Tag Archives: NSA

Personal data is becoming a primary target at every level

I recently published a blog about the data breach at the Office of Personal Management (OPM) and the Interior Department which is being blamed on China.

In the last week, there have been a number of experts giving more detail on the depth of the stolen data. The concern is about Standard Form 86 which is used to collect data on potential federal employees applying for positions in National Security.

As you can imagine, this form probes into areas of someone’s background, family and friends that not even those close to the person may know. There are 127 pages of the form and the collection of information includes citizenship, passport, residence schools, military service, employment, financial records, alcohol and drug use, criminal records, psychological and emotional health, groups that may have been associated with, foreign travel, associates including relatives and friends.

The data is extremely valuable to any foreign government or intelligence agency, knowing your enemy in this much detail is a definite advantage. Some observers are suggesting that the data may even be used to blackmail people.  While there is of course this possibility, I doubt anyone who successfully got a position in the NSA would be susceptible to blackmail…

However, there is the risk of an unsuccessful applicant being blackmailed with the data on their Standard Form 86. Naturally, this is bad news for them and they need protection as they are not in positions of national security.

Any breach that affects the people responsible for our security is extremely serious and there needs be a robust plan to assist current and past employees, and even those who simply filled out the form.

Personal data is becoming the primary target for many cyber criminals, foreign powers and governments and the holders of the data need to take precautions to secure it. We are all potential victims of data theft and it’s our responsibility to understand the dangers of handing over our data.

While in this case there is no alternative for national security employees, in many of the data breach cases recently there are ways that we can limit our exposure by sharing less.

US Navy Soliciting Zero Days

A RFP, which has since been taken down, surfaced last week from the Naval Supply Systems Command seeking operational exploits and vulnerability intelligence for commercial software from leading IT vendors.

Apple Pushing Developers Toward HTTPS Connections From Apps

Apple is encouraging developers who create apps for iOS to begin moving their apps to an HTTPS-only model as soon as possible in an effort to thwart eavesdropping on insecure, plaintext HTTP connections. The move is yet one more sign that major Internet and technology companies are becoming ever more resistant to large-scale, passive surveillance […]

Rights Groups Call for More Change Two Years After Snowden Revelations Began

It’s been two years now since the first stories about NSA surveillance capabilities began to appear, and the environment has shifted dramatically in that time. Awareness of and resistance to mass surveillance has increased greatly, but the changes to policy and laws that many observers had hoped for haven’t necessarily emerged. A new report from Privacy […]

Got privacy? Fewer than 10% of Americans feel in control of their data

It’s a tricky tightrope we walk between security and privacy. The newest report by Pew Research shows that Americans value their privacy and, paradoxically, are only too aware that they don’t have it.

The report, released May 20, highlighted what Pew terms “data insecurity.”

  • Nine in ten adults say being in control of who can get information about them and controlling what information is collected about them is important.
  • Only 9% of respondents felt they had a lot of control over how much information was collected about them and how it was used; and just 6% of the Americans surveyed felt that they could depend on the government to keep their data secure.
  • In the neighborhood of seven in ten people were not confident their activities and records recorded by online advertisers, social media sites and search engines would remain private and secure.

“The majority of Americans believe it is important – often very important – that they be able to maintain privacy and confidentiality in commonplace activities of their lives. Most strikingly, these views are especially pronounced when it comes to knowing what information about them is being collected and who is doing the collecting.”

We at AVG know this well. Pews report mirrors the attitudes that have shown up in our own research and studies conducted with the Mobile Economic Forum.  In our 2014 survey with MEF, we found that 72% of mobile consumers are not happy sharing personal data such as location or contact details when using an app, and one-third (34%) say trust prevents them from buying more goods and services using their mobile device.

The good news is that it looks like people are increasingly aware of their digital footprint and taking action.  For example, according to the Pew survey, 59% cleared their cookies or browser history; 47% refused to provide personal information not relevant to a transaction; 25% used a temporary username or email address; and 24% gave inaccurate or misleading information about themselves.

If you’re like those in the majority of the Pew survey and increasingly worry about your privacy, I urge you to take action.

At the very least, you can take advantage of our free AVG PrivacyFix app to help you manage your online profile across multiple social media platforms, and on all your devices, from one simple interface.  This includes adjusting privacy settings, stopping ad targeting, and blocking tracking.

In the meantime, the tide may be turning for privacy. A lawsuit brought by the American Civil Liberties Union led to a U.S. federal appeals court ruling in May that found that the NSA’s bulk phone call metadata-gathering program is illegal. (If you’re an insomniac you can read the 97-page ruling here.)

Obviously, we all want a strong national security program, and if rooting out terrorist cells is to have any success, a communications intelligence network is paramount. But there is another equally important imperative represented by the Fourth Amendment. The Fourth Amendment protects all Americans against unreasonable searches by the government. It’s a fine balance between the two mandates and goes directly to the Constitution.

The court ruling is a serious matter, and there may be broader implications. Surely, the natural question is then do these consumer rights apply to all digital footprints, including cyberspace?

Stay tuned.

