HELD FOR RANSOM - Colonial Pipeline and U.S. Infrastructure

"The Colonial Pipeline Ransomware Hackers Had a Secret Weapon: Self-Promoting Cybersecurity Firms" by Renee Dudley and Daniel Golden, ProPublica 5/24/2021

This story was co-published with MIT Technology Review.

On Jan 11, antivirus company Bitdefender said it was “happy to announce” a startling breakthrough.  It had found a flaw in the ransomware that a gang known as DarkSide was using to freeze computer networks of dozens of businesses in the U.S. and Europe.  Companies facing demands from DarkSide could download a free tool from Bitdefender and avoid paying millions of dollars in ransom to the hackers.

But Bitdefender wasn’t the first to identify this flaw.  Two other researchers, Fabian Wosar and Michael Gillespie, had noticed it the month before and had begun discreetly looking for victims to help.  By publicizing its tool, Bitdefender alerted DarkSide to the lapse, which involved reusing the same digital keys to lock and unlock multiple victims.  The next day, DarkSide declared that it had repaired the problem, and that “new companies have nothing to hope for.”

“Special thanks to BitDefender for helping fix our issues,” DarkSide said.  “This will make us even better.”

DarkSide soon proved it wasn’t bluffing, unleashing a string of attacks.  This month, it paralyzed the Colonial Pipeline Co., prompting a shutdown of the 5,500 mile pipeline that carries 45% of the fuel used on the East Coast, quickly followed by a rise in gasoline prices, panic buying of gas across the Southeast and closures of thousands of gas stations.  Absent Bitdefender’s announcement, it’s possible that the crisis might have been contained, and that Colonial might have quietly restored its system with Wosar and Gillespie’s decryption tool.

Instead, Colonial paid DarkSide $4.4 million in Bitcoin for a key to unlock its files.  “I will admit that I wasn’t comfortable seeing money go out the door to people like this,” CEO Joseph Blount told The Wall Street Journal.

The missed opportunity was part of a broader pattern of botched or half-hearted responses to the growing menace of ransomware, which during the pandemic has disabled businesses, schools, hospitals and government agencies across the country.  The incident also shows how antivirus companies eager to make a name for themselves sometimes violate one of the cardinal rules of the cat-and-mouse game of cyber-warfare: Don’t let your opponents know what you’ve figured out.  During World War II, when the British secret service learned from decrypted communications that the Gestapo was planning to abduct and murder a valuable double agent, Johnny Jebsen, his handler wasn’t allowed to warn him for fear of cluing in the enemy that its cipher had been cracked.  Today, ransomware hunters like Wosar and Gillespie try to prolong the attackers’ ignorance, even at the cost of contacting fewer victims.  Sooner or later, as payments drop off, the cybercriminals realize that something has gone wrong.

Whether to tout a decryption tool is a “calculated decision,” said Rob McLeod, senior director of the threat response unit for cybersecurity firm eSentire.  From the marketing perspective, “You are singing that song from the rooftops about how you have come up with a security solution that will decrypt a victim’s data.  And then the security researcher angle says, ‘Don’t disclose any information here.  Keep the ransomware bugs that we’ve found that allow us to decode the data secret, so as not to notify the threat actors.’”

Wosar said that publicly releasing tools, as Bitdefender did, has become riskier as ransoms have soared and the gangs have grown wealthier and more technically adept.  In the early days of ransomware, when hackers froze home computers for a few hundred dollars, they often couldn’t determine how their code was broken unless the flaw was specifically pointed out to them.

Today, the creators of ransomware “have access to reverse engineers and penetration testers who are very very capable,” he said.  “That’s how they gain entrance to these oftentimes highly secured networks in the first place.  They download the decryptor, they disassemble it, they reverse engineer it and they figure out exactly why we were able to decrypt their files.  And 24 hours later, the whole thing is fixed.  Bitdefender should have known better.”

It wasn’t the first time that Bitdefender trumpeted a solution that Wosar or Gillespie had beaten it to.  Gillespie had broken the code of a ransomware strain called GoGoogle and was helping victims without any fanfare, when Bitdefender released a decryption tool in May 2020.  Other companies have also announced breakthroughs publicly, Wosar and Gillespie said.

“People are desperate for a news mention, and big security companies don’t care about victims,” Wosar said.

Bogdan Botezatu, director of threat research at Bucharest, Romania-based Bitdefender, said the company wasn’t aware of the earlier success in unlocking files infected by DarkSide.  Regardless, he said, Bitdefender decided to publish its tool “because most victims who fall for ransomware do not have the right connection with ransomware support groups and won’t know where to ask for help unless they can learn about the existence of tools from media reports or with a simple search.”

Bitdefender has provided free technical support to more than a dozen DarkSide victims, and “we believe many others have successfully used the tool without our intervention,” Botezatu said.  Over the years, Bitdefender has helped individuals and businesses avoid paying more than $100 million in ransom, he said.

Bitdefender recognized that DarkSide might correct the flaw, Botezatu said.  “We are well aware that attackers are agile and adapt to our decryptors.”  But DarkSide might have “spotted the issue” anyway.  “We don’t believe in ransomware decryptors made silently available.  Attackers will learn about their existence by impersonating home users or companies in need, while the vast majority of victims will have no idea that they can get their data back for free.”

The attack on Colonial Pipeline, and the ensuing chaos at the gas pumps throughout the Southeast, appears to have spurred the federal government to be more vigilant.  President Joe Biden issued an executive order to improve cybersecurity and create a blueprint for a federal response to cyberattacks.  DarkSide said it was shutting down under U.S. pressure, although ransomware crews have often disbanded to avoid scrutiny and then re-formed under new names, or their members have launched or joined other groups.

“As sophisticated as they are, these guys will pop up again, and they’ll be that much smarter,” said Aaron Tantleff, a Chicago cybersecurity attorney who has consulted with 10 companies attacked by DarkSide.  “They’ll come back with a vengeance.”

At least until now, private researchers and companies have often been more effective than the government in fighting ransomware.  Last October, Microsoft disrupted the infrastructure of Trickbot, a network of more than 1 million infected computers that disseminated the notorious Ryuk strain of ransomware, by disabling its servers and communications.  That month, ProtonMail, the Swiss-based email service, shut down 20,000 Ryuk-related accounts.

Wosar and Gillespie, who belong to a worldwide volunteer group called the Ransomware Hunting Team, have cracked more than 300 major ransomware strains and variants, saving an estimated 4 million victims from paying billions of dollars.

By contrast, the FBI rarely decrypts ransomware or arrests the attackers, who are typically based in countries like Russia or Iran that lack extradition agreements with the U.S.  DarkSide, for instance, is believed to operate out of Russia.  Far more victims seek help from the Hunting Team, through websites maintained by its members, than from the FBI.

The U.S. Secret Service also investigates ransomware, which falls under its purview of combating financial crimes.  But, especially in election years, it sometimes rotates agents off cyber assignments to carry out its better-known mission of protecting Presidents, Vice Presidents, major party candidates and their families.  European law enforcement, especially the Dutch National Police, has been more successful than the U.S. in arresting attackers and seizing servers.

Similarly, the U.S. government has made only modest headway in pushing private industry, including pipeline companies, to strengthen cybersecurity defenses.  Cybersecurity oversight is divided among an alphabet soup of agencies, hampering coordination.  The Department of Homeland Security conducts “vulnerability assessments” for critical infrastructure, which includes pipelines.

It reviewed Colonial Pipeline in around 2013 as part of a study of places where a cyberattack might cause a catastrophe.  The pipeline was deemed resilient, meaning that it could recover quickly, according to a former DHS official.  The department did not respond to questions about any subsequent reviews.

Five years later, DHS created a pipeline cybersecurity initiative to identify weaknesses in pipeline computer systems and recommend strategies to address them.  Participation is voluntary, and a person familiar with the initiative said that it is more useful for smaller companies with limited in-house IT expertise than for big ones like Colonial.  The National Risk Management Center, which oversees the initiative, also grapples with other thorny issues such as election security.

Ransomware has skyrocketed since 2012, when the advent of Bitcoin made it hard to track or block payments.  The criminals’ tactics have evolved from indiscriminate “spray and pray” campaigns seeking a few hundred dollars apiece to targeting specific businesses, government agencies and nonprofit groups with multimillion-dollar demands.

Attacks on energy businesses in particular have increased during the pandemic — not just in the U.S. but in Canada, Latin America and Europe.  As the companies allowed employees to work from home, they relaxed some security controls, McLeod said.

