Home Tags Eavesdropping

Tag: Eavesdropping

Eavesdropping Malware Discovered Gathering Audio Data in Ukraine

NEWS ANALYSIS: "Operation BugDrop" malware stealthily infects computers and turns on the onboard microphone to gather audio files, which it exports to Dropbox files for retrieval and analysis.

Ars announces HTTPS by default (finally)

Doing our part to push the encrypted-by-default vision of the Web.

ProtonMail Gets Own Tor-Accessible .Onion Hidden Service

Users of the encrypted email service ProtonMail looking for an extra layer of security now have the option of accessing their inbox directly through the Tor network. ProtonMail, originally developed by CERN and MIT scientists, announced Thursday it had added its own Tor hidden service. According to a blog post from Andy Yen, the service’s co-founder and chief executive officer, users can access ProtonMail on Tor, assuming it’s been properly configured, at https://protonirockerxow.onion. We have launched a Tor hidden service! Now there's a more secure way to access your encrypted mailbox. @torproject https://t.co/6inDtzC9C5 pic.twitter.com/xTbqX7mrQ7 — ProtonMail (@ProtonMail) January 19, 2017 While ProtonMail is already encrypted by design, Yen points out that users may want to route their traffic through Tor as a means to prevent a hacker from eavesdropping on their connection.

The main goal of launching the hidden service, Yen claims, is a means to make the service more resistant to censorship and surveillance. “Tor applies extra encryption layers on top of your connection, making it more difficult for an advanced attacker to perform a man-in-the-middle attack on your connection to us.

Tor also makes your connections to ProtonMail anonymous as we will not be able to see the true IP address of your connection to ProtonMail,” Yen wrote. According to the blog post, ProtonMail conferred with Roger Dingledine on the .onion site. Dingledine developed Tor and currently serves as the service’s research director and president. As ProtonMail was able to acquire a certificate from the CA DigiCert, the .onion site exists only on HTTPS, meaning users should see a green bar in their browser upon navigating to the site. Developers with the service acknowledge that while the concept of using HTTPS for an onion site may sound redundant to some, it was a necessary step. If Tor was ever compromised, Yen claims having HTTPS enforced by default would protect users.
Vice versa, if a certificate authority was ever compromised, or HTTPS was ever cracked, Tor could help safeguard users. “The notion of HTTPS being compromised is one that we take seriously, considering that there are hundreds of CAs (certificate authorities) that are trusted by default, with many of them under direct government control in high risk countries,” Yen wrote. Yen goes on to say that the way the site is put together should make it more resistant to phishing. The company used some spare computational power it had to “generate millions of encryption keys” which it then hashed to generate a more “human readable hash” for the URL. Yen is still asking users to double check that they’re on the right site – most importantly that it has a SSL certificate issued to Proton Technologies AG – before entering their credentials. Yen points out that the site is experimental, so it may take longer to reach and users’ experiences may vary. Nevertheless, he is still encouraging ProtonMail users who value their privacy to seek it out. It was over two years ago that DigiCert issued an .onion SSL certificate to Facebook for its own hidden service.

The move, at the time, was a milestone; it marked the first time a CA had issued a legitimate SSL certificate for an .onion address. The move was a success. Over the course of 30 days this past summer one million people accessed the site over Tor. Following Facebook’s hidden service news, the CA said it was mulling opening up the way it was issued .onion domain certificates. Jeremy Rowley, then DigiCert’s vice president of business development and legal, said the company believed there was a value in providing SSL and TLS security for Tor, but only if the right security controls were in place.

The company went on to issue HTTPS .onion certificates for Blockchain.info and the Intercept’s SecureDrop installation in the months following.

Playtime’s over: Internet-connected kids toys ‘fail miserably’ at privacy

Won't someone think of the children, literally? The Electronic Privacy Information Center (EPIC) and the European Consumer Organization (BEUC) are calling for US and EU data protection authorities to take action against insecure networked toys. Declaring that "My Friend Cayla," a Bluetooth-enabled doll released in 2014, and "i-Que," a connected robot released last year, "fail miserably when it comes to safeguarding basic consumer rights, security, and privacy," the BEUC on Tuesday presented findings about the device's shortcomings, based on an investigation by the Norwegian Consumer Council, a BEUC member. The BEUC argues that the toys violate the EU Unfair Contract Terms Directive and the EU Data Protection Directive. EPIC, also on Tuesday, filed a complaint with the Federal Trade Commission alleging that the toys violate US privacy law. The toys, manufactured by Genesis Toys and supported by speech recognition software from Nuance Communications, are designed to talk to children and to capture their speech, in conjunction with Android or iOS mobile apps. EPIC and BEUC contend the companies use collected data for purposes beyond interaction, specifically hidden marketing.

