Monthly Archives: March 2014

Report: RSA endowed crypto product with second NSA-influenced code

Posted on by

Security provider RSA endowed its BSAFE cryptography toolkit with a second NSA-influenced random number generator (RNG) that's so weak it makes it easier for eavesdroppers to decrypt protected communications, Reuters reported Monday.

Citing soon-to-be-published research from several universities, Reuters said the Extended Random extension for secure websites allows attackers to work tens of thousands of times faster when breaking cryptography that uses the Dual EC_DRBG algorithm to generate the random numbers that populate a specific cryptographic key. Dual EC_DRBG is a pseudo-random number generator that was developed by cryptographers from the National Security Agency and was the default RNG in BSAFE even after researchers demonstrated weaknesses so severe that many suspected they were introduced intentionally so the US spy agency could exploit them to crack encrypted communications of people it wanted to monitor. In December, Reuters reported that the NSA paid RSA $10 million to give Dual EC_DRBG its favored position in BSAFE.

Extended Random was a second RNG that would presumablymake cryptographic keys more robust by adding a second source of randomness. In theory, the additional RNG should increase the entropy used when constructing a new key. In reality, the algorithm made protected communications even easier for attackers to decrypt by reducing the time it takesto predict the random numbers generated by Dual EC_DRBG, which is short for Dual Elliptic Curve, Reuters reported Monday.

"If using Dual Elliptic Curve is like playing with matches, then adding Extended Random is like dousing yourself with gasoline," Matt Green, a professor specializing in cryptography at Johns Hopkins University and one of the authors of the upcoming academic report, told Reuters. Monday's report continued:

The NSA played a significant role in the origins of Extended Random. The authors of the 2008 paper on the protocol were Margaret Salter, technical director of the NSA's defensive Information Assurance Directorate, and an outside expert named Eric Rescorla.

Rescorla, who has advocated greater encryption of all Web traffic, works for Mozilla, maker of the Firefox Web browser. He and Mozilla declined to comment. Salter did not respond to requests for comment.

Though few companies appear to have embraced Extended Random, RSA did. The company built in support for the protocol in BSafe toolkit versions for the Java programming language about five years ago, when a preeminent Internet standards groupthe Internet Engineering Task Forcewas considering whether to adopt Extended Random as an industry standard. The IETF decided in the end not to adopt the protocol.

The researchers said it took them about an hour to crack a free version of BSAFE for Java using about $40,000 worth of computer gear, Reuters reported. Cracking was 65,000 times faster when BSAFE used Extended Random, an improvement that reduced attacks to seconds.

Read more from the original source:
Report: RSA endowed crypto product with second NSA-influenced code

BlackBerry Approved for New Cryptography Certification

Posted on by

BlackBerry has announced that it has secured US government security approval for its Secure Work Space for iOS and Android a multi platform containerization solution managed through BlackBerry Enterprise Service 10 (BES10).

Considered a critical benchmark for security in government, FIPS validation assures users that a given encryption technology has passed rigorous testing in order to be used to encrypt and secure sensitive information.

With Secure Work Space, BES10 protocols for data-at-rest and data-in-transit are extended to iOS and Android devices. This means data is protected while traversing networks as well as within the walls of the enterprise. Administrators can configure, secure, wipe and interact within the Secure Work Space on a device, while employees can use the device for personal use.

"BlackBerry is considered the most trusted and secure mobile platform and we continue to provide customers with choice and flexibility without compromising security," said Scott Totzke, Senior Vice President, Security Group at BlackBerry.

FIPS 140-2 is issued by the National Institute of Standards and Technology (NIST) to coordinate the requirements and standards for certifying cryptographic modules. In addition to U.S. government recognition, the certification is accepted and supported by the Communications Security Establishment Canada (CSEC) for government use.

BlackBerry products and solutions are protected by AES 256-bit encryption, a highly secure, internationally recognized data protection standard. In addition to FIPS certification, BlackBerry 10 smartphones are also approved by NATO for use in classified communications up to the level of "Restricted." Additionally, BlackBerry was the first MDM vendor to achieve "Authority to Operate" on the U.S. Department of Defense's secure networks.

