The US Government Is Considering Drafting Middle-Aged Hackers To Fight The Cyberwar

from the could-not-have-found-a-worse-way-to-approach-its-personnel-problem dept

There's no time like the near future to be conscripted into military service. Due to citizens' declining interest in being personally involved in the government's multiple Forever Wars, the Commission on Military, National and Public Service is exploring its options. And one of the options on the table is removing restrictions on certain draftees (or volunteers) headed for certain positions in the armed forces.

Got hacking skills? Uncle Sam may want you for the U.S. Army—even if you’re far past traditional draft age.

The National Commission on Military, National and Public Service is seeking public feedback on a slew of possible changes to the way the government handles its selective service requirements, including drafting people with cyber skills regardless of their age or gender.

The commission study was directed by Congress in the 2017 version of the National Defense Authorization Act, an annual defense policy bill, and is due to Congress in 2020.

This expansion would net the government essential personnel needed to fight the still-undeclared Cyberwar. No matter your age or severity of bone spurs, the government might have a desk job for you. And you might not have a say in the matter. If the commission recommends a draft targeting key non-combat personnel, people in their thirties and forties might find themselves parachuting telecommuting into the war zone despite having careers in place elsewhere.

The key points of the Commission's directive [PDF] can be found in this paragraph.

Congress has specifically directed the Commission to consider:

“(1) the need for a military selective service process, including the continuing need for a mechanism to draft large numbers of replacement combat troops;

(2) means by which to foster a greater attitude and ethos of service among United States youth, including an increased propensity for military service;

(3) the feasibility and advisability of modifying the military selective service process in order to obtain for military, national, and public service individuals with skills (such as medical, dental, and nursing skills, language skills, cyber skills, and science, technology, engineering, and mathematics (STEM) skills) for which the Nation has a critical need, without regard to age or sex; and

(4) the feasibility and advisability of including in the military selective service process, as so modified, an eligibility or entitlement for the receipt of one or more Federal benefits (such as educational benefits, subsidized or secured student loans, grants or hiring preferences) specified by the Commission for purposes of the review.”

Congress may be looking to reinstate the draft. It seems we wouldn't need to "draft large numbers of replacement troops" if we weren't continually sending them off to foreign lands to get shot at or blown up. Scaling back our military presence might nip the draft idea in the bud, but with few exceptions, things have only escalated since September 11, 2001, rather than cooled down.

Dropping the age and sex requirement for other positions is wise, but it quickly becomes foolhardy once it's no longer voluntary. The reason the government can't keep the military stocked is it's done all it can over the past 50 years to destroy Americans' faith in it. Things went south reputationally during the Vietnam War, which is the last time the draft was in place. A bungled "military action," punctuated by atrocities, extended for purely political reasons, and ended with what one could generously call a "tie," did little to warm the hearts of American citizens. The years since then have seen "wars on" various ideas declared, with no definitive enemy or endpoint. There's not a lot of enthusiasm left for joining the world's police force, especially when threats to American way of life shift with White House regime changes. The rebels we once sold arms to are now a terrorist organization in need of stomping out by boots on the ground.

That dovetails into the second task of the Commission: "fostering a greater attitude and ethos of service." This is the government's fault and the government needs to fix it. It won't be able to do it overnight or even in time to rustle up a bunch of "replacement troops" to send to whatever area of the world is in need of gunpoint democracy. I'm sure the final report may have something to say about millennials failing to adopt the ethos and pro-American enthusiasm of their generational predecessors, but who could blame them? The Social Security safety net will have dried up before they have a chance to access it and their economic future is in the hands of malicious actors the government has never shown an interest in punishing. (See every administration ever vs. "too big to fail.")

Knowing this ship won't be righted easily may prompt the Commission to suggest something no one would imagine being enacted here. A few pages down, the Commission asks a bunch of questions of itself -- one that would appear to answer another one, but with a "solution" most commonly found in totalitarian dictatorships.

(1) Is a military draft or draft contingency still a necessary component of U.S. national security?

(2) Are modifications to the selective service system needed?

(3) How can the United States increase participation in military, national, and public service by individuals with skills critical to address the national security and other public service needs of the nation?

