rigorousintuition.ca

elfismiles » Wed Oct 16, 2013 3:57 pm wrote:NSA Hid Explosions, Delays at $1.2 Billion Spy Compound
Nextgov-Oct 8, 2013
NSA's Utah Data Center, shown in June, occupies 200 acres in Utah. ... explosions and a year-long delay that NSA officials did not disclose.
http://www.nextgov.com/defense/2013/10/ ... und/71567/

$2 Billion NSA Spy Center is Going Up in Flames
The Fiscal Times-by Brianna Ehley-Oct 8, 2013
Technical glitches have sparked fiery explosions within the NSA's newest and largest data storage facility in Utah, destroying hundreds of ...
http://www.thefiscaltimes.com/Articles/ ... ing-Flames

Op-Ed: New NSA $1.2 billion data center in Utah has 10 'meltdowns'
DigitalJournal.com-Oct 14, 2013
Salt Lake City - The National Security Agency's mega spy data center is ... problems with the $1.2 billion dollar NSA Utah data center take place in the secret, high ... Several reports describe the surges as causing explosions.
http://www.digitaljournal.com/article/360231


http://www.youtube.com/watch?v=aFLT-XChf1A




http://www.NullifyNSA.com / http://www.OffNow.org

• Shining a spotlight on online data tracking to help people understand the Web around them. That’s what we set out to accomplish a little more than a year ago as we began building on a popular, experimental add-on for Firefox called Collusion.
  
  While revelations about government surveillance continue to stun people around the world, there’s another area of online data collection with its own complicated transparency challenges that remains important to users. And that’s the diverse range of third party companies that shape so much of our online experiences today from advertising to social sharing to personalization. Third parties are an integral part of the way the Internet works today. However, when we’re unable to understand the value these companies provide and make informed choices about their data collection practices, the result is a steady erosion of trust for all stakeholders.
  
  Today, we’re proud to announce the release of the next iteration of Collusion, which we’re now calling Lightbeam for Firefox. The release happened at at this year’s MozFest.
  
  Lightbeam is an add-on for Firefox that brings to light the array of first and third party companies people interact with everyday across the Web. Development of Lightbeam for Firefox is developed with support from the Ford Foundation and the Natural Sciences and Engineering Research Council, and aided by faculty and students of the Emily Carr University of Art and Design.
  
  < end excerpt >

Allegro » 22 Oct 2013 03:23 wrote:

Allegro » 04 Nov 2013 06:58 wrote:Firefox’s add-on, Lightbeam, allows users to see companies that are tracking them. Development support for Lightbeam includes Natural Sciences and Engineering Research Council of Canada, a country that’s one of five that comprise an alliance of intelligence operations known as Five Eyes (FVEY). So, we users through Lightbeam get to see which companies are tracking, supposing too that some of those companies are customers of National Security Agency?

Links in original, from which the text below is an introductory excerpt.

_________________
Lightbeam for Firefox: Privacy Education for Users & Open Data for Publishers
October 25, 2013
< Lightbeam from Firefox

Mozilla is joining with over 60 leading technology companies, startups, investors, technology trade groups and public interest groups today to call on the US government to allow the release of information pertaining to national security requests for user data.

Mozilla is one of the organizers behind today’s letter. We gathered the signatures of a broad range of Internet and VC leaders for many of whom this is their first time publicly weighing in on this issue. Mozilla has also been one of the leading groups behind the StopWatching.Us campaign, which has gathered over 550,000 signatures and brought together one of the most diverse coalitions of public interest organizations ever assembled on an Internet policy topic.

