Slashdot Mirror
Surveillance Backdoor Enabled Chinese Gmail Attack?
Major Blud writes "CNN is running an opinion piece on their front page from security technologist Bruce Schneier, in which he suggests that 'In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.' His article is short on sources, and the common belief is that a flaw in IE was the main attack method. Has this come up elsewhere? Schneier continues, 'Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state.'"
There was the following report:
http://www.computerworld.com/s/article/9144221/Google_attack_part_of_widespread_spying_effort
That's because they apparently were able to access a system used to help Google comply with search warrants by providing data on Google users, said a source familiar with the situation, who spoke on condition of anonymity because he was not authorized to speak with the press. "Right before Christmas, it was, 'Holy s***, this malware is accessing the internal intercept [systems],'" he said.
That is not a backdoor. But it did concern me that google is actively preserving all of this information that could be used in the future for good or ill by anyone.
The backdoor in question is likely only available on Google's internal network. If it's guarded by VPN, this is fairly secure. Of course, there are many ways to hack into a company's internal network, as the Chinese hack demonstrates. But the law enforcement interface isn't uniquely problematic in this regard. Once you're into the internal network, there are all types of things you can do.
The real problem here is pen register taps, and it's application to email. The police can get as much "traffic analysis" information as they want without a warrant. This law enforcement interface was designed to allow easy access to this information, further invading our privacy through warrantless activities.
* All email header information other than the subject line, including the email addresses of the people to whom you send email, the email addresses of people that send to you, the time each email is sent or received, and the size of each email that is sent or received.
* Your IP (Internet Protocol) address and the IP address of other computers on the Internet that you exchange information with, with timestamp and size information.
* The communications ports and protocols used, which can be used to determine what types of communications you are sending using what types of applications.
From the EFF.
Schneier is not primarily a 'blogger,' although that may be how we most frequently encounter him. As the publisher of the renowned book "Applied Cryptography," Schneier is a recognized domain expert in the field of security.
Therefore it is possible, even likely, that Schneier has directly received information pertinent to the attack. Someone assigned to the investigation may have phoned him up to consult his opinion, if nothing else. Given the progressive techno-legal opinion he wrote, I think it is just as possible that someone from the investigation 'leaked' information to Scheneier about the use of the CALEA interface.
By the way, for those who doubt that there is a 'backdoor' to gmail, CALEA is a law which _mandates_ a law enforcement backdoor, either through manual procedures or through computational interface. It sounds like Google has implement a CALEA interface, and China used an IE6 vulnerability to hack first Google, then used the CALEA interface to monitor specific accounts.
The nice thing about using the CALEA interface is that I presume this would not give any clue to the monitored user that the account is being monitored. Logging in with the user's password, as a contrary example, updates the IP usage information displayed by gmail.