In my last blog post about Zoom, I noted that the company says "that critics have misunderstood how they do encryption." New research from Citizen Lab show that not only were the critics correct, Zoom's design shows that they're completely ignorant about encryption. When companies roll their own crypto, I expect it to have flaws. I don't expect those flaws to be errors I'd find unacceptable in an introductory undergraduate class, but that's what happened here.

Let's start with the egregious flaw. In this particular context, it's probably not a real threat I doubt if anyone but a major SIGINT agency could exploit it but it's just one of these things that you should absolutely never do: use the Electronic Code Book (ECB) mode of encryption for messages. Here's what I've told my students about ECB:

Again, it would be hard to exploit here, but it suggests that the encryption code was written by someone who knew nothing whatsoever about the subject and lays open the suspicion that there are deeper, more subtle problems. I mean, subtle problems are hard to avoid in cryptography even when you know what you're doing.

The more important error isn't that egregious, but it does show a fundamental misunderstanding of what "end-to-end encryption" means. The definition from a recent Internet Society brief is a good one:

End-to-end (E2E) encryption is any form of encryption in which only the sender and intended recipient hold the keys to decrypt the message. The most important aspect of E2E encryption is that no third party, even the party providing the communication service, has knowledge of the encryption keys.

As shown by Citizen Lab, Zoom's code does not meet that definition:

By default, all participants' audio and video in a Zoom meeting appear to be encrypted and decrypted with a single AES-128 key shared amongst the participants. The AES key appears to be generated and distributed to the meeting's participants by Zoom servers.

Zoom has the key, and could, in principle, retain it and use it to decrypt conversations. They say they do not do so, which is good, but this clearly does not meet the definition [emphasis added]: no third party, even the party providing the communication service, has knowledge of the encryption keys."

Doing key management that is, ensuring that the proper parties and only the proper parties know the key is a hard problem, especially in a multiparty conversation. At a minimum, you need assurance that someone you're talking to is indeed the proper party, and not some interloper or eavesdropper. That, in turn, requires that anyone who is concerned about the security of the conversation has to have some reason to believe in the other parties' identities, whether via direct authentication or because some trusted party has vouched for them. On today's Internet, when consumers log on to a remote site, they typically supply a password or the like to authenticate themselves, but the site's own identity is established via a trusted third party known as a certificate authority.

Zoom can't quite do identification correctly. You can have a login with Zoom, and meeting hosts generally do, but often, participants do not. Again, this is less of an issue in an enterprise setting, where most users could be registered, but that won't always be true for, say, university or school classes. Without participant identification and authentication, it isn't possible for Zoom to set up a strongly protected session, no matter how good their cryptography; you could end up talking to Boris or Natasha when you really wanted to talk confidentially to moose or squirrel.

You can associate a password or PIN with a meeting invitation, but Zoom knows this value and uses it for access control, meaning that it's not a good enough secret to use to set up a secure, private conference.

Suppose, though, that all participants are strongly authenticated and have some cryptographic credentials they can use to authenticate themselves. Can Zoom software then set up true end-to-end encryption? Yes, it can, but it requires sophisticated cryptographic mechanisms. Zoom manifestly does not have the right expertise to set up something like that, or they wouldn't use ECB mode or misunderstand what end-to-end encryption really is.

Suppose that Zoom wants to do everything right. Could they retrofit true end-to-end encryption, done properly? The sticking point is likely to be authenticating users. Zoom likes to outsource authentication to its enterprise clients, which is great for their intended market but says nothing about the existence of cryptographic credentials.

All that said, it might be possible to use a so-called Password-authenticated key exchange (PAKE) protocol to let participants themselves agree on a secure, shared key. (Disclaimer: many years ago, a colleague and I co-invented EKE, the first such scheme.) But multiparty PAKEs are rather rare. I don't know if there are any that are secure enough and would scale to enough users.

So: Zoom is doing its cryptography very badly, and while some of the errors can be fixed pretty easily, others are difficult and will take time and expertise to solve.

Visit link:
Zoom Cryptography and Authentication Problems - CircleID

Introduction

In this episode of Infosecs Cyber Work podcast series, host Chris Sienko speaks with Ted Shorter. Ted is co-founder and CTO of Keyfactor, a computer security firm. He has worked in security for over 20 years, with a focus on cryptography, application security, authentication and authorization services, and software vulnerability analysis. His past experience includes a masters degree in computer science from Johns Hopkins University, active CISSP certification and 10 years at the National Security Agency (NSA).