We began working on an online tech sector letter shortly after new information began to surface about the state of online surveillance by the NSA. From our many discussions, there’s broad agreement that the way national security requests are being carried out have the potential to undermine innovative web technologies, from the cloud to big data to mobile, not to mention search and social. These practices put any company with user data in a position of not being able to fully live up to its privacy commitments and treating users outside the US with fewer protections and rights. We believe developers will abandon ideas for new technologies or offshore them over a risk of growing numbers of government requests and the lack of resources to defend against and process them. And for investors funding the next generation of online services, we heard that backlash from users outside the US is hardly in anyone’s best interest, let alone our nation’s. One only need to look to recent news in important emerging markets like Brazil or the resolution passed by the EU Parliament and upcoming inquiry to see the shape of things to come for our sector.

We encourage all companies dependent on a vibrant, open and transparent Internet ecosystem we can trust to sign onto today’s letter. Follow the discussion about today’s unprecedented letter and also a new White House petition on Twitter using the hashtag, #weneedtoknow.

Here’s a copy of what we sent to leaders in the Obama Administration and Congress:

July 18, 2013

We the undersigned are writing to urge greater transparency around national security-related requests by the US government to Internet, telephone, and web-based service providers for information about their users and subscribers.

First, the US government should ensure that those companies who are entrusted with the privacy and security of their users’ data are allowed to regularly report statistics reflecting:

• 1. The number of government requests for information about their users made under specific legal authorities such as Section 215 of the USA PATRIOT Act, Section 702 of the FISA Amendments Act, the various National Security Letter (NSL) statutes, and others;
  2. The number of individuals, accounts, or devices for which information was requested under each authority; and
  3. The number of requests under each authority that sought communications content, basic subscriber information, and/or other information. 
Second, the government should also augment the annual reporting that is already required by statute by issuing its own regular “transparency report” providing the same information: the total number of requests under specific authorities for specific types of data, and the number of individuals affected by each.

As an initial step, we request that the Department of Justice, on behalf of the relevant executive branch agencies, agree that Internet, telephone, and web-based service providers may publish specific numbers regarding government requests authorized under specific national security authorities, including the Foreign Intelligence Surveillance Act (FISA) and the NSL statutes. We further urge Congress to pass legislation requiring comprehensive transparency reporting by the federal government and clearly allowing for transparency reporting by companies without requiring companies to first seek permission from the government or the FISA Court.

Basic information about how the government uses its various law enforcement–related investigative authorities has been published for years without any apparent disruption to criminal investigations. We seek permission for the same information to be made available regarding the government’s national security–related authorities.

This information about how and how often the government is using these legal authorities is important to the American people, who are entitled to have an informed public debate about the appropriateness of those authorities and their use, and to international users of US-based service providers who are concerned about the privacy and security of their communications.

Just as the United States has long been an innovator when it comes to the Internet and products and services that rely upon the Internet, so too should it be an innovator when it comes to creating mechanisms to ensure that government is transparent, accountable, and respectful of civil liberties and human rights. We look forward to working with you to set a standard for transparency reporting that can serve as a positive example for governments across the globe.

Thank you.

Companies
AOL
Apple Inc.
CloudFlare
CREDO Mobile
Digg
Dropbox
Evoca
Facebook
Google
Heyzap
LinkedIn
Meetup
Microsoft
Mozilla
Reddit
salesforce.com
Sonic.net
Stripe
Tumblr
Twitter
Yahoo!
YouNow

Investors

Boston Common Asset Management
Domini Social Investments
F&C Asset Management Plc
New Atlantic Ventures
Union Square Ventures
Y Combinator

Nonprofit Organizations & Trade Associations
Access
American Booksellers Foundation for Free Expression
American Civil Liberties Union
American Library Association
American Society of News Editors
Americans for Tax Reform
Brennan Center for Justice at NYU Law School
Center for Democracy & Technology
Center for Effective Government
Committee to Protect Journalists
Competitive Enterprise Institute
Computer & Communications Industry Association
The Constitution Project
Demand Progress
Electronic Frontier Foundation
First Amendment Coalition
Foundation for Innovation and Internet Freedom
Freedom to Read Foundation
FreedomWorks
Global Network Initiative
GP-Digital
Human Rights Watch
Internet Association
Liberty Coalition
National Association of Criminal Defense Lawyers
National Coalition Against Censorship
New America Foundation’s Open Technology Institute
OpenTheGovernment.org
Project On Government Oversight
Public Knowledge
Reporters Committee for Freedom of The Press
Reporters Without Borders
TechFreedom
Wikimedia Foundation
World Press Freedom Committee

Allegro » Sat Jun 08, 2013 10:37 am wrote:Eavesdropping 101: What Can the NSA Do?

