NSA Targeted 'The Two Leading' Encryption Chips (theintercept.com)

Advocatus Diaboli sends a report from Glenn Greenwald at The Intercept about the NSA's efforts to subvert encryption. Back in 2013, several major publications reported that the NSA was able to crack encryption surrounding commerce and banking systems. Their reports did not identify which specific technology was affected. The recent backdoor found in Juniper systems has caused the journalists involved to un-redact a particular passage from the Snowden documents indicating the NSA targeted the "two leading encryption chips" in their attempts to compromise encryption. Quoting: The reference to "the two leading encryption chips" provides some hints, but no definitive proof, as to which ones were successfully targeted. Matthew Green, a cryptography expert at Johns Hopkins, declined to speculate on which companies this might reference. But he said that "the damage has already been done. From what I've heard, many foreign purchasers have already begun to look at all U.S.-manufactured encryption technology with a much more skeptical eye as a result of what the NSA has done. That's too bad, because I suspect only a minority of products have been compromised this way."

Comments

Re:Good on them

[Qzukk]

There was a time at Slashdot when we would be congratulating the NSA for doing this stuff.

When was that? I've been here since before Echelon and general consensus here when Echelon was revealed was bomb nuclear jihad assault rifle terrorism explosion poison murder kill.

Re:Good on them

[ledow]

Not really.

It hasn't been their job to insert backdoors into their own and existing systems worldwide, really. Not even the early codebreakers did that kind of thing.

It's their job to produce foreign signals intelligence, yes, but backdooring every piece of hardware in the country doesn't achieve that. All that achieves is compromise of people who were trusting US hardware already. For example, their allies.

All they've done is hurt their other core purpose - the national security of the US - and significantly damage their country's economy in a few specific areas.

Spying is not about having backdoors in hardware you produce in your own country. It's about getting those into foreign countries, foreign hardware, and about defeating encryptions that you're NOT already in control of.

Literally, a signed court order saying that Cisco/Juniper has to put in a backdoor for US intelligence into products X, Y, Z achieves this aim in the same way. With non-disclosure clauses, it's as secret. That's not what the NSA should be wasting their time on, if that's even what the US want to do.

Remember Huawei?

[Ragnarok89]

Remember the big scare a while back about backdoors in Huawei network switches and routers? Looks like we weren't that far behind.

Re:Remember Huawei?

[Sique]

I would rather guess that the NSA knew about their own backdoor, and thus they suspected China of doing the same. It's a rule of thumb for me: If one side in a conflict warns about shenanigans from the other side which are not provable yet, you can safely assume that a) the first side thought about it themself and b) has already implemented it.

Well of course ...

[gstoddart]

From what I've heard, many foreign purchasers have already begun to look at all U.S.-manufactured encryption technology with a much more skeptical eye as a result of what the NSA has done. That's too bad, because I suspect only a minority of products have been compromised this way

Not just encryption, but pretty much any US created technology ... cloud services or anything else.

If the US has made their technology companies part of their spy apparatus, then who the hell would trust a US technology company? You simply can't.

So don't go all boo-hoo that people are looking at your products with some skepticism they can trust you when you created the situation in which they can't trust you.

Anybody outside of the US has no choice but to look at US technologies and ask "given that it's almost certain they're under the thumb of the NSA, what are my alternatives?"

You can't have it both ways. And you don't get to whine if people stop buying your products because they can't trust you anymore.

Re:Well of course ...

[Anonymous Coward]

Have you seen Intel's Management Engine (ME).

Jesus Christ on a hopping frog. It's basically a system for allowing Intel/NSA/GCHQ free reign over your IT.

It's a small computer that runs alongside your main machine. It's sips power and runs even when the machine is off. It talks directly to the network card and takes instructions/returns data. It has open access to the entire machine's memory. You aren't allowed to know what it does. The entire system is cryptoed and proprietary.

Intel is flogging this nightmare as a management system... when you couldn't design a more effective government sponsored backdoor into every PC. It's Intel giving the spies their wettest of dreams.

Re:Well of course ...

[Anonymous Coward]

Well the US doing this is fact.
Other countries doing it is a suspicion.

