Sinister Security: NSA

Don’t freak out about Facebook messenger app, NSA already has your chats

Read

Don’t freak out about Facebook messenger app, NSA already has your chats

Privacy concerns over the Facebook Chat App is at an all time high. Increasingly more and more people are voicing their concern and even their anger at the permissions needed from the user in order to use the App.

Although the App was released some time ago, it wasn’t until Facebook took away end user choice and made the App mandatory that the concerns began to materialize and spread like wildfire on social media and blogs alike.

The permissions of the App have never changed. It has always required autonomous access without user confirmation to the device’s microphone and camera. The hysteria currently can only be attributed to the numerous Social Media posts and blogs informing people who were otherwise uninformed. Also as the masses become more tech savvy where Apps and Smart Phones are concerned, what was once ignored (permissions) are no longer being so and end users are taking a keener interest in what an App requires before they download it onto their devices.

The saying there is no such thing as a free lunch is not immune to the fluid world that is App Developing. Someone has to pay. Someone foots the bill and as much as we all love a free lunch we must accept that someone somewhere has to pick up the tab in the case of Apps, the price to be paid is allowing access to devices we once cherished as our own private tech domain because our private data needs to be monetized so that the free lunch can be paid somewhere along the line.

When one looks at this logically, people should not worry about the problem of a private company prying because NSA is looking after the issue. Recently a former director of the NSA disclosed the fact that agency (according to the law) can gain access to a wealth of data from companies but it has no power to take data of US citizens. The clever way to get access to the data of people is to get it from companies. Bearing this in mind, becoming hysterical about Facebook should be the least of your concern.

Let us not forget Snowden who revealed how the NSA workers often stumble upon people’s nude photos which they often pass around to others in the office. How do they get hold of your private pictures? ring a bell?

James Buchal (candidate for Congress in Oregon) has an excellent powerpoint presentationthat outlines the privacy invasions of the NSA. Here are a few slides:

Now people can understand why Facebook is spending so much money and offering everything for free. Some experts claim that Facebook is earning through advertising but the amount the company receives from government agencies is significantly higher than the amount that Facebook earns through advertising. Conclusively, the people may not know that NSA already has access to their data and chats. Thus, logic suggests that if all the data is already disclosed then there is no need to worry about any other app doing the same.

The new Facebook chat app has become an inseparable part of people’s life. Clearly, all of the fuss is useless. Can they beat giant corporations? Can they win against NSA or government agencies? If this is a lose-lose situation then they should not worry about the Facebook chat app. It is here to stay and people are still left with a choice; give up on privacy or stop using Facebook. Which is more important to you Facebook or Privacy?

In addition, people happily give away valuable information and talk about their private lives, post pictures of their children and even nudes of themselves. They do all this voluntarily and without concern but now they take a aggressive stance regarding privacy because Facebook is forcefully retrieving their data? Facebook probably retrieves less data than people have already put out there freely and without concern.

Is it that people are concerned about privacy or simply jumping on a band wagon or even succumbing to the Anti Big Corporation movement? Either way people STILL have a choice quit complaining or quit Facebook. It’s about priority. Which is yours? Privacy or the ability to use Facebook?

Read More Add comment

Post-September 11, NSA ‘enemies’ include us

By 0x000216

Read

0 Comments

James Bamford
Politico

Somewhere between Sept. 11 and today, the enemy morphed from a handful of terrorists to the American population at large, leaving us nowhere to run and no place to hide.

Within weeks of the attacks, the giant ears of the National Security Agency, always pointed outward toward potential enemies, turned inward on the American public itself. The Foreign Intelligence Surveillance Court, established 23 years before to ensure that only suspected foreign agents and terrorists were targeted by the NSA, would be bypassed. Telecom companies, required by law to keep the computerized phone records of their customers confidential unless presented with a warrant, would secretly turn them over in bulk to the NSA without ever asking for a warrant.

Around the country, in tall, windowless telecom company buildings known as switches, NSA technicians quietly began installing beam-splitters to redirect duplicate copies of all phone calls and email messages to secret rooms behind electronic cipher locks.

There, NSA software and hardware designed for “deep packet inspection” filtered through the billions of email messages looking for key names, words, phrases and addresses. The equipment also monitored phone conversations and even what pages people view on the Web — the porn sites they visit, the books they buy on Amazon, the social networks they interact with and the text messages they send and receive.

Because the information is collected in real time, attempting to delete history caches from a computer is useless.

