Slashdot Mirror
Surveillance Backdoor Enabled Chinese Gmail Attack?
Major Blud writes "CNN is running an opinion piece on their front page from security technologist Bruce Schneier, in which he suggests that 'In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.' His article is short on sources, and the common belief is that a flaw in IE was the main attack method. Has this come up elsewhere? Schneier continues, 'Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state.'"
His article is short on sources
Agreed so I visited his blog and a recent post is equally scant. He points back to another blog post with a little more but really he's just pointing out the irony of a new proposed bill outlawing Google's collaboration with China in violating human rights issues. The irony being that the US has asked for similar backdoors from Google already.
So here's my problem: More frequently Schneier acts as a reputable news source 'breaking' a story without citing the originator of the information. This is fine when it's a big paper like the New York Times but Schneier runs a blog on security. That's it. He might be a first hand expert but if so why isn't he showing and describing his conclusive evidence that the US mandated backdoor is how Chinese hackers gained entry? There's no doubt the software is less secure with a backdoor -- by definition -- but when he says:
In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.
He better be able to back it up. And he reiterates:
China's hackers subverted the access system Google put in place to comply with U.S. intercept orders.
I just want to caution everyone that you're reading an opinion piece by a security blogger with no corroborating evidence. And on top of that, he has zero accountability. In fact, he says none of this on his blog, he leaves it as an op-ed on CNN. Read it like a strange click generating opinion piece and nothing more.
I have respect for the man but this certainly shakes that. Any concrete proof of this would be welcomed. The problem is I'm not sure how one would prove it one way or the other since I believe all the source in question is closed source to begin with.
My work here is dung.
As long as you do not place restrictions on your executive branch, anything can be used to facilitate a police state. If a cop has unrestricted rights to search you, your days of privacy are over.
I want to delete my account but Slashdot doesn't allow it.
"And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state."
ORLY, Bruce? Bad civic hygiene - for sure. But surely you're aware that so-called Legal Interception (LI) facilities are there in basically all communications networks used by the masses. It's not like this Google "backdoor" is anything out of the ordinary.
And you say correctly that they are a bad thing. Although, they would not be that bad, were they used to remove corruption and organized crime. But corruption and organized crime go hand in hand with top-tier politics, and therefore have protection.
As it stands now, such systems will only be used to target politically annoying individuals and kill off any dissent against status quo (whatever it may be, choose your -ism).
All of us can already now be tracked every single day by the digital communications methods we use. It doesn't matter if you live in USA or Iran, the LI facilities are built-in. In light of that, your comment strikes me as very ignorant - you say it as if it's a new thing.
Mod doesn't agree with GP but lacks the intellectual capacity to compose a counter argument.
Ask Google for the documentation that admits they cooperated with a secret government program to spy on Americans?
What 'secret government program to spy on Americans'? Read the article. They mention the Communications Assistance for Law Enforcement Act of 1994 (CALEA). Here is Wikipedia's summary if you don't have the stomach for legalese. You can read all about how it went in during Clinton's administration and has been enjoyed by every administration since (a lost freedom is rarely won back) and will continue to be enjoyed for a long time coming.
So Google is afraid to reveal what the law (CALEA) forces them to do?
We already know the telephone and cellular companies have found a way to monetize state surveillance by law enforcement, so they're not complaining.
That's funny. If they didn't charge for it, the consumer would be paying for the overhead of them being spied on. Would you like that scenario better? Get out, get vocal, tell people, tell average people on the street when they hang up their phone that all that information just got logged for the government. And do it with some tact so you don't look like a goddamn crazy.
My work here is dung.
This is congruent with another report that mentioned
Google put its Google China staff on paid leave and
suspended their access after the incident:
http://www.guardian.co.uk/technology/2010/jan/18/china-google-cyber-attack
A lot of evidence points into google treating it as an internal security leak .In the hacking very likely some google China employee was found to have leaked
, and is conducting an internal audit on all its China employee. It seems
Google has very good external security but is very vulnerable from inside
information that facilitate the attack. And that explain Google management's fury
as it would be a moment as shocking for them as the
“Cambridge Five” for British government .
Firstly it would mean Google can no longer count on its Chinese
employee’s loyalty when it clashes with their loyalty to China, so if
it wants to operate in China it has to continue with a tainted staff, though that
should have been expected for any corporation operating in a foreign country.
Secondly it would mean there are serious security loopholes in Google
internal management as it failed to implement a safety mechanism to
check or limit inside attack.It this is true, pile on the fact that
Google is already facing increasing privacy scrutiny in the US and
Europe,it would be a heavy blow to Google’s reputation as a whole as
it sends out the message that Google cannot be trusted with your data
IN ANY COUNTRY.
In my opinion Google failed to take care of its own fences,However ,as
Google’s genius lies in politicizing this incident
it completely shadows the question of Google’s own internal security
vulnerability, as evidenced by the blanket omitting of this question
in most of the news reports I have seen.It became a Good vs Evil in the news ,
and you cannot criticizing Good ole Google
without being grouped with the Evil Chinese Communist, can you?
More like, how is it ON topic? I have to exploit my imagination quite a bit, to see relation between stories, and I still can't see, how they correlate in any meaningful way.
Even if we accept Schneier's source at his word, an "internal intercept" system which shows traffic on an account is NOT the same as a system which feeds all your details to the government. There's a difference between a system which Google employees can use to comply with government warrants (as required by CALEA) and a system directly accessible by government officials ala AT&T.
Still, if you think anything you send via email unencrypted anywhere in the Western world is safe from the US government (and, by extension, any government able to penetrate the US government), you're dreaming.
Thanks, but I think that people are being too hard on Schneier. The Computer World article that I cited is based on an "unnamed source" who is "not authorized to speak to the press." Obviously that article should have been cited, but I that oversight in citation is a blunder, not something that challenges the integrity of Schneier.
But it is consistent with the official report out of Google, which stated that the Gmail accounts themselves were not compromised, and that the information stolen was subject lines and account creation date. The only purpose I can see for having a system that would just have access to that kind of information is would be for some kind of "pre-scanning" for law enforcement.
Among the many questions that I want answered is whether the credentials used to access that system (presumably obtained via long standing Adobe Reader or IE zero-day vulnerabilities) belong to a Google employee or someone else who had access to that system.
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
"Backdoors" into telco switches and the like should be "hardwired" to only be accessible at specific locations, by specific people, with specific reasons, with extensive logs of who saw what and when so oversight authorities (e.g. Congress, courts) can audit them.
Each switch or server should have a dedicated network port, not connected to any network except the snooper's, over which snooping is done.
Ideally, it would not be a "snooper's network" but rather a "snooper box," with an air-gap between it and the other FBI or police computers.
The military knows how to do this right. If the FBI and police departments aren't using something like this, they can take a lesson.
By the way, it's not just "telco/ISP/mail-provider backdoors" that need this, anything that gives sensitive access should be as isolated as practical. For some networks, this means complete isolation/air gap. For others, it means dedicated communication channels. For others, a traditional firewall is sufficient.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If papers and news sites carried only substantiated stories they'd be pretty boring. And small.
http://ihatehate.wordpress.com
What exactly has Schneier done that needs a retraction? He's written an unsubstantiated op-ed piece: just like the thousand other unsubstantiated op-ed pieces on a thousand other news sites. It might be lazy journalism but it isn't a crime...
http://ihatehate.wordpress.com