Since 2019, numerous gangs have ratcheted up pressure with a technique known as “double extortion.”  Upon entering a system, they steal sensitive data before launching ransomware that encodes the files and makes it impossible for hospitals, universities and cities to do their daily work.  If the loss of computer access is not sufficiently intimidating, they threaten to reveal confidential information, often posting samples as leverage.  For instance, when the Washington, D.C., police department didn’t pay the $4 million ransom demanded by a gang called Babuk last month, Babuk published intelligence briefings, names of criminal suspects and witnesses, and personnel files, from medical information to polygraph test results, of officers and job candidates.

DarkSide, which emerged last August, epitomized this new breed.  It chose targets based on a careful financial analysis or information gleaned from corporate emails.  For instance, it attacked one of Tantleff’s clients during a week when the hackers knew the company would be vulnerable because it was transitioning its files to the cloud and didn’t have clean backups.

To infiltrate target networks, the gang used advanced methods such as “zero-day exploits” that immediately take advantage of software vulnerabilities before they can be patched.  Once inside, it moved swiftly, looking not only for sensitive data but also for the victim’s cyber insurance policy, so it could peg its demands to the amount of coverage.  After two to three days of poking around, DarkSide encrypted the files.

“They have a faster attack window,” said Christopher Ballod, associate managing director for cyber risk at Kroll, the business investigations firm, who has advised half a dozen DarkSide victims.  “The longer you dwell in the system, the more likely you are to be caught.”

Typically, DarkSide’s demands were “on the high end of the scale,” $5 million and up, Ballod said.  One scary tactic: If publicly traded companies didn’t pay the ransom, DarkSide threatened to share information stolen from them with short-sellers who would profit if the share price dropped upon publication.

DarkSide’s site on the dark web identified dozens of victims and described the confidential data it claimed to have filched from them.  One was New Orleans law firm Stone Pigman Walther Wittmann.  “A big annoyance is what it was,” attorney Phil Wittmann said, referring to the DarkSide attack in February.  “We paid them nothing,” said Michael Walshe Jr., chair of the firm’s management committee, declining to comment further.

Last November, DarkSide adopted what is known as a “ransomware-as-a-service” model.  Under this model, it partnered with affiliates who launched the attacks.  The affiliates received 75% to 90% of the ransom, with DarkSide keeping the remainder.  As this partnership suggests, the ransomware ecosystem is a distorted mirror of corporate culture, with everything from job interviews to procedures for handling disputes.  After DarkSide shut down, several people who identified themselves as its affiliates complained on a dispute resolution forum that it had stiffed them.  “The target paid, but I did not receive my share,” one wrote.

Together, DarkSide and its affiliates reportedly grossed at least $90 million.  Seven of Tantleff’s clients, including two companies in the energy industry, paid ransoms ranging from $1.25 million to $6 million, reflecting negotiated discounts from initial demands of $7.5 million to $30 million.  His other three clients hit by DarkSide did not pay.  In one of those cases, the hackers demanded $50 million.  Negotiations grew acrimonious, and the two sides couldn’t agree on a price.

DarkSide’s representatives were shrewd bargainers, Tantleff said.  If a victim said it couldn’t afford the ransom because of the pandemic, DarkSide was ready with data showing that the company’s revenue was up, or that COVID-19’s impact was factored into the price.

DarkSide’s grasp of geopolitics was less advanced than its approach to ransomware.  Around the same time that it adopted the affiliate model, it posted that it was planning to safeguard information stolen from victims by storing it in servers in Iran.  DarkSide apparently didn’t realize that an Iranian connection would complicate its collection of ransoms from victims in the U.S., which has economic sanctions restricting financial transactions with Iran.  Although DarkSide later walked back this statement, saying that it had only considered Iran as a possible location, numerous cyber insurers had concerns about covering payments to the group.  Coveware, a Connecticut firm that negotiates with attackers on behalf of victims, stopped dealing with DarkSide.

Ballod said that, with their insurers unwilling to reimburse the ransom, none of his clients paid DarkSide, despite concerns about exposure of their data.  Even if they had caved in to DarkSide, and received assurances from the hackers in return that the data would be shredded, the information might still leak, he said.

During DarkSide’s changeover to the affiliate model, a flaw was introduced into its ransomware.  The vulnerability caught the attention of members of the Ransomware Hunting Team.  Established in 2016, the invitation-only team consists of about a dozen volunteers in the U.S., Spain, Italy, Germany, Hungary and the U.K.  They work in cybersecurity or related fields.  In their spare time, they collaborate in finding and decrypting new ransomware strains.

Several members, including Wosar, have little formal education but an aptitude for coding.  A high school dropout, Wosar grew up in a working-class family near the German port city of Rostock.  In 1992, at the age of 8, he saw a computer for the first time and was entranced.  By 16, he was developing his own antivirus software and making money from it.  Now 37, he has worked for antivirus firm Emsisoft since its inception almost two decades ago and is its chief technology officer.  He moved to the U.K. from Germany in 2018 and lives near London.

He has been battling ransomware hackers since 2012, when he cracked a strain called ACCDFISA, which stood for “Anti Cyber Crime Department of Federal Internet Security Agency.”  This fictional agency was notifying people that child pornography had infected their computers, and so it was blocking access to their files unless they paid $100 to remove the virus.

The ACCDFISA hacker eventually noticed that the strain had been decrypted and released a revised version.  Many of Wosar’s subsequent triumphs were also fleeting.  He and his teammates tried to keep criminals blissfully unaware for as long as possible that their strain was vulnerable.  They left cryptic messages on forums inviting victims to contact them for assistance or sent direct messages to people who posted that they had been attacked.

In the course of protecting against computer intrusions, analysts at antivirus firms sometimes detected ransomware flaws and built decryption tools, though it wasn’t their main focus.  Sometimes they collided with Wosar.

In 2014, Wosar discovered that a ransomware strain called CryptoDefense copied and pasted from Microsoft Windows some of the code it used to lock and unlock files, not realizing that the same code was preserved in a folder on the victim’s own computer.  It was missing the signal, or “flag,” in their program, usually included by ransomware creators to instruct Windows not to save a copy of the key.

Wosar quickly developed a decryption tool to retrieve the key.  “We faced an interesting conundrum,” Sarah White, another Hunting Team member, wrote on Emsisoft’s blog.  “How to get our tool out to the most victims possible without alerting the malware developer of his mistake?”

Wosar discreetly sought out CryptoDefense victims through support forums, volunteer networks and announcements of where to contact for help.  He avoided describing how the tool worked or the blunder it exploited.  When victims came forward, he supplied the fix, scrubbing the ransomware from at least 350 computers.  CryptoDefense eventually “caught on to us ... but he still did not have access to the decrypter we used and had no idea how we were unlocking his victims’ files,” White wrote.

But then an antivirus company, Symantec, uncovered the same problem and bragged about the discovery on a blog post that “contained enough information to help the CryptoDefense developer find and correct the flaw,” White wrote.  Within 24 hours the attackers began spreading a revised version.  They changed its name to CryptoWall and made $325 million.

Symantec “chose quick publicity over helping CryptoDefense victims recover their files,” White wrote.  “Sometimes there are things that are better left unsaid.”

A spokeswoman for Broadcom, which acquired Symantec’s enterprise security business in 2019, declined to comment, saying that “the team members who worked on the tool are no longer with the company.”

Like Wosar, the 29-year-old Gillespie comes from poverty and never went to college.  When he was growing up in central Illinois, his family struggled so much financially that they sometimes had to move in with friends or relatives.  After high school, he worked full time for 10 years at a computer repair chain called Nerds on Call.  Last year, he became a malware and cybersecurity researcher at Coveware.

Last December, he messaged Wosar for help.  Gillespie had been working with a DarkSide victim who had paid a ransom and received a tool to recover the data.  But DarkSide’s decryptor had a reputation for being slow, and the victim hoped that Gillespie could speed up the process.

Gillespie analyzed the software, which contained a key to release the files.  He wanted to extract the key, but because it was stored in an unusually complex way, he couldn’t.  He turned to Wosar, who was able to isolate it.

The teammates then began testing the key on other files infected by DarkSide.  Gillespie checked files uploaded by victims to the website he operates, ID Ransomware, while Wosar used VirusTotal, an online database of suspected malware.

That night, they shared a discovery.

