PRISM

silentrust · 13-06-2013 9:39am

Capt'n Midnight wrote: »

The Germans knew Enigma was breakable, they just didn't think anyone would go to all the trouble. And yes you're right the Poles found lots of speed ups and issued in a whole new era of cryptography.

A similar story is the US embassy shredding all the documents before leaving Iran. They reasoned that that while it was possible it would take too much manpower to recover the files. Instead they Iranians used illiterate carpet weavers in school halls to join the pieces together. Low tech and took ages but they recovered a lot of stuff.

There are two levels here. One where they passively decrypt your remote data and comms. Two is where you are of interest and they decide to actively pursue you, the best encryption in the world isn't much use if they can sneak a key logger onto your system.

Ah yes the old "evil maid" attack. I suppose this is why physical security is so important, as even if your machine is encrypted they could still install a corrupted bootloader onto it but surely you'd have to an arch-terrorist or spy to go to that kind of trouble?

Khannie · 13-06-2013 9:51am

Thanks for the links there nmop.

nmop_apisdn wrote: »

Guide to how fcuked is SSL?

Interesting article. I consider everyones keys compromised now tbh. I will only trust my own. My data is secure between me, google and the NSA. That's something at least. :pac:

This bit:

The NSA is able to read individual messages, reading all traffic would (probably) be too much computering.

I can confirm to be absolute bollox. It does require quite a bit of compute power to decrypt large volumes of SSL encrypted traffic, even with the keys. HOWEVER (and it's a big however - do you see what I did there?) if you were using any of the following and have a large budget, you would be well able to decrypt the sh*t out of everything:

- hardware assist (pretty sure AES-NI on the new intel chips can be used to help decrypt SSL, though I haven't fully read into it)
- hardware acceleration (there are SSL decrypt cards out there)
- commodity hardware in a decent compute cluster (a la the goog)

Well....really it's only a question of cost when you have the keys.

Khannie · 13-06-2013 9:55am

silentrust wrote: »

Ah yes the old "evil maid" attack. I suppose this is why physical security is so important, as even if your machine is encrypted they could still install a corrupted bootloader onto it but surely you'd have to an arch-terrorist or spy to go to that kind of trouble?

Meh, I have a box set up where it will only boot with a USB key containing both the /boot partition (to avoid getting the shaft from a malicious initrd) and the decrypt key for the root partition (a 256bit key). It was fun doing it. I learned a lot.

Of course in a situation like that you have to keep the USB key secure.

silentrust · 13-06-2013 10:15am

Khannie wrote: »

Thanks for the links there nmop.

Interesting article. I consider everyones keys compromised now tbh. I will only trust my own. My data is secure between me, google and the NSA. That's something at least. :pac:

This bit:

I can confirm to be absolute bollox. It does require quite a bit of compute power to decrypt large volumes of SSL encrypted traffic, even with the keys. HOWEVER (and it's a big however - do you see what I did there?) if you were using any of the following and have a large budget, you would be well able to decrypt the sh*t out of everything:

- hardware assist (pretty sure AES-NI on the new intel chips can be used to help decrypt SSL, though I haven't fully read into it)
- hardware acceleration (there are SSL decrypt cards out there)
- commodity hardware in a decent compute cluster (a la the goog)

Well....really it's only a question of cost when you have the keys.

Hi Khannie,

I don't think the problem is so much of a technical one as it is a human one. Proof of concept and work has been published time and again on attacking SSL, we know that can be done. What the NSA can't have is the manpower to scour every e-mail sent over SSL - probably why the rumours are that they focus on keywords or targeted individuals.

silentrust · 13-06-2013 10:43am

nmop_apisdn wrote: »

This. I'm curious about GPG, what makes ye guys think it's safe?

If an encrypted file was served up to something like this, China builds the fastest computer ever without even trying, but change the cpu's for gpu's, CUDA-enabled GPGPU app cracks PGP passwords 200x faster than a CPU, and take away the randomness, Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331”

Would it not fall in no time?????? NSA has systems like that going by stories from recent child pornography cases involving encrypted HDDs in which they were asked to decrypt, but refused.

Thank you for some very interesting links nmop.

I'm just going to respond to your points re: gpg if that's OK as this is a question that comes up fairly often in the Security forums on the Silk Road.

So far there's been no successful extrapolation of someone's private key from just their public key as far as I know though it is theoretically possible. Assuming the NSA are twenty years ahead of us in terms of computing it might (just) be possible for them to d this in a reasonable amount of time however, I don't insist it's impossible.

