Tech companies are raising their game (and pants) post-Snowden

Is everything fatally borked? Not quite, say security godheads


Snowden anniversary If there’s a positive to the disclosures by ex-National Security Contractor (NSA) contractor Edward Snowden, it’s that it’s been a disaster for technology and internet firms.

Yes, a positive.

In the last year we’ve learned the NSA has backdoors placed in the hardware that makes networks, the existence of massive funnels placed in internet and phone companies’ data centers to suck up vast amounts of data, and the breaking of internet encryption.

The effect of all this should be a raising of these companies’ games and a shaking of users’ complacency in relying on “free” products and in being too accepting of what they’re given and of standard “solutions.”

Already, tech and web companies are coming back. Caught with their pants down, they are now being given the time and money to pull them back up again.

Pre-Snowden it was generally assumed the government was carrying out some sorts of surveillance against key targets and that the bright boys and girls at the National Security Agency (NSA) could subvert security systems if they really wanted to.

Bruce Schneier

Schneier: how far has the NSA really gone?

There had long been rumors of backdoors in operating systems and government malware-writing teams, but very little in the way of proof.

Snowden's leaks showed not only that security weaknesses are being built into software but also that the large companies to whom we entrust our data are helping in this – and they have been criminally lax about the security of users' data within their own organizations.

The first two leaks from the Snowden files – allegations that Verizon was handing over consumer metadata on mobile calls and the existence of the PRISM program – didn’t come a as a massive surprise to many. Caspar Bowden, Microsoft's former chief privacy adviser, has been warning about this kind of stuff for years after all.

Then, in August 2013, Snowden's secure email provider Lavabit shut down its service, with its chief, Ladar Levison, saying that he wouldn't "become complicit in crimes against the American people." Shortly afterwards Silent Circle, which had been offering a similar service, followed suit.

Both companies are prohibited by law from confirming the exact reason for their shutdown, but it's down to the use of existing legislation whereby the US government can force email providers to hand over encryption keys on national security grounds. Too bad for users of this kind of system, you might think, but the problems didn’t stop there.

It was the September 2013 leak about Project Bullrun that really set the cat among the pigeons. The documents Snowden released showed that the NSA was spending $250m a year to build security weaknesses into common code and had cracked many of the encryption systems commonly used online.

Bullrun appears to have started after September 11, 2001 and appears to have allowed the NSA to get around both VPN protections, SSL and HTTPS. For most internet users that's pretty much the entire ballgame.

As any security expert knows, intentionally introducing flaws into your products is a stupid move. Sure, it gives the intelligence community a backdoor into software, but there's no guarantee that someone else won’t discover the same flaw and start using it. In fact, the way code examination is these days, it's a virtual certainty that someone will do this.

Crypto and privacy guru Bruce Schneier is frank in his assessment of what this all meant for the internet. He told The Register:

From forcing Microsoft to make Skype more eavesdropping friendly and then not telling anyone, to demanding Lavabit's master encryption key and demanding that they lie about it, to creating fake Facebook servers on the Internet to hack into computers, to intercepting Cisco networking equipment in transit to install eavesdropping equipment, the NSA has completely subverted the internet.


Other stories you might like

  • Beijing-backed baddies target unpatched networking kit to attack telcos
    NSA, FBI and CISA issue joint advisory that suggests China hardly has to work for this – flaws revealed in 2017 are among their entry points

    State-sponsored Chinese attackers are actively exploiting old vulnerabilities to "establish a broad network of compromised infrastructure" then using it to attack telcos and network services providers.

    So say the United States National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI), which took the unusual step of issuing a joint advisory that warns allied governments, critical infrastructure operators, and private industry organizations to hurry up and fix their IT estates.

    The advisory states that network devices are the target of this campaign and lists 16 flaws – some dating back to 2017 and none more recent than April 2021 – that the three agencies rate as the most frequently exploited.

    Continue reading
  • Protecting data now as the quantum era approaches
    Startup QuSecure is the latest vendor to jump into the field with its as-a-service offering

    Analysis Startup QuSecure will this week introduce a service aimed at addressing how to safeguard cybersecurity once quantum computing renders current public key encryption technologies vulnerable.

    It's unclear when quantum computers will easily crack classical crypto – estimates range from three to five years to never – but conventional wisdom is that now's the time to start preparing to ensure data remains encrypted.

    A growing list of established vendors like IBM and Google and smaller startups – Quantum Xchange and Quantinuum, among others – have worked on this for several years. QuSecure, which is launching this week after three years in stealth mode, will offer a fully managed service approach with QuProtect, which is designed to not only secure data now against conventional threats but also against future attacks from nation-states and bad actors leveraging quantum systems.

    Continue reading
  • Cheers ransomware hits VMware ESXi systems
    Now we can say extortionware has jumped the shark

    Another ransomware strain is targeting VMware ESXi servers, which have been the focus of extortionists and other miscreants in recent months.

    ESXi, a bare-metal hypervisor used by a broad range of organizations throughout the world, has become the target of such ransomware families as LockBit, Hive, and RansomEXX. The ubiquitous use of the technology, and the size of some companies that use it has made it an efficient way for crooks to infect large numbers of virtualized systems and connected devices and equipment, according to researchers with Trend Micro.

    "ESXi is widely used in enterprise settings for server virtualization," Trend Micro noted in a write-up this week. "It is therefore a popular target for ransomware attacks … Compromising ESXi servers has been a scheme used by some notorious cybercriminal groups because it is a means to swiftly spread the ransomware to many devices."

    Continue reading

Biting the hand that feeds IT © 1998–2022