The NSA and CIA being involved in corporate espionage is fact.
Other countries doing corporate espionage is suspicion.

Too late

[U2xhc2hkb3QgU3Vja3M]

From what I've heard, many foreign purchasers have already begun to look at all U.S.-manufactured encryption technology with a much more skeptical eye as a result of what the NSA has done. That's too bad, because I suspect only a minority of products have been compromised this way.

I think it's more because of the NSA, CIA, etc and the general feeling we get from the U.S.A. that we cannot trust anything you do, period.

Signed,
the rest of the world.

Re:Too late

[Anonymous Coward]

* perpetual state of pseudowar
* extreme incarceration rate
* taking the mickey out of your own constitution (misuse of state power)
* state == religion (flag code, indoctrination of children with pledge of allegiance, flags everywhere, anthem at every sporting event with people standing up touching their hearts, etc)
* mass media just a codeword for party propaganda machine
* most of the nation living in poverty with elite 1% untouchable by law

i'm not saying there aren't differences but do you seriously not see the similarities? you do not have a single dictator, instead you have a powerful corporate elite buying legislation.

Re:Good on them

[rmdingler]

If you believe there is a pressing reason for our spy agencies to engage in backdooring the work of private companies, then you (perhaps) have an argument.

However, if you are inept enough to keep getting caught in the act, eventually all you do is cripple foreign sales of the companies who cooperate with your efforts.

Eventually, you have less ability to target the threats you are so afraid of.

Re:How is this a story exactly?

[Sique]

This is not about breaking cryptography. Ever governmental agency can legally force domestic companies to include a backdoor and keep their mouth shut about it. China was publicly suspected of shipping one with Huawei products, probably in an attempt to twart Huawei's success in selling them to U.S. customers and customers in their allied countries.

This is about deliberately sell defective products to about anyone.

I would applaud the NSA if they managed to include their backdoor in Huawei products. That would have been quite a stunt.

Re:Good on them

[Kjella]

Spying is not about having backdoors in hardware you produce in your own country. It's about getting those into foreign countries, foreign hardware, and about defeating encryptions that you're NOT already in control of. Literally, a signed court order saying that Cisco/Juniper has to put in a backdoor for US intelligence into products X, Y, Z achieves this aim in the same way. With non-disclosure clauses, it's as secret. That's not what the NSA should be wasting their time on, if that's even what the US want to do.

Sure, because slapping a multi-national full of foreigners with no security clearance with an NDA is totally simliar to an in-house NSA project with all Top Secret clearances. And if China or Russia is the customer, we'll just make a special order just for you without anybody noticing. It's not like the end result would be any better either, everybody would wonder if their hardware has been NSL'd instead of r00ted. I'm not saying either way is a good gamble, but I'd rather take the technical one than the legal one.

Re:FTFY

[Anonymous Coward]

"without question, protected by US free speech rights even if the US government happened to have been able to access some of the encrypted data."

The US is not the bastian of freedom you seem to think it is.

The US treated the detainees at Guantanamo bay with utter disregard for civil rights and international law.

Your double-think is disgusting.

Re:Good on them

[PvtVoid]

This.

One of the NSA's mandates is signals intelligence. Another is information assurance, i.e. making sure our communications infrastructure is secure. Inserting backdoors in crypto hardware represents a pyrrhic victory for the first, and a complete disaster for the second.

The one thing that advocates for crypto backdoors completely fail to understand is that what you gain from the ability to monitor traffic comes at an enormous cost, which is the indroduction of a systemic flaw in our entire information infrastructure, which could potentially have catastrophic consequences. The best reason to oppose backdoors is not because "privacy" or "freedom" (although those may indeed be sufficient), but because backdoors combat a nuisance by making us vulnerable to a truly existential threat.

Only a minority?

[sehlat]

That's too bad, because I suspect only a minority of products have been compromised this way.

When you have a 55-gallon drum of sewage with a teaspoon of pure water in it, you have a 55-gallon drum of sewage.
When you have a 55-gallon drum of pure water with a teaspoon of sewage in it, you have a 55-gallon drum of sewage.

Re:Only a minority?