(4) What are the barriers to participation in military, national, or public service?

(5) Does service have inherent value, and, if so, what is it?

(6) Is a mandatory service requirement for all Americans necessary, valuable, and feasible?

(7) How does the United States increase the propensity for Americans, particularly young Americans, to serve?

Yes, one sure way to "increase participation" is to mandate participation via a draft. Another way is to make it mandatory across the board for all citizens, making the draft redundant. Neither of these efforts will solve other problems like "fostering a greater attitude or ethos of service." If either of these are enacted, the military will be full of people who don't want to be there and who won't have their eye on anything other than the calendar. This will only exacerbate the military's current issues. The only thing it addresses is the need for periodic infusions of cannon fodder.

The cyberwar the government has been gearing up to fight for most the last decade will be another Forever War. Even if it's a bloodless battle, it will be far from harmless. The government already makes policy decisions based on highly-speculative attribution. In the future, it will engage in both cyberwar and conventional war using the same information. There won't be bodies to bury, but someone's going to end up taking out the wrong critical infrastructure or targeting the wrong critical government entity based on political wind shifts. A steady infusion of keyboard warriors may sound like a good idea, but displacing people and uprooting their lives to act on political whims won't restore faith in the US of A. No one's going to be throwing parades for cyberveterans marching home with college money and participation ribbons. And if the tech side of the military industrial complex thinks it already has a problem with insider threats, just wait till it's mostly composed of people who have been pressed into service against their will.

Filed Under: cyberwar, draft, hackers

Senate IT Tells Staffers They're On Their Own When It Comes To Personal Devices And State-Sponsored Hackers

from the not-the-best-way-to-handle-an-impossible-situation dept

Notification of state-sponsored hacking attempts has revealed another weak spot in the US government's defenses. The security of the government's systems is an ongoing concern, but the Senate has revealed it's not doing much to ensure sensitive documents and communications don't end up in the hands of foreign hackers.

The news of the hacking attempt was greeted with assurances that nothing of value was taken.

That gap in security was brought front and center for Senate IT staffers on Jan. 12, when cybersecurity firm Trend Micro announced findings that seven months earlier, the same Russian government hacking group responsible for hacking Democratic Party targets in 2016 had created a phishing campaign that specifically targeted Senate staffers’ emails.

There’s no indication that the attempts were successful, and Trend Micro immediately alerted the FBI and the Office of the Sergeant at Arms, the agency responsible for Senate security, the firm said. Hours after Trend Micro’s report, multiple Senate staffers told BuzzFeed News, the sergeant-at-arms called a private meeting of Senate IT personnel to assure them that there was no real threat, as it had blocked the avenues the hackers would have tried to use.

It blocked those avenues, but Senate IT left a lot of avenues wide open. According to the Buzzfeed report, those in this meeting were told the protections offered would not include personal devices or email accounts. This makes some sense, as personnel have a responsibility to ensure their devices/accounts are as secure as possible if they're going to be using them for government work.

Laws and policies have been put in place to deter people from taking their sensitive work home with them. But they address a problem government agencies often exacerbate by treating employees as always on duty, even where they're off the clock. Multiple top government officials have been caught storing sensitive documents on private devices or in private accounts. Hillary Clinton underwent an FBI investigation because of this. Two years ago, a teenage hacker got a hold of documents detailing US military operations by gaining access to the CIA director's AOL account.

So, drawing a line at personal devices seems like the right thing to do, but only if you ignore the attack vectors left open by this policy. Even banning personal devices from government offices has its problems -- going far beyond the fact that this policy is pretty much unenforceable when there are thousands of staffers to keep an eye on.

Reached for comment, a sergeant-at-arms representative declined to give a formal statement, but told BuzzFeed News that its cybersecurity team’s specific directive is to protect Senate email accounts and Senate-issued devices.

But that could be a problem if a Senate staff member – there are thousands – uses a Senate device to also access personal email. If the staffer downloads a malicious program from personal email on a Senate-issued computer, that program could gain access to the device.

