AES-256 encryption keys cracked by hands-off hack – The INQUIRER

SOME DUTCH RESEARCHERS have discovered a way of cracking AES-256 encryption using reasonably cheap gear and wireless tech.

Fox-IT, which is the Dutch company, calls the attack 'Tempest' and explains that it is enabled through proximity and relies on the monitoring of electromagnetic signals in what is known as a side channel attack.

Researchers put together a piece of kit worth less than $200 and were able to wirelessly extract secret AES-256 encryption keys from a distance of one metre. They said that the attack can be carried out by people on all budgets and with all kinds of means.

"The recording hardware can range from extremely high-end radio equipment, down to 20 USB SDRs. We have found that even the cheap USB dongles can be used to attack software implementations!" they said. "This is not a game exclusively for nation states, but also anyone with pocket money and some free time (PDF)."

Usually, such an attack would require direct access and manipulation, but Fox-IT found that it was possible just to swan past the target with a bag of wires and small screws and catch a winner in record time.

"Using this approach only requires us to spend a few seconds guessing the correct value for each byte in turn (256 options per byte, for 32 bytes so a total of 8192 guesses)," boasts the firm.

"In contrast, a direct brute-force attack on AES-256 would require 2256 guesses and would not complete before the end of the universe"

The next challenge is distance. Currently, Fox-IT has met reached a goal of 30cm but says that afull meter is a possibility given the right circumstances.

"Our work here has shown a proof of concept for TEMPEST attacks against symmetric crypto such as AES-256. To the best of our knowledge, this is the first public demonstration of such attacks. The low bandwidth requirements have allowed us to perform the attack with surprisingly cheap equipment (20 radio, modest amplifiers and filters) at significant distances," it added.

"In practice this setup is well suited to attacking network encryption appliances. Many of these targets perform bulk encryption (possibly with attacker controlled data) and the ciphertext is often easily captured from elsewhere in the network."

See more here:
AES-256 encryption keys cracked by hands-off hack - The INQUIRER

Encryption-dodging hacking powers expanded for German law enforcement – SC Magazine UK

The Bundestag (pictured) voted to grant the police the powers last Thursday

German law enforcement has been be granted vast new hacking powers. The Bundestag - the German legislature - voted on June 22 to grant law enforcement the powers it needs to hack into, and spy on, smartphones and computers.

The ruling coalition government, made up of the conservative Christian Democrats and the centre-left Social Democrats, pushed hard for the law, arguing that the police will need to get around encryption if they are to do their job.

Existing law allows law enforcement to tap a phone, but not actually hack an electronic device in any other case than one where lives are directly threatened. With the expansion of of their powers, law officers will now be able use malware - state trojans', or Bundestrojaner - to watch the real time communications of suspects and view a device's saved files and data. The new law expands the cases in which such measures can be used to include nearly 40 offences, such as murder, drug trafficking, money-laundering and illegal pornography.

With the passage of the law, Germany enters further into the group of western states who use hacking technology in police work. While this is not an attempt to break encryption' as per the desire of so many states, it does allow law enforcement to circumvent it and read the encrypted communications of those it chooses to surveil.

Germany has traditionally held a liberal stance on policing powers, mindful of a return to the authoritarian governments that ruled the country for much of the twentieth century.

When the state trojan', R2D2, was first discovered by the Berlin-based Chaos Computer Club (CCC), it prompted a public outcry. At the time the CCC offered an analysis which may be considered prescient: "this refutes the claim that an effective separation of just wiretapping internet telephony and a full-blown trojan is possible in practice - or even desired. Our analysis revealed once again that law enforcement agencies will overstep their authority if not watched carefully.

Germany has some of the strongest data protection laws in the world and has often eschewed the kinds of mass surveillance regimes that have emerged in the UK and the US, going so far as to publicly condemn them.

When it was discovered that German Chancellor Angela Merkel's phone was being monitored by the US National Security Agency, Germany vowed to ban tech companies that worked with the NSA from being granted Federal contracts. In 2016, German courts ruled heavily against mass surveillance programmes, declaring many of its allies' projects as well its own, unlawful.

That legacy of liberalism now clashes with resurgent terrorist campaigns across Europe and the transformation of crime in cyber-space. In 2016 alone, the German public were subject to three separate terrorist attacks culminating in a truck attack on a Christmas market in December, which left 12 dead. In direct response to the atrocity, the German government proposed the expansion of CCTV monitoring to a variety of new public spaces.