LogJam Vulnerability Threatens Thousands of HTTPS Websites & Mail Servers

What it’s all about

The weaknesses that allow the so called LogJam Attack apparently have to do with how Diffie-Hellman key exchange has been deployed. Said key is a popular cryptographic algorithm that allows internet protocols to agree on a shared key and negotiate a secure connection. Since it is fundamental to many protocols like HTTPS, SSH, IPsec and SMTPS it is relatively wide spread: about 8.4% of the top one million websites and an even bigger part of servers using IPv4 are affected by LogJam.

“Millions of HTTPS, SSH, and VPN servers all use the same prime numbers for Diffie-Hellman key exchange. Practitioners believed this was safe as long as new key exchange messages were generated for every connection. However, the first step in the number field sieve—the most efficient algorithm for breaking a Diffie-Hellman connection—is dependent only on this prime. After this first step, an attacker can quickly break individual connections”, the team state.

According to the researchers LogJam can be used to downgrade connections to 80% of TLS DHE EXPORT servers. They also estimates that a skilled team can break a 768-bit prime and that  – due to the available resources – a state-sponsored campaign could break the common 1024-bit prime.

This is especially scary since they estimate that a successful 1024-bit prime attack would allow for eavesdropping on up to 18% of the top one million HTTPS domains.

Their research paper goes even further: “Our calculations suggest that it is plausibly within NSA’s resources to have performed number field sieve precomputations for at least a small number of 1024-bit Diffie-Hellman groups. This would allow them to break any key exchanges made with those groups in close to real time. If true, this would answer one of the major cryptographic questions raised by the Edward Snowden leaks: How is NSA defeating the encryption for widely used VPN protocols?” How about that! It definitely opens up room for a lot of discussions.

As with FREAK, the vulnerability is actually quite old already. “To comply with 1990s-era U.S. export restrictions on cryptography, SSL 3.0 and TLS 1.0 supported reduced-strength DHE_EXPORT ciphersuites that were restricted to primes no longer than 512 bits”, the released paper reads.

What you can do

Luckily the team has already been in touch with most of the browser developers which means that there are either already fixes available (namely for the Internet Explorer) or will be very very soon.

Make sure you have the most recent version of your web browser installed: Google Chrome (including Android Browser), Mozilla Firefox, Microsoft Internet Explorer, and Apple Safari are all deploying fixes for the Logjam attack. If you run a web or mail server you should disable support for export cipher suites and generate a unique 2048-bit Diffie-Hellman group.

More information on LogJam can be found on the dedicated page.

The post LogJam Vulnerability Threatens Thousands of HTTPS Websites & Mail Servers appeared first on Avira Blog.

LogJam Vulnerability Threatens Thousands of HTTPS Websites & Mail Servers

What it’s all about

The weaknesses that allow the so called LogJam Attack apparently have to do with how Diffie-Hellman key exchange has been deployed. Said key is a popular cryptographic algorithm that allows internet protocols to agree on a shared key and negotiate a secure connection. Since it is fundamental to many protocols like HTTPS, SSH, IPsec and SMTPS it is relatively wide spread: about 8.4% of the top one million websites and an even bigger part of servers using IPv4 are affected by LogJam.

“Millions of HTTPS, SSH, and VPN servers all use the same prime numbers for Diffie-Hellman key exchange. Practitioners believed this was safe as long as new key exchange messages were generated for every connection. However, the first step in the number field sieve—the most efficient algorithm for breaking a Diffie-Hellman connection—is dependent only on this prime. After this first step, an attacker can quickly break individual connections”, the team state.

According to the researchers LogJam can be used to downgrade connections to 80% of TLS DHE EXPORT servers. They also estimates that a skilled team can break a 768-bit prime and that  – due to the available resources – a state-sponsored campaign could break the common 1024-bit prime.

This is especially scary since they estimate that a successful 1024-bit prime attack would allow for eavesdropping on up to 18% of the top one million HTTPS domains.

Their research paper goes even further: “Our calculations suggest that it is plausibly within NSA’s resources to have performed number field sieve precomputations for at least a small number of 1024-bit Diffie-Hellman groups. This would allow them to break any key exchanges made with those groups in close to real time. If true, this would answer one of the major cryptographic questions raised by the Edward Snowden leaks: How is NSA defeating the encryption for widely used VPN protocols?” How about that! It definitely opens up room for a lot of discussions.

As with FREAK, the vulnerability is actually quite old already. “To comply with 1990s-era U.S. export restrictions on cryptography, SSL 3.0 and TLS 1.0 supported reduced-strength DHE_EXPORT ciphersuites that were restricted to primes no longer than 512 bits”, the released paper reads.

What you can do

Luckily the team has already been in touch with most of the browser developers which means that there are either already fixes available (namely for the Internet Explorer) or will be very very soon.

Make sure you have the most recent version of your web browser installed: Google Chrome (including Android Browser), Mozilla Firefox, Microsoft Internet Explorer, and Apple Safari are all deploying fixes for the Logjam attack. If you run a web or mail server you should disable support for export cipher suites and generate a unique 2048-bit Diffie-Hellman group.

More information on LogJam can be found on the dedicated page.

The post LogJam Vulnerability Threatens Thousands of HTTPS Websites & Mail Servers appeared first on Avira Blog.