Hail to the Thief: The Case Against Edward Snowden – Signature Reads

Former National Security Agency contractor Edward Snowden is a polarizing figure.

Some consider him a whistleblower who sacrificed his career and freedom to inform the American people of government intrusion into their private lives. Edward Jay Epstein, author of How America Lost Its Secrets: Edward Snowden, the Man and the Theft, suspects that Snowdens motives were less than noble, and that, intentionally or not, his actions benefited the intelligence apparatus of an adversary nation.

In this interview, Epstein shares some of the lesser known facts behind the headlines, and opines on whether or not Snowdens flight to Russia helped the country to hack our most recent presidential election.

SIGNATURE: Youve been digging into the skullduggery behind some of our biggest headlines for a long time. Why did you choose Snowden for your next project?

EDWARD JAY EPSTEIN: To answer your question in some depth, I began as an undergraduate in college where I got access to all the members of the Warren Commission, which no one had ever done before or after, as well as their records, so before I had even graduated college, I found that some narratives that are accepted as unquestionable facts can be questioned. In the case of the Warren Commission, the unquestioned assertion was that it had done a totally exhaustive job. I found that while they had done an honest and good job, it wasnt exhaustive and they hadnt answered certain questions.

Ive found, at least in my case, that an author keeps writing his first successful book over and over again. I kept looking for areas in which a narrative could be questioned, even if it turned out that the narrative was true, like in the case of the 9/11 Commission. I had planned to do a book about it, but when I found that the 9/11 Commission had actually done the job that it was supposed to do, I dropped that project and moved on to another one.

My search pattern has always been to look for something that comes from a single source and is maybe questionable. I realized that the entire narrative about Snowden that he was a whistleblower, that he was a patriot who had only accidentally ended up in Russia and who had only helped America came from a single, self-interested source who was actually in Moscow: Snowden himself. That interested me. If the world was depending on this one guy who was the perpetrator of a crime and was under the control of the Russian government, then I was going to look at the case de novo blank slate myself.

SR: If I had paid only a little bit of attention to the Snowden affair, I would be left with the following idea: Snowden had slipped away with a file indicating that the NSA had an illegal surveillance apparatus in the United States, and that Moscow had given him sanctuary from American persecution. That would be the narrative I would follow. The one you explore in your book is a good bit different.

EJE: If you, or anyone else, who simply read the accounts coming from the very small group of people Glenn Greenwald, Barton Gellman, Laura Poitras, and Snowdens lawyers, Ben Wizner, and Robert Tibbo, maybe another person or two after theyd gone through the echo chamber of the media, youd get the exact narrative you suggested: that Snowden only stole documents that exposed an illegal NSA program, and that because the US government had tricked and demonized him, his winding up in Moscow was the work of the Obama administration and that he was really trying to get to South America. You can see it all in the Oliver Stone movie; thats the narrative.

The problem with that narrative, and its very simple, is that he didnt take two, or three, or a thousand documents bearing on his whistleblowing. He stole, or as the House Intelligence Committee says, removed, 1.5 million files, some of which had as many as 32,000 pages. He took a massive amount of communication and signal intelligence: more than anyone in history has ever taken before. These included 900,000 military documents involving submarines, drones, planes, cyberwarfare that had nothing to do with whistleblowing. Just imagine if someone robbing a bank found a few pages in the bank that showed it wasnt giving the proper rebates to the customers and he took those to the media, and took the rest of the haul away: You wouldnt call the guy a whistleblower, youd call him a bank robber. Thats what Snowden did.

Snowden stopped in Hong Kong and had a disclosure operation there where he disclosed to reporters all of whom were honest reporters, I would have done the same thing they did and so would have any other reporter that he was with the NSA and then presented them with documents that showed that the NSA was involved with an illegal program. Whether they were illegal or just questionable is an argument, but lets give him credit and say they were illegal. What he didnt tell the reporters, these reporters who almost became like the prophets of a religion, was that he had met with officials of the Russian government. How do we know that? Its because Vladimir Putin, of all people, decided to disclose that Snowden had met with Russian officials in Hong Kong before he was granted asylum. We know that he was in contact with the Russians, and he didnt disclose that.

He also didnt disclose that he removed 1.5 million documents. How do we know that he removed that large number? Were talking about digital copies, its not like he took books and theyre missing from the library. In this digital world, you make a copy of something and the original remains where it is. The way we know is that he transferred them between computers and left a trail that he tried to erase but the NSA and Department of Defense was able to reconstruct. We know that because the House Intelligence Committee, the oversight committee for the NSA, did a report which was released in September 2016 that stated that the house committee had been given a damage assessment by the Department of Defense. Thats how we know that, but he didnt tell the reporters this. He denied it. So the narrative begins that this is a whistleblower who made headlines by exposing some very unsavory programs that the NSA was involved in.