“I have confirmation DarkSide is re-using their RSA keys,” Gillespie wrote to the Hunting Team on its Slack channel.  A type of cryptography, RSA generates two keys: a public key to encode data and a private key to decipher it.  RSA is used legitimately to safeguard many aspects of e-commerce, such as protecting credit numbers.  But it’s also been co-opted by ransomware hackers.

“I noticed the same as I was able to decrypt newly encrypted files using their decrypter,” Wosar replied less than an hour later, at 2:45 a.m. London time.

Their analysis showed that, before adopting the affiliate model, DarkSide had used a different public and private key for each victim.  Wosar suspected that, during this transition, DarkSide introduced a mistake into its affiliate portal used to generate the ransomware for each target.  Wosar and Gillespie could now use the key that Wosar had extracted to retrieve files from Windows machines seized by DarkSide.  The cryptographic blunder didn’t affect Linux operating systems.

“We were scratching our heads,” Wosar said.  “Could they really have fucked up this badly? DarkSide was one of the more professional ransomware-as-a-service schemes out there.  For them to make such a huge mistake is very, very rare.”

The Hunting Team celebrated quietly, without seeking publicity.  White, who is a computer science student at Royal Holloway, part of the University of London, began looking for DarkSide victims.  She contacted firms that handle digital forensics and incident response.

“We told them, ‘Hey listen, if you have any DarkSide victims, tell them to reach out to us, we can help them.  We can recover their files and they don’t have to pay a huge ransom,’” Wosar said.

The DarkSide hackers mostly took the Christmas season off.  Gillespie and Wosar expected that, when the attacks resumed in the new year, their discovery would help dozens of victims.  But then Bitdefender published its post, under the headline “Darkside Ransomware Decryption Tool.”

In a messaging channel with the ransomware response community, someone asked why Bitdefender would tip off the hackers.  “Publicity,” White responded.  “Looks good.  I can guarantee they’ll fix it much faster now though.”

She was right.  The next day, DarkSide acknowledged the error that Wosar and Gillespie had found before Bitdefender.  “Due to the problem with key generation, some companies have the same keys,” the hackers wrote, adding that up to 40% of keys were affected.

DarkSide mocked Bitdefender for releasing the decryptor at “the wrong time…., as the activity of us and our partners during the New Year holidays is the lowest.”

Adding to the team’s frustrations, Wosar discovered that the Bitdefender tool had its own drawbacks.  Using the company’s decryptor, he tried to unlock samples infected by DarkSide and found that they were damaged in the process.  “They actually implemented the decryption wrong,” Wosar said.  “That means if victims did use the Bitdefender tool, there’s a good chance that they damaged the data.”

Asked about Wosar’s criticism, Botezatu said that data recovery is difficult, and that Bitdefender has “taken all precautions to make sure that we’re not compromising user data” including exhaustive testing and “code that evaluates whether the resulting decrypted file is valid.”

Even without Bitdefender, DarkSide might have soon realized its mistake anyway, Wosar and Gillespie said.  For example, as they sifted through compromised networks, the hackers might have come across emails in which victims helped by the Hunting Team discussed the flaw.

“They might figure it out that way — that is always a possibility,” Wosar said.  “But it’s especially painful if a vulnerability is being burned through something stupid like this.”

The incident led the Hunting Team to coin a term for the premature exposure of a weakness in a ransomware strain.  “Internally, we often joke, ‘Yeah, they are probably going to pull a Bitdefender,’” Wosar said.

CYBERSECURITY - Offense & Defense

"Playing offense and defense in the face of cybersecurity threats" PBS NewsHour 8/22/2018

Excerpt

SUMMARY:  In the past 48 hours, findings have been released regarding attempts by hackers to influence the midterm elections.  Now, the Democratic National Committee has reportedly asked the FBI to investigate an attempt to infiltrate its voter database.  Nick Schifrin joins Amna Nawaz to discuss what groups might be responsible for hacking and what preventive measures are being deployed.

BACKDOORS - From Cisco

"Cisco Finds Backdoor Installed on 12 Million PCs" by Eduard Kovacs, Computer Help Forums 4/28/2016

UPDATED:  Cisco’s Talos security intelligence and research group has come across a piece of software that installed backdoors on 12 million computers around the world.

The software, which exhibits adware and spyware capabilities, was developed by a French online advertising company called Tuto4PC.  The firm, previously known as Eorezo Group and apparently linked to another company called Wizzlabs, has been targeted by French authorities over its questionable practices regarding the installation of unwanted software and harvesting of users’ personal details.

Cisco started analyzing Tuto4PC’s OneSoftPerDay application after its systems detected an increase in “Generic Trojans” (i.e. threats not associate with any known family).  An investigation uncovered roughly 7,000 unique samples with names containing the string “Wizz,” including “Wizzupdater.exe,” “Wizzremote.exe” and “WizzInstaller.exe.” The string also showed up in some of the domains the samples had been communicating with.

Researchers determined that the application, installed with administrator rights, was capable not only of downloading and installing other software, such as a known scareware called System Healer, but also of harvesting personal information.  Furthermore, experts found that the software is designed to detect the presence of sandboxes, antiviruses, security tools, forensic software and remote access doors.

These “features” have led Cisco Talos to classify the Tuto4PC software as a “full backdoor capable of a multitude of undesirable functions on the victim machine.”

According to Tuto4PC’s website, the company offers hundreds of tutorials that users can access for free by installing a piece of software that displays ads.  However, based on Cisco’s research, it appears the company is doing more than just displaying ads.

Tuto4PC said its network consisted of nearly 12 million PCs in 2014, which could explain why Cisco’s systems detected the backdoor on 12 million devices.  An analysis of a sample set revealed infections in the United States, Australia, Japan, Spain, the UK, France and New Zealand.

“Based on the overall research, we feel that there is an obvious case for this software to be classified as a backdoor.  At minimum it is a potentially unwanted program (PUP).  There is a very good argument that it meets and exceeds the definition of a backdoor,” Cisco Talos researchers said in a blog post.

“The creation of a legitimate business, multiple subsidiaries, domains, software and being a publicly listed company do not stop this adware juggernaut from slowing down their attempts to push their backdoors out to the public,” they added.

In response to Cisco’s blog post, Tuto4PC Group CEO Franck Rosset clarified that its antivirus bypass technology is not used for malicious purposes — he says it’s designed to make it easier for users to install its applications, which have been blocked by antiviruses.  The company has provided the following statement to SecurityWeek:

• “The Talos blogpost is inaccurate in describing Tuto4PC as a shady malware distribution enterprise.  We are currently working with our lawyers in order to evaluate the action we can take against Talos’ inexact (negative) presentation of our business.

• We are a listed company on the French stock exchange.  Since 2004, our business model is to create widgets, tutorials etc, for free download on download websites.  The download of our programs is for free subject to agreement for accepting advertising from an adware attached in the download.

• Contrary to Talos’ wrongful allegations, our business has been approved by French regulators and we have never been indicted or sued for any malware distribution!!!!

• We have a technology subsidiary (Cloud 4PC) with some developments in cybersecurity.  Due to some undue blocking by antiviruses that recently blocked Tuto4PC adware (some of them have also an adware business model), we are using a bypass technology so that people can easily download our programs (and adware).  Although the bypass software is extremely efficient, it has no other purpose or use that helping the Tuto4PC adware download.

• There is no malware activity and Talos cannot prove or show any malware use of the program — with more than 10 million installed, if there was to be any malware activity, obviously there should be some user complaints.

• As you can see, we are a French company — very easy to reach, we are not hiding in some rogue country — we do not understand why Talos has not contacted us prior to their post.

• In any case, our subsidiary Cloud 4PC is going to launch soon “AV Booster,” an antivirus booster that will help stop any real malware that use bypass techniques like the ones we developed."

CYBER SURVEILLANCE - Inside Britain

"Inside the British government’s sweeping cyber surveillance program" PBS NewsHour 9/26/2015

Excerpt

SUMMARY:  For years, the British government has reportedly tracked and stored billions of records of Internet use by British citizens and those outside the UK in an effort to track every visible user on the Internet.  Ryan Gallagher of "The Intercept" joins Hari Sreenivasan via Skype from Brighton, England, with more on UK cyber surveillance.

HARI SREENIVASAN (NewsHour):  For years, the British government has reportedly tracked and stored billions of records of Internet use by British citizens and people outside the U.K., in an effort to track every visible user on the internet.  That finding comes from “The Intercept” Web site, which is publishing findings from National Security Agency contractor (traitor) Edward Snowden’s leak on government surveillance practices.