As a computer scientist and team lead at NSA, Ted briefed high-level government officials, including presidential advisors and members of the Joint Chiefs of Staff. Ted also served as lead software developer on a contract with the Department of Defense to integrate biometric authentication with the DoD Common Access Card program. Ted lives in Akron, Ohio with his wife and two sons.

Ted and Chris talked about a recent Keyfactor report, the danger of so-called predictable randomness, the raw work of cryptography in keeping devices like these safe, the importance of building security into their devices during design and development and some career advice for those who might like a career in cryptography.

A big piece of Teds foundational experiences center around problem-solving, and it is one of those things you are sort of born with. In terms of his professional history, it really started to take off when he joined a consulting firm called Certified Security Solutions in 2003. It was a boutique consultancy that spent a lot of time talking to clients about security strategy.

During this time, Ted worked a lot with digital certificates and public infrastructure. Certified Security Solutions focused on identifying unmet needs of customers regarding products and implementation. To this end, they (Read more...)

Originally posted here:
Cyber Work podcast: Cryptography careers and IoT vulnerabilities with Ted Shorter - Security Boulevard

Identiq uses cryptographic algorithms and preserves customer privacy while enabling companies to to identify new customers through a network of trust.

An ID validation and fraud prevention startup has developed what it claims is the first and only truly anonymous peer-to-peer verification network that enables companies to work together to validate identities without sharing or exposing any personal customer data. Identiq uses cryptographic algorithms to anonymously compare new user data against identities already trusted by other network members while preserving customer privacy, the company said. It was named a Gartner "Cool Vendor" for privacy.

Neither blockchain or artificial intelligence are usedonly cryptography, said Uri Arad, co-founder and vice president of product. So far, he said, over 20 companies in retail, ridesharing, travel, gaming, and social networking have expressed interest in joining the network when it launches this quarter.

Member B2C companies "can validate their users by working together as a network to ask questions about people and data points they don't know'' and vouch for them as trustworthy users, explained Identiq Chief Marketing Officer Shmuli Goldberg.

He added that no data is ever shared among network members or with Identiq. "This is in direct contrast with how this industry has been running" for over 20 years, Goldberg said, noting that Equifax and other credit bureaus collect and allow a company to validate a consumer's data against what they have in their databases.

"We are posing the exact opposite [model] and we believe, and our tech has shown, we can create a better user experience trying to validate user identities without sharing any data whatsoever," he said.

SEE:Windows 10 security: A guide for business leaders(TechRepublic Premium)

The technology can sniff out fraudsters and verify identity without relying on the usual methods of checking against third-party data providers, Goldberg said. It does it without sharing or storing any information at all, thus eliminating ID theft and personal information sprawl, he said.

After spending several years at PayPal managing risk analysts and data scientists, Arad said, he came to the realization that even very large companies "struggle to manage risk when it comes to new customers or any information they have not seen before," and that "this is what fraudsters are taking advantage of.''

If new information is coming in when a person opens an account online, he said. "there's nothing for you to say this looks suspicious. The only way companies are able to make any progress in this area is by going to external data vendors and asking them what they think,'' he said.

The idea is to make it easy for companies to identify who their new customers are through a "network of trust," he said. They can do that without sharing the customer's personal information, he said.

"We looked into a branch of cryptography called multi-party computation, which is over 30 to 40 years old," Arad said. "This branch deals with the question of how multiple parties can calculate some function together without revealing their own individual inputs."

For example, if you were conducting an online auction, every participant can make a bid and multi-party computation can allow the participants to find out who the winner is without revealing individual bids, he said.

Another example would be in a ride sharing scenario--it's very important to validate the identity of both the driver and the riders for the safety of both, said Goldberg.

"Instead of building a large database to solve identity, we are the first company that says we don't want your datawe see no data, we buy/sell/share no data," he stressed. "That's the inverse of the model of the vast majority of solutions on the market today."

Multi-party computation allows parties to make sure they both have the same phone number or more sensitive information like credit card data "without me having to tell you what I have and vice versa,'' Goldberg said.

Since it is a provider-less technology company, Identiq's revenue model will be to take a small portion of what people pay to use the network, he said.