Everyone wants privacy I dont blame them and to them, Snowden was a hero because he was standing up for his privacy. What they didnt know was about his meeting with the Russians, and how many documents he took. At the time he took them and for many months after, the NSA didnt know the total size of the damage because they didnt know how he transferred them. It was the Department of Defense that actually had a team of between 200 and 250 intelligence officers reading through every document that pieced together the trail which led to a server in the cryptocenter where he was working and they were able to reconstruct the number of files he transferred to it. Snowdens narrative was a false narrative in every respect. Like all false narratives, it had a number of true statements in it, and these can convince people that all of it cant be lies. Some of what he said was truthful.

SR: How is it that someone like Snowden, who had very little formal background in what he did, get the clearance that he had? How did he manage to get these documents out of what I would have to assume is a very secure facility?

EJE: Snowden had very little formal education. He dropped out of high school in his first year. Thats not to say that he wasnt smart, but he had no formal education. He loved to play games and loved computers, apparently. I was able to reconstruct that from his posts, tweets, and other social media.

His entire family worked for the government. His grandfather, Edward Barrett, was an admiral in the Coast Guard, and then worked for a CIA joint task force. Then he had a high position in the FBI. His father was a member of the Coast Guard. His mother worked for a court in Maryland. His sister worked for the Federal Judicial Center. Everyone in his family worked for the government, so it wasnt surprising that he would look for a government job.

He tried to be in the military but was administratively discharged after a few months. He then worked as a security guard for a facility at the University of Maryland that was related to the NSA, so he got a security clearance. Then he joined the CIA as a TCO: a Technical Communications Officer. After he got fired, or forced to resign, he sought out private contractors.

Private contractors look for one thing besides a person who knows how to work a computer: They look for someone who already has a security clearance. When you leave the CIA, you keep your SCI (sensitive compartmentalized information) security clearance for two years, even if you leave under a cloud, like Snowden did. He had an SCI security clearance, so he was very valuable. A contractor wouldnt have to go through the trouble of getting him a security clearance.

He went to Japan, where he worked for Dell SecureWorks: a private contractor. He did okay, and a few months later, he took the most valuable of information and went to work for Booz Allen. He offered to take a pay cut, and again, he was very valuable because he had an SCI clearance, so they snapped him up. He went to work at the center for five or six weeks, maybe less, and stole all the information there and left.

It started at the CIA: He got the security clearance there and kept it. The real scandal is not so much Snowden, but how American intelligence has privatized intelligence by having outside contractors run the computers. Hes part of the scandal.

SR: I assume that I wouldnt be able to walk out with a flash drive very easily were I an employee of one of these agencies, and the information is compartmentalized, too. How was he able to get access to this and get it out? I would have thought that it was impossible until I read the book.

EJE: It was close to impossible. Snowden organized it very cleverly. He started work in the second week of April 2013 at Booz Allen, which had a contract at the cryptology center in Hawaii. Its a tall, modern building at Wheeler Air Force Base. He went to work there, and because the information and methods they worked with were so secret, independent contractors like Snowden werent allowed to have what they called fat computers: portable computers with ports and storage capability. Everyone worked with the NSA equivalent of an iPad: a thin computer. Its a security measure so no one can steal information.

What Snowden managed to do was to use his thin computer to transfer the data to a server at the center. He had the passwords to that, and according to the House Select Committee on Intelligence, he drove the twenty minute drive to the place he formerly worked, a place called the Kunia Tunnel, where he had left his old computer a fat computer and used it to download the information from the server into that computer. From there, he put it on thumb drives and took it.

The whole operation was extremely complicated for someone who had been working at the cryptological center for two weeks or something like that. Had he planned it in advance? Did he have someone working with him at his old job at the Kunia Tunnel that had his old computer? None of it is very clear to me. He didnt have passwords for any of the compartments he entered. One way or the other, and I dont know the way, I only know now that the FBI is willing to assume he did it alone and Im reporting that, he managed to get the information downloaded to his old computer.

Leaving the NSA is not a big deal: Hundreds of people work at the center and they leave every night to go home. Theres a big parking lot and they walk out. I sort of went to the center and was only allowed in a few feet, but I could see the parking lot and the people leaving and they just stream out. They randomly check people, supposedly, but if theres a random check I would say its one in a thousand, just observing it. Snowden walked out with the external drives, got on an airplane, and went to Hong Kong. Thats how he stole the information.

SR: Id like to fast forward to a point in the story that I think is particularly salient right now. He took all of this information to Russia and disappeared for a while. We had nothing more from him than basically a promise that he wouldnt turn over documents to them that were dangerous to our national security.

EJE: He didnt promise anyone anything. The important thing here is that he met with what Putin called diplomats. Russian diplomats often have a second job, intelligence, especially in a place like Hong Kong. Putin used the plural, diplomats, not a diplomat. He might have met with them before he met with the journalists, but they knew, suddenly everyone in the world knew after he met with the journalists that he had a large number of documents. Maybe just 15,000, not 1.5 million, but they knew he had a large number. The Russians knew that and he was put on a Russian airplane and was flown to Russia.

