Slashdot Mirror
Schneier: Either Everyone Is Cyber-secure Or No One Is
Presto Vivace sends a new essay from Bruce Schneier called "The Democratization of Cyberattack." Quoting:
When I was working with the Guardian on the Snowden documents, the one top-secret program the NSA desperately did not want us to expose was QUANTUM. This is the NSA's program for what is called packet injection--basically, a technology that allows the agency to hack into computers.Turns out, though, that the NSA was not alone in its use of this technology. The Chinese government uses packet injection to attack computers. The cyberweapons manufacturer Hacking Team sells packet injection technology to any government willing to pay for it. Criminals use it. And there are hacker tools that give the capability to individuals as well. ... We can't choose a world where the U.S. gets to spy but China doesn't, or even a world where governments get to spy and criminals don't. We need to choose, as a matter of policy, communications systems that are secure for all users, or ones that are vulnerable to all attackers. It's security or surveillance.
Good luck implementing it though.
not sure how packet injection breaks into my computer.
There was an unknown error in the submission.
"...even a world where governments get to spy and criminals don't..."
How's it then that the governments get to use ICBMs but criminals don't?
Its always seemed obvious to me that the system that you *know* grants unauthorised access cannot be considered to be secure. I never thought I was saying anything profound or even worthwhile, but apparently this fact is lost on a good number of people.
Right now there's not really an option, we're all insecure. And we will continue to be insecure as long as we favor features over security (which probably won't change).
"First they came for the slanderers and i said nothing."
other governments are not.
Just develop everything in house. And I do mean everything.
You're preaching to the choir here... but it'd sure be great if you got a chance to explain this to the President and to Congress, though.
#DeleteChrome
Schneier is of course right. Unfortunately megalomaniac politicians around the world are violating the very rights their are supposed to be protecting which is why Bruce is naive is thinking this attitude will change any time soon. Thus the only path to security must come come through private sector. 1 Companies that sell software... better have all code open sourced (not same as free) or should be labelled "NOT TO BE TRUSTED". (including firmware.. Bios, NICs, HDD, GPU, riouter,s switches, etc..) Code (including scripts and updates) is then compiled locally and before first execution hash checked automatically against non-centralized database (p2p technology similar to bitcoin block chain) 3. All hardware sold with precise technical diagrams... or should be labelled "NOT TO BE TRUSTED" 4. All encryption always on client side. Virtually all major current email providers should be labelled "NOT TO BE TRUSTED" (salute to ProtonMail) 5. Get rid of centralized authorities for security (looking at you SSL) Centralized servers have big fat sign that say "NOT TO BE TRUSTED". P2P. 6. Create new network protocols (to replace www, ftp, imap, etc..) that are designed from ground up on zero knowledge principle. Websites not using it zero knowledge proof... "NOT TO BE TRUSTED" https://en.wikipedia.org/wiki/... 7. Shaming lists on NGOs (applause to EFF). Any politician that votes for mass surveillance or doesn't adhere to above principles. put on NGO lists as "HUMAN RIGHTS VIOLATORS" and NOT TO BE TRUSTED"..
This summary ends in a conclusion which seems appropriate for slashdot. But it grew from a questionable source.
We are expected to believe that Mr. Schneier at the Guardian, one of the anointed who had access to Snowden documents ... the NSA contacted him with concerns about exposing QUANTUM? Was this done by telephone, via intermediaries or a personal visit? How did the NSA know the Guardian/Schneier knew about QUANTUM? The logistics, the timeline, the specifics of this meeting have escaped me in this short summary and in TFA. Schneier has a good reputation at slashdot but that doesn't excuse him from documenting his public statements. I think the facts of his NSA communication are important if this allegation has substance. This is not Fox news and readers expect more than accusations and opinions.
...omphaloskepsis often...
Haven't people testing wireless security with aircrack been using packet injection for like... years??
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Really - you make no sense - have you missed your meds today ?
... people don't make "free choices" to begin with, the universe works on the laws of nature. The only way to safeguard our privacy would have to have been to build it in at its foundations early in history when it was being invented but that didn't happen because the people who invented it didn't really think about it too much because of computational and other limits of the technology of the time. The freedom and open-ness that gave us the internet ended up being its achilles heel.
Just look at early things like Gopher and email, all plaintext and early HTML as well. That was pretty much just asking to be spied on and let's remember, most of the internet is in plaintext so its trivial to see what they are doing.
All systems can be hacked given infinite resources and time, and given the political climate, Schneier would do well to see what science has discovered about reasoing. Reason doesn't work the way we thought it does, your sense of reality is controlled by emotion not truth:
https://www.youtube.com/watch?v=PYmi0DLzBdQ
Most have no clue what's really going on in the world... the elites are afraid of political awakening.
