30 September 2013
Al Qaeda Promotes Own Comsec
http://www.nytimes.com/2013/09/30/us/qaeda-plot-leak-has-undermined-
us-intelligence.html
Qaeda Plot Leak Has Undermined U.S. Intelligence
By ERIC SCHMITT and MICHAEL S. SCHMIDT
Published: September 29, 2013
WASHINGTON — As the nation’s spy agencies assess the fallout from
disclosures about their surveillance programs, some government analysts and
senior officials have made a startling finding: the impact of a leaked terrorist
plot by Al Qaeda in August has caused more immediate damage to American
counterterrorism efforts than the thousands of classified documents disclosed
by Edward Snowden, the former National Security Agency contractor.
Since news reports in early August revealed that the United States intercepted
messages between Ayman al-Zawahri, who succeeded Osama bin Laden as the head
of Al Qaeda, and Nasser al-Wuhayshi, the head of the Yemen-based Al Qaeda
in the Arabian Peninsula, discussing an imminent terrorist attack, analysts
have detected a sharp drop in the terrorists’ use of a major communications
channel that the authorities were monitoring. Since August, senior American
officials have been scrambling to find new ways to surveil the electronic
messages and conversations of Al Qaeda’s leaders and operatives.
“The switches weren’t turned off, but there has been a real decrease
in quality” of communications, said one United States official, who
like others quoted spoke on the condition of anonymity to discuss intelligence
programs.
The drop in message traffic after the communication intercepts contrasts
with what analysts describe as a far more muted impact on counterterrorism
efforts from the disclosures by Mr. Snowden of the broad capabilities of
N.S.A. surveillance programs. Instead of terrorists moving away from electronic
communications after those disclosures, analysts have detected terrorists
mainly talking about the information that Mr. Snowden has disclosed.
Senior American officials say that Mr. Snowden’s disclosures have had
a broader impact on national security in general, including counterterrorism
efforts. This includes fears that Russia and China now have more technical
details about the N.S.A. surveillance programs. Diplomatic ties have also
been damaged, and among the results was the decision by Brazil’s president,
Dilma Rousseff, to postpone a state visit to the United States in protest
over revelations that the agency spied on her, her top aides and Brazil’s
largest company, the oil giant Petrobras.
The communication intercepts between Mr. Zawahri and Mr. Wuhayshi revealed
what American intelligence officials and lawmakers have described as one
of the most serious plots against American and other Western interests since
the attacks on Sept. 11, 2001. It prompted the closing of 19 United States
Embassies and consulates for a week, when the authorities ultimately concluded
that the plot focused on the embassy in Yemen.
McClatchy Newspapers first reported on the conversations between Mr. Zawahri
and Mr. Wuhayshi on Aug. 4. Two days before that, The New York Times agreed
to withhold the identities of the Qaeda leaders after senior American
intelligence officials said the information could jeopardize their operations.
After the government became aware of the McClatchy article, it dropped its
objections to The Times’s publishing the same information, and the newspaper
did so on Aug. 5.
In recent months, senior administration officials — including the director
of national intelligence, James Clapper Jr. — have drawn attention to
the damage that Mr. Snowden’s revelations have done, though most have
been addressing the impact on national security more broadly, not just the
effect on counterterrorism.
“We have seen, in response to the Snowden leaks, Al Qaeda and affiliated
groups seeking to change their tactics, looking to see what they can learn
from what is in the press and seek to change how they communicate to avoid
detection,” Matthew Olsen, the director of the National Counterterrorism
Center, told a security conference in Aspen, Colo., in July.
American counterterrorism officials say they believe the disclosure about
the Qaeda plot has had a significant impact because it was a specific event
that signaled to terrorists that a main communication network that the
group’s leaders were using was being monitored. The sharpest decline
in messaging has been among the Qaeda operatives in Yemen, officials said.
The disclosures from Mr. Snowden have not had such specificity about terrorist
communications networks that the government is monitoring, they said.
“It was something that was immediate, direct and involved specific people
on specific communications about specific events,” one senior American
official said of the exchange between the Qaeda leaders. “The Snowden
stuff is layered and layered, and it will take a lot of time to understand
it. There wasn’t a sudden drop-off from it. A lot of these guys think
that they are not impacted by it, and it is difficult stuff for them to
understand.”
Other senior intelligence and counterterrorism officials offer a dissenting
view, saying that it is difficult, if not impossible, to separate the impact
of the messages between the Qaeda leaders from Mr. Snowden’s overall
disclosures, and that the decline is more likely a combination of the two.
“The bad guys are just not going to talk operational planning
electronically,” said one senior counterterrorism official. Moreover,
that official and others say, it could take months or years to fully assess
the impact of Mr. Snowden’s disclosures on counterterrorism efforts.
Over the past decade, the N.S.A. has invested billions of dollars in a
clandestine campaign to preserve its ability to eavesdrop. The agency has
circumvented or cracked much of the encryption, or digital scrambling, that
guards global commerce and banking systems, protects sensitive data like
trade secrets and medical records, and automatically secures the e-mails,
Web searches, Internet chats and phone calls of Americans and others around
the world, according to documents provided by Mr. Snowden.
The government’s greatest fear concerning its counterterrorism operations
is that over the next several months, the level of intercepted communications
will continue to fall as terrorists most likely find new ways to communicate
with one another, one senior American official said. It will likely take
the government some time to break into that method and monitor communications.
One way the terrorists may try to communicate, the official said, is strictly
through couriers, who would carry paper notes or computer flash drives. If
that happens, the official said, terrorists will find it very difficult to
communicate as couriers take significant time to move messages.
