Slashdot Mirror
Surveillance Backdoor Enabled Chinese Gmail Attack?
Major Blud writes "CNN is running an opinion piece on their front page from security technologist Bruce Schneier, in which he suggests that 'In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.' His article is short on sources, and the common belief is that a flaw in IE was the main attack method. Has this come up elsewhere? Schneier continues, 'Whether the eavesdroppers are the good guys or the bad guys, these systems put us all at greater risk. Communications systems that have no inherent eavesdropping capabilities are more secure than systems with those capabilities built in. And it's bad civic hygiene to build technologies that could someday be used to facilitate a police state.'"
His article is short on sources
Agreed so I visited his blog and a recent post is equally scant. He points back to another blog post with a little more but really he's just pointing out the irony of a new proposed bill outlawing Google's collaboration with China in violating human rights issues. The irony being that the US has asked for similar backdoors from Google already.
So here's my problem: More frequently Schneier acts as a reputable news source 'breaking' a story without citing the originator of the information. This is fine when it's a big paper like the New York Times but Schneier runs a blog on security. That's it. He might be a first hand expert but if so why isn't he showing and describing his conclusive evidence that the US mandated backdoor is how Chinese hackers gained entry? There's no doubt the software is less secure with a backdoor -- by definition -- but when he says:
In order to comply with government search warrants on user data, Google created a backdoor access system into Gmail accounts. This feature is what the Chinese hackers exploited to gain access.
He better be able to back it up. And he reiterates:
China's hackers subverted the access system Google put in place to comply with U.S. intercept orders.
I just want to caution everyone that you're reading an opinion piece by a security blogger with no corroborating evidence. And on top of that, he has zero accountability. In fact, he says none of this on his blog, he leaves it as an op-ed on CNN. Read it like a strange click generating opinion piece and nothing more.
I have respect for the man but this certainly shakes that. Any concrete proof of this would be welcomed. The problem is I'm not sure how one would prove it one way or the other since I believe all the source in question is closed source to begin with.
My work here is dung.
The backdoor in question is likely only available on Google's internal network. If it's guarded by VPN, this is fairly secure. Of course, there are many ways to hack into a company's internal network, as the Chinese hack demonstrates. But the law enforcement interface isn't uniquely problematic in this regard. Once you're into the internal network, there are all types of things you can do.
The real problem here is pen register taps, and it's application to email. The police can get as much "traffic analysis" information as they want without a warrant. This law enforcement interface was designed to allow easy access to this information, further invading our privacy through warrantless activities.
* All email header information other than the subject line, including the email addresses of the people to whom you send email, the email addresses of people that send to you, the time each email is sent or received, and the size of each email that is sent or received.
* Your IP (Internet Protocol) address and the IP address of other computers on the Internet that you exchange information with, with timestamp and size information.
* The communications ports and protocols used, which can be used to determine what types of communications you are sending using what types of applications.
From the EFF.
This is congruent with another report that mentioned
Google put its Google China staff on paid leave and
suspended their access after the incident:
http://www.guardian.co.uk/technology/2010/jan/18/china-google-cyber-attack
A lot of evidence points into google treating it as an internal security leak .In the hacking very likely some google China employee was found to have leaked
, and is conducting an internal audit on all its China employee. It seems
Google has very good external security but is very vulnerable from inside
information that facilitate the attack. And that explain Google management's fury
as it would be a moment as shocking for them as the
“Cambridge Five” for British government .
Firstly it would mean Google can no longer count on its Chinese
employee’s loyalty when it clashes with their loyalty to China, so if
it wants to operate in China it has to continue with a tainted staff, though that
should have been expected for any corporation operating in a foreign country.
Secondly it would mean there are serious security loopholes in Google
internal management as it failed to implement a safety mechanism to
check or limit inside attack.It this is true, pile on the fact that
Google is already facing increasing privacy scrutiny in the US and
Europe,it would be a heavy blow to Google’s reputation as a whole as
it sends out the message that Google cannot be trusted with your data
IN ANY COUNTRY.