So… I don't know… throw the CFAA at them? [I'm joking, DOJ. Please don't do this.] There's no great solution to this problem. You can push the responsibility back on the person who became the attack vector but that just leaves sensitive government systems as weak as the weakest person with access. And employees should rightfully be wary of government attempts to "secure" devices and accounts, which could lead to lots of snooping into non-government communications.

It's impossible to secure everything but Senate IT shouldn't be so quick to wall off personal devices and accounts. Ignoring attack vectors doesn't solve the problem. Consistent enforcement of policies governing the handling of sensitive documents and communications might reduce the chances of a breach. But the problem remains the government's to deal with. As a former White House staffer notes in the article, the tools government employees need to do their jobs effectively aren't all supplied by the government. Many are supplied by third parties and may only run (or run well) on personal devices. The government can't be expected to be all things to all employees, but maybe it should consider extending its protective services to the devices and accounts it unofficially expects staffers to use.

Filed Under: encryption, hackers, it, privacy, security, senate, surveillance

FTC Advice On How To Deal With Equifax Hack: Er... Race The Hackers To Filing Your Taxes Before They Do

from the what-the-actual-fuck dept

So, yes, by now you know all about the whole Equifax hack and how really, really terrible it is. Lots of sites have been posting various stories about what you should do about it, when the truth is you really can't do much. A lot of people are likely going to deal with an awful lot of bad stuff almost entirely because of this leak by Equifax. Not surprisingly, the FTC has weighed in with some suggestions, most of which won't actually help very much. Most of them are the standard suggestions everyone's giving -- including checking your credit reports, putting a credit freeze on your files and basically watching very closely to see if you're fucked over by whoever has access to these files.

But the FTC's very last suggestion is the one I wanted to focus on today. It's basically "um, well, maybe try to file your tax returns early next year, so you beat hackers trying to do the same?"

File your taxes early — as soon as you have the tax information you need, before a scammer can. Tax identity theft happens when someone uses your Social Security number to get a tax refund or a job. Respond right away to letters from the IRS.

As someone who has been a victim of someone filing fake tax returns to try to get your refund, it's a really shitty process to go through. The problem here, though, is the whole setup of our tax system, which makes it pretty damn easy for someone to fake your tax returns -- now made even easier thanks to this breach. If the FTC really wanted to help, it should be pushing for a complete overhaul of how tax filing works, such that merely knowing your Social Security Number and address isn't enough to file tax returns in your name. Among the many problems here, it starts with the idiotic idea that we use SSNs as an identity tool -- but there's also the fact that we continue to have the IRS force every American to play a guessing game with their taxes just to keep tax prep companies like Intuit and H&R Block happy.

I recognize that the FTC isn't directly in a position to fix this, but the fact that it's best suggestion is "race the hackers to filing your tax returns and hope you get there first" should highlight just how totally fucked up our income tax system is in the US.

Filed Under: ftc, hackers, social security numbers, tax returns
Companies: equifax

Hacker Extortion Attempt Falls Flat Because Netflix Actually Competes With Piracy

from the sound-and-fury,-signifying-nothing dept

A hacking group calling itself TheDarkOverlord (TDO) has tried, and failed (so far) to extort Netflix and several other companies after stumbling onto a server of unreleased content. TDO was apparently able to compromise the servers of an audio post-production company by the name of Larson Studios. Among the content acquired from the hackers were ten episodes of the as-yet-unreleased new season of the popular Netflix show "Orange is the New Black," which isn't supposed to see full release until June. Outside of some free advertising in the news media and some wasted calories, the group's efforts don't appear to have culminated in much.

At first, the hacking group tried to extort the post-production company, which didn't go very well. The group claims that Larson originally agreed to pay 50 bitcoin (around $67,000) to prevent the release of the compromised content, but then didn't follow through on the payment after a December 31 deadline. TorrentFreak claims they were shown a copy of a contract purportedly signed by Larson Studios, but the group claims that while the contract was printed, signed, scanned and returned to them, Larson got cold feet about paying up.

