Risk
9/9/2013
12:18 PM
50%
50%

NSA Crypto Revelations: 7 Issues To Watch

After latest NSA leaks, security and crypto experts sound off on repercussions, unanswered questions and ramifications for U.S tech vendors selling abroad.

4. Networks Are More Vulnerable Than Endpoints.

Another takeaway from the recent NSA revelations is that some types of eavesdropping employed by the agency require proportionally greater resources, and are thus less likely to be used on a regular basis. "The primary way the NSA eavesdrops on Internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic," said Schneier. "Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly."

As that suggests, network infrastructure remains an especial weak point. "The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on," said Schneier. "This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability."

5. Embrace Well-Vetted Open-Source Tools.

People can protect themselves against casual NSA surveillance, but it's going to require more work. "I still believe that those that are willing to put some effort into maintaining their privacy can, though the level of effort has certainly increased over what I thought it was," Caudill said. "Precautions that I would have called paranoid and excessive today seem reasonable. Not everything can be hidden, of course, and especially not if you are singled out -- but there are still ways to protect yourself -- at least I hope that's true."

One strategy for defending against the NSA's digital dragnet is to tap well-regarded -- and thoroughly reviewed -- open source tools. "Clearly, this is a big affirmation of the importance of open source, and openness in general," said Qualys' Ristic. "Who's going to want to rely on proprietary software in the future? That would make no sense, given that government agencies are going to keep on doing what they were always been doing."

Furthermore, many security experts believe that open-source tools will provide people with their most reliable source of an application they can trust that implements an encryption algorithm that's known to be tough or impossible to break.

6. Complete NSA Resistance Is Futile.

But there's a caveat to that advice: the NSA can still eavesdrop on high-value targets, no matter what they do. Indeed, Schneier said that the NSA's TAO – Tailored Access Operations – group, which is charged with hacking into endpoints, has an array of tools which are almost impossible, even for trained security professionals, to find. "Your antivirus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget," said Schneier. "What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period."

7. Foreign Businesses Will Think Twice About U.S. Goods, Cloud.

Will reports that the NSA has added back doors to equipment and software sold by U.S. technology firms lead businesses in other countries to avoid buying from American manufacturers? "I think it'll have a detrimental effect on both foreign and U.S. businesses when considering using U.S. products and services that may have been compromised by the NSA," said Taia Global's Carr via email.

Callas echoed that assessment, saying that the revelations would "undoubtedly" have an effect. Then again, the NSA isn't the only intelligence agency in the world, and when it comes to building back doors into commercial equipment, "we know that other countries are doing it, too," he said.

As a result, Ristic predicts all security vendors will face some bigger questions from their customers, as well as a push for carefully vetted open-source alternatives. "This is a big blow to the security industry, the cloud, and the IT industry in general; especially for the companies headquartered in the U.S.," he said. "Nothing's going to change over night, but we should expect to see big movement of data and services in the following months and years."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/11/2013 | 10:41:55 AM
re: NSA Crypto Revelations: 7 Issues To Watch
Jerry -- Influencing is one thing, but undermining is arguably a different matter entirely.
JohnR044
50%
50%
JohnR044,
User Rank: Apprentice
9/10/2013 | 11:20:31 PM
re: NSA Crypto Revelations: 7 Issues To Watch
The news out of NSA just keeps getting worse. This is "SPIES GONE WILD" the sequel. In view of these depressing revelations, we can only do what we little we can do to protect what's left of our privacy.

Encryption won't keep NSA out entirely, but it will make it harder for them to pick us out of the crowd. Decrypting still takes extra time & effort and that little bit of hassle may be enough to keep their noses out of your business.

The same goes for storing stuff on Dropbox, iCloud, etc. Take it down and stash everything in a CloudLocker (www.cloudlocker.it), which works just the same but it's private and stays in your home where they still need a warrant to see inside.
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
9/10/2013 | 8:44:03 PM
re: NSA Crypto Revelations: 7 Issues To Watch
NSA influencing cryptography designs is ancient news. Consider DES, the 1970's-designed predecessor to AES (ref. http://en.wikipedia.org/wiki/D....
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?