Snowdens passport was suspended in Hong Kong, so why the Russians put him on the plane is speculation. My guess is that they knew he was going to give them a lot of information, or they had already gotten it before he got on the plane. In any case, he flew to Russia and was taken off the plane in what they called a special operation. Then he disappeared from June 23 to July 14. During that time, no one in the outside world no journalists saw him. They didnt see him getting off the plane, so the last time they saw him was in Hong Kong.

In that period, as the various American intelligence services I spoke with said, he was their man: He was in the palm of their hands. They didnt have to threaten him with torture, they could just threaten him by sending him back to America. America was trying to get him back. He said he gave nothing to the Russians, but almost every spy who goes to Russia, or China, or everywhere else, says they gave nothing to them. That, simply, is another part of his narrative: that he gave nothing to Russia.

Since Putin jeopardized a summit conference that was scheduled with Obama for September, and Obamas participation in, or attendance at, the Winter Olympic games that were scheduled in Sochi, he knew he was going to pay a high price. One has to assume that he also knew he would get something back for it.

SR: How bad has this hurt the United States? The topic of Russian hacking is top news right now. Can we see a connection between anything Snowden provided, our current political climate, and how the intelligence community was affected?

EJE: Its hard to deny or neglect the connection between the damage that Snowden did and the presence of Russian intrusions in cyberspace. The moment the NSA determined Snowden had taken those 1.5 million files and the Pentagon had gone through each and every one of those files which took four months around the clock it didnt matter whether he had given the files to Russia, or China, or journalists, or thrown them into the ocean, or burned them. The moment those files were taken out of the secure environment of the NSA in Hawaii, they had to be considered compromised. When a source, or the sources in these documents, are compromised, theres only one thing to do: shut them down. You dont know if the Russians got them, but if they did, theyll arrest anyone connected with them, or use the channels to feed disinformation through.

What happened after Snowden removed those files was a massive case of self-destruction. The NSA had to close down every source in those files. That meant that, basically, the NSA and CIA suddenly went dark, and anyone who depended on them for intelligence on Russian and China, couldnt anymore.

Deputy Director of the NSA Richard Ledgett described one of those files as the keys to the kingdom: It contained every gap in American coverage of Russia. That file gave whomever obtained it a road map to everything the United States, Britain, and Israeli intelligence was doing. All of the sources had to be closed down. The NSA was shut down in a large part of its coverage of adversary nations, which included North Korea, China, and Russia.

Now the question comes is what damage is done when the NSA goes dark. The answer is the old adage: When the cat is away, the mice will play. Russia, realizing that we had to shut down all of our sources, now had a tremendous amount of room to establish its own activities, which included not only hacking and a lot of attention has been paid to hacking and false news but that cant be successful unless theres a feedback loop: a way in which theyre able to assess where its going right and where its going wrong, and where it is achieving their purposes and where it is counterproductive. They needed to establish their own penetrations and everything that goes with them.

In the black period that started as soon as the NSA realized these documents were taken in the Spring of 2013, the agency had to find new sources. Whether they did or didnt I dont know, but the vice chairman of Booz Allen, and the former director of the NSA and former Director of National Intelligence, Michael McConnell, said that generations of intelligence was lost by Snowdens act. If I understand that properly, generations means intelligence that has been gathered over twentyyears is one generation and it goes on. Huge amounts of sources were compromised, which left huge opportunities for Russia to become more aggressive, especially in cyberspace. I dont think we can ignore the possible connection between the loss of our own ability to defend ourselves in cyberspace and the intrusion of other countries, including Russia.

Continued here:
Hail to the Thief: The Case Against Edward Snowden - Signature Reads

Edward Snowden: An argument for treachery – UVU Review

Edward Snowdens illegal release of classified information will rank among the most widely debated issues of the millennial generation. One side of the argument depicts Snowdens actions as honorable, if not patriotic. Others cry foul.

David Menzies brought the conversation to UVU in the Jan. 9, 2017 edition of The Review. I encourage you to read his artful summation of the situation and his call for Snowdens safe returnand heros welcometo the United States. Many will welcome Snowden home, but as a hero, I sincerely doubt.

Snowden claimed the National Security Agency, or NSA, was violating the Fourth Amendment to the Constitution. As an employee of both the Central Intelligence Agency and the NSA subcontractor, Booz Allen Hamilton, Snowden was trained in the proper use and handling of classified information and materiel. We can be certain he received this training as it is both regular and mandatory.

Subsection 798 (a) of Title 18, US code states it is against federal law if a person knowingly and willfully communicates, furnishes, transmits, or otherwise makes available to an unauthorized person, or publishes, or uses in any manner prejudicial to the safety or interest of the United States or for the benefit of any foreign government to the detriment of the United States any classified information. Suffice it to say, by leaking classified material, Snowden broke the law.

Regardless of rhetoric, Snowden knew the rules and he chose to violate them. He claimed he took his concerns to multiple superiors and reported being ignored. He then decided his only option was treason and espionage. Subsection 2302 (b) (8) of Title 5, US code protects intelligence whistleblowers from punitive action. His failure to pursue this institutionalized last resort indicates either contempt for the US government or a preconceived radicalization.

