Slashdot Mirror
Security Experts Call For Boycott of RSA Conference In NSA Protest
Hugh Pickens DOT Com writes "ZDNet reports that at least eight security researchers or policy experts have withdrawn from RSA's annual security conference in protest over the sponsor's alleged collaboration with the National Security Agency. Last month, it was revealed that RSA had accepted $10 million from the NSA to use a flawed default cipher in one of its encryption tools. The withdrawals from the highly regarded conference represent early blowback by experts who have complained that the government's surveillance efforts have, in some cases, weakened computer security, even for innocent users. Jeffrey Carr, a security industry veteran who works in analyzing espionage and cyber warfare tactics, took his cancellation a step further calling for a boycott of the conference, saying that RSA had violated the trust of its customers. 'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr. 'I don't know what worse action a security company could take than to sell a product to a customer with a backdoor in it.' Organizers have said that next month's conference in San Francisco will host 560 speakers, and that they expect more participants than the 24,000 who showed up last year. 'Though boycotting the conference won't have a big impact on EMC's bottom line, the resulting publicity will,' says Dave Kearns. 'Security is hard enough without having to worry that our suppliers — either knowingly or unknowingly — have aided those who wish to subvert our security measures.'"
"'Though boycotting the conference won't have a big impact on EMC's bottom line"... not buying their products because there's a f-cking backdoor in it will.
Some people die at 25 and aren't buried until 75. -Benjamin Franklin
The only thing interesting about this affair is that RSA only got $10M.
I don't know if they sold their products with some clever fine-print disclaimers, but shouldn't those who bought their products bring them into court and demand damage payments?
Or everyone in the industry has slept with the NSA so they don't want to set a precedent by suing RSA?
As child porn wouldn't effect the customers bottom line.
This is more like Bernie Madoff hosting an ethics conference.... today.
Why not just recast the conference as a black hat/government contractor conference and show the tiniest amount of honesty.
About time more americans started acting snowde-like. As in ballsy
Reuters reported that they did.
Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.
Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract.
So, who's going to sue them? And on what grounds?
'I can't imagine a worse action, short of a company's CEO getting involved in child porn,' says Carr.
The CEO getting involved in child porn means his personal life is tainted and he goes to jail and hell and all that.
This is bad news for the company because people lose their trust on the company. No one needs to identify with the CEO of a company... but not trusting a company in the security field doesn't bode well for said company.
I asked this when this original story first broke headlines. There are allegations, but has anybody ACTUALLY seen proof they compromised security on the NSAs wishes for a paltry $10M?
When I attended the conferences back in the 1990's, the NSA was there...they even presented findings on the strength of DES and the need for a newer algorithm. Skipjack and Clipper, promoted by Al Gore, was the scare at the time.
Back then, licensing of the libraries (BSafe and TIPEM) came in two flavors - the low-cost Mom/Pop shop licensing (with 10% royalties paid on profits and $10K for a license to distribute and $250K+lower royalties for larger organizations. Being a little guy, the Mom/Pop deal made sense. Larger corporations would easily pay out $10M from royalties alone.
The licensing has since changed - probably because of the expiration of the RSA related patents. Perhaps, the new owners, EMC, felt that they should take the money (they are publicly traded, right?). RSA Labs was private in the past (and, had a reputation to uphold). It was well known at the time there were values that would make algorithms such as RSA and Diffie-Hellman and DES/3DES weak. Discussions centered on how to eliminate those weaknesses. EC was just coming into existence outside of the academic circles. Given source was available (for a price) and compilable, there was plenty of opportunity to examine the code for holes. The biggest, publiclly, known threat we knew of was when SecureId and SecureToken was compromised - that was admitted by the company. Too much money, particulary in secure systems design and certification was to be made - why build upon a loosely constructed house of cards?
So, did RSA/EMC intentionally weaken their products for a paltry $10M? Where is the proof, beyond circumstantial supposition, that this occurred? Can somebody point me to links showing this evidence? Or, is this conjecture based on documents that Snowden supposedly "leaked"? If so, how was the veracity and authenticity of these "admissions" proven? Is there a check, signed contract or ledger book showing the transaction(s) actually took place?
Sadly, so many in the security field will do anything to make a name for themselves - 15 minutes of fame. If there is real proof, then the call for a boycott and public raking over the coals is justified. I am asking to see the proof.