I use a 4096 bit Public Key so if you send me a message, according to the Cryptocat blog that's about as strong as 170bit AES encryption - Bruce Schneier doesn't believe that the NSA have developed a practical way of cracking AES but this doesn't paint the full picture as cracking gpg really comes down to how fast they can factor prime numbers, so they may have found a method to do it.

Having said this, it is usually simpler to try to compromise a person's private key and try to extrapolate their password from that, which is why it's so important that you keep this safe (I store my gpg program on an encrypted drive for this reason). Poor physical security also means you're vulnerable to the aforementioned "evil maid" attack where someone could trick their way into your home and install a keylogger.

Having said this, there's no reason you need to rely on gpg encryption alone to help you stay safe. The norm on the Silk Road is to use a service like Tormail or I2Pmail to make it near impossible to intercept messages in the first place. I think I mentioned before when I was speaking to a Russian fraudster over the jabber client Psi, he insisted we use OpenPGP keys to encrypt our chat as well as Tor to connect.

You can also use GPG to encrypt files e.g a Truecrypt container protected with a "cascade" algorithm (i.e several encryption algorithims together such as AES, Serpent and Twofish.

There's also no requirement to write in plain English, code words as well as good old-fashioned hand ciphers like VIC or Solitaire.

However I don't do this given the extra time it takes to encipher a message plus the fact that if the NSA did decode a person's hard drive using some super-hyper-quantum computer they had locked away, they would be tacitly revealing its existence to the world - it wouldn't be enough to simply give a printout of your messages in court, the defence would demand to know how the information was obtained, so I don't flatter myself that the government would compromise themselves in that way on my behalf.

Khannie · 13-06-2013 10:52am

silentrust wrote: »

I don't think the problem is so much of a technical one as it is a human one. Proof of concept and work has been published time and again on attacking SSL, we know that can be done.

Only with 2 things - human stupidity, or the keys. SSL is technologically sound.

silentrust wrote: »

What the NSA can't have is the manpower to scour every e-mail sent over SSL - probably why the rumours are that they focus on keywords or targeted individuals.

True, but the article stresses "computering" indicating that the author believes that large scale decryption with keys is overly compute costly. This is not the case with even a reasonable budget.

Once it is decrypted, yes, you would still have way too much data for humans to sift through. Hell...I have trouble reading all my own communications. Knock yourselves out lads.

silentrust · 13-06-2013 10:58am

Khannie wrote: »

Only with 2 things - human stupidity, or the keys. SSL is technologically sound.

I had thought that TLS was the new flavour of the month but let's not dwell on it - it's a moot point if the companies like Google and Facebook using SSL are handing data over to the government once it arrives safely encrypted at their servers!

silentrust · 13-06-2013 11:00am

Khannie wrote: »

Meh, I have a box set up where it will only boot with a USB key containing both the /boot partition (to avoid getting the shaft from a malicious initrd) and the decrypt key for the root partition (a 256bit key). It was fun doing it. I learned a lot.

Of course in a situation like that you have to keep the USB key secure.

Your HDD is encrypted with a keyfile - I am very jealous as I don't know how to do it, nicely played! Of course if the Secret Police do hoof in your door, they'll probably arrest you and take the key but at least they can't do anything while you're away.

Khannie · 13-06-2013 11:08am

silentrust wrote: »

Assuming the NSA are twenty years ahead of us in terms of computing

They are definitely not. Private industry overtook what governments could achieve many years ago. Intels R&D budget just blows the crap out of whatever the US government can and should spend on trying to create its own hardware. Why bother?

Now the flip side to this is that they obviously have a massive budget so not much is beyond them if they really want it. It's clear that they think they're acting in their nations best interests. Many (most?) Americans believe some intrusion into privacy is worth the security benefits and I find it difficult to argue strongly against that. It's easy for us living in our nice peaceful land that nobody wants to see burn to the ground to say that it's all nasty and terrible. When you're dealing with nations like Afghanistan where 92% of the population have never heard that 9/11 happened (WTF? link) and they think you're there to crush their religion, well how do you combat that?

Again though - you'd want to be some idiot to be:

1) planning something (this is your first mistake - you are an idiot to plan doing something because you probably have not got a good enough understanding of all the underlying technologies or how to exploit them to your benefit to save yourself from getting caught and when you are caught you haven't got the knowledge or the stones to look after yourself properly)
2) talking about it
3) using anything other than your own privately, properly secured communications method to do it

That opsec talk that I believe bedlam linked to earlier discussed someone exchanging password information over facebook chat. Those people deserve to get caught. If you are doing that, you may as well be handing yourself over for a good spanking. Tools.

silentrust · 13-06-2013 11:37am

Khannie wrote: »

They are definitely not. Private industry overtook what governments could achieve many years ago. Intels R&D budget just blows the crap out of whatever the US government can and should spend on trying to create its own hardware. Why bother?