The BEUC says that the toys spout pre-programmed phrases that endorse commercial products. "For example, Cayla will happily talk about how much she loves different Disney movies, meanwhile, the app-provider also has a commercial relationship with Disney," the BEUC said. The BEUC also objects to the transference of speech data from EU-based children to Nuance, a US-based company. Moreover, it asserts the terms of service presented to customers are illegal because customers must agree that the terms can be changed without notice, that personal data can be used for advertising, and that information may be shared with undisclosed third parties. Finally, BEUC says the toys lack adequate security measures because, without much effort, they can be hijacked using a mobile phone. The EPIC complaint echoes those concerns: "The failure to employ basic security measures to protect children’s private conversations from covert eavesdropping by unauthorized parties and strangers creates a substantial risk of harm because children may be subject to predatory stalking or physical danger." Pen Test Partners, a UK-based security research group, came to the same conclusion last year when it published details about several security problems affecting "My Friend Cayla" and hacked the doll to make it swear. Genesis Toys, incorporated in Hong Kong and based in Los Angeles, was not immediately reachable for comment. A spokesperson for Nuance, in response to a query from The Register, pointed to a post by Richard Mack, VP of corporate marketing. "Nuance takes data privacy seriously," Mack said, omitting the "very" present in variants of the phrase offered by Facebook and Google in the past. Mack says Nuance has not received in inquiry from the FTC or other privacy authority. He stresses that the company's policy is that it doesn't use or sell voice data for marketing purposes and that it doesn't share voice data collected from one customer with another. "Upon learning of the consumer advocacy groups' concerns through media, we validated that we have adhered to our policy with respect to the voice data collected through the toys referred to in the complaint," he said. ® Sponsored: Want to know more about PAM? Visit The Register's hub

Cyber college for wannabe codebreakers planned at UK’s iconic Bletchley Park

EnlargeQufaro reader comments 3 Share this story Bletchley Park—the home of codebreakers whose pioneering work helped Britain and its allies win the Second World—could be the site for a College of National Security, with plans for it to open in 2018. The new sixth-form boarding school will, we're told, be run by a private non-profit consortium of tech firms, venture capitalists, and entrepreneurs, with rumoured input from GCHQ.
It will enrol 500 teenagers (aged 16 to 19) who will be taught cybersecurity skills—which could, it's hoped, go some way to addressing the shortfall in UK talent. The outfit behind the college, which would apparently be free for its pupils to attend, says at least part of the syllabus would be set by infosec experts focusing mostly on cybersecurity (roughly 40 percent of the curriculum), with additional modules on maths, computer science, economics, and physics also taught over a three-year period of study.

Applicants won't be selected on the basis of specific academic qualifications, so much as through aptitude tests set by the college, or even on the basis of previously demonstrated skills, such as self-taught coding. The initiative is being funded and run by a group called Qufaro, whose members include Cyber Security Challenge UK, The National Museum of Computing, the Institute of Information Security Professionals, Raytheon, and BT Security.
It will be certified by City and Guilds, a major provider of vocational qualifications. Qufaro chair Alastair MacWilson described the state of the UK's current IT education as "complex, disconnected, and incomplete, putting us at risk of losing a whole generation of critical talent." He added: For those interested in forging a career in cyber, the current pathway is filled with excellent but disparate initiatives—each playing a vital role without offering a truly unified ecosystem of learning and support. By connecting what already exists and filling the gaps, Qufaro will make it easier for budding professionals to grow their cyber security skills at every stage of their journey, and contribute more to the sector as a result. Enlarge / Much of the Bletchley site has fallen into a state of disrepair. Qufaro The college plans to open in G-Block, one of the largest wartime buildings that still stands on the grounds of the Buckinghamshire stately home, once much-needed upgrades and refurbishments—costing an estimated £5 million—have been completed. However, while they share space on the same site, the new college has nothing to do with the Bletchley Park museum, a representative for the trust told Ars. G-Block was notable for dealing with German secret service material during WWII. A GCHQ spokesperson declined to say how much involvement it had with the planned cyberschool. He said the UK's eavesdropping nerve centre "welcomes initiatives that promote and develop skills in cybersecurity," adding: "The concept of a sixth form college is interesting, especially if it can provide a pathway for talented students from schools that are not able to provide the support they need. We wish Qufaro well in the endeavour." MacWilson estimates that there's a shortage of about 700,000 cybersecurity professionals in Europe at present, and wants the new college to make headway in addressing the issue.
It's been reported that Qufaro has applied to the department for education for state funding, but if it can't secure any, the college will be funded privately. One of its key objectives will be to try to "address the historical under-representation of girls studying STEM subjects" with the plan to enrol at least a third of female students. This post originated on Ars Technica UK

Drops the mic… Hang on, hackers could be listening through my...

RealTek codec vuln can switch speakers from output to input Experimental malware has highlighted the possibility that hackers might be able to turn headphones into microphones in order to snoop on computer users. Research by computer scientists at Ben-Gurion University, Israel, has revealed that both headphones and loudspeakers present a potential bugging risk.

The boffins put together proof-of-concept malware, dubbed SPEAKE(a)R, in order to validate the risk. "Malware can use a computer as an eavesdropping device, even when a microphone is not present, muted, taped or turned off," the researchers warn.
In a paper, SPEAKE(a)R: Turn Speakers to Microphones for Fun and Profit (PDF), the researchers survey the scope of the risk and access potential countermeasures. Possible hardware-based defences include using only active one-way speakers or deploying either white noise emitters or an audio jammer. Youtube Video A speaker converts an electric signal into a sound wave.