The hacking group then shifted its attention to trying to get Netflix to pay up to avoid public release of the episodes. After apparently getting no initial response from the giant streaming company, the hacking group announced on Twitter it had leaked the first episode in the new, as-yet-unreleased fifth season of "Orange is the New Black" on BitTorrent networks:

When Netflix didn't respond to that, the group proceeded to release ten episodes of the show's 13-episode season, and an already deleted message via Pastebin claiming Netflix would lose significantly more money if the company didn't pay up:

"It didn’t have to be this way, Netflix. You’re going to lose a lot more money in all of this than what our modest offer was. We’re quite ashamed to breathe the same air as you. We figured a pragmatic business such as yourselves would see and understand the benefits of cooperating with a reasonable and merciful entity like ourselves."

Netflix's response to the entire affair? A giant..."meh":

“We are aware of the situation. A production vendor used by several major TV studios had its security compromised and the appropriate law enforcement authorities are involved."

That's a notably calmer and more reasoned response than you usually see from traditional Hollywood operations after a leak (read: pouting, crying, lawsuits, hysteria and face-fanning). In large part because Netflix knows that it's extremely unlikely that users are going to cancel their Netflix subscription just because of an early, partial leak of the show's upcoming fifth season. That, in turn, is largely because Netflix's flat-rate, relatively-inexpensive pricing model provides enough value that users don't find piracy to be the superior alternative (read: they successfully compete with piracy).

Its ambitions quashed by Netflix's apathy, the hacking group is apparently moving on, and says it plans to now target other companies (ABC, Fox, National Geographic and IFC) whose content was also found on the compromised server:

Outside of some short-lived infamy and a few spoilers, it doesn't seem likely that any of the group's efforts will amount to much of anything.

Filed Under: business models, competition, copyright, hackers, leaks, piracy, streaming
Companies: netflix

Whistleblower Says UK Police Worked With Hackers To Access Activists' Email Accounts

from the redefining-'terrorism,'-one-abuse-at-a-time dept

Here come even more revelations of surveillance abuse by UK law enforcement. To date, various law enforcement agencies have been exposed as participating in very broad readings of very broadly-written anti-terrorism laws to spy on journalists and activists. The latest abuse detailed by The Guardian concerns the surveillance of activists by UK law enforcement on behalf of a foreign government.

The police watchdog is investigating allegations that a secretive Scotland Yard unit used hackers to illegally access the private emails of hundreds of political campaigners and journalists.

The allegations were made by an anonymous individual who says the unit worked with Indian police, who in turn used hackers to illegally obtain the passwords of the email accounts of the campaigners, and some reporters and press photographers.

[...]

Hacked passwords were passed to the Metropolitan police unit, according to the writer of the letter, which then regularly checked the emails of the campaigners and the media to gather information. The letter to Jones listed the passwords of environmental campaigners, four of whom were from Greenpeace. Several confirmed they matched the ones they had used to open their emails.

This is more of the same for any UK agencies with access to surveillance tools and easily-abusable laws. These complaints are adding to the pile sitting in front of the Independent Police Complaints Commission. Not that the Commission will ever get to the bottom of this, as it's finding its oversight being thwarted by the agencies it's assigned to oversee.

Last month the IPCC said it had uncovered evidence suggesting the documents had been destroyed despite a specific instruction that files should be preserved to be examined by a judge-led public inquiry into the undercover policing of political groups.

The letter claimed that the shredding “has been happening for some time and on a far greater scale than the IPCC seems to be aware of”. The author added that “the main reason for destroying these documents is that they reveal that [police] officers were engaged in illegal activities to obtain intelligence on protest groups”

It's unclear what the Indian police -- who used hackers to obtain account passwords -- were looking for or why they turned to Scotland Yard for assistance. Those whose accounts were accessed were far from dangerous individuals. Although the activists may be vehemently opposed to UK government policies and the actions of several major corporations, the worst of the worst of those confirmed to be surveilled did 80 hours hard time community service stemming from an incident where unwanted solar panels were forcibly installed on a deputy prime minister's house.

Presumably, the valuable info snagged from hacked accounts gave police on both sides heads up on planned demonstrations, as well as any other non-protest-related conversations the activists might have had. Considering what flows into the average email account, police could have gained access to financial transactions, medical information, and conversations between activists and those with zero interest in making the world a subjectively better place.

