September 12, 2013 at 01:21Under NSA Supervision: How to Stay Protected (Bruce Schneier Recommendations)
- Transfer
- Recovery mode
From a translator: Bruce Schneier is an American cryptographer and information security specialist. Among his other articles, which have already been translated into a hub, for some reason there is no article with specific recommendations on how to escape from under the hood. In this regard, I submit it to your court. I hope she will be useful to someone.
Now that we have enough details about how the NSA listens to the Internet, including today's drain that the NSA purposefully weakens cryptographic systems , we can begin to think about how to protect ourselves.
For the past two weeks, I have been working with The Guardian on articles about the NSA, and have read hundreds of top secret documents provided by Edward Snowden.
Now I feel that I can give some advice on how to defend against such an adversary.
The primary way the NSA collects information is online. This is where their capabilities are greatest. They invested in huge programs to automatically collect and analyze traffic. Everything that requires them to attack individual nodes is much more expensive and risky for them, and they will do these things carefully and economically.
Such opportunities provide secret agreements with all telecommunications companies in the USA and England, and many other "partners" around the world - the NSA has access to the Internet's communication lines. In cases where they do not have such friendly access, they do everything to secretly monitor communications - branches from underwater cables, interception of satellite signals, etc.
These are large amounts of data, and the NSA has equivalent large capacities to quickly filter out excess and find traffic of interest. “Interest” can be determined in many ways: by source, by purpose, by content, by related parties, etc. All this is sent to numerous NSA systems for future analysis.
The NSA collects a lot more traffic metadata: who talked with whom, when, for how long, and in what way. Metadata is much easier to store and analyze than content. This data can be very personalized and constitute valuable data.
Intelligence management is up to date on data collection, and the resources spent on it are amazing. I read a report on these programs, a discussion of the features, details of operations, planned improvements, etc. Each task - recovering signals from optical fiber, working with terabyte streams, filtering traffic of interest - has a separate group for solving it. Their achievements are global.
The NSA attacks network devices directly: routers, switches, firewalls, etc. Most of these devices already have built-in monitoring capabilities; you only need to know how to enable them. This is a particularly successful path for attacks; Routers rarely update, they do not have security software, and they are often ignored as a vulnerability.
The NSA also provides significant resources for attacks on target computers. This is done by a group of TAO - Tailored Access Operations ( available on request ). TAO has a set of exploits that you can use against your computer — whatever you use Windows, Mac OS, Linux, iOS, or something else — and tricks that you can use to send them to your computer. Your antivirus will not detect them, and you will not find them, even if you know where to look. These are hacking tools created by hackers with an almost unlimited budget. I realized from Snowden's docs that if the NSA wants to penetrate your computer, it will. It's a question of time.
The NSA works with any encrypted information more often cracking cryptographic algorithms than using secret mathematical holes. Now there is a lot of bad cryptography. If they discover a connection protected by MS-CHAP, for example, they can very easily crack and recover the key. They crack weak user passwords using the same dictionary attacks as hackers do.
Today's information has shown that the NSA works with security product manufacturers to make sure that commercial encryption products have a secret vulnerability that only the NSA knows about. We know that this has been happening for a long time: CryptoAG and Lotus Notes are the most famous examples, there is also evidence of a backdoor in Windows. Several people told me fresh stories from their experience, I plan to write about them soon. Basically, the NSA asks companies to slightly change their products in a difficult way: to make the random number generator less random, somehow show the key, add a common exponent to the public key exchange protocol, etc. If they find a backdoor, this is due to an error. And, as we now know, the NSA is very successful in this direction.
TAO breaks into computers to steal long-term keys. If you use a VPN with a long complex shared key to protect your data, and the NSA is interested in this, they will try to steal this key. Such operations are carried out only against high-priority targets.
How then to defend oneself? Snowden said this at an online Q&A session shortly after the publication of the first document: “Cryptography works. Properly implemented strong cryptosystems are one of the things you can rely on. ”
I believe that this is so despite today's discoveries and tantalizing statements about“ innovative cryptanalytic capabilities ”made by James Clapper, director of national intelligence in another secret document . These features use weakened cryptography.
Snowden continued with a very important phrase: “Unfortunately, the security at the end nodes is so weak that the NSA can circumvent it.”