At the NSA, thousands of analysts who once eavesdropped on troop movements of enemy soldiers in distant countries were now listening in on the bedroom conversations of innocent Americans in nearby states.

“We were told that we were to listen to all conversations that were intercepted, to include those of Americans,” Adrienne Kinne, a former NSA “voice interceptor,” told me. She was recalled to active duty after Sept. 11.

“Some of those conversations are personal,” she said. “Some even intimate. … I had a real problem with the fact that people were listening to it and that I was listening to it. … When I was on active duty in ’94 to ’98, we would never collect on an American.”

Despite his hollow campaign protests, President Barack Obama has greatly expanded what President George W. Bush began. And through amendments to the Foreign Intelligence Surveillance Act, Congress largely ratified the secret Bush program.

So much intercepted information is now being collected from “enemies” at home and abroad that, in order to store it all, the agency last year began constructing the ultimate monument to eavesdropping. Rising in a remote corner of Utah, the agency’s gargantuan data storage center will be 1 million square feet, cost nearly $2 billion and likely be capable of eventually holding more than a yottabyte of data — equal to about a septillion (1,000,000,000,000,000,000,000,000) pages of text.

Read Full Article

var linkwithin_site_id = 557381;

linkwithin_text=’Related Articles:’

Read More Add comment

Obama administration won’t reveal how many Americans’ emails the NSA has reviewed without warrants

By 0x000216

Read

0 Comments

Trevor Timm
EFF

Since last year, a few members of Congress—led by Senator Ron Wyden—have been trying to get the Obama administration to answer a simple question: how many Americans’ phone calls or emails have been and are being collected and read without a warrant under the authority of the FISA Amendments Act of 2008 (FAA)? Unfortunately, no one else in the government seems to want that question answered.

The question arose soon after Congress passed the FAA, which among other things sought to create immunity for telecoms that helped the NSA conduct warrantless wiretapping and gutted privacy protections for Americans communicating overseas. A New York Times investigation described how, under the FAA, a “significant and systemic” practice of “overcollection” of communications resulted in the NSA’s intercepting millions of purely domestic emails and phone calls between Americans. In addition, documents obtained via a Freedom of Information Act request by the ACLU, although heavily redacted, revealed “that violations [of the FAA and the Constitution] continued to occur on a regular basis through at least March 2010”— the last month anyone has public data for.

The FISA Amendments Act is currently up for renewal, and Sen. Wyden, along with Sen. Mark Udall, wants the NSA answer questions about these violations before Congress extends the law for five more years. “We have concluded… that section 702 [of the Act] currently contains a loophole that could be used to circumvent traditional warrant protections and search for the communications of a potentially large number of American citizens,” the Senators alleged.

Yet not only have changes not been made to the law to address this vital concern, but the administration refuses to give the Senators any information on whether they’re correct. Back in July 2011, the Office of the Director of National Intelligence told them “it is not reasonably possible to identify the number of people located in the United States whose communications may have been reviewed” under the FAA.

Well, what about just a rough estimate? Last week, the Inspector General of the Intelligence Community officially responded for himself and the NSA Inspector General: “such an estimate was beyond the capacity of his [the NSA IG’s] office and dedicating sufficient additional resources would likely impede the NSA’s mission.” Then, almost unbelievably, the NSA IG excused itself further from oversight by saying that “an IG review of the sort suggested would itself violate the privacy of U.S. persons.”

That’s right. The government says that it would violate Americans’ privacy for the NSA’s inspector general to estimate how many Americans’ privacy have been violated by the NSA.

The loophole that Wyden is likely talking about appears to be so-called “back door” searches. As Wyden explains it, since communications are sucked up without an individual warrant under the FAA, there must “be clear rules prohibiting the government from searching through these communications in an effort to find the phone calls or emails of a particular American, unless the government has obtained a warrant or emergency authorization permitting surveillance of that American.” The Senate Select Committee on Intelligence (SSCI) rejected an amendment stating that as well. SSCI chairman Dianne Feinstein insisted no such loophole existed, but still refused to support the amendment that would have cleared up any ambiguity.

In response, Sen. Ron Wyden commendably put a ‘hold’ on the FAA’s reauthorization in the Senate—a procedural maneuver that will at least temporarily keep the bill from going forward without debate—citing the potential massive privacy violations that the government will not explain to the American public.

Unfortunately, the House has so far refused to compel such information as well. Two weeks ago, the House Judiciary Committee passed the re-authorization of the FISA Amendments Act 23-11, yet voted down all amendments that would have forced the government to be more transparent about the communications it had collected.

