Heartbleed prompts joint vendor effort to boost OpenSSL, security

Reeling from the Heartbleed security fiasco, major IT vendors including Microsoft, IBM, Intel, Google and Cisco are backing a Linux Foundation initiative designed to boost open source projects considered critical to the industry.

Under the Core Infrastructure Initiative, these and other tech vendors such as Fujitsu, Facebook, NetApp, Rackspace and VMware will support open source projects with funding and expertise.

Unsurprisingly, the first such project on the list for consideration is OpenSSL, the cryptographic library used by millions of websites to encrypt their communications via SSL (Secure Sockets Layer) and TLS (Transport Layer Security) whose Heartbleed vulnerability sent the entire IT industry into emergency mode earlier this month.

On April 7, it was revealed that a severe flaw that existed since December 2011 in several versions of the OpenSSL had been patched, sending thousands of companies scrambling in turn to patch their websites.

If exploited, the flaw could allow an attacker to steal critical data, such as account and password information, from affected systems.

Open source software projects, like OpenSSL, are developed by communities of volunteer coders, and often only have a handful of full-time staffers working on them. This was the case with OpenSSL.

OpenSSL could receive funding "for key developers" and other resources to improve its security, according to The Linux Foundation, which is organizing the multi-million dollar initiative.

"We are expanding the work we already do for the Linux kernel to other projects that may need support," said Jim Zemlin, executive director of The Linux Foundation, in a statement. "Our global economy is built on top of many open source projects."

Juan Carlos Perez covers enterprise communication/collaboration suites, operating systems, browsers and general technology breaking news for The IDG News Service. Follow Juan on Twitter at @JuanCPerezIDG.

Read the original here:
Heartbleed prompts joint vendor effort to boost OpenSSL, security

Cheap randomness delivers real security

Summary:Modern cryptography protocols require real randomness. Sadly, most Random Number Generators (RNG) are pseudo-random and, therefore, hackable. Here's a cheap RNG for the rest of us.

In the wake of the Snowden revelations it's clear that all communications should be encrypted. But how?

Crypto systems require a public and a private number - and the latter should be totally random. But achieving randomness from a digital system is practically impossible - which is why you see the term "pseudo-random" number generators (p-RNG).

For convenience and cost p-RNGs are commonly used, despite the fact that they repeat their "random" numbers over time. What's needed is a cheap, simple, RNG based on truly random physical phenomena.

Expensive versions of such devices are commercially available. But with the need for billions of RNGs for the Internet of Things, we need cheap, simple and open RNGs.

Which is what researchers Mattia Fabbri and Sergio Callegari of the University of Bologna are proposing in Very Low Cost Entropy Source Based on Chaotic Dynamics Retrofittable on Networked Devices to Prevent RNG Attacks. Think of it as the Raspberry Pi of RNGs - except cheaper.

The details are complex, but the simple explanation is that operation is based on a loop using an Analog to Digital Converter (ADC) hosted on a standard microcontroller. If a large random number is desired, successive random numbers can be accumulated to build one.

The authors have built and tested prototypes that cost less than $10 as opposed to the hundreds or thousands current RNGs cost. Volume could improve prices still further.

Cheap devices need cheap RNGs. The RNGs also need to be open so the security community can determine if they will perform as advertised.

As microcontrollers continue to improve it should be possible to build RNGs into many more devices. The advantage of Fabbri's and Callegari's device is that it should interface easily to the millions of current devices on today's Internet.

See the rest here:
Cheap randomness delivers real security

Everything you need to know about cryptography in 1 hour – Colin Percival – Video


Everything you need to know about cryptography in 1 hour - Colin Percival
Everything you need to know about cryptography in 1 hour Cryptography is hard. It usually takes many years of study before it is possible to make any serious...

By: Polyglot Software Association

Original post:
Everything you need to know about cryptography in 1 hour - Colin Percival - Video

Edward Snowden is more narcissist than patriot – Chicago …

Watching Edward Snowden is interesting for me.

In the 1990s, freshly graduated from a top liberal arts college, I found myself in a job with a Top Secret security clearance. I would have loved to brag to my former classmates and the rest of the world about my newly won privilege of poring over state secrets. But in one of the more stifling parts of the job, we were sworn to keep the work to ourselves.

I thought about this recently while watching "Citizenfour," Laura Poitras' fawning Snowden documentary sure to earn an Oscar nomination next month. The documentary leaves out how Snowden bristles at the title of "low-level systems analyst" that he was given by the government he betrayed. Reflexively (and pompously) he continually cites in other interviews the "undercover and overseas" work he claims to have done not for one but for three spy agencies, including the CIA.

I can sort of relate: I remember taking umbrage when someone passed me off as a bureaucrat.

But Snowden exhibits a strain of narcissism common among people in the intelligence community clinging to the mystique that comes with the title of intelligence analyst. "Spies" desperately also want to live public lives. The urge to tell all is usually kept in check by the threat of imprisonment, the potential destruction of one's family over spilled secrets or simple worry of losing a secure job a concern that looms large among this group of federal workers with nontransferable experience.