A microphone converts sound to an electrical signal. "The difference between these two pieces of equipment is that they have been optimised for the direction of conversion," according to Paul Farrington, manager of EMEA solution architects at application security firm Veracode. "However, there is little to prevent the conversion happening in the reverse direction." This feature of consumer tech coupled with the possibility of hacking an audio port's role in the PC from output to input creates a bugging risk. "The RealTek codec chip vulnerability is apparently allowing malware running on the device to take advantage of the physical properties of the connected equipment to use the ports to accept input when they should be restricted to output only," Farrington continued. RealTek or operating system developers might be able to deliver a software patch to mitigate this chip vulnerability and help secure IO ports, according to Farrington. ® Sponsored: Customer Identity and Access Management

17 essential tools to protect your online identity, privacy

Make no mistake: Professional and state-sponsored cybercriminals are trying to compromise your identity -- either at home, to steal your money; or at work, to steal your employer’s money, sensitive data, or intellectual property. Most users know the basics of computer privacy and safety when using the internet, including running HTTPS and two-factor authentication whenever possible, and checking haveibeenpwned.com to verify whether their email addresses or user names and passwords have been compromised by a known attack. But these days, computer users should go well beyond tightening their social media account settings.

The security elite run a variety of programs, tools, and specialized hardware to ensure their privacy and security is as strong as it can be. Here, we take a look at this set of tools, beginning with those that provide the broadest security coverage down to each specific application for a particular purpose. Use any, or all, of these tools to protect your privacy and have the best computer security possible. Everything starts with a secure device Good computer security starts with a verified secure device, including safe hardware and a verified and intended boot experience.
If either can be manipulated, there is no way higher-level applications can be trusted, no matter how bulletproof their code. Enter the Trusted Computing Group.
Supported by the likes of IBM, Intel, Microsoft, and others, TCG has been instrumental in the creation of open, standard-based secure computing devices and boot pathways, the most popular of which are the Trusted Platform Module (TPM) chip and self-encrypting hard drives. Your secure computing experience begins with TPM. TPM. The TPM chip provides secure cryptographic functions and storage.
It stores trusted measurements and private keys of higher-level processes, enabling encryption keys to be stored in the most secure manner possible for general-purpose computers. With TPM, computers can verify their own boot processes, from the firmware level up.

Almost all PC manufacturers offer models with TPM chips.
If your privacy is paramount, you’ll want to ensure the device you use has an enabled TPM chip. UEFI. Universal Extensible Firmware Interface is an open standards firmware specification that replaces the far less secure BIOS firmware chips. When enabled, UEFI 2.3.1 and later allow device manufacturers to “lock” in the device’s originating firmware instructions; any future updates must be signed and validated in order to update the firmware.

BIOS, on the other hand, can be corrupted with a minimum number of malicious bytes to “brick” the system and make it unusable until sent back to the manufacturer. Without UEFI, sophisticated malicious code can be installed to bypass all your OS’s security protections. Unfortunately, there is no way to convert from BIOS to UEFI, if that’s what you have. Secure operating system boot. Your operating system will need self-checking processes to ensure its intended boot process hasn’t been compromised. UEFI-enabled systems (v.2.3.1 and later) can use UEFI’s Secure Boot process to begin a trusted boot process. Non-UEFI systems may have a similar feature, but it’s important to understand that if the underlying hardware and firmware do not have the necessary self-checking routines built in, upper-level operating system checks cannot be trusted as much. Secure storage. Any device you use should have secure, default, encrypted storage, for both its primary storage and any removable media storage devices it allows. Local encryption makes it significantly harder for physical attacks to read your personal data. Many of today’s hard drives are self-encrypting, and many OS vendors (including Apple and Microsoft) have software-based drive encryption. Many portable devices offer full-device encryption out of the box. You should not use a device and/or OS that does not enable default storage encryption. Two-factor authentication. Two-factor authentication is fast becoming a must in today’s world, where passwords are stolen by the hundreds of millions annually. Whenever possible, use and require 2FA for websites storing your personal information or email.
If your computing device supports 2FA, turn it on there. When 2FA is required, it ensures an attacker can’t simply guess or steal your password. (Note that using a single biometric factor, such as a fingerprint, is not even close to being as secure as 2FA.
It’s the second factor that gives the strength.) 2FA ensures that an attacker cannot phish you out of your logon credentials as easily as they could if you were using a password alone.

Even if they get your password or PIN, they will still have to get the second logon factor: biometric trait, USB device, cellphone, smart card, device, TPM chip, and so on.
It has been done, but is significantly more challenging. Be aware, though, that if an attacker gains total access to the database that authenticates your 2FA logon, they will have the super admin access necessary to access your data without your 2FA credentials. Logon account lockout. Every device you use should lock itself when a certain number of bad logons have been attempted.

The number isn’t important.

Any value between 5 and 101 is reasonable enough to keep an attacker from guessing your password or PIN. However, lower values mean that unintentional logons might end up locking you out of your device. Remote find. Device loss or theft is one of the most common means of data compromise. Most of today’s devices (or OSes) come with a feature, often not enabled by default, to find a lost or stolen device. Real-life stories abound in which people have been able to find their devices, often at a thief’s location, by using remote-find software. Of course, no one should confront a thief.

