EFF sues NSA…

EFF_NSA-680x400The Electronic Frontier Foundation, has filed a lawsuit against the U.S. National Security Agency to get it to specify the extent to which it might exploit software security flaws.

The EFF said it had filed a Freedom of Information Act lawsuit against the NSA and the Office of the Director of National Intelligence to gain access to documents showing how intelligence agencies choose whether to disclose software security flaws known as “zero days.” These early stage flaws are typically discovered by researchers but are not yet patched by developers or the company. A market has even sprung up around the flaws, in which governments will purchase the vulnerabilities to gain access to people’s computers, EFF said.  Not disclosing zero-day flaws jeopardizes people’s data and communications, the EFF has argued.

The suit comes amid concerns and accusations that government agencies, including but not limited to the NSA, may be exploiting these vulnerabilities for intelligence-gathering processes without the public’s awareness.  In April, Bloomberg News reported that the NSA had used the then-recently disclosed “Heartbleed” security bug to gather intelligence for at least two years before it was discovered by others. The NSA said the report was incorrect.  The EFF had filed a Freedom of Information Act request in May related to these processes, but still has not received any documents, despite Intelligence Director James Clapper’s office agreeing to expedite the request.

“This [suit] seeks transparency on one of the least understood elements of the U.S. intelligence community’s toolset: security vulnerabilities,” said Andrew Crocker, EFF legal fellow, in a statement. “These documents are important to the kind of informed debate that the public and the administration agree needs to happen in our country.”

A spokeswoman for the NSA declined to comment. The intelligence director’s office did not immediately respond to comment.

Following disclosures made last year by former NSA contractor Edward Snowden, intelligence agencies’ techniques have come under much scrutiny. In addition to their possible exploitation of software vulnerabilities, whether agencies can exploit weaknesses in encryption has also sparked concern.  As a result many large companies like Google and Microsoft have bolstered their use of encryption technology in recent months.

SOURCE – Infoworld

Squeaky Dolphin?

squeakydolphin-640x456Documents obtained by former NSA contractor Edward Snowden show that NSA analysts monitored content on The Pirate Bay and used the agency’s surveillance systems to track where it came from. The documents also show that the NSA’s British partners at the GCHQ used XKeyscore data as part of a surveillance program on sites that included WikiLeaks. That was part of a broader psychological profiling and targeting program to collect intelligence, influence individuals online, and disrupt groups like Anonymous that were considered threats.  The new documents show that the GCHQ conducted “broad real-time monitoring of social media activities, processing data on activities like watching YouTube videos and Facebook Likes to profile, categorize, and target individuals for psychological operations.” The NSA documents in the latest disclosure refer to monitoring for content that could be considered “malicious foreign activity.” But it’s clear that the NSA also used its XKeyscore surveillance to dig through traffic to the torrent-sharing site, and it could very well have profiled foreign users of sites like WikiLeaks and monitored their access to that and other websites.

However, the documents—one an internal NSA “frequently asked questions” Wiki page and the other a set of GCHQ slides on psychological operations—do not provide a picture of how much information about people accessing WikiLeaks was shared between the GCHQ and the NSA. And while the documents point to NSA monitoring of Pirate Bay, there’s no suggestion of how the information gathered was used or if it was used at all.  A third, unpublished document shows that the Obama administration apparently encouraged foreign governments in 2010 (including the UK) to pursue charges against WikiLeaks for the publication of diplomatic “wires” provided by Chelsea Manning, formerly known as Bradley Manning.

The GCHQ slide deck, published in 2012, highlights two tools used to conduct social networking, Web monitoring, and profiling. The first, called “Squeaky Dolphin,” pulls online activities within Web traffic caught by the agency’s monitoring systems. The monitoring systems are called “Airwolf” in the slides, which may be a UK codeword for the GCHQ’s equivalent of XKeyscore. That data includes webmail, blogs visited, YouTube views, Facebook “likes” clicked on websites themselves, and other data culled from individual users’ captured activity.

It runs those activities, captured in real-time, through IBM’s InfoSphere Streams processing software to create analytical feeds. Those feeds are then piped into a Splunk database and surfaced through a “dashboard” view that allows analysts to find trends in sentiment. As an example, the slides showed activity related to cricket matches in London and the surge in Facebook likes for Conservative member of Parliament Liam Fox. It can also be used to spot trends in traffic that might indicate upcoming events such as protests or other civil unrest.

While Squeaky Dolphin tends to look at things with a wider view, “AnticrisisGirl” is a bit more targeted. It can be used to passively monitor specific websites—including traffic to WikiLeaks, as the slides demonstrate. The tool can be tuned to a specific set of Internet user signatures or keywords, and it provides analytics of their behavior in real time, capturing search terms or direct Web addresses used to get to the sites in question.

SOURCE – arstechnica.com

From NSA to Gmail: Ex-Spy Launches Free Email Encryption Service

The surveillance bombshells revealed by Edward Snowden have prompted many Americans to reconsider what they say and do online.

Hoping to seize upon amplified privacy concerns, a former National Security Agency architect launched a free service this week that allows users to easily encrypt their Gmail, Yahoo and Outlook emails.

Virtru, which has received $4 million in angel financing and emerged from stealth mode to attracted significant interest from a number of potential corporate customers, including big Wall Street banks.