[Anonymous Coward]

And yet with the proper processing, either drum can be turned into clean, safe drinking water. That's why to some extent, none of this matters. You can use all the compromised leaky back-doored broken products that you want (this is what you're doing anyway, every time you communicate over the Internet, where your packets are routed through other peoples' systems), provided that all the data that these products ever see, is your cyphertext.

That's hard to do with a phone (you're not going to "tunnel through" the microphone and speaker) but nevertheless in a lot of cases, it's pretty easy.

Someone says you have to use their VPN? Fine. Your VPN software ought to be able to tunnel through their VPN just fine.

Government forces you to use encryption software that also encrypts the session key with their public key? No problem. Let them decrypt that data, revealing the cyphertext that you previously encrypted before exposing it to their ridiculous pre-broken system.

GooMicrapple's DropPlan backup system is just fine for backing up your already-GPG-encrypted files, as long as you have a convenient way to run their shitty proprietary backup client since they don't use standard protocols? Oh, it's not convenient? Well, pretend it were convenient: of course you could use it. You just wouldn't trust it.

When it comes down to how you decide what to trust, nothing is changing at all. You-twenty-years-ago would advise 2016-you: if you built it and understand it, you can probably trust it. If someone unaccountable provided it for you, then obviously you don't trust it. You can still use it, though.

Re:How is this a story exactly?

[Anonymous Coward]

Who here is shocked that a government agency whose job it is to FUCKING BREAK CRYPTOGRAPHY would target products that people actually use for cryptography?

Obviously, nobody is "shocked" or is even claiming that someone else is stupid enought to be shocked. The emotion is anger, not shock.

Why? Because actually the NSA's job is to protect US security, whereby breaking crypto is only one possible strategy for accomplishing that goal. A rational actor running the NSA might decide that it would be directly contrary to their mission to undermine the encryption used by the US, and also contrary to their mission to undermine the sale of US products.

For whatever reason, that's not what they decided, so now we have a less secure country than if the NSA had done nothing.

Either someone made a dumb decision (d'oh!), or someone within the NSA decided to do the opposite of their job (in exchange for whatever from whomever). Either way, that's something to be legitimately angry about. We all realize that even the cleverest mathematicians can have stunning-stupid PHBs telling them to do stupid things, but we all tend to hope for better. (Nothing wrong with trying to set the bar high, is there?) And one of the neat things about America is that above the PHBs there's an elected president. And now we're seeing that even as late as 2010 the guy on top wasn't firing people left and right for incompetence and betrayal, so we have yet again, another president in a long uninterrupted series of presidents making the wrong call.

It's like we really are too stupid to elect someone to end the stupidity. Worse, at this point it looks like pretty much no matter how things go, in Jan 2017 we are going to get an even worse president than the last two. That's no matter whether you think the country is going to vote R or D. (Hillary Trump will have us longing for a return of Barrack Bush.) So that means the NSA is going to be working against the interests of America's security through at least 2020 (and We The People will be funding them, with taxes and externalities). With friends like these, we don't need enemies. Leave it to us, IIS and Al Queda: just sit back and relax.

And yes, telling people about evidence of what they had already suspected, is news. Unless you're going to tell me that when aliens are (or aren't) found, viable fusion power is (or isn't) invented, and next year's CPUs are a few percent faster, those things also won't be news. (But you're not really going to claim you're that stupid, are you?)

Re:Good on them

[plague911]

"Spying is not about having backdoors in hardware you produce in your own country. It's about getting those into foreign countries, foreign hardware, and about defeating encryptions that you're NOT already in control of." And you think they are not doing that as well? lol. They are doing their job and hitting every nail. Even the American made ones.

Re:Good on them

[CAIMLAS]

Nonsense. The US government hasn't been about protecting US citizen interests for some time. The "economy" of the US government itself is bigger than that of most world countries, after all. They only care in so far as we are able to perpetuate them.

Re:These forums were getting much too boring this

[avandesande]

We are also due for SJW post.

Re:Good on them

[AmiMoJo]

Remember those photos of NSA agents intercepting Cisco hardware during shipping and installing backdoors? It's not just anything built in America, it's anything exported from there too.

Best not to buy stuff online really, get it in person and pay cash.