FBI Won't Tell Me How Much It Paid To Break Into Syed Farook's iPhone, Saying It Might Jeopardize Its Investigation

from the say-what-now? dept

As you probably recall, several months ago, after going to court to try to force Apple to write some software to allow the FBI to hack into Syed Farook's work iPhone, the DOJ and FBI abruptly called off the case, claiming that it had been able to get an exploit that let it into the phone. A few weeks later, FBI Director James Comey suggested that the government paid over $1.2 million to get that exploit from some "hackers." Some later news reports indicated that the FBI quietly tried to talk down those numbers, and suggested that perhaps Comey was just bad at math (rather than name a number, he said that the FBI had paid "more than I will make in the remainder of this job, which is seven years and four months....").

Either way, I sent a FOIA request into the FBI that day asking for either the invoice or any other documentation showing how much the FBI had paid to get into Farook's work iPhone. The FBI has now rejected my FOIA request, arguing that since this is an "ongoing investigation," responding to such a request might somehow "interfere" with the case. This is complete hogwash, for a variety of reasons. First, Farook is dead. Second, what investigation is there left to do? We know that Farook and his wife shot up Farook's office party and killed a bunch of people. We also know that the FBI was so unconcerned about further investigation that it allowed reporters to ransack Farook's townhouse soon after the shooting. Third, how the hell would revealing the price impact the investigation? The answer is that it will not. There is nothing in saying "it cost us $1 million" or "it cost us $653,000" or whatever, that in any way interferes with whatever investigation remains to be done.

This is nothing more than the FBI doing what the FBI frequently does with FOIA requests. Denying them because the FBI doesn't want to answer.

Filed Under: exploit, fbi, foia, iphone, james comey, syed farook, vulnerability

EFF Sues NSA Again Over Failure To Release Procedures For Dealing With Zero Days

from the eff-may-need-a-whole-floor-devoted-to-nsa-lawsuits dept

Another day, another lawsuit filed by the EFF against the NSA. As you may recall, back in April there was some discussion about how the NSA deals with zero day exploits it discovers, and (specifically) whether or not it reveals them to relevant parties or keeps them for its own ability to exploit them. The NY Times revealed that President Obama had put in place an official rule that said the NSA should have a "bias" towards revealing the flaws, but left open a gaping loophole in saying the NSA could exploit those zero days for "a clear national security or law enforcement need." That's a pretty big loophole -- especially when you consider how law enforcement has been abusing every opportunity of late.

EFF filed a FOIA request to find out about the NSA's process for determining whether to exploit or reveal a zero day... and hasn't received a response, despite a promise by the government to "expedite" the request. Hence: the new lawsuit.

"This FOIA suit seeks transparency on one of the least understood elements of the U.S. intelligence community's toolset: security vulnerabilities," EFF Legal Fellow Andrew Crocker said. "These documents are important to the kind of informed debate that the public and the administration agree needs to happen in our country."

Over the last year, U.S. intelligence-gathering techniques have come under great public scrutiny. One controversial element has been how agencies such as the NSA have undermined encryption protocols and used zero days. While an intelligence agency may use a zero day it has discovered or purchased to infiltrate targeted computers or devices, disclosing its existence may result in a patch that will help defend the public against other online adversaries, including identity thieves and foreign governments that may also be aware of the zero day.

"Since these vulnerabilities potentially affect the security of users all over the world, the public has a strong interest in knowing how these agencies are weighing the risks and benefits of using zero days instead of disclosing them to vendors," Global Policy Analyst Eva Galperin said.

These days, it really does seem that the only way to get the government to cough up these kinds of documents is to file a lawsuit, which really defeats the purpose of the whole FOIA process. Perhaps the government should just admit it's a charade and let people go straight to the lawsuit filing process instead.

