Archive for the 'NSA' Category

Glenn Reynolds at Instapundit says “Thanks, NSA,” for this.

My oldest son Josh, who is the web developer and programmer, says this.

We can all thank the NSA, again, for today.

The next time you hear horse shit about how the NSA is protecting you, remember today.

Congress needs to stop wasting our time doing NOTHING AT ALL, find their balls again, and summon the NSA head and whoever the hell reports to him and the guys who reports to that guy and make them answer for what they’ve done.

Their actions were already crippling our IT industry in foreign markets because no one wants to buy shit from us. Now their actions are literally crippling banks and hospitals.

The republicans are a joke. They have all three branches of government, a majority of state governors, and a favorable Supreme Court. They still aren’t doing anything. Nothing.

Oh, I think they’re doing what comes natural.  It’s full steam ahead for the spy state.  It doesn’t matter that it all violates the constitution, that covenant by which we are all supposed to be bound.  No, the only thing that matters is stability operations, and this is a big part of it.

The NSA is conducting warfare, and this is part of it.  That warfare is designed to be applied across the board, regardless of whether the target is a U.S. citizen.  The system is designed to conduct warfare on U.S. citizens.  You understand that, right?

It’s called Vault 7, concerning the CIA hacking tools.  If you haven’t taken the time to read through it, you should.  I’m going to link, paste some of the content, and comment on an article at NRO today concerning this release, but before I do, you really need this reddit discussion thread as an antidote to the jingoistic silliness in the article.  There are other articles out there, but they pale in comparison to the stupidity of this one at NRO.

According to press reports, WikiLeaks today released thousands of highly classified CIA documents on methods the CIA allegedly is using to conduct cyber warfare. If these documents are legitimate, this illegal release will ruin cyber programs worth billions of dollars that the CIA was using to do battle with America’s enemies, especially terrorist groups.

The CIA officer who took the law into his or her hands to release this material justified this release by claiming this data “urgently need to be debated in public, including whether the CIA’s hacking capabilities exceed its mandated powers and the problem of public oversight of the agency.” The source also said he or she “wishes to initiate a public debate about the security, creation, use, proliferation and democratic control of cyberweapons.”

What nonsense. If the traitor truly believed this program violated U.S. law or endangered the privacy rights of America, there are numerous legal avenues he or she could have used, including the CIA inspector general and the House and Senate intelligence committees. CIA officers take an oath to protect classified national-security information. Such a massive illegal disclosure in violation of the CIA secrecy oath is not an act of courage or whistleblowing, it was “a Snowden” — an act of cowardice by a disgruntled individual who never should have been hired by the CIA.

The only nonsense is in this article.  I’ve copied and pasted enough now.  If you read any more, you’re head is liable to explode due to the overpressure from flow of stupidity.

So let’s rehearse what we do know, not what we can posture and preen about.  First of all, Edward Snowden told us about illegal surveillance being conducted on Americans.  Let’s note that again.  What the NSA was doing when Snowden made his revelations was illegal, and they’re still doing it.  There is absolutely no statutory basis for what they’re doing.

Next, Edward Snowden would be charged with crimes if he were to return to the U.S.  If he had taken this information to the Senate or House, it would have been pushed off to a committee, hidden, and nothing done about it, right after Snowden was arrested.  We know that for a fact because to this date, nothing whatsoever has been done about Snowden’s revelations.  The Senate and House are all compromised in “Brownstone operations” (and we’ll rehearse that in a moment).

What Wikileaks revealed today was that not only is the NSA doing it, but the CIA is doing it as well, and not only that, they’re possibly doing it better.  And no, this isn’t restricted to overseas targets or terrorists, it’s being used on literally anyone and everyone they want to target.  We also know that there is absolutely no statutory basis or justification for what the CIA is doing.  None.

Next, consider what the CIA is doing.  They are quite literally buying the vulnerabilities in U.S.-made software.  They are paying money to keep the vulnerabilities in software and hardware in order to exploit those weaknesses.  One more time so you get the point.  They are creating and buying zero-day exploits for systems and of course refraining from telling the manufacturers of those devices.  This is irresponsible and dangerous to the point of being criminal.  It isn’t negligent, it’s intentionally criminal.

