Slashdot Mirror
Security Experts Call For Boycott of RSA Conference In NSA Protest
Hugh Pickens DOT Com writes "ZDNet reports that at least eight security researchers or policy experts have withdrawn from RSA's annual security conference in protest over the sponsor's alleged collaboration with the National Security Agency. Last month, it was revealed that RSA had accepted $10 million from the NSA to use a flawed default cipher in one of its encryption tools. The withdrawals from the highly regarded conference represent early blowback by experts who have complained that the government's surveillance efforts have, in some cases, weakened computer security, even for innocent users. Jeffrey Carr, a security industry veteran who works in analyzing espionage and cyber warfare tactics, took his cancellation a step further calling for a boycott of the conference, saying that RSA had violated the trust of its customers. 'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr. 'I don't know what worse action a security company could take than to sell a product to a customer with a backdoor in it.' Organizers have said that next month's conference in San Francisco will host 560 speakers, and that they expect more participants than the 24,000 who showed up last year. 'Though boycotting the conference won't have a big impact on EMC's bottom line, the resulting publicity will,' says Dave Kearns. 'Security is hard enough without having to worry that our suppliers — either knowingly or unknowingly — have aided those who wish to subvert our security measures.'"
"'Though boycotting the conference won't have a big impact on EMC's bottom line"... not buying their products because there's a f-cking backdoor in it will.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
The only thing interesting about this affair is that RSA only got $10M.
I don't know if they sold their products with some clever fine-print disclaimers, but shouldn't those who bought their products bring them into court and demand damage payments?
Or everyone in the industry has slept with the NSA so they don't want to set a precedent by suing RSA?
As child porn wouldn't effect the customers bottom line.
This is more like Bernie Madoff hosting an ethics conference.... today.
Why not just recast the conference as a black hat/government contractor conference and show the tiniest amount of honesty.
About time more americans started acting snowde-like. As in ballsy
Reuters reported that they did.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract.
So, who's going to sue them? And on what grounds?
'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr.
The CEO getting involved in child porn means his personal life is tainted and he goes to jail and hell and all that.
This is bad news for the company because people lose their trust on the company. No one needs to identify with the CEO of a company... but not trusting a company in the security field doesn't bode well for said company.
I asked this when this original story first broke headlines. There are allegations, but has anybody ACTUALLY seen proof they compromised security on the NSAs wishes for a paltry $10M?
When I attended the conferences back in the 1990's, the NSA was there...they even presented findings on the strength of DES and the need for a newer algorithm. Skipjack and Clipper, promoted by Al Gore, was the scare at the time.
Back then, licensing of the libraries (BSafe and TIPEM) came in two flavors - the low-cost Mom/Pop shop licensing (with 10% royalties paid on profits and $10K for a license to distribute and $250K+lower royalties for larger organizations. Being a little guy, the Mom/Pop deal made sense. Larger corporations would easily pay out $10M from royalties alone.
The licensing has since changed - probably because of the expiration of the RSA related patents. Perhaps, the new owners, EMC, felt that they should take the money (they are publicly traded, right?). RSA Labs was private in the past (and, had a reputation to uphold). It was well known at the time there were values that would make algorithms such as RSA and Diffie-Hellman and DES/3DES weak. Discussions centered on how to eliminate those weaknesses. EC was just coming into existence outside of the academic circles. Given source was available (for a price) and compilable, there was plenty of opportunity to examine the code for holes. The biggest, publiclly, known threat we knew of was when SecureId and SecureToken was compromised - that was admitted by the company. Too much money, particulary in secure systems design and certification was to be made - why build upon a loosely constructed house of cards?
So, did RSA/EMC intentionally weaken their products for a paltry $10M? Where is the proof, beyond circumstantial supposition, that this occurred? Can somebody point me to links showing this evidence? Or, is this conjecture based on documents that Snowden supposedly "leaked"? If so, how was the veracity and authenticity of these "admissions" proven? Is there a check, signed contract or ledger book showing the transaction(s) actually took place?
Sadly, so many in the security field will do anything to make a name for themselves - 15 minutes of fame. If there is real proof, then the call for a boycott and public raking over the coals is justified. I am asking to see the proof.
A bigger problem we, as consumers and businesses, are now facing are all the compromised wireless routers that was revealed last week. Given that the shutdown of Blackhole malware kit and no suitable replacement, we are seeing a rise of Ransom-ware. But, a single compromised machine on a wireless network behind one of these routers opened up the entire network - the attackers could access ANY machine without having to go through the originally infected host at will. We should be asking how THAT happened and insist upon inspection of the hardware and firmware by respected engineers and cryptographers (under NDA) for any critical parts or components sold for use in our routers. Their stamp would put their reputations on the line if an easily manifested exploit were found. And, did any of the companies selling products with these vulnerabilities know of the backdoors in their products? Just wondering.
