Even Microsoft has to pay for it

Microsoft has joined Google, Mozilla, and the rest by finally offering a bug bounty.

In the past, Microsoft didn't have to offer bounties. Windows was ubiquitous. Whenever something crashed, security professionals would launch the debugger, figure out what crashed, how to repeat the crash, and thus, find the vuln. Disclosing the bug to Microsoft, and getting credit for it, was an important resume builder. A lot of early cybersec pros got their first high-paying jobs based on their public disclosure of vulnerabilities.

In addition to the carrot, Microsoft had a stick. Because of its dominating position in the industry, most company's survival depends upon goodwill from Microsoft. With it's "responsible disclosure" policy, Microsoft has made it clear that this goodwill would disappear if people didn't follow their policy, such as disclosing a bug before Microsoft fixed it (even if it took them a year to fix it). This intimidation forced many security researchers to play along.

Then the things changed. Starting about 10 years ago with WinXP SP2, Microsoft go real serious about defense. They went from the joke of the industry (though unfairly) to the leader in writing secure code. We professionals spend more time with our iPads, Androids, and other systems and less time with Microsoft products. We are less likely to come across bugs accidentally in daily use, and we are less likely to be intimidated into responsible disclosure.

The biggest change has been the rise of the "vuln market". Instead of pimping your vuln for fame, you can now sell it to an interested party, such as Russian organized crime, Chinese spies, or the NSA cyberwarriors. The right bug, to the right customer, at the right time, can be worth $1 million. Even crappy bugs can be worth $10,000. That means Microsoft can no longer count on people disclosing bugs to them -- they have bid against the Russians, Chinese, and Americans.

Bug bounties from the vendors still pay lower than the "market rate", for good reason. If you sell to the Russians, you may find yourself (or a family member) getting kidnapped. If you sell to the NSA, you might find the FBI raiding your house. Also, you don't know who, precisely, to sell to, so you'll be going through a middleman, who will take a cut. Thus, the safest and surest route is to sell your bug to the vendor -- even at a fraction of the price.

Upcoming revelations speculations

Greenwald/Snowden claim even more explosive revelations are coming. I thought I'd write some guesses of what those revelations might be.

Factoring 1024 bit keys

I don't think the NSA can crack any RSA key through the use of quantum computers. If they could, only 10 people would know, and it wouldn't filter down to people like Snowden. Moreover, Snowden tried to get Greenwald to use PGP -- which he wouldn't have done if the NSA could crack it.

But, the NSA has the ability to brute-force short RSA keys using arrays of custom silicon chips (ASICs or FPGAs).

What we don't know how far they've gotten, what the largest key is that they can crack. I think one of the revelations will be the size of keys the NSA is currently cracking. Since most websites default to 1024 bit keys, that the NSA can routinely crack keys of that size would be an explosive revelation.

Just as important would be revelation about specific cases where it might've used its vast cracking power, such as whether it successfully has decrypted somebody's SSL connections using this technique. If the NSA is routinely cracking RSA in the SSL traffic it eavesdrops on throughout the world, that'd be huge.

Update: A 768-bit RSA key was factored in 2010. They estimate cracking a 1024-bit key would be 1000 times harder, taking 1.5 million desktop computers to accomplish the feat. This is within the NSA's budget. Thus, it factoring these keys wouldn't be surprising -- but proof they regularly do it would cause everyone to update their SSL certificates.

TOR eavesdropping

I assume the NSA operates TOR (The Onion Router) entry/exit nodes purely on the principle that they'd be a fool not to. By default, TOR creates a new circuit every 15 minutes. Thus, a single high-speed exit node will eventually get a sample of everyone who uses TOR.

An interesting revelation would be the extent to which the NSA is monitoring TOR. With enough exit, entry, and internal nodes, the NSA would be able to successfully unmask a person. It would be an enormous investment, though.