Rep. Jackson-Lee’s amendment—similar to Sen. Wyden’s request—for an “estimate” on how many times Americans’ emails have been read without a warrant was rejected, despite testimony from ACLU’s Jameel Jaffer laying out all the evidence that dragnet surveillance of American’s communcations was rampant. The Judiciary committee also rejected an amendment requiring the release of redacted FISA rulings—which are all classified—and a shorter re-authorization period.

Secret $1.8 Million Cryptocurrency Script

Yesterday, the House Permanent Select Committee on Intelligence (HPSCI) did the same thing, unanimously voting to extend the law for five years as well—again, with no known changes—and in secret.

These bills both still need to be voted on by the full House and Senate before going to the President’s desk, and without amendments adding robust oversight, transparency, and privacy protections, they should be voted down. Please call your member of Congress and tell them you strenously oppose the reauthorization of the FISA Amendments Act.

Please visit Electronic Frontier Foundation to support internet freedom and privacy.

You can share this information by voting on Reddit HERE

var linkwithin_site_id = 557381;

linkwithin_text=’Related Articles:’

/* */

/* */

Read More Add comment

Congress Must Act After US Government Admits To Unconstitutional Warrantless Wiretapping

By 0x000216

Read

0 Comments

Trevor Timm
EFF

As Congress and the President rush to re-authorize the dangerous FISA Amendments Act (FAA)—the law shamefully passed after pressure to legalize certain portions of the NSA’s warrantless wiretapping program—EFF has been sounding the alarm that Americans’ communications are still being unconstitutionally collected by the government without a warrant. On Friday, the Office of the Director of National Intelligence, (DNI) begrudgingly agreed, acknowledging that, “on at least one occasion” the secret FISA court “held that some collection…used by the government was unreasonable under the Fourth Amendment.”

In a letter to Sen. Ron Wyden (D-OR), the DNI declassified three statements at the request of the Senator, one of which indicated that the FISA Court agreed with Wyden that the government had “circumvented the spirit of the law.” Wired called it a “federal sidestep of a major section of the Foreign Intelligence Surveillance Act,” and the Wall Street Journalconfirmed it “represented the first time the government has acknowledged U.S. spy activities violated the constitution since the passage of” the FAA in 2008.

This is vital information, as Congress is in the midst of debate over extending Section 702 of the FAA before it expires at the end of the year. Section 702 severely weakened privacy protections for Americans communicating overseas, and may have swallowed protections against surveillance of our domestic communications as well.

But it’s also important to take a step back here to understand how we know this and why that process is deeply troubling. Apparently, the secret FISA court—at some point—ruled that the government was violating the Constitution. When? We have no idea. How many Americans were affected? We don’t know that either. As Cato Institute’s Julian Sanchez pointed out, these requests can be incredibly broad—a single incident could potentially impact millions of Americans. Were there any remedies or was the NSA just given a slap on the wrist? Again, we don’t know.

And remember, the declassified statement says “on at least one occasion” so there very likely could be more. Previously, the NSA told Sen. Wyden it was not possible to count the number of Americans affected by FAA surveillance. Rather unbelievably, the NSA also stated that even a general estimate of how many people the NSA had spied on would somehow violate the privacy of those same Americans.

Wyden had been warning the American people for months in vague terms that the government was overstepping its bounds in its interpretation of 702. Now, the only reason we’ve learned the barest minimum about of the sidestepping of a public law and the Bill of Rights is becausethe very same government agency that was responsible for the wrongdoing allowed it.

Congress can and should force the administration to answer all of these questions in public, so that we can allow the democratic process to determine whether 702 should be extended.

Of course, many major news outlets had been reporting since just after the FAA passed (here,here, and here for starters) that Americans’ communications were still being collected by the NSA without a warrant. Yet Congress has steadfastly refused to fix the problem. Both House and Senate committees recently voted down amendments that would have added privacy safeguards and transparency requirements to the law, claiming no such evidence existed.

Sen. Wyden, on the other hand, has been alleging that “section 702 [of the Act] currently contains a loophole that could be used to circumvent traditional warrant protections and search for the communications of a potentially large number of American citizens.” But Wyden’s amendment that would have required a warrant to search the communications of a specific American was voted down 13-2 after Intelligence committee chairman Dianne Feinstein insisted there was no such loophole. Sen. Feinstein’s assurances seem to conflict with the DNI’s statement.