Always get law enforcement involved. Remote wipe. If you can’t find a lost or stolen device, the next best thing is to remotely wipe all personal data. Not all vendors offer remote wipe, but many, including Apple and Microsoft, do. When activated, the device, which is hopefully already encrypted and protected against unauthorized logons, will either wipe all private data when a certain number of incorrect logons are entered or when instructed to do so upon the next connection to the internet (after being instructed to wipe itself by you). All of the above provide a foundation for an overall secure computing experience. Without firmware, boot, and storage encryption protection mechanisms, a truly secure computing experience cannot be ensured.

But that’s only the start. True privacy requires a secure network The most paranoid computer security practitioners want every network connection they use to be secured.

And it all starts with a VPN. Secure VPN. Most of us are familiar with VPNs, from connecting remotely to our work networks.

Corporate VPNs provide secure connectivity from your offsite remote location to the company network, but often offer no or limited protection to any other network location. Many hardware devices and software programs allow you to use a secure VPN no matter where you connect. With these boxes or programs, your network connection is encrypted from your device to your destination, as far as possible.

The best VPNs hide your originating information and/or randomly tunnel your connection among many other participating devices, making it harder for eavesdroppers to determine your identity or location. Tor is the most used, free, secure VPN service available today. Using a Tor-enabled browser, all of your network traffic is routed over randomly selected intermediate nodes, encrypting as much as the traffic as possible.

Tens of millions of people rely on Tor to provide a reasonable level of privacy and security.

But Tor has many well-known weaknesses, ones that other secure VPN solutions, such as MIT’s Riffle or Freenet are attempting to solve. Most of these attempts, however, are more theoretical than deployed (for example, Riffle) or require opt-in, exclusionary participation to be more secure (such as Freenet).

Freenet, for example, will only connect to other participating Freenet nodes (when in “darknet” mode) that you know of in advance. You can’t connect to other people and sites outside of Freenet when in this mode. Anonymity services. Anonymity services, which may or may not provide VPN as well, are an intermediate proxy that completes a network request on behalf of the user.

The user submits his or her connection attempt or browser connection to the anonymity site, which completes the query, obtains the result, and passes it back to the user.

Anyone eavesdropping on the destination connection would be more likely to be stopped from tracking beyond the anonymity site, which hides the originator’s information.

There are loads of anonymity services available on the web. Some anonymity sites store your information, and some of these have been compromised or forced by law enforcement to provide user information. Your best bet for privacy is to choose an anonymity site, like Anonymizer, that doesn’t store your information for longer than the current request.

Another popular, commercial secure VPN service is HideMyAss. Anonymity hardware. Some people have attempted to make Tor and Tor-based anonymity easier using specially configured hardware. My favorite is Anonabox (model: anbM6-Pro), which is a portable, Wi-Fi-enabled VPN and Tor router.
Instead of having to configure Tor on your computer/device, you can simply use Anonabox instead. Secure VPNs, anonymity services, and anonymity hardware can enhance your privacy greatly by securing your network connections.

But one big note of caution: No device or service offering security and anonymity has proved to be 100 percent secure.

Determined adversaries and unlimited resources can probably eavesdrop on your communications and determine your identity.

Everyone who uses a secure VPN, anonymity services, or anonymity hardware should communicate with the knowledge that any day their private communications could become public. Secure applications are a must as well With a secure device and secure connections, security experts use the most (reasonable) secure applications they can find. Here’s a rundown of some of your best bets for protecting your privacy. Secure browsing. Tor leads the way for secure, almost end-to-end Internet browsing. When you can’t use Tor or a Tor-like VPN, make sure the browser you use has been set to its most secure settings. You want to prevent unauthorized code (and sometimes legitimate code) from executing without your being aware.
If you have Java, uninstall it (if not using it) or make sure critical security patches are applied. Most browsers now offer “private browsing” modes. Microsoft calls this feature InPrivate; Chrome, Incognito.

These modes erase or do not store browsing history locally and are useful in preventing local, unauthorized forensic investigations from being as fruitful. Use HTTPS for all internet searches (and connections to any website), especially in public locations.

Enable your browser’s Do Not Track features.

Additional software can prevent your browser experience from being tracked, including browser extensions Adblock Plus, Ghostery, Privacy Badger, or DoNotTrackPlus.
Some popular sites try to detect these extensions and block your use of their sites unless you disable them while on their sites. Secure email. The original “killer app” for the internet, email is well-known for violating user’s privacy.

The internet’s original open standard for securing email, S/MIME, is being less used all the time.
S/MIME requires each participating user to exchange public encryption keys with other users.

This requirement has proved overly daunting for less savvy users of the internet. These days most corporations that require end-to-end email encryption use commercial email services or appliances that allow secure email to be sent via HTTPS-enabled sites. Most commercial users of these services or devices say they are easy to implement and work with, but can sometimes be very expensive. On the personal side there are dozens of secure email offerings.

The most popular (and widely used in many businesses) is Hushmail. With Hushmail, you either use the Hushmail website to send and receive secure email or install and use a Hushmail email client program (available for desktops and some mobile devices). You can use your own, original email address, which gets proxied through Hushmail’s proxy services, or obtain a Hushmail email address, a cheaper solution. Hushmail is one among dozens of secure email providers currently available. Secure chat. Most OS- and device-provided chat programs do not offer strong security and privacy.