Continued here:
BlackBerry Approved for New Cryptography Certification

Assange not running in new Australian election

Posted on by

High performance access to file storage

Julian Assange will not, as previously indicated, run for Australia Senate again.

The part-time Ecuadorian ran as a candidate for The Wikileaks Party at Australia's general election last year, hoping to win a Senate seat in the State of Victoria. Doing so probably would not have allowed him safe passage from Ecuadors London embassy, but might have given him some new legal arguments to pursue.

A second candidacy was raised as a possibility after the Senate election was botched in the State of Western Australia. Last November, the Wikileaks Party announced it would once again seek to install Assange as its main candidate for any re-run election.

Subsequent decisions mean that election has been ordered for April 5th, when Western Australia will return to the polls to elect six Senators.

But Assange is not on the ballot paper because, says Wikileaks Party's campaign manager Gerry Georgatos, Australia's Electoral Commission deemed he is ineligible to run.

Australian citizens are eligible to run as candidate if they are over 18 years of age and are either enrolled or eligible to be enrolled on the Commonwealth electoral roll. Would-be candidates must also satisfy the provisions of Section 44 of Australia's Constitution , that rules out criminals, bankrupts, those accused of treason, foreign citizens and those who work for or profit from Commonwealth enterprises.

Tempting as it is to imagine Assange has become an Ecuadorian citizen or been charged with treason, a stuff-up looks the likely reason for the the leaker-in-chief's failure to appear on the ballot paper.

"He may not have enrolled in Western Australia on time," Georgatos told The Reg. Once Assange's candidature was untenable, WikiLeaks party's 2600-strong membership elected two new candidates: TV producer Tibor Meszaros and journalist Lucy Nicol.

Georgatos but is not optimistic about their prospects, fearing the taint of what he said were incorrect reports of the party's intention to direct preferences to right-wing parties at Australia's September 2013 election.

Continue reading here:
Assange not running in new Australian election

Judge Jeanine slams Obama – Putin’s been bitchslapping you since the Edward Snowden mess – Video

Posted on by


Judge Jeanine slams Obama - Putin #39;s been bitchslapping you since the Edward Snowden mess
Moments ago, Judge Jeanine unloaded on Obama saying that Obama is singlehandedly bringing about the decline of America as a world power. This in turn affects...

By: LSUDVM

See the rest here:
Judge Jeanine slams Obama - Putin's been bitchslapping you since the Edward Snowden mess - Video

Edward Snowden Urges SXSW Crowd to Thwart NSA With Technology

Posted on by

Edward Snowden speaks at SXSW.

With lawmakers slow to pass legislation curbing NSA surveillance, its up to the technology community to step in and devise solutions that will better protect online communications from snoops, said Edward Snowden, speaking today from Moscow at the South by Southwest conference in Austin.

[T]he people who are in the room at Austin right now, theyre the folks who can really fix things, who can enforce our rights for technical standards even when Congress hasnt yet gotten to the point of creating legislation that protect our rights in the same manner, he said. Theres a policy response that needs to occur, but theres also a technical response that needs to occur. And its the makers, the thinkers, the developing community that can really craft those solutions to make sure were safe.

The massive surveillance being done by the NSA and other governments has created an adversarial internet, he said, a sort of a global free-fire zone for governments, thats nothing that we ever asked [for]; its not what we wanted. Its something we need to protect against.

[T]heyre setting fire to the future of the internet. And the people who are in this room now, you guys are all the firefighters. And we need you to help us fix this.

One solution he highlighted, that would make it more difficult for the U.S. and other governments to conduct passive surveillance, is the implementation of end-to-end encryption that would protect communications from user to user, rather than as its currently done by Google and other services, which only encrypt the communication from user to service, leaving it vulnerable to collection from the service provider.