Most analysts' circumspection, however, is rooted in an admission, deep down in places we didn't like to talk about, that the work of the individual spy does very little to safeguard the nation.

At college reunions, and even with our own families, those of us in the "futures" intelligence game anyway found clever ways to boast while concealing we were tilting at windmills between the fall of the Berlin Wall and the totally unpredicted fall of the World Trade Center towers.

Forecasting what military capabilities hostile nations might have in 20 years was the mandate for futures intelligence in 1995, when I was in the business. America needed to build the machinery of war not to counter what menacing devices the world already had but what it was likely to face by some milestone date: 2015 was the magical year.

For a 20-something with inflated notions of safeguarding democracy, my security clearances were keys to imagining the next big threat to the United States after the Cold War. Top Secret "Special Compartmented Information," while detailed and in some cases hard-won by sources in the field, was in the end of very little help, or worse, sent the defense industry down the wrong path of readying power to meet threats we mis-imagined.

Twenty years ago there were more than 600 submarines in the inventories of more than 40 nations, some of them belonging to "rogue" nations such as Libya and Iran. It was only a footnote that many were rusting in port. The Defense Department's impressive-sounding Quadrennial Defense Review of 1996, the first review requested by Congress since the collapse of the Soviet Union, coursed through the Pentagon's inner rings with a tired tallying of global military assets, particularly in East Asia.

Excerpt from:
Edward Snowden is more narcissist than patriot - Chicago ...

Snowden reveals how to go ‘level 5′, give the NSA fits

Nate Swanner

In the wake of Edward Snowden once again making revelations about the NSAs widespread and troubling spying and information gathering, were getting a better idea of the lengths the United States Government agency went through to soak in knowledge. Were also finding out how hard it can be to get the information they desire. Though a single secure system may be easy to crack, Snowden says a layering of several might actually render you totally safe from the prying eyes of big brother.

According to Snowden, the NSA had a ranking system for those programs they wanted to hack. Some, like messaging apps, typically fall under level one, which is trivial. those would be easiest to snoop on.

Level five, however, is labeled as catastrophic. That is the hardest sometimes impossible protection layer, but also rarely comes via a single app or system.

When a few harder-to-crack layers were put together, the security was about as airtight as we can get as citizens. For instance, taking something like Tor and using it along with Zoho would fragment and encrypt your info to the point that piecing it together becomes extremely difficult.

The NSA also had trouble with Truecrypt, which encrypted files on your computer straight away. While none alone gave the NSA trouble beyond level four, or major, a combination could send a user into level five, giving the NSA fits.

Source: Der Spiegel

Here is the original post:
Snowden reveals how to go ‘level 5′, give the NSA fits

Backlash in Berlin over NSA spying recedes as threat from Islamic State rises

BERLIN In a crescendo of anger over American espionage, Germany expelled the CIAs top operative, launched an investigation of the vast U.S. surveillance programs exposed by Edward Snowden and extracted an apology from President Obama for the years that U.S. spies had reportedly spent monitoring German Chancellor Angela Merkels cellphone.

In an address to Parliament last year, Merkel warned that U.S.-German cooperation would be curtailed and declared that trust needs to be rebuilt.

But the cooperation never really stopped. The public backlash over Snowden often obscured a more complicated reality for Germany and other aggrieved U.S. allies. They may be dismayed by the omnivorous nature of the intelligence apparatus the United States has built since the Sept. 11, 2001, attacks, but they are also deeply dependent on it.

Over the past year, Germany has secretly provided detailed information to U.S. spy services on hundreds of German citizens and legal residents suspected of having joined insurgent groups in Syria and Iraq, U.S. and German officials said.

Germany has done so reluctantly to enlist U.S. help in tracking departed fighters, determining whether they have joined al-Qaeda or the Islamic State and, perhaps most importantly, whether they might seek to bring those groups violent agendas back to Germany.

The stream of information includes names, cellphone numbers, e-mail addresses and other sensitive data that German security services ever mindful of the abuses by the Nazi and Stasi secret police have been reluctant even to collect, let alone turn over to a suspect ally.

A senior German intelligence official compared the U.S. relationship to a dysfunctional marriage in which trust has bottomed out but a breakup is not an option. Amid what Germans see as evidence of repeated betrayal, the question remaining is whether the husband is a notorious cheater or can be faithful again, said the official, who like others interviewed for this article spoke on the condition of anonymity to discuss intelligence matters. Were just going to have to give it another try. There is no alternative. Divorce is out of the question.

More than 550 German citizens have gone to Syria, officials said, and at least nine have killed themselves in suicide attacks.

The exodus is part of a much broader flow of more than 15,000 foreign fighters who have entered Syria over the past four years from 80 countries. At least 3,000 of them are from Europe the largest contingent of Islamist jihadists with Western passports that counterterrorism agencies have ever faced.

As a result, nearly every country in Europe is turning over significant data on their own departed fighters to the United States. Some of these nations, including Germany, have capable security and intelligence agencies of their own. But even their combined resources probably cannot match the scope and reach of their U.S. counterparts.

Excerpt from:
Backlash in Berlin over NSA spying recedes as threat from Islamic State rises