Fortunately, the documentation backing up the hacking accusations is still in the hands of repentant hackers, rather than headed for the Scotland Yard shredder.

Filed Under: activists, hackers, scotland yard, uk

Top UK Cop Says Hackers Should Be Punished Not With Prison, But With Jammed WiFi Connections

from the yeah,-that'll-work dept

Here's a story that starts out well. One of the UK's top police officers, Chief Superintendent Gavin Thomas, has said that putting people in prison for offenses like hacking into computers makes no sense. He points out that it costs around $50,000 a year to keep someone in a traditional prison, and that education programs are likely to be a far more cost-effective solution, especially in terms of reducing recidivism. This is absolutely right, and it's great to hear a senior officer admit it. Unfortunately, things go downhill from here. He told the Telegraph:

If you have got a 16-year-old who has hacked into your account and stolen your identity, this is a 21st century crime, so we ought to have a 21st century methodology to address it.

His solution is as follows:

He said convicted criminals could be fitted with electronic jammers around their wrists or ankles which blocked wifi signals and prevented them from going online.

Leaving aside the human rights implications, which to his credit Thomas acknowledges, there is another big problem with the proposal, as Techdirt readers have doubtless already spotted. The people wearing these WiFi jammers would be those who have been found guilty of some computer-related crime. By definition, then, they are likely to be tech-savvy. So they probably have other computers that can use Ethernet connections to access the Internet. In addition, they are unlikely to have any problems using Bluetooth or a USB cable to reverse-tether their mobiles to a system with wired access. The more adventurous might even try to rig up some kind of Faraday shielding to jam the jammer. In other words, this isn't going to work, but would probably cause havoc with everyone else's WiFi connections.

Back in 2015, Thomas was quoted by Computer Business Review on the topic of encryption, and the problems it posed for the police, when he said:

It is utterly essential for detectives and criminal investigators to use data held on smartphones and other devices when they are investigating serious crimes.

Given his belief that jamming bracelets would stop convicted computer criminals from using the Internet, the worry has to be that he shares the mistaken view that tech companies can create a safe system of crypto backdoors or "golden keys" that only the authorities can use. Let's hope he takes some expert advice before offering an opinion on that one.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: access, gavin thomas, hackers, jail, law enforcement, punishment, uk, wifi

NYPD Says Releasing Basic Stingray Contract Info Will Result In A Supercriminal Apocalypse

from the some-prime-ass-talking-going-on-here dept

Secrecy still continues to shroud law enforcement Stingray use, in large part because courts have been far too receptive to the government's insistence that the release of any details at all would result in the expensive tech being rendered instantly useless.

The NYPD has decided to go past the usual "law enforcement means and methods" obfuscatory tactics and push a rather novel narrative about why it would be "dangerous" for IMSI catcher info to make its way into the public domain. (I mean more so… I guess.)

Joseph Cox of Motherboard reports the NYPD's latest opacity play involves hoodie-wearing males operating laptops in underlit rooms and comic book supervillain-esque levels of coordinated criminal activity.

In a recent case, the New York Police Department (NYPD) introduced a novel argument for keeping mum on the subject: Asked about the tools it uses, it argued that revealing the different models of IMSI catchers the force owned would make the devices more vulnerable to hacking.

In the words [PDF] of the NYPD's Gregory Antonsen, hackers would be able to crack open Stingrays like OPM records if the department were to turn over Harris Corp. contract info and nondisclosure agreements to the New York branch of the ACLU in response to its FOIL request. Also: terrorism.

The purpose of this affidavit is to explain the reasons that disclosing the Withheld Records would cause grave damage to counterterrorism and law enforcement operations, and so could endanger the lives or safety of New Yorkers.

Additionally, disclosing the Withheld Records would reveal confidential and non-routine criminal investigative techniques, which would hamper ability to conduct operations and would permit perpetrators to evade detection. Moreover, disclosure of the Withheld Records would jeopardize the ability of NYPD to secure its information technology assets.