Laws especially those in Title 18, US code should apply to everyone charged with the care of classified material. But do they?

Menzies aptly described the US government as a snake eating its tail. US Attorney General Loretta Lynch, the nations lead prosecutor concerning violations of federal law, was unable to define the very laws Snowden was condemned for breaking, during her July 12, 2016 testimony before the House Judiciary Committee.

When Hillary Clinton was accused of mishandling classified material, the same debate erupted. Congressman Jason Chaffetz of Utah asked Lynch whether mishandling of classified material was against the law. Lynch replied with, It depends.

How are contractors supposed to know and respect the law when Attorney General Lynch refuses to acknowledge them?

When I asked Congressman Chaffetz about Lynchs responses to his questions he said, Its ridiculous. [People] should be in prison.

Snowden

Visit link:
Edward Snowden: An argument for treachery - UVU Review

Encryption | California State University, Northridge

Bluetooth itself as a technology isn't secure, it's not only about the implementation, there are some serious flaws in the design itself. Bluetooth isn't a short range communication method - just because you're a bit far doesn't mean you're safe.Class I Bluetooth deviceshave a range up to 100 meters. Bluetooth isn't a mature communicate method (security-wise). With smart phones, it has turned into something totally different from what it was meant to be. It was created as a way to connect phones to peripherals. Please don't use Bluetooth for accessing Level 1 data.

If you do need to use Bluetooth devices please do the following

Here is theWindows documentation.

Here is theMacintosh documentation

Disk encryption safely protects all the data stored on a hard drive. When the entire hard disk is encrypted, everything on that disk is protected if the computer is lost or stolen. CSUN recommends the following drive encryption programs for non-portable storage devices. Select the appropriate link for more information on how to use each program:

E-mails may be encrypted and/or authenticated to prevent the contents from being read by unintended recipients. Please ask your local tech if you believe you need to encrypt e-mail messages.

The following encryption methods are available for protecting files and folders stored on portable storage devices such as, USB sticks, external hard drives and other mobile devices. Select the appropriate link below for more information on how to use each program:

There are storage devices that use hardware based encryption.

File encryption is designed to protect stored (at rest) files or folders.

Additional information is available by clicking on each product name.

Caution: Data in encrypted files are not retrievable if the encryption key is lost.

Following are examples of file encryption software to use when encrypting your data:

The following productivity tools let you password-protect and/or encrypt individual files:

It is possible to encrypt entire networks, which may be desirable in certain situations. If you think this may be relevant to you, please contact your local tech for assistance.

Visit link:
Encryption | California State University, Northridge

How have ARM TrustZone flaws affected Android encryption? – TechTarget

Google received a lot of praise for the security improvements in Android N, but some security experts have taken...

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Google to task over what they claim are shortcomings with Android N encryption. What are the issues with Android N's encryption scheme?

Encryption is the cornerstone of information security, yet it is notoriously difficult to implement well, particularly on desktops and mobile devices used by non-tech-savvy users. Ease of use, speed and data recovery all need to be balanced against robust encryption.

The two main technologies for meeting these requirements are full disk encryption (FDE) and file-based encryption (FBE). FBE only encrypts selected folders or files, which remain encrypted until the user chooses to access them by providing the correct credentials. FDE encrypts the entire contents of a device's hard drive, so if the device is lost or stolen, or the drive is placed into another device, all the data remains protected. However, once a user unlocks their device, none of the data is protected, as the entire contents of the drive will have been decrypted. While desktop computers are regularly turned off, most mobile devices are left on indefinitely, leaving sensitive data decrypted and potentially accessible to unauthorized users.

Since Android version 5.0, Android devices have had FDE enabled by default. This is based on the Linux kernel subsystem dm-crypt, a widely used and robust encryption scheme. But, like every encryption scheme, it is only as strong as the key used to encrypt the data.

An independent researcher, Gal Beniamini, posted an exploit code that breaks Android's FDE on devices running on Qualcomm chips by leveraging weaknesses in the chips' design.

ARM TrustZone is a system-on-a-chip and CPU system-wide approach to security that supports a Trusted Execution Environment, backed by hardware-based access control, which cannot be interfered with by less trusted applications or the operating system.

Android's Keystore Keymaster module is intended to assure the protection of cryptographic keys generated by applications, and it runs in the ARM TrustZone. It contains the device encryption key (DEK) used for FDE, which is further protected through encryption with a key derived from the user's unlock credentials. This key is bound to the device's hardware through the intermediate Keymaster signature. This means all cryptographic operations have to be performed directly on the device itself by the Keymaster module, thus preventing off-device brute force attacks.

However, as the key derivation process is not truly hardware-bound, the Keymaster signature is stored in software instead of hardware, and is directly available to the TrustZone. This makes Android's FDE only as robust as the ARM TrustZone kernel or Keymaster module.

