This Week In 'The NSA Knows F**king Everything': How It Hacked Most Hard Drives And SIM Cards

from the call-it-a-twofer... dept

Thought that the revelations of NSA/GCHQ spying were dying out? Having some "surveillance fatigue" from all the stories that have been coming out? Have no fear -- or, rather, be very very very fearful -- because two big new revelations this week show just how far the NSA will go to make sure it collects everything. First up: your hard drives. Earlier this week, Kaspersky Lab revealed that the NSA (likely) has figured out ways to hide its own spyware deep in pretty much any hard drive made by the most popular hard drive manufacturers: Western Digital, Seagate and Toshiba.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said.

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran's uranium enrichment facility. The NSA is the U.S. agency responsible for gathering electronic intelligence.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the spy agency valued these espionage programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

As the report notes, it appears that this is a kind of "sleeper" software, that is buried inside tons of hard drives, but only "turned on" when necessary. The report notes that it's unclear as to how the NSA was getting this software in there, but that it couldn't do it without knowing the source code of the hard drive firmware -- information that is not easily accessible. A few of the hard drive manufacturers have denied working with the government on this and/or giving them access to the firmware. It's possible they're lying/misleading -- but it's also possible that the NSA figured out other ways to get that information.

And that brings us to door number two: your mobile phone's SIM card. Today, the Intercept revealed (via the Ed Snowden documents) how the NSA and GCHQ were basically able to hack into the world's largest manufacturer of mobile phone SIM cards in order to swipe encryption keys, so that your friendly neighborhood intelligence snooper can snoop on you too:

The company targeted by the intelligence agencies, Gemalto, is a multinational firm incorporated in the Netherlands that makes the chips used in mobile phones and next-generation credit cards. Among its clients are AT&T, T-Mobile, Verizon, Sprint and some 450 wireless network providers around the world. The company operates in 85 countries and has more than 40 manufacturing facilities. One of its three global headquarters is in Austin, Texas and it has a large factory in Pennsylvania.

In all, Gemalto produces some 2 billion SIM cards a year. Its motto is “Security to be Free.”

With these stolen encryption keys, intelligence agencies can monitor mobile communications without seeking or receiving approval from telecom companies and foreign governments. Possessing the keys also sidesteps the need to get a warrant or a wiretap, while leaving no trace on the wireless provider’s network that the communications were intercepted. Bulk key theft additionally enables the intelligence agencies to unlock any previously encrypted communications they had already intercepted, but did not yet have the ability to decrypt.

The details of just how the NSA hacked into Gemalto are quite a story -- and proves what a load of crap it is when the NSA and its defenders insist that they only target bad people. As former NSA (and CIA) boss Michael Hayden recently admitted, they actually like to spy on "interesting people." And who could be more interesting than the people who have access to the encryption keys on billions of mobile phones? So, yeah, the NSA and GCHQ basically spied on IT folks at the company until they found a way in. So, the NSA spies on "bad guys" and "IT people" for the good guys. Because, I'm sure they'll claim, it helps them get the bad guys. We've seen this before, when the GCHQ hacked into Belgian telco giant Belgacom, allowing them to tap into communications at the EU Parliament. Hacking into various companies appears to be standard operating procedures for the NSA/GCHQ these days, with no thought to the collateral damage being caused.

And, yes, both of these hacks basically involve giving the NSA an astounding amount of access to our electronic devices:

Leading privacy advocates and security experts say that the theft of encryption keys from major wireless network providers is tantamount to a thief obtaining the master ring of a building superintendent who holds the keys to every apartment. “Once you have the keys, decrypting traffic is trivial,” says Christopher Soghoian, the principal technologist for the American Civil Liberties Union. “The news of this key theft will send a shock wave through the security community.”

[....]

The U.S. and British intelligence agencies pulled off the encryption key heist in great stealth, giving them the ability to intercept and decrypt communications without alerting the wireless network provider, the foreign government or the individual user that they have been targeted. “Gaining access to a database of keys is pretty much game over for cellular encryption,” says Matthew Green, a cryptography specialist at the Johns Hopkins Information Security Institute. The massive key theft is “bad news for phone security. Really bad news.”