My recollections are hazy, but I think most Tor nodes use 1024 bit RSA keys. Thus, the above discussion on RSA factoring can be extended to cover Tor traffic. That ability would be an explosive revelation.

BitCoin mining

Anybody with more than 50% of the computation power of the BitCoin network can destroy it. The NSA has long been a huge customer of custom designed ASICs and FPGAs, and is something they could easily do -- if they wanted to.

A separate issue is anonymity  As everyone knows, BitCoin is pseudonymous. Every transaction is logged in a public legger open to everyone, including the NSA. It's just that these transactions are pure metadata. We don't know the physical person behind the BitCoin addresses. However, the NSA can sync this up with other metadata, such as it's tracking of all financial transactions, phone numbers, and IP addresses. That they'd successfully unmasked major BitCoin targets would be explosive.

Also, there is the rumor that Satoshi Nakamura (the pseudonym of BitCoin's creator) is an NSA employee.

Stuxnet and 0day market

We all believe the NSA created Stuxnet, so any confirmation of this won't surprise us.

But it's unlikely that NSA created it alone. Instead, they probably used contractors and purchased the 0days on the open market. It's like that the sellers of some of those 0days are well known to us in the cybersec community, being people that we personally know.

Likewise, there might be explosive revelations about the extent of the 0day market in general, how many the NSA has been buying, how often they've been used, and who they've targeted.

Backdoors

Decades ago, the NSA was caught bribing a Swiss company to put a backdoor in their crypto products. The rumor that the NSA continues to do so as persisted ever since. For example, when people found the "NSAKEY" in Windows a decade ago, the tin foil hat crowd assumed it was an NSA backdoor (it wasn't).

Modern backdoors are beyond crypto. For example, we might find that anti-virus companies routinely ignore malware at the request of the NSA. Or, conversely, the NSA might have a program for tricking anti-virus companies, such as by creating two copies of software that have the same MD5/SHA1 hash, then successfully getting anti-virus companies to whitelist the good version.

Another example is the iMessage issue. In theory, Apple promises some sort of "end-to-end encryption" such that even they cannot decrypt your messages. In practice, everyone believes there is a backdoor for law enforcement. The exact details of this might be revealed.

In other countries, there is a high degree of mistrust of American products, like Internet routers and telcom equipment. These might be revealed to have backdoors.

Even though most computer hardware and chips are designed in the United States, they usually manufactured in China. There has been constant rumors about the Chinese backdooring hardware during the manufacturing process.

What we might find is that the NSA has been backdooring hardware during the design process.

Skype

Microsoft bought Skype for $8 billion dollars. It doesn't seem to make sense. Now that we see Skype and Microsoft prominently mentioned in the PRISM documents, we may find out that this entire thing was a plot by the NSA.

The way it would work is this. In exchange for being the public face owning Skype, the NSA might guarantee $500-million a year of purchases of "software licenses". This could be a win-win for Microsoft, as it could use these fictitious licenses to hide from Wall Street how much their Windows market share is tanking in the mobile market.

Undersea Cables

Why the heck was Edward Snowden working in Hawaii? The assumption that many people have is because that's where undersea cable taps lead.

As everyone knows, the NSA has its own private nuclear powered submarine. Everyone assumes this is for settling on the deep ocean floor to install its taps. What we may find is the true scope of this program.

There's more to it than just cable taps. Through manipulation of BGP routing, it's easy to cause targeted traffic that would normally be wholly within a country to leak out through an undersea cable, and then go back into the country. Revelations of this sort of thing would be pretty explosive.

More monitoring of Americans

As the NSA repeatedly says, they don't monitor Americans themselves -- they just outsource it to the FBI.

There might be more revelations about how the NSA hoovers up various law enforcement data from around the country into "fusions centers" that combine and correlate it.

For example, local police departments are increasingly scanning license plates automatically, recording the GPS location and time when the license plates were seen. This includes cameras on the side of the road, cameras mounted on top of police cars, and or manual action by police officers typing in plates into the computer.