Beniamini's previous blog posts have shown that applications that run in the TrustZone in Android devices using Qualcomm chips can be reverse-engineered. By reverse-engineering the Keymaster module and leveraging two ARM TrustZone kernel vulnerabilities he discovered, Beniamini developed an off-device exploit to decrypt the DEK. No longer restricted to a limited number of password attempts, the user's credentials can be brute forced by passing them through the key derivation function until the resulting key decrypts the stored DEK. Once the DEK is decrypted, it can be used to decrypt the entire drive, breaking Android's FDE scheme. The attacker can also downgrade a patched device to a vulnerable version to extract the key.

This flaw makes Android's FDE implementation far weaker than Apple's, which has encryption keys that are properly bound to the device's hardware, and which are never divulged to software or firmware. This means an attacker must brute force an iOS user's password on the device. This requires overcoming the on-device protections, like delays between decryption attempts and wiping user data after so many failed attempts. Android devices, on the other hand, perform encryption using keys which are directly available to the ARM TrustZone software.

Poor implementation is usually the weak point in any encryption technology. While the two ARM TrustZone vulnerabilities used by Beniamini, CVE-2015-6639 and CVE-2016-2431, have been patched, many devices remain susceptible to the attack because they have yet to receive the patches. This is a constant problem that plagues Android devices due to restrictions and delays created by manufacturers or carriers that prevent end users from receiving or installing the updates they release.

Read about the new memory protection features in the Linux kernel on Android OS

Learn about the security features in the Samsung Knox platform

Find out the differences between symmetric and asymmetric encryption types

Go here to read the rest:
How have ARM TrustZone flaws affected Android encryption? - TechTarget

Why isn’t US military email protected by standard encryption tech? – Naked Security

One of the United States Senates most tech-savvy members is asking why much of the US militarys email still isnt protected by standard STARTTLS encryption technology.

Last month, Sen. Ron Wyden (D-Oregon) shared his concerns with DISA, the federal organization that runs mail.mil for the US army, navy, marines and the Coast Guard:

The technology industry created STARTTLS fifteen years ago to allow email servers to communicate securely and protect email messages from surveillance as they are transmitted over the internet. STARTTLS is widely supported by email server software but, critically, it is often not enabled by default, meaning email server administrators must turn it on.

Wyden noted that major tech companies including Google, Yahoo, Microsoft, Facebook, Twitter, and Apple use STARTTLS, as do the White House, Congress, NSA, CIA, FBI, Director of National Intelligence, and Department of Homeland Security but not DISA.

A 2015 Motherboard investigation originally uncovered the limited use of STARTTLS by U.S. government security agencies. Since then, Motherboard reports, many of the aforementioned agencies have started using STARTTLS but not DISA.

Wyden observed that until DISA enables STARTTLS, unclassified email messages sent between the military and other organizations will be needlessly exposed to surveillance and potentially compromised by third parties.

Even if all the military messages sent through DISAs servers are unclassified, if Wyden is correct, this might conceivably give adversaries additional insights into the US militarys structure, decision-makers, and decision-making processes.

Early reports on Wydens letter quoted DISA as saying that it would respond formally to him. DISA told Naked Security:

We are not at liberty to discuss specific tactics, techniques, and procedures by which DISA guards DOD email traffic. Email is one of the largest threat vectors in cyberspace. We can tell you that DISA protects all DOD entities with its Enterprise Email Security Gateway Solution (EEMSG) as a first line of defense for email security.

DISAs DOD Enterprise Email (DEE) utilizes the EEMSG for internet email traffic and currently rejects more than 85% of daily email traffic due to malicious behavior. DISA inspects the remaining 15% of email traffic to detect advanced, persistent cybersecurity threats. The Agency always makes deliberate risk-based decisions in the tools it uses for cybersecurity, to include email protocols for the DoD.

In the news you can use spirit, this might be a good time for a brief primer on STARTTLS. This SMTP extension aims to partially remedy a fundamental shortcoming of the original SMTP email protocol: it didnt provide a way to signal that email communication should be secured as messages hop across servers towards their destinations.

Using STARTTLS, an SMTP client can connect over a secure TLS-enabled port; the server can then advertise that a secure connection is available, and the client can request to use it.

STARTTLS isnt perfect. It can be vulnerable to downgrade attacks, where an illicit man-in-the-middle deletes a servers response that STARTTLS is available. Seeing no response, the client sends its message via an insecure connection, just as it would have if STARTTLS never existed. But, as the Internet Engineering Task Force (IETF) puts it, this opportunistic security approach offers some protection most of the time.

IETF says protocols like STARTTLS are:

not intended as a substitute for authenticated, encrypted communication when such communication is already mandated by policy (that is, by configuration or direct request of the application) or is otherwise required to access a particular resource. In essence, [they are] employed when one might otherwise settle for cleartext.

For context, Google reports that 88% of the Gmail messages it sends to other providers are now encrypted via TLS (in other words, both Google and the other provider supports TLS/STARTTLS encryption); 85% of messages inboundto Gmail are encrypted.

