NSA Planned To Hijack Google App Store To Hack Smartphones
Advocatus Diaboli writes: A newly released top secret document reveals that the NSA planned to hijack Google and Samsung app stores to plant spying software on smartphones. The report on the surveillance project, dubbed "IRRITANT HORN," shows the U.S. and its "Five Eyes" alliance: Canada, the United Kingdom, New Zealand and Australia, were looking at ways to hack smartphones and spy on users. According to The Intercept: "The top-secret document, obtained from NSA whistleblower Edward Snowden, was published Wednesday by CBC News in collaboration with The Intercept. The document outlines a series of tactics that the NSA and its counterparts in the Five Eyes were working on during workshops held in Australia and Canada between November 2011 and February 2012."
Bad part is, this would be middle of the newspaper, at best. Most people in the USA just don't care how badly our government is abusing everyone.
And, since then, almost every Internet service I use has started bringing their stuff out of the US. Not saying that makes us "hack-proof" (not least from our own intelligence agencies) but businesses can't do business with other governments or even large corporations if this kind of thing is suspected to be going on.
Every week or so, another large company tells me that they've pulled all their EU users and their data to their Ireland datacentre so that only the US people's data can be "collected" by the US authorities and otherwise the NSA are just the same as any other foreign hostile entity trying to get into their systems.
DropBox was the latest one I got an email from. The government and education services already do everything in-EU anyway because of a lovely thing called the Data Protection Act (which the US really needs to start adopting its own version of), and now even people's photo-sharing sites are doing the same because they just don't want this kind of stuff reflecting on them because they happen to do business in the US too.
Tell me, people, if China were doing this everybody would be up in arms. But because it's the US, it's okay?
All they've done is made everybody go from "Maybe the NSA could do this if they wanted" to "We have to assume they are doing this, all day, every day, no matter what the law says", move their data abroad, and massively increase awareness of security and encryption.
Hell, I'm now suspicious of Elliptic Curve, especially if it relies on published curve parameters rather than them being an inherently configurable part of the exchange (like Diffie-Helman - agree on a curve that nobody has used before but has certain properties and then use that as the basis for encryption) - I have a feeling that all the push to move on COULD be a cleverly orchestrated move to something such agencies "approve" of in secret even if they say it causes them problems in public.
When you think the trick is happening, maybe it's already been done...
in other news, wind is windy.