[...]

RHNs innovatively use baseband and satellite communications capabilities that enable regionalized reach-back to the Army’s global network. The RHNs operate “in sanctuary,” or out of the fight zone, and were designed to provide division, brigade combat teams and below early access to the Global Information Grid, the infrastructure and services that move information through the global network. The RHN gives the Soldier in the field immediate access to secure and non-secure internet and voice communications, and it allows them to do their job anywhere on the globe. To provide tactical users with secure, reliable connectivity worldwide, the Army has positioned RHNs in five separate strategic regions: Continental United States (CONUS) East and CONUS West, Central Command, European Command, and Pacific Command.

The second operating system hiding in every mobile phone

posted by Thom Holwerda on Tue 12th Nov 2013

I've always known this, and I'm sure most of you do too, but we never really talk about it. Every smartphone or other device with mobile communications capability (e.g. 3G or LTE) actually runs not one, but two operating systems. Aside from the operating system that we as end-users see (Android, iOS, PalmOS), it also runs a small operating system that manages everything related to radio. Since this functionality is highly timing-dependent, a real-time operating system is required.

This operating system is stored in firmware, and runs on the baseband processor. As far as I know, this baseband RTOS is always entirely proprietary. For instance, the RTOS inside Qualcomm baseband processors (in this specific case, the MSM6280) is called AMSS, built upon their own proprietary REX kernel, and is made up of 69 concurrent tasks, handling everything from USB to GPS. It runs on an ARMv5 processor.

The problem here is clear: these baseband processors and the proprietary, closed software they run are poorly understood, as there's no proper peer review. This is actually kind of weird, considering just how important these little bits of software are to the functioning of a modern communication device. You may think these baseband RTOS' are safe and secure, but that's not exactly the case. You may have the most secure mobile operating system in the world, but you're still running a second operating system that is poorly understood, poorly documented, proprietary, and all you have to go on are Qualcomm's Infineon's, and others' blue eyes.

The insecurity of baseband software is not by error; it's by design. The standards that govern how these baseband processors and radios work were designed in the '80s, ending up with a complicated codebase written in the '90s - complete with a '90s attitude towards security. For instance, there is barely any exploit mitigation, so exploits are free to run amok. What makes it even worse, is that every baseband processor inherently trusts whatever data it receives from a base station (e.g. in a cell tower). Nothing is checked, everything is automatically trusted. Lastly, the baseband processor is usually the master processor, whereas the application processor (which runs the mobile operating system) is the slave.

So, we have a complete operating system, running on an ARM processor, without any exploit mitigation (or only very little of it), which automatically trusts every instruction, piece of code, or data it receives from the base station you're connected to. What could possibly go wrong?

With this in mind, security researcher Ralf-Philipp Weinmann of the University of Luxembourg set out to reverse engineer the baseband processor software of both Qualcomm and Infineon, and he easily spotted loads and loads of bugs, scattered all over the place, each and every one of which could lead to exploits - crashing the device, and even allowing the attacker to remotely execute code. Remember: all over the air. One of the exploits he found required nothing more but a 73 byte message to get remote code execution. Over the air.

You can do some crazy things with these exploits. For instance, you can turn on auto-answer, using the Hayes command set. This is a command language for modems designed in 1981, and it still works on modern baseband processors found in smartphones today (!). The auto-answer can be made silent and invisible, too.