This lends itself to fraud, abuse, extortion, potential convictions in a courtroom with the use of illegally obtained material, material that violates the Fourth Amendment to the constitution.  Here is something else.  Since some of the malware is stolen from Russia, no one can ever, ever again trust the CIA when they say something like “this malware or hacking attack has a known Russian [or any other country for that matter] signature.”  Never.  Not that I ever trusted the CIA anyway.

We would all love to live in a country in which we know with certainty that the men and women in responsible charge of the nation’s international security target only the known enemies of state, i.e., foreign enemies.  But that’s not reality, and only a fool or simpleton believes things like that.  We know that this lust for knowledge, this consuming drive for power, is emblematic of the fall in Genesis, where they wanted to be like God.  Statism is a wicked religion, and jingoism is its bread and butter.

So why would this writer, who wrote the same thing at Center For Security Policy, weigh in with such an article as this?  Why would he beclown himself in this way?  I can think of only two reasons.  The first is that he really doesn’t understand the nature of the deep state.

No, I’m not talking about the deep state in the way Bill Kristol talks about the deep state, with utter ignorance of the subject.  I mean the true nature of the deep state.  CIA, DynCorp (former SpecOps who handles the military operations of the CIA), the State Department, The Clinton Foundation, The Clinton Global Initiative, some FBI (e.g., Andrew McCabe and others), some generals (e.g., Petraeus), and other actors in the corporate world, have participated in nation-toppling in North Africa and the Middle East for the last ten or more years, going after oil, money, precious metals, weapons, human organs and human trafficking (read here child trafficking).

Their bread and butter for extortion is “Brownstone operations,” and their military bread and butter in North Africa has been coupling with the Muslim Brotherhood to overthrow countries and destabilize entire regions.  Of course, money from George Soros came in quite handy.  If this writer doesn’t know about George Webb on YouTube (who is being assisted by FBI by his own admission), the Reddit discussion threads, the Voat discussion threads, and if this writer doesn’t know about “FBIAnon” and “DHS Insider” who is assisting some of these citizen investigations, then the writer is incompetent and should be fired.

If he worked for the CIA all these years and yet doesn’t know about the current war within the IC, then he is a buffoon.  On the other hand, if he does know about all of this, and if he does understand that both the NSA and CIA are engaging in illegal surveillance against American citizens, and yet he supports these programs anyway, then he is a traitor.  The second possibility is darker than the first.

Either way, the MSM is chock full of articles and commentaries today on this subject, and amusingly none of the articles display any significant degree of indignation.  When Nixon’s men broke into Watergate, the whole nation was outraged (except for Lynyrd Skynyrd).  Today, everyone is being recorded, every text message is being sent to storage from one of a few main internet nodes, every phone call is being recorded, and every penny made is being cataloged by the U.S. government.  And no one is batting an eyelid.

It’s a sad commentary on the state of affairs, a state that would have sickened our founders and caused rebellion at one tenth of what we’ve witnessed.  Our founding fathers would have already burned Washington, D.C. to the ground.  The war of independence was started over taxes and gun control.  The saddest part is that nothing is likely to happen as a result of the revelations today.  This too will pass, I predict, just like Snowden’s revelations.

John Jay has related thoughts.  WRSA also links a good video.

I’m going to provide a running list of recent reports concerning NSA spying on Americans, and then some commentary at the end.

The NSA Back Door to NIST:

Through the Snowden disclosures, the NIST standard for pseudo-random number generation has fallen into disrepute. Here I describe the back door to the NIST standard for pseudo-random number generation in elementary and mathematically precise terms. The NIST standard offers three methods for pseudo-random number generation [NIST]. My remarks are limited to the third of the three methods, which is based on elliptic curves.

This is a scholarly paper, and I simply don’t have the time to explain how random number generators work (I have seen the coding and have several algorithms).  I also don’t have the time to explain public and private encryption keys and how they work.  Any attempt to explain this would run way past the usual time Site Meter shows that I have readers.  But suffice it to say that random number generators are compromised.  Thus, any communication you use in which you depend on such methods has also been compromised and isn’t reliable.