The (mass surveillance) by the NSA and abuse by law enforcement is just more part and parcel of state suppression of dissent against corporate interests. They're worried that the more people are going to wake up and corporate centers like the US and canada may be among those who also awaken. See this vid with Zbigniew Brzezinski, former United States National Security Advisor.
https://www.youtube.com/watch?v=Ttv6n7PFniY
Brezinski at a press conference
https://www.youtube.com/watch?v=0kmUS--QCYY
The real news:
http://therealnews.com/t2/
http://www.amazon.com/Democracy-Incorporated-Managed-Inverted-Totalitarianism/dp/069114589X/
http://www.amazon.com/Shadow-Government-Surveillance-Security-Single-Superpower/dp/1608463656/
http://www.amazon.com/National-Security-Government-Michael-Glennon/dp/0190206446/
Look at the following graphs:
http://imgur.com/a/FShfb
http://www2.ucsc.edu/whorulesamerica/power/wealth.html
And then...
WIKILEAKS: U.S. Fought To Lower Minimum Wage In Haiti So Hanes And Levis Would Stay Cheap
http://www.businessinsider.com/wikileaks-haiti-minimum-wage-the-nation-2011-6
https://www.youtube.com/watch?v=hnkNKipiiiM
Free markets?
https://www.youtube.com/watch?v=WHj2GaPuEhY#t=349
Free trade?
https://www.youtube.com/watch?v=Ju06F3Os64
http://www.amazon.com/Empire-Illusion-Literacy-Triumph-Spectacle/dp/1568586132/
"We now live in two Americas. One—now the minority—functions in a print-based, literate world that can cope with complexity and can separate illusion from truth. The other—the majority—is retreating from a reality-based world into one of false certainty and magic. To this majority—which crosses social class lines, though the poor are overwhelmingly affected—presidential debate and political rhetoric is
What's with the clickbait headlines? By itself, the headline is total BS. The actual statement made, however, is spot on. The hole in your security doesn't care who exploits it. There's no "good guy" flag in IP headers (though I'm sure some April 1st RFC will soon introduce it).
What worries me most is that we could win this fight, if it weren't for our own governments deciding to betray us. There are vastly more people interested in secure communication and other people not being able to spy on or subvert our computers and mobile devices than there are people interested in compromised communications and systems (basically only criminals and some deluded, criminal-if-the-laws-were-right elements of governments).
There is just one problem to Bruce's argument: The largest and most powerful spy agency in the world disagrees with his fundamental assumption. We often forget that the NSA has two missions, and they are exactly the two things that Bruce argues cannot co-exist: To secure the computing infrastructure of the US against foreign espionage, and to provide espionage on foreign communication.
The NSA believes, and/or is tasked with exactly these two things that Bruce says (and I agree) are mutually exclusive. No surprise they've gone rogue, their very mission statement is a recipe for a mental breakdown through cognitive dissonance.
Assorted stuff I do sometimes: Lemuria.org
"... This is the NSA's program for what is called packet injection--basically, a technology that allows the agency to hack into computers.Turns out, though, that the NSA was not alone in its use of this technology. The Chinese government uses packet injection to attack computers." ,,,that ALL the spies have much more in common with each other than they do with civilians.
Towards the end of the Cold War the UK and Russian intelligence services were routinely exchanging data on their activities - the idea being that this enabled each group to justify its budget to its masters by warning of what the other side were doing.
Effectively, this whole field is a self-perpetuating blot on humanity. Spies justify their ever-increasing budgets by claiming that they are 'saving' their country from unspecified secret threats which do not really exist. And then they recommend that the military undertake destabilising activities in an attempt to make these threats exist. Why do you think that we went into the Middle East, Russia went into the Ukraine, or China is moving into the islands around Japan?
For those that don't know or have forgotten. The British PM made a statement that he wants to ban communication which cannot be intercepted and deciphered by the government. We may as well just send all our communication in plain text ascii.
Either we're all safe, or we all get destroyed.
I don't have a sig.
And if Schneier is writing about it, you do not think something has taken its place?
We choose security for our homes but why don't we all live in bank vaults? cost? aesthetics?
There are some types of security that the average person simply can't have. Most of us have no choice but to use a commercial provider for our internet access and as long as we can't own and control every point between us and our target node and the development and manufacturer of every critical component in our devices - our governments will always be able to subvert our trust and spy on us anyway.
You're expecting companies that only care about making money to care about our security. They only care so far - to the point that people are satisfied enough to buy the service. For enough money or with threats of their profits or ability to do business being affected - There's very few businesses that won't comply and those that don't suddenly find themselves restricted in such a way as to lose out to their competitors. The shareholders won't be happy and they're more important to businesses than morality - or you.
There is nothing that anybody can do or say that will represent undeniable evidence that at some point in the chain, be it in your chips or your wires; security has not been compromised.
