SUMMARY: On Saturday, programming code for National Security Agency hacking tools was shared online. The content appears to be legitimate, but it is not clear if it was intentionally hacked or accidentally leaked. Hari Sreenivasan speaks with The Washington Post's Ellen Nakashima and Paul Vixie of Farsight Security about where this development fits in the context of other recent cybersecurity breaches.
HARI SREENIVASAN (NewsHour):The National Security Agency's primary mission is to spy on the electronic communications of countries and people overseas.
Over the weekend, though, sophisticated code the NSA developed to penetrate computer security systems was posted online. This serious breach comes amid the ongoing revelations of the hacking of the Democratic National Committee and other organizations, allegedly by groups linked to Russian intelligence.
For more on this, we turn to The Washington Post national security correspondent Ellen Nakashima, and Paul Vixie. He designed and built some of the software that is the backbone of the Internet today. He is now chairman and CEO of Farsight Security, a computer security firm.
Ellen Nakashima, what happened this weekend? What got released?
ELLEN NAKASHIMA, The Washington Post:Over the weekend, apparently on Saturday, mysteriously, a cache of NSA hacking tools was released online through file-sharing sites such as BitTorrent and Dropbox.
It really wasn't noticed until about Monday, when the computer security community started commenting on it and questions arose as to whether or not the NSA had been hacked.
HARI SREENIVASAN: So, Paul Vixie, if these lock picks, these digital tools to try break into different systems out are out in the open now, these are the tools that the American government was using, what is the consequence, if it is in the public sphere?
PAUL VIXIE, Farsight Security:Well, I think, every day, everybody is trying to hack everybody. So, this is not huge news.
What's big news about it is that these tools were built by the U.S. government. Some of the lock picks, as you call them, are now obsolete. They are relying on vulnerabilities that have since been closed, because the files are about 3 years old.
But at least one of them is active against a very current piece of equipment from Cisco. And it is going to lead to a lot of break-ins while the patches are prepared and shipped and then applied.
SUMMARY: Folded into the massive spending and tax cut bill was a significant and controversial new law on cybersecurity. The act encourages private companies to share data about hacks with the government, but it's raising questions among security advocates and privacy groups alike. Jeffrey Brown talks to James Lewis of the Center for Strategic and International Studies and Elissa Shevinsky of JeKuDo.
GWEN IFILL (NewsHour): Before the president and Congress left town for the holidays, they managed to enact a massive 2,000-page package of spending and tax cuts. Typically, these laws draw attention only for the chaos they create, like shutting down the government.
But there’s a lot more deep inside, in this case, a significant and controversial new law governing cyber-security and Internet data. The new law encourages private companies to share data about cyber-hacks with the government. It protects companies from liability, and it also allows data to shared with other companies and with the Department of Homeland Security.
Lawmakers from both parties said it was a good deal.
SEN. DIANNE FEINSTEIN, D-Calif.: If someone sees a particular virus or harmful cyber-signature, they should tell others, so they can protect themselves. That’s what this bill does.
REP. DEVIN NUNES, R-Calif.: We believe that sharing is an area where you really can’t do any harm. It doesn’t hurt anybody to have a way to talk. But, right now, they can’t even talk.
SEN. SUSAN COLLINS, R-Maine:Does it make sense that we require one case of measles to be reported to a federal government agency, but not a cyber-attack?
GWEN IFILL: But there are some security advocates and privacy groups who say the law manages to go too far and not quite far enough.
Jeffrey Brown has that debate.
JEFFREY BROWN (NewsHour): To understand more, we’re joined by James Lewis, senior fellow for the Center for Strategic and International Studies, and Elissa Shevinsky, founder of JeKuDo, a tech start-up designed to provide private communications to customers.
SUMMARY: The U.S. government wants to be able to read certain data that's inaccessible to intelligence agencies due to encryption. At a Senate hearing, FBI director James Comey said the privacy technology can be a double-edged sword, detrimental to public safety. Gwen Ifill speaks to former Homeland Security Department official Stewart Baker and Susan Landau of the Worcester Polytechnic Institute.
GWEN IFILL (NewsHour): Earlier in the day, the Obama administration went to Capitol Hill to make its case to allow government great access to encrypted information. Essentially, the government wants to be able to read certain data that intelligence agencies cannot get now because it’s been protected with special codes. That’s at the heart of an ongoing battle with tech companies.
JAMES COMEY, FBI Director: Encryption is a great thing. It keeps us all safe. It protects innovation.
GWEN IFILL: But, FBI Director James Comey warned at Senate hearings today, it’s also a double-edged sword. That’s because the technologies that seal off smartphones from surveillance also impede efforts to track criminals and terrorists.
JAMES COMEY: We are moving inexorably to a place where all of our lives, all of our papers and effects, all of our communications will be covered by universal strong encryption. And that is a world that in some ways is wonderful and in some ways has serious public safety ramifications.
GWEN IFILL: Google, Apple and other tech firms have ramped up data encryption in the wake of Edward Snowden’s revelations of sweeping government surveillance. They’re also responding to stepped-up hacking coming from Russia and China.
But, at the same time, Islamic State followers and other militants are now using encrypted communications to recruit at a rapid pace. Deputy Attorney General Sally Yates underscored that point today.
SALLY YATES, Deputy Attorney General: ISIL currently communicates on Twitter, sending communications to thousands of would-be followers right here in our country. When someone responds and the conversations begin, they are then directed to encrypted platforms for further communication.
And even with a court order, we can’t see those communications. This is a serious threat. And our inability to access these communications with valid court orders is a real national security problem.
GWEN IFILL: And the FBI’s Comey suggested it’s just a matter of time before that leads to a terror attack.
JAMES COMEY: We are stopping these things so far through tremendous hard work, the use of sources, the use of online undercovers, but it is incredibly difficult. I cannot see me stopping these indefinitely.
I make no guarantee that any advice given on these pages will work as expected. There are just too many variables depending on Operator Systems and hardware configurations to give any advice that will always work.
Where possible, I will provide links to my source.
I have over 30yrs experience in electronics, computers, and software. I have served as an IT Technician. So I have created this blog to pass on my experience on these subjects.
Note that I do not have any Certifications nor degrees. All I know is from hands-on.
My experience in electronics comes from 22yrs in the Navy (retired) in Avionics, including as an instructor.
Note that I monitor the support forums under "Recommended Links."
There is no guarantee that any link provided in this blog will always work, especially for older links. The validity of any link is governed by the source-site policies. Some sites will archive articles and require subscription to access. Very small sites, such as a local town newspaper, may not archive at all.