Strengthen your organization's IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices. Delivered Tuesdays and Thursdays

See the original post here:
Fraud prevention startup working on anonymous peer-to-peer verification network - TechRepublic

Even with all the looming uncertainty surrounding the global COVID-19 pandemic, system security needs to remain at the forefront of companies planning.

Businesses around the world are shutting down under local, state or national decrees as COVID-19 fears bring caution regarding public gatherings. Unsurprisingly, hackers have used the unprecedented opportunity of chaos and panic to probe weaknesses in information technology systems. One of those systems happened to be the United States Department of Health and Human Services, making the act even more egregious, considering the circumstances.

But the problem extends beyond hackers and threats to companies and individuals. During times of crisis, civil liberties also come under threat, and cryptography often provides a shield against unwarranted encroaches by the government.

So, whether youre a business worried about paying server and security costs during this economic turmoil or an individual protecting your digital assets, cryptography can serve you well.

Its an unfortunate byproduct of crises, but hackers can wield social, economic and financial chaos for their gain.

For example, hackers launched a distributed denial of service attack against the Department of Health and Human Services last month in a bid to slow down the COVID-19 response. The current narrative makes the hack seem distinctly malicious in its effort to make the pandemic response slower, but there is likely more to the story.

The surging number of cases and by extension the hoarding of medical data under a consolidated government system presents an opportunity for hackers to abscond with sensitive information. Moreover, when emergency responses elicit rapid reactions, much of the systems security may be a patchwork of protocols not backend tested thoroughly.

For example, cases being uploaded from the field such as hospitals, makeshift testing centers, etc. to government servers that aggregate and display current COVID-19 metrics may contain serious security flaws due to the rapidity of their development. Applications developed by small teams to assist doctors in times of crisis may also not follow security standards, specifically the Health Insurance Portability and Accountability Act commonly referred to as HIPAA compliance laws, which are esoteric and outside the scope of most technology-focused engineers.

Hackers, looking for medical data that can be sold at a high value on black markets, likely view this as a gold mine. The hacking incident against the Health Department is probably not the first, nor will it be the last, of ongoing attempts to infiltrate prominent security systems.

Cryptography provides a useful layer of defense against such intrusions. Masking medical data identifiers and other sensitive information is possible with a variety of cryptographic standards available today. Many projects in the crypto sector explicitly focus on financial applications, but the cryptographic modules for protecting and verifying sensitive data translate to other industries, such as healthcare, very well.

Thats not to say that cryptography is a panacea to the ongoing fallout of COVID-19. In some cases, governments are covertly using the dilemma as a method to subvert encryption entirely, such as is occurring in the U.S.

Hidden behind all of the headlines about the Federal Reserve interest rate, the S&P 500 tanking and COVID-19 cases was a proposed legislation effort that has profound consequences on the field of cryptography.

Known as the EARN IT bill, U.S. Congresspeople have proposed a bill that would effectively grant the U.S. government the ability to access any digital message. The bill would create a consortium of law enforcement agencies headed by the Justice Department that would institute a standard verification mechanism for any digital message. If the message does not use the standard verification of the governments technology to authenticate the message, then the sending/receiving parties can be sued into oblivion.

Concerning cryptography, this is a disastrous bill. The proposed document cleverly avoids the explicit use of the word encryption, but its language indicates that cryptography would become illegal, as all messages cannot be private between two counterparties. The government gets a backdoor.

Encryption would become illegal by default because it preserves privacy and authentication of a message between two parties, preventing the ability of a third party to snoop on the messages contents.

The bill is still in its early stages, but it shows, once again, that governments do not approve of widespread encryption use among the public. Whether it be the Clipper chip scandal of the 1990s or the subversive move by Congress that is masked by a national crisis, the governments efforts are persistent.

Fortunately, cryptography which is empirically just math does not adhere to the caprices of hackers, governments or opportunities to subvert its influence. The grassroots encryption movement started by cypherpunks and bolstered by the crypto community has spread the technology to an extent that is unlikely to fade away at fiat decree.

For businesses enduring the turbulent COVID-19 situation, dont forget to account for your security during these vulnerable times. As individuals, remember that cryptography is your friend in protecting your civil liberties during a public health crisis.

The views, thoughts and opinions expressed here are the authors alone and do not necessarily reflect or represent the views and opinions of Cointelegraph.