For strong end-to-end security you need to install an additional chat program. Luckily, there are dozens of chat programs, both free and commercial, that claim to offer greater security.
Some require installation of a client app; others offer website services. Most require all parties to communicate with the same program or use the same website (or at least the same chat protocol and protection). Common secure chat programs include ChatCrypt, ChatSecure, and Cryptocat. Most secure chat clients have the same basic features, so pick the one that enables you to communicate with the broadest set of people you need to securely chat with. Secure payments. Most payment systems are required to store lots of information about you and your purchases, and they are usually required to provide payment or payer details when asked by law enforcement.

Even if they aren’t required to provide detailed data to the police or governments, many payment databases are compromised each year by malicious hackers. Most users wishing for greater payment anonymity on the internet are turning to online cryptocurrencies, such as bitcoin. Users must first buy bitcoins, usually via traditional online payment methods, and must go through bitcoin exchanges to get their bitcoin value back out into traditional currencies.

Each exchange into and out of bitcoin typically takes a small payment fee. Of course, the privacy and anonymity of virtual currencies comes with real risk.

They are usually not considered legal currency and may not be provided the same protections under law as “real” currencies.

They may also have incredible price volatility, with the value of your holdings potentially jumping or declining by huge margins in a single day.
It’s also possible that a single crypto attack could result in permanent, unrecoverable loss. Hackers have been successful in stealing millions of dollars in bitcoins, and sometimes those thefts are not reimbursed by the compromised holders. As for credit cards, you can buy and use temporary online (or physical) credit cards. Most credit card agencies offer temporary cards, often at slightly high fee rates, which can be used for a temporary set period of time or even one-time use.
If a website gets compromised, exposing your temporary credit card, you won’t be at a loss because you’ll never use it again. Secure file transfers. Probably the only class of applications that offer more alternatives than secure email is secure file transfer.

Any program using SSH or SCP allows encrypted and secure file sharing, and there are dozens, if not hundreds, of commercial offerings. Users who wish to securely share files while also preserving their anonymity have a myriad of choices. One of the most popular commercial services is BTGuard.
It provides file anonymity services over the BitTorrent, a very popular peer-to-peer file sharing protocol. Anything Phil Zimmerman creates. Phil Zimmermann, creator of Pretty Good Privacy (PGP), cares deeply about privacy. He was willing to risk being arrested, imprisoned, and even potentially faced the U.S. death penalty because he strongly believed that everyone on the planet deserved good privacy tools. Every good and experienced computer security person I know and trust uses PGP.

To work with PGP, each participant creates their own private/public key pair and shares their public key with other participants for securely sending files, emails, or other content. Symantec bought and has supported PGP commercially since 2010, but dozens of open source versions are available and trusted, including OpenPGP.
If you don’t have PGP, get it, install it, and use it. Zimmermann, who was also behind Hushmail, is a co-founder of Silent Circle, which offers secure solutions for a range of technologies.
It even offers the Blackphone, which was designed from the ground up to be the most secure, generally accessible cellphone ever.

There have been some hacks of the Blackphone, but it still is the cellphone that prizes privacy and security above all other features -- at least as much as one can and still sell the product to the general population. Whatever Phil Zimmermann creates or promotes can be assured to be well thought out, delivering privacy and security in spades. Related articles

Google teaches “AIs” to invent their own crypto and avoid eavesdropping

reader comments 18 Share this story Google Brain has created two artificial intelligences that evolved their own cryptographic algorithm to protect their messages from a third AI, which was trying to evolve its own method to crack the AI-generated crypto. The study was a success: the first two AIs learnt how to communicate securely from scratch. Enlarge / The setup of the crypto system. P = input plaintext, K = shared key, C = encrypted text, and PEve and PBob are the computed plaintext outputs. The Google Brain team (which is based out in Mountain View and is separate from Deep Mind in London) started with three fairly vanilla neural networks called Alice, Bob, and Eve. Each neural network was given a very specific goal: Alice had to send a secure message to Bob; Bob had to try and decrypt the message; and Eve had to try and eavesdrop on the message and try to decrypt it. Alice and Bob have one advantage over Eve: they start with a shared secret key (i.e. this is symmetric encryption). Importantly, the AIs were not told how to encrypt stuff, or what crypto techniques to use: they were just given a loss function (a failure condition), and then they got on with it. In Eve's case, the loss function was very simple: the distance, measured in correct and incorrect bits, between Alice's original input plaintext and its guess. For Alice and Bob the loss function was a bit more complex: if Bob's guess (again measured in bits) was too far from the original input plaintext, it was a loss; for Alice, if Eve's guesses are better than random guessing, it's a loss. And thus an adversarial generative network (GAN) was created. Alice, Bob, and Eve all shared the same "mix and transform" neural network architecture, but they were initialised independently and had no connection other Alice and Bob's shared key. For Alice the key and plaintext are input into the first layer of the neural network; for Bob the key and the ciphertext were input; and for Eve, she got just the ciphertext. The first layer is fully-connected, so the text and key can mix about. Following the first layer there are a number of convolutional layers, which learn to apply a function to the bits that were handed to it by the previous layer. They don't know what that function might be; they just learn as they go along. For Alice, the final layer spits out some ciphertext; Bob and Eve output what they hope is the plaintext. Enlarge / Bob and Eve's reconstruction errors during training. You can see that Eve starts to improve, but then a change in the Alice-Bob crypto method shuts her out again. The results were... a mixed bag. Some runs were a complete flop, with Bob never able to reconstruct Alice's messages. Most of the time, Alice and Bob did manage to evolve a system where they could communicate with very few errors. In some tests, Eve showed an improvement over random guessing, but Alice and Bob then usually responded by improving their cryptography technique until Eve had no chance (see graph). The researchers didn't perform an exhaustive analysis of the encryption methods devised by Alice and Bob, but for one specific training run they observed that it was both key- and plaintext-dependent. "However, it is not simply XOR. In particular, the output values are often floating-point values other than 0 and 1," they said. In conclusion, the researchers—Martín Abadi and David G. Andersen—said that neural networks can indeed learn to protect their communications, just by telling Alice to value secrecy above all else—and importantly, that secrecy can be obtained without prescribing a certain set of cryptographic algorithms. There is more to cryptography than just symmetric encryption of data, though, and the researchers said that future work might look at steganography (concealing data within other media) and asymmetric (public-key) encryption. On whether Eve might ever become a decent adversary, the researchers said: "While it seems improbable that neural networks would become great at cryptanalysis, they may be quite effective in making sense of metadata and in traffic analysis." You can read the researchers' preprint paper on arXiv. This post originated on Ars Technica UK

