Apple had intended to make end-to-end encryption of an entire device's data, which would then be uploaded to iCloud, available to customers. But then the FBI stepped in and put the kibosh on those plans.

The problem, according to law enforcement: Fully locked-down iPhones could be a roadblock to investigations, like the probe into a Saudi Air Force officer who shot three people dead at a Pensacola, Florida naval base last month.

U.S. Attorney General William Barr publicly asked Apple to unlock the two iPhones the shooter had in his possession. The company eventually did hand over backups from his iCloud account, but the whole ordeal shone a light on the back-and-forth dialogue going on between the U.S. government and tech companies that disagree about whether or not end-to-end encryption should be allowed. Just last month, both Democratic and Republican senators considered legislation to ban end-to-end encryption, using unrecoverable evidence in crimes against children as an example.

Apple had been planning to introduce end-to-end encryption for over two years and even told the FBI, according to a Reuters report that cited one current and three former Bureau officials, as well as one current and one former Apple employee. Shortly thereafter, the FBIs cybercrime agents and its operational technology division came out as staunchly opposed to those plans because it would make it impossible for Apple to recover people's messages for use in investigations.

"Legal killed it, for reasons you can imagine," another former Apple employee told Reuters. "They decided they werent going to poke the bear anymore."

In this case, the bear is the government. In 2016, a nearly identical showdown between the FBI and Apple took place after the two parties got into a legal battle over access to an iPhone owned by a suspect in the San Bernardino, California mass shooting.

The nixed encryption plans are a loss for iPhone users because end-to-end encryption is more advanced than today's industry standard for security: basic encryption. Loads of companies use encryption, which basically scrambles the contents of a message or some other snippet of data, rendering it completely useless without the decryption key, which can unshuffle the jargon and restore the original.

Under this framework, a company usually has the cryptographic encryption key, which means the data isn't truly safe if a government or hacker gets their hands on the key. End-to-end encryption, though, means only the, well, end computerthe one receiving the datahas the encryption key stored. In theory, that person's computer could still be hacked and the encryption key could be forfeited, but it really reduces those odds.

But that limitation on who has access to the encryption key is the very crux of law enforcement's issue with end-to-end encryption: If Apple doesn't have the encryption key to access backups of a person's iPhone on the cloud, then the government can't access that data either.

Still, it's not entirely clear that the government is to blame for this project being killed. It's entirely possible Apple didn't want to have to deal with the headache of its customers accidentally locking themselves out of their own data.

For the rest of the world's smartphone users who rely on the Android operating system, end-to-end encryption is an option. Back in October 2018, Google announced that customers could use a new capability that would keep backed-up data from their phones completely locked down by using a decryption key that's randomly generated on that user's phone, using their lock screen pin, pattern, or passcode.

"By design, this means that no one (including Google) can access a user's backed-up application data without specifically knowing their passcode," the company wrote in a blog post. This end-to-end encryption offering is still available.

See the original post here:
Apple Wanted the iPhone to Have End-to-End Encryption. Then the FBI Stepped In - Popular Mechanics

An Amazon Web Services (AWS) engineer last week inadvertently made public almost a gigabytes worth of sensitive data, including their own personal documents as well as passwords and cryptographic keys to various AWS environments.

While these kinds of leaks are not unusual or special, what is noteworthy here is how quickly the employees credentials were recovered by a third party, whoto the employees good fortune, perhapsimmediately warned the company.

On the morning of January 13, an AWS employee, identified as a DevOps Cloud Engineer on LinkedIn, committed nearly a gigabytes worth of data to a personal GitHub repository bearing their own name. Roughly 30 minutes later, Greg Pollock, vice president of product at UpGuard, a California-based security firm, received a notification about a potential leak from a detection engine pointing to the repo.

Despite the privacy concerns, labor strikes, and reports that Amazon is selling literal trash on

An analyst began working to verify what specifically had triggered the alert. Around two hours later, Pollock was convinced the data had been committed to the repo inadvertently and might pose a threat to the employee, if not AWS itself. In reviewing this publicly accessible data, I have come to the conclusion that data stemming from your company, of some level of sensitivity, is present and exposed to the public internet, he told AWS by email.

AWS responded gratefully about four hours later and the repo was suddenly offline.

Since UpGuards analysts didnt test the credentials themselveswhich would have been illegalits unclear what precisely they grant access to. An AWS spokesperson told Gizmodo on Wednesday that all of the files were personal in nature and unrelated to the employees work. No customer data or company systems were exposed, they said.

At least some of the documents in the cache, however, are labeled Amazon Confidential.

