11.12.13
New Evidence of Criminality in Spying Agencies, Going as Far as Exploiting FOSS Sites to Spread Malware
An illustration of James Bond by artist John McLusky for the Daily Express newspaper.
Summary: The job of spooks in the US and the UK is anything but sexy and professional, new leaks continue to reveal
Bombshells regarding the NSA and its British offshoot GCHQ just can’t help coming. There is so much dirty laundry and Snowden et al. bring it out by the bucketload (to be attributed to Snowden). Techrights might have an exclusive story of its own pretty soon. We are still trying to ascertain/verify the facts in a case involving Arizona’s corrupt authorities (we asked for court documents to support the claims and to potentially publish). If the claims are true, then not only the NSA and FBI inject malware into people’s computers (e.g. CIPAV) but local authorities too are trying to do this, completely against the law. They spy without warrants, crack computers, and also pass new laws as means of revenge against people whom they are desperate to prosecute (but can’t). It sounds like a movie plot, but it sure seems to be real.
The big story in the news this week is that Slashdot got used by GCHQ to inject malware. This is criminal. When one is hijacking, infecting and distributing malware it is a serious crime — well, typically a crime when done by entities not connected to the government. The NSA-subsidised operations base known as GCHQ sure is damaging the British software industry [1] and the British “information commissioner” sure misses the point [2]; the real issue here is the illegal spying, not those who expose the illegal spying (whistleblowing/reporting). The British press which covers this the most is promoting Darkmail right now [3] and the ‘British Snowden’ explains to us how serious a problem we are dealing with [4]. Over 80% of US citizens are not satisfied with NSA oversight [5]. The NSA basically collects everything quite indiscriminately [6] and even phones that are switched off (powered off) are believed to be tracked by the NSA [7]. Services that require one’s real identity to use are getting more aggressive [8], the surveillance is being used for an expanding number of purposes (drug enforcement, taxes, etc.) [9], and even NIST turns out to be somewhat of a fraud with fake (moles-based) peer review [10].
Finally, for those who don’t know, Microsoft allegedly puts Windows back doors for the NSA [11]. What we know for sure is that Microsoft does tell the NSA how to remotely crack Windows PCs. Microsoft and the NSA are in bed together, so anyone who values his/her privacy should avoid everything from Microsoft and Microsoft-owned companies like Facebook. Now is a good time to move to Free/libre software. It’s never too late. █
Related/contextual items from the news:
-
GCHQ data snooping has “destroyed trust in British tech”
GCHQ’s online surveillance has destroyed trust in British technology companies and irrevocably damaged the nation’s information security industry, according to a cryptography expert.
-
Information commissioner voices fears over scale of NSA surveillance
Liberty’s director, Shami Chakrabarti, asked about the impact of the Snowden revelations on the security services’ attempts to tackle terrorism, said: “I’m sure it creates challenges and irritations [but] any challenges are probably overblown. The serious bad boys know all about the technological possibilities.”
Chakrabarti said Snowden had revealed “not just blanket surveillance and intrusion of privacy [but] that we got taken for mugs.
“There was a big debate in this country about a snooper’s charter. That bill was dropped and now we find out they were doing this stuff anyway. That is not just a breach of privacy it is a fundamental breach of the rule of law, contempt for people, parliament and contempt of the law.
-
Darkmail opens: New email encryption standard aims to keep government agencies out
Silent Circle and Lavabit hope to respond to Snowden leaks with service stopping ‘state snoopers’ accessing email metadata
-
The spies are called to account
As the Snowden-related disclosures continue to flow, each new one refuting the last dissembling statements of the desperate spies, diplomats around the world must be cursing the overweening ambitions of the NSA and it vassals.
American ambassadors are being summoned from their fortified embassies to account for US malfeasance in country after country: Brazil, Spain, France and, of course, Germany.
In this last country there has been scandal after scandal: first the hoovering up of billions of private communications; the revelation that the German intelligence agency, the BND, had been an enthusiastic partner of the NSA in developing the XKeyScore programme and more; then, despite this, humiliatingly to learn that Germany is only considered a 3rd Party intelligence partner by the Yanks — putting them on a par with countries like Iran, China and Russia.
-
Less Than 20% Of Americans Believe That There’s Adequate Oversight Of The NSA
One of the key responses from the NSA and its defenders to all of these Snowden leaks is that there is “rigorous oversight” of the NSA by the courts and Congress. Of course, that talking point has been debunked thoroughly, but NSA defenders keep trotting it out. It appears that the public is not buying it. At all. A recent poll from YouGov found that only 17% of people believe that Congress provides “adequate oversight” on the spying of Americans. A marginally better 20% (though, within the 4.6% margin of error, so meaningless difference really) felt that Congress provides adequate oversight of the NSA when it comes to collecting data on foreigners. Basically, that part of the NSA story just isn’t particularly believable in light of everything that’s come out. Oh, and people are paying attention to the news. A full 87% had heard something about the spying on foreign countries — with only 14% thinking that such a program has helped US interests abroad.
-
Dan Geer Explains the Government Surveillance Mentality
-
Samsung, Nokia say they don’t know how to track a powered-down phone
Privacy International still awaits answers from Apple, BlackBerry, and others.
-
Your Face and Name Will Appear in Google Ads Starting Today
-
NSA’s Vast Surveillance Powers Extend Far Beyond Counterterrorism, Despite Misleading Government Claims
-
Post-NSA Revelations, NIST Opens Review of All Crypto Standards
-
Chrome Clamps Down, Bitcoin Vulnerability & More…
Back when the Eric Snowden brouhaha first began, we said that this was going to have serious repercussions on the tech sector here in the United States, especially after it became evident that Microsoft was actively working with the spooks by allegedly designing back doors into their operating system and keeping federal intelligence agents informed about unpatched security holes that could be used against foreign governments and “terrorist,” which now days seems to be everyone who doesn’t work for the NSA, FBI or CIA.
Content is available under CC-BY-SA
Needs Sunlight said,
November 12, 2013 at 8:16 am
These injection MITM attacks only work on Web 2.0 sites. Secure sites, which work with javascript disabled, can’t do anything to a non-Windows machine if javascript is disabled. With all these revelations or confirmations, it almost looks like insecurity is a motivating factor in the spread of Web 2.0.
SSL MITM is a related problem, but it is the javascript which is the real enabler to mischief.