Monthly Archives: July 2017

$20 antennas can now help breach 256-bit encryption standards – Digital Trends

Posted on by

Get today's popular DigitalTrends articles in your inbox:

Why it matters to you

This technique shows hackers don't need bottomless wallets or even direct access to a system to breach heavy encryption.

Security researchers have devised a method of defeating AES-256bit encryption in as little as five minutes, and most importantly, you dont need an expensive supercomputer to do it. The technique leverages radio hardware to measure the frequency changes in the magnetic field generated during encryption to record and decode the information from a distance.

Manufacturing and digital security often have the project management triangle in common. Defeating security and breaching encryption can rarely be done fast, well and without significant cost. But what this Fox-IT technique achieves is very close to that ideal, offering the ability to crack even complex AES-256bit encryption in a few minutes with relatively cheap, off-the-shelf hardware.

Although using more-expensive radio recording hardware can yield better results, the technique is capable of cracking software encryption using just a $25 USB stick and a small wire loop antenna.

By measuring the power output of the encrypting system, the snoopers can tell when an algorithm is receiving input data and later outputting it in an encrypted form. With a mixture of guesswork and correlation, the researchers are able to take that and begin to decode the AES algorithm. By attempting to figure out what the correct value (of 256 options) for each of the 32 bytes is, only 8,192 guesses must be made.

If you were to attempt to brute force hack the encrypted message itself, youd be making an impossible number of guesses (two, to the power of 256). This technique makes the impossible not only viablebut easy.

Better yet, the technique doesnt require direct access to the encrypting hardware. The researchers were able to perform the technique from up to a meter away.

That was technically only possible because of ideal testing conditions though. In reality, the most even those with high-end equipment could expect to conduct such an attack is from 30 centimeters away. Still, being able to make such an attack from a distance with cheap hardware highlights the potential for new attack vectors against typically near-foolproof encryption systems.

Although breaking open someones obfuscated files is almost always going to be easier if you extract the decryption key from the owner, this system offers a new way for all sorts of organizations and individuals to target it. In turn, this should lead to better shielding for protected hardware in the future.

Read the original here:
$20 antennas can now help breach 256-bit encryption standards - Digital Trends

Dev to El Reg: Making web pages pretty is harder than building crypto – The Register

Posted on by

+Comment An Australian computer scientist working in Thailand has offered his contribution to Australia's cryptography debate by creating a public-key crypto demonstrator in less than a day, using public APIs and JavaScript.

Brandis.io not a useful encryption implementation (the site itself says as much), but is a useful public education exercise.

By using the WebCryptoAPI, author Dr Peter Kelly has implemented end-to-end crypto in just 445 lines of JavaScript code.

As Kelly writes at GitHub, Brandis does not implement encryption itself; instead, it relies on the Web Cryptography API provided by your browser, and simply exposes a user interface to this API that enables its use by non-programmers.

Hence its smallness: the cryptography is already out there, in the form of straightforward calls to public APIs: there's more JavaScript devoted to screen furniture than to generating public and private keys, or encrypting/decrypting the messages.

Dr Kelly's Brandis.io crypto demonstrator

As Kelly told Vulture South: I spent way more time on [the presentation] than I did on the crypto-using code. Picking a colour scheme took longer than writing the code for generating a public/private key pair.

Kelly warns visitors to the site not to treat this as a messaging platform: Brandis is primarily intended as a demonstration; it was put together in less than a day. For real-world usage, we recommend more established software such as GnuPG.

By the way, if you decide to try Brandis.io, note that its current message size limit is 190 characters. Kelly's investigating why that's so.

+Comment: Vulture South notes that kelly's efforts only addresses one part of the debate the Australian government ignited when its Attorney-General George Brandis fired the latest shot in what's being colloquially called CryptoWars 2. The other half is device security.

A common critique levelled at those who resist the idea of governments undermining encryption (the so-called war on mathematics, highlighted when Prime Minister Malcolm Turnbull unhelpfully quipped that Australia's laws will prevail over he laws of mathematics) is that they've got the wrong end of the stick, because messages could be recovered by means that don't attack encrypted messages in transit, but rather while they're at rest for example, by recovering messages as stored on devices like iPhones or Androids.