After detailing the use of Stingrays to perform a variety of heartwarming investigations (tracking down a missing elderly person, rescuing someone from sex trafficking, etc.), Antonsen gets down to business. According to the NYPD's theory, any information released about the NYPD's IMSI catcher contracts could be "scrutinized" by bad guys who would be able to infer from extremely limited information the extent of the department's cellphone-tracking capabilities. It's basically the mosaic theory, but without the mosaic.

But the far stupider assertion is the one made without any supportive citations -- just a far-fetched hypothetical.

The CSS technologies are also critical and essential information technology assets. As such, all CSS technologies require periodic software updates. Public disclosure of the specifications of the CSS technologies in the NYPD's possession from the Withheld Records would make the software vulnerable to hacking and would jeopardize ability to keep the technologies secure. Of great concern is that a highly sophisticated hacker could use the knowledge of CSS technologies to invade the CSS software undetected, thus creating a situation in which law enforcement personnel are lured into a situation based on a misleading cell-phone location and are then trapped and ambushed.

The ACLU's Chris Soghoian has responded [PDF] to the NYPD's assertions. As to the claims that providing contract information would somehow result in sophisticated criminals finding ways to route around this surveillance, Soghoian points out that every Stingray device -- no matter its capabilities -- can be defeated by even the dumbest thug… and all without having to scour a redacted invoice for clues.

The most effective countermeasure, which can be used by anyone at no cost is to simply turn off a phone or put it into airplane mode. This will thwart tracking by any model of Stingray. Knowing the models of Stingrays that the NYPD uses does not make this countermeasure more or less effective. It is 100% effective regardless of which models of Stingrays the NYPD uses.

Soghoian went easy on the "but criminals will beat our IMSI catchers" argument. The "but we'll be hacked" argument is treated with all the respect it deserves: none.

It would be a serious problem if the costly surveillance devices purchased by the NYPD without public competitive bidding are so woefully insecure that the only thing protecting them from hackers is the secrecy surrounding their model names.

He also chides the NYPD for making claims the federal government isn't even willing to make.

The Harris Corporation, which in addition to manufacturing Stingrays has been awarded public contracts for securing the President's communications and supplying secure radios used by the U.S. Army, is clearly capable of designing secure products for its government customers that does not rely on keeping secret the mere existence of the devices for their security.

Soghoian also points out that the release of other information would similarly have zero effect on the devices' capabilities. Because they spoof cell towers, it does criminals no good to know how many the NYPD has or even where they tend to deploy them. A cellphone can't tell it's connected to a BS "tower." And just because the NYPD may be more likely to deploy them in certain areas does not guarantee that avoiding those areas will allow criminals to avoid detection.

And this wonderful paragraph snarkily deflates the NYPD's paranoid ravings its tech officers deploy as justification for continued secrecy.

Inspector Antonsen also claims that knowing the number of Stingrays owned by the NYPD may enable an extremely well-resourced criminal group to orchestrate a greater number of simultaneous hostage situations than the number of Stingrays available to the NYPD. Even assuming that such a sophisticated criminal group made the unlikely decision to rely on its knowledge of the number of Stingrays in the possession to use cell phones in executing such a hypothetical event, knowing that number will not help them as it is almost certainly the case that one, if not multiple, federal law enforcement agencies would step in and assist the NYPD with their own cellular surveillance technology. Moreover, this hypothetical is no different from saying that at some point some criminal group may be able to overwhelm the number of police cars that the NYPD owns or the number of police officers on the force.

It's hard to believe law enforcement is still throwing out these tired arguments after nearly a decade of incremental exposure of Stingray information. The NYPD wants publicly-available information (Stingray names, suggested retail prices) to somehow be the first cat successfully stuffed back into the bag. Since it has no legitimate arguments to justify this cat stuffing, tech officers are resorting to hypothetical scenarios even the most-handwavingest of sci-fi writers wouldn't feel comfortable inserting into their speculative fiction.

Filed Under: criminals, foia, hackers, imsi catcher, nypd, stingray, transparency

FBI Says Foreign Hackers Got Into Election Computers

from the well,-that's-just-great dept

We've written probably hundreds of stories on just what a dumb idea electronic voting systems are, highlighting how poorly implemented they are, and how easily hacked. And, yet, despite lots of security experts sounding the alarm over and over again, you still get election officials ridiculously declaring that their own systems are somehow hack proof.