Remember - they're not protecting us, they're protecting themselves. It's not your elected officials that are making these decisions, it's unelected heads of powerful branches of government that are unaffected by elections.
Vote for whoever you like but the true power lies with agencies such as the NSA, CIA, GHCQ, MI5, MI6, Mossad.
No vote you cast will topple those pyramids and they live for control and power over you, foreign states and each other.
You want true security? fire every last single person from the top to the bottom in every last government connected office and replace them with randomly selected, suitable candidates. It's the only way you'll weed out the corruption that's the true heart of all the decisions that are made on 'our behalf'.
....those that abuse false dichotomies and those that don't!
Another huge problem with all this data gathering is that the amount of data is impossible to process by humans, so the agencies will have to rely on algorithms to find the "bad guys". Who can defend themself against accusations or persecution that falls out of such algorithms? It quickly becomes a case of everybody have to prove their own innocense (which of course is impossible). Add injection of false data and corruption of databases, and we are all doomed.
There is a solution.
Fix most of the known flaws, and fix so called devices to raise the alarm when clumsy borked packets come in.
Failing that recompile your own software, and have a few different routers and firmware in line that drop mangled packets on the floor.
In short most of the commercial software lacks tight checking(for performance advantages). Beef up the checking, and put back the missing RFC parsing checks.
May not be complete, but will make things better.
It is just another plausible reason 'I must have been hacked' defense will convince juries to dismiss anything with an IP address claim.
is the enemy of good.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
You can have gov spy on you and hackers not. Just mandate all traffic go through VPN.gov, and CAs co-operating. Yeah, gov can't spy on you covertly - you know they're there. And China.gov can't spy on your US.gov connection and vice-versa. Dystopias would have borders again. We've always been at war with East Asia, Emmanuel Goldstein spreads lies, and all that.
The counter argument is that citizens can never be truly secure unless national security services have the ability to see what adversaries such as terrorists and hostile nation states, corrupt criminal corporations are really up to which wholly locked down security paradigm would make impossible. Would you adversaries respect this standard? In fact, this is why you have security services so the whole argumentation is spurious and childish and shows a lack of mature insight.
The real problem here is are these services following the rule of law (they aren't) and are your elected representatives exercising proper oversight (they are not).
The basic problem is we are based on a constitution and a body of laws that the elites, business class, and the national security state are busily running into the ground. It's not a problem until a corrupt politician or extreme party buys it's way into the white house again and wants to create a "permanent" presidency and go after adversaries using this type of technology. There were some indications that the triumvirate of Bush, Cheney, Rumsfeld where willing to think along those lines.
There is enough shitty software out there, can we please try to not make it shittier by including extra points of failure just so that law enforcement can have an easier time at their job.
and why is it that Law Enforcement gets to make their lives easier when the last time i checked their bumbelings make our jobs harder day by day, so in the end we just get dumber cops.
Law Enforcement EVERYWHERE of ANY TYPE should be held to a much higher standard than the citizenery. it is glaring obvious that this is currently false and there are multiple levels of justice depending on how connected you are... Ladies and gentlemen, that is not a democracy! a democracy is when every member of the nation is considered equal.
Here is the very simple point that everyone seems to have missed: It's not just a matter of data collection. The NSA and probably all other similar agencies around the globe must also be trusted to maintain the security of the data they collect. How on earth could one low level person download the crown jewels so easily as Edward Snowden? Might not Edward Snowden's evil twin have gone to the Chinese? How would we know?
Actually, discussions on Slashdot have never been well informed; they were bad back then, and they are worse now. "Well informed" died in september 1995, it existed on USENET prior to that.
... everyone has access to the same tools.
By way of example, it's damn near impossible for me to buy a grenade, but the military has lots.
The way cyber warfare is developing, it's more of a level playing field.
The major difference between capabilities of governments and civilians, on the cyber warfare stage, is money.
It little behooves the best of us to comment on the rest of us.
also uses DPI (packet injection) and is supposed to be the state-of-the-art full-spectrum intelligence platform: it will allow one to intercept an email, alter and forward it unknown to either the addressor or addressee, with a new meeting time and place, and then dispatch either an extreme rendition, or kill team, to the rendezvous point. Ain't life grand?
https://www.wikileaks.org/spyf...
http://www.spiegel.de/internat...
http://www.allgov.com/news/us-...
http://securityaffairs.co/word...
Commenter claims: . We often forget that the NSA has two missions, and they are exactly the two things that Bruce argues cannot co-exist: To secure the computing infrastructure of the US against foreign espionage, and to provide espionage on foreign communication.
Had you ever worked at the NSA, or served in military intelligence, you would know better, as their two missions are financial intelligence acquisition for the money masters, and command-and-control of the populace. Sometime you might study the history of who founded the American intelligence establishment, or else peruse the three chapters on the Kennedy administration in Richard Parker's outstanding biography of John Kenneth Galbraith.