First, it's worth keeping in mind that the government itself drew attention towards strong encryption, with its complaint that singled out specific end-to-end encrypted applications, and its promise to get platform-makers to co-operate (as well as device vendors).

More importantly, however, the argument that an endpoint compromise is okay ignores history. Whether it's the sloppy IoT security let the Mirai botnet hose big servers or the leaked NSA tools that let loose ransomware rampages, or the DNS Changer malware attack that began in 2006, there's ample evidence of the danger posed by insecure endpoints.

You can't have security if you have insecure endpoints was first expressed to this writer in the 1990s, and it's still true. We can't redirect concerns about weak cryptography by saying you can still have strong crypto, if vendors will make weak devices.

Even the NSA couldn't keep device exploits secret, after all.

More here:
Dev to El Reg: Making web pages pretty is harder than building crypto - The Register

A brief history of GnuPG: vital to online security but free and … – Computerworld Australia

Posted on by

Most people have never heard of the software that makes up the machinery of the internet. Outside developer circles, its authors receive little reward for their efforts, in terms of either money or public recognition.

One example is the encryption software GNU Privacy Guard (also known as GnuPG and GPG), and its authors are regularly forced to fundraise to continue the project.

GnuPG is part of the GNU collection of free and open source software, but its story is an interesting one, and it begins with software engineer Phil Zimmermann.

We do not know exactly what Zimmermann felt on January 11, 1996, but relief is probably a good guess. The United States government had just ended its investigation into him and his encryption software, PGP or Pretty Good Privacy.

In the 1990s, the US restricted the export of strong cryptography, viewing it as sensitive technology that had once been the exclusive purview of the intelligence and military establishment. Zimmermann had been facing serious punishment for posting PGP on the internet in 1991, which could have been seen as a violation of the Arms Export Control Act.

To circumvent US export regulations and ship the software legally to other countries, hackers even printed the source code as a book, which would allow anyone to scan it at its destination and rebuild the software from scratch.

Zimmermann later worked with the PGP Corporation, which helped define PGP as an open internet standard, OpenPGP. A number of software packages implement this standard, of which GnuPG is perhaps the best-known.

PGP implements a form of cryptography that is known as asymmetric cryptography or public-key cryptography.

The story of its discovery is itself worth telling. It was invented in the 1970s by researchers at the British intelligence service GCHQ and then again by Stanford University academics in the US, although GCHQs results were only declassified in 1997.

Asymmetric cryptography gives users two keys. The so-called public key is meant to be distributed to everyone and is used to encrypt messages or verify a signature. The private or secret key must be known only to the user. It helps decrypt messages or sign them - the digital equivalent of a seal to prove origin and authenticity.

Zimmermann published PGP because he believed that everybody has a right to private communication. PGP was meant to be used for email, but could be used for any kind of electronic communication.

Despite Zimmermanns work, the dream of free encryption for everyone never quite came to full bloom.

Neither Zimmermanns original PGP nor the later GnuPG managed to become entirely user-friendly. Both use highly technical language, and the latter is still known for being accessible only by typing out commands - an anachronism even in the late 1990s, when most operating systems already used the mouse.

Many users did not understand why they should encrypt their email at all, and attempts to integrate the tools with email clients were not particularly intuitive.

Big corporations such as Microsoft, Google and Apple shunned it to this day, they do not ship PGP with their products, although some are now implementing forms of end-to-end encryption.

Finally, there was the issue of distributing public keys - they had to be made available to other people to be useful. Private initiatives never gathered much attention. In fact, a number of academic studies in the early and late 2000s showed that these attempts never managed to attract widespread public usage.

The release of the Edward Snowden documents in 2013 spurred renewed interest in PGP. Crypto parties became a global phenomenon when people met in person to exchange their public keys, but this was ultimately short-lived.

When I met Zimmermann in Silicon Valley in 2015, he admitted that he did not currently use PGP. In a more recent email, he said this is because it does not run on current versions of macOS or iOS. I may soon run GnuPG, he wrote.

By todays standards, GnuPG like all implementations of OpenPGP lacks additional security features that are provided by chat apps such as WhatsApp or Signal. Both are spiritual descendants of PGP and unthinkable without Zimmermanns invention, but they go beyond what OpenPGP can do by protecting messages even in the case of a private key being lost.