Go here to read the rest:
Encryption-dodging hacking powers expanded for German law enforcement - SC Magazine UK

Encryption: Turnbull tilts at windmills again – iTWire

In a statement that brings to mind the valour of Don Quixote, Australian Prime Minister Malcolm Turnbull has flagged "a crackdown on ungoverned spaces online".

According to another report from The Age similar to some of the others that one has quoted in the past Australia plans to pressure "social media companies pressure social media companies to do more to co-operate with governments to combat would-be terrorists who are organising online".

If this were not fanciful enough, Turnbull wants the rule of law to apply online as it does in what The Age calls the "analogue, offline world".

Remember, this comes from a man who claims to be digitally aware, one who has used the words "innovation" and "agile" more times in the last year than any other politician, and one who has repeatedly let slip little hints like his use of an encrypted app for messaging to give the impression that he knows his ones and zeroes.

As usual, there are no specifics. Last time I looked, Facebook, Twitter, and their ilk were all based in the US, a country which is highly unlikely to do anything to disturb them. So what Turnbull has in mind is mystifying.

That Turnbull continues to make such statements, putting himself very much on part with some of the pronouncements that have emanated from Attorney-General George Brandis, is surprising, considering that he has an educated adviser in the shape of Alistair MacGibbon to brief him on the basics of encryption.

But if all that Turnbull is seeking is to pass the time of day by making pronouncements as nonsensical as those uttered by his British counterpart, Theresa May, then he is going about things the right way.

Encryption has taken centrestage ever since the world became aware in 2013 that the NSA was conducting surveillance of man+dog. Since then, companies have been trying to guarantee clients that their data will be safe in order to attract more sales.

Microsoft has even gone to the extent of offering its American clients cloud storage in Germany, a country where data security is taken a little more seriously given its past.

The genie is well and truly out of the bottle and politicians who promise security measures which do not take reality into account are doing just one thing: telling porkies to score political points.

The only point at which this mess will be resolved is when politicians are willing to admit that terrorism is a political problem and requires a political solution. It is not a law and order issue.

View original post here:
Encryption: Turnbull tilts at windmills again - iTWire

Cryptocurrency exchange to credit traders for ethereum ‘flash crash’ – CNBC

Some traders who lost money in this week's ethereum "flash crash" are going to be credited for their losses, the GDAX cryptocurrency exchange announced on Friday.

The price of ethereum, the alternative digital currency to bitcoin, crashed as low as 10 cents from around $319 in about a second in trading on the GDAX on Wednesday. The exchange blamed the move on a "multimillion dollar market sell" order.

In a blog post on Friday, vice president Adam White said the exchange was "confident all trades this week were executed properly, however, some customers did not receive the quality of service we strive to provide and we want to do better."

Therefore, the GDAX will create a process to credit customer accounts which experienced a margin call or stop loss order as a result of that crash, he said.

Those affected customers will have their ETH-USD account restored to the equivalent of the account at the moment prior to the rapid price drop.

Some traders apparently lost a lot of money during the crash. On the social forum Reddit, users complained of losing large sums of money from $3,000 to $9,000.

Others saw it as an opportunity to make money. However, White noted that the exchange will honor all buy orders filled during that time.

"We view this as an opportunity to demonstrate our long-term commitment to our customers and belief in the future of this industry," White said.

CNBC's Arjun Kharpal contributed to this report.

Excerpt from:
Cryptocurrency exchange to credit traders for ethereum 'flash crash' - CNBC

Cryptocurrency: How We Hook the Masses – CoinDesk

Rich Svinkin is the CEO of Jaywalk.me, a startup that motivates increased physical activity with brick-and-mortar retail rewards.

In this opinion piece,Svinkin argues that using cryptocurrencies for rewards schemes can demonstrate the value of the technology and ultimately help bring mass adoption.

Before the hype and before the price explosions of the past year, I sat down and looked at cryptocurrencies from a UXperspective.

That post, published on CoinDesk,offered a simple central premise: the entire bitcoin project was envisioned, designed, built and released as a peer-to-peer value exchange system. It wasn't supposed to be a standalone asset class or a messaging system for banks.