End nodes mean the software that you use, the computer that you use, and the local network that you use. If the NSA can change the cryptographic algorithm or plant a trojan for you, all cryptography of the world is useless. If you want to stay protected from the NSA, you must be as sure as possible that cryptography works without interference.
With all this in mind, I have five pieces of advice:
1) Hide in the net. Use hidden services. Use Thor for anonymity. Yes, Thor users are under the gun of the NSA, but for them it works. The less noticeable you are, the safer you are.
2) Encrypt your communications.Use TLS. Use IPsec. Once again, despite the fact that the NSA keeps an eye on encrypted connections, and it has exploits against these protocols, you are protected more than without encryption.
3) Suppose your computer can be hacked, then this will require work and risk from the NSA - perhaps they will not want to do this. If you have something really important, use the “air barrier”. When I first started working with Snowden's documents, I bought a new computer that never connected to the Internet. If I want to transfer a file, I encrypt it on this protected computer, and transfer it to my network computer using a USB flash drive. To decrypt something, I do the same in reverse order. This is probably not bulletproof, but very good.
4)Be suspicious of commercial encryption products, especially from major manufacturers. I assume that most crypto products from large vendors from the USA have backdoors for the NSA, and many foreign ones, probably, too. It is reasonable to assume that foreign crypto programs also have backdoors for foreign intelligence services. Systems with original keys are vulnerable to the NSA.
5) Try to use widespread cryptography that is compatible with other implementations.For example, it’s more difficult for the NSA to install a backdoor in TLS than in BitLocker, because the TLS implementation from any manufacturer should be compatible with other TLS implementations from other manufacturers, while BitLocker should only be compatible with itself, giving the NSA more space for changes. And, since Bitlocker is proprietary, there is much less chance that anyone will be aware of these changes. Use symmetric algorithms on top of public key algorithms.
Since I started working with Snowden documents, I started using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit. I understand that most of these things are difficult for a typical Internet user. Even I don’t use all these things for all the things I’m working on. And I mainly use Windows, unfortunately. Llinux would be safer.
The NSA has turned the Internet into a huge controlled platform, but they are not wizards. They are limited by the same economic realities as we, and our best defense is to make their control as expensive as possible.
Believe in math. Encryption is your friend. Use it, do everything to make sure that nothing is compromised. So you can be safe even in the face of the NSA.
Now that we have enough details about how the NSA listens to the Internet, including today's drain that the NSA purposefully weakens cryptographic systems , we can begin to think about how to protect ourselves.
For the past two weeks, I have been working with The Guardian on articles about the NSA, and have read hundreds of top secret documents provided by Edward Snowden.
Now I feel that I can give some advice on how to defend against such an adversary.
The primary way the NSA collects information is online. This is where their capabilities are greatest. They invested in huge programs to automatically collect and analyze traffic. Everything that requires them to attack individual nodes is much more expensive and risky for them, and they will do these things carefully and economically.
Such opportunities provide secret agreements with all telecommunications companies in the USA and England, and many other "partners" around the world - the NSA has access to the Internet's communication lines. In cases where they do not have such friendly access, they do everything to secretly monitor communications - branches from underwater cables, interception of satellite signals, etc.
These are large amounts of data, and the NSA has equivalent large capacities to quickly filter out excess and find traffic of interest. “Interest” can be determined in many ways: by source, by purpose, by content, by related parties, etc. All this is sent to numerous NSA systems for future analysis.
The NSA collects a lot more traffic metadata: who talked with whom, when, for how long, and in what way. Metadata is much easier to store and analyze than content. This data can be very personalized and constitute valuable data.
Intelligence management is up to date on data collection, and the resources spent on it are amazing. I read a report on these programs, a discussion of the features, details of operations, planned improvements, etc. Each task - recovering signals from optical fiber, working with terabyte streams, filtering traffic of interest - has a separate group for solving it. Their achievements are global.
The NSA attacks network devices directly: routers, switches, firewalls, etc. Most of these devices already have built-in monitoring capabilities; you only need to know how to enable them. This is a particularly successful path for attacks; Routers rarely update, they do not have security software, and they are often ignored as a vulnerability.