Whats more, email reveals the sender and receiver names anyway. In the age of data mining, this is often enough to infer the contents of encrypted communication.

Nevertheless, GnuPG (and hence OpenPGP) is alive and well. Relative to the increased computational power available today, their cryptography is as strong today as it was in 1991. GnuPG just found new use cases - very important ones.

Journalists use it to allow their sources to deposit confidential data and leaks. This is a vital and indispensable method of self-protection for the leaker and the journalist.

But even more importantly, digital signatures are where GnuPG excels today.

Linux is one of the worlds most common operating system (it even forms the basis of Android). On internet servers that run Linux, software is downloaded and updated from software repositories - and most of them sign their software with GnuPG to confirm its authenticity and origin.

GnuPG works its magic behind closed curtains, once again.

Ralph HolzisLecturer in Networks and Security at theUniversity of Sydney

This article was originally published on The Conversation. Read the original article.

Error: Please check your email address.

Tags securityencryptioncyber security

Read the original post:
A brief history of GnuPG: vital to online security but free and ... - Computerworld Australia

Twitter Still Refusing To Verify Accounts For Julian Assange And Other Gov’t Critics – Mintpress News (blog)

Posted on by

Verified Twitter accounts are impervious to impostors and others who would seek to discredit the accounts owners. But Julian Assange and other well-known government critics are still unverified, leading to speculation that Twitter is purposefully allowing their accounts to remain vulnerable.

In defiance of its own verification policy, Twitter still wont verify Julian Assanges account.

MINNEAPOLIS Despite claiming that it authenticates accounts that are determined to be an account of public interest, Twitter has continuously refused to authenticate the accounts of some well-known public figures, particularly those who push against mainstream and government narratives.

The most well-known victim of Twitters essential weaponization of its account verification policy is Julian Assange, founder of the publishing organization WikiLeaks. Assanges Twitter account, @JulianAssange, has been confirmed by WikiLeaks as his authentic personal account, a fact Twitter itself even acknowledged when it referenced the authentic Assange account in its own writings.

Assange has attempted to have his account verified since last October, but has repeatedly had his authentication request denied, despite Twitters unofficial admission that they know that @JulianAssange is the authentic account. Twitter has refused to issue a public statement as to why Assanges account remains unverified.

While the verified account situation may seem minuscule compared to other issues that Assange currently faces, it has still had negative consequences nonetheless. The lack of verification on Assanges account, in particular, has led to the proliferation of a slew of fake Assange accounts. As journalist Caitlin Johnstone notes, these fake accounts are commonly mistaken by casual social media users as being Assanges real account due to the lack of verification.

Not only that, but some of the fake accounts actively post on popular tweets, claiming to be the real Assange and causing further confusion while also discrediting Assange. Many of those accounts have been reported, but Twitter has not taken any action against them. Not only that, but the lack of verification makes it more difficult for Assange to get his opinions to a wider audience, as the lack of verification makes it difficult for him to amass followers.

While Assange is certainly the most prominent public figure to be repeatedly denied account verification, he is not alone. Former U.S. Congresswoman and 2008 Green Party presidential candidate Cynthia McKinney has also spoken out regarding Twitters refusal to verify her account. McKinney is a well-known critic of U.S. imperialism and war propaganda, as well as a prominent voice in the 9/11 Truth Movement. She has over 25,000 Twitter followers.

Twitter has turned its authentication of popular accounts into a weapon, allowing it limit the Twitter presence of those who do not toe the establishment line. Twitter does not treat pundits from MSNBC or Fox News the same way it treats Assange and McKinney, making it clear that this is a politically-biased stance on the part of the social network.

However, this is by no means the first time that Twitter has come under fire for discriminating against popular users over their political leanings. Twitters launch last year of the Twitter Trust and Safety Council came complete with a group known as the Dangerous Speech Project that shares ties with the liberal John D. and Catherine T. MacArthur Foundation, as well as George Soros Open Society Institute. Not a single conservative-leaning group is found on the council, which includes over 40 member groups.