A year later, we're in the midst of a hype-ridden initial coin offering (ICO) explosion. ICOs are another use case in the UX quiver, one we can add to the progress of the last few years. The ICOs (I prefer to call them token sales) are a great engine of growth but they do not achieve our ultimate goal: adoption of cryptocurrency by the masses.

Prior to Jobs and Wozniak, computers were the domain of engineers, hobbyists, large corporations and government agencies. The dominant framework for users to interact with these machines, the command line, ensured low user adoption.

As Neal Stephenson noted, however, the wizards who held sway over the simple cursor and text interfaces later built the tools to drive mass adoption. From the command line, we moved into something relatable and simple, and, in the process, we hid all of the piping behind wall after wall of abstraction.

I don't want to understate how big of a leap this was for my generation. You mean we can make the screen do what we want like an arcade game? We can "save" what we're doing and come back to it later? We can put stuff on a disk and put it on another computer? Wow!

After we were hooked, we started learning heuristics for the things we'd need to master to get more out of the experience. We started implicitly understanding what a KB meant. We grew to "kinda know" how much would fit on a floppy disk.

Some of us started learning how to make simple animations and games. The computer was at first a toy then a tool.

I argue that, in the crypto space, we're at the point in our evolution where the command-line is giving way to new and more generalized heuristics with similarly explosive opportunities. Right now, the equivalent of the command line are things like wallet addresses, private keys, cold storage, and other obfuscating elements.

I wrote a year ago that I think we need a Steve Jobs in this space. No one has yet stepped up to the plate.

Even if regular people were to learn all the terms of art, master using the exchanges, grow comfortable with identity verification and currency exchange rates, and accept the long wait times in transferring fiat in/out, we'd still have a problem that would keep the bulk of the planet off the chain in a meaningful way: risk.

Modern operating systems mitigate risk immensely. Every program we use has some sort of backup system and now you rarely lose work. With cryptocurrencies, the existential threat of losing everything is still there.

The best way to deal with risk, at least at the start, is to try to eliminate it. We must not treat crypto like a competitive currency at least not now. Instead we must treat it like a reward, something new.

We must allow people to buy it, but also allow folks to earn it, with their time, effort, attention, with non-monetary capital. Don't force people to have to buy it with fiat.

Instead, let them earn it.

There are folks that are on a rewards-oriented path: Steemit, Brave, Bitwalking, Metal and others.

This is going to be a growing trend in the months and years to come. All of them want to reward you for something Steemit for creating and engaging with digital content, Bitwalking just for walking. Brave is taking things to the next level: you get rewards just for using a secure browser and for engagement and attention.

Metal will reward you for converting, sending and spending.

All are trying to get to the same goal: they want the cryptocurrency they've issued to become valuable in the real world, to become the lifeblood of a new economy centered around a particular set of use cases.

The success of these products is dependent on ultimately hooking the masses via a rewards-based introduction points, miles, cash back these are notions we all get, just like I did 30 years ago with writing, drawing and reading on the Mac.

But the final step requires users to make that leap from rewards to currency for this revolution to get to the next level. And for that goal, I a true believer am very hopeful with this recent wave.

That said,I still have one hesitation. All of these solutions make progress on the various complexities and issues surrounding adoption.

But, the one thing they all do not do, is obfuscate the currency exchange problem inherent in forging ahead with something new right away. It can show the value of the new currency in terms of fiat, but even currency earned through effort will be at risk of losing credibility and lasting power.

There will always be fear that the $398 I have in crypto will one day be $0, or in anhour will be worth $118.

Sure, we could be at the start of a fiat currency collapse and not even know it, as the market cap of crypto currency rockets up. This may even be good for the whole system. But, even if the crypto world supersedes the money we know, it will be the option with the most perceived stability that ends up winning. Not the ones with the most speculative upside or interesting "applications."

Well know we've "won" when a cryptocurrency becomes woven into the daily lives of the majority of people on earth. That people recognize finally that the fiat they know is also volatile and purchasing power is dynamic and ever changing, and cryptocurrency has many other benefits the analog doesnt have. Or simply that a cryptocurrency finally becomes more stable so people run to it to escape losing all their value in government-backed money as a crisis looms or is underway.

Until then, it's hard to say what weve accomplished truly, but the goal is ultimately that we move belief in fiat money to belief in cryptocurrency.

To me, the best way to start that transition is to get people used to and interested in this new phenomenon by utilizing familiar bridges like air miles and minimizing fear and risk to allow for everyday use to come to bear and even bring some fun to the strange world of cryptocurrencies.

