explorer

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 8:09 pm

DHS warns against using Internet Explorer until bug is patched by Mark Hachman.

From the post:

A vulnerability discovered in Internet Explorer over the weekend is serious—serious enough that the Department of Homeland Security is advising users to stop using it until it’s been patched.

On Monday, the United States Computer Emergency Readiness Team (US-CERT), part of the U.S. Department of Homeland Security, weighed in.

“US-CERT is aware of active exploitation of a use-after-free vulnerability in Microsoft Internet Explorer,” it said in a bulletin. “This vulnerability affects IE versions 6 through 11 and could lead to the complete compromise of an affected system.

Two questions that need answering:

First, how long as the NSA know about this vulnerability? Thinking the government should be helping the public and software vendors.

Second, is this really a zero-day bug? I ask because the source of the announcement was Microsoft itself. I thought “zero-day” referred to the advance notice given to the vendor before a bug is publicly identified. Yes?

April 11, 2014

NSA … *ucked Up …TCP/IP

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 10:42 am

CERF: Classified NSA Work Mucked Up Security For Early TCP/IP by Paul Roberts.

From the post:

Did the National Security Agency, way back in the 1970s, allow its own priorities to stand in the way of technology that might have given rise to a more secure Internet? You wouldn’t be crazy to reach that conclusion after hearing an interview with Google Vice President and Internet Evangelist Vint Cerf on Wednesday.

As a graduate student in Stanford in the 1970s, Cerf had a hand in the creation of ARPANet, the world’s first packet-switched network. He later went on to work as a program manager at DARPA, where he funded research into packet network interconnection protocols that led to the creation of the TCP/IP protocol that is the foundation of the modern Internet.

Cerf is a living legend who has received just about every honor a technologist can: including the National Medal of Technology, the Turing Award and the Presidential Medal of Freedom. But he made clear in the Google Hangout with host Leo Laporte that the work he has been decorated for – TCP/IP, the Internet’s lingua franca – was at best intended as a proof of concept, and that only now – with the adoption of IPv6 – is it mature (and secure) enough for what Cerf called “production use.”

Specifically, Cerf said that given the chance to do it over again he would have designed earlier versions of TCP/IP to look and work like IPV6, the latest version of the IP protocol with its integrated network-layer security and massive 128 bit address space. IPv6 is only now beginning to replace the exhausted IPV4 protocol globally.
…

Paul later points out that we can’t know the impact of then available security would have had on the creation and adoption of the Internet.

Fair point.

And there isn’t any use in crying over spilled milk.

However, after decades of lying, law breaking and trying to disadvantage the population it is alleged to serve, why isn’t Congress defunding the NSA now?

If an agency has a proven track record of law-breaking and lying to Congress, what reason is there to credit any report, any statement or any information the NSA claims to have gathered?

You know the saying: Fool me once, shame on you. Fool me twice, shame on me?

The entire interview:

If you aren’t worried about privacy, human rights, etc., let’s make it a matter of dollars and cents.

Think about the economic losses and expenses of your enterprise from an insecure Internet or the profits you could be making with a secure Internet.

The NSA has been at war against your commercial interests for as long as the Internet has existed. If you are serious about the Internet and information, then it is time to rid everyone of the #1 drag on ecommerce, the NSA.

March 25, 2014

Microsoft Outlook Users Face Zero-Day Attack

Filed under: Cybersecurity,Microsoft,NSA,Security — Patrick Durusau @ 6:50 pm

Microsoft Outlook Users Face Zero-Day Attack by Mathew J. Schwartz.

From the post:

Simply previewing maliciously crafted RTF documents in Outlook triggers exploit of bug present in Windows and Mac versions of Word, Microsoft warns

There is a new zero-day attack campaign that’s using malicious RTF documents to exploit vulnerable Outlook users on Windows and Mac OS X systems, even if the emailed documents are only previewed.