More here:
Twitter Still Refusing To Verify Accounts For Julian Assange And Other Gov't Critics - Mintpress News (blog)

Cryptocurrency Hit Record Low Values Over the Weekend – Futurism

Posted on by

In BriefCryptocurrencies fell over the weekend, reaching record lowsand loosing billions in market cap. While they've since recoveredthe losses, it shows just how unpredictable the cryptocurrencymarket truly is. Cryptos Rise (& Fall)

Over the weekend, cryptocurrencies suffered one of the most severe decreases in value in history when their market cap fell from a record high of $116 billion in June to $60 billion on Sunday July 17. Early this week, themarket has started to rise again, but the plummet will not soon be forgotten:throughout the day on Sunday, Bitcoin dropped from over $2,000 to as low as $1,758.20, and Ether fell 20percent to $130.26.Click to View Full Infographic

As of Tuesday morning, it seems thedownward trend has ended, with all major cryptocurrencies reporting rising rates again: Bitcoin is back over $2,000 once more, with Coin Market Cap reporting the currency is now trading at $2,307 (9:00 EST), while Ether has risen from a low over the weekend to a current value of $196.58. The total market cap has regained losses of around $10 billion,according to Coindesk.

Despite the improvement, however, cryptocurrencies are a long way off the meteoric successes they enjoyed in June, where they saw a market cap as high as $116 billion. Since then, Bitcoin has lost around 30 percent of its value, with its highpoint being $3,000 in contrast to todays figure of roughly $2,000. Ethereum has suffered even more severely, dropping from $395 to $164. Despite these falls, 2017 remains a record breaking year for cryptocurrency overall.

There have been, according to Venture Beat, three main reasons for the 48 hour cryptocurrency flop.

First, the bitcoin civil war that seems imminent as of August 1st when the Bitcoin improvement proposal 148 is set to activate. For one, theproposal concerns the possibility of increasing the cryptocurrencysblock size, (a decision which has divided miners and investors).At any rate, and regardless of the eventual decision, the uncertainty right now has caused many investors to liquidate their virtual assets.

Second, a flurry of startups have chosen to get out of the game afterprofitable rounds of investment derived from initial coin offerings (ICOs). Two particularly striking examples are EOS: after raising $200 million worth of Ether earlier this month, they have been offloading it to Bitfinex and TenX, which raised 200,000 ETH ($67 million at the time) in its token sale 30 percent of which has already been sold. This contributes to uncertainty and danger in the marketplace, which can precipitatedecreasing value.

Third, the presence of amateur sellers that the bitcoin market attracts through its fundamental lack of regulation and policing can have a multiplier effect on every market movement, namely throughfrantic, if not occasionally panicked, buying and selling practices.

While the ultimate success of cryptocurrencies remains speculative, one thing we know for sure after observingtheir activity over the last few days is that financial currencies remain volatile and prone to unpredictability.

Disclosure: Several members of the Futurism team, including the editors of this piece, are personal investors in a number of cryptocurrency markets. Their personal investment perspectives have no impact on editorial content.

More:
Cryptocurrency Hit Record Low Values Over the Weekend - Futurism

Trading Cryptocurrency the eToro Way – newsBTC

Posted on by

Digital currencies are decentralized, peer to peer currencies that are not influenced by the actions of governments or central banks. They run on open source platforms, and can be traded against fiat currencies, or as funds, at leading trading platforms. Blockchain technology has revolutionized e-commerce and financial services, and more banks are adopting this dynamic technology to process financial transactions.

Digital currencies have come a long way since inception after the global financial crisis of 2008/2009. Bitcoin was created by Satoshi Nakamoto, an individual, or group of individuals, who have since disappeared from the scene. Their legacy remains however, with a myriad of digital currencies now available on the market. These include Bitcoin, Litecoin, Dogecoin, Ethereum and hundreds of others which are rapidly garnering the attention of e-commerce retailers, traders, banks, financial institutions, and even regulatory authorities around the world.

One of the worlds premier financial trading platforms, eToro has launched a CryptoFund. This fund tracks the activity of cryptocurrency such as Bitcoin and others. The precise asset allocation in the CryptoFund is as follows:

The bulk of the CryptoFund 84% is comprised of Bitcoin, Ripple and Ethereum. In June, the fund tracked negatively with losses of 4.65%, followed by month-to-date declines in July of 25.64%. The eToro CryptoFund is a trading option, meaning that registered clients can benefit from price movements in the fund regardless of direction. At eToro, there are currently over $300,000 worth of assets under management (daily reading) with the CryptoFund, with hundreds of traders.