Dr. Huang Lin is the co-founder and CTO of Suterusu, a project developing trustless privacy technology. He holds Ph.D. degrees in applied cryptography and privacy-preserving distributed systems from Shanghai Jiao Tong University and the University of Florida. He has worked as a postdoctoral researcher at Ecole Polytechnique Federale de Lausanne on applied cryptography for genomic privacy and blockchain-based data monetization.

Read the original:
Coronavirus Pandemic Reminds Us That Security Is Important During the Zoom Boom - Cointelegraph

Back in 2018, OnePlus teamed up with UNIT9, Sleep Deprivation Lab, and Google to launch a mobile game called Crackables. The game had players racing to solve cryptography puzzles over multiple rounds, with the ultimate gaming setup waiting at the end for the grand prize winner. Crackables is making a comeback this year, with OnePlus announcing Crackables 2.0 today.

It sounds like Crackables 2.0 will follow the same kind of structure the original Crackables did in 2018. That means itll be another race to solve these crypto-puzzles and go toe-to-toe with other players for a grand prize. While the grand prize was a gaming setup last time around, this time the prize players will be competing for is straight up cash specifically, the grand prize winner will get $10,000 for themselves and an additional $10,000 to donate to a charity supporting those affected by COVID-19.

Crackables 2.0 is based on Google technology (with the big G helping conceptualize the game as well) and is primarily made by UNIT9 and Sleep Deprivation Lab. OnePlus promises that puzzle difficulty will start low and ramp up from there, so if youre not sure if crypto-puzzles are for you, youll be able to get your feet wet with some easy puzzles to start. In its announcement today, OnePlus said that players will need to travel through gates to move between levels, and that some of those gates will involve community-oriented challenges that will have you working together with others.

The game will open up to everyone on April 14th, and the first 10 players to solve the final puzzle will have the chance to square off in a grand finale tournament for that $10,000 prize. Regular gameplay wraps up on April 30th a little more than two weeks after the game begins and the tournament will be live-streamed for everyone to watch beginning on May 7th.

If Crackables 2.0 is something that you want to participate in, you can register for the game beginning today over on the OnePlus website. Registration will run until April 14th, when the game will kick off for everyone.

Originally posted here:
Google and OnePlus Crackables 2.0 could be the perfect pandemic distraction - SlashGear

Global Hardware Encryption Market: Snapshot

A variety of factors or specific business needs influences the choice of specific encryption solutions among various end-use industries. Hardware encryption is gaining popularity for protecting sensitive data on portable devices such as laptops and USB flash drives. Its ease of use, consistent performance, and robust protection against numerous common and less sophisticated attacks offsets its high cost compared to software-based encryption. For instance, any brute-force attacks by hackers to gain access to hardware encrypted chips can be easily thwarted with the help of this. The mechanism of hardware encryption works on the devices on-board security, which performs the needed encryption and decryption. Unlike software-based encryption, it doesnt require drivers and has minimal configuration requirements.

Download Brochure of This Market Report at https://www.tmrresearch.com/sample/sample?flag=B&rep_id=647

However, since it is tied to a particular device, hardware encryption methods may not prove so helpful. Nevertheless, the soaring use of mobile devices by several governmental agencies and the storage of confidential financial and healthcare data in mobile devices have propelled the demand for hardware encryption methods. In case the devices are stolen, the data cannot be compromised.

In recent years, Advanced Encryption Standard (AES), a specification standard by the National Institute of Standards and Technology (NIST) has been gaining prominence for data security for hardware as well as software encryption method. The cryptographic module is fast gaining adoption among several military, government, healthcare institutions, and financial organizations world over, especially in developing and developed nations. AES has become one of the most popular algorithms adopted in symmetric key cryptography by various governmental agencies in the U.S. Boasting of marked improvements over its predecessors, AES employs longer cryptographic keys, offers easy implementation, and can be used in restricted environments such as in smart cards.

Global Hardware Encryption Market: Overview

The global market for hardware encryption is projected to witness healthy growth throughout the forecast period, thanks to the advent of portable storage devices in order to transfer files and information between computers. In addition, these devices help in improving the security concerns and confidentiality of data. These devices cannot be altered or removed by any malware or virus or be uninstalled by the user, owing to which the market is likely to witness high growth over the coming few years.