And now, along comes the FBI to alert people that it's discovered at least two state election computer systems have been hacked already, and both by foreign entities.

The FBI has uncovered evidence that foreign hackers penetrated two state election databases in recent weeks, prompting the bureau to warn election officials across the country to take new steps to enhance the security of their computer systems, according to federal and state law enforcement officials.

The report apparently noted that Arizona and Illinois were the two states whose systems were exploited -- with both attacks coming from the same IP addresses. From the report, it does not look as if the hacks were specifically about modifying vote totals, but rather accessing voter registration data -- but that's still a pretty big concern.

In response, the Department of Homeland Security has apparently reached out to state election officials offering "help" in better securing their election systems. Doesn't it seem a bit late for them to start securing their systems now? And, of course, it's not like DHS is somehow a great at stopping hackers either. It wasn't so long ago that a 16-year-old kid using the online handle "penis" was able to hack DHS's computer systems.

Maybe, just maybe, people in charge of elections in America should have considered some of this, I dunno, two decades ago when people first raised the issues about vulnerabilities in election systems.

Filed Under: cybersecurity, dhs, e-voting, fbi, foreign hackers, hackers, homeland security, security

Volkswagen Created A 'Backdoor' To Basically All Its Cars... And Now Hackers Can Open All Of Them

from the backdoors-are-bad-m'kay? dept

And... for our latest example for why requiring companies to build backdoors into encryption or similar technologies is a bad idea comes from automaker Volkswagen. Researchers are now revealing that approximately 100 million VW vehicles can be easily opened via a simple wireless hack. The underlying issue: a static key used on basically all of the wireless locks in VWs.

The researchers found that with some “tedious reverse engineering” of one component inside a Volkswagen’s internal network, they were able to extract a single cryptographic key value shared among millions of Volkswagen vehicles. By then using their radio hardware to intercept another value that’s unique to the target vehicle and included in the signal sent every time a driver presses the key fob’s buttons, they can combine the two supposedly secret numbers to clone the key fob and access to the car. “You only need to eavesdrop once,” says Birmingham researcher David Oswald. “From that point on you can make a clone of the original remote control that locks and unlocks a vehicle as many times as you want.”

In other words, VW created a backdoor, and assumed that it would remain hidden. But it did not.

This is exactly the kind of point that we've been making about the problems of requiring any kind of backdoor and not enabling strong encryption. Using a single encryption key across every device is simply bad security. Forcing any kind of backdoor into any security system creates just these kinds of vulnerabilities -- and eventually someone's going to figure out how they work.

On a related note, the article points out that the researchers who found this vulnerability are the same ones who also found another vulnerability a few years ago that allowed them to start the ignition of a bunch of VW vehicles. And VW's response... was to sue them and try to keep the vulnerability secret for nearly two years. Perhaps, rather than trying to sue these researchers, they should have thrown a bunch of money at them to continue their work, alert VW and help VW make their cars safer and better protected.

Filed Under: backdoors, cars, encryption, hackers, research
Companies: volkswagen

Car Hack Demonstrates Why Security Researchers Shouldn't Have To Worry About Copyright In Exposing Weaknesses

from the copyright-where-it-doesn't-belong dept

So, by now you've heard the story of how Wired reporter Andy Greenberg allowed two car hackers to hack into a car that he was driving, remotely, while he was on a highway. The story is getting plenty of well-deserved attention, with some people raising a variety of concerns. The most obvious concern is the "holy hell, that seems scary, we should improve car security." And that's true. A second level of concern is over whether or not that experiment on a real highway was appropriate, given the very real potential of danger (including the truck that almost hit Greenberg). A third concern is over the reality of the threat, given that Greenberg was driving a car owned by the hackers, that they had the ability to touch previously (i.e. the "remote" part of the hack sounds scary, but it's less scary if hackers have to get into your car first).