“The problem for Al Qaeda is they cannot function without cellphones,”
said one former senior administration official. “They know we listen
to them, but they use them anyhow. You can’t run a sophisticated
organization without communications in this world. They know all this, but
to operate they have to go on.”
A senior intelligence official put it this way: “They are agile, we
are agile. When we see a change in behavior, our guys are changing right
along with it, or we’re already seeing it and adapting to it. Our
capabilities are changing in hours and days, versus weeks and months like
we used to.”
To be sure, Qaeda leaders and their top lieutenants use other secure electronic
communications as well as old-fashioned means — like couriers, as Bin
Laden did — that pose major challenges to American intelligence services.
In the past few months, the Global Islamic Media
Front, the propaganda arm of Al Qaeda and other Islamic terrorist groups,
has released new software that allows users to encrypt communications for
instant-messaging and cellphones. Officials say these new programs may pose
fresh challenges for N.S.A. code breakers.
Jihadists have been working on camouflaging their communications through
encryption software for years.
Al Qaeda’s use of advanced encryption technology dates to 2007, when
the Global Islamic Media Front released the Asrar al-Mujahedeen, or so-called
“Mujahedeen Secrets,” software. An updated version, Mujahedeen
Secrets 2, was released in January 2008, and has been revised at least twice,
most recently in May 2012, analysts said.
The program was popularized in the first issue of Inspire, Al Qaeda in the
Arabian Peninsula’s quarterly online magazine, in a July 2010 post entitled
“How to Use Asrar al-Mujahedeen: Sending and Receiving Encrypted
Messages.”
Since then, each issue of Inspire has offered a how-to section on encrypting
communications, recommending MS2 as the main encryption tool.
Shortly after Mr. Snowden leaked documents about the secret N.S.A. surveillance
programs, chat rooms and Web sites used by jihadis and prospective recruits
advised users how to avoid N.S.A. detection, from telling them to avoid using
Skype to recommending specific online software programs like MS2 to keep
spies from tracking their computers’ physical locations.
A few months ago, the Global Islamic Media Front issued new software that
relies on the MS2’s “Asrar al-Dardashah, or “Secrets of
Chatting,” which allows users to encrypt conversations over
instant-messaging software like Paltalk, Google Chat, Yahoo and MSN, according
to Laith Alkhouri, a senior analyst at Flashpoint Global Partners, a New
York security consulting firm that tracks militant Web sites.
In early September, the Global Islamic Media Front said it had released an
encryption program for messages and files on mobile phones running the Android
and Symbian operating systems.
According to the group, the software can encrypt text messages and files
and send them by e-mail or between cellphones with different operating systems.
The software also lets users securely check e-mail and prevents users from
receiving nonencrypted messages, the group claimed.
Monday, September 30, 2013
Sunday, September 29, 2013
NSA PGP Public Keys
|
NSA SYANPSE
|
NSA IDA Cryptologic Research Centers
|
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vDaUMi3sKo-XeKpO07f8naj--TBD4hCuGD7ANqQstKjbjmCogcFxvDKHmUP2x3Pf7luabCqnpKPEUq6pYZUAVAKTw28XXvbQsxpmjjtdiv3Fv5TaM_XA=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vY4C44exSJUpIfUrw3OFYGzatCEtUlgm7jw5bJoqGacwFYO5VTcSHr5vrhCmROpgDLRGQ8r-fdPOGIx0zlkfEMXu33ZRrCeGSk5K1H_Q76lcBP20cb=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tm9IjvTg7tsIdI-6l0RcNzkymhGIrFGvnxGgkO24W6PGpU_QM48WE5XU5g5-G8ciXkOCjrLRyj-5YYqL3WenMmf2S8lvyy842vXKHYB4wAApKAyN-p=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vNsjGRXY1JRboJYMZIgiyVvE7P_usRzA1MqimjY1W2JaJiUnf3qgwzag5ayA9ws-wqz1sdZxID0DQVirVzVb1Spm57wd51MNADNd_tek1qTCWXUtq5=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vyQxqVp9wBjTcTj8-2uXXSFIabnCoRZgcFUjOx5HBWMZpcAfOzbnJITcThLucjftcZtcN7aF2B0wN5B8QYydbfKy3nMcL8-0ba_UkccHam9iLQHKLN=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tZ9bNPXmIFvllX_TcwBx9maSqfSL1sz9rmvvNI7yibQdsQfEf0z4Nqj-ganhomBPQrfYus8UhheExYCvMwx1PheKqTWIFr5oJWeiFBJ1atn-Ce3BYf=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sBqwmhkgTOITF-RK8WeHVDdmUmE88zFqilVCW5xAgOuHrksLPI0QOTjqZjln75_P1YfA6frZQLkMHxK30bp9h5sGjmD6jK4WJTFSvvi8tCXhwB7JO55g=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t8o_pBLnvn9R1_4JP7bXd74kpykOWjffuv-4Mcf-RNn1IZFY99dPjmMmmmgj_4YRvoKg166L-qUjwzAEgHYEOGR6Ibh42860272HCzXuXP0FH5Bdx7Eg=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ueTMM8aOG7W4JRlR-3lNWmIGHKiyFt6ecvpYi7rY6vMqFnj5f7aG2ZlS2Jii-D_GjarzlBu1_mnR7MmuUdbPJkZ_IlDNw_wqhpkXxyNeGlw7LvuyGXEw=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_twDYmaUsfRpmpthEsbpBew96r3WdAVc509eHUp6OYfG7Vg1rVLwl763swdiVlsG98C4WLPdfUmyyBPiVcZa45COlzx0dPYP4f-4bWi3ddAw_8i8BAl=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