“Intercept” reporter Ryan Gallagher wrote the story and joins me now via Skype from Brighton, England.

First of all, explain the scale of surveillance that was happening from the British equivalent of the NSA, the GCHQ.

RYAN GALLAGHER, THE INTERCEPT:  Well, the skill is quite phenomenal.  I mean, it’s hard to translate it when you just see the numbers.  But you’re talking about 50 (ph) to 100 billion metadata records of phone calls and e-mails every single day.  So vast, vast quantities of information they’re sweeping up.  And they were talking by 2030 having in place the world’s largest surveillance system, so, a system that surpasses even what the NSA and U.S. has built itself.

HARI SREENIVASAN:  OK, when somebody hears that there’s millions and billions and possibly trillions of pieces of data, they’re going to say, you know, what, how do you actually identify this is specifically me that’s doing this, or going to the site, or saying this thing in a chat room?

RYAN GALLAGHER:  Uh-huh. Well, I mean, we have — we don’t actually — one of the interesting parts of the story is that we had a bunch of specific cases where, for example, we had monitored something like 200,000 people from something like 185 different countries, so almost every country in the world, they have listened to radio source (ph) through their computer.  In one case, they decided to pick out just one of these people.  It seems like at random, and what web site he had been viewing.

So, it’s kind of an all-seeing system.  When you’re gathering that amount of information, it’s going to be something that does have an impact and effect in all of us really.

SECURITY - Software Code Cribbing

"Programmers are copying security flaws into your software, researchers warn" by Laura Hautala, CNet 6/23/2015

Many software developers are cribbing code, and its flaws, that someone else created. And the problem is only getting harder to keep up with.

It's easy to assume that hackers work way above our pay grade.  Electronic intruders must be able to exploit vulnerabilities in the software we use because they're evil geniuses, right?

That may be the case in some very sophisticated attacks, experts say, but in others, not so much.  Programmers -- the people who create the software -- don't write all their code from scratch, instead borrowing freely from others' work.  The problem: they're not vetting the code for security problems.

Working more as code assemblers than as writers, programmers are sourcing about 80 percent to 90 percent of the code in any given software application from third parties, many experts estimate.  Sometimes programmers buy code from other companies, and sometimes they use open-source code that's free for anyone to use.

The problem affects all software, which means everything from the mobile apps on your smartphone to your favorite website to the programs you run on your computer.  Everything except for the operating system on a device or computer is likely composed of building blocks of code rather than created wholly new, said Chris Wysopal, co-founder and executive at software security company Veracode.

The priority for all those highly paid programmers is speed, not security, Wysopal said.  His company, which assesses software for businesses, released a report Tuesday analyzing its own clients' habits when it comes to software use.

Veracode found 6.9 million flaws in more than 200,000 inspections of code used by its clients over the last year.  Those clients fixed 4.7 million of the flaws.  While in-house programmers likely wrote some of that code, industry numbers suggest the vast majority of it came from elsewhere.

"That's the trend -- to reuse as much code as possible," Wysopal said.  It speeds up production time and lets software programmers work on solving new problems instead of reinventing the wheel.

"Everything is good about that except for the inheriting-vulnerabilities part," Wysopal said.

Feds and flaws

Lowest ranking among the industries Veracode checked for security flaws was the federal government.  "Part of the reason for this is that the government still uses older programming languages," Veracode researchers wrote in the report.

That might not come as a surprise to those following news of multiple breaches of federal government workers' personal records, which compromised the Social Security numbers of millions of current and former federal workers and revealed sensitive personal information on everyone who has applied for a security clearance.

The problem of flawed source code is bad enough that Veracode has made a business out of checking software components for problems, and other companies are similarly offering to vet software components for those speed-hungry programmers.

One of those companies is Sonatype, and its chief technology Joshua Corman says he's on the side of the programmers hitting Ctrl-V, the keyboard shortcut for "paste."

Are programmers lazy?  No, Corman says, just efficient.

"The best way to put this is the time value of money," he said.  "You want to spend your unique talent pool on different problems."

Some companies are using services like Sonatype and Veracode, and some are hiring security "fellows" whose paychecks are dependent on finding security flaws in code.

Corman's company provides a repository of open-source code, but it also focuses on finding and eliminating problems in the code.  In fact, Corman went so far as to check out a major government project for flaws to see if it was vulnerable to hackers.

That project was Healthcare.gov, the website rolled out by the Obama administration to get people signed up for the health insurance mandated by the Affordable Care Act.

The website was notoriously buggy when it first went live, and Corman decided to look at the building blocks used by the government contractors who built it to see if hackers might have an avenue into it.

He looked at the third-party code accessed by the developers and concluded it contained some vulnerabilities.  But he wasn't sure if those flaws made it into the website's final code.  Nonetheless, this news alarmed lawmakers, Corman said.

Eventually, those lawmakers learned that federal law doesn't explicitly require software programmers contracted by the government to vet code they didn't write themselves.  A proposed fix to the problem-- a bill called H.R. 5793 -- would have required software developers to give the government a list of third-party code, assurance that all the code was free of known flaws, and a guarantee to fix any vulnerabilities that come up later.

Rep. Edward Royce (R-Calif.) introduced the bill in December at the end of the congressional session.  The bill never made it to a vote, and Corman said he thinks it might be better suited for an executive order.

Other industries have problems with faulty source code, too, according to Veracode's research.  Retail and hospitality companies that use Veracode to vet their software had a poor track record with their efforts to encrypt data, for example.  Again, this isn't surprising news given the breach of customer information at major retailers like revealed by Target and the Home Depot over the past year.

The pace of software development is only speeding up, meaning the problem is harder to keep up with, Wysopal said.

"New languages and new environments to write code in are continuously being invented, and companies want to push software out the door as quickly as possible," he said.  But speed doesn't have to sacrifice security, he argued.

"They don't need to be mutually exclusive.  If you build security processes in or if you require vendors to build it in, you can still go fast," Wysopal said.  But, he noted, "It can't be an afterthought."

CYBER WARS - China vs U.S.

"With a series of major hacks, China builds a database on Americans" by Ellen Nakashima, Washington Post 6/5/2015

China is building massive databases of Americans’ personal information by hacking government agencies and U.S. health-care companies, using a high-tech tactic to achieve an age-old goal of espionage:  recruiting spies or gaining more information on an adversary, U.S. officials and analysts say.

Groups of hackers working for the Chinese government have compromised the networks of the Office of Personnel Management, which holds data on millions of current and former federal employees, as well as the health insurance giant Anthem, among other targets, the officials and researchers said.

“They’re definitely going after quite a bit of personnel information,” said Rich Barger, chief intelligence officer of ThreatConnect, a Northern Virginia cybersecurity firm.  “We suspect they’re using it to understand more about who to target [for espionage], whether electronically or via human ­recruitment.”

The targeting of large-scale data­bases is a relatively new tactic and is used by the Chinese government to further its ­intelligence-gathering, the officials and analysts say.  It is government espionage, not commercial espionage, they say.

“This is part of their strategic goal — to increase their intelligence collection via big-data theft and big-data aggregation,” said a U.S. government official who, like others, spoke on the condition of anonymity to discuss a sensitive topic.  “It’s part of a strategic plan.”

One hack of OPM, which was disclosed by the government Thursday, dates at least to December, officials said.  Earlier last year, OPM discovered a separate intrusion into a highly sensitive database that contains information on employees seeking or renewing security clearances and on their background investigations.

Once harvested, the data can be used to glean details about key government personnel and potential spy recruits, or to gain information useful for counter­intelligence.  Records in OPM’s database of background investigations, for instance, could contain a complete history of where an individual has lived and all of his or her foreign contacts in, say, China.  “So now the Chinese counterintelligence authorities know which American officials are meeting with which Chinese,” a China cyber and intelligence expert said.

The data could help Chinese analysts do more effective targeting of individuals, said a former National Security Agency official.  “They can find specific individuals they want to go after, family members,” he said.

The trend has emerged and accelerated over the past 12 to 18 months, the official said.  An increase in Chinese capability has opened the way “for bigger data storage, for bigger data theft,” he said.  “And when you can gain it in bulk, you take it in bulk.”

The Chinese government, he said, is making use of Chinese companies that specialize in aggregating large sets of data “to help them in sifting through” the information for useful details.  “The analogy would be one of our intelligence organizations using Google, Yahoo, Accenture to aggregate data that we collected.”