In my opinion Google failed to take care of its own fences,However ,as
Google’s genius lies in politicizing this incident
it completely shadows the question of Google’s own internal security
vulnerability, as evidenced by the blanket omitting of this question
in most of the news reports I have seen.It became a Good vs Evil in the news ,
and you cannot criticizing Good ole Google
without being grouped with the Evil Chinese Communist, can you?
Schneier is not primarily a 'blogger,' although that may be how we most frequently encounter him. As the publisher of the renowned book "Applied Cryptography," Schneier is a recognized domain expert in the field of security.
Therefore it is possible, even likely, that Schneier has directly received information pertinent to the attack. Someone assigned to the investigation may have phoned him up to consult his opinion, if nothing else. Given the progressive techno-legal opinion he wrote, I think it is just as possible that someone from the investigation 'leaked' information to Scheneier about the use of the CALEA interface.
By the way, for those who doubt that there is a 'backdoor' to gmail, CALEA is a law which _mandates_ a law enforcement backdoor, either through manual procedures or through computational interface. It sounds like Google has implement a CALEA interface, and China used an IE6 vulnerability to hack first Google, then used the CALEA interface to monitor specific accounts.
The nice thing about using the CALEA interface is that I presume this would not give any clue to the monitored user that the account is being monitored. Logging in with the user's password, as a contrary example, updates the IP usage information displayed by gmail.
Get out, get vocal, tell people, tell average people on the street when they hang up their phone that all that information just got logged for the government.
That isn't quite how it works. Other than the normal billing logs, the phone companies do NOT log all the data, much less voice logs, without a specific request.
I spent 2 years helping implement CALEA for Sprint/Nextel and was the point person for much of the integration. The simple truth is, the telecom companies don't have the storage capacity to log all the niggling details that CALEA requires for everyone. Hell, if the link between the CO and the LEO goes down, they're only required to store call data, not voice. That is all the button pushes, numbers called, etc. Voice is uploaded live and if the link is down, so is the voice collect.
Normal billing records include the phone number, direction and duration. CALEA records include EVERYTHING -- cell tower connected to, buttons pushed, call response, number of rings, text messages, multi-party calls, etc.
The truth is, the gov't DOESN'T log everything every time you use a phone. And no, on the cell networks I've worked on, they don't even listen for "key words" ala ECHELON unless it goes international.
Unless, of course, you or another party on the line is a target.
Learning HOW to think is more important than learning WHAT to think.
I don't know about cell. But on land lines, they DO log everything. The switches emit raw call record data. The billing logs are produced from the call record data.
Did you ever believe there was a time when a wiretap was nearly impossible?
It used to be far more difficult. In the electromechanical switching era, there was no built-in support for wiretaps. Somebody had to physically wire into the appropriate cable pair, either near the phone being tapped or in the central office. New York Telephone would only do that if they got a court order, and they'd then bill the law enforcement organization for a private line. When Giuliani was a prosecutor taking down the New York Mafia, there was much grumbling about the million dollar a year phone bill for wiretaps. There was one embarrassing situation when the FBI didn't pay their wiretap bill on time, and the billing software billed the party being wiretappped for their "additional extension".
It was possible to listen in on an line using the Automatic Line Insulation Test equipment, but a typical central office only had two ALIT units, and they had line testing work to do, so tying up one for wiretapping really irked telcos. Sometimes telcos would do that for the FBI, but not for local law enforcement.
Because of this, wiretapping was rare. It was just too much work to be used lightly.
As for call data, the original "pen register" was a physical device hooked to one line which produced dashes on a paper tape for dial pulses. The electromechanical central offices didn't store any data about local calls; only toll calls produced a billing record. Law enforcement agencies that wanted information about toll calls could only get it for the calling party, in the form of a copy of the phone bill. The data wasn't sorted by receiving party.
Now, it's too easy. All the call data is in indexed databases, and CALEA has huge capacity for recording calls.