A bigger problem we, as consumers and businesses, are now facing are all the compromised wireless routers that was revealed last week. Given that the shutdown of Blackhole malware kit and no suitable replacement, we are seeing a rise of Ransom-ware. But, a single compromised machine on a wireless network behind one of these routers opened up the entire network - the attackers could access ANY machine without having to go through the originally infected host at will. We should be asking how THAT happened and insist upon inspection of the hardware and firmware by respected engineers and cryptographers (under NDA) for any critical parts or components sold for use in our routers. Their stamp would put their reputations on the line if an easily manifested exploit were found. And, did any of the companies selling products with these vulnerabilities know of the backdoors in their products? Just wondering.
for not truthfully advertising their products as "Insecurity Solutions"
We're all running systems based on some derivative of Unix. The user based permission model was fine for 1970s computer science departments, but it's totally crap for the world we now live in. We all should be running systems that are at least Orange Book A1 level secure, but we aren't. The resources are available to do it, we could totally pump this out in a year or two in the open source world.... but we won't.
Everyone thinks they have secure enough systems... but they don't, not by a country mile. Nobody seems to understand that trusting applications to do their jobs, and not subvert the systems, is a stupid thing.
We have persistently insecure computing... encryption, even if done perfectly, doesn't help fix that.
From what I've read, it may be too quick to gang up on RSA. It sounds like they accepted a payment from the NSA to make Dual_EC_DRBG preferred/default, not to accept a backdoor.
The industry as a whole is responsible for accepting and adopting Dual_EC_DRBG. According to Wikipedia, "Members of the ANSI standard group, to which Dual_EC_DRBG was first submitted, were aware of the exact mechanism of the potential backdoor and how to disable it, but did not take sufficient steps to unconditionally disable the backdoor."
It seems to me that RSA is just being made a scapegoat for an industry failure because they accepted a payment to make it the default (which would be perfectly acceptable if the NSA positioned it as payment to ensure wide acceptance of an improvement over the previous default). I've seen nothing to indicate that RSA knew about or was involved in creating the backdoor, or that it is any more culpable than the rest of the industry for its acceptance as a standard.
"National Security is the chief cause of national insecurity." - Celine's First Law
Not a cipher, but a pseudo-random number generator. Which means that every cipher, signature, or other algorithm that used random keys was compromised.
Not quite. I am telling you that because of abortion, no one is willing to stop the NSA putting back doors in software.
[Sir Garlon] is the marvellest knight that is now living, for he destroyeth many good knights, for he goeth invisible.
What end-user products should one avoid in order to avoid this back door?
Politics; n. : A religion whereby man is god.
No way, go there and freaking trash the place. Go all "occupy" on them or plan silly string attacks or flash mob protests in the middle of presentations. THAT would send them more of a message than slightly lower than average attendance.
I find the slow researcher withdrawal more than a little disconcerting.
All depends what you're researching and who with.
systemd is Roko's Basilisk.
Revelations of back doors are, as I suspect, limited - perhaps there are many more that we don't know of yet. And since that's the case, since people are more into making money than they are into making sense, then "computers" themselves cannot be "trusted". That doesn't mean that we can't use them as they are however. I'm not about to go off and learn what the shit "systems that are at least Orange Book A1 level secure" even means. I'm going to continue to use commercial software and hardware, because life's simply to short, and I only care so much about privacy - as long as I'm not being charged with some bullshit charge (and I have been charged with some bullshit charge in the past) that I cannot prove is a bullshit charge (I was able to prove that what I was charged with was total bullshit and it got thrown out), aka some terrorist plot or something like that.
"Computers" should be treated like girls that have a stinky vagina. There's obviously something wrong, but that doesn't mean that she's not cool to talk to, ask questions of, play games with.
Politics; n. : A religion whereby man is god.
People go to these conferences for the networking opportunities, not necessarily because they care about the flagship product of the main sponsor.
Those security conferences are packed with government contractors that know better than to bite the hand that feeds them.
I agree; barring incontrovertible evidence to the contrary, the NSA will never be believed again.
Time to dismantle the entire operation and start over with new people; obviously none of these people understand what Domestic enemies are: People who are destroying the Constitution.
It is being destroyed because it is being ignored in the name of "National Security"; that bill of rights is so inconvenient for Despots.
They didn't need to repeal it; take a look around; they know there's nothing we can do about it.
Congress is likely being blackmailed into silence; in our society, everyone is guilty of something, are they not?
And here we always thought the "tinfoil hat" and gun nuts were just crazy... :facepalm:
Truth isn't Truth - Guliani
n/t.
Truth isn't Truth - Guliani
So in summary, there's discounted tickets available now...
Uh, hello pinhead. HELLO PINHEAD!
NOT going to the conference is EXACTLY what the NSA wants you to do!
If you DO go to the conference, then you get to discuss the issue with like minds and with the source of the issue.
If you "boycott" the conference, trust me, there's already a prepared script for handling that "quote" "contingency" "quote".
I would have some serious questions for whomever first pitched the idea of boycotting the conference as some kind of political statement. Can it be traced to a person or circle of people? What is / are their identity(ies)?
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee