All posts by Rufo Guerreschi

Motives of the Hacking Team hack may have much in common with those that broughtin 1903 the British Mr Maskelyne – and possibly its UK corporate/state sponsors – to hack Marconi’s radio telegraph in 1903 …

general, work2

… to establish their tech/service as the “secure” remote communications of choice for global corporations and governments:

Maskelyne followed his trick with an even bigger showstopper. In June 1903, Marconi was set to demonstrate publically for the first time in London that morse code could be sent wirelessly over long distances. A crowd filled the lecture theatre of the Royal Institution while Marconi prepared to send a message around 300 miles away in Cornwall. The machinery began to tap out a message, but it didn’t belong to the Italian scientist.

“Rats rats rats rats,” it began. “There was a young fellow of Italy, who diddled the public quite prettily …” Maskelyne had hijacked the wavelength Marconi was using from a nearby theatre. He later wrote a letter to the Times confessing to the hack and, once again, claimed he did it to demonstrate the security flaws in Marconi’s system for the public good.

Of course cable could be undetectably be “sniffed” then as fiber cable can be sniffed today …

if sousveillance tools do not have sufficiently extreme levels of security and user-accoutability, they become additional tool of the powers-that-be…

work2

This article – “Indian cops want Bangalore’s citizens to help them catch criminals by using Periscope” – makes me think that if sousveillance tools do not have sufficiently extreme levels of security and user-accoutability, they become additional tool of the powers-that-be…

Even a Transparent Society – which could replace this one if we fail technically to find ways to provide meanigful priovacy to all – presupposes that we achieve extreme levels of user-trustworthiness of at least part of our IT system, so as to ensure effectively symmetric transparency.

Who sets the security standards for lawful access systems like Hacking Team team?!

en1, general, personal1, work1, work2

After what came out of the Hacking Team scandal, we should consider if the standards for such techs, crucial for society – that many governments want extended as mandatory to other IP communications – maybe we have a problem at their origina, i.e. with their international governance by NIST and ETSI, the non-binding bodies that set their standards (which are then mostly updaken by national governments).  If we know NIST has broken crucial crypto standards on pressure fom NSA, here is the formal governance of ETSI, which is then deeply participated in its process by industry players :

 

Screen Shot 2015-07-10 at 10.12.15

Why Hacking Team backdoor is old news from the late 80’s!

en1, general, personal1, work1

The just revealed Hacking Team RCS systems backdoor (for them and presumably for their state friends) was the very reason of existence of the first such systems from the early 80-90’s (!!), created by former NSA staff, and then taken over by former (?) Mossad senior agents, and sold to tens of governments worldwide.

Pushed around “presumably” with the key goal of giving Israeli intelligence full info on what other intelligence were up to. US made an illegal copy for itself and pushed that one around to other governments …

Here is the Wikipedia file a long detailed story of it, and Here excerpts from a relatively authoritative book on the history of Mossad “Gideon’s Spies” which I finished reading last Christmas:
https://en.wikipedia.org/wiki/Inslaw
http://cryptome.info/promis-mossad.htm

Hacking Team on the relative morality of their general line of business

en1, work2

From Ars Technica post today. It does make sense in many regards:

Rabe argued that just as the United States and other Western countries routinely sell arms to allied countries like Saudi Arabia, so too should Hacking Team be able to sell its wares as well. After all, he pointed out, more than a dozen of the September 11 hijackers were from that country.

“Do you want Saudi Arabia to be able to track that sort of thing or would you rather have them be able to operate behind contemporary secrecy and the Internet?” he said.

“My point is not really to argue the various dangers of different kinds of equipment but just to say that if you’re going to sell weaponry to a country, it’s a little disingenuous to say that a crime-fighting tool is off-limits.”

Rabe ended the call with a forceful defense of the company’s entire business model, saying that there should be a controlled, appropriate way for governments and law enforcement to breach digital security.