Would STARTTLS offer value in securing the military communications DISA manages through mail.mil? From the outside, its easy to say Yes. But it sure would be fascinating to hear the technical conversation between DISAs security experts and Senator Wydens.

Email service providers are caught on the horns of a dilemma, it seems. Naked Securitys Paul Ducklin says:

STARTTLS only deals with server-to-server encryption of the SMTP part, so it isnt a replacement for end-to-end encrypted email in environments where thats appropriate.In other words, there are situations in which you may be able to make a strong case for not needing STARTTLS. But my opinion is that its easier just to turn on STARTTLS anyway just think of all the time youll save not having to keep explaining that strong case of yours.

As for you: if you arent using STARTTLS wherever its available to you, why not?

Read the rest here:
Why isn't US military email protected by standard encryption tech? - Naked Security

Keeping the enterprise secure in the age of mass encryption – Information Age

By automatically discovering every key and certificate generated by your organisation as they are created, and integrating this data into security tools, you can finally shine a light on encrypted tunnels

Organisations have always been told that strong encryption is their friend. When applied to internet traffic, encryption secures the connection between user and website, locking the bad guys out and foiling the hijackers attempting to spoof legitimate sites or eavesdrop on communications.

So when Mozilla recently revealed that the majority of web pages loaded by Firefox used the secure HTTPS protocol, it seemed like a good news day for information security. Naturally, the story is far more complex than that.

The truth is that the hackers are getting increasingly adept at hiding in these encrypted tunnels which disguises their attacks from even the best defences. For example, roughly 90% of CIOs have already been attacked, or expect to be, by hackers hiding in encrypted traffic.

>See also:Enterprises using IoT arent securing sensitive data Thales

Businessesurgently need to improve their management of encrypted tunnels, or they risk compromising the effectiveness of our cyber security defences. But for that to happen, organisations must first gain visibility and control over their expansive estates of digital keys and certificates.

These keys and certificates are the cryptographic assets that form the foundation of encryption, allowing machines to identify each other in the same way usernames and passwords work for human users.

CISOs do not accept having limited visibility over identity and access management for all their users the same rigorous oversight needs to be extended to keys and certificates.

The growth of HTTPS is both a positive and negative thing. Encryption is the primary tool used to keep internet transactions out of the reach of prying eyes, and weve seen increased adoption over the past few years, partly driven by revelations of mass state surveillance exposed by NSA whistleblower Edward Snowden.

HTTPS protects the sensitive data of hundreds of millions of users around the world, offering protection against man-in-the-middle attacks and attackers looking to spoof trusted sites.

Encrypted traffic is beginning to become the norm, rather than the exception, and a survey from this years RSA Conference showed that this trend will continue: two-thirds (66%) of attendees said that their organisation is planning to increase encryption usage.

>See also:Who owns your companys encryption keys?

But what happens when a hacker manages to get into encrypted traffic? This is not a hypothetical problem a third (32%) of security professionals at RSA said that they are either not confident or have only 50% confidence in their organisations ability to protect and secure encrypted communications.

And once a hacker does get into encrypted traffic it will offer the same protections, but this time against the organisations security tools. Intrusion detection and prevention systems, firewalls and similar tools are rendered useless, unable to inspect the traffic going in and out of the organisation.

A hacker could hide malware or web exploits from these tools to launch an attack and then use the encrypted tunnel to ferry stolen data out again.

The problem ultimately boils down to the digital keys and certificates that form the Internets base of cyber security and trust. Today, this system is used to secure everything from online banking to mobile apps and the Internet of Things (IoT). Theres just one problem: our foundation is built on sand.

The volume of keys and certificates has exploded over recent years, thanks to virtualisation and the growth in mobile devices, cloud servers and now the IoT. Everything with an IP address depends on a key and certificate to create a secure connection.

>See also:Network security doesnt just begin and end with encryption

But organisations simply cant keep track of this explosive growth, often leaving them unsecured and managed manually. This has allowed cyber criminals to sneak in and use unprotected keys and certificates for their own ends.

The problem will only get worse as the number of IoT devices grows. Gartner recently claimed 8.4 billion connected devices will be in use globally by the end of 2017, up 31% from 2016, and reach a staggering 20.4 billion by 2020.

Additionally, half of the organisations Venafi polled last year said they saw key and certificate usage grow by over 25%. And one in five claimed it had increased by more than 50%.

As keys and certificates grow, so do the opportunities for the hackers. But there is hope. If were able to provide our security tools with the all-important keys, then they can open up and inspect encrypted traffic to ensure it doesnt contain anything malicious.

This is easier said than done; especially given the hundreds of thousands of keys and certificates a typical organisation must manage. New keys and certificates are retired and created every day.

What organisations need is centralised intelligence and automation system. This will ensure that all security tools are provided with a continuously updated list of all the relevant keys and certificates they need in order to inspect encrypted traffic.

