Slashdot Mirror
John McAfee: NSA's Back Door Has Given Every US Secret To Enemies (businessinsider.com)
John McAfee, American computer programmer and contributing editor of Business Insider, explains how the NSA's back door has given every U.S. secret to its enemies. He begins by mentioning the importance of software, specifically meta- software, which contains a high level set of principles designed to help a nation survive in a cyberwar. Such software must not contain any back doors under any circumstances, otherwise it can and may very likely allow perceived enemies of the U.S. to have access to top-secret information. For example, the Chinese used the NSA's back door to hack the Defense Department last year and steal 5.6 million fingerprints of critical personnel. "Whatever gains the NSA has made through the use of their back door, it cannot possibly counterbalance the harm done to our nation by everyone else's use of that same back door." McAfee believes the U.S. has failed to grasp the subtle implications of technology and, as a result, is 20 years behind the Chinese, and by association, the Russians as well.
You are mad. Perhaps even more crazy is the fact that you speak the truth.
When the foot seeks the place of the head, the line is crossed. Know your place. Keep your place. Be a shoe.
Isn't this the guy wanted in connection with the mysterious disappearance of a former neighbor? I'm not sure I'd take anything at face value from Mr. Stability.
If he's talking about the Chinese, they don't need an NSA back door to hack systems in the U.S., they've been porking government and contractor systems for years. The Chinese have the designs for every nuclear weapon in our arsenal and the personnel records of hundreds of thousands of government workers, including their security clearance applications. What would they get from an NSA back door that they don't already have?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
I thought he sided with the FBI against Apple. He thinks Apple should include a backdoor in their phones for the FBI...and now he's pointing out how dangereous backdoors are....
No, he didn't side with anyone. He offered to decrypt the phone. That's not what the FBI wants. The FBI wants Apple to produce vulnerable code. John didn't offer to produce vulnerable code. By making his offer, McAfee was illustrating that the FBI isn't after the decrypted data.
"Oh no... he found the
He did no such thing. That article you wrongully remember was him blasting the US government and comparing them to the Nazis.
In the 70s there were secure operating systems like Multics. Then the only things allowed for US export were the ones that failed to be secure. That's how we got DOS then Windows. Now everything needs to be rewritten from scratch by people without commercial pressure for there to be any chance. Think about the nave ending up forced to use "Windows for warships". In the meantime the Chinese always knew they couldn't trust software from the West. 20 year head start is probably an underestimate.
From TFA:
The British spy agency GCHQ, with the knowledge and apparent cooperation of the NSA, acquired the capability to covertly exploit security vulnerabilities in 13 different models of firewalls made by Juniper Networks.
I hope we all understand now what “acquired the capability” means. The NSA planted a programmer within Jupiter Networks. The was no other way to “acquire" this capability.
Except that he just referenced a claim that the British acquired the capability by being told about the backdoor, and he then goes on to say that the Chinese acquired the same capability by discovering the backdoor through reverse-engineering. So there is another way after all.
Which raises the following possibilities, each just as plausible as "The NSA planted a programmer":
1. The Chinese planted a programmer, and the NSA or GCHQ discovered it via reverse-engineering and shared it with the other.
2. The Chinese planted a programmer, and the NSA discovered it during review of source-code shared as a condition of purchasing for sensitive government use.
3. A programmer was paid to create the backdoor by a non-governmental entity interested in corporate espionage, and all the state actors discovered it via reverse-engineering.
4. The backdoor was created unintentionally (e.g. failure to remove white-box test code before going to production), and all the actors discovered it via reverse-engineering and/or source review.
Basically, John presents no evidence whatsoever for his claim that the NSA caused the backdoor.
Ultimately, I do agree with his point he does make is that code inspections can catch and close both intentional and unintentional backdoors. But the rest of the article is FUD.
He may not have explicitly sided with Apple, but his remarks in this article were clearly not on the side of the FBI.
...then eats the crayon.
... then eats the napkins.
Socialism: a lie told by totalitarians and believed by fools.
..and what's wrong with McAfee showing that the FBI was interested in a little bit MORE than just a decrypted phone?
He offered them what they SAID they wanted by a different path. So the FBI was lying because what they REALLY wanted wouldn't sit well with the public. So THANK YOU McAfee for actually looking out for the people.
I'd have to agree based on many historic examples.
The current issue with Apple is my favorite example at the time. There's no way of knowing whether Apple has already given some agencies backdoors or not; if they have, pretending to "fight" with the agencies on a backdoor gives consumers and shareholders the illusion that's more desirable.
And also, let's take into consideration that Apple is well-known for abusing the leverage of "planned obsolescence". Their devices are apt to be updated with a completely necessary platform revision that renders old-enough models absolutely incapable of maintaining any decent level of performance.