Now the flip side to this is that they obviously have a massive budget so not much is beyond them if they really want it. It's clear that they think they're acting in their nations best interests. Many (most?) Americans believe some intrusion into privacy is worth the security benefits and I find it difficult to argue strongly against that. It's easy for us living in our nice peaceful land that nobody wants to see burn to the ground to say that it's all nasty and terrible. When you're dealing with nations like Afghanistan where 92% of the population have never heard that 9/11 happened (WTF? link) and they think you're there to crush their religion, well how do you combat that?

Again though - you'd want to be some idiot to be:

1) planning something (this is your first mistake - you are an idiot to plan doing something because you probably have not got a good enough understanding of all the underlying technologies or how to exploit them to your benefit to save yourself from getting caught and when you are caught you haven't got the knowledge or the stones to look after yourself properly)
2) talking about it
3) using anything other than your own privately, properly secured communications method to do it

That opsec talk that I believe bedlam linked to earlier discussed someone exchanging password information over facebook chat. Those people deserve to get caught. If you are doing that, you may as well be handing yourself over for a good spanking. Tools.

I hope you'll forgive my pessimism Khannie but I like to play it safe re: where the NSA are. Indeed the very fact that there seems to be some suggstion of collusion between the big companies like Facebook et al. would seem to suggest to me that this shadowy supercomputer if they have it can't be used to crack open SSL like a walnut - but of course perhaps that's what they want us to think... :-D

I think we can all agree that some intrusion into a person's privacy is justifiable. The furore here is over the fact that this is being done regularly as some part of sweep rather than targeting surveillance and obtaining a warrant from a Judge to glean further information.

While it's true this method may well capture e-mails between Afghan terrorists intent on setting a bomb outside a petting zoo, the lawful communications of US Citizens (and seemingly UK and Irish citizens) are also being intercepted as matter of course.

However the point you make is one put to the creators of the Tor project as they know that they are enabling drug dealers and paedophiles to communicate more freely. However when you see human rights groups in Burma and China using GPG to encode their messages and services like Tor, I2P and anonymous remailers to deter government surveillance, it puts this into a rather harsh perspective.

I think most criminals like you say are simply stupid enough not to use these kinds of methods to protect themselves - my Dad was a copper and said that 99% of the time it really doesn't take a Sherlock Holmes to work out whodunit - one very obliging burglar even left his driving licence and mobile phone behind in the house he broke into!

Khannie · 13-06-2013 11:41am

silentrust wrote: »

Your HDD is encrypted with a keyfile - I am very jealous as I don't know how to do it, nicely played! Of course if the Secret Police do hoof in your door, they'll probably arrest you and take the key but at least they can't do anything while you're away.

Ah it was more an intellectual exercise tbh. I'll be honest, it took quite a bit of messing around to get done. I have about 10 years using linux as my every day OS now and I was glad of every minute of experience doing it.

I mostly followed an article that I'll dig out for you if you like? I had to digress from it at a few points because of my own setup and the fact that I only wanted to use 1 USB key (the article calls for 2 - 1 for /boot and 1 for the key where I have both on the same key).

edit: actually having the key would be only semi-useful. My /home partition is stored as a further password encrypted partition on that already encrypted root partition. Nothing a good beating wouldn't reveal though.

It's a cost / benefit thing though. There's nothing of interest on my machine, so you wouldn't really be arsed investing much effort in getting it.

Khannie · 13-06-2013 11:46am

silentrust wrote: »

]one very obliging burglar even left his driving licence and mobile phone behind in the house he broke into!

Haha. Reminds me of an episode of "Worlds Dumbest Criminals" that I saw where a guy was holding up a 7/11 in the US and said "Nobody catches <insert name here>". Narrator then says "The thrilling manhunt took almost 30 seconds" and you see them flipping through the phone book.