Disclosure: CoinDesk is a subsidiary of Digital Currency Group, which has an ownership stake in Brave.

Mac computer image via Shutterstock

The leader in blockchain news, CoinDesk strives to offer an open platform for dialogue and discussion on all things blockchain by encouraging contributed articles. For more details on how you can submit an opinion or analysis article, view our Editorial Collaboration Guide or email [emailprotected].

Read the original post:
Cryptocurrency: How We Hook the Masses - CoinDesk

Wikileaks: The CIA can remotely hack into computers that aren’t even connected to the internet – Quartz

When firewalls, network-monitoring services, and antivirus software arent enough, theres always been one surefire way to protect computers that control sensitive operations like power grids and water pumps: cut them off from the internet entirely. But new documents published by WikiLeaks on June 22 suggest that even when such extreme measures are taken, no computer is safe from motivated, well-resourced hackers.

The 11 documents describe a piece of software called Brutal Kangaroo, a set of tools built for infiltrating isolated, air-gapped computers by targeting internet-connected networks within the same organization. Its the latest publication in the Vault 7 series of leaked documents, which describe myriad hacking tools WikiLeaks says belong to the US Central Intelligence Agency (CIA).

Brutal Kangaroo works by creating a digital path from an attacker to an air-gapped computer and back. The process begins when a hacker remotely infects an internet-connected computer in the organization or facility being targeted. Once it has infected that first computer, what the documents refer to as the primary host, Brutal Kangaroo waits. It cant spread to other systems until someone plugs a USB thumb drive into that first one.

Once someone does, malware specific to the make and model of the thumb drive is copied onto it, hiding in modified LNK files that Microsoft Windows uses to render desktop icons, and in DLL files that contain executable programs. From this point, Brutal Kangaroo will spread further malware to any system that thumb drive is plugged into. And those systems will infect every drive thats plugged into them, and so on, and the idea is that eventually one of those drives will be plugged into the air-gapped computer.

The major flaw in the concept of isolating sensitive computers is that the air gap around them can only be maintained if no one ever needs to copy files onto or off of them. But even for specialized systems, there are always updates and patches to install, and information that has to be fed in or pulled out. Its common knowledge among IT specialists that external hard drives are an obvious target for anyone seeking to break the air gap, and precautions are presumably taken in facilities with diligent IT specialists. Those precautions, however, can be subverted with exploitations of obscure vulnerabilities, and sometimes mistakes simply happen.

If a thumb drive infected with Brutal Kangaroo is plugged into an air-gapped computer, it immediately copies itself onto it. If a user tries to browse the contents of the infected drive on that computer, it will trigger additional malware that will collect data from the computer. As users continue plugging the drive into connected and disconnected computers, a relay is formed, ultimately creating a slow path back to the hacker, through which data copied from the air-gapped computer will be delivered if everything goes according to plan.

Many details described in the Brutal Kangaroo documents have drawn comparisons to Stuxnet, the powerful malware reportedly developed by the US and Israel to sabotage Irans nuclear program. Stuxnet was specifically built to target air-gapped computers that controlled centrifuges in an Iranian nuclear facility. The attackers in that case did not target an internet-connected network within the nuclear facility, presumably because there wasnt one, but instead targeted five outside organizations, according to a 2014 report in Wired. From there, however, the attack worked in much the same way as the methods described in the Brutal Kangaroo documents: Stuxnet also spread through thumb drives, hid in LNK files, and attempted to create a relay to send information back to the attackers.

Stuxnet was eventually discovered by security researchers because it was too powerful, and spread to far more computers than its creators apparently wanted it to. The developers of Brutal Kangaroo appear to have taken a lesson from that, and described several checks in their documents that will stop it from spreading if certain factors are met. Every time it lands on a new computer, Brutal Kangaroo first checks the computers date. If it is past a date hard-coded into the malware, the program will immediately exit, according to the documents. It also checks some sort of black list, and will quit if the computer is on it. It will also quit Brutal Kangaroo if the computer had been seen before.

The Brutal Kangaroo documents are only the latest revelation about what the CIAs hackers are allegedly capable of. Previous Vault 7 publications have included documents that suggest the agency can turn smart TVs into listening devices, hack various desktop and mobile operating systems, and monitor internet traffic by breaking into home wifi routers. In April, Symantec matched several tools described in the releases to invasive software it had been tracking since 2014. That malware had infected at least 40 targets in 16 countries since 2011, the company said in a blog post, and was possibly active as far back as 2007.