No problem. cold_fjord will be there for their consolation
I applaud a boycott at this point, but I find the slow researcher withdrawal more than a little disconcerting. WHY?
It's been what, a couple weeks since the NSA funded backdoor announcement, right? We had 1 or 2 immediate withdrawal from researchers, but there wasn't a vast uproar of action in response to RSA, specificially with regard to their conference. There's been more coverage of the story, and more and more researchers and technologists are chiming in, but that initial reaction from the security field en masse was, well, rather impotent. I'm not saying they aren't right. Not at all. This is a wholesale stab in the back that RSA has committed, as far as I'm concerned. What is disconcerting, in my opinion, was that there wasn't an immediate 180 by security researchers with regard to the RSA conference. An IMMEDIATE reaction. Yes, I understand they want to, or need to, vette out the claims, since they are pretty damning. But this didn't just happen yesterday. I'm wondering what the pause is. Why the staggered complacency on the matter? Being vocal is one thing, and many a researcher has, and some even have done more. But, where is the widespread physical protest of this conference, and RSA, in the security field? All I'm saying is, from where I'm sitting, it's been a slow momentum for withdrawal from the conference. I keep saying the conference because, aside from not buying or using any product of RSA and EMC, or writing a scathing report online, what other form of protest do you have? I'm just a little disappointed is all. I figured the security field, when taken as an overall, the top teir folk, or majority of researchers were all on the 'same page' so to speak about their industry. I know reputations are everything in your field, but isn't this something you'd stick your neck out on? If it's not, at what point would you?
As a lowly IT Admin, I read these stories at arms distance. I now know, with 100% certainty, that keeping my systems up to date is no longer enough to keep out the intruders. Steps will be take beyond the norm for me, or perhaps, the norm is something else that I'll adapt to. Something that others, a very small number, have been implementing for quite a while. But my overall concern is that the response by the security field, beyond lip service and op-ed, doesn't give me confidence for the future security of our technology going forward. I hope this concern does not go unnoticed.
for not truthfully advertising their products as "Insecurity Solutions"
We're all running systems based on some derivative of Unix. The user based permission model was fine for 1970s computer science departments, but it's totally crap for the world we now live in. We all should be running systems that are at least Orange Book A1 level secure, but we aren't. The resources are available to do it, we could totally pump this out in a year or two in the open source world.... but we won't.
Everyone thinks they have secure enough systems... but they don't, not by a country mile. Nobody seems to understand that trusting applications to do their jobs, and not subvert the systems, is a stupid thing.
We have persistently insecure computing... encryption, even if done perfectly, doesn't help fix that.
From what I've read, it may be too quick to gang up on RSA. It sounds like they accepted a payment from the NSA to make Dual_EC_DRBG preferred/default, not to accept a backdoor.
The industry as a whole is responsible for accepting and adopting Dual_EC_DRBG. According to Wikipedia, "Members of the ANSI standard group, to which Dual_EC_DRBG was first submitted, were aware of the exact mechanism of the potential backdoor and how to disable it, but did not take sufficient steps to unconditionally disable the backdoor."
It seems to me that RSA is just being made a scapegoat for an industry failure because they accepted a payment to make it the default (which would be perfectly acceptable if the NSA positioned it as payment to ensure wide acceptance of an improvement over the previous default). I've seen nothing to indicate that RSA knew about or was involved in creating the backdoor, or that it is any more culpable than the rest of the industry for its acceptance as a standard.
"National Security is the chief cause of national insecurity." - Celine's First Law
So you are telling me that because of abortion the NSA is putting back doors in software?
Not a cipher, but a pseudo-random number generator. Which means that every cipher, signature, or other algorithm that used random keys was compromised.
What end-user products should one avoid in order to avoid this back door?
Politics; n. : A religion whereby man is god.
No way, go there and freaking trash the place. Go all "occupy" on them or plan silly string attacks or flash mob protests in the middle of presentations. THAT would send them more of a message than slightly lower than average attendance.
I'll do my part, I will not be there. (Wasn't going to be anyway, so I was planning ahead!)