“[CEO David Vincenzetti] started life in what we would call defensive security, to keep people out, and then he realized as more and more of the communications became inaccessible, that there was a need for a tool that gave investigators the opportunity to do surveillance. I don’t think that’s really that hard to understand, frankly. I don’t think any of us are against cryptography, but what we’re against is police being able to catch criminals and prevent crime, that’s what we’re worried about.”

work1

In a recent post on Wired, called “Why We Need Free Digital Hardware Designs“, Richard Stallman compares the prospects and meaining of Free digital Hardware and designs, in comparison with Free Software:

You can’t build and run a circuit design or a chip design in your computer. Constructing a big circuit is a lot of painstaking work, and that’s once you have the circuit board. Fabricating a chip is not feasible for individuals today; only mass production can make them cheap enough. With today’s hardware technology, users can’t download and run John H Hacker’s modified version of a digital hardware design, as they could run John S Hacker’s modified version of a program. Thus, the four freedoms don’t give users today collective control over a hardware design as they give users collective control over a program. That’s where the reasoning showing that all software must be free fails to apply to today’s hardware technology.

Sure, but without meaningfully-trustworthy hardware – i.e. with verifiable and adequately verified critical hardware components, even during fabrication – the Free Software gives the user much freedom to hack and very little civil freedom, as there is little assurance against scalable undetectable low-cost end-point attacks.

In 1983 there was no free operating system, but it was clear that if we had one, we could immediately use it and get software freedom. All that was missing was the code for one.

In 2014, if we had a free design for a CPU chip suitable for a PC, mass-produced chips made from that design would not give us the same freedom in the hardware domain. If we’re going to buy a product mass produced in a factory, this dependence on the factory causes most of the same problems as a nonfree design. For free designs to give us hardware freedom, we need future fabrication technology.

We can envision a future in which our personal fabricators can make chips, and our robots can assemble and solder them together with transformers, switches, keys, displays, fans and so on. In that future we will all make our own computers (and fabricators and robots), and we will all be able to take advantage of modified designs made by those who know hardware. The arguments for rejecting nonfree software will then apply to nonfree hardware designs too.

That future is years away, at least.

That vision is great, but the timing is even worst. In fact, the economics of assuring the such fabricators and robots so that they themselves will not contain vulnerabilities that may compromise all devices produced with them, places the such home fabrication possibility at the very least one or two decades away.

Is there no alternative till then thatn to just trust multiple hardware makers?!

In the meantime, there is no need to reject hardware with nonfree designs on principle.

*As used here, “digital hardware” includes hardware with some analog circuits and components in addition to digital ones.

We need free digital hardware designs

Although we need not reject digital hardware made from nonfree designs in today’s circumstances, we need to develop free designs and should use them when feasible. They provide advantages today, and in the future they may be the only way to use free software.

Free hardware designs offer practical advantages. Multiple companies can fabricate one, which reduces dependence on a single vendor. Groups can arrange to fabricate them in quantity. Having circuit diagrams or HDL code makes it possible to study the design to look for errors or malicious functionalities (it is known that the NSA has procured malicious weaknesses in some computing hardware).

I makes it possible to look only for some errors, as its is widely recognized that there are vulnerabilities that may be inserted during fabrication which cannot be ascertained after fabrication. “You cannot add trust to intergated circuits after fabrication” said US Defense Science Board back in 2005.

Furthermore, free designs can serve as building blocks to design computers and other complex devices, whose specs will be published and which will have fewer parts that could be used against us.

Free hardware designs may become usable for some parts of our computers and networks, and for embedded systems, before we are able to make entire computers this way.

Free hardware designs may become essential even before we can fabricate the hardware personally, if they become the only way to avoid nonfree software. As common commercial hardware is increasingly designed to subjugate users, it becomes increasingly incompatible with free software, because of secret specifications and requirements for code to be signed by someone other than you. Cell phone modem chips and even some graphics accelerators already require firmware to be signed by the manufacturer. Any program in your computer, that someone else is allowed to change but you’re not, is an instrument of unjust power over you; hardware that imposes that requirement is malicious hardware. In the case of cell phone modem chips, all the models now available are malicious.

Some day, free-design digital hardware may be the only platform that permits running a free system at all. Let us aim to have the necessary free digital designs before then, and hope that we have the means to fabricate them cheaply enough for all users.

If you design hardware, please make your designs free. If you use hardware, please join in urging and pressuring companies to make hardware designs free.