ExtremeTech:

Security researchers have successfully broken one of the most secure encryption algorithms, 4096-bit RSA, by listening – yes, with a microphone — to a computer as it decrypts some encrypted data. The attack is fairly simple and can be carried out with rudimentary hardware. The repercussions for the average computer user are minimal, but if you’re a secret agent, power user, or some other kind of encryption-using miscreant, you may want to reach for the Rammstein when decrypting your data.

This acoustic cryptanalysis, carried out by Daniel Genkin, Adi Shamir (who co-invented RSA), and Eran Tromer, uses what’s known as a side channel attack. A side channel is an attack vector that is non-direct and unconventional, and thus hasn’t been properly secured. For example, your pass code prevents me from directly attacking your phone — but if I could work out your pass code by looking at the greasy smudges on your screen, that would be a side channel attack. In this case, the security researchers listen to the high-pitched (10 to 150 KHz) sounds produced by your computer as it decrypts data.

This might sound crazy, but with the right hardware it’s actually not that hard. For a start, if you know exactly what frequency to listen out for, you can use low- and high-pass filters to ensure that you only have the sounds that emanate from your PC while the CPU decrypts data. (In case you were wondering, the acoustic signal is actually generated by the CPU’s voltage regulator, as it tries to maintain a constant voltage during wildly varied and bursty loads). Then, once you have the signal, it’s time for the hard bit: Actually making sense of it.

Without going into too much detail, the researchers focused on a very specific encryption implementation: The GnuPG (an open/free version of PGP) 1.x implementation of the RSA cryptosystem. With some very clever cryptanalysis, the researchers were able to listen for telltale signs that the CPU was decrypting some data, and then listening to the following stream of sounds to divine the decryption key. The same attack would not work on different cryptosystems or different encryption software — they’d have to start back at the beginning and work out all of the tell-tale sounds from scratch.

Hard and a lot of work, but feasible.  My oldest son Joshua responds this back to me concerning this article.

Yeah, saw this on reddit. Physical security is just as important as digital. Also, the Debian distro just released a new version that fixes this by generating pink noise, although if they know the algorithm used to generate the randomness in pink noise they could still filter it.Right now they’re working on using thermal heat/noise generated by PC components as an external factor to seed random number generators.Still, the takeaway is that if the government wants access to the info, they’re going to get it one way or another. Russia just placed an order for typewriters so they could begin archiving sensitive material on paper instead of digitally because paper is more difficult to exfiltrate.

AP:

One of the slides described how the NSA can plant malicious software onto Apple Inc.’s iPhone, giving American intelligence agents the ability to turn the popular smartphone into a pocket-sized spy.

Another slide showcased a futuristic-sounding device described as a “portable continuous wave generator,” a remote-controlled device which – when paired with tiny electronic implants – can bounce invisible waves of energy off keyboards and monitors to see what is being typed, even if the target device isn’t connected to the Internet.

A third slide showcased a piece of equipment called NIGHTSTAND, which can tamper with wireless Internet connections from up to 8 miles (13 kilometers) away.

An NSA spokeswoman, Vanee Vines, said that she wasn’t aware of Appelbaum’s presentation, but that in general should would not comment on “alleged foreign intelligence activities.”

“As we’ve said before, NSA’s focus is on targeting the communications of valid foreign intelligence targets – not on collecting and exploiting a class of communications or services that would sweep up communications that are not of bona fide foreign intelligence interest to the U.S. government.”

Spiegel (select quotes):

The insert method and other variants of QUANTUM are closely linked to a shadow network operated by the NSA alongside the Internet, with its own, well-hidden infrastructure comprised of “covert” routers and servers. It appears the NSA also incorporates routers and servers from non-NSA networks into its covert network by infecting these networks with “implants” that then allow the government hackers to control the computers remotely. (Click here to read a related article on the NSA’s “implants”.)

In this way, the intelligence service seeks to identify and track its targets based on their digital footprints. These identifiers could include certain email addresses or website cookies set on a person’s computer. Of course, a cookie doesn’t automatically identify a person, but it can if it includes additional information like an email address. In that case, a cookie becomes something like the web equivalent of a fingerprint.

Once TAO teams have gathered sufficient data on their targets’ habits, they can shift into attack mode, programming the QUANTUM systems to perform this work in a largely automated way. If a data packet featuring the email address or cookie of a target passes through a cable or router monitored by the NSA, the system sounds the alarm. It determines what website the target person is trying to access and then activates one of the intelligence service’s covert servers, known by the codename FOXACID.