>See also:Keys to the castle: Encryption in the cloud

By automatically discovering every key and certificate generated by your organisation as they are created, and integrating this data into security tools, you can finally shine a light on encrypted tunnels.

The result? IT leaders will not only benefit from improved resilience from cyber attacks, data breaches and the like, but also finally gain full value from their technology investments.

With encrypted traffic growing all the time and 85% of CIOs expecting criminal misuse of keys and certificates to get worse, businessescant afford to hang around.

Sourced byKevin Bocek, chief cyber-security strategist atVenafi

Nominations are now open for theTech Leaders Awards 2017, the UKs flagship celebration of the business, IT and digital leaders driving disruptive innovation and demonstrating value from the application of technology in businesses and organisations. Nominating is free and simply: just click here to enter. Good luck!

Go here to see the original:
Keeping the enterprise secure in the age of mass encryption - Information Age

Cripple encryption and you weaken global and national security – Irish Times

There are long-standing, sound reasons why encryption backdoors have failed to get the green light any time they have been proposed in the US or EU

In the midst of the hullabaloo last week over Brexit and article 50 trigger-pulling, not many noticed that EU Commissioner for Justice Vera Jourov proposed the EU-wide introduction of encryption backdoors for popular social apps such as WhatsApp.

Just in case you missed it (and most people likely did, as Jourovs speech to this effect was made on March 28th, the day before the UKs article 50 letter was delivered to EU officials), she said she will announce three or four options in June to allow law enforcement agencies to access encrypted communications.

These will include proposals for binding legislation, as well as voluntary, yet, she suggested, nonetheless mandatory or enforceable compliance from technology companies.

Jourov noted: At the moment, prosecutors, judges, also police and law enforcement authorities are dependent on whether or not providers will voluntarily provide the access and the evidence. This is not the way we can facilitate and ensure the security of Europeans, being dependent on some voluntary action.

She said she intended to introduce clear, simple rules into the European legislation to let law enforcement demand access from technology companies to communications and to do this with swift, reliable response.

However, she said in her speech to the EU Justice and Home Affairs Council that nonlegislative solutions would be needed initially, because legislative solutions, such as a requirement for backdoors, could take years to bring in.

She wouldnt go into details on how that would all work, but we can all look forward now to June, when the proposals arrive in this fresh reconsideration of business, economic, security and, of course, human rights lunacy.

Perhaps we will need some EU shenanigans to exasperate us in June, now that Jourov also has just announced that the joint US-EU review of transatlantic data transfer agreement Privacy Shield wont occur in June, as had been presumed, but has been pushed into September.

Well, proposing encryption backdoors yet again will certainly exasperate.

Backdoors are a secret method of bypassing the normal authentication needed to access the contents of an encrypted file or message. They are built into the application, so that every instance of the application ends up with this secret tunnel. In short, backdoors are deliberate security flaws to cripple a security product.

For example, when you download and install WhatsApp, your messages are automatically encrypted when sent, and can only be decrypted by the user you send them to. But a backdoor would enable law enforcement authorities to also see the message.

Which might seem a good idea given security concerns about terrorism and criminal activity, and Jourov, of course, referenced recent attacks in Europe. And thats why a consideration of backdoors is again on the EU table.

Officials in the UK, France and Germany have been pressing for months for European law enforcement to have a method of accessing encrypted communications. As recently as March 26th, UK home secretary Amber Rudd said the companies that produce encrypted apps should be forced to give police access to contents of messages when asked.

But the problem with encryption is that once you build in a deliberate vulnerability, the application is no longer secure. Even if the key to the backdoor is designed to only be in the possession of security agencies and law enforcement, every shred of evidence in the digital world to date indicates it wont remain a secret and will eventually be located and exploited. Vulnerabilities tend to get found out, one way or another.

And it wont be the good guys that do the exploiting. No, it will of course be the same dark side actors that encryption exists to protect against.

Maybe you are thinking that you dont care if security agencies can read your WhatsApp discussions with your friends if it helps prevent a suicide bomber. But it isnt just about you.

Encryption is ubiquitous, needed for the basic functioning of banks, governments, businesses large and small, utilities, the military, citizen transactions and interactions, just about everything you can think of. Weaken it, and you weaken national and international security, national grids, global transactions, the worlds economies.

Meanwhile, the bad guys will of course just switch to or themselves create something other than WhatsApp (or Signal, or iMessage, any other service forced to install a backdoor).

There are thus long-standing, sound reasons why encryption backdoors have failed to get the green light any time they have been proposed in the US or EU. They can be summed up simply: if you cripple encryption, then you cripple security overall.

Thats not to say legislators are impervious to eventually doing something truly catastrophic. But I wouldnt wager that Europe will bring in backdoors any time soon.

The evidence is far too strong that backdoors would be extraordinarily risky, for little payback. In addition, theres a steep, perhaps impossible challenge of figuring out even some kind of voluntary scheme, given the way encryption services work (secret is secret).

So, the June proposals will be interesting to see. Expect to be exasperated.