While we can sort-of assume that the base stations in cell towers operated by large carriers are "safe", the fact of the matter is that base stations are becoming a lot cheaper, and are being sold on eBay - and there are even open source base station software packages. Such base stations can be used to target phones. Put a compromised base station in a crowded area - or even a financial district or some other sensitive area - and you can remotely turn on microphones, cameras, place rootkits, place calls/send SMS messages to expensive numbers, and so on. Yes, you can even brick phones permanently.

This is a pretty serious issue, but one that you rarely hear about. This is such low-level, complex software that I would guess very few people in the world actually understand everything that's going on here.

That complexity is exactly one of the reasons why it's not easy to write your own baseband implementation. The list of standards that describe just GSM is unimaginably long - and that's only GSM. Now you need to add UMTS, HSDPA, and so on, and so forth. And, of course, everything is covered by a ridiculously complex set of patents. To top it all off, communication authorities require baseband software to be certified.

Add all this up, and it's easy to see why every cellphone manufacturer just opts for an off-the-shelf baseband processor and associated software. This does mean that each and every feature and smartphone has a piece of software that always runs (when the device is on), but that is essentially a black box. Whenever someone does dive into baseband software, many bugs and issues are found, which raises the question just how long this rather dubious situation can continue.

It's kind of a sobering thought that mobile communications, the cornerstone of the modern world in both developed and developing regions, pivots around software that is of dubious quality, poorly understood, entirely proprietary, and wholly insecure by design.

Back in July 2013, The Washington Post reported that nearly a decade ago, the National Security Agency developed a new technique that allowed spooks to “find cellphones even when they were turned off. JSOC troops called this ‘The Find,’ and it gave them thousands of new targets, including members of a burgeoning al-Qaeda-sponsored insurgency in Iraq, according to members of the unit.”

• They sentenced me to 20 years of boredom
  For trying to change the system from within
  ~ Leonard Cohen

• Former U.S. National Security Agency contractor Edward Snowden succeeded where President Barack Obama couldn’t -- getting Microsoft Corp. (MSFT), Google Inc. and Yahoo! Inc. (YHOO) to upgrade computer security against hackers.
  
  The companies are adopting harder-to-crack code to protect their networks and data, after years of largely rebuffing calls from the White House and privacy advocates to improve security. The new measures come after documents from Snowden revealed how U.S. spy programs gain access to the companies’ customer data -- sometimes with their knowledge, sometimes without -- and that’s threatening profits at home and abroad.
  
  “These companies actively fought against numerous mechanisms that would have mandated far more secure data,” Sascha Meinrath, director of the Open Technology Institute at the New America Foundation in Washington, said in a phone interview. “Now they are paying the literal price.”
  
  While Google (GOOG), Yahoo, Microsoft and Facebook Inc. (FB) provide data to the government under court orders, they are trying to prevent the NSA from gaining unauthorized access to information flowing between computer servers by using encryption. That scrambles data using a mathematical formula that can be decoded only with a special digital key.
  
  The NSA has tapped fiber-optic cables abroad to siphon data from Google and Yahoo, circumvented or cracked encryption, and covertly introduced weaknesses and back doors into coding, according to reports in the Washington Post, the New York Times and the U.K.’s Guardian newspaper based on Snowden documents. He is now in Russia under temporary asylum.
  
  ‘Government Snooping’
  
  Microsoft is the latest company considering measures to ensure the protection of customer data and strengthen security “against snooping by governments,” according to Brad Smith, general counsel for the Redmond, Washington-based company.
  
  Microsoft’s networks and services were allegedly hacked by the NSA, the Washington Post reported Nov. 26. Documents disclosed by Snowden suggest, without proving, that the NSA targeted Microsoft’s Hotmail and Windows Live Messenger services under a program called MUSCULAR, the newspaper said.
  