Since this is a CopyFund, it is possible to follow successful traders, copy their trades and profit accordingly. The increasing popularity of cryptocurrencies is a result of several factors, notably their increasing adoption in e-commerce, their rarity, and the anonymity that is afforded to traders. Compared to fiat currency which is completely controlled by governments and central banks, cryptocurrency offers multiple trading opportunities. This fund has a market capitalization of at least $1 billion with monthly trading volumes in excess of $20 million.

eToro management carefully monitors the individual components of the fund and if any of them dips beneath $1 billion, or if trading volumes are less than $20 million, a currency could be dropped from the fund. The cryptocurrency with the highest market capitalization is Bitcoin at $40 billion, but others like Ethereum and Litecoin also have high market capitalizations. The precise weighting assigned to individual currencies in the fund is determined by the portfolio manager at eToro.

The Crypto Copyfund is traded as a CFD (contract for difference) which is a derivative trading instrument. eToro management protects traders with the limits imposed on the daily trading activity of the CryptoFund. If the limit is exceeded, the funds trading activity will be closed for the day. This is done to maintain stability in trading activity, much like the major indices on Wall Street.

eToro is a strictly regulated financial trading enterprise. Only traders from accepted jurisdictions can register, deposit, and trade cryptocurrency online. In the United Kingdom, eToro is registered by the Financial Conduct Authority (FCA) and operates under the name eToro UK. The minimum required deposit is $5,000, and clients are required to be UK residents.

See original here:
Trading Cryptocurrency the eToro Way - newsBTC

Steep decline in cryptocurrency market has miners dumping their … – PC Gamer

Posted on by

Ethereum, one of the most popular cryptocurrencies, is becoming more difficult to mine. At the same time, volatility is rearing its welcome head, and the value of Ethereum is now less than half of what it was around a month ago. As a result, profitability is way down, and some miners are putting their GPUs up for sale on second-hand sites such as Ebay, CoinDesk reports.

While it is difficult to predict anything when it comes to cryptocurrencies, we are cautiously optimistic that GPU pricing should start trending back to normal in the coming weeks. That could change at the drop of the hat, of course, but with the way things are now, miners are less motivated to stock up on GPUs and mine Ethereum.

That was not the case a month ago when Ethereum reached an all-time high of $300 before recording another high of more than $400 a short while later. More and more miners jumped on the crytpocurrency bandwagon in hopes of making some extra dough, and maybe even eventually striking it rich, as some early adopters of Bitcoin did. But since then, Ethereum has fallen in value, declining to a low of $133 over the weekend. It's currently trading at around $170-$180.

It has also become more difficult to mine over the past month. Have a look at the steep trend line from the beginning of June until now:

From our vantage point, the difficulty in mining has caused about a 10 percent drop in profitability, while the falling price has made Ethereum mining 50 percent (or more) less profitable. Power costs remain constant, so where an RX 580 might have grossed up to $5 per day next last month, it will now only gross around $1.70. That means instead of a net profit of $4, it's now down to a net gain only $1.25 (at a power cost of $0.10 per kWh). Generally speaking, it looks like a typical miner might have to wait six months or more to pay for a GPU hardware investment, compared to two or three months.

This is a good thing for gamers. While crytpocurrencies like Bitcoin (SHA256) are far more easily mined on ASIC hardware, othere's like Ethereum (Dagger-Hashimoto) and ZCash (Equihash) use algorithms that are resistant to ASIC hardware. Combined with Ethereum's spiking value, miners went running for the hills with as many GPUs as they could carry in what became a modern day gold rush.

This resulted in a shortage of many desirable graphics cards from both AMD and Nvidia. The best bang-for-buck options for gaming are also great options for mining, but there just aren't enough parts to meet the demand of both markets. Cards like the Radeon RX 570 have been out of stock or grossly overpriced by third-party vendors, such as this Gigabyte Aorus Radeon RX 570 going for $550. And that's not even the most expensive RX 570 SKU out there. PowerColor's Red Devil variant is listed on Newegg (through a third-party) for $639.