Similarly, when Rep. John Conyers implored his House colleagues to vote for an amendment requiring the government give a general estimate how many times Americans’ communications had been collected without a warrant, Rep. Dan Lungren (R-California) shot back: “What evidence is there that it is being used to spy on Americans?” The amendment failed 11-20.

Secret $1.8 Million Cryptocurrency Script

Congress may be able to ignore reports in the media that the NSA is still collecting Americans’ emails, but it should not ignore the admission from the DNI itself. Congress must now drastically overhaul this law to prevent further abuses of the Constitution or vote down entirely.

Please visit Electronic Frontier Foundation to support Internet freedom and privacy.

You can support this information by voting on Reddit HERE

var linkwithin_site_id = 557381;

linkwithin_text=’Related Articles:’

/* */

/* */

Read More Add comment

5 Major Reasons The NSA Can’t Be Trusted to Run U.S. Cybersecurity Programs

By 0x000216

Read

0 Comments

EFF

This week, the Senate will be voting on a slew of amendments to the newest version of the Senate’s cybersecurity bill. Senators John McCain and Kay Bailey Hutchison have proposed several amendments that would hand the reins of our nation’s cybersecurity systems to the National Security Agency (NSA). All of the cybersecurity bills that have been proposed would provide avenues for companies to collect sensitive information on users and pass that data to the government. Trying to strike the balance between individual privacy and facilitating communication about threats is a challenge, but one thing is certain: the NSA has proven it can’t be trusted with that responsibility. The NSA’s dark history of repeated privacy violations, flouting of domestic law, and resistance to transparency makes it clear that the nation’s cybersecurity should not be in its hands.

In case you need a refresher, here’s an overview of why handing cybersecurity to the NSA would be a terrible idea:

1. An executive order generally prohibits NSA from conducting intelligence on Americans’ domestic activities

Executive Order 12333 signed by President Reagan in 1981 (and amended a few times since1), largely prohibits the NSA from spying on domestic activities:

no foreign intelligence collection by such elements [of the Intelligence Community] may be undertaken for the purpose of acquiring information concerning the domestic activities of United States persons.

If amended, the Cybersecurity Act would allow the NSA to gain information related to “cybersecurity threat indicators,” which would allow it to collect vast quantities of data that could include personally identifiable information of U.S. persons on American soil. Law enforcement and civilian agencies are tasked with investigating and overseeing domestic safety. The NSA, on the other hand, is an unaccountable military intelligence agency that is supposed to focus on foreign signals intelligence—and it’s frankly dangerous to expand the NSA’s access to information about domestic communications.

2. NSA has a dark history of violating Americans’ constitutional rights

In the 1960’s, a Congressional investigation, led by four-term Senator Frank Church, found that the NSA had engaged in widespread and warrantless spying on Americans citizens. Church was so stunned at what he found, he remarked that the National Security Agency’s “capability at any time could be turned around on the American people, and no American would have any privacy left, such is the capability to monitor everything.” (emphasis added) The investigation led to the passage of the Foreign Intelligence Surveillance Act, which provided stronger privacy protections for Americans’ communications—that is, until it was weakened by the USA-PATRIOT Act and other reactions to 9/11.

3. NSA has continued its warrantless wiretapping scandal

In 2005, the New York Times revealed that the NSA set up a massive warrantless wiretapping program shortly after 9/11, in violation of the Fourth Amendment and several federal laws. This was later confirmed by virtually every major media organization in the country. It led to Congressional investigations and several ongoing lawsuits, including EFF’s. Congress passed the FISA Amendments Act to grant telecom companies retroactive immunity for participating in illegal spying and severely weaken privacy safeguards for Americans communicating overseas.Since the FISA Amendments Act (FAA) passed, the NSA has continued collecting emails of Americans. A 2009 New York Times investigation described how a “significant and systemic” practice of “overcollection” of communications resulted in the NSA’s intercepting millions of purely domestic emails and phone calls between Americans. In addition, documents obtained via a Freedom of Information Act request by the ACLU, although heavily redacted, revealed “that violations [of the FAA and the Constitution] continued to occur on a regular basis through at least March 2010″— the last month anyone has public data for.

4. NSA recently admitted to violating the Constitution.

Secret $1.8 Million Cryptocurrency Script

Just last week, the Office of the Director of National Intelligence—which oversees the NSA—begrudgingly acknowledged that “on at least one occasion” the secret FISA court “held that some collection… used by the government was unreasonable under the Fourth Amendment.” Wired called it a “federal sidestep of a major section of the Foreign Intelligence Surveillance Act,” and it confirmed the many reports over the last few years: the NSA has violated the Constitution.