The NSA also provides significant resources for attacks on target computers. This is done by a group of TAO - Tailored Access Operations ( available on request ). TAO has a set of exploits that you can use against your computer — whatever you use Windows, Mac OS, Linux, iOS, or something else — and tricks that you can use to send them to your computer. Your antivirus will not detect them, and you will not find them, even if you know where to look. These are hacking tools created by hackers with an almost unlimited budget. I realized from Snowden's docs that if the NSA wants to penetrate your computer, it will. It's a question of time.
The NSA works with any encrypted information more often cracking cryptographic algorithms than using secret mathematical holes. Now there is a lot of bad cryptography. If they discover a connection protected by MS-CHAP, for example, they can very easily crack and recover the key. They crack weak user passwords using the same dictionary attacks as hackers do.
Today's information has shown that the NSA works with security product manufacturers to make sure that commercial encryption products have a secret vulnerability that only the NSA knows about. We know that this has been happening for a long time: CryptoAG and Lotus Notes are the most famous examples, there is also evidence of a backdoor in Windows. Several people told me fresh stories from their experience, I plan to write about them soon. Basically, the NSA asks companies to slightly change their products in a difficult way: to make the random number generator less random, somehow show the key, add a common exponent to the public key exchange protocol, etc. If they find a backdoor, this is due to an error. And, as we now know, the NSA is very successful in this direction.
TAO breaks into computers to steal long-term keys. If you use a VPN with a long complex shared key to protect your data, and the NSA is interested in this, they will try to steal this key. Such operations are carried out only against high-priority targets.
How then to defend oneself? Snowden said this at an online Q&A session shortly after the publication of the first document: “Cryptography works. Properly implemented strong cryptosystems are one of the things you can rely on. ”
I believe that this is so despite today's discoveries and tantalizing statements about“ innovative cryptanalytic capabilities ”made by James Clapper, director of national intelligence in another secret document . These features use weakened cryptography.
Snowden continued with a very important phrase: “Unfortunately, the security at the end nodes is so weak that the NSA can circumvent it.”
End nodes mean the software that you use, the computer that you use, and the local network that you use. If the NSA can change the cryptographic algorithm or plant a trojan for you, all cryptography of the world is useless. If you want to stay protected from the NSA, you must be as sure as possible that cryptography works without interference.
With all this in mind, I have five pieces of advice:
1) Hide in the net. Use hidden services. Use Thor for anonymity. Yes, Thor users are under the gun of the NSA, but for them it works. The less noticeable you are, the safer you are.
2) Encrypt your communications.Use TLS. Use IPsec. Once again, despite the fact that the NSA keeps an eye on encrypted connections, and it has exploits against these protocols, you are protected more than without encryption.
3) Suppose your computer can be hacked, then this will require work and risk from the NSA - perhaps they will not want to do this. If you have something really important, use the “air barrier”. When I first started working with Snowden's documents, I bought a new computer that never connected to the Internet. If I want to transfer a file, I encrypt it on this protected computer, and transfer it to my network computer using a USB flash drive. To decrypt something, I do the same in reverse order. This is probably not bulletproof, but very good.
4)Be suspicious of commercial encryption products, especially from major manufacturers. I assume that most crypto products from large vendors from the USA have backdoors for the NSA, and many foreign ones, probably, too. It is reasonable to assume that foreign crypto programs also have backdoors for foreign intelligence services. Systems with original keys are vulnerable to the NSA.
5) Try to use widespread cryptography that is compatible with other implementations.For example, it’s more difficult for the NSA to install a backdoor in TLS than in BitLocker, because the TLS implementation from any manufacturer should be compatible with other TLS implementations from other manufacturers, while BitLocker should only be compatible with itself, giving the NSA more space for changes. And, since Bitlocker is proprietary, there is much less chance that anyone will be aware of these changes. Use symmetric algorithms on top of public key algorithms.
Since I started working with Snowden documents, I started using GPG, Silent Circle, Tails, OTR, TrueCrypt, BleachBit. I understand that most of these things are difficult for a typical Internet user. Even I don’t use all these things for all the things I’m working on. And I mainly use Windows, unfortunately. Llinux would be safer.
The NSA has turned the Internet into a huge controlled platform, but they are not wizards. They are limited by the same economic realities as we, and our best defense is to make their control as expensive as possible.
Believe in math. Encryption is your friend. Use it, do everything to make sure that nothing is compromised. So you can be safe even in the face of the NSA.