Read the original post:
Cripple encryption and you weaken global and national security - Irish Times

6 workarounds for accessing encrypted devices – GCN.com

6 workarounds for accessing encrypted devices

The story of Syed Farooks iPhone is a perfect illustration of both the power of encryption on personal devices and the governments frustration with such security when it hinders an investigation.

In the wake of the 2015 San Bernadino, Calif., shootings, investigators wanted access to Farooks iPhone. The phone was encrypted, the FBI asked Apple to write software to give it access and Apple refused to comply. What ensued was a long battle that played out in courts and in public. In the end the government allegedly paid $1 million to third party to have the phone unlocked.

Access to encrypted information need not always be as difficult or expensive for investigators, however. Two cybersecurity experts have published an essay that discusses the practical, technological and legal implications of six encryption workarounds.

Encryption raises a challenge for criminal investigators, wrote Orin S. Kerr, director of the Cybersecurity Law Initiative at George Washington University Law School, and Bruce Schneier, fellow at Harvard Universitys Berkman Klein Center for Internet & Society and CTO at Resilient. When law enforcement attempts to access encrypted data, only ciphertext or scrambled information can be seen, which is useless unless it can be decrypted. For government investigators," Kerr & Schneider wrote, "encryption adds an extra step: They must figure out a way to access the plaintext form of a suspects encrypted data.

The following workarounds have been used by investigators since messages have been encrypted back to the time of Elizabeth I when decoded private letters revealed an assassination plot. Today, because encryption is so widespread, investigators come across it in routine cases, making ways to bypass encryption especially timely and relevant.

1. Find the key. The most obvious of the six ways to get around encryption is finding the passwords, passcodes or passphrases required to get into a device. The key might be written down somewhere or stored on an accessible device.

2. Guess the key. Although encryption keys themselves are long and random, the passwords that protect them are usually easier to guess. Investigators have used a suspects date of birth as a password to access personal devices. Password-cracking software can try millions of passwords per second, but investigators can be limited by a devices features that only allow a certain number of password tries before locking out the would-be user.

3. Compel the key. Merely asking, Whats your password? could get investigators the exact information they need, and authorities could legally compel device owners or others who know its password to provide it, the authors said. Both the Fourth and Fifth Amendments provide the device owners with some protection, but considerable ambiguity remains about how much of a burden [these Amendments] impose on investigators.

4. Exploit a flaw in the encryption scheme. This workaround requires finding a flaw in the encryption and using that weakness to gain access to the device. This technique, commonly used by hackers, is analogous to breaking into a locked car by breaking a window instead of picking the lock, the researchers said. The FBI likely gained access to the San Bernardino shooters phone this way, the authors said. The company helping the FBI may have found a flaw in an auto-erase function used on the phone to make it harder to guess passwords. This approach relied on two workarounds in tandem: First, exploit the flaw; second, guess the key, they said.

5. Access plaintext when the device is in use. This workaround requires accessing a device while it is in use and its data has been decrypted, such as when a suspect using a device is arrested before the phone or computer can be shut down. Gaining remote access is much more complicated than physically seizing the machine, the two said. First, hacking will require the government to have figured out a technical means to gain remote access to the device. Second, government hacking can raise complex legal questions under the Fourth Amendment and other laws. Dozens of federal courts are currently considering the legality.

6. Locate a plaintext copy. Cant get into the device? Find the information somewhere else. The information that investigators are looking for likely exists in an unencrypted version somewhere, Kerr and Schneier suggested; cloud copies are increasingly common. In the San Bernardino case, investigators were able to get iCloud backups of the shooters phone. The information was six weeks out of date which is why the FBI paid for the workaround -- but it still provided insight.

Read the full paper here.

About the Author

Matt Leonard is a reporter/producer at GCN.

Before joining GCN, Leonard worked as a local reporter for The Smithfield Times in southeastern Virginia. In his time there he wrote about town council meetings, local crime and what to do if a beaver dam floods your back yard. Over the last few years, he has spent time at The Commonwealth Times, The Denver Post and WTVR-CBS 6. He is a graduate of Virginia Commonwealth University, where he received the faculty award for print and online journalism.

Leonard can be contacted at mleonard@gcn.com or follow him on Twitter @Matt_Lnrd.

Click here for previous articles by Leonard.

Here is the original post:
6 workarounds for accessing encrypted devices - GCN.com

Examples of free and open-source software – AdCiv

edit Some major free and open source software projects

Main Page > Open collaborative design > Free and open-source software > Examples of free and open-source software

This page lists good quality free and open-source software that anyone can download at no cost and use or modify freely. Plenty more quality open-source software exists this is just an introductory sample. Most of these programs are cross-platform, meaning they can be installed on MS Windows, Mac OS X and Linux.

The software below is not freeware or shareware, which are both significantly different to open source.

See more open-source CMS software here

These are some examples of open-source software that anyone can freely download and use, or even modify, without restriction

Click to enlarge a thumbnail image. Click a second time to get a full resolution image

Click to enlarge a thumbnail image. Click a second time to get full resolution image