This NSA server coerces the user into connecting to NSA covert systems rather than the intended sites. In the case of Belgacom engineers, instead of reaching the LinkedIn page they were actually trying to visit, they were also directed to FOXACID servers housed on NSA networks. Undetected by the user, the manipulated page transferred malware already custom tailored to match security holes on the target person’s computer …

At the same time, it is in no way true to say that the NSA has its sights set exclusively on select individuals. Of even greater interest are entire networks and network providers, such as the fiber optic cables that direct a large share of global Internet traffic along the world’s ocean floors.

One document labeled “top secret” and “not for foreigners” describes the NSA’s success in spying on the “SEA-ME-WE-4” cable system. This massive underwater cable bundle connects Europe with North Africa and the Gulf states and then continues on through Pakistan and India, all the way to Malaysia and Thailand. The cable system originates in southern France, near Marseille. Among the companies that hold ownership stakes in it are France Telecom, now known as Orange and still partly government-owned, and Telecom Italia Sparkle.

The document proudly announces that, on Feb. 13, 2013, TAO “successfully collected network management information for the SEA-Me-We Undersea Cable Systems (SMW-4).” With the help of a “website masquerade operation,” the agency was able to “gain access to the consortium’s management website and collected Layer 2 network information that shows the circuit mapping for significant portions of the network.”

It appears the government hackers succeeded here once again using the QUANTUMINSERT method.

The document states that the TAO team hacked an internal website of the operator consortium and copied documents stored there pertaining to technical infrastructure …

Take, for example, when they intercept shipping deliveries. If a target person, agency or company orders a new computer or related accessories, for example, TAO can divert the shipping delivery to its own secret workshops. The NSA calls this method interdiction. At these so-called “load stations,” agents carefully open the package in order to load malware onto the electronics, or even install hardware components that can provide backdoor access for the intelligence agencies. All subsequent steps can then be conducted from the comfort of a remote computer.

These minor disruptions in the parcel shipping business rank among the “most productive operations” conducted by the NSA hackers, one top secret document relates in enthusiastic terms. This method, the presentation continues, allows TAO to obtain access to networks “around the world.”

Now for my own commentary.  I overheard a television commercial over Christmas state something like “we believe in helping children reach their creative potentials and then creating their own future,” or some claptrap like that.

I don’t believe that, as I’ve explained before.  The thieves stealing your information and invading your privacy were once creative children too.  Creativity can be turned towards good or evil.  The moral rot and decay in America has produced the totalitarianism under which we now suffer.  The NSA is a sign of the wickedness of our society.  I am not giving excuse to individuals inside the NSA who do this, for it is not society but individuals who do these things.  But I’m remarking on the general cultural, religious, theological and moral darkness that pervades our world.

I am not sanguine about our immediate future.  Oh yes, I have guns and ammunition.  And I know how to use them.  So do a lot of my readers.  But regardless of what happens in our near term and far term future, without addressing the moral rot that caused this situation, we cannot move forward – not with a new constitution, not with a constitutional convention, not with a new revolution.  These things don’t change the heart of man.

The nearest I can see to a solution, albeit a temporary band aid, is secession, in part because of the fact that my location, i.e., the South, has not yet so completely thrown off the garments of our orthodox Christian heritage.  This is not so much a solution for other places, which would doubtless devolve into totalitarianism and anarchy in dialectic tension in short order.

I know this is a long way from the original subject of the post, but with no hesitation and no apology, I unequivocally assert that if you believe that all of your training, all of your tactics, all of your firearms, all of your ammunition, and all of your passion for whatever you have passion, are some sort of fix for moral darkness, you are sadly mistaken, and you will eventually learn this.

This country has far greater problems than how many guns I own.  The kind of behavior we are witnessing from the NSA is consistent with Nazi Germany, Communist China, the Soviet Union and North Korea.  The America I once knew has almost faded from memory, and exists no more.  I have hope that one day it will be born anew, but I know that it will not happen within the present moral darkness and relativism.

UPDATE: The Daily Dot.  The NSA has nearly complete backdoor access to Apple’s iPhone.

UPDATE #2: Zero Hedge, How The NSA Hacks Your iPhone.