Imagine if all that data was sent to the NSA, to be combined with other metadata, such as the cell location from your phone. I think this would get a lot of people upset.

Booz-Allen itself

The Booz-Allen company itself (as well as other military industrial complex companies) are up to their eyeballs in intelligence stuff. It also has a weird history: it was purchased by the private equity company The Carlyle Group, then a minority stake was spun out as a public company, with the Carlyle Group holding onto some business units for itself. A company doesn't have the same restrictions as the NSA. It may be able to do certain things that the NSA can't.

All this means that we may be getting some interesting revelations about what the company is up to quite appart from the NSA. I'm not sure I'd want to hold stock in this company (though I probably am through a mutual fund or something).

Robert Mueller in drag

I'm sure the NSA has pictures of the director of the FBI in drag.

(I'm making a joke here, refering to how J Edger Hoover was rumored to be a transvestite. Sadly, in this age of tolerance, jokes and gossip about somebody's transvitism no longer works, because nobody cares.)

They finally come for me

These guesses are just the product of my paranoid fantasies, but there's a chance that some might be correct. I might get two FBI agents showing up at my door or be whisked away in the night for questioning.

For the record, I have not yet received an NSL (National Security Letter). Crypto guy Matt Blaze irregularly points this out on twitter as a neat trick. An NSL forbids a person from disclosing that they received the NSL. Thus, while you can't confirm you've received one, you can simply stop posting that you haven't.

NSA poll: You are reading the numbers wrong

Everyone is misquoting the Pew poll that finding 54% of Americans support surveillance. That's not what the poll asked. Instead, the poll asked "surveillance or terrorism?".

Consider instead if the poll had asked, as described in this story, whether:

Is it acceptable for the government to monitor all phone records, looking for patterns, even if those numbers have no known connection to terrorism?

Or, consider this story, and the results of a poll that would ask:

Is it acceptable for the government to use monitored phone records in the pursuit of political objectives?

Or, consider stories like this one which points out that Americans are as likely to be killed by furniture as terrorism. Do Americans have a rational appreciation for the risks of terrorism? Or is this something government misleads the public about, in order to justify their actions?

Oaths, conscience, and honor

When does something become so unconscionable that it's worth forswearing your oaths? Some say never, absolutely, and would suffer any evil rather than break their word. Others break their principles whenever they are slightly inconvenient.

Libradar: Is Edward Snowden libertarian?

People are asking if Edward Snowden (the NSA leaker) is libertarian. My answer is "probably".

We libertarians have a sort of "gaydar", we can spot fellow libertarians even when they say things that are completely neutral and non-political. Back in the day, I was in the "libertarian-closet", and tried to hide my wacky feelings for limited government. I tried to talk and act like everyone else. However, other libertarians could tell my true self. I never understood how that was possible.

Now that I've gotten older, I've discovered that I've got libradar, too, and can often recognize my fellow wackos. I can't say consciously what makes me feel that Snowden is libertarian, but I get that vibe from him.

NSA is wrong, not evil

My twitter feed has gotten this one-sided view of the NSA. Soon, they’ll be claiming the NSA practices witchcraft and eats babies, because, as everyone knows, the NSA is evil. In truth, the NSA is not evil, just wrong. I point this out because there are two sides to every story. The better we understand the NSA’s point of view, the better we can fight them. Power corrupts: understanding this from their point of view will teach us how this happens.

In this post, I describe my first hand experiences dealing with the NSA, and what I understand from their point of view. I don't like the NSA, as you can tell from my other posts, but at the same time, I hate this "us vs. them" attitude that just because we oppose them, that we can impute all sorts of evil untrue attributes onto them.

Vote for my short story!

This years conference, DefCon 21, has a short story contest. I entered a story called Demo Demons. Go read it, and if you like it, go vote for it (story #13389). Since only about 20 people have voted so far, even one vote matters (remember, to vote, you have to first create a DefCon forums account).