u35p_4Kg5-_te1a140C8tSdFldEwevHeeKUwP6v1Q0-hgYGJAIH30bWkI4bO_vsztn7-yIPs1Y9GFYSxir_5tkSIHVcRa-dudANu4YtSfo9Om3dHywuw=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tY-Br8vQyhCqycRdOljR04_nKu7VIRYOgpKMRmBzwnD862i8gKH-8t3Jhf4z6F6wq888RMJEtfFJOqBFBePeywMpht-OmERtgT08XG6ZH74R5bzfNcwQ=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_slaxfxpIT682qdUvY-_9i5ROXeVsomtcfYWpZ3AnN75_uK6_2Zgw_eybZqTUVltmIjxsY86W1DgTLBitS3w2pw7QnM2zDsYWRlwK-MxQ_pzmpbDf1w=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sxOU31CTtBpSE9smBtZSZlLryYXd1n0n6SLzLg46RS_b56DaLXyStXP-uN1kyVD2avYE44yTYbWbtxpL_8SZhjQ-f0L_KynFXEXgMIPynjHTOZW6Im=s0-d)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tCbAyZhQ-KXoS4uTGZWUynyBi-6rQ_4MPgdsiCCwhc06LETSdMlPLrPXhHReIdDMJk1rDshR3ljKomiic1mxL241VwxNcP3a9suv_FqVUHwbOS_iy5cQ=s0-d)
Friday, September 13, 2013
NSA Brazil Spy Slides Decensored
Date: Thu, 12 Sep 2013 15:56:22 -0700 (PDT)
From: paulmd[at]efn.org
To: ronxyzzzzz
Subject: The rest of the the Geopolitical trends: censored slide
I am not bothering to encrypt this, for several reasons. 1) it was on Brazilian TV already. 2) I already posted this on Wikipedia. 3) I want to yank the NSA's chain, just a bit. 4) There's little here that will surprise anyone who reads the news, with the possible exception of what actually got published on O Globo's website.
The Fantastico broadcast itself actually reveals most of this slide. (in fact, you already have posted the some of the source images) There is an image of it shown on Greenwald's laptop. And there were closeups of certain areas. Using a combination of tools (video capture software, an image compositor to stitch the closeup pans, and a photo editor), and a talent for reading blurry text, I am able to reconstruct with full confidence all but 2 of the blacked items.
I have about 50% certainty of one of the remaining (the second) "Non State Organizations and Turkey on the World Stage", I think so partly because 1) the letters fit, and 2) the next slide. Which again Fantastico revealed a larger portion of in the original broadcast.
Feel free to post, if you like.
And yes, I'm the guy who wrote the new articles on OAKSTAR and STORMBREW on Wikipedia, which you should check out. There is information that is actually new. The slides were shown on Fantastico, but the tables and some analyses are mine.
From: paulmd[at]efn.org
To: ronxyzzzzz
Subject: The rest of the the Geopolitical trends: censored slide
I am not bothering to encrypt this, for several reasons. 1) it was on Brazilian TV already. 2) I already posted this on Wikipedia. 3) I want to yank the NSA's chain, just a bit. 4) There's little here that will surprise anyone who reads the news, with the possible exception of what actually got published on O Globo's website.
The Fantastico broadcast itself actually reveals most of this slide. (in fact, you already have posted the some of the source images) There is an image of it shown on Greenwald's laptop. And there were closeups of certain areas. Using a combination of tools (video capture software, an image compositor to stitch the closeup pans, and a photo editor), and a talent for reading blurry text, I am able to reconstruct with full confidence all but 2 of the blacked items.
I have about 50% certainty of one of the remaining (the second) "Non State Organizations and Turkey on the World Stage", I think so partly because 1) the letters fit, and 2) the next slide. Which again Fantastico revealed a larger portion of in the original broadcast.
Feel free to post, if you like.
And yes, I'm the guy who wrote the new articles on OAKSTAR and STORMBREW on Wikipedia, which you should check out. There is information that is actually new. The slides were shown on Fantastico, but the tables and some analyses are mine.
| Slide as published by
Fanstastico: http://cryptome.org/2013-info/09/nsa-br-mx-2/pict17.jpg ![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sLF1Dze0HNfqsSivaknuP3NawuClf4EIqfLLd6oxmCkzNvnR-r6XsfBd94IOIJgdVUK73pHWjv3mj84Qo6390azQRX-ZKSewkGNKnubqDZQOZHUhxG6v_wdZU=s0-d)
Screen shot of slide by Fanstastico: ![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tpU-UUTzL4Z7m05jdR7CH86iKRkxEdFL6r2x4BFtOsA4enmrVNhbvrPHBrzpVyYmYxw_XZPL7K2J_nDRqoqAOc5iikVTtuOfLqvalACglgdvv4Bj-7bd4XwNY=s0-d)
Decensored: ![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sovxEfNjNAfydhMSmBO2nyTlLdmk5rM-n5I660dTwQsMw5SkSVHR5pBEvbtuAJCH5CpWT1D9jFYj40aYGCMa3v_WGDQA0_ZnwgYU2_uoxhOUxa7amPQ-XarYI=s0-d) |
| Slide as publised by
Fanstastico: http://cryptome.org/2013-info/09/nsa-br-mx-2/pict16.jpg ![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sRUYKVycPys2LBWj17tmWNUOprAORS1xd_xGSi_ECUJ_vMn5E7Ol0zrQtBRkoR_Ho4vdhJ-bmIhGnjCoCtEPBoTGHwcUmGB1dCaUiUPlV4uuAJAxZUBaOvew=s0-d)
Decensored: ![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tPQh_MIXO4bWq9ciHBSEvDJkdUbE6Q49ig7NkvIAflEo1-7-I6rdHCicZCOmnfUpVda3Rr83iUlMUV1ETS7Oi0wJDcnruj4AUEBBQHqg_jv_baMu6sRDY_5g=s0-d) |
Thursday, September 12, 2013
NSA-FBI-NYPD SPYING UNITS!
