Risk
9/9/2013
12:18 PM
Connect Directly
RSS
E-Mail
50%
50%

NSA Crypto Revelations: 7 Issues To Watch

After latest NSA leaks, security and crypto experts sound off on repercussions, unanswered questions and ramifications for U.S tech vendors selling abroad.

4. Networks Are More Vulnerable Than Endpoints.

Another takeaway from the recent NSA revelations is that some types of eavesdropping employed by the agency require proportionally greater resources, and are thus less likely to be used on a regular basis. "The primary way the NSA eavesdrops on Internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic," said Schneier. "Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly."

As that suggests, network infrastructure remains an especial weak point. "The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on," said Schneier. "This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability."

5. Embrace Well-Vetted Open-Source Tools.

People can protect themselves against casual NSA surveillance, but it's going to require more work. "I still believe that those that are willing to put some effort into maintaining their privacy can, though the level of effort has certainly increased over what I thought it was," Caudill said. "Precautions that I would have called paranoid and excessive today seem reasonable. Not everything can be hidden, of course, and especially not if you are singled out -- but there are still ways to protect yourself -- at least I hope that's true."

One strategy for defending against the NSA's digital dragnet is to tap well-regarded -- and thoroughly reviewed -- open source tools. "Clearly, this is a big affirmation of the importance of open source, and openness in general," said Qualys' Ristic. "Who's going to want to rely on proprietary software in the future? That would make no sense, given that government agencies are going to keep on doing what they were always been doing."

Furthermore, many security experts believe that open-source tools will provide people with their most reliable source of an application they can trust that implements an encryption algorithm that's known to be tough or impossible to break.

6. Complete NSA Resistance Is Futile.

But there's a caveat to that advice: the NSA can still eavesdrop on high-value targets, no matter what they do. Indeed, Schneier said that the NSA's TAO – Tailored Access Operations – group, which is charged with hacking into endpoints, has an array of tools which are almost impossible, even for trained security professionals, to find. "Your antivirus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget," said Schneier. "What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period."

7. Foreign Businesses Will Think Twice About U.S. Goods, Cloud.

Will reports that the NSA has added back doors to equipment and software sold by U.S. technology firms lead businesses in other countries to avoid buying from American manufacturers? "I think it'll have a detrimental effect on both foreign and U.S. businesses when considering using U.S. products and services that may have been compromised by the NSA," said Taia Global's Carr via email.

Callas echoed that assessment, saying that the revelations would "undoubtedly" have an effect. Then again, the NSA isn't the only intelligence agency in the world, and when it comes to building back doors into commercial equipment, "we know that other countries are doing it, too," he said.

As a result, Ristic predicts all security vendors will face some bigger questions from their customers, as well as a push for carefully vetted open-source alternatives. "This is a big blow to the security industry, the cloud, and the IT industry in general; especially for the companies headquartered in the U.S.," he said. "Nothing's going to change over night, but we should expect to see big movement of data and services in the following months and years."

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mathew
50%
50%
Mathew,
User Rank: Apprentice
9/11/2013 | 10:41:55 AM
re: NSA Crypto Revelations: 7 Issues To Watch
Jerry -- Influencing is one thing, but undermining is arguably a different matter entirely.
JohnR044
50%
50%
JohnR044,
User Rank: Apprentice
9/10/2013 | 11:20:31 PM
re: NSA Crypto Revelations: 7 Issues To Watch
The news out of NSA just keeps getting worse. This is "SPIES GONE WILD" the sequel. In view of these depressing revelations, we can only do what we little we can do to protect what's left of our privacy.

Encryption won't keep NSA out entirely, but it will make it harder for them to pick us out of the crowd. Decrypting still takes extra time & effort and that little bit of hassle may be enough to keep their noses out of your business.

The same goes for storing stuff on Dropbox, iCloud, etc. Take it down and stash everything in a CloudLocker (www.cloudlocker.it), which works just the same but it's private and stays in your home where they still need a warrant to see inside.
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
9/10/2013 | 8:44:03 PM
re: NSA Crypto Revelations: 7 Issues To Watch
NSA influencing cryptography designs is ancient news. Consider DES, the 1970's-designed predecessor to AES (ref. http://en.wikipedia.org/wiki/D....
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.