Capt'n Midnight · 13-06-2013 12:31pm

http://www.theregister.co.uk/2012/10/21/android_app_ssl_vulnerability/

More than 1,000 out of a sample of 13,000 Android applications analysed by German researchers contained serious flaws in their SSL implementations.
...
17 percent of the SSL-using apps in their sample suffered from implementations that potentially made them vulnerable to man-in-the-middle MITM attacks.
...
The problems arise because of developers misusing the SSL settings the Android API offers.

anyone remember this gem ?
https://en.wikinews.org/wiki/Predictable_random_number_generator_discovered_in_the_Debian_version_of_OpenSSL

This vulnerability was caused by the removal of two lines of code from the original version of the OpenSSL library. These lines were used to gather some entropy data by the library, needed to seed the PRNG used to create private keys, on which the secure connections are based. Without this entropy, the only dynamic data used was the PID of the software. Under Linux the PID can be a number between 1 and 32,768, that is a too small range of values if used to seed the PRNG and will cause the generation of predictable numbers. Therefore any key generated can be predictable, with only 32,767 possible keys for a given architecture and key length, and the secrecy of the network connections created with those keys is fully compromised.

And there is a whole class of stuff that falls under "don't use a wireless connection to change your WiFi password"

EDIT live stream from 13:00 http://sciencegallery.com/live

silentrust · 13-06-2013 12:55pm

Khannie wrote: »

Ah it was more an intellectual exercise tbh. I'll be honest, it took quite a bit of messing around to get done. I have about 10 years using linux as my every day OS now and I was glad of every minute of experience doing it. I mostly followed an article that I'll dig out for you if you like? I had to digress from it at a few points because of my own setup and the fact that I only wanted to use 1 USB key (the article calls for 2 - 1 for /boot and 1 for the key where I have both on the same key).

edit: actually having the key would be only semi-useful. My /home partition is stored as a further password encrypted partition on that already encrypted root partition. Nothing a good beating wouldn't reveal though.

It's a cost / benefit thing though. There's nothing of interest on my machine, so you wouldn't really be arsed investing much effort in getting it.

Well if it's not too much trouble I'd love to see how you did it! I agree it's better to have two separate USB keys but God help you if they're stolen/lost. Of course for the /boot part I imagine you could just achieve the same thing by having a LiveCD by your computer with your signature on it which you could then use to boot into the OS?

One of the few drawbacks of using Linux over Windows of course is that you can't use Truecrypt to install a hidden OS so you have plausible denial, such are the times!

bonzodog2 · 13-06-2013 1:00pm

This amused me today:
http://www.theregister.co.uk/2013/06/12/nsa_logo_scandal/

Khannie · 13-06-2013 1:28pm

silentrust wrote: »

Your HDD is encrypted with a keyfile - I am very jealous as I don't know how to do it, nicely played! Of course if the Secret Police do hoof in your door, they'll probably arrest you and take the key but at least they can't do anything while you're away.

Mostly used this guide.

nmop_apisdn · 14-06-2013 2:16am

What exactly is Microsoft handing over???

PRISM fears give private search engine DuckDuckGo its best week ever

Khannie wrote: »

nmop.

Flip your screen...or your Head and you'll be nmop_apisdn
:pac:

Khannie wrote: »

They are definitely not. Private industry overtook what governments could achieve many years ago. Intels R&D budget just blows the crap out of whatever the US government can and should spend on trying to create its own hardware. Why bother?

A lawsuit filed against the U.S. National Security Agency reveals a frightening array of technologies and programs designed to keep tabs on individuals.

NSA technology is developed and implemented in secret from private corporations, academia and the general public.

At the present time the NSA has nanotechnology computers that are 15 years ahead of present computer technology. The NSA obtains blanket coverage of information in the US by using advanced computers that use artificial intelligence to screen all communications, regardless of medium, for key words that should be brought to the attention of NSA agents/cryptologists.

Timelines abit off but they are probably rocking something like this.
Faster Computers With Nanotechnology and the software they use to process the Data along with real world applications.

Sort of links in with this show on CH4 a few weeks back.

Quantum Computing is still abit off (though IBM estimate 15-20yrs) The NSA is working on powerful quantum computing technology all the big guys are working on it. Lockheed Martin bought a D-Wave aswell.

Looks like they are going to have to rethink it being Crypto-Unhackable though. Just How Secure Is Quantum Cryptography?

Khannie wrote: »

edit: actually having the key would be only semi-useful. My /home partition is stored as a further password encrypted partition on that already encrypted root partition. Nothing a good beating wouldn't reveal though.

They'll take it straight out of your head going by the above.:P

Hackers backdoor the human brain, successfully extract sensitive data

silentrust wrote: »

I think I mentioned before when I was speaking to a Russian fraudster over the jabber client Psi, he insisted we use OpenPGP keys to encrypt our chat as well as Tor to connect.