5. NSA keeps much of what it does classified and secret

Because cybersecurity policy is inescapably tied to our online civil liberties, it’s essential to maximize government transparency and accountability here. The NSA may be the worst government entity on this score. Much of the NSA’s work is exempt from Freedom of Information Act (FOIA) disclosure because Congress generally shielded NSA activities from FOIA2. Even aside from specific exemption statutes, much information about NSA activities is classified on national security grounds. The NSA has also stonewalled organizations trying to bring public-interest issues to light by claiming the “state secrets” privilege in court. EFF has been involved in lawsuits challenging the NSA’s warrantless surveillance program since 2006. Despite years of litigation, the government continues to maintain that the “state secrets” privilege prevents any challenge from being heard. Transparency and accountability simply are not the NSA’s strong suit.

We remain unconvinced that we need any of the proposed cybersecurity bills, but we’re particularly worried about attempts to deputize the NSA as the head of our cybersecurity systems. And even the NSA has admitted that it does “not want to run cyber security for the United States government.”

Thankfully, new privacy changes in the cybersecurity bill heading towards the Senate floor have explicitly barred intelligence agencies like the NSA from serving as the center of information gathering for cybersecurity. We need to safeguard those protections and fend off amendments that give additional authority to the NSA. We’re asking concerned individuals to use our Stop Cyber Spying tool to tweet at their Senators or use the American Library Association’s simple tool to call Senators. We need to speak out in force this week to ensure that America’s cybersecurity systems aren’t handed to the NSA.

You can support this information by voting on Reddit HERE

Please visit and support Electronic Frontier Foundation for Internet freedom and privacy.

var linkwithin_site_id = 557381;

linkwithin_text=’Related Articles:’

/* */

/* */

Read More Add comment

ALERT: CISPA Amendment Won’t Stop Data Going to the NSA

By 0x000216

Read

0 Comments

Read More Add comment

How The NSA Deploys Malware: An In-Depth Look at the New Revelations

By 0x000216

Read

0 Comments

Image

Dan Auerbach
Electronic Frontier Foundation

We’ve long suspected that the NSA, the world’s premiere spy agency, was pretty good at breaking into computers. But now, thanks to an article by security expert Bruce Schneier—who is working with the Guardian to go through the Snowden documents—we have a much more detailed view of how the NSA uses exploits in order to infect the computers of targeted users. The template for attacking people with malware used by the NSA is in widespread use by criminals and fraudsters, as well as foreign intelligence agencies, so it’s important to understand and defend against this threat to avoid being a victim to the plethora of attackers out there.

How Does Malware Work Exactly?

Deploying malware over the web generally involves two steps. First, as an attacker, you have to get your victim to visit a website under your control. Second, you have to get software—known as malware—installed on the victim’s computer in order to gain control of that machine. This formula isn’t universal, but is often how web-based malware attacks proceed.

In order to accomplish the first step of getting a user to visit a site under your control, an attacker might email the victim text that contains a link to the website in question, in a so-called phishing attack. The NSA reportedly uses phishing attacks sometimes, but we’ve learned that this step usually proceeds via a so-called “man-in-the-middle” attack.1 The NSA controls a set of servers codenamed “Quantum” that sit on the Internet backbone, and these servers are used to redirect targets away from their intended destinations to still other NSA-controlled servers that are responsible for the injection of malware. So, for example, if a targeted user visits “yahoo.com”, the target’s browser will display the ordinary Yahoo! landing page but will actually be communicating with a server controlled by the NSA. This malicious version of Yahoo!’s website will tell the victim’s browser to make a request in a background to another server controlled by the NSA which is used to deploy malware.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
(adsbygoogle = window.adsbygoogle || ).push({});

Once a victim visits a malicious website, how does the attacker actually infect the computer? Perhaps the most straightforward method is to trick the user into downloading and running software. A cleverly designed pop-up advertisement may convince a user to download and install the attacker’s malware, for example.

But this method does not always work, and relies on a user taking action to download and run software. Instead, attackers can exploit software vulnerabilities in the browser that the victim is using in order to gain access to her computer. When a victim’s browser loads a website, the software has to perform tasks like parsing text given to it by the server, and will often load browser plugins like Flash that run code given to it by the server, in addition to executing Javascript code given to it by the server. But browser software—which is becoming increasingly complex as the web gains more functionality—doesn’t work perfectly. Like all software, it has bugs, and sometimes those bugs are exploitable security vulnerabilities that allow an attacker to gain access to a victim’s computer just because a particular website was visited. Once browser vendors discover vulnerabilities, they are generally patched, but sometimes a user has out of date software that is still vulnerable to known attack. Other times, the vulnerabilities are known only to the attacker and not to the browser vendor; these are called zero-day vulnerabilities.