China on Friday dismissed the allegation of hacking as “irresponsible and unscientific.”

Chinese Foreign Ministry spokesman Hong Lei said Beijing wanted to cooperate with other nations to build a peaceful and secure cyberspace.

“We wish the United States would not be full of suspicions, catching wind and shadows, but rather have a larger measure of trust and cooperation,” he told a regular news briefing,

OPM disclosed that the latest hack of one of its systems exposed personal data of up to 4 million current and former employees — the largest hack of federal employee data in recent years.

It is possible that officials as senior as Cabinet secretaries had their data exposed, a congressional aide said on a briefing call with government officials Friday.

U.S. officials privately said China was behind it.  The stolen information included Social Security numbers and performance evaluations.

“This is an intelligence operation designed to help the Chinese government,” the China expert said.  “It’s a new phase in an evolution of what they’re doing.  It certainly requires greater sophistication on their part in terms of being able to take out this much data.”

Barger’s firm has turned up technical evidence that the same Chinese group is behind the hacks of Premera Blue Cross and Empire BlueCross, which were discovered at roughly the same time earlier this year.

The first OPM incident has been linked to the health-care hacks by Barger and another security researcher, John Hultquist, senior manager for cyberespionage threat intelligence at iSight Partners.  Hultquist said the same group is responsible for all of them, and for other intrusions into commercial databases containing large sets of Americans’ personal information.

“They would leverage this data to get to diplomatic, political, military and economic intelligence that they typically target,” said Hultquist, who declined to comment on who was behind the attacks.

Though much Chinese cyber­espionage is attributed to the People’s Liberation Army, these hacks, Barger said, appeared to be linked to the Ministry of State Security, which is a spy agency responsible for foreign espionage and domestic counterintelligence.

Other Chinese entities, including the military, may also be involved in the campaign, analysts said.

Chinese government hackers “are like a vacuum cleaner” in sucking up information electronically, said Robert “Bear” Bryant, a former top counterespionage official in the government.  “They’re becoming much more sophisticated in tying it all together.  And they’re trying to harm us.”

Security researchers have pointed to a cyber tool or family of malicious software called Derusbi that has been linked exclusively to Chinese actors.  One group that has used Derusbi is Deep Panda, a name coined by the firm CrowdStrike, which has linked that group to the Anthem hack.

Disclosed in February, that incident exposed the Social Security numbers, addresses, phone numbers, e-mail addresses and member IDs of tens of millions of customers.  No medical data such as diagnosis or treatment information was compromised, the company said.

Researchers note that in contrast to the hacks of Home Depot and Target, personal data that might have been stolen from OPM, Anthem and the other companies has not shown up on the black market, where it can be sold to identity thieves.  That is another sign, they said, that the intrusions are not being made for commercial purposes.

“Usually if there’s a criminally or financially motivated breach like that, we see the data making its way into the black market soon after that,” Barger said.

The big-data approach being taken by the Chinese might seem to mirror techniques used abroad by the NSA, which has come under scrutiny for its data-gathering practices under executive authority.  But in China, the authorities do not tolerate public debate over the proper limits of large-scale spying in the digital age.

“This is what all intelligence services do if they’re good,” said the China cyber expert.  “If you want to find a needle, first you have to gather a haystack of needles.”

The massive data harvesting “reflects a maturity in Chinese” electronic intelligence gathering, the expert said.  “You have to put in place structured data repositories.  You have to have big-data management tools to be able to store and sift and analyze.”

Barger said that “with a large pool of data, they can prioritize who is the best to target electronically and who is the best to target via human recruitment.”

The U.S. official noted that the Chinese “would not take [the data] if they did not have the opportunity to aggregate it.”  And, he added, “they are taking it.”

How the Internet became so vulnerable

SCIENTIFIC AMERICAN - Fear of Cyberattacks Should Not Lead Us to Destroy What Makes the Internet Special

"Freedom and Anonymity" by Jonathan Zittrain, Scientific American 2011

It’s starting to get weird out there.  When WikiLeaks released classified U.S. government documents in December, it sparked several rounds of online conflict.  WikiLeaks became the target of denial-of-service attacks and lost the support of its hosting and payment providers, which inspired sympathizers to counterattack, briefly bringing down the sites of MasterCard and a few other companies.  Sites related to the hackers were then attacked, and mirror sites sprang up claiming to host copies of the WikiLeaks documents—although some were said to carry viruses ready to take over the machines of those who downloaded the copies, for who knows what end.  Months before, an FBI official said disruption of the Internet was the greatest active risk to the U.S. “other than a weapon of mass destruction or a bomb in one of our major cities.”

Attacks on Internet sites and infrastructure, and the compromise of secure information, pose a particularly tricky problem because it is usually impossible to trace an attack back to its instigator.  This “attribution problem” is so troublesome that some law-enforcement experts have called for a wholesale reworking of Internet architecture and protocols, such that every packet of data is engraved with the identity of its source.  The idea is to make punishment, and therefore deterrence, possible.  Unfortunately, such a reworking would also threaten what makes the Internet special, both technologically and socially.

The Internet works thanks to loose but trusted connections among its many constituent parts, with easy entry and exit for new Internet service providers or new forms of expanding access.  That is not the case with, say, mobile phones, in which the telecom operator can tell which phone placed what call and to whom the phone is registered.  Establishing this level of identity on the Internet is no small task, as we have seen with authoritarian regimes that have sought to limit anonymity.  It would involve eliminating free and open WiFi access points and other ways of sharing connections.  Terminals in libraries and cybercafes would have to have verified sign-in rosters.  Or worse, Internet access would have to be predicated on providing a special ID akin to a government-issued driver’s license—perhaps in the form of a USB key.  No key, no bits.  To be sure, this step would not stop criminals and states wanting to act covertly but would force them to invest much more to achieve the anonymity that comes so naturally today.

The price to the rest of us would also be high.  The Internet’s distinct configuration may have made cyberattacks easy to launch, but it has also kindled the flame of freedom.  One repressive state after another has been caught between the promise of economic advancement through abundant Internet access and the fear of empowering its citizens to express themselves freely.  An Internet without the attribution problem would introduce a new issue: citizens could be readily identified and punished for their political activities.

We need better options for securing the Internet. Instead of looking primarily for top-down government intervention, we can enlist the operators and users themselves.  For example, Web site operators could opt into a system of “mirror as you link.”  Whenever their servers render a page, they cache the contents of the link.  Then, when someone tries to get to the site and can’t, he or she can go back to the original linking site and digitally say, “I can’t get that link you just directed me to.  Would you mind telling me what was there?”

Such a system of mutual aid would draw on the same cooperative and voluntary instinct behind the development of the Internet itself.  If I participate as a Web site, I will know that others linking to me will also mirror my material; we each help the other, not simply because it’s the right thing to do, but because we each benefit, spreading the risk of attack and cushioning its impact among all of us.  It’s a NATO for cyberspace, except it would be an alliance of Web sites instead of states.

A mutual aid framework could also make the Internet secure in other ways.  PCs can alert others not to run code that just sickened them, signaling health levels to others.  Internet providers could also develop technologies to validate their relationships to one another and ferret out misleading data, the way Wikipedia volunteers can quickly act to roll back thousands of acts of vandalism a day.

We rightly fear our networks and devices being attacked—but we should not let this fear cause us to destroy what makes the Internet special.  We have to become more involved and more subtle—and soon.

CYBERSECURITY - Big Business, No Incentive For Greater Security

"Data breaches may cost less than the security to prevent them" by Michael Kassner, TechRepublic 4/9/2015

Companies have little incentive to invest in cybersecurity, says Benjamin Dean.  The security expert says the reason why may be moral hazard.

When it comes to data breaches, 2014 was a banner year.  However, if Benjamin Dean, Fellow for Internet Governance and Cyber-security, School of International and Public Affairs at Columbia University, did his math right, 2015 will be more of the same.

In a March 2015 column on The Conversation, Dean provided a hard to disagree with defense of why things security-wise "ain't gonna change" soon.  "When we examine the evidence, though, the actual expenses from the recent breaches at Sony, Target and Home Depot amount to less than 1% of each company's annual revenues," wrote Dean.  "After reimbursement from insurance and minus tax deductions, the losses are even less."

Dean then administered the knockout punch:  "This indicates that the financial incentives for companies to invest in greater information security are low and suggests that government intervention might be needed."