“There is mass concern about privacy. The issue is people don’t know where to go to take action. We’re trying to meet that need,” said John Ackerly, a former White House official who co-founded Virtru with his brother Will.

While working at the NSA, Will Ackerly helped invent an encryption format that has become the standard for sharing sensitive data between U.S. intelligence agencies. Seeing the great demand to protect personal and commercial documents, the Ackerly brothers are now deploying that platform to a much wider audience.

“Services like Virtru will probably give most commercial users a degree of security that only governments have enjoyed to this point,” said Cedric Leighton, a former NSA official who does not know the Ackerly brothers.

Virtru appears to be launching at a perfect time given the enormous amount of attention on government surveillance, which classified documents leaked by Snowden show is far greater than the American public realized.  According to a poll of 2,000 U.S. adults by Harris Interactive that Virtru commissioned, 73% of Americans online are concerned about the privacy of their email communications. But just 34% of online adults said they had taken steps like using a secure email provider or encrypted technologies.

While the Snowden revelations “caused the country tremendous harm in terms of national security,” John Ackerly said the “issues are real and the balance of power has shifted away from the individual.”

Using the open-source Trusted Data Format that Will Ackerly helped create in 2008, Virtru allows users to encrypt emails from Google’s Gmail, Yahoo, Microsoft’s Outlook and Apple’s Mac Mail. The service is powered by 256-bit AES encryption.

VIDEO – See how Virtru works…

SOURCE – foxbusiness.com

NSA Proof Smartphone?

blackphoneFriends, I’m sure you all know that the NSA is reading your mail, listening in on your conversations and monitoring your activity on this very website.  I ran across an article about an upcoming smartphone called Blackphone aims to put privacy in your hands, protecting you from anyone wanting to snoop into your private data — even the NSA.  A Switzerland-based join venture between Silent Circle and Geeksphone, the project is backed by several important figures in the fields of computer security, including Phil Zimmermann, creator of data encryption protocol PGP (Pretty Good Privacy).  Blackphone is powered by a “security-oriented” Android build called PrivatOS. It’s carrier- and vendor-independent, and enables users to make and receive secure phone calls and video chats, exchange secure texts as well as transfer and store files.  Exact specifications of the phone haven’t been revealed, but Silent Circle CEO Mike Janke claims it’ll be a “high-end” smartphone.  The No. 1 priority of Blackphone isn’t its specs, however: It’s protecting users’ privacy, claims Zimmerman.  See the Video here.

“Blackphone provides users with everything they need to ensure privacy and control of their communications, along with all the other high-end smartphone features they have come to expect,” said Zimmermann.

The two companies behind the project make an interesting match. Silent Circle is a U.S.-based company focused on encryption; Geeksphone is a Spanish company behind Firefox OS developer devices.  Blackphone will be unveiled at the Mobile World Congress (MWC) in Barcelona on Feb. 24.

SOURCE – Mashable.com

UPDATE – 02/26/14 – Blackphone Unveils Super-Secure Smartphone at MWC

UPDATE – 02/27/14 – Take a closer look at the Batphone; I mean Blackphone

Tor remains resistant to the NSA…

The U.S. National Security Agency has repeatedly tried to compromise Tor, the government-funded online anonymity tool, but has had little success, according to a new report in the U.K.’s Guardian.

The NSA has tried multiple strategies for defeating Tor, with its most successful method focused on attacking vulnerable software on users’ computers, including the Firefox browser, according to the report, published Friday. In the Firefox attack, NSA agents have been able to gain “full control” of targets’ computers, said the report, citing documents given to the Guardian by former NSA contractor Edward Snowden.  tor_nsaNSA documents provided by Snowden, which the Guardian began  publishing in June, say the agency is collecting bulk phone records in  the U.S. as well as Internet communications overseas.  But in many cases, the NSA has been frustrated in its efforts to  target Tor users, an irony because the open-source project is largely  funded by the U.S. Department of Defense, the NSA’s parent agency, and  the U.S. Department of State.

“We will never be able to de-anonymize all Tor users all the time,” according to one NSA document quoted by the Guardian. “With  manual analysis we can de-anonymize a very small fraction of Tor users.”  The NSA has had “no success de-anonymizing a user in response” to a  specific request, the document said.

Tor is “the king of high-secure, low-latency internet anonymity,” the report quotes another NSA document as saying.  Tor routes Internet traffic through a number of relays as a way  to keep communications anonymous. The State Department promotes the  software to activists in countries with strong censorship regimes,  including Iran and China.  An NSA spokeswoman referred a request for comments on the story to a previous statement from the agency:

“In carrying out its signals intelligence mission, NSA collects  only those communications that it is authorized by law to collect for  valid foreign intelligence and counterintelligence purposes, regardless  of the technical means used by those targets or the means by which they  may attempt to conceal their communications. … It should hardly be  surprising that our intelligence agencies seek ways to counteract  targets’ use of technologies to hide their communications.  “Throughout history, nations have used various methods to protect  their secrets, and today terrorists, cybercriminals, human traffickers  and others use technology to hide their activities,” the statement  continued. “Our intelligence community would not be doing its job if we  did not try to counter that.”

NSA efforts to compromise “anonymous online communication” is  justified, U.S. Director of National Intelligence James Clapper said in a  statement released late Friday.

SOURCE – Infoworld

Interesting Read – How does the NSA break SSL?

  • Ads