The NSA has a set of servers on the public Internet with the code name “FoxAcid” used to deploy malware. Once their Quantum servers redirect targets to a specially crafted URL hosted on a FoxAcid server, software on that FoxAcid server selects from a toolkit of exploits in order to gain access to the user’s computer. Presumably this toolkit has both known public exploits that rely on a user’s software being out of date, as well as zero-day exploits which are generally saved for high value targets.2 The agency then reportedly uses this initial malware to install longer lasting malware.

Once an attacker has successfully infected a victim with malware, the attacker generally has full access to the user’s machines: she can record key strokes (which will reveal passwords and other sensitive information), turn on a web cam, or read any data on the victim’s computer.

What Can Users Do To Protect Themselves?

We hope that these revelations spur browser vendors to action, both to harden their systems against exploits, and to attempt to detect and block the malware URLs used by the FoxAcid servers.

In the meantime, users concerned about their security should practice good security hygiene. Always keep your software up to date—especially browser plugins like Flash that require manual updates. Make sure you can distinguish between legitimate updates and pop-up ads that masquerade as software updates. Never click a suspicious looking link in an email.

For users who want to go an extra step towards being more secure—and we think everyone should be in this camp—consider making plugins like Flash and Java “click-to-play” so that they are not executed on any given web page until you affirmatively click them. For Chromium and Chrome, this option is available in Settings => Show Advanced Settings => Privacy => Content Settings => Plug-ins. For Firefox, this functionality is available by installing a browser Add-On like “Click to Play per-element”. Plugins can also be uninstalled or turned off completely. Users should also use ad blocking software to stop unnecessary web requests to third party advertisers and web trackers, and our HTTPS Everywhere add-on in order to encrypt connections to websites with HTTPS as much as possible.

Secret $1.8 Million Cryptocurrency Script

Finally, for users who are willing to notice some more pain when browsing the web, consider using an add-on like NotScripts (Chrome) or NoScript (Firefox) to limit the execution of scripts. This means you will have to click to allow scripts to run, and since Javascript is very prevalent, you will have to click a lot. For Firefox users, RequestPolicy is another useful add-on that stops third-party resources from loading on a page by default. Once again, as third-party resources are popular, this will disrupt ordinary browsing a fair amount. Finally, for the ultra paranoid, HTTP Nowhere will disable all HTTP traffic completely, forcing your browsing experience to be entirely encrypted, and making it so that only websites that offer an HTTPS connection are available to browse.

Conclusion

The NSA’s system for deploying malware isn’t particularly novel, but getting some insight into how it works should help users and browser and software vendors better defend against these types of attacks, making us all safer against criminals, foreign intelligence agencies, and a host of attackers. That’s why we think it’s critical that the NSA come clean about its capabilities and where the common security holes are—our online security depends on it.

1.The term “man-in-the-middle” is sometimes reserved for attacks on cryptographically secure connections, for example using a fraudulent SSL certificate. In this context, however, we mean it more generally to mean any attack where the attacker sits between the victim and the intended website.

2.According to the Guardian article, “the most valuable exploits are saved for the most important targets.”

/* */

/* */

Read More Add comment

To Spy or Not to Spy; Congress to Decide

By 0x000216

Read

0 Comments

To Spy or Not to Spy; Congress to Decide

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

Dec 31st was the expiry date for section702 of the Foreign Intelligence Surveillance Act (FISA). Tech groups have been bandied together to remind Congress that the decision to extend the act should not be taken so lightly. And there should be an open debate rather than a rubber stamp to the provision which allows the National Security Agency to spy on people overseas.

There are six major tech groups gathered together so far to fight the imminent extension of the Act; these include BSA, the Consumer Technology Association as well as the Computer and Communications Industry Association.

In a recent letter (Pdf) to Congress, they stated that “In our view, it is critical that Congress takes a balanced yet focused approach with respect to Section 702.”

Further requesting measures should be taken by the committee to ensure transparency and accountability, and a commitment to continued Congressional oversight.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

There were no demands or ideas for further amendments to the act just certain points reminding the committee members of their obligations to protect internet users privacy and civil liberties by including meaningful safeguards if there is to be any reauthorization of the act.