:eek:
Acquiring new Prism Target...........
.................................................
Processing..................................
Processing..................................
New Target Locked.:pac:

silentrust · 14-06-2013 10:09am

[QUOTE=

:eek:
Acquiring new Prism Target...........
.................................................
Processing..................................
Processing..................................
New Target Locked.:pac:[/QUOTE]

You needn't concern yourself nmop, this isn't how I communicate with people anonymously(!) but that said there doesn't seem any obvious way to intercept and trace a conversation using this method.

Instead of relying on security by obscurity though I would much rather tell security-conscious people like you the method used so it can be subject to scrutiny -the very reason we're in this mess in the first place is that we can't believe a company like Skype when they say, "Trust us, your communications can't be intercepted," I say use open source code and let it be put to the test!

IMHO you need to have a security outlook which means it won't do the powers that be any good if they are monitoring your communications - as I said before, Dropbox can hand over my encrypted Truecrypt container to PRISM if they want to, much good it'll do them without the right password and keyfiles.

Capt'n Midnight · 14-06-2013 10:47am

nmop_apisdn wrote: »

PRISM fears give private search engine DuckDuckGo its best week ever

What if DuckDuckGo is really a honeypot ? :eek:

A lawsuit filed against the U.S. National Security Agency reveals a frightening array of technologies and programs designed to keep tabs on individuals.

It's a good thing our personal tracking devices can't eavesdrop on just about everything useful in the audio/visual, magnetic, and RF spectrum apart from our brain waves.

silentrust · 14-06-2013 10:51am

Capt'n Midnight wrote: »

What if DuckDuckGo is really a honeypot ? :eek:

The Tor Browser uses DuckDuckGo and StartPage as memory serves so if you worried about it being a honeypot, I say just access them that way.

Hopefully this latest scandal with PRISM will encourage more visitors, God knows Google has enough customers already.

Capt'n Midnight · 14-06-2013 4:41pm

nmop_apisdn · 15-06-2013 1:01am

Encrypted e-mail: How much annoyance will you tolerate to keep the NSA away?

silentrust · 15-06-2013 1:53am

nmop_apisdn wrote: »

Encrypted e-mail: How much annoyance will you tolerate to keep the NSA away?

Good question!

I've added a line to my signature in gmail saying :

"My PGP key can be downloaded from http://keyserver.pgp.com"

So far sadly no takers on my regular e-mail account. We live in hopes! :-)

nmop_apisdn · 15-06-2013 11:27pm

nmop_apisdn wrote: »

What exactly is Microsoft handing over???

Answer = Complete Access.

Microsoft Said To Give Zero Day Exploits To US Government Before It Patches Them

Google researcher publishes Windows zero-day exploit

silentrust · 16-06-2013 12:09am

Well it's official folks, we're surrounded by f-in eejits.

Reading the latest Cryptogram newsletter, which in turn links to this Wired article containing supposedly bulletproof methods by which future whistleblowers can inform on the government, namely:

- Buy a laptop with cash, go to an internet cafe then e-mail the press using a new Gmail account.

If this sounds a bit sus you can try option # 2 and buy a prepay mobile phone.

Not one mention of I2P, Tor, VPN's, anonymous remailers or one of the many methods which would actually protect you - has the world gone mad?!!

[-0-] · 16-06-2013 3:26am

I think I need to become Amish, dump my electronics into the sea and go live like a hobbit in the hills, reading by candle light.

silentrust · 16-06-2013 11:27am

[-0-] wrote: »

I think I need to become Amish, dump my electronics into the sea and go live like a hobbit in the hills, reading by candle light.

Come join us in the Survivalism and Self Sufficiency forum, you'll be most welcome! :-)

Capt'n Midnight · 16-06-2013 12:00pm

[-0-] wrote: »

I think I need to become Amish, dump my electronics into the sea and go live like a hobbit in the hills, reading by candle light.

good thinking Batman

You'll be profiled as a unabomber and appear regularly on DroneTV

Or you could hide in the noise

silentrust · 16-06-2013 6:30pm

Well guys it's official, I have now deleted my data and closed my Facebook account. No doubt there'll be people who think I've gone too far, particularly as I never used my real name or location anyway but better safe than sorry say I.

Capt'n Midnight · 17-06-2013 1:04am

silentrust wrote: »

Well guys it's official, I have now deleted my data and closed my Facebook account. No doubt there'll be people who think I've gone too far, particularly as I never used my real name or location anyway but better safe than sorry say I.

/me opens a facebook account in silentrust's name and starts phishing

PRISM

Comments