11 September 2013
FBI Joint Terrorism Task Force and New York Police Department Spy Division
The location of these facilities is described in the recently published "Enemies Within: Inside the NYPD's Secret Spying Unit," by Associated Press reporters Matt Apuzzo and Adam Goldman
FBI Joint Terrorism Task Force and New York Police Department Spy Division
The location of these facilities is described in the recently published "Enemies Within: Inside the NYPD's Secret Spying Unit," by Associated Press reporters Matt Apuzzo and Adam Goldman
|
West entrance to FBI Joint Terrorism Task Force (NBC are initials of
the National Biscuit Company)
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ud9I9QwnWON6An2k8S490wE-lJvvyYzJcePSiHzfKeOC3RWE5VUjcV0opxEZs_vyxeJl2u2iKHQ6I296bDXWG1GN2afXwwq8Bnnerkftt6alYW7kfpsA=s0-d) |
Bridge Links FBI JTTF, at upper left, to NYPD Spying Unit across 10th
Avenue
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t27J2dLv6LZ_7U8agIkRszfYkNtTYgZXVeBuRhPGDQO2zX7pbjtIFDN9OKnyX2Cuw3WzqdrbjpQ8Cd-CPnRyDYMU9ng4EM0bR5tGCsfjh3ro2SlE7gLA=s0-d) |
Bridge Links FBI JTTF, at front, to NYPD Spying Unit across 10th Avenue
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_uNpx5_fs0HGULTUhC2E4wWatu7cFqO8VkWtwHBpFA59XnE4TjtokoeDFGrkDiyeyzM-BY0sajuFbJOGuZhJkLuvtuq-OgVHUYI_0PK4FoDPVgFkMB9LA=s0-d) |
Bridge Links FBI JTTF, at rear, to NYPD Spying Unit across 10th Avenue
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vwkiuIV4qC96nQ9b8Ejq_6lnz3tHb94dvJaVs4bdsM9-gVwwEu-RbLBTQdLC-HK4_lesq_to8hH_AgWvySTqJUIGbcfWXP2Pi2xWP4dNjRU1RwZs2bojc=s0-d) |
Bridge Links FBI JTTF, at rear, to NYPD Spying Unit across 10th Avenue
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vEaDfFdChI5GNEkvEVZe-gR-E_Vafn_imV_SQtZFe0t4_IdADfS1__nFIhjDfqRXmZOHr2qhEblYXrdV9SUn46QzFPxHCdMwRBA_RU1hUr21nQsCUghUw=s0-d) |
NYPD Spying Unit at left, FBI JTTF at right
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sVWfv_nHEr7TOyB8p1S9PKn4BFv1WcCoxVZ5Rscg40DlE7n3CxFp9EGgtRlF9wDsqo_nYrMenzuROW6xsaqKGCSpTWk5q6Tc3XuOCg6bZO45tQUWujwaE=s0-d) |
East facade FBI JTTF
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vyoeqdjRLc-4mhJSeDALpJ96LLLXkD91Q1pmUE6fs-kCI3v84nYbwjkr02lAfndwSl7QUO3y1aBkEwyTks-YbGfXTC0xhBNy9_cGD4uyCozXJbtlMPTeo=s0-d) |
North facade of FBI JTTF
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tXX4yyYDjVbA77AoDdGJo8Zj5NuApKx4y_47J6fpuSsBj9A1LUzxnZt3a97tzSqbNZxt1QJiX1G4EqfNSu3silvk3LFijup4EWH__JzExVyhLP-_4o7w=s0-d) |
West facade of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sh9hIAYZRZFm1xIWQEn7swTeIO2c_weuXAlf18AXyxJASMhow2er_UvnIaiAygs1kyi-cOL8Z1zQLTOm9cbsW5gUlFcUkD3mmi9EMBQSxXfIk5enBP=s0-d) |
North facade of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sfSPMKWR37Sdk5vwMPH8fwTMj4T9gif39gV7Z-UkdWjhwkttPyaMAgOFhxXihZ5shjICKLq_Mrw6HVZXut47z_W65uQN3YpkzkfxZzoWMLW0Bwgcqzag=s0-d) |
South facade of FBI JTTF
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vJt30d1EKILifYrsXGgD0yV_vJVLTUVImH92aBH4GfWVh9DoYQYXgAiDUP2D5XP_HaufNVUqeON6t0rJsO79wTtN-fpil6ekaUBxbxwgA1kzQCkDD3Xk4=s0-d) |
East facade of FBI JTTF
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sGwfYPgJTy75Oy5JQZ5aWPAIm0Ep_saJgqvpRSR-TYXemGCSw3F9CEVr6XiNzk1JdamunvD1sH6i4PyVt9w0qM3sXAsMC7vFQkE6sybxRXlP1jXt03CA=s0-d) |
Southwest facades of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ulEx7fJqKS823VzrqI9ltTWOuC7Elt5g7MF4SO_R0TniyaSWTYJC0IiUF0HRb2p1-yZPfgYMJN6QTOJczRAaxVmBnoLG4xwcTXCQlPMQhD1l1HpfKBwaE=s0-d) |
South facade of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sjfcNygPcTvkzy07OiZyuc1w5aTBeTdrko3nmXxqZkBLWNFMGv2Prw1aADR39nRFfQ98U4UnoTr3bikJA_5NrXSfFUR8KzFKtXT5rr9q6ybupbAUEE=s0-d) |
South facade of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tIpTa_Pg9fmnJOSVSQffCFR3QYbdZet3EtMs4zooj9x9gf9AZc05YCTgZzocQqe0Mw4_qZFLj1BTf4iMyY6laX-MsNgZ3xI9atOJ4Fo-_T_iKwQid9Tg=s0-d) |
Possible South facade of NYPD Spying Unit
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vmkAX7Gc_wYuh8vjiw7HINHFOerc4j2u4ECHmK2iIPSDGP47x6AA2TSvxi62jackzArlcHGnQetEgwalLKW7oaTivDUqg0_7l-EHsWHKdlQ-PZXKXX=s0-d) |
NYPD Spying Unit vehicle
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_u-gcYKc4ZABFK759V5cMLDiaVObRy9sCZcJE36SMIYEmrBW8Z-CqSSCM9Go8g2ePcOjiGo0wTFvWKfj1J5-BGOC3fBk7SvHUhMJEH2pZP2vtDKeZVc4g=s0-d) |
NYPD Spying Unit vehicle
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_t2gPoSKe_jCiuR_aTOV8rfT9YnzSr1eCXbMye0u57ER7gYMk9TZDACjvXQVI-HSRi9u1H3zuJG2yUsbtbOqzKKaIALg8LksGVLo7EtOBViIsvUrrFq2g=s0-d) |
NYPD Spying Unit vehicle
![[Image]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_tY_oTQNnc9ANGKZBHR_3q5giqLmdGcU6QspCtIn_qo5L9WLenLqwyljU0ekAcQ7X5tTrziJ3CwBmb3r0MC-fIeQ4JWbx1cXGXb_eivG8UpaJ0HR6TE=s0-d) |
PRISM-Proof Security Considerations!!!!
Date: Wed, 11 Sep 2013 16:30:50 -0400
From: Phillip Hallam-Baker <hallam[at]gmail.com>
To: "cryptography[at]metzdowd.com" <cryptography[at]metzdowd.com>
Subject: [Cryptography] Summary of the discussion so far