The CIA has not confirmed its ownership of the documents or tools, but as Motherboard pointed out last March, US officials said in court that the documents contain classified information, suggesting that the leaks are in fact authentic.

Go here to see the original:
Wikileaks: The CIA can remotely hack into computers that aren't even connected to the internet - Quartz

WikiLeaks founder Julian Assange explains why the Democratic … – Washington Examiner

WikiLeakers founder Julian Assange on Saturday predicted the demise of the Democratic Party.

In a post online, shared by his Twitter account, Assange argued that the party has been "consumed" by "hysteria about Russia," something he called a "political dead end." It is upon this "narrative" that the "party's elite" attempts to keep a hold on power, he said.

"Without the 'We didn't lose, Russia won' narrative the party's elite and those who exist under its patronage would be purged for being electorally incompetent and ideologically passe," Assange said.

Assange's group, WikiLeaks, is responsible for the publication of stolen documents from the Democratic National Committee and Hillary Clinton's campaign during the 2016 campaign, which has been attributed to hurting Clinton's chances. Furthermore, though WikiLeaks denies it, the U.S. intelligence community reported in January with "high confidence" that both WikiLeaks and Guccifer 2.0, among others, were being used by Russian intelligence "to release US victim data obtained in cyberoperations publicly" in order to help undermine the 2016 presidential election in favor of President Trump.

Despite this, Assange said that the "Trump-Russian collusion narrative" being investigated by a number of probes and consistently reported on by the media is unfounded, and "we are left with the Democratic establishment blaming the public for not liking the truth about what Hillary Clinton said to Goldman Sachs and blaming their own base for not liking what they said in their own emails about fixing the DNC primaries."

Filling out a list of six reasons why the Democratic Party is "doomed," Assange said the party "needs the support of the security sector and media barons to push this diversionary conspiracy agenda," but that this strategy is unsustainable. Both the CIA and the FBI, he explained, will be turned against them when they "merge" with the Trump administration.

Not all of the criticism was reserved for the Democrats. For instance, Assange said Trump is embracing "robber barons, dictators and gravitas-free buffoon's like the CIA's Mike Pompeo." In April, Pompeo called WikiLeaks a "non-state, hostile intelligence service." A week later, the Washington Post reported that the Justice Department is close to considering arresting and filing criminal charges against members of WikiLeaks, including Assange.

Still, the bulk of Assange's post focused on the Democrats. "GOP/Trump has open goals everywhere: broken promises, inequality, economy, healthcare, militarization, Goldman Sachs, Saudi Arabia & cronyism, but the Democrat establishment can't kick these goals since the Russian collusion narrative has consumed all its energy and it is entangled with many of the same groups behind Trump's policies," he wrote.

He ended his post calling on the Democratic base to start a new party, in an argument that makes references to French President Emmanuel Macron's recent campaign.

"The Democratic base should move to start a new party since the party elite shows no signs that they will give up power," Assange wrote. "This can be done quickly and cheaply as a result of the internet and databases of peoples' political preferences. This reality is proven in practice with the rapid construction of the Macron, Sanders and Trump campaigns from nothing. The existing Democratic party may well have negative reputational capital, stimulating a Macron-style clean slate approach. Regardless, in the face of such a threat, the Democratic establishment will either concede control or, as in the case of Macron, be eliminated by the new structure."

View post:
WikiLeaks founder Julian Assange explains why the Democratic ... - Washington Examiner

Best Fashion Instagrams of the Week: Paris Hilton and Her Pup’s Look, Chelsea Manning Wears Marc Jacobs, and More – Vogue.com

A little coordination goes a long way. Just ask Paris Hilton who matched her daffodil print dress with none other than her pint-sized pup, who wore a Lilliputian, four-paw version of his own. Stylist Lotta Volkova and a male model also made a case for twinning and both gave their best face in sweet shades of pink.

On the dress front, Adwoa Aboah was quite the head-turner in a lime green Alessandra Rich frock and Balenciaga cuissardes while Elisabeth Moss was as elegant as ever in a lace dress accessorized with a Planned Parenthood pin. Making the boldest statement of them all was Chelsea Manning who beamed in a black Marc Jacobs dress, a look that she coined "neo-cyberpunk."