The costs of the Target, Home Depot, and Sony data breaches

Target's data breach in late 2013 involving 40 million credit- and debit-card records, plus 70 million customer records (including addresses and phone numbers), came under Dean's microscope.  A Target financial statement revealed the data breach cost Target $252 million.  "When we subtract insurance reimbursement, the losses fall to $162 million," explained Dean.  "If we subtract tax deductions (yes, breach-related expenses are deductible), the net losses tally $105 million."

Dean pointed out that this sum equaled 0.1% of Target's 2014 sales.

Home Depot suffered a data breach in 2014 where attackers stole 56 million credit- and debit-card numbers plus 53 million email addresses.  According to Dean after an insurance reimbursement of $15 million, the data breach cost Home Depot $28 million or .01% of its sales in 2014.

Dean also looked at Sony's data breach that occurred near the end of 2014.  Sony at first suggested losses exceeded $100 million.  However, Dean found some equally-interesting numbers in Sony's third-quarter financial statement, "$15 million in 'investigation and remediation costs' and that it [Sony] doesn't expect to suffer any long-term consequences."

A senior general manager at Sony later said the figure would be closer to $35 million for the fiscal year ending March 31.  Dean offered some perspective about the losses:  "To give some scale to these losses, they represent from 0.9% to 2% of Sony's total projected sales for 2014 and a fraction of the initial estimates."

As to the question of Sony's reputation, Dean provided the following numbers on the movie "The Interview":

• It cost $44 million to make the film; and
• it has grossed $46.7 million in online sales and cinemas worldwide.

"If anything, the free publicity for a new movie on cable news, across social networks and daily newspapers, at Christmas to boot, represents a net financial benefit to Sony," mentioned Dean.  "There's no such thing as bad press, after all."

The moral hazard response

Dean then introduced a concept I had not heard of: moral hazard.  There are several versions of the definition, but this one from Wikipedia is relevant to this discussion:

"In economics, moral hazard occurs when one person takes more risks because someone else bears the burden of those risks."

Dean applied the concept of moral hazard to Target, Home Depot, and Sony.  "These companies are able to invest less in information security," said Dean in an email exchange with me.  "Because, in the event of a breach, other parties (banks, customers, etc) bear the lion's share of the costs of the breach."

In the case of Home Depot, Dean said credit- and debit-card providers plus Home Depot customers caught the brunt of the fallout.  "Credit unions claim to have spent $60 million in September 2014 alone replacing compromised cards," Dean added.  "Each customer whose card had to be replaced also incurred a cost in terms of inconvenience."

Dean then concluded it does not make economic sense for companies like Target, Home Depot, and Sony to invest heavily in information security, especially when insurance payments and tax deductions cut the financial outlay to where it is less than what it would cost to improve information security.

What is the answer?

Removing the moral hazard seems to be the logical answer.  But how would that come about -- government intervention?  "It's important to make sure the intervention doesn't make the problem of moral hazard worse," cautioned Dean.  "This is a huge problem because as we plough billions of dollars into intelligence agencies, supposedly to keep us all safe from 'cyber-attacks', it has the effect of further weakening the already low incentives for companies to invest in information security themselves."

"Unintended consequences of policies, even in instances where the case for government intervention is strong, can be worse than the consequences of doing nothing at all," further cautions Dean.  "I'm not saying that we do nothing at all -- just that we need verifiable and reliable data on which to begin making these complex policy decisions."

SECURITY - Vulnerablities 2014

COMMENT:  What is most important to security is which OS is the most targeted.  Microsoft is still the most popular and therefore the most targeted.

"Apple, Linux, not Windows, most vulnerable operating systems in 2014" by Ms. Smith, Network Wold 2/22/2015

OS X, iOS, and Linux were the top three most vulnerable operating systems in 2014, but Internet Explorer was the most vulnerable app.

A whopping average of 19 security vulnerabilities were reported every day in 2014.  The number of vulnerabilities discovered each year in operating systems, applications, and hardware has skyrocketed in a nasty trend, according to analysis by GFI Software.

Operating systems with most security vulnerabilities in 2014

The top spot for vulnerabilities in operating systems no longer goes to Microsoft Windows; in fact, Windows isn't even listed in the top three.  Instead, the most vulnerable OS was Apple Mac OS X, followed by Apple iOS and Linux kernel.  As you can see in the list below, Mac OS X had 147 vulnerabilities, with 64 being rated as high-severity bugs.  There were 127 in iOS, 32 of those rated as high.  Linux kernel had a rough year, with 119 security vulnerabilities and 24 being rated as high-severity.  The flip-side is that none of the security holes in Windows versions were rated as low severity.

"2014 was a tough year for Linux users from a security point of view, coupled with the fact that some of the most important security issues of the year were reported for applications that usually run on Linux systems," explained GFI Software manager Cristian Florian.  "Heartbleed, for example, is a critical security vulnerability detected in OpenSSL while Shellshock is a vulnerability that affects GNU Bash."

Most security vulnerabilities in apps during 2014

However, Microsoft can't crow too much about being "more secure," since Internet Exploder Explorer blew away the "competition" by having nearly twice as many security flaws than the second most vulnerable app, which was Google Chrome.  IE had 242 security flaws, with a whopping 220 of those being high-severity vulnerabilities.  Chrome had 124 total bugs with 86 of those rated as high.  With a 117 total, Firefox wasn't too far behind Chrome for security holes reported, but only 57 were high severity.

It's interesting to note that a separate report on security flaws by Secunia found that Google Chrome had the most vulnerabilities in January 2015; Chrome had 71, compared to the second place tie of 19 security glitches each in Oracle Java JRE and Oracle Java JDK.  Internet Explorer didn't even make the top 20 list for vulnerabilities discovered in the first month of this year.

Unsurprisingly, GFI said the worst offender in 2014 for having security flaws was third-party applications.  Apps made up a whopping 83% of reported bugs, followed by 13% in operating systems and then 4% in hardware.

Florian reported:

The applications listed here are pretty much the same as in 2013.  Not surprisingly at all, web browsers continue to have the most security vulnerabilities because they are a popular gateway to access a server and to spread malware on the clients.  Adobe free products and Java are the main challengers but web browsers have continuously topped the table for the last six years.  Mozilla Firefox had the most vulnerabilities reported in 2009 and 2012; Google Chrome in 2010 and 2011; Internet Explorer was at the top for the last two years.

Total security vulnerabilities reported in 2014

To review, last year an average of 19 new security vulnerabilities were reported every day to the National Vulnerability Database (NVD).

In total, there were 7,038 vulnerabilities in 2014.  That figure blows away the new flaws found in any other year.  For comparison, in 2013 there were 13 new security vulnerabilities per day for a total of 4,794; at that time, the number was the highest number of vulnerabilities in the last five years.

If you'd like to end with "good" news, then GFI found some in the fact that the percentage of vulnerabilities rated as "high severity" dropped to 24% in 2014.  Although that is lower than in 2013, there were still more total vulnerabilities discovered in 2014. Sixty-eight percent of vulnerabilities in 2014 were rated as "medium" for severity, with only 8% rated as "low."

CYBER ATTACKS - Outdated Internet Browsers

"Your outdated Internet browser is a gateway for cyber attacks" PBS NewsHour 11/18/2014

Excerpt

JUDY WOODRUFF (NewsHour):  Major U.S. government agencies have been the target of cyber-attacks of late.  The State Department is the latest.  During the past week, officials had to temporarily shut down an unclassified e-mail system after a suspected hacking.  In recent months, the White House, the Postal Service and the National Weather Service all have been targeted.

Meanwhile, as the holiday season approaches, retailers and the business world are on the lookout for breaches.

A new book breaks down the pervasiveness of what’s happening.

Jeffrey Brown has our conversation.

JEFFREY BROWN (NewsHour):  Hardly a week goes by anymore without a report of some major cyber-breach, whether it’s targeting retailers, the government, or any and all of us.  The attacks are generated in a new netherworld of crime, some of it individualized, even chaotic, other parts of it extremely well-organized.

Writer and journalist Brian Krebs has uncovered some major breaches, including the one on Target that compromised the credit card data of tens of millions of people.  He writes about all of this on his blog Krebs on Security and now in his new book, “Spam Nation.”

And welcome to you.

BRIAN KREBS, Author, “Spam Nation”:  Thank you.

JEFFREY BROWN:  You are peering a world of cyber-crime that few of us ever see.  What does it look like?

BRIAN KREBS:  It’s a pretty dark place.

JEFFREY BROWN:  It is?

BRIAN KREBS:  Yes, absolutely.