It's a crazy situation, but here's hoping that recent events restore some sanity to the graphics card market. There's an RX 580 8GB currently in stock at Newegg for 'only' $310, which is still way over MSRP, but the coming weeks should see inventories and prices start to return to normal. If you'd rather not wait for inventory levels to even out, you can also check second-hand sites for deals.

See the article here:
Steep decline in cryptocurrency market has miners dumping their ... - PC Gamer

Barclays Downgrades AMD on Cryptocurrency Sustainability Concerns – TheStreet.com

Posted on by

Barclays cut Advanced Micro Devices Inc. (AMD) to "sell" from "hold" on concerns that the strong market for the company's GPU cards, which are used to mine cryptocurrencies, is not sustainable.

AMD shares were down 4% to $13.26 in premarket trading Tuesday.

"Bottom line, we are not at all bullish on the sudden surge on demand for GPU cards from cryptocurrency mining. We see a fair bit of similarities to what happened in 2013/2014, which was a more than a one-quarter bust for AMD, after the boom in cryptocurrency mining," Tuesday's note said.

What's Hot On TheStreet

Netflix is so impressive: By trouncing quarterly subscriber estimates and issuing solid guidance, Netflix Inc. (NFLX) did much to put to rest fears that its stock had gotten ahead of itself following a 31% rise so far in 2017, TheStreet's Eric Jhonsa says. The streaming giant also showed that it has reached a point where its sheer scale provides a competitive edge that makes it hard for even deep-pocketed tech and media rivals to slow it down, Jhonsa adds.

Overall, Netflix is an unstoppable beast because millennials like watching movies on the couch.

Tesla is bizarre: Tesla Inc. (TSLA) is adding two new executives from major media corporations to its board of directors after investors urged the electric carmaker to add members without close ties to CEO Elon Musk, TheStreet reports.

James Rupert Murdoch, the CEO of Twenty-First Century Fox Inc. (FOXA) , and Linda Johnson Rice, the chairman of Johnson Publishing Co., will join Tesla's board, according to a company blog post.

View original post here:
Barclays Downgrades AMD on Cryptocurrency Sustainability Concerns - TheStreet.com

Four Spy Experts on Trump Blackmail, WikiLeaks, and Putin’s Long Game – Mother Jones

Posted on by

Explaining the troubling tactics of the Kremlinand the White House.

Hannah Levintova, Bryan Schatz and AJ VicensJuly/August 2017 Issue

Information warfare is at the heart of the scandal engulfing the Trump administration. We spoke with four experts to help explain it, from WikiLeaks role to Putins long gameand Trumps own use of disinformation. Heres what they had to say.

Help MoJo mount a truly independent investigation into Trumps ties to Russia. Make a tax-deductible monthly or one-time donation today.

Andrei Soldatov is a longtime Russian investigative reporter, the co-founder of Agenta.ru, a website focusing on the Russian secret services, and the co-author of two books on Russian intelligence activities.

Mother Jones: Do you think WikiLeaks is actively coordinating with Russian interests?

Andrei Soldatov: Yeah, after 2016 I think its pretty clear.

MJ: How does that relationship work?

AS: The entire history of the Russian hacking operations is mostly outsourced operations, so you can easily deny your responsibility. Its not so hierarchical and direct, like you have the government secret agency and you have WikiLeaks and you have one guy in between. It might be much more complicated.

MJ: Can you walk us through the ecosystem of how the Russian hacking operations work?

AS: You have three elements: You have the secret services, mostly the FSB. They have extremely good connections to criminal hackers and the IT industry because the FSB is also in charge of licensing all activities in cyber, like encryption. The military is a second actor, extremely active now, extremely adventurous. Then you have informal actors, people who have their own direct access to the Kremlin. Some of them might work for the security services, but a lot of these guys work directly for the administration of the president.

This tactic was developed in 1999, when the Chechens found a way to start all these websites about whats going on in Chechnya. That was a real threat. So the security agencies got some students to hack these websites. And immediately the Kremlin understood that if youve got students, not government actors, attacking your targets, it provides you deniable responsibility. And immediately they started encouraging these people to attack other sensitive targets. Some targets were based in Russia: independent media, political opposition. Some were based outside the country. But the Kremlin understood outsourcing is much more effective. They have been using this trick ever since.