Revelations of back doors are, as I suspect, limited - perhaps there are many more that we don't know of yet. And since that's the case, since people are more into making money than they are into making sense, then "computers" themselves cannot be "trusted". That doesn't mean that we can't use them as they are however. I'm not about to go off and learn what the shit "systems that are at least Orange Book A1 level secure" even means. I'm going to continue to use commercial software and hardware, because life's simply to short, and I only care so much about privacy - as long as I'm not being charged with some bullshit charge (and I have been charged with some bullshit charge in the past) that I cannot prove is a bullshit charge (I was able to prove that what I was charged with was total bullshit and it got thrown out), aka some terrorist plot or something like that.
"Computers" should be treated like girls that have a stinky vagina. There's obviously something wrong, but that doesn't mean that she's not cool to talk to, ask questions of, play games with.
Politics; n. : A religion whereby man is god.
Those security conferences are packed with government contractors that know better than to bite the hand that feeds them.
I agree; barring incontrovertible evidence to the contrary, the NSA will never be believed again.
Time to dismantle the entire operation and start over with new people; obviously none of these people understand what Domestic enemies are: People who are destroying the Constitution.
It is being destroyed because it is being ignored in the name of "National Security"; that bill of rights is so inconvenient for Despots.
They didn't need to repeal it; take a look around; they know there's nothing we can do about it.
Congress is likely being blackmailed into silence; in our society, everyone is guilty of something, are they not?
And here we always thought the "tinfoil hat" and gun nuts were just crazy... :facepalm:
Truth isn't Truth - Guliani
n/t.
Truth isn't Truth - Guliani
I thought Qwijibo was sending out grades.
... to believe that, due to NSA intrusion, supposed 'secure' devices and systems are easier to hack into by the criminal element? A company manufacturing a product that the NSA has paid for a 'backdoor' in could also use that insecure code in other products. As an example - the Target point of sale hardware that was hacked. Could a weakness from another product also be in these devices? If that is the case - would you go as far as to say the NSA is liable for the losses?
So in summary, there's discounted tickets available now...
Uh, hello pinhead. HELLO PINHEAD!
NOT going to the conference is EXACTLY what the NSA wants you to do!
If you DO go to the conference, then you get to discuss the issue with like minds and with the source of the issue.
If you "boycott" the conference, trust me, there's already a prepared script for handling that "quote" "contingency" "quote".
I would have some serious questions for whomever first pitched the idea of boycotting the conference as some kind of political statement. Can it be traced to a person or circle of people? What is / are their identity(ies)?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
The scum drawn to this conference LOVE the fact that the NSA budget has exploded over recent years. They are the worst kids of Human parasites willingly feeding on the horrific abuses unleashed by Team USA and Team Blair.
For every individual in the IT security businesses that PRETENDS to have a conscience (be in no doubt, the boycotters are merely indulging in a reputation ploy), thousands simply throw themselves at any opportunity to serve the massively expanding full surveillance initiatives. Each of them hopes they might one day be in a position where NSA people offer them hundreds of thousands of dollars to help author back-doors into the products sheeple stupidly trust.
The ONLY reason RSA is drawing opprobrium is because of the crude and clumsy methods RSA used in serving the NSA, bringing the whole project into disrepute. Those in the security business EXPECT companies as well placed as RSA to fully implement PLAUSIBLE DENIABILITY constructs, so sites like this can imply that the RSA was wholly innocent. The team for which the owners of Slashdot so willingly bat for, do not like it when entities on their side screw up so badly, that reputation management is almost impossible.
Even so, the owners of Slashdot have repeatedly promoted stories implying that RSA is 'innocent', no matter how laughable that suggestion may be. Even in the face of cast iron proof, FUD campaigns, as the owners of Slashdot well know, always manage to influence the thinking of a good number of the type of betas who hang around sites like this one.
Anyone moronic enough to continue supporting the system that abuses them, by voting, is likely to fall for the old "give them the benefit of the doubt" ploy.
Sadly, in so-called professions, people will always go along with 'the money'- even doctors in the USA will willingly work against the interests of their patients, if by doing so their pockets are sufficiently enriched. And IT professionals consider their 'moral' duties lie way, way, way below those of doctors. This fact is why, when you allow your system to be absolutely corrupted at the top, it cannot be 'repaired' by relying on the morality of people lower down. Humans, by and large, assume they will always work to lower moral standards than those found in people they perceive to be above them. Open corruption at the top is thus a complete cancer.
And it gets worse. The extremist zionists that own Yahoo recently served malware designed to exploit Java weaknesses to 2 million plus users outside the USA. The malware operates on behalf of the usual zionist crime gangs in the Ukraine vicinity and Israel. However, Yahoo, courtesy of its well-appointed 'family' friends in the USA and Europe, is above the Law, and faces no legal sanctions whatsoever. This is how blatant they are.