Alongside those documents are AWS and RSA key pairs, some of which are marked mock or test. Others, however, are marked admin and cloud. Another is labeled rootkey, suggesting it provides privileged control of a system. Other passwords are connected to mail services. And there are numerous of auth tokens and API keys for a variety of third-party products.

AWS did not provide Gizmodo with an on-the-record statement.

It is possible that GitHub would have eventually alerted AWS that this data was public. The site itself automatically scans public repositories for credentials issued by a specific list of companies, just as UpGuard was doing. Had GitHub been the one to detect the AWS credentials, it would have, hypothetically, alerted AWS. AWS would have then taken appropriate action, possibly by revoking the keys.

But not all of the credentials leaked by the AWS employee are detected by GitHub, which only looks for specific types of tokens issued by certain companies. The speed with which UpGuards automated software was able to locate the keys also raises concerns about what other organizations have this capability; surely many of the worlds intelligence agencies are among them.

GitHubs efforts to identify the leaked credentials its users uploadwhich began in earnest around five years agoreceived scrutiny last year after a study at North Carolina State University (NCSU) unearthed over 100,000 repositories hosting API tokens and keys. (Notably, the researchers only examined 13 percent of all public repositories, which alone included billions of files.)

While Amazon access key IDs and auth tokens were among the data examined by the NCSU researchers, a majority of the leaked credentials were linked to Google services.

GitHub did not respond to a request for comment.

UpGuard says it chose to make the incident known to demonstrate the importance of early detection and underscore that cloud security is not invulnerable to human error.

Amazon Web Services is the largest provider of public cloud services, claiming about half of the market share, Pollock said. In 2019, a former Amazon employee allegedly stole over a hundred million credit applications from Capital One, illustrating the scale of potential data loss associated with insider threats at such large and central data processors.

In this case, Pollock added, theres no evidence that the engineer acted maliciously or that any customer data was affected. Rather, this case illustrates the value of rapid data leaks detection to prevent small accidents from becoming larger incidents.

The rest is here:
Amazon Engineer Leaked Private Encryption Keys. Outside Analysts Discovered Them in Minutes - Gizmodo

In the wake of last months shooting at a Pensacola, Florida, naval base, Attorney General William Barr isputting pressureon Apple to help FBI investigators unlock two of the shooters iPhones. Followers of these issues will recall a similarpressure campaignin 2016 to force Apple to decrypt the San Bernardino, California, shooters iPhone. In that case, the FBI ultimatelyhiredan external company to break the encryption, at a cost of over $1 million.

One might think that the FBIs current efforts mean that iPhone encryption has advanced such that only Apple has the capability to unlock the shooters iPhones, but depending on the exact model of the Pensacola shooters phone, the FBI could payas little as$15,000 to reach the data locked inside. However, if commercially available solutions dont work, its likely there isno way for Appleto unlock the phone without its passcode.

Read the original article.

Read the original:
iPhone War: The Justice Department Is Taking On Apple Over Encryption (Again) - Yahoo News

A brigade of paratroopers deployed in early January to the Middle East in the wake of mounting tensions with Iran has been asked by its leadership to use two encrypted messaging applications on government cell phones.

The use of the encrypted messaging applications Signal and Wickr by the 82nd Airbornes Task Force Devil underscores the complexity of security and operations for U.S. forces deployed to war zones where adversaries can exploit American communications systems, cell phones and the electromagnetic spectrum.

But it also raises questions as to whether the Department of Defense is scrambling to fill gaps in potential security vulnerabilities for American forces operating overseas by relying on encrypted messaging apps available for anyone to download in the civilian marketplace.

All official communication on government cell phones within TF Devil has been recommended to use Signal or Wickr encrypted messaging apps, Maj. Richard Foote, a spokesman for the 1st Brigade Combat Team, told Military Times.

These are the two apps recommended by our leadership, as they are encrypted and free for download and use, Foote said.

Foote added that there is no operational discussions via the apps and an extra layer of security is provided because users must go through virtual private networks.

However, there are government transparency concerns with the use of encrypted messaging apps like Signal and Wickr, which feature auto-delete functions where messages are erased after a set period of time. Electronic communications and text messages sent as part of official government business are part of the public record, and should be accessible via a Freedom of Information Act request.

The Department of Defense did not respond to queries from Military Times regarding government records keeping policies and whether Signal and Wickr have been audited for security flaws by the DoD. Military Times has reached out to the National Security Agency, and has yet to receive a response.

Get the military's most comprehensive news and information every morning.