That warning was sounded Monday by Microsoft, which said that it’s seen “limited, targeted attacks” in the wild that exploit a newly discovered Microsoft Word RTF file format parser flaw, which can be used to corrupt system memory and execute arbitrary attack code.

“An attacker who successfully exploited this vulnerability could gain the same user rights as the current user,” said a Microsoft’s security advisory. “If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

It’s only Snowden Year One (SY1) and with every new zero-day attack that makes the news I wonder: “Did this escape from the NSA?”

The other lesson: Only by building securely can there be any realistic computer security.

One good place to start would be building software that reads (if not also writes) popular office formats securely.

March 23, 2014

New Book on Data and Power

Filed under: Data,Government,NSA,Privacy,Security — Patrick Durusau @ 6:23 pm

New Book on Data and Power by Bruce Schneier.

From the post:

I’m writing a new book, with the tentative title of Data and Power.

While it’s obvious that the proliferation of data affects power, it’s less clear how it does so. Corporations are collecting vast dossiers on our activities on- and off-line — initially to personalize marketing efforts, but increasingly to control their customer relationships. Governments are using surveillance, censorship, and propaganda — both to protect us from harm and to protect their own power. Distributed groups — socially motivated hackers, political dissidents, criminals, communities of interest — are using the Internet to both organize and effect change. And we as individuals are becoming both more powerful and less powerful. We can’t evade surveillance, but we can post videos of police atrocities online, bypassing censors and informing the world. How long we’ll still have those capabilities is unclear.

Understanding these trends involves understanding data. Data is generated by all computing processes. Most of it used to be thrown away, but declines in the prices of both storage and processing mean that more and more of it is now saved and used. Who saves the data, and how they use it, is a matter of extreme consequence, and will continue to be for the coming decades.

Data and Power examines these trends and more. The book looks at the proliferation and accessibility of data, and how it has enabled constant surveillance of our entire society. It examines how governments and corporations use that surveillance data, as well as how they control data for censorship and propaganda. The book then explores how data has empowered individuals and less-traditional power blocs, and how the interplay among all of these types of power will evolve in the future. It discusses technical controls on power, and the limitations of those controls. And finally, the book describes solutions to balance power in the future — both general principles for society as a whole, and specific near-term changes in technology, business, laws, and social norms.
….

Bruce says a table of contents should appear in “a couple of months” and he is going to be asking “for volunteers to read and comment on a draft version.”

I assume from the description that Bruce is going to try to connect a fairly large number of dots.

Such as who benefits from the Code of Federal Regulations (CFRs) not having an index? The elimination of easier access to the CFRs is a power move. Someone with a great deal of power wants to eliminate the chance of someone gaining power from following information in the CFRs.

I am not a conspiracy theorist but there are only two classes of people in any society, people with more power than you and people with less. Every sentient person wants to have more and no one will voluntarily take less. Among chickens they call it the “pecking order.”

In human society, the “pecking order” in enforced by uncoordinated and largely unconscious following of cultural norms. No conspiracy, just the way we are. But there are cases, the CFR indexes being one of them, where someone is clearly trying to disadvantage others. Who and for what reasons remains unknown.

March 20, 2014

iOS Reverse Engineering Toolkit

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 8:28 pm

Introducing the iOS Reverse Engineering Toolkit by Stephen Jensen.

From the post:

It should be the goal of every worker to expend less time and energy to achieve a task, while still maintaining, or even increasing, productivity. As an iOS penetration tester, I find myself repeating the same manual tasks for each test. Typing out the same commands to run various tools that are required to help me do my job. And to be honest, it’s completely monotonous. Every time I fat-finger a key, I lose productivity, forcing me to expend more time and energy to achieve the task. I’m a fan of automation. I’m a fan of streamlined innovation that saves me time and still accomplishes, for the most part, the same results. It was this desire to save time, and reduce my likelihood of suffering from carpal tunnel, that I created the iOS Reverse Engineering Toolkit.

It’s close enough to the weekend to start looking for interesting diversions.