Adi Shamir: ” “In the Second World War if you had good crypto protecting your communication you were safe. Today with an APT sitting inside your most secure computer systems, using cryptography isn’t going to give you much protection.”

general, work2

http://www.theregister.co.uk/2013/03/01/post_cryptography_security_shamir/

“In the Second World War if you had good crypto protecting your communication you were safe. Today with an APT sitting inside your most secure computer systems, using cryptography isn’t going to give you much protection.

“It’s very difficult to use cryptography in an effective way if you assume that an APT is watching over the computer system, watching everything that is being done, including the encryption and decryption process.”

Panopticon sounds very much like the post-Snoden world for all of us

en1, general, work2

http://en.wikipedia.org/wiki/Panopticon

The Panopticon is a type of institutional building designed by the English philosopher and social theorist Jeremy Bentham in the late 18th century. The concept of the design is to allow a single watchman to observe (-opticon) all (pan-) inmates of an institution without the inmates being able to tell whether or not they are being watched. Although it is physically impossible for the single watchman to observe all cells at once, the fact that the inmates cannot know when they are being watched means that all inmates must act as though they are watched at all times, effectively controlling their own behaviour constantly

What’s the use of ultra-privacy techs when mics are everywhere?

en1, general, work1

Since Snowden all hopes to retain a meaningful, albeit limited, personal privacy sphere have relied on the possibility of making devices resistant to advanced surveillance available to citizens, supplementary to ordinary commercial ones, and make so that they won’t be made illegal.

Eve if we succeeded, such devices may not serve their purpose or achieve wide adoption, if the average citizen will be constantly and increasingly surrounded by Net connected devices with a mic (mobile, Tv, Pc, Internet of Things), which may allow extremely low cost and scalable continuous surveillance. Schneier just made a fantastic analysis of the issue.

In fact, it would be inconvenient enough to have to place your ordinary phone in a purse, or under a thick pillow, before making a call with your (ultra-) private device, but it would be unbearable to most to have go in the garden because their TV or my fridge may be listening.

It is crucial, therefore, to press for national laws forbidding the sales of any Internet-connectible devices without a certified physical switch-off for mic, camera and power.

If one doesn’t come soon, we may be lead to a point where we might be better quitting on privacy altogether, and turn our efforts assessing the technical and political feasibility of making total surveillance as symmetrical as possible versus the powerful, somewhat in the vision of the Transparent Society paradigm of David Brin.

It is a major change in the existential nature of human life, but a large and increasing number of people (such as me) are already  living in such world, with constant awareness that any word I say near my mobile (i. e. always) or I type in an electronic device may very well be collected and archived, at extreme low cost, and accessible to who knows how many.

It’s bearable.

What I can’t bear is that a small group of powerful or rich people, state and non-state related, can increasingly enjoy ultra-privacy and/or huge access to the information of others. This creates a huge shift of unaccountable power towards them, with very dire consequences for human race prospects of survival, and avoidance of durable forms of inhumane global governance.

” BIOS and firmware-level attacks were somewhat common in the late 80s and early 90s. At that point, when the Internet took rise, probably around the advent of Windows 95, it became easy enough for “hobbiest” hackers to forget about the more difficult task of infiltrating hardware and focus on the software. But clearly the NSA had the resources and inclination to keep focus on the lowest level.”

work2

http://blog.thinkst.com/p/if-nsa-has-been-hacking-everything-how.html?m=1

” Orwell thought we would be destroyed by the things we fear, particularly comprehensive surveillance. Huxley conjectured that we would be destroyed by the things that delight us. As it happens, we’ve wound up with both. NSA/GCHQ are doing the Orwellian stuff, while Google, Facebook, Apple, Yahoo, Microsoft, Skype et al are taking care of the Huxleyan side of things.”

work2

http://www.theguardian.com/technology/2014/aug/31/forget-orwell-huxley-dave-eggers-has-seen-future

John Maynard Keynes 1953 : “Will the discontented peoples of Europe be willing for a generation to come so to order their lives that an appreciable part of their daily produce may be available to meet a foreign payment, the reason of which … does not spring compellingly from their sense of justice or duty?” he asked. Greece profit from German history | Jeffrey Sachs | Comment is free | The Guardian

personal2, work2

http://www.theguardian.com/commentisfree/2015/jan/21/greece-profit-german-history-1953-debt-relief