It’s nearly 2017 and JPEGs, PDFs, font files can hijack your...

Get patching now Apple has distributed a fresh round of security updates to address remote-code execution holes in iOS, macOS, Safari, and the firmware for Apple Watch and AppleTV. Miscreants who exploit these flaws can take over the vulnerable device – all a victim has to do is open a JPEG or PDF file booby-trapped with malicious code, so get patching before you're caught out.

Check for software The fixes come just days before the Cupertino developer of TextEdit is set to hold a special event to introduce a (presumed) refresh of its Mac product line and potentially new iPad tablets. For those running iOS, the 10.1 release includes updates to address 12 CVE-listed security vulnerabilities in the firmware for the iPhone, iPad and iPod Touch. Those flaws include a remote code execution flaw in the handling of JPEG images (CVE-2016-4673), a remote code execution bug in WebKit (CVE-2016-4677), local code execution flaws, and a vulnerability in contacts (CVE-2016-4686) that would let an application pull Address Book details even when access has been revoked. For macOS Sierra (10.12.1), the update brings fixes for 16 CVE-listed vulnerabilities.

Those include the CVE-2016-4673 image-handling bug as well as remote code execution flaws that could be triggered by font files (CVE-2016-4667) and PDF files (CVE-2016-4671).

Also released was a fix for a denial of service error in Nvidia graphics card drivers (CVE-2016-4663) and a bug that exposed the length of user passwords (CVE-2016-4670). Included among the latest fixes for iOS and macOS was CVE-2016-4635, a remote audio eavesdropping vulnerability for FaceTime that Apple had previously attempted to remedy in older versions of iOS and OS X. Apple did not say whether the flaw was exposed in iOS 10.1 and macOS Sierra, or if the fix was an update to an already-installed security measure. For those running the Safari browser on Sierra and older versions of OS X, Apple has produced patches to address a trio of WebKit flaws that can allow web pages or applications to achieve remote code execution (CVE-2016-4666, CVE-2016-4677) and pull location information (CVE-2016-4676). Meanwhile, Apple Watch users are advised to update their arm candy to watchOS 3.1 to get fixes for eight CVE-listed flaws, including two flaws in sandbox profiles (CVE-2016-4664, CVE-2016-4665) that allow third-party applications to view image libraries and sound files without permission. The AppleTV will also get an update for 10 flaws, including the sandbox profiles flaws (CVE-2016-4664, CVE-2016-4665), the WebKit remote code execution bug (CVE-2016-4677), and the CoreGraphics JPEG bug (CVE-2016-4673) patched in other Apple products. ®

WatchGuard Takes Guesswork Out of Wi-Fi Security With Cloud-based Solution

WatchGuard Wi-Fi Cloud delivers automated wireless threat prevention with interactive engagement and analytics18 October 2016 – WatchGuard® Technologies has announced WatchGuard Wi-Fi Cloud, a secure, scalable and feature-rich Wi-Fi management platform with a new family of high-performance, cloud-ready access points.

Deployed together, this next-generation secure wireless solution delivers a sophisticated Wireless Intrusion Prevention System (WIPS), while turning Wi-Fi hot spots into powerful consumer research, analytics and push marketing tools. WatchGuard WiFi logo Architected from the ground up to focus on ease of deployment and administration, the WatchGuard Wi-Fi Cloud simplifies even the most complex aspects of Wi-Fi management, making fast, secure and intelligent Wi-Fi accessible to organisations of all types and sizes. WatchGuard Wi-Fi Cloud delivers high-quality wireless performance, while ensuring consistent security policies across all connected devices, even at remote locations.

The patented WIPS technology built into WatchGuard’s new cloud-ready AP120 and AP320 access points automatically classifies wireless devices as Authorized, Rogue, or External, resulting in a very low false positive rate.