(please select a country) United States United Kingdom Afghanistan Albania Algeria American Samoa Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos (Keeling) Islands Colombia Comoros Congo Congo, The Democratic Republic of The Cook Islands Costa Rica Cote D'ivoire Croatia Cuba Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Falkland Islands (Malvinas) Faroe Islands Fiji Finland France French Guiana French Polynesia French Southern Territories Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guinea Guinea-bissau Guyana Haiti Heard Island and Mcdonald Islands Holy See (Vatican City State) Honduras Hong Kong Hungary Iceland India Indonesia Iran, Islamic Republic of Iraq Ireland Israel Italy Jamaica Japan Jordan Kazakhstan Kenya Kiribati Korea, Democratic People's Republic of Korea, Republic of Kuwait Kyrgyzstan Lao People's Democratic Republic Latvia Lebanon Lesotho Liberia Libyan Arab Jamahiriya Liechtenstein Lithuania Luxembourg Macao Macedonia, The Former Yugoslav Republic of Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Martinique Mauritania Mauritius Mayotte Mexico Micronesia, Federated States of Moldova, Republic of Monaco Mongolia Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands Netherlands Antilles New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Northern Mariana Islands Norway Oman Pakistan Palau Palestinian Territory, Occupied Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Poland Portugal Puerto Rico Qatar Reunion Romania Russian Federation Rwanda Saint Helena Saint Kitts and Nevis Saint Lucia Saint Pierre and Miquelon Saint Vincent and The Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia and Montenegro Seychelles Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Africa South Georgia and The South Sandwich Islands Spain Sri Lanka Sudan Suriname Svalbard and Jan Mayen Swaziland Sweden Switzerland Syrian Arab Republic Taiwan, Province of China Tajikistan Tanzania, United Republic of Thailand Timor-leste Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates United Kingdom United States United States Minor Outlying Islands Uruguay Uzbekistan Vanuatu Venezuela Viet Nam Virgin Islands, British Virgin Islands, U.S. Wallis and Futuna Western Sahara Yemen Zambia Zimbabwe

Subscribe

By giving us your email, you are opting in to the Early Bird Brief.

Operational planners and military commanders rely on government cell phones for basic menial tasks from scheduling and daily muster even when deployed overseas.

Foote told Military Times that there is no requirement for extensive use of cell phones for work communication for the deployed 82nd paratroopers.

If cell phones are used, we have taken the best steps, readily available, to ensure the best security of our transmissions, Foote explained

To be clear, the term official communication in this setting refers to coordination of assets, sharing of meeting time changes, etc. There is no operational discussion on these platforms, Foote said.

Adversaries like Iran, which boast robust cyber and electronic warfare capabilities can glean much information from phone collections and basic text messages that could highlight daily patterns on an installation or sudden shifts and changes in schedules potential indications of pending operations.

But Foote explained to Military Times that the 82nds government cell communications include an extra layer of security.

When official business is being conducted via cell, it is done on the apps over VPN-protected [virtual private network] connectionssystems reviewed and recommended by our Communications and Cyber sections, Foote said.

In 2016, Signal received a positive security review when it was audited by the International Association for Cryptologic Research.

We have found no major flaws in the design, IACR said in its 2016 security audit of Signal.

A former military intelligence operator who has extensive experience working with the special operations community told Military Times that the Signal app was very secure with no known bugs.

He explained that the 82nd Airbornes reliance on the app for government cell communications wasnt necessarily an indication that the DoD was behind the curve on protecting cellphone security for deployed troops. The former intelligence operator said he believed the DoD was just being lazy.

Unfortunately, those apps are more secure than texting in the clear, which is more or less the alternative. Granted, if a hostile party has access to the handset, that encryption isnt particularly helpful, a former U.S. defense official told Military Times.

The former U.S. defense official, who spoke to Military Times on condition of anonymity because he was not authorized to speak on the record, said the DoD should use commercial applications as long as they are tested and meet security requirements.

I dont have confidence that DoD could build a unique texting system with proper security protocols that would beat any commercial, off the shelf, version, the former official said.

With regards to transparency and records keeping requirements, Foote said he cannot confirm if any personnel have Signal or Wickr settings which allow auto-delete of messages at this time.

Military Times has not been able to confirm if Signal and Wickr have been audited for security flaws and vulnerabilities by the DoD.

Officials from Signal and Wickr did not immediately respond to requests for comment.

Continue reading here:
Deployed 82nd Airborne unit told to use these encrypted messaging apps on government cell phones - Military Times

By: Express News Service | New Delhi | Updated: January 25, 2020 7:24:53 am Suggested changes currently need production of a court order before a messaging intermediary is required to break encryption.

The Information Technology Intermediaries Guidelines (Amendment) Rules, 2018, the new set of rules on regulation of social media which the government is to submit to the Supreme Court later this month, will push for traceability of content which in effect means breaking end-to-end encryption, even of messaging intermediaries.