The thing that's interesting about my story is that a lot of it is drawn from my experiences over the last 15 years as a "hacker" who speaks at conferences. The title, demo demons, is the phrase we speakers use to refer to the fact that our hacker demonstrations always go awry, no matter who well we practice. Conversely, I've given demos where I've inadvertently been too successful -- capturing too much information and showing it to the audience.

One of my experiences is dealing with the FBI. When they were threatening me once, while talking about "vulnerabilities", an FBI agent said "we don't know what that is, we don't have a Ph.D. in computer science". So, I put that sort of experience into the story.

There are lots of tidbits that you people may recognize. For example, the story refers to female cryptographer who does a surprising crypto trick. That's obviously in reference to a cool trick that Nadia Henninger did. So, if you read bits and wonder if I'm refering to something, the answer is that I probably am.

My point is that even though this is my first attempt at creative writing, and it was written quickly in a week to meet the contest's deadlines, it's worthwhile reading to understand the point-of-view of the hacker culture.

---

By the way, I'm interested in feedback. I'd like to flesh out this story a bit more, and maybe make a series of similar stories, and publish as an ebook. So I'd appreciate comments like:

• this bit sucks, fix it
• this bit rocks, don't change it
• I'd like to know more about this bit

Reconciling PRISM claims

I thought I'd write up a brief piece of journalists on reconciling the admissions by the NSA and the denials by the companies involved with the PRISM program.

The thing you need to look at is my Altivore program, a bit of code I wrote back in 2000 to explain the Carnivore controversy. Like the current issue, there were irreconcilable claims about Carnivore. One set of claims is that it eavesdropped on everyone's traffic, including "Echelon" style keyword searching of emails. The second set of claims is that it was just a law enforcement tool, that it only captured the traffic of a single person that was the subject of lawful warrant.

If we can shoot them, we can cyber them

The latest Greenwald/Guardian leak is a Presidential directive covering offensive cyberwarfare. As someone with some experience in this field, I find nothing particularly interesting.

All the document says is that "cyber" is the same as "kinetic" warfare. Any rules that apply to shooting somebody also apply to hacking them. It means, for example, that the CIA or military can't go off on its own and hack a foreign country without going through the chain of command.

Those who have not read Orwell are doomed to repeat him

Journalist William Saletan writes that the government's surveillance program isn't Orwellian because the government surpervises itself. But government supervising itself doesn't make something less Orwellian. If anything, it it makes it more.

To quote Wikipedia, the book Nineteen Eighty-Four is about "perpetual war, omnipresent government surveillance, and public mind control -- under the control of a privileged inner party elite". As I show below, so is the NSA's surveillance of American citizens.

Welcome to Echelon 2.0

The NSA isn't spying on you. They don't have to. They just outsource it to businesses.

Back 20 years ago, there was a conspiracy theory going around called "ECHELON" that claimed the NSA was monitoring the content of everyone's phone calls and emails, everywhere in the world, including the United States. Echelon (probably) existed, but it's wasn't technically feasible to be as extensive as claimed. It was also against the constitution: the NSA is a bunch of bastards, but they would never cross that line.

But they'll move the line. That's what today's revelation by Glen Greenwald (@ggreenwald) at the Guardian has shown us. While the NSA cannot intercept signals within the United States, then can get a court order for most of the information from businesses, with help from the FBI and the FISA court. The court order demanded everyone's call records from Verizon. It demanded not just records of calls made to foreign countries, but those wholly within the United States as well.

Manning trial: looking up serial numbers

At the Bradley Manning trial, prosecutors identified the laptops by serial number. So I looked up the serial number on the vendor's websites.

Bradley Manning's laptop was a MacBook with a serial number of W8939AZ066E. I went to the Apple Care support site (https://selfsolve.apple.com/agreementWarrantyDynamic.do) and entered that information. I find that it's a mid-2009 MacBook Pro, 13-inch.