There was plenty of traveling going on this week, too. Bella Hadid was at her "second home" at Dior in Paris donning a red skirt set, captured none other than in the most meta way possible a Polaroid . Karlie Kloss most likely had some extra baggage charges judging by her Instagram: The model struck a pinup pose on her multiple suitcases before she headed out to Shanghai. Emily Ratajakowski, perpetually bikini-bound, made like a nonna and hung her towels on a clothesline amid the Italian landscape. Need some inspiration on how to dress for the museum? Vogue 's Hamish Bowles was all the bit dapper and buttoned-up at The Louvre in Paris.

The rest is here:
Best Fashion Instagrams of the Week: Paris Hilton and Her Pup's Look, Chelsea Manning Wears Marc Jacobs, and More - Vogue.com

CIA chief: Intel leaks on the rise, cites leaker ‘worship’ – Sacramento Bee


Sacramento Bee
CIA chief: Intel leaks on the rise, cites leaker 'worship'
Sacramento Bee
There are several other recent cases, including Chelsea Manning, the Army private formerly known as Bradley Manning. She was convicted in a 2013 court-martial of leaking more than 700,000 secret military and State Department documents to WikiLeaks ...

and more »

Follow this link:
CIA chief: Intel leaks on the rise, cites leaker 'worship' - Sacramento Bee

Trump CIA director blames ‘worship of Edward Snowden’ for rise in leaks – The Guardian

Mike Pompeo, the director of the CIA, has blamed the worship of leakers such as Edward Snowden for a rise in the public disclosure of US intelligence.

Donald Trumps pick to head the intelligence agency said more needed to be done to stem what he called an increase in the leaking of state secrets.

In some ways, I do think [leaking has] accelerated, Pompeo told MSNBC in an interview broadcast on Saturday. I think there is a phenomenon, the worship of Edward Snowden, and those who steal American secrets for the purpose of self-aggrandizement or money or for whatever their motivation may be, does seem to be on the increase.

Pompeo added: Its tough. You now have not only nation states trying to steal our stuff, but non-state, hostile intelligence services, well-funded folks like WikiLeaks, out there trying to steal American secrets for the sole purpose of undermining the United States and democracy.

Snowden is a former CIA employee who in 2013 revealed the extent of surveillance programs of ordinary citizens by the National Security Agency, leaking documents to media outlets including the Guardian. Snowden, who now lives in Moscow, has been hailed by some as a whistleblower who exposed a system that intruded on peoples private lives to a degree that blunted genuine national security efforts.

Pompeo, along with many other Republicans and some Democrats, has taken a dimmer view of the revelations. Last year, he called for Congress to pass a law re-establishing collection of all metadata.

In a National Review op ed published in December 2015, he wrote: To share Edward Snowdens vision of America as the problem is to come down on the side of President Obamas diminishing willingness to collect intelligence on jihadis.

WikiLeaks, meanwhile, has been a thorn in the side of the US government for some time. In 2010 Chelsea Manning, a former US army private who was recently released after being convicted by court marshal in 2013, gave Wikileaks more than 700,000 documents and diplomatic cables.

In March 2017, WikiLeaks revealed information on CIA activities, releasing nearly 8,000 documents that it said showed how the agency accesses computers. Speaking in April, Pompeo said: It is time to call out WikiLeaks for what it really is a non-state hostile intelligence service often abetted by state actors like Russia.

During the 2016 election, WikiLeaks published Democratic party emails procured in a hack US intelligence agencies including the CIA believe was carried out by Russian actors seeking to help the Trump campaign.

Links between Trump aides and Moscow are now the focus of FBI and congressional investigations. The Trump White House has made attacks on those who leak confidential information a central plank of its response to those investigations.

In his MSNBC interview on Saturday, Pompeo predicted the Trump administration will have success in deterring leakers as well as punishing those who we catch who have done it.

The CIA director said Trump was an avid consumer of intelligence material. Our goal is that he has the facts, the truth, he said.

Pompeo said that while Islamic State remains an enormous threat to the US, he considered Iran a greater menace. He also identified North Korea as a very real danger and said Trump asks him about the communist dictatorship almost every day.

Original post:
Trump CIA director blames 'worship of Edward Snowden' for rise in leaks - The Guardian