Between both of these big stories this week, it's clear that the NSA is basically deeply buried in pretty much every bit of electronic equipment these days, with the tools ready to go to spy on just about anything. The idea that this power isn't being abused regularly is pretty laughable.

Filed Under: certificate, encryption key, gchq, hacking, hard drives, malware, nsa, privacy, sim cards, spyware, surveillance
Companies: gemalto, samsung, seagate, toshiba, western digital

Spotify In A Box: Why Sharing Will Never Be Stopped

from the jukebox-of-alexandria dept

Most people will be familiar with Moore's Law, usually stated in the form that processing power doubles every two years (or 18 months in some versions.) But just as important are the equivalent compound gains for storage and connectivity speeds, sometimes known as Kryder's Law and Nielsen's Law respectively.

To see why, consider that the IBM PC XT had a 10 Mbyte hard drive when it was launched in 1983, which meant you couldn't even fit a single song on it. Similarly, the first widely-used modem, the 1981 Hayes Smartmodem, had a maximum speed of 300 baud: to transfer a digitized song using a dial-up connection would have taken around 500 hours.

With those kind of figures, it's easy to see why the recording industry underestimated the threat that file sharing would become once the Internet arrived: based on the past, it was almost inconceivable that people would ever swap music between computers. Of course, once that did start to happen, and the shape of the future became obvious to many, the industry nonetheless wilfully ignored the facts and the trends at every turn, when instead it should have taken the lead in re-inventing media for the Internet age.

That woeful history of refusing to accept the implications of rapidly-advancing technologies makes this prediction, found via Slashdot, even more fateful:

Technologies that will make it possible to expand disk density include heat-assisted magnetic recording (HAMR), which Seagate patented in 2006. Seagate has already said it will be able to produce a 60TB 3.5-in. hard drive by 2016.

Assuming Seagate or someone else delivers, that 60 terabyte hard disk could store around 10 million typical MP3 files. A year ago, Spotify was said to have 15 million tracks, which means that you could store most of today's Spotify on that future Seagate drive. Spotify is likely to grow even larger by 2016, but it probably won't grow as fast as the storage capacity of hard disks, so there will be some point in the not-too-distant future when you can place all of its holdings on a single hard disk: Spotify in a box.

Obviously, few people will choose to do that, but storing your favorite million songs will not only be realistic, it will be cheap -- and even portable. Provided the transfer rate to and from such disks also keeps up with the growth in capacities -- an indispensable technological requirement, otherwise they become impossible to use -- this means that people will be able to move around huge collections of music, without ever touching an Internet connection. That makes all those three-strikes plans moot, since you won't actually need your broadband line in order to swap files with friends. You'll just plug in your portable hard drives to a common computer and exchange stuff directly (as probably already happens with today's terabyte-sized portable disks.)

In an ideal world, we would also see a kind of constant scaling of the intelligence of the recording industry, such that by 2016 it would finally accept that trying to stop sharing -- whether online or off -- is simply pointless. Somehow, though, I think we'll just have to make do with the other variants of Moore's Law.

Follow me @glynmoody on Twitter or identi.ca, and on Google+

Filed Under: kryder's law, moore's law, nielsen's law, storage
Companies: hayes, ibm, seagate, spotify

Has Seagate Realized That Patent Infringement Lawsuits Won't Help It Stay Afloat?

from the probably-not...-but... dept

A year ago, we noted that Seagate's outspoken CEO, Bill Watkins, had admitted that if the company found it impossible to compete technologically with solid state drives, it would resort to patent infringement lawsuits. And... indeed, it did exactly that just a few weeks later, suing SSD provider STEC. So, it's a bit surprising to find out that Seagate has suddenly dropped the lawsuit entirely, with the rather odd excuse that the troubled economy has hurt STEC's business so much that it's not really selling enough infringing SSDs to matter. STEC, in response, suggests that Seagate actually realized it had no chance of winning the lawsuit -- which is probably true (though, that certainly hasn't stopped some patent holders from dragging out such lawsuits). However, given that it was Bill Watkins that was so gung ho in pursuing a patent litigation strategy, perhaps the real reason has something to do with Watkins getting fired in January. Maybe that means the new management actually would prefer to focus on innovating to build its business, rather than litigating to hold innovation down.