But it’s not as dark as you might imagine.  If you’re somebody who doesn’t know their way around, there are plenty of people willing to show you the way.  They might take a cut of the action to help you do that, but it’s not as dark…

SECURITY - NSA's Secret 'Google'

"The Surveillance Engine:  How the NSA Built Its Own Secret Google" by Ryan Gallagher, The Intercept 8/25/2014

Excerpt

The National Security Agency is secretly providing data to nearly two dozen U.S. government agencies with a “Google-like” search engine built to share more than 850 billion records about phone calls, emails, cellphone locations, and internet chats, according to classified documents obtained by The Intercept.

The documents provide the first definitive evidence that the NSA has for years made massive amounts of surveillance data directly accessible to domestic law enforcement agencies.  Planning documents for ICREACH, as the search engine is called, cite the Federal Bureau of Investigation and the Drug Enforcement Administration as key participants.

ICREACH contains information on the private communications of foreigners and, it appears, millions of records on American citizens who have not been accused of any wrongdoing.  Details about its existence are contained in the archive of materials provided to The Intercept by NSA whistleblower Edward Snowden.

Earlier revelations sourced to the Snowden documents have exposed a multitude of NSA programs for collecting large volumes of communications.  The NSA has acknowledged that it shares some of its collected data with domestic agencies like the FBI, but details about the method and scope of its sharing have remained shrouded in secrecy.

ICREACH has been accessible to more than 1,000 analysts at 23 U.S. government agencies that perform intelligence work, according to a 2010 memo.  A planning document from 2007 lists the DEA, FBI, Central Intelligence Agency, and the Defense Intelligence Agency as core members.  Information shared through ICREACH can be used to track people’s movements, map out their networks of associates, help predict future actions, and potentially reveal religious affiliations or political beliefs.

The creation of ICREACH represented a landmark moment in the history of classified U.S. government surveillance, according to the NSA documents.

“The ICREACH team delivered the first-ever wholesale sharing of communications metadata within the U.S. Intelligence Community,” noted a top-secret memo dated December 2007.  “This team began over two years ago with a basic concept compelled by the IC’s increasing need for communications metadata and NSA’s ability to collect, process and store vast amounts of communications metadata related to worldwide intelligence targets.”

The search tool was designed to be the largest system for internally sharing secret surveillance records in the United States, capable of handling two to five billion new records every day, including more than 30 different kinds of metadata on emails, phone calls, faxes, internet chats, and text messages, as well as location information collected from cellphones.  Metadata reveals information about a communication — such as the “to” and “from” parts of an email, and the time and date it was sent, or the phone numbers someone called and when they called — but not the content of the message or audio of the call.

INTERNET - Internet Giants vs Spy Agencies

"Internet Giants Erect Barriers to Spy Agencies" by DAVID E. SANGER and NICOLE PERLROTH, New York Times 6/6/2014

Just down the road from Google’s main campus here, engineers for the company are accelerating what has become the newest arms race in modern technology:  They are making it far more difficult — and far more expensive — for the National Security Agency and the intelligence arms of other governments around the world to pierce their systems.

As fast as it can, Google is sealing up cracks in its systems that Edward J. Snowden revealed the N.S.A. had brilliantly exploited.  It is encrypting more data as it moves among its servers and helping customers encode their own emails.  Facebook, Microsoft and Yahoo are taking similar steps.

After years of cooperating with the government, the immediate goal now is to thwart Washington — as well as Beijing and Moscow.  The strategy is also intended to preserve business overseas in places like Brazil and Germany that have threatened to entrust data only to local providers.

Google, for example, is laying its own fiber optic cable under the world’s oceans, a project that began as an effort to cut costs and extend its influence, but now has an added purpose: to assure that the company will have more control over the movement of its customer data.

A year after Mr. Snowden’s revelations, the era of quiet cooperation is over.  Telecommunications companies say they are denying requests to volunteer data not covered by existing law.  A.T.&T., Verizon and others say that compared with a year ago, they are far more reluctant to cooperate with the United States government in “gray areas” where there is no explicit requirement for a legal warrant.

But governments are fighting back, harder than ever.  The cellphone giant Vodafone reported on Friday that a “small number” of governments around the world have demanded the ability to tap directly into its communication networks, a level of surveillance that elicited outrage from privacy advocates.

Vodafone refused to name the nations on Friday for fear of putting its business and employees at risk there.  But in an accounting of the number of legal demands for information that it receives from 14 companies, it noted that some countries did not issue warrants to obtain phone, email or web-searching traffic, because “the relevant agencies and authorities already have permanent access to customer communications via their own direct link.”

The company also said it had to acquiesce to some governments’ requests for data to comply with national laws.  Otherwise, it said, it faced losing its license to operate in certain countries.

Eric Grosse, Google’s security chief, suggested in an interview that the N.S.A.'s own behavior invited the new arms race.

“I am willing to help on the purely defensive side of things,” he said, referring to Washington’s efforts to enlist Silicon Valley in cybersecurity efforts.  “But signals intercept is totally off the table,” he said, referring to national intelligence gathering.

“No hard feelings, but my job is to make their job hard,” he added.

In Washington, officials acknowledge that covert programs are now far harder to execute because American technology companies, fearful of losing international business, are hardening their networks and saying no to requests for the kind of help they once quietly provided.

Robert S. Litt, the general counsel of the Office of the Director of National Intelligence, which oversees all 17 American spy agencies, said on Wednesday that it was “an unquestionable loss for our nation that companies are losing the willingness to cooperate legally and voluntarily” with American spy agencies.

“Just as there are technological gaps, there are legal gaps,” he said, speaking at the Wilson Center in Washington, “that leave a lot of gray area” governing what companies could turn over.

In the past, he said, “we have been very successful” in getting that data.  But he acknowledged that for now, those days are over, and he predicted that “sooner or later there will be some intelligence failure and people will wonder why the intelligence agencies were not able to protect the nation.”

Companies respond that if that happens, it is the government’s own fault and that intelligence agencies, in their quest for broad data collection, have undermined web security for all.

Many point to an episode in 2012, when Russian security researchers uncovered a state espionage tool, Flame, on Iranian computers.  Flame, like the Stuxnet worm, is believed to have been produced at least in part by American intelligence agencies.  It was created by exploiting a previously unknown flaw in Microsoft’s operating systems.  Companies argue that others could have later taken advantage of this defect.

Worried that such an episode undercuts confidence in its wares, Microsoft is now fully encrypting all its products, including Hotmail and Outlook.com, by the end of this year with 2,048-bit encryption, a stronger protection that would take a government far longer to crack.  The software is protected by encryption both when it is in data centers and when data is being sent over the Internet, said Bradford L. Smith, the company’s general counsel.

Mr. Smith also said the company was setting up “transparency centers” abroad so that technical experts of foreign governments could come in and inspect Microsoft’s proprietary source code.  That will allow foreign governments to check to make sure there are no “back doors” that would permit snooping by United States intelligence agencies.  The first such center is being set up in Brussels.

Microsoft has also pushed back harder in court.  In a Seattle case, the government issued a “national security letter” to compel Microsoft to turn over data about a customer, along with a gag order to prevent Microsoft from telling the customer it had been compelled to provide its communications to government officials.  Microsoft challenged the gag order as violating the First Amendment.  The government backed down.

Hardware firms like Cisco, which makes routers and switches, have found their products a frequent subject of Mr. Snowden’s disclosures, and their business has declined steadily in places like Asia, Brazil and Europe over the last year.  The company is still struggling to convince foreign customers that their networks are safe from hackers — and free of “back doors” installed by the N.S.A.  The frustration, companies here say, is that it is nearly impossible to prove that their systems are N.S.A.-proof.

Most American companies said they never knowingly let the N.S.A. weaken their systems, or install back doors.  But Mr. Snowden’s documents showed how the agency found a way.

In one slide from the disclosures, N.S.A. analysts pointed to a sweet spot inside Google’s data centers, where they could catch traffic in unencrypted form.  Next to a quickly drawn smiley face, an N.S.A. analyst, referring to an acronym for a common layer of protection, had noted, “SSL added and removed here!”

Google was already suspicious that its internal traffic could be read, and had started a program to encrypt the links among its internal data centers, “the last chink in our armor,” Mr. Grosse said.  But the slide gave the company proof that it was a regular target of the N.S.A.  “It was useful to have proof, in terms of accelerating a project already underway,” he said.