I have attempted to produce a summary of the discussion so far for use as a requirements document for the PRISM-PROOF email scheme. This is now available as an Internet draft.
http://www.ietf.org/id/draft-hallambaker-prismproof-req-00.txt
I have left out acknowledgements and references at the moment. That is likely to take a whole day going back through the list and I wanted to get this out.
If anyone wants to claim responsibility for any part of the doc then drop me a line and I will have the black helicopter sent round.
--
Website: http://hallambaker.com/
_______________________________________________
The cryptography mailing list
cryptography[at]metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
From: Phillip Hallam-Baker <hallam[at]gmail.com>
To: "cryptography[at]metzdowd.com" <cryptography[at]metzdowd.com>
Subject: [Cryptography] Summary of the discussion so far
I have attempted to produce a summary of the discussion so far for use as a requirements document for the PRISM-PROOF email scheme. This is now available as an Internet draft.
http://www.ietf.org/id/draft-hallambaker-prismproof-req-00.txt
I have left out acknowledgements and references at the moment. That is likely to take a whole day going back through the list and I wanted to get this out.
If anyone wants to claim responsibility for any part of the doc then drop me a line and I will have the black helicopter sent round.
--
Website: http://hallambaker.com/
_______________________________________________
The cryptography mailing list
cryptography[at]metzdowd.com
http://www.metzdowd.com/mailman/listinfo/cryptography
Internet Engineering Task Force (IETF) Phillip Hallam-Baker
Internet-Draft Comodo Group Inc.
Intended Status: Standards Track September 11, 2013
Expires: March 15, 2014
PRISM-Proof Security Considerations
draft-hallambaker-prismproof-req-00
Abstract
PRISM is reputed to be a classified US government that involves
covert interception of a substantial proportion of global Internet
traffic. This document describe the security concerns such a program
raises for Internet users and security controls that may be employed
to mitigate the risk of pervasive intercept capabilities regardless
of source.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Hallam-Baker March 15, 2014 [Page 1]
Internet-Draft Writing I-Ds using HTML September 2013
Table of Contents
1. Requirements . . . . . . . . . . . . . . . . . . . . . . . . . 3
2. Attack Degree . . . . . . . . . . . . . . . . . . . . . . . . 3
2.1. Content Disclosure . . . . . . . . . . . . . . . . . . . 3
2.2. Meta Data Analysis . . . . . . . . . . . . . . . . . . . 4
2.3. Traffic Analysis . . . . . . . . . . . . . . . . . . . . 4
2.4. Denial of Service . . . . . . . . . . . . . . . . . . . . 4
2.5. Protocol Exploit . . . . . . . . . . . . . . . . . . . . 5
3. Attacker Capabilities . . . . . . . . . . . . . . . . . . . . 5
3.1. Passive Observation . . . . . . . . . . . . . . . . . . . 5
3.2. Active Modification . . . . . . . . . . . . . . . . . . . 5
3.3. Cryptanalysis . . . . . . . . . . . . . . . . . . . . . . 6
3.4. Kleptography . . . . . . . . . . . . . . . . . . . . . . 6
3.4.1. Covert Channels in RSA . . . . . . . . . . . . . . . 6
3.4.2. Covert Channels in TLS, S/MIME, IPSEC . . . . . . . 6
3.4.3. Covert Channels in Symmetric Ciphers . . . . . . . . 7
3.4.4. Covert Channels in ECC Curves . . . . . . . . . . . 7
3.4.5. Unusable Cryptography . . . . . . . . . . . . . . . 7
3.5. Lawful Intercept . . . . . . . . . . . . . . . . . . . . 7
3.6. Subversion or Coercion of Intermediaries . . . . . . . . 7
3.6.1. Physical Plant . . . . . . . . . . . . . . . . . . . 8
3.6.2. Internet Service Providers . . . . . . . . . . . . . 8
3.6.3. Router . . . . . . . . . . . . . . . . . . . . . . . 8
3.6.4. End Point . . . . . . . . . . . . . . . . . . . . . 8
3.6.5. Cryptographic Hardware Providers . . . . . . . . . . 8
3.6.6. Certificate Authorities . . . . . . . . . . . . . . 8
3.6.7. Standards Organizations . . . . . . . . . . . . . . 9
4. Controls . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1. Confidentiality . . . . . . . . . . . . . . . . . . . . . 9
4.1.1. Perfect Forward Secrecy . . . . . . . . . . . . . . 10
4.2. Policy, Audit and Transparency . . . . . . . . . . . . . 10
4.2.1. Policy . . . . . . . . . . . . . . . . . . . . . . 10
4.2.2. Audit . . . . . . . . . . . . . . . . . . . . . . . 10
4.2.3. Transparency . . . . . . . . . . . . . . . . . . . . 10
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . . 11
Hallam-Baker March 15, 2014 [Page 2]
Internet-Draft Writing I-Ds using HTML September 2013
1. Requirements
PRISM is reputed to be a classified US government that involves
covert interception of a substantial proportion of global Internet
traffic. While the precise capabilities of PRISM are unknown the
program is believed to involve traffic and meta-data analysis and