MJ: The US intelligence community has concluded that the hacking operation was closely directed by Putin.

AS: Its entirely plausible to me. This election was really personal for Putin because he believed that Clinton is a personal enemy. He genuinely believed she was behind the Moscow protests in 2012, 2011. I do not think these groups would try to do something without his authorization or his knowledge. It would be really crazy.

MJ: How do everyday Russians view this whole episode?

AS: Its a strange combination of two thoughts. The first one is, Look how ridiculous are Americans. They blame us for everything. And the second thought is, Look how great we are. We are to blame for everything in the world, which means we are really, really important.

Steven Hall/CIA

Steven Hall, who retired in 2015 after a decorated career at the CIA, ran the agencys Russia operations.

Mother Jones: If you were involved in the Trump-Russia investigation, who or what would you hone in on?

Steven Hall: Mike Flynn, no doubt. Its fun to think about what I would do if I was a Russian intelligence officer in charge of running these various operations. Not just the influence operation, which its quite clear now was pretty successful in increasing the likelihood that Donald Trump would be elected. But if I was the SVR [Russian foreign intelligence] guy who was told, Okay, your job is to try to find whether there are members of the campaign who would be willing to play ball with us, No. 1 on my list would be Flynn. First of all, hes a former chief of the DIA [Defense Intelligence Agency]. Hes an intelligence officer, so he understands how discreet and clandestine you need to be if youre going to cooperate on that level. And then, theres the future: Hes probably going to land a pretty good job, assuming Trump wins. So its a win-win-win in terms of targeting Flynn. Furthermore, hes come to Moscow. Hes accepted money from Russian companies, and hes tried to conceal that. So on paper, hes a really good-looking candidate for a spy.

MJ: Is there any parallel to this moment that you saw in your 30-plus year career with the CIA?

SH: The short answer is no. There have certainly been big spy cases in the pastAldrich Ames, Robert Hanssen. But I cant think of one that would be as senior a guy as somebody like the national security adviser, or even more unprecedentedif it turns out that the Trump camp had the go-ahead from the big dog to talk to the Russians prior to the election.

MJ: How likely is it that the Kremlin has collected kompromat on Trump?

SH: I can absolutely tell you that the FSB [Russias Federal Security Service] are rigged up to collect as much compromising information against any target they consider to be valuable. So when Trump was there in Russia, would they have collected against him? I think the answer is yes. I think they would have seen Trump for what he was at the time, which to the Russian lens would have just been an American oligarcha rich guy with considerable power who you might need something on at some pointHes a good guy to have at your beck and call.

If there was compromising material that had a shot at actually making Trump behave the way the Russians wanted him to, I would imagine it would be something financialillegal, dirty dealings, or something with legal import.

MJ: Do you think Congress is able to investigate the Trump-Russia allegations effectively?

SH: I dont think so, given where Congress is right now in terms of partisanship. There might have been a time historically15, 20 years ago. Short of having an independent investigator or some other mechanism that can get rid of some of the partisanship, I just dont think its going to happen.

Jack Barsky

Jack Barsky is a former KGB officer who spent a decade spying in the United States before defecting in 1988. His 2017 memoir, Deep Undercover: My Secret Life and Tangled Allegiances as a KGB Spy in America, details his path from a Soviet intelligence operative to a proud US citizen.

Mother Jones: What type of intelligence interest would have been aroused by Donald Trumps 2013 trip to Moscow? Is it likely he was surveilled?

Jack Barsky: Absolutely. In todays Russiaif you go over there and talk business with senior businessmen, then youve had some contact with Russian intelligence without knowing it.

MJ: Why was Russia so brazen in interfering in the US election?

JB: It wasnt so much about getting Trump elected. It was about creating disorder, stirring up problems, destabilizing to the extent you can. Even prior to the internet, the KGB was famous for planting false news and somehow getting information circulated in the Western world that was entirely phony. They are taking advantage of the weaknesses of an open society. Its actually a strength. But from the point of view of a tightly controlled regime, our openness, the ability to plant all kinds of information with all kinds of people because we dont have a tightly, centrally controlled mediathat is a weakness. They absolutely succeeded to some degree. And we are helping with this success. Thats what bothers me. We took the bait, the media and the politicians. We are wallowing in this internal bickering. The longer this goes on, the more folks back in Moscow will rub their hands and say, Hey, this is going pretty well.