This will make it difficult for large social media intermediaries, mostly international business conglomerates, to give in without a battle.

The guidelines, which are not being discussed or debated publicly with only a few in the government privy to the details, are meant to control online content deemed unlawful. But these will raise fundamental questions on both freedom of speech and privacy of ordinary users.

Suggested changes currently need production of a court order before a messaging intermediary is required to break encryption.

The Indian Express has been told that there could be two levels of online intermediaries defined in the new set of rules, each with different regulations, for social and non-social media.

Non-social media may have relatively lighter regulations given that there could be mandatory local legal incorporation for large social media intermediaries. Non-social media intermediaries will still have to appoint a local office for grievance redressal.

On November 21 last year, Sanjay Dhotre, Minister of State for Electronics and Information Technology, in a written reply to a question in Rajya Sabha, confirmed that the Centre was going ahead with new amended rules for social media. He said social media companies have to follow certain due diligence as laid out in the Information Technology (Intermediary Guidelines) Rules, 2011 under Section 79 of the Information Technology Act.

The issue of messaging apps being required to break end-to-end encryption has been a sticky point between governments and messaging apps like Facebook-owned WhatsApp, especially after revelations last year on the use of spy software being used by governments to break into phones and conduct surveillance into private conversations of activists, journalists and lawyers, including in India.

The need to conduct surveillance for reasons of security versus the right to privacy of citizens and users has been a heated debate, and remains unresolved the government appears to be pushing for more and intermediaries are insisting on greater transparency in the rules-framing process.

On December 24, 2018, The Indian Express reported that in the draft of The Information Technology Intermediaries Guidelines (Amendment) Rules, 2018, Rule 3 (9) required intermediaries, or online platforms, to deploy technology-based automated tools or appropriate mechanisms, with appropriate controls, for proactively identifying or removing or disabling access to unlawful information or content.

It is now learnt that automatic proactive filtering for all unlawful content could be replaced by a re-upload prevention provision it will prevent re-uploading of certain specific categories of content deemed illegal and taken down by platforms.

Social media intermediaries will still be required to provide user data within 72 hours in response to a government surveillance request, and have content-takedown timelines of 24 hours for content declared unlawful.

For all the latest India News, download Indian Express App

See the original post:
Govt looks to break into encrypted messages - The Indian Express

Apple has come a long way building a reputation of having what is arguably the most secure mobile operating system iOS. Whether this is true or not, we can all agree that its very difficult to hack into an iPhone or infect it with malware. When it comes to security, Apple makes no compromises. This is very reassuring, unless of course, you work for the FBI.

In a recently released report from Reuters, Apple had planned on offering end-to-end encryption for iCloud backups two years ago. However, it scrapped those plans after heavy protests from the FBI. According to them, such a feature would hamper FBI investigations in cases where iCloud data could be used as evidence during criminal prosecutions.

Join our writing teamand develop your writing skills, as you see your articles featured onApple News,Google News, and allaround the world.

Basically, end-to-end encryption is a communication system that allows only the sender and receiver to read messages. Essentially, this cuts out third parties and eavesdroppers from the communication cycle, even Apple itself. Messages sent using end-to-end encryption cannot even be deciphered by the server facilitating the communication as only the devices carrying out the communication hold the decryption keys.

- Advertisement -

The FBI has a history of twisting Apples arm into handing over private iCloud information. With a court order, the FBI can request to access any users iCloud data from Apple, even without the users knowledge. They can also get assistance from Apple to retrieve iCloud data from an iPhone during an investigation, as seen in 2019 when Apple was forced to provide iCloud data of two of Mohammed Saeed Alshamranis iPhones, after he was implicated of perpetrating the attack on Naval Air Station in Pensacola, Florida. Had Apple already implemented end-to-end encryption at the time, not even they would have been able to access Alshamranis iCloud information.

It is yet to be determined if Apple wishes to implement end-to-end encryption in the future, or whether it will bow to the FBIs requests for a backdoor.

Join our writing teamand develop your writing skills, as you see your articles featured onApple News,Google News, and allaround the world. Subscribe to our newsletter,What Just Happened, where we dive deep into the hottest topics from the week!

+ United Nations to investigate reports on Saudi Crown Prince behind the hack of Jeff Bezos phone

- Advertisement -

+ Qualcomm is still focusing on 4G amid the 5G craze

+ More cities restrict travel as death toll rises from Chinese coronavirus

+ Robotic hearts may end the need for a heart transplant in 10 years

Read more from the original source:
FBI bullied Apple into dropping plans for end-to-end encryption on iCloud backups - News Landed