  “These allegations are very disturbing,” Smith said in an e-mailed statement. “If they are true these actions amount to hacking and seizure of private data and in our view are a breach of the protection guaranteed by the Fourth Amendment to the Constitution.”
  
  Smith didn’t provide details about what the company is considering doing.
  
  Technology Laggards
  
  Microsoft lags behind other major companies when it comes to protecting “users against extralegal attacks on its networks to obtain user data without a warrant,” said Kurt Opsahl, senior staff attorney for the digital-rights group Electronic Frontier Foundation, based in San Francisco.
  
  The nonprofit has compiled a report providing a side-by-side comparison of the encryption measures companies have adopted.
  
  “We have asked companies to implement encryption on every step of the way for a communication on its way to, or within, a service provider’s systems,” Opsahl said in an e-mail. “The news about the NSA’s MUSCULAR program served as a wakeup call, and it’s encouraging to see so many companies working to ensure that user data is not stolen out the backdoor.”
  
  Internet companies resisted efforts to be included under an executive order Obama issued in February to better secure vital U.S. computer networks.
  
  The Feb. 12 order said the government can’t designate “commercial information technology products or consumer information technology services” as critical U.S. infrastructure. That exempted services like Mountain View, California-based Google’s Gmail, Microsoft’s Windows and Cupertino, California-based Apple Inc. (APPL)’s iPhone software.
  
  Money Talks
  
  The difference now is the companies are responding to market pressure, said James Lewis, director of the technology and public policy program at the Center for Strategic and International Studies, a Washington nonprofit.
  
  “They’ve got to do something to show the foreign customers they’re protecting them from surveillance,” Lewis said in a phone interview. “The administration was looking for incentives and it appears they found one.”
  
  The Obama administration and members of Congress say cybersecurity legislation is still needed to secure the networks of power grids, banks and pipelines, which haven’t been affected by the Snowden disclosures. Legislation has been proposed in the Senate to establish voluntary cybersecurity standards for companies, while the House passed a bill that would give companies legal protections for sharing hacking threat data with each other and the government.
  
  ‘Serious Damage’
  
  News about the spy programs has “great potential for doing serious damage to the competitiveness” of U.S. companies, Richard Salgado, Google’s director for law enforcement and information security, told a U.S. Senate panel Nov. 13.
  
  Revelations of NSA spying may cost the U.S. cloud industry as much as $35 billion by 2016, according to the Information Technology Industry Council and the Software Information Industry Association, two Washington trade associations.
  
  Even after the NSA revelations to date, it isn’t clear whether the agency bypassed or received cooperation from companies that provide the fiber-optic cables and other equipment that make up the Internet’s backbone, such as Broomfield, Colorado-based Level 3 Communications Inc. (LVLT) and Sunnyvale, California-based Juniper Networks Inc. (JNPR)
  
  The NSA collects “the communications of targets of foreign intelligence value, irrespective of the provider that carries them,” agency spokeswoman Vanee Vines said in an e-mail.
  
  Legal Liability
  
  Level 3 is constantly “monitoring, testing, adapting and improving our security measures to protect against the ever-evolving threat landscape,” Dale Drew, the company’s chief security officer, said in an e-mailed statement.
  
  “Our top priority remains to protect our customers and our network infrastructure -- the source of an attack is immaterial,” he said.
  
  Juniper products are “designed to meet the high security and privacy standards that users require” and the company has “multiple layers of security, including the right policies, protocols and technologies to counter a variety of security risks and vulnerabilities,” spokeswoman Cindy Ta said in an e-mailed statement.
  
  Meinrath, with the Open Technology Institute, said companies that claim to secure data while allowing it to be intercepted due to lax security should face legal liabilities.
  
  “The smartest minds in these companies completely fell down on the job in terms of identifying risks to these business models,” Meinrath said. “The fact that the Snowden revelations can act as a catalyst to implement best practices for secure communications and data integrity is a great outcome.”