Risk
9/9/2013
12:18 PM
Connect Directly
RSS
E-Mail
50%
50%

NSA Crypto Revelations: 7 Issues To Watch

After latest NSA leaks, security and crypto experts sound off on repercussions, unanswered questions and ramifications for U.S tech vendors selling abroad.

4. Networks Are More Vulnerable Than Endpoints.

Another takeaway from the recent NSA revelations is that some types of eavesdropping employed by the agency require proportionally greater resources, and are thus less likely to be used on a regular basis. "The primary way the NSA eavesdrops on Internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic," said Schneier. "Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly."

As that suggests, network infrastructure remains an especial weak point. "The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on," said Schneier. "This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability."

5. Embrace Well-Vetted Open-Source Tools.

People can protect themselves against casual NSA surveillance, but it's going to require more work. "I still believe that those that are willing to put some effort into maintaining their privacy can, though the level of effort has certainly increased over what I thought it was," Caudill said. "Precautions that I would have called paranoid and excessive today seem reasonable. Not everything can be hidden, of course, and especially not if you are singled out -- but there are still ways to protect yourself -- at least I hope that's true."

One strategy for defending against the NSA's digital dragnet is to tap well-regarded -- and thoroughly reviewed -- open source tools. "Clearly, this is a big affirmation of the importance of open source, and openness in general," said Qualys' Ristic. "Who's going to want to rely on proprietary software in the future? That would make no sense, given that government agencies are going to keep on doing what they were always been doing."

Furthermore, many security experts believe that open-source tools will provide people with their most reliable source of an application they can trust that implements an encryption algorithm that's known to be tough or impossible to break.

6. Complete NSA Resistance Is Futile.

But there's a caveat to that advice: the NSA can still eavesdrop on high-value targets, no matter what they do. Indeed, Schneier said that the NSA's TAO – Tailored Access Operations – group, which is charged with hacking into endpoints, has an array of tools which are almost impossible, even for trained security professionals, to find. "Your antivirus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget," said Schneier. "What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period."

7. Foreign Businesses Will Think Twice About U.S. Goods, Cloud.

Will reports that the NSA has added back doors to equipment and software sold by U.S. technology firms lead businesses in other countries to avoid buying from American manufacturers? "I think it'll have a detrimental effect on both foreign and U.S. businesses when considering using U.S. products and services that may have been compromised by the NSA," said Taia Global's Carr via email.

Callas echoed that assessment, saying that the revelations would "undoubtedly" have an effect. Then again, the NSA isn't the only intelligence agency in the world, and when it comes to building back doors into commercial equipment, "we know that other countries are doing it, too," he said.

As a result, Ristic predicts all security vendors will face some bigger questions from their customers, as well as a push for carefully vetted open-source alternatives. "This is a big blow to the security industry, the cloud, and the IT industry in general; especially for the companies headquartered in the U.S.," he said. "Nothing's going to change over night, but we should expect to see big movement of data and services in the following months and years."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/11/2013 | 10:41:55 AM
re: NSA Crypto Revelations: 7 Issues To Watch
Jerry -- Influencing is one thing, but undermining is arguably a different matter entirely.
JohnR044
50%
50%
JohnR044,
User Rank: Apprentice
9/10/2013 | 11:20:31 PM
re: NSA Crypto Revelations: 7 Issues To Watch
The news out of NSA just keeps getting worse. This is "SPIES GONE WILD" the sequel. In view of these depressing revelations, we can only do what we little we can do to protect what's left of our privacy.

Encryption won't keep NSA out entirely, but it will make it harder for them to pick us out of the crowd. Decrypting still takes extra time & effort and that little bit of hassle may be enough to keep their noses out of your business.

The same goes for storing stuff on Dropbox, iCloud, etc. Take it down and stash everything in a CloudLocker (www.cloudlocker.it), which works just the same but it's private and stays in your home where they still need a warrant to see inside.
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
9/10/2013 | 8:44:03 PM
re: NSA Crypto Revelations: 7 Issues To Watch
NSA influencing cryptography designs is ancient news. Consider DES, the 1970's-designed predecessor to AES (ref. http://en.wikipedia.org/wiki/D....
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.