Given that Apple is a known abuser of planned obsolescence, let's think about the current stand-off in similar terms:
* Apple could, after much "fighting" for the audience of consumers and shareholders, be "forced" to give-in to the agencies' demands and produce a backdoor.
* But Apple is smart, and courageous. So they promise consumers and shareholders that the currently release backdoor is only going to be useful on all previous and existing models of Apple devices; the next iteration of Apple devices will utilize a different standard, function, or giant integer that renders the backdoor moot.
* Voila: every person who owns every past model of Apple devices will gladly get rid of their old "junk" and get the brand-newest Apple device. If they don't do so gladly, maybe it's because standards of practice at their workplace simply force them to do so in order to maintain corporate integrity.
McAfee has sided with Apple a bit too strongly and a bit too readily at the present time, for my tastes. And that taste is one that prefers my computer gurus and infosec wizards to be consistent, unwavering and to never miss a single detail.
Now, McAfee's a busy guy. Maybe he hasn't had the time to consider that Apple could be co-conspiring with the FBI and so on.
"Stratigraphically the origin of agriculture and thermonuclear destruction will appear essentially simultaneous" -- Lee
From John McAfee - I have considered that. But isn't it more convenient to assume, at the start, that individual people are mostly honest, than mostly dishonest?
I have the most to lose - already being investigated by the FBI for a multitude of imagined offenses (multiple murders, drug manufacturer, treason and a host of others). I am, at least, standing up - risking all - and calling the FBI deceptive, dishonest, self serving and anti-society.
The US government is, without any doubt, my enemy. At least with Apple there is the possibility that they are not my enemy.
Wow..
If it is known that I can defeat security measure X for Y reasons, then I can defeat security measure X for any reasons. Yes, the FBI specifically asked Apple to write code to defeat it's own security measure. If it happens, the FBI does not need to have access to the code, just access to Apple which is the same in all respects considering the loose requirements for warrants under laws like the patriot act and so on.
Nothing material about what was said is false. Please stop arguing semantics. It is about as bad as Dick Cheney going around saying that no one's civil liberties were violated in the metadata bulk collection spying because they are officially "company records" and not private communications.
With the articles on them? Now there's food for thought.
Ezekiel 23:20
By deploying an entire Internet of cats?
Sent from my ASR33 using ASCII
Hello,
Mr. McAfee has a rich and varied history of stating as fact things which cannot be proven as true or as false, simply because they cannot be verified. It is most certainly not paranoid rantings, nor is it based on any actual information about the current situation. Instead, it is carefully-crafted statements made for one reason and one reason only: To maximize his coverage in the media.
Recent examples of similar behavior include:
Sometimes making comments to the media works to McAfee's advantage, sometimes they don't. But as long as he keeps coming up with new ones, he keeps getting media coverage. This story is just one more example of such continuing behavior.
Regards,
Aryeh Goretsky
Dexter is a good dog.
As an Australian, I feel very uncomfortable about an American coming up my back passage. It makes me feel naked and violated.
Soon trump will try to put a stop to this.
By deploying an entire Internet of cats?
That's what it's for. We have Cat6 cable now after all.
The commercial software industry pretty well started with Gates and others dumpster diving for other people's code and closing off previously freely available software that other people had written. The figures that are not "wild west" were either giving their stuff away with hardware or publishing it freely from academia.
Anyone (else) remember how we used to write programs (for the main frame)? The Chinese didn't invent anything, they simply followed the IBM red book. Although the advent of personal computers has certainly changed everything, the very basis upon which they did that eliminated the very thing being touted. Giving the power to process data (write code) to the end user will of necessity remove any impetus for code review.
There are other issues as well that are engendered in the forces driving software development itself. First and foremost is the inclusion of inexperienced programmers. Ones whose only experience is with writing GUI routines who are then promoted to creating systemic code. The two have completely different security needs. Similarly the move to frameworks such as AGILE where code production is valued over code correctness have led to a plethora of routines which only have positive testing, and no review. Finally the creation of both tertiary languages, ones that have to be translated twice before they arrive at machine code, and the rampant use of tools which eliminate the need to actually write code in lieu of dragging and dropping functional blocks, make code review nearly impossible. You aren't reviewing the code itself but rather larger collections of routines. You'll never find the backdoor because it isn't in the code you are reviewing.
What I'd like to see, and it won't happen, is a return to the bad old days. This is when a program update took between 6 mos and several years due to review and rewrite schedules. You can approach the same endpoint with well constructed negative testing, but I have yet to encounter a software firm which performed exhaustive negative testing. Usually if it is done at all it is simply a session using random data. No stress testing. No deliberate failure induction. No code review.
Why do we want to move all of our things to being internet connected (IoT) when we can't even write a decent firewall.