End-to-end encryption makes mass surveillance impossible at the network level, he says, and provides a more constitutionally protected model of surveillance, because it forces the government to target the endpoints the individual users through hacking, rather than conduct mass collection.

Snowden, speaking through a Google Hangout session, masking his whereabouts through seven online proxies, appeared onscreen sitting in front of a backdrop of the Constitutions First Amendment likely a sly reference to a Kansas lawmakers attempt to bar Snowdens free speech by asking the conference organizers last week to cancel his talk.

Snowdens talk was broadcast online to more than 40,000 viewers as well as to a packed house and overflow rooms in Austin.

The interview was conducted by Ben Wizner, one of Snowdens attorneys and director of the ACLU Speech, Privacy & Technology Project, and Wizners colleague Chris Soghoian, principal technologist and a senior policy analyst for the same project.

View post:
Edward Snowden Urges SXSW Crowd to Thwart NSA With Technology

Russia evades US SIGINT surveillance – Has Snowden turned spy?

Posted on by

This will be a bit controversial as famed NSA whistleblower Edward Snowden himself is a controversial figure. Some say hes a hero, others say hes a villain and others say the truth is somewhere in between. Given the nature of what Snowden acquired and disclosed, we must be careful not to assume that every intelligence failure that comes along has something to do with Snowden. However, world events in recent weeks have piled together some circumstances that bear review. Russia has invaded Crimea, yet according to a report in the Daily Beast prior to the invasion, US intelligence concluded that Russia would not openly invadethe Crimean Peninsula or the Ukraine itself. Calling it a bluff, the article stated:

A senior U.S. intelligence official told The Daily Beast that the timing of the military exercise, coming only days after the Ukrainian parliament voted to oust the pro-Russian president, Viktor Yanukovych, was suspicious. But nonetheless, U.S. intelligence agencies have collected no information suggesting the training exercises were preparation for an invasion.

The mere fact of the timing when you consider what is going on in Ukraine and you see the sudden nature of the exercise would cause concern, this official said. From an intelligence perspective we dont have any reason to think its more than military exercises.

That assessment was clearly wrong, theres no getting around that. Intelligence operations have missed some things before, but it seems that in this case, the open assessment was based on a lack of positive indicators and that seems to have turned out to be a major problem. Julian Barnes of the Wall St. Journal last week went into how Russians had been able to evade eavesdropping by the US. This is a recent development that surprised people, because obviously the plans to invade should have been intercepted by US surveillance, US SIGINT was potentially circumvented.

U.S. military satellites spied Russian troops amassing within striking distance of Crimea last month. But intelligence analysts were surprised because they hadnt intercepted any telltale communications where Russian leaders, military commanders or soldiers discussed plans to invade.

Americas vaunted global surveillance is a vital tool for U.S. intelligence services, especially as an early-warning system and as a way to corroborate other evidence. In Crimea, though, U.S. intelligence officials are concluding that Russian planners might have gotten a jump on the West by evading U.S. eavesdropping.

One has to consider whether it is a coincidence that the Russians figured out how to throw NSA surveillance off their tracks, or whether they have gained another edge somehow in their capabilities. It is quite tantalizing to think that a famed NSA contractor in possession of highly classified, highly sensitive information about the very parties that conduct this surveillance may have something to do with it. Snowden was granted asylum in Russia, and according to the latest Russian statements on the affair, there is no pressure to end his asylum. Thats as interesting a coincidence as any other, and it is quite possible that select documents may have ended up in Russian hands given this sudden ability to evade the NSAs ability to pick up communications.

You cant exactly throw this at Snowdens feet so readily however, as it is still just a possibility. The intelligence community is capable of missing things and has done so before, and I suppose there are many possibilities as to why Russia has been able to evade surveillance. Note that as outside observers we may never get to the truth of the matter, but we must remain vigilant to all the potential factors and that includes that Snowden may have leaked direct info to his grantors of asylum. The Wall Street Journal writes:

More:
Russia evades US SIGINT surveillance – Has Snowden turned spy?