Does anybody know if NSA staff use iPhones or not? 😉

They can hardly complain about the ethics of surveillance. Yes?

Nosy Americans?

Filed under: Cybersecurity,NSA,Security — Patrick Durusau @ 7:55 pm

You have heard the phrase “ugly Americans,” but have you heard “nosy Americans?”

Lee Munson reports in NSA can record 100% of another country’s telephone calls that:

The National Security Agency (NSA) has the ability to record every single one of a foreign country’s telephone calls and then play the conversations back up to a month after recording, according to a report by The Washington Post.

The NSA program, which begun in 2009, is known as MYSTIC.

MYSTIC, according to the Post, is used to intercept conversations in just one (undisclosed) country, but planning documents show that the NSA intends to use the system in other countries in the future.

The really sad part is when you read:

The Washington Post says, at the request of US officials, it will not reveal the country in question, or any other nation where the system has been planned to be put to use. It is, however, quite likely that calls made to or from that nation will include American citizens.

I must have missed the ballot when United States citizens elected the Washington Post to decide on our behalf what facts we need to hear, and those we don’t.

And I don’t have a lot of sympathy for the argument that surveillance may include American citizens.

Its an easy argument to make constitutionally, but if you denigrate the rights of others based on citizenship, the soccer fields aren’t as far away as you think. (But they will be in non-U.S. territory.)

March 17, 2014

Facebook Graph Search with Cypher and Neo4j

Filed under: Cybersecurity,Cypher,Neo4j,NSA,Security — Patrick Durusau @ 8:14 pm

Facebook Graph Search with Cypher and Neo4j by Max De Marzi.

A great post as always but it has just been updated:

Update: Facebook has disabled this application

Your app is replicating core Facebook functionality.

Rather ironic considering this headline:

Mark Zuckerberg called Obama about the NSA. Let’s not hang up the phone by Dan Gillmor.

It’s hard to say why Mark is so upset.

Here are some possible reasons:

  • NSA surveillance is poaching on surveillance sales by Facebook
  • NSA leaks exposed surveillance by Facebook
  • NSA leaks exposed U.S. corporations doing surveillance for the government
  • NSA surveillance will make consumers leery of Facebook surveillance
  • NSA leaks make everyone more aware of surveillance
  • NSA leaks make Mark waste time on phone with Obama acting indignant.

I am sure I have missed dozens of reasons why Mark is upset.

Care to supply the ones I missed?

February 11, 2014

Is 11 Feb 2014 The Day We Fight Back?

Filed under: Cryptography,Cybersecurity,NSA,Privacy,Security — Patrick Durusau @ 11:31 am

Is 11 Feb 2014 The Day We Fight Back? by Mark Stockley.

From the post:

Appalled with government surveillance without oversight? Sick of having your privacy invaded? Numb from stories about the NSA? If you are, you’ll have had many more bad days than good since June 2013.

But today, just perhaps, could be one of the better ones.

Mark covers the general theme of protests quite well and then admits, ok, so people are protesting, now what?

Lacking a target like SOPA, there is not specific action to ask for or for anyone to take.

Or as Mark points out:

Who do we lobby to fix that situation [government surveillance} and how will we ever know if we have succeeded?

I put it to you the government(s) being petitioned for privacy protection are the same ones that spied on you. Is there irony that situation?

Is it a reflection on your gullibility that despite years of known lies, deceptions and rights violations, you are willing to trust the people responsible for the ongoing lies, deceptions and rights violations?

If you aren’t going to trust the government, if you aren’t going to protest, what does that leave?

Fighting back effectively.

Mark points out a number of efforts to secure the technical infrastructure of the Internet. Learn more about those, support them and even participate in them.

Among other efforts, consider the OASIS PKCS 11 TC:

The OASIS PKCS 11 Technical Committee develops enhancements to improve the PKCS #11 standard for ease of use in code libraries, open source applications, wrappers, and enterprise/COTS products: implementation guidelines, usage tutorials, test scenarios and test suites, interoperability testing, coordination of functional testing, development of conformance profiles, and providing reference implementations.