Facebook and Yahoo have also been encrypting traffic among their internal servers.  And Facebook, Google and Microsoft have been moving to more strongly encrypt consumer traffic with so-called Perfect Forward Secrecy, specifically devised to make it more labor intensive for the N.S.A. or anyone to read stored encrypted communications.

One of the biggest indirect consequences from the Snowden revelations, technology executives say, has been the surge in demands from foreign governments that saw what kind of access to user information the N.S.A. received — voluntarily or surreptitiously.  Now they want the same.

At Facebook, Joe Sullivan, the company’s chief security officer, said it had been fending off those demands and heightened expectations.

Until last year, technology companies were forbidden from acknowledging demands from the United States government under the Foreign Intelligence Surveillance Act.  But in January, Google, Facebook, Yahoo and Microsoft brokered a deal with the Obama administration to disclose the number of such orders they receive in increments of 1,000.

As part of the agreement, the companies agreed to dismiss their lawsuits before the Foreign Intelligence Surveillance Court.

“We’re not running and hiding,” Mr. Sullivan said.  “We think it should be a transparent process so that people can judge the appropriate ways to handle these kinds of things.”

The latest move in the war between intelligence agencies and technology companies arrived this week, in the form of a new Google encryption tool.  The company released a user-friendly, email encryption method to replace the clunky and often mistake-prone encryption schemes the N.S.A. has readily exploited.

But the best part of the tool was buried in Google’s code, which included a jab at the N.S.A.'s smiley-face slide.  The code included the phrase: “ssl-added-and-removed-here-; - )”

SECURITY - Comic Book With a Cybersecurity Theme as a Teaching Tool

"‘Cynja’ battles botnets and other cyber-scourges" by Larisa Epatko, PBS NewsHour 5/12/2014

The PBS NewsHour’s Hari Sreenivasan speaks to co-authors Chase Cunningham and Heather Dahl about their new comic book, “The Cynja”.

Fictional character Grant Wiley, 11, is a wiz on computers.  One day, his favorite teacher disappears, leaving nothing at his desk but a smoldering USB stick.  Suspecting his help might be needed, Grant grabs the stick and plugs it into his computer at home.

He’s instantly sucked into the Internet and thus begins his adventures as a newly trained “cynja” fighting computer worms, hackers, malware … and worse.

Authored by Chase Cunningham and Heather Dahl, who both work for cybersecurity consulting firms, “The Cynja: Volume 1” aims to introduce children to the world of cybersecurity and teach them how to protect their computers.

Dahl said in an interview with the PBS NewsHour’s Hari Sreenivasan that she was motivated to take on the project when she tried to find a book to teach her young nephew about “the bad guys who live in our computers.”  But “I couldn’t find anything that showed the world I work in,” so she approached Cunningham to help fill the void.

Cunningham said his goal was to create a relatable character that could explain to children what people are doing to protect their cyber-future.  “I’ve worked in this industry for a long time and a lot of the guys that are out there doing what they can to protect the Internet and keep us safe, they don’t have badges and they’re not policemen or firemen or something like that.”

His hope is readers will better understand the role of these protectors and think, “You’re a cynja, you’re a cyberspace ninja — that’s cool.”

SECURITY - Heartbleed Hacks SSL Security Servers

Heartbleed hacks into the SSL protocol that protects HTTPS sites.

"Security bug Heartbleed could have provided key that unlocks personal online data" PBS NewsHour 4/9/2014

Excerpt

GWEN IFILL (NewsHour):  You may have heard headlines today about a major lapse in Internet security and the possibility that millions of passwords, credit card numbers, bank information, and commonly used Web sites could have been exposed.

It involves a bug or security leak called Heartbleed, which can be used to read encrypted information.

Hari Sreenivasan gets a breakdown on what you need to know.

HARI SREENIVASAN (NewsHour):  Essentially, Heartbleed can be used to read the memory of computer servers, the places behind a Web site that store your information, including the lock and key system which protects your usernames and passwords.

You probably see this encryption in the form of a green lock when you conduct a transaction and exchange information.  The breach was revealed this week, but apparently has existed for a long time.

Russell Brandom of The Verge, an online site covering tech news, is here to help explain.

THE WEB - Who Should Oversee It

The title of this article is slightly misleading to non-techies.  NO single entity controls the WEB.  The issue is who assigns the Internet Protocol (IP) Addressing and assigning of Domain Names to IPs.

"As the U.S. government relinquishes control, who should oversee the Web?" PBS NewsHour 3/24/2014

Excerpt

SUMMARY:  The Commerce Department recently announced it would give up oversight of ICANN, the California nonprofit that manages the unique domains of the world's websites and email servers.  There's been international pressure to make the change, especially in light of revelations about NSA surveillance.  Vint Cerf of Google and Randolph May of the Free State Foundation join Judy Woodruff to offer debate.

JUDY WOODRUFF (NewsHour):  Who controls the World Wide Web, and how is it overseen and governed?  These are the questions that most of us don’t really know the answers to, but the Obama administration announced a change in the role played by the United States, one that’s stirring up concerns about the Internet’s future and freedom from censorship.

FADI CHEHADE, CEO, ICANN:  To become the world’s ICANN, we have to go to the world.

JUDY WOODRUFF:  Change was in the wind as the Internet Corporation for Assigned Names and Numbers, ICANN, kicked off a meeting in Singapore this weekend, its purpose, to start crafting a transition from U.S. control of administration of the Internet.

Since 1998, the California nonprofit has had a federal contract to manage the unique identifiers of the world’s Web sites and e-mail servers, regulating domain names such as dot-com and dot-gov.

SECURITY - Hacking By Radio

Public release of this information is a direct threat to U.S. national security.  We have just let our new enemies know what to look for.

"N.S.A. Devises Radio Pathway Into Computers" by DAVID E. SANGER and THOM SHANKER, New York Times 1/14/2014

Excerpt

The National Security Agency has implanted software in nearly 100,000 computers around the world that allows the United States to conduct surveillance on those machines and can also create a digital highway for launching cyberattacks.

While most of the software is inserted by gaining access to computer networks, the N.S.A. has increasingly made use of a secret technology that enables it to enter and alter data in computers even if they are not connected to the Internet, according to N.S.A. documents, computer experts and American officials.

The technology, which the agency has used since at least 2008, relies on a covert channel of radio waves that can be transmitted from tiny circuit boards and USB cards inserted surreptitiously into the computers.  In some cases, they are sent to a briefcase-size relay station that intelligence agencies can set up miles away from the target.

The radio frequency technology has helped solve one of the biggest problems facing American intelligence agencies for years: getting into computers that adversaries, and some American partners, have tried to make impervious to spying or cyberattack.  In most cases, the radio frequency hardware must be physically inserted by a spy, a manufacturer or an unwitting user.

The N.S.A. calls its efforts more an act of “active defense” against foreign cyberattacks than a tool to go on the offensive.  But when Chinese attackers place similar software on the computer systems of American companies or government agencies, American officials have protested, often at the presidential level.

Among the most frequent targets of the N.S.A. and its Pentagon partner, United States Cyber Command, have been units of the Chinese Army, which the United States has accused of launching regular digital probes and attacks on American industrial and military targets, usually to steal secrets or intellectual property.  But the program, code-named Quantum, has also been successful in inserting software into Russian military networks and systems used by the Mexican police and drug cartels, trade institutions inside the European Union, and sometime partners against terrorism like Saudi Arabia, India and Pakistan, according to officials and an N.S.A. map that indicates sites of what the agency calls “computer network exploitation.”

“What’s new here is the scale and the sophistication of the intelligence agency’s ability to get into computers and networks to which no one has ever had access before,” said James Andrew Lewis, the cybersecurity expert at the Center for Strategic and International Studies in Washington.  “Some of these capabilities have been around for a while, but the combination of learning how to penetrate systems to insert software and learning how to do that using radio frequencies has given the U.S. a window it’s never had before.”

No Domestic Use Seen

There is no evidence that the N.S.A. has implanted its software or used its radio frequency technology inside the United States.  While refusing to comment on the scope of the Quantum program, the N.S.A. said its actions were not comparable to China’s.

“N.S.A.'s activities are focused and specifically deployed against — and only against — valid foreign intelligence targets in response to intelligence requirements,” Vanee Vines, an agency spokeswoman, said in a statement.  “We do not use foreign intelligence capabilities to steal the trade secrets of foreign companies on behalf of — or give intelligence we collect to — U.S. companies to enhance their international competitiveness or increase their bottom line.”