However, the part that I wanted to focus on is related to a discussion we were just having a few weeks ago, in which General Motors (which was not the target of this particular hack) claimed that any sort of tinkering with their software, such as to discover these kinds of security holes, should be considered copyright infringement, thanks to Section 1201 of the DMCA. Section 1201, also known as the anti-circumvention provision, says circumventing "technological protection measures" (TPMs) -- even for reasons that have nothing to do with copyright -- should be deemed copyright infringement and subject to all the statutory damages (up to $150k per violation!) that copyright allows. Some have been pushing for an exemption for things like security researchers tinkering with new connected car systems to make sure they're safe. And GM and other automakers have said "no way." GM's argument is, more or less, that the company would prefer to put its head in the sand, and not have security researchers help it discover security flaws in its systems -- leaving only malicious attackers to find those.

While proponents such as Electronic Frontier Foundation characterize the exemption as merely allowing the vehicle owners to “tinker” with their vehicles “in a decades-old tradition of mechanical curiosity and self-reliance,” if granted, the proposed exemption could introduce safety and security issues as well as facilitate violation of various laws designed specifically to regulate the modern car, including emissions, fuel economy, and vehicle safety regulations.

Of course, copyright is not the right law to be relying on if you think that tinkering with your software could lead to safety problems. Instead, it seems to be the law that automakers are relying on to try to hide some of the security vulnerabilities in their cars.

The Association of Global Automakers goes even further with its argument, basically saying that since they already let security researchers of their own choosing do research, no one else should be able to do that research also:

Automobile manufacturers are not adverse to external input and have a long and symbiotic history with aftermarket businesses and others, but are justifiably unwilling to risk public safety, security, and environmental wellness by compromising quality controls and oversight. Moreover, the exemption is unnecessary given that automobile manufacturers already provide access to their valuable copyrighted materials for the precise purposes proposed. By allowing every automobile owner to access and copy automotive software in the name of research, the proposed exemption undermines existing research efforts and, ultimately, wrests control of such research from those in the best position to actually improve the security and safety of our automobiles: the automobile manufacturers and their suppliers, who have the utmost responsibility to ensure that vehicles are safe and secure. The very real risk that ostensibly legitimate research unwittingly undermines vehicle security by serving as a guidebook to software vulnerabilities that enables or even accelerates illicit hacking and malicious modifications to automotive software weighs heavily against the proposed exemption. The balance of benefit versus detriment, in view of all factors involved, simply dictates against the proposed exemption.

In short, since security researchers might find a really serious hole in our software that might put lives in danger, we're much better off using copyright law to make sure no one's even looking for such a hole. Are they serious? Wouldn't it be much better to give people incentives to find these kinds of security flaws so the automakers can fix them rather than relying on security-by-head-in-the-sand?

Finally, the Alliance of Automobile Manufacturers also opposed the exemption for some fairly bizarre reasons, claiming that it would magically free up researchers to disclose how a vulnerability works without first informing the manufacturer:

By arguing that the current legal landscape is too treacherous for independent researchers, proponents are in effect seeking to be freed from existing statutory constraints that are biased in favor of prudent and responsible practices – such as managing disclosure of security vulnerabilities to minimize the risk of legal violations and exploitation of those vulnerabilities by bad actors – to protect the safety and security of members of the public. For instance, under the proposed exemption, researchers who publish detailed analyses of vulnerabilities before sharing their findings with manufacturers would nonetheless benefit from a blanket exemption to circumvention liability, even though such premature publication could dramatically increase the risk of such harmful exploitations.

This is bullshit. There is nothing in removing the liability for circumvention that changes industry best practices of first alerting the manufacturer. That would still be standard practice. What it would do, however, is stop those manufacturers from responding by threatening a ridiculous copyright infringement lawsuit instead of realizing they need to fix a real problem in their systems. And if the automakers don't think such threats happen, we've got plenty of examples to send their way.

If the automakers are serious about wanting to make sure their cars on the road are safe, they should be encouraging this kind of research (though perhaps not on actual highways... ). But the fact that copyright law is blocking some of this kind of research is a real travesty.

Filed Under: 1201, anti-circumvention, automotive, car, copyright, dmca, hack, hackers
Companies: chrysler, gm