Filed Under: competition, innovation, patents
Companies: seagate, stec

Seagate Decides It Can't Compete With Solid State; Sues Over Patents

from the shows-how-comfortable-Seagate-is dept

Just a few weeks ago, we noted that Seagate's CEO appeared to be admitting that his company didn't have a real strategy to compete with the growing threat of solid-state flash drives competing against traditional hard drives. Instead, he said that if the competition got too hot, he'd just sue for patent infringement. Basically, he was admitting that he was planning to use patents in exactly the opposite of the way they were intended to be used. He'd use them to block an innovative new competitor, but only once that competition became serious enough. Apparently, Seagate believes that moment is now, as we're seeing more and more laptops hit the market with solid state drives, so Seagate has filed its first patent infringement lawsuit against a maker of the technology. Basically, the company is admitting that it can't actually compete or make a better product, so its strategy is to sue competitors. It's a pretty weak response, but thanks to our patent system, it may be perfectly legal (if exactly the opposite of what the patent system intended).

Filed Under: competition, hard drives, innovation, lawsuits, patents, solid state
Companies: seagate

Seagate: If Flash Drives Get Too Cheap, We'll Use Patents To Make Them Expensive

from the just-as-Thomas-Jefferson-intended dept

Back in 2005, we pointed out that Seagate's CEO, Bill Watkins, should be worried about the future of flash solid state drives (SSDs) eventually replacing hard drives. It's taken some time, but those SSDs are starting to show up in laptops like the MacBook Air and the Lenovo Thinkpad x300. Reader Nick Burns points out that Watkins appears to be singing the same old tune, with one slight adjustment. For the most part he's doing the "nothing to see here, flash drives are still too expensive" song and dance -- but people who understand the inevitable march of technology (and how the innovator's dilemma works) are finally pointing out flash is getting much cheaper very, very quickly. So what's Watkin's response? If SSDs get really cheap, he'll just sue everyone for patent infringement. Yes, even though SSDs are totally different technology than a standard hard drive, Seagate's holding on to patents that cover "many of the ways a storage device communicates with a computer." So, if solid state drives suddenly get popular, Watkins plans to sue. In other words, he'll use patents to stop the competition of a totally different technology. It's the same old story. When you're losing in the marketplace, sue for patent infringement. If you want to know the point at which Seagate has realized it's lost the battle, just look for when the infringement lawsuits come out. Just as Thomas Jefferson and James Madison envisioned.

Filed Under: bill watkins, flash drives, hard drives, patents, solid state
Companies: seagate

Seagate Hard Drives Came With Trojan Pre-Installed

from the no-extra-charge,-either dept

There have been plenty of stories this year about problems with Chinese manufacturing outlets, though, not many of them have touched on the technology industry. Now, however, Seagate is admitting that some of its hard drives that were made in China came with a trojan horse password sniffer pre-installed. It mostly targeted Chinese online games, but the one American game it included was the ever-popular World of Warcraft. On the plus side, the trojan also disables any other password stealing keyloggers that it finds. Seagate is now offering free copies of anti-virus software to customers impacted by this. In the meantime, experts suggest that you might want to format any new hard drives you get, just to be safe.

Filed Under: hard drives, trojans, world of warcraft
Companies: seagate

Another Good Patent Ruling: Standard For Willful Infringement Raised

from the courts-are-coming-to-their-senses dept

Just last week, we were talking about how the fear of being accused of "willful infringement" was once again distorting the purpose of the patent system. If you're found willfully infringing, rather than just accidentally infringing, the damages can be tripled. For that reason, many companies now have policies telling employees that they are not to search through patents, as any indication that they saw a specific patent could potentially be used as evidence of willful infringement. However, there is some good news on this front. The Against Monopoly blog points out that a new appeals court ruling has raised the bar on what is considered willful infringement to the point where the accuser must show "clear and convincing evidence that the infringer acted despite an objectively high likelihood that its actions constituted infringement of a valid patent." It's interesting to see this ruling come out of CAFC, the appeals court that handles patent cases. The Supreme Court has been slapping down CAFC decisions left and right lately, suggesting that it's unhappy with CAFC's previously lenient position on patents. Perhaps the folks at CAFC have gotten the message.

Filed Under: patents, willful infringement
Companies: seagate