that the intercepts are obtained with the assistance of
intermediaries trusted by Internet end users. Such intermediaries may
or may not include ISPs, backbone providers, hosted email providers
or Certificate Authorities.
Government intercept capabilities pose a security risk to Internet
users even when performed by a friendly government. While use of the
intercept capability may be intended to be restricted to counter-
terrorism and protecting national security, there is a long and
abundant history of such capabilities being abused. Furthermore an
agency that has been penetrated by an Internet privacy activist
seeking to expose the existence of such programs may be fairly
considered likely to be penetrated by hostile governments.
The term 'PRISM-Proof' is used in this series of documents to
describe a communications architecture that is designed to resist or
prevent all forms of covert intercept capability. The concerns to be
addressed are not restricted to the specific capabilities known or
suspected of being supported by PRISM or the NSA or even the US
government and its allies.
2. Attack Degree
Some forms of attack are much harder to protect against than others
and providing protection against some forms of attack may make
another form of attack easier.
The degrees of attack that are of concern depend on the security
concerns of the parties communicating.
2.1. Content Disclosure
Content disclosure is disclosure of the message content. In the case
of an email message disclosure of the subject line or any part of the
message body.
The IETF has a long history of working on technologies to protect
email message content from disclosure beginning with PEM and MOSS. At
present the IETF has two email security standards that address
confidentiality with incompatible message formats and different key
management and distribution approaches.
S/MIME and PGP may both be considered broken in that they reveal the
message subject line and content Meta-data such as the time. This
problem is easily addressed but at the cost of sacrificing backwards
Hallam-Baker March 15, 2014 [Page 3]
Internet-Draft Writing I-Ds using HTML September 2013
compatibility.
2.2. Meta Data Analysis
Meta Data is information that is included in a communication protocol
in addition to the content exchanged, This includes the sender and
receiver of a message, the time, date and headers describing the path
the message has taken in the Internet mail service. Meta-data
analysis permits an attacker to uncover the social network of parties
that are in frequent communication with each other.
Preventing disclosure of meta-data is possible through techniques
such as dead drops and onion routing but such approaches impose a
heavy efficiency penalty and it is generally considered preferable to
limit the parties capable of performing meta-data analysis instead.
The IETF STARTTLS extension to email permits the use of TLS to
encrypt SMTP traffic including meta-data. However use of STARTTLS has
two major limitations. First SMTP is a store and forward protocol and
STARTTLS only protects the messages hop-by-hop. Second there is
currently no infrastructure for determining that an SMTP service
offers STARTTLS support or to validate the credentials presented by
the remote server. The DANE Working Group is currently working on a
proposal to address the second limitation.
2.3. Traffic Analysis
Analysis of communication patterns may also leak information about
which parties are communicating, especially in the case of
synchronous protocols such as chat, voice and video.
Traffic analysis of store and forward protocols such as SMTP is more
challenging, particularly when billions of messages an hour may pass
between the major Webmail providers. But clues such as message length
may permit attackers more leverage than is generally expected.
2.4. Denial of Service
Providing protection against denial of service is frequently at odds
with other security objectives. In most situations it is preferable
for a mail client to not send a message in circumstances where there
is a risk of interception. Thus an attacker may be able to perform a
Denial of Service attack by creating the appearance of an intercept
risk.
Whether the potential compromise of confidentiality or service is
preferable depends on the circumstances. If critical infrastructure
such as electricity or water supply or the operation of a port
depends on messages getting through, it may be preferable to accept a
confidentiality compromise over a service compromise even though
confidentiality is also a significant concern.
Hallam-Baker March 15, 2014 [Page 4]
Internet-Draft Writing I-Ds using HTML September 2013
2.5. Protocol Exploit
Many protocols are vulnerable to attack at the application layer. For
example the use of JavaScript injection in HTML and SQL injection
attacks.