The research report on the global hardware encryption market offers a thorough overview, focusing on the key growth drivers and currents trends in the market. The research study throws light on the product segmentation, applications, technological advancements, and the regional segments of the global hardware encryption market. In addition, the limitations and challenges that are being faced by the prominent players in the overall market have been discussed in the research study.

Global Hardware Encryption Market: Drivers and Restraints

The rising concerns related to the privacy of data and data security and tremendous expansion of the digital content are anticipated to encourage the growth of the global hardware encryption market throughout the forecast period. In addition, several advantages offered by hardware encryption in comparison with software encryption technology and the rising need of regulatory framework are some of the other factors estimated to accelerate the growth of the overall market in the near future.

On the contrary, the need for high capital investment and the lack of awareness among consumers reading the benefits of hardware encryption technology are projected to restrict the growth of the global hardware encryption market in the next few years. Nevertheless, the emergence of economical and compact hardware encryption technique and the rising adoption of cloud computing are expected to offer promising opportunities for market players in the coming years.

Global Hardware Encryption Market: Region-wise Outlook

The global market for hardware encryption has been divided on the basis of geography into Europe, the Middle East and Africa, North America, Latin America, and Asia Pacific. The research study has provided a detailed analysis of the leading regional segment, highlighting the market share and anticipated growth rate. In addition, the key factors that are encouraging the growth of these segments have been discussed in the scope of the research study.

According to the research study, Asia Pacific is anticipated to witness strong growth throughout the forecast period, owing to the robust development of the IT industry. In addition, a substantial contribution from China, India, Malaysia, and South Korea is expected to accelerate the growth of the hardware encryption market in Asia Pacific throughout the forecast period. Furthermore, with the presence of a large number of established hardware encryption manufacturing companies, North America is anticipated to witness healthy growth in the next few years.

Key Players Mentioned in the Research Report are:

The global hardware encryption market is projected to witness a high level of competition in the coming few years. The leading players in the market are focusing on offering new products to consumers in order to enhance their market penetration and maintain their dominant position throughout the forecast period. Some of the prominent players operating in the hardware encryption market across the market are Netapp, Maxim Integrated Products, Inc., Toshiba Corp., Gemalto NV., Micron Technology, Inc., Samsung Electronics Co. Ltd., Kanguru Solutions, Thales (E-Security), Winmagic Inc., Kingston Technology Corp., Western Digital Corp., and Seagate Technology PLC.

Furthermore, the research study has provided a detailed analysis of the competitive landscape of the global hardware encryption market. An in-depth overview of company profiles and their financial overview have been discussed at length in the scope of the research study. Additionally, the business strategies, SWOT analysis, and the recent developments have been included to offer a clear understanding of the overall market.

Request For TOC On this Market Report at https://www.tmrresearch.com/sample/sample?flag=T&rep_id=647

About TMR Research:

TMR Research is a premier provider of customized market research and consulting services to business entities keen on succeeding in todays supercharged economic climate. Armed with an experienced, dedicated, and dynamic team of analysts, we are redefining the way our clients conduct business by providing them with authoritative and trusted research studies in tune with the latest methodologies and market trends.

Link:
Hardware Encryption Market Analysis On Trends and Need 2025 - Science In Me

More Effective Cybersecurity: The Practical Application of The MITRE ATT&CK Framework

Date: Wednesday, April 29th at 11:00am PT / 2:00pm ET

In March, Chris White, CSO and Co-Head of MSS at BlueVoyant presented the MITRE ATT&CK framework and discussed its implications for Security TeamsConsisting of 11 tactics and 291 techniques, MITRE ATT&CK can easily overwhelm security teams. The most common question is almost always How and where do I start?

In this webinar, Chris will summarize and expand on the discussion from his previous discussion. This webcast will focus on:

Register now!

About the presenter:

Chris is BlueVoyant's Co-Head of Managed Security Services. He has a decade of experience consulting to Fortune 500 and US Intelligence Community organizations and was previously Booz Allen's Chief Engineer for Commercial Cyber Engineering Services and Data Protection Solutions. He is an experienced advisor in the realm of cryptography, data discovery, metadata analysis, risk metrics/analytics, data visualization, and reporting. Throughout his career, he has assessed, designed and built information security programs for a wide variety of large financial, pharmaceutical and technology organizations.

Date: 04/29/2020

Time: 11:00amPT

Sponsored By

Read the original:
More Effective Cybersecurity: The Practical Application of The MITRE ATT&CK Framework - Redmondmag.com