Many civil liberties groups and activists have joined to form End 702, they are more forthcoming saying “Absent a full reform” the act needs to expire. Further stating on their website “Section 702 of FISA has allowed for mass surveillance programs, including PRISM and UPSTREAM, that have been used by the US government to warrantlessly collect and search the Internet communications of people all over the world.”

The NSA Prism internet surveillance program first came to prominence when revealed by the infamous NSA whistleblower Edward Snowdon. Revelations that showed section 702 of FISA allowed the NSA to hoard data of American citizens whether home or abroad, this was originally defended by President Obama saying it was necessary to protect against terrorism.

U.S. intelligence agencies further defended this as being essential to combat security threats. In a committee hearing last May, Matthew Olsen an executive with IronNet Cybersecurity explained that as the director of the National Counterterrorism Centre he was informed of dozens of terrorist plots which were thwarted due to NSA surveillance. As well as stressing it was vital to our security.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

But with the explosion of the use of encryption apps such Signal and Confide, who use state of the art, end to end encryption. Furthermore, Confide has a default feature which automatically self-destructs messages. Is this the tech world’s way of fighting back without having to battle in court or draw blood.

Source: CciaNet (PDF) | Coverage: PC World | Image Via: Flickr/FJ

DDoS attacks are increasing, calculate the cost and probability of a DDoS attack on your business with this DDoS Downtime Cost Calculator.

Read More Add comment

Notepad++ Issues Fix After CIA Attack Revealed in Vault7 Documents

By 0x000216

Read

0 Comments

Notepad++ Issues Fix After CIA Attack Revealed in Vault7 Documents

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

On 7th Match 2017, the whistle-blowing organization Wikileaks published a series of new documents code-named “Vault 7” allegedly belonging to the U.S. Central Intelligence Agency (CIA). These documents not only revealed the existence of a large-scale cyber espionage campaign but also show how the agency used zero days security flaws in Windows, macOS, Linux, iPhones, Android devices, several other high-profile software and utilities including Notepad and video player VLC (“VideoLan”).

Now, VLC has issued an official statement on the matter while Notepad++ has released patches since its name was on the list of hacking tools used by the CIA to target unsuspecting Windows users.

Notepad++ statement:

In their official blog post Notepad++ said that:

The issue of a hijacked DLL concerns scilexer.dll (needed by Notepad++) on a compromised PC, which is replaced by a modified scilexer.dll built by the CIA. When Notepad++ is launched, the modified scilexer.dll is loaded instead of the original one.

It doesn’t mean that CIA is interested in your coding skill or your sex message content in Notepad++, but rather it prevents raising any red flags while the DLL does data collection in the background.

It’s not a vulnerability/security issue in Notepad++, but for remedying this issue, from this release (v7.3.3) forward, notepad++.exe checks the certificate validation in scilexer.dll before loading it. If the certificate is missing or invalid, then it just won’t be loaded, and Notepad++ will fail to launch.

Checking the certificate of DLL makes it harder to hack. Note that once users’ PCs are compromised, the hackers can do anything on the PCs. This solution only prevents from Notepad++ loading a CIA homemade DLL. It doesn’t prevent your original notepad++.exe from being replaced by modified notepad++.exe while the CIA is controlling your PC.

Just like knowing the lock is useless for people who are willing to go into my house, I still shut the door and lock it every morning when I leave home. We are in a f**king corrupted world, unfortunately.

Otherwise, there are a lot of enhancements and bug fixes which improve your Notepad++ experience. For all the detail change log, please check on the Download page.”

Screenshot from Vault 7 leaks about Notepad ++ / Source: Wikileaks

Notepad users are advised to download its latest 7.3.3 version from here and also report any bug they find on Notepad++ forum.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

VideoLAN’s statement:

One of the leaked Vault7 documents revealed that CIA is using fake VLC players to steal data from an infected device. The document further revealed that CIA agents used a tool to exploit a modified old version of VLC media player. The described tool gathers documents from a computer or network and, to hide its activity, runs inside VLC Portable 2.1.5 on Microsoft Windows platforms. Such modified software provides a legitimate appearance (plays media files) while scanning the computer or the network for its intelligence purpose.