MJ: Whats Russias endgame?

JB: Reestablishing the Russian empire. It doesnt necessarily mean conquering Europe and being super aggressive like Hitler was, but establishing themselves again as a power to be reckoned with in the world. After the collapse of the Soviet Union, Russia lost significant influence and power. And Putin wants to restore this. Thats historically something thats part of the Russian national character. And obviously, any kind of intelligence efforts will try to support that end goal.

Help us dig deep on Trumps ties to Russia. Make a tax-deductible monthly or one-time donation to Mother Jones today.

There are four basic techniques of propagandathe 4Dsaccording to Ben Nimmo, an England-based analyst of Russian information warfare. Though hes mostly applied them to Putins disinformation operations, they also provide a helpful lens for understanding Donald Trumps mastery of spin.

1. Dismiss: Reject uncomfortable allegations or facts.

Example: One day before he fired FBI Director James Comey, Trump tweeted, The Russia-Trump collusion story is a total hoax.

2. Distract: Throw out diversionary stories or shiny counterclaims.

Example: As reports of his staffers Russian ties heated up in March, Trump tweeted that Obama had my wires tapped in Trump Tower just before the victory.

3. Distort: If you dont like the facts, invent your own.

Example: The NSA and FBI tell Congress that Russia did not influence electoral process, Trump tweeted in March, just after National Security Agency Director Mike Rogers and Comey testified that Russia had tried to do exactly that.

4. Dismay: And if all else fails, try to scare them into shutting up.

Example: During the election, Trump threatened to prosecute Hillary Clinton if he became president. Trump has also threatened to roll back First Amendment protections for journalists who report purposely negative and horrible and false articles about him: Were going to open up libel laws, folks, and were going to have people sue you like you never got sued before.

Hannah Levintova is a reporter in Mother Jones' DC bureau. You can email her at hlevintova[at]motherjones[dot]com. For more of her stories, click here.

Bryan Schatz is a reporter at Mother Jones. Reach him at bschatz@motherjones.com.

Mother Jones is a nonprofit, and stories like this are made possible by readers like you. Donate or subscribe to help fund independent journalism.

Continue reading here:
Four Spy Experts on Trump Blackmail, WikiLeaks, and Putin's Long Game - Mother Jones

WikiLeaks Exposes CIA’s HighRise SMS Spying Tool In Latest Vault 7 Dump – Hot Hardware

Posted on by

WikiLeaks has published another set of leaked documents from the United States Central Intelligence Agency (CIA). This latest leak is part of WikiLeaks' Vault 7 batch and details a malicious app for Android devices called HighRise. Also called TideCheck, this app allows a remote hacker to redirect or intercept SMS text messages that are sent to a target's cellular phone, and have those communications forwarded to a remote web server.

This appears to be an old tool that was used by the CIA, or at least the version described in the leaked documents is an older piece of malware. The accompanying manual is dated December 16, 2013, and describes a tool that was designed to work on mobile handsets running Android 4.0 (Ice Cream Sandwich) to 4.3 (Jelly Bean). There have been four other major Android releases since then, including KitKat, Lollipop, Marshmallow, Nougat. Google is also close to releasing yet another Android build, Android O.

One thing that is interesting about this particular malware is that it cannot be installed remotely, unlike some of the other tools the CIA is known to have used. HighRise must be installed physically and then manually run once before it will automatically run in the background or after a reboot. As a consequence of this, HighRise also shows up in the list of installed apps so it can be started by the HighRise operator, according to the user guide.

These features suggest that this particular version probably was not used for spying on a target, at least not directly, and instead was used as a secure line of communication with CIA agents in the field, perhaps as a backup. Previous versions of the app did not have these attributes.

It is not known if the CIA continues to use this tool, albeit and updated version that supports newer version of Android (and perhaps iOS as well).

Read the original:
WikiLeaks Exposes CIA's HighRise SMS Spying Tool In Latest Vault 7 Dump - Hot Hardware