This advanced rogue detection process can safely and automatically shut down unauthorised access points and clients, while nearly eliminating the risk of illegally interfering with neighbouring wireless networks. “Today’s savvy businesses realise that safe and reliable Wi-Fi is a basic requirement, but many SMBs and distributed enterprise organisations struggle to deliver it. We’ve developed a comprehensive solution that dramatically simplifies how businesses deploy and manage wireless, while at the same time elevating Wi-Fi security standards,” said Ryan Orsi, director of wireless products at WatchGuard. “In addition to security, the WatchGuard Wi-Fi Cloud makes it easier for organisations to turn Wi-Fi into an extension of their brand, an interactive experience for their customers and a powerful analytics tool.” WIRELESS SECURITYMost traditional wireless network management solutions fail to stop rogue devices from connecting to their networks or block threats like wireless denial-of-service attacks.

Current WIPS technology delivers a high rate of false positives, incorrectly categorising neighbouring hotspots and innocuously connected devices as malicious, which creates unnecessary frustration and end-user complaints. In addition to automatically detecting and disabling rogue wireless devices and attacks, WatchGuard’s industry-leading WIPS also provides customers with: Secure Bring Your Own Device (BYOD) Policy Enforcement – automatically identifies on-network smart devices and blocks unapproved connections. Accurate Location Tracking – pinpoints the location of connected wireless devices or sources of interference, enabling administrators to quickly take action. Flexible Deployment – deployable in configurations to meet any security need.
It can be installed as an overlay on top of an existing WLAN infrastructure or as a stand-alone enforcement system for Wi-Fi prohibited zones. Customers can easily and cost effectively run all of their wireless network traffic through one of WatchGuard's leading network security appliances, thereby providing the same AV, IPS, web filtering, spam blocking, application control, APT blocking, data loss prevention and reputation lookup techniques to wireless traffic.

This protects them against malware planting, eavesdropping and data theft and prevents inappropriate or illegal use of their network. INTERACTIVE ENGAGEMENT AND ANALYTICSThe Wi-Fi Cloud provides visibility into marketing data, including insights into footfall and customer demographics visualised on customisable dashboards. Organisations can easily monetise these insights by tapping into the mobile engagement features, which allow direct and customised communication with individual customers in the form of SMS, MMS and their social network of choice. WatchGuard Wi-Fi Cloud management features also include: Custom Splash Pages and Social Wi-Fi Engagement – captive portals allow businesses to personalise customer Wi-Fi experiences by offering promotional opportunities, surveys and strong authentication through Facebook, Twitter, LinkedIn, Instagram and other social applications. Mobile Engagement – delivers custom messages to customers via SMS, MMS, and social networks, based on predefined triggers including user interaction and length of time on-network. Wi-Fi Analytics - data is collected via passive scans, active scans and user connections in and around your Wi-Fi networks.

Analyses and conceptualises this data to provide insight into traffic patterns, behaviour and demographics of your Wi-Fi users, in addition to generating a visual map of foot traffic patterns on a floor plan. “There is a strong demand among our customers for widely deployable, cloud-enabled solutions and we are excited to add WatchGuard Wi-Fi Cloud to our portfolio,” said Ian Kilpatrick, director at Wick Hill. “This new Wi-Fi cloud functionality expands our ability to sell more to existing customers and to reach brand new customers.

Additionally, Firebox and Wi-Fi Cloud installations will increase partners’ service revenues.

This represents a big win for everyone.” ADDITIONAL RESOURCES: AVAILABILITY:WatchGuard Wi-Fi Cloud subscriptions, along with the AP120 and AP320 are available now.

Customers can purchase them as a stand-alone solution, or as part of a holistic configuration that routes traffic through a Firebox or XTM appliance, to extend best-in-class security services like APT Blocker, WebBlocker, and Gateway AntiVirus into their wireless environments.

For more information, visit https://www.watchguard.com/wifi. About WatchGuard Technologies, Inc.WatchGuard® Technologies, Inc. is a global leader in network security, providing best-in-class Unified Threat Management, Next Generation Firewall, secure Wi-Fi, and network intelligence products and services to more than 75,000 customers worldwide.

The company’s mission is to make enterprise-grade security accessible to companies of all types and sizes through simplicity, making WatchGuard an ideal solution for Distributed Enterprises and SMBs. WatchGuard is headquartered in Seattle, Washington, with offices throughout North America, Europe, Asia Pacific, and Latin America.

To learn more, visit WatchGuard.com. For additional information, promotions and updates, follow WatchGuard on Twitter, @WatchGuard on Facebook, or on the LinkedIn Company page.

Also, visit our InfoSec blog, Secplicity, for real-time information about the latest threats and how to cope with them at www.secplicity.org. Contacts:Rowena Case, WatchGuard Technologies0203 608 9070, ukmarketing@watchguard.com Peter Rennison, PRPR01442 245030, pr@prpr.co.uk

Encrypted communications could have an undetectable backdoor

Researchers warn that many 1,024-bit keys used to secure communications on the internet today might be based on prime numbers that have been intentionally backdoored in an undetectable way. Many public-key cryptography algorithms that are used to secure web, email, VPN, SSH and other types of connections on the internet derive their strength from the mathematical complexity of discrete logarithms -- computing discrete logarithms for groups of large prime numbers cannot be efficiently done using classical methods.