A recent trend in Internet chat services is to permit the
participants in a group chat to share links to images and other
content on other sites. Introducing a link into the chat session
causes every connected client to retrieve the linked resource, thus
allowing an attacker with access to the chat room to discover the IP
address of all the connected parties.
3. Attacker Capabilities
Some forms of attack are available to any actor while others are
restricted to actors with access to particular resources. Any party
with access to the Internet can perform a Denial of Service attack
while the ability to perform traffic analysis is limited to parties
with a certain level of network access.
A major constraint on most interception efforts is the need to
perform the attack covertly so as to not alert the parties to the
fact their communications are not secure and discourage them from
exchange of confidential information. Even governments that
intentionally disclose the ability to perform intercepts for purposes
of intimidation do not typically reveal intercept methods or the full
extent of their capabilities.
3.1. Passive Observation
Many parties have the ability to perform passive observation of parts
of the network. Only governments and large ISPs can feasibly observe
a large fraction of the network but every network provider can
monitor data and traffic on their own network and third parties can
frequently obtain data from wireless networks, exploiting
misconfiguration of firewalls, routers, etc.
A purely passive attack has the advantage to the attacker of being
difficult to detect and impossible to eliminate the possibility that
an intercept has taken place. Passive attacks are however limited in
the information they can reveal and easily defeated with relatively
simple cryptographic techniques.
3.2. Active Modification
Active attacks are more powerful but are more easily detected. Use of
TLS without verification of the end-entity credentials presented by
each side is sufficient to defeat a passive attack but is defeated by
a man-in-the-middle attack substituting false credentials.
Hallam-Baker March 15, 2014 [Page 5]
Internet-Draft Writing I-Ds using HTML September 2013
Active attacks may be used to defeat use of secure after first
contact approaches but at the cost of requiring interception of every
subsequent communication.
While many attackers have the ability to perform ad-hoc active attack
only a few parties have the ability to perform active attack
repeatedly and none can expect to do so with absolute reliability.
A major limitation on active attack is that an attacker can only
perform an active attack if the target is known in advance or the
target presents an opportunity that would compromise previous stored
communications.
3.3. Cryptanalysis
Many parties have the ability to perform cryptanalysis but government
cryptanalytic capabilities may be substantially greater.
3.4. Kleptography
Kleptography is persuading the party to be intercepted to use a form
of cryptography that the attacker knows they can break. Real life
examples of kleptography include the British government encouraging
the continued use of Enigma type cryptography machines by British
colonies after World War II and the requirement that early export
versions of Netscape Navigator and Internet Explorer use 40 bit
symmetric keys.
3.4.1. Covert Channels in RSA
One form of kleptography that is known to be feasible and is relevant
to IETF protocols is employing a RSA modulus to provide a covert
channel. In the normal RSA scheme we choose primes p and q and use
them to calculate n = pq. But the scheme works just as well if we
choose n' and p and look for a prime q in the vicinity of n'/p then
use p and q to calculate the final value of n. Since q ~= n'/p it
follows that n' ~= n. For a 2048 bit modulus, approximately 1000 bits
are available for use as a covert channel.
Such a covert channel may be used to leak some or all of the private
key or the seed used to generate it. The data may be encrypted to
avoid detection.
3.4.2. Covert Channels in TLS, S/MIME, IPSEC
Similar approaches may be used in any application software that has
knowledge of the actual private key. For example a TLS implementation
might use packet framing to leak the key.
Hallam-Baker March 15, 2014 [Page 6]
Internet-Draft Writing I-Ds using HTML September 2013
3.4.3. Covert Channels in Symmetric Ciphers
A hypothetical but unproven possibility is the construction of a
symmetric cipher with a backdoor. Such an attack is far beyond the
capabilities of the open field. A symmetric cipher with a perfect
backdoor would constitute a new form of public key cryptography more
powerful than any known to date. For purposes of kleptography however
it would be sufficient for a backdoor to limit the key space that an
attacker needed to search through brute force or have some other
limitation that is considered essential for public key cryptography.
3.4.4. Covert Channels in ECC Curves
Another hypothetical but unproven possibility is the construction of
a weak ECC Curve or a curve that incorporates a backdoor function. As
with symmetric ciphers, this would require a substantial advance on
the public state of the mathematical art.
3.4.5. Unusable Cryptography
A highly effective form of kleptography would be to make the
cryptographic system so difficult to use that nobody would bother to
do so.
3.5. Lawful Intercept
Lawful intercept is a form of coercion that is unique to government
actors by definition. Defeating court ordered intercept by a domestic
government is outside the scope of this document though defeating
foreign lawful intercept requests may be.
While the US government is known to practice Lawful Intercept under
court order and issue of National Security Letters of questionable
constitutional validity, the scope of such programs as revealed in
public documents and leaks from affected parties is considerably more
restricted than that of the purported PRISM program.
While a Lawful Intercept demand may in theory be directed against any
of the intermediaries listed in the following section on subversion
or coercion, the requirement to obtain court sanction constrains the
number and type of targets against which Lawful Intercept may be
sought and the means by which it is implemented. A court is unlikely
to sanction Lawful Intercept of opposition politicians for the
political benefit of current office holders.
3.6. Subversion or Coercion of Intermediaries
Subversion or coercion of intermediaries is a capability that is
almost entirely limited to state actors. A criminal organization may
coerce an intermediary in the short term but has little prospect of
succeeding in the long term.