In their official statement [Pdf], the developers of VLC player VideoLAN said that the company is taking the revelation seriously. However, it must be noted that this is not an actual vulnerability in VLC but a result of downloading the set up from untrusted sources.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

VicdeoLAN further explains that:

The technique used is a modification of the software’s manifest to force the loading of a fake dynamic library “psapi.dll,” instead of using the official Windows version. This DLL contains the malware’s executable code. The attack described in the leaked document requires • physical access to the targeted computer, • Microsoft Windows XP or later host system, • and execution of the tool allegedly developed by the CIA (provided on “thumb drive”, but not exclusively).

[…]

We would like to bring to your attention that this exploit is nothing different than installing a trojaned software from an untrusted source. The only safe source for getting VLC media player is the official VideoLAN website. Security of our users’ data is of prime importance. As a consequence, we have taken countermeasures to prevent malware from hiding their activity behind VLC media player.

The used attack vector modification will not be possible starting from the next minor release, 2.2.5. We are also working on hardening the VLC security for the next major releases (3.x.x).

Screenshot from Vault 7 leaks about VLC player / Source: Wikileaks

If you are using VLC player make sure you have its updated version and if you plan to download its setup do that from VideoLan’s official website.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

More: Wikileaks Support Account Deletes Tweet about Making Database of Verified Accounts

DDoS attacks are increasing, calculate the cost and probability of a DDoS attack on your business with this DDoS Downtime Cost Calculator.

Read More Add comment

Unprotected S3 Cloud Bucket Exposed 100GB of Classified NSA Data

By 0x000216

Read

0 Comments

Unprotected S3 Cloud Bucket Exposed 100GB of Classified NSA Data

Another day another massive trove of sensitive NSA data exposed online – This time, security firm UpGuard’s Cyber Risk team has identified yet another unsecured AWS (Amazon Web Service) S3 cloud storage bucket containing sensitive, confidential data that belongs to the joint command of National Security Agency (NSA) and US Defense Department called the United States Army Intelligence and Security Command (INSCOM).

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

The server was discovered on September 27th, 2017 by the Director of Cyber Risk Research at UpGuard, Chris Vickery. The bucket is configured to allow public access to exclusive intelligence information gathered by INSCOM for political leaders and US military. The repository is located at the subdomain “inscom” at AWS, and it contains around 47 viewable files and folders out of which three are downloadable as well.

The bucket’s most valuable asset is the downloadable virtual hard drive that was used for recording communications within protected federal IT environments. When opened, the drive displays confidential information titled NOFORN, which indicates that the information is highly sensitive and prohibited from being accessed by even foreign allies. Furthermore, the data bucket also includes sensitive details related to the Defense Department’s Distributed Common Ground System-Army (DCGS-A), a battlefield intelligence program, and Red Disk, the department’s cloud auxiliary.

Reportedly, the bucket contains over 100GB of classified data, and it got exposed to the public only because of adopting careless security practices. According to Vickery, anyone who gets the URL can easily access this treasure trove of valuable, sensitive data. We cannot ignore that unsecured S3 AWS buckets have caused quite an uproar across the Pentagon and US Defense Department lately as these have caused embarrassing data leakages for various governmental institutions most dominantly the NSA.

Unprotected S3 Cloud Bucket Exposed 100GB of Classified NSA Data — Screenshot from the exposed data (Credit: UpGuard)

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});

The blog post from UpGuard read that this cloud leak could have been avoided it the IT-related errors were timely fixed, and much reliable security practices were implemented to ensure that such an “impactful” data repository remains protected.

“Plainly put, the digital tools needed to potentially access the networks relied upon by multiple Pentagon intelligence agencies to disseminate information should not be something available to anybody entering a URL into a web browser. Although the UpGuard Cyber Risk Team has found and helped to secure multiple data exposures involving sensitive defense intelligence data, this is the first time that classified information has been among the exposed data,” stated UpGuard’s post.

The virtual hard drive contains information about a US military project that was codenamed Red Disk. It was actually a failed cloud-based content sharing program that was developed to allow field troops easy access to intelligence data from the Pentagon in real-time.

The data was extremely sensitive as it contained drone images and satellite images too along with hashed passwords for key internal systems of the department and private keys that were provided to Third-party INSCOM defense contractors so that they could access Distributed Intelligence Systems. There are various areas the hard drive that has been marked as Top Secret.

Currently, the NSA hasn’t issued any statement in response to the findings of UpGuard, however, this is the second time in the last couple of months that UgGuard has discovered such a sensitive trove of data. Previously, the company discovered misconfigured Amazon S3 buckets containing US Military’s social media spying campaign.

//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js (adsbygoogle=window.adsbygoogle||).push({});