Category: NSA

Jun 14 2016

Goodbye, Obamaberry. Hello, Obamadroid.

 

When President Barack Obama took office in 2009, he pushed to keep his BlackBerry. Instead, he was issued another BlackBerry device—a BlackBerry 8830 World Edition with extra crypto—for unclassified calls and e-mail. Until recently, Obama continued to carry a BlackBerry handset, but mobile device technology shifts have finally caught up with the White House. Sadly, the Obamaberry is no more.

In an appearance on Late Night with Jimmy Fallon, Barack Obama noted that he now carries a secure "smartphone" that is so locked down that he compared it to an infant's toy phone. While Obama didn't mention the type of handset he now carries, there's only one mobile device supported by the Defense Information Systems Agency—the agency that provides the White House with communications services. That phone is a "hardened" Samsung Galaxy S4.

Read 4 remaining paragraphs | Comments

Jan 10 2016

Juniper drops NSA-developed code following new backdoor revelations

(credit: Juniper)

Juniper Networks, which last month made the startling announcement its NetScreen line of firewalls contained unauthorized code that can surreptitiously decrypt traffic sent through virtual private networks, said it will remove a National Security Agency-developed function widely suspected of also containing a backdoor for eavesdropping.

The networking company said in a blog post published Friday that it will ship product releases in the next six months that remove the Dual_EC_DRBG random number generator from NetScreen firewalls. Security researchers have known since 2007 that it contains a weakness that gives knowledgeable adversaries the ability to decrypt encrypted communications that rely on the function. Documents provided by former NSA subcontractor Edward Snowden showed the weakness could be exploited by the US spy agency, The New York Times reported in 2013.

A month after the NYT report was published, Juniper officials wrote in a knowledge base article that NetScreen encryption couldn't be subverted by the weakness because Dual_EC_DRBG wasn't the sole source for generating the random numbers needed to ensure strong cryptography. The Juniper post said NetScreen also relied on a separate random number generator known as ANSI X.9.31 that made it infeasible to exploit the Dual_EC_DRBG weaknesses. Random number generators are a crucial ingredient in strong cryptography. Their role is similar to the shaking of dice at a craps table and ensure that keys contain enough entropy to make them infeasible to guess or predict.

Read 5 remaining paragraphs | Comments

Jan 10 2016

Juniper drops NSA-developed code following new backdoor revelations

(credit: Juniper)

Juniper Networks, which last month made the startling announcement its NetScreen line of firewalls contained unauthorized code that can surreptitiously decrypt traffic sent through virtual private networks, said it will remove a National Security Agency-developed function widely suspected of also containing a backdoor for eavesdropping.

The networking company said in a blog post published Friday that it will ship product releases in the next six months that remove the Dual_EC_DRBG random number generator from NetScreen firewalls. Security researchers have known since 2007 that it contains a weakness that gives knowledgeable adversaries the ability to decrypt encrypted communications that rely on the function. Documents provided by former NSA subcontractor Edward Snowden showed the weakness could be exploited by the US spy agency, The New York Times reported in 2013.

A month after the NYT report was published, Juniper officials wrote in a knowledge base article that NetScreen encryption couldn't be subverted by the weakness because Dual_EC_DRBG wasn't the sole source for generating the random numbers needed to ensure strong cryptography. The Juniper post said NetScreen also relied on a separate random number generator known as ANSI X.9.31 that made it infeasible to exploit the Dual_EC_DRBG weaknesses. Random number generators are a crucial ingredient in strong cryptography. Their role is similar to the shaking of dice at a craps table and ensure that keys contain enough entropy to make them infeasible to guess or predict.

Read 5 remaining paragraphs | Comments

Dec 15 2015

Fact-checking the debate on encryption

As politicians and counter-terrorism officials search for lessons from the recent attacks in Paris and San Bernardino, California, senior officials have called for limits on technology that sends encrypted messages.

It's a debate that has repeatedly recurred for more than a decade.In the 1990s, the Clinton Administration directed technology companies to store copies of their encryption keys with the government. That would have given the government a "backdoor" to allow law enforcement and intelligence agencies easy access to encrypted communications. That idea was dropped after sharp criticism from technologists and civil liberties advocates.

More recently, intelligence officials in Europe and the United States have asserted that encryption hampers their ability to detect plots and trace perpetrators. But many have questioned whether it would be practical or wise to allow governments widespread power to read encrypted messages.

Read 36 remaining paragraphs | Comments