This is what makes cracking strong encryption computationally impractical. Most key-generation algorithms rely on prime parameters whose generation is supposed to be verifiably random. However, many parameters have been standardized and are being used in popular crypto algorithms like Diffie-Hellman and DSA without the seeds that were used to generate them ever being published.

That makes it impossible to tell whether, for example, the primes were intentionally "backdoored" -- selected to simplify the computation that would normally be required to crack the encryption. Researchers from University of Pennsylvania, INRIA, CNRS and Université de Lorraine recently published a paper in which they show why this lack of cryptographic transparency is problematic and could mean that many encryption keys used today are based on backdoored primes without anyone -- aside from those who created them -- knowing. To demonstrate this, the researchers created a backdoored 1,024-bit Diffie-Hellman prime and showed that solving the discrete log problem for it is several orders of magnitude easier than for a truly random one. "Current estimates for 1,024-bit discrete log in general suggest that such computations are likely within range for an adversary who can afford hundreds of millions of dollars of special-purpose hardware," the researchers said in their paper. "In contrast, we were able to perform a discrete log computation on a specially trapdoored prime in two months on an academic cluster." The problem is that for someone who doesn't know about the backdoor, demonstrating that a prime has been trapdoored in the first place would be nearly impossible. "The near universal failure of implementers to use verifiable prime generation practices means that use of weak primes would be undetectable in practice and unlikely to raise eyebrows." This is conceptually similar to the backdoor found in the Dual_EC random number generator, which is believed to have been introduced by the U.S. National Security Agency. However, that backdoor was much easier to find and, unlike Diffie-Hellman or DSA, Dual_EC never received widespread adoption. Diffie-Hellman ephemeral (DHE) is slowly replacing RSA as the preferred key exchange algorithm in TLS due to its perfect forward secrecy property that's supposed to keep past communications secure even if the key is compromised in the future. However, the use of backdoored primes would defeat that security benefit. Furthermore, 1,024-bit keys are still widely used online, despite the U.S. National Institute of Standards and Technology recommending a transition to larger key sizes since 2010.

According to the SSL Pulse project, 22 percent of the internet's top 140,000 HTTPS-enabled websites use 1,024-bit keys. "Our results are yet another reminder that 1,024-bit primes should be considered insecure for the security of cryptosystems based on the hardness of discrete logarithms," the researchers said. "The discrete logarithm computation for our backdoored prime was only feasible because of the 1,024-bit size, and the most effective protection against any backdoor of this type has always been to use key sizes for which any computation is infeasible." The researchers estimate that performing similar computations for 2048-bit keys, even with backdoored primes, would be 16 million times harder than for 1,024-bit keys and will remain infeasible for many years to come.

The immediate solution is to switch to 2048-bit keys, but in the future all standardized primes should be published together with their seeds, the researchers said. Documents leaked in 2013 by former NSA contractor Edward Snowden suggested that the agency has the ability to decrypt a lot of VPN traffic. Last year, a group of researchers speculated that the reason for this was the widespread use in practice of a small number of fixed or standardized groups of primes. "Performing precomputation for a single 1,024-bit group would allow passive eavesdropping on 18 percent of popular HTTPS sites, and a second group would allow decryption of traffic to 66 percent of IPsec VPNs and 26 percent of SSH servers," the researchers said in their paper at that time. "A close reading of published NSA leaks shows that the agency’s attacks on VPNs are consistent with having achieved such a break."

Arrested NSA contractor may have hoarded secrets to work from home

reader comments 89 Share this story Investigators have little doubt that a National Security Agency contractor arrested in August hoarded mountains of classified material, but so far they've found no evidence that he leaked anything to anyone, The New York Times reported Friday. Still, even if Harold T. Martin III didn't intentionally leak anything, federal officials remain highly concerned. Martin's home computers had "minimal security protection," leaving open the possibility, however remote, that hackers broke in and stole data that could compromise vital national security programs.

As the NYT reported: "Let’s just say he’s only a psycho hoarder and he keeps this stuff with his old copies of National Geographic and his collection of lunchboxes," said an administration official, who also asked not to be named. "That’s still extremely troubling to anyone in national security, because people like that don’t keep track of where things are or with whom they are talking." In Mr. Martin’s case, the official said, the sloppy handling "is particularly worrisome—we are talking sources and methods, tactics, techniques and procedures.

Those are the things we guard most closely." On seven occasions in the last three years, top-secret information has leaked from the NSA, raising concerns that leakers remain at large in a post-Edward Snowden agency. Martin's former wife portrayed her ex-husband, a former Navy officer, as a loyal US patriot who probably took the material so he could work on it at home.

The hoarding occurred over years.

At first, material was snuck out on paper, then on CDs, and eventually on thumb drives. A former PhD mentor at the University of Maryland, Baltimore County, where Martin was a PhD candidate, also portrayed Martin as dedicated and thoughtful.

But the mentor also said Martin seemed to believe his research into offensive computer security was under-appreciated on a campus where students and faculty had little understanding of the military. Over the past few years, two leaks in particular have concerned officials. One involved techniques the NSA uses to penetrate targeted computers even when they're not connected to the Internet.

Another published by WikiLeaks identified eavesdropping targets and included transcripts of intercepted communications from American allies.
So far, investigators are skeptical that the information came from Martin, but they are continuing to look for connections. Listing image by NSA