Hallam-Baker March 15, 2014 [Page 7]
Internet-Draft Writing I-Ds using HTML September 2013
3.6.1. Physical Plant
The Internet is at base a collection of data moving over wires,
optical cables and radio links. Every form of interconnect that is a
practical means of high bandwidth communication is vulnerable to
interception at the physical layer. Attacks on physical interconnect
require only a knowledge of where the signal cables are routed and a
back hoe.
Even quantum techniques do not necessarily provide a guarantee of
security. While such techniques may be theoretically unbreakable, the
physical realization of such systems tend to fall short. As with the
'unbreakable' One Time Pad, the theoretical security tends to be
exceptionally fragile.
Attacks on the physical plant may enable high bandwidth passive
intercept capabilities and possibly even active capabilities.
3.6.2. Internet Service Providers
Internet Service Providers have access to the physical and network
layer data and are capable of passive or active attacks. ISPs have
established channels for handling Lawful Intercept requests and thus
any employee involved in an intercept request that was outside the
scope of those programs would be on notice that their activities are
criminal.
3.6.3. Router
Compromise of a router is an active attack that provides both passive
and active intercept capabilities. such compromise may be performed
by compromise of the device firmware or of the routing information.
3.6.4. End Point
Compromise of Internet endpoints may be achieved through insertion of
malware or coercion/suborning the platform provider.
3.6.5. Cryptographic Hardware Providers
Deployment of the 'kleptography' techniques described earlier
requires that the attacker be capable of controlling the
cryptographic equipment and software available to the end user.
Compromise of the cryptographic hardware provided is one means by
this might be achieved.
Hallam-Baker March 15, 2014 [Page 8]
Internet-Draft Writing I-Ds using HTML September 2013
3.6.6. Certificate Authorities
Certificate Authorities provide public key credentials to validated
key holders. While compromise of a Certificate Authority is certainly
possible, this is an active attack and the credentials created leave
permanent evidence of the attack.
3.6.7. Standards Organizations
Another route for deployment of cryptography would be to influence
the standards for use of cryptography although this would only permit
the use of kleptographic techniques that are not publicly known.
Another area of concern is that efforts to make strong cryptography
usable through deployment of key discovery infrastructure or security
policy infrastructure may have been intentionally delayed or
discouraged. The chief security failure of the Internet today is that
insecurity is the default and many attacks are able to circumvent
strong cryptography through a downgrade attack.
4. Controls
Traditionally a cryptographic protocol is designed to resist direct
attack with the assumption that protocols that provide protection
against targeted intercept will also provide protection against
pervasive intercept. Consideration of the specific constraints of
pervasive covert intercept demonstrates that a protocol need not
guarantee perfect protection against a targeted intercept to render
pervasive intercept infeasible.
One of the more worrying aspects of the attempt to defend the
legality of PRISM program is the assertion that passive intercept
does not constitute a search requiring court oversight. This suggests
that the NSA is passively monitoring all Internet traffic and that
any statement that a citizen might make in 2013 could potentially be
used in a criminal investigation that began in 2023.
At present Internet communications are typically sent in the clear
unless there is a particular confidentiality concern in which case
techniques that resist active attack are employed. A better approach
would be to always use encryption that resists passive attack,
recognizing that some applications also require resistance to active
attacks.
4.1. Confidentiality
Encryption provides a confidentiality control when the symmetric
encryption key is not known to or discoverable by the attacker. Use
of strong public cryptography provides a control against passive
attacks but not an active attack unless the communicating parties
have a means of verifying the credentials purporting to identify the
Hallam-Baker March 15, 2014 [Page 9]
Internet-Draft Writing I-Ds using HTML September 2013
parties.
4.1.1. Perfect Forward Secrecy
One of the main limitations of simple public key exchange schemes is
that compromise of an end entity decryption key results in compromise
of all the messages encrypted using that key. Perfect Forward Secrecy
is a misnomer for a technique that forces an attacker to compromise a
separate private key for every key exchange. This is usually achieved
by performing two layers of public key exchange using the credentials
of the parties to negotiate a temporary key which is in turn used to
derive the symmetric session key used for communications.
Perfect Forward Secrecy is a misnomer as the secrecy is not
'perfect', should the public key system used to identify the
principals be broken, it is likely that the temporary public key will
be vulnerable to cryptanalysis as well. The value of PFS is not that
it is 'perfect' but that it dramatically increases the cost of an
attack to an attacker.
4.2. Policy, Audit and Transparency
The most underdeveloped area of internet security to date is the lack
of a security policy infrastructure and the audit and transparency
capabilities to support it.
4.2.1. Policy
A security policy describes the security controls that a party
performs or offers to perform. One of the main failings in the
Internet architecture is that the parties have no infrastructure to
inform them of the security policy of the party they are attempting
to communicate with except for the case of Certificate Policy and
Certificate Practices Statements which are not machine readable
documents.
A machine readable policy stating that a party always offers a
minimum level of security provides protection against downgrade
attack.
4.2.2. Audit
Audit is verifying that a party is in compliance with its published
security policy. Some security policies are self-auditing (e.g.
advertising support for specific cryptographic protocols) others may
be audited by automatic means and some may require human
interpretation and evaluation.
Hallam-Baker March 15, 2014 [Page 10]
Internet-Draft Writing I-Ds using HTML September 2013
4.2.3. Transparency
A security policy is transparent if it may be audited using only
publicly available information.
An important application of transparency is by trusted intermediaries
to deter attempted coercion or to demonstrate that a coercion attempt
would be impractical.
Author's Address
Phillip Hallam-Baker
Comodo Group Inc.
philliph[at]comodo.com
Subscribe to:
Posts (Atom)