The updated standard provides additional support for mobile and cloud computing use cases: for distributed/federated applications involving key management functions (key generation, distribution, translation, escrow, re-keying); session-based models; virtual devices and virtual keystores; evolving wireless/sensor applications using near field communication (NFC), RFID, Bluetooth, and Wi-Fi.

TC members are also designing new mechanisms for API instrumentation, suitable for use in prototyping, profiling, and testing in resource-constrained application environments. These updates enable support for easy integration of PKCS #11 with other cryptographic key management system (CKMS) standards, including a broader range of cryptographic algorithms and CKMS cryptographic service models. (from the TC homepage)

Whatever security you have from government intrusion is going to come from you and others like you who create it.

Want to fight back today? Join one of the efforts that Marks lists or the OASIS PKCS 11 TC. Today!

February 9, 2014

Snowden Used Low-Cost Tool to Best N.S.A.

Filed under: Cybersecurity,Humor,NSA,Web Scrapers,Webcrawler — Patrick Durusau @ 4:47 pm

Snowden Used Low-Cost Tool to Best N.S.A. by David E. Sanger and Eric Schmitt.

From the post:

Intelligence officials investigating how Edward J. Snowden gained access to a huge trove of the country’s most highly classified documents say they have determined that he used inexpensive and widely available software to “scrape” the National Security Agency’s networks, and kept at it even after he was briefly challenged by agency officials.

Using “web crawler” software designed to search, index and back up a website, Mr. Snowden “scraped data out of our systems” while he went about his day job, according to a senior intelligence official. “We do not believe this was an individual sitting at a machine and downloading this much material in sequence,” the official said. The process, he added, was “quite automated.”

The findings are striking because the N.S.A.’s mission includes protecting the nation’s most sensitive military and intelligence computer systems from cyberattacks, especially the sophisticated attacks that emanate from Russia and China. Mr. Snowden’s “insider attack,” by contrast, was hardly sophisticated and should have been easily detected, investigators found.

Moreover, Mr. Snowden succeeded nearly three years after the WikiLeaks disclosures, in which military and State Department files, of far less sensitivity, were taken using similar techniques.

Mr. Snowden had broad access to the N.S.A.’s complete files because he was working as a technology contractor for the agency in Hawaii, helping to manage the agency’s computer systems in an outpost that focuses on China and North Korea. A web crawler, also called a spider, automatically moves from website to website, following links embedded in each document, and can be programmed to copy everything in its path.
….

A highly amusing article that explains the ongoing Snowden leaks and perhaps a basis for projecting when Snowden leaks will stop….not any time soon! The suspicion is that Snowden may have copied 1.7 million files.

Not with drag-n-drop but using a program!

I’m sure that was news to a lot of managers in both industry and government.

Now of course the government is buttoning up all the information (allegedly), which will hinder access to materials by those with legitimate need.

It’s one thing to have these “true to your school” types in management at agencies where performance isn’t expected or tolerated. But in a spy agency that you are trying to use to save your citizens from themselves, that’s just self-defeating.

The real solution for the NSA and any other agency where you need high grade operations is to institute an Apache meritocracy process to manage both projects and to fill management slots. It would not be open source or leak to the press, at least not any more than it does now.

The upside would be the growth, over a period of years, of highly trained and competent personnel who would institute procedures that assisted with their primary functions, not simply to enable the hiring of contractors.

It’s worth a try, the NSA could hardly do worse than it is now.

PS: I do think the NSA is violating the U.S. Constitution but the main source of my ire is their incompetence in doing so. Gathering up phone numbers because they are easy to connect for example. Drunks under the streetlight.

PPS: This is also a reminder that it isn’t the cost/size of the tool but the effectiveness with which it is used that makes a real difference.

« Newer Posts — Older Posts »

Powered by WordPress