Filed Under: cybersecurity, exploit, foia, james clapper, nsa, odni, surveillance, zero days
Companies: eff

Smart TV Exploit Means Hackers Can Watch You Watch TV

from the i-spy-with-my-little-eye dept

Remember all the hubbub (now there's a word I never thought I'd use; thanks a lot, aging process) over Comcast's kind of, maybe plan to spy on subscribers through their cable box as they watch TV, fold their laundry, or engage in coitus? There was quite an outcry at the time, even as Comcast said that the plan was only to have the cameras be able to recognize when different types or numbers of people were watching the tube. People just didn't feel comfortable with corporations being able to spy on them. As a result, Comcast backed away from the plan -- the people had defeated the corporation.

All, apparently, so that hackers could spy on them instead. At least, that's what some reports are saying about Samsung Smart TVs and an exploit that would allow hackers to snatch social media credentials, access any files or devices connected to the smart TV...oh, and to use the built in cameras to spy the hell out of people as they do whatever they do while watching television.

In an e-mail exchange with Security Ledger, the Malta-based firm said that the previously unknown ("zero day") hole affects Samsung Smart TVs running the latest version of the company's Linux-based firmware. It could give an attacker the ability to access any file available on the remote device, as well as external devices (such as USB drives) connected to the TV. And, in a Orwellian twist, the hole could be used to access cameras and microphones attached to the Smart TVs, giving remote attacker the ability to spy on those viewing a compromised set.

The group that reportedly discovered the vulnerability, ReVuln, proudly stated that they would not publish any information about what they'd uncovered except to paying subscribers because screw everyone else (not an actual quote). They also have a company policy, apparently, that would prevent them from working with Samsung directly on a fix or even to disclose the hole, leading me to reach the logical conclusion that Dr. Evil is apparently running that company.

Even more fun, thanks to how Samsung designed the product, chances are any fix that could be produced would be difficult to implement.

Currently, the Smart TVs offer no native security features, such as a firewall, user authentication or application whitelisting. More critically: there is no independent software update capability, meaning that, barring a firmware update from Samsung, the exploitable hole can't be patched without "voiding the device's warranty and using other exploits," ReVuln said.

The company posted a video of an attack on a Samsung TV LED 3D Smart TV online. It shows an attacker gaining shell access to the TV, copying the contents of its hard drive to an external device and mounting them on a local drive, providing access to photos, documents and other content. ReVuln said an attacker would also be able to lift credentials from any social networks or other online services accessed from the device.

In other words, customers get to wait around until Samsung can figure this thing out on their own, since ReVuln won't help them out by company policy, or risk voiding their warranty on their smart TV that has a complete lack of security features. Nicely done, everyone involved.

Filed Under: exploit, hacks, smart tv, spying, tv
Companies: samsung

Exploit On Hadopi Site Turns It Into Pirate Bay Supporter

from the guilty-until-proven-innocent dept

Hadopi, the French agency set up to enforce France's three strikes and you're kicked off the internet policy, apparently isn't very good at securing their own website. Someone found a simple XSS vulnerability and set up a page where Hadopi was promoting the Pirate Bay with an integrated search. Of course, lots of sites end up with XSS vulnerabilities. It's often tough to avoid them (and yes, we've been caught with them a few at times). But, the reason why this is especially ironic is that part of Hadopi's position is that if you fail to secure your internet access point, you're still liable for the actions of users on that access point. Thus, it's not a stretch to argue that Hadopi is, by its own rules, liable for any infringement that may have occurred via its own site, right? Perhaps Hadopi should kick itself off the internet.

Filed Under: exploit, hadopi, xss
Companies: hadopi, the pirate bay

Does It Make Sense To Ban Players From Xbox Live Just For Using A Glitch?

from the seems-a-bit-extreme dept

Microsoft recently got some attention for cutting off hundreds of thousands of Xbox Live players for using modded Xboxes -- even if there was no evidence they were used for cheating. This is already leading to talk of a class action lawsuit against Microsoft. Even so, Microsoft is now going even further, issuing temporary bans for all of Xbox Live for anyone using a certain "exploit" in Modern Warfare 2 that lets a player set off a grenade after they die in the game. It makes sense for Infinity Ward to create a fix for their own programming mistake, but it seems rather ridiculous for Microsoft to kick people out of the game for doing what the game actually allows. Why blame players for merely doing what is allowed by the game itself?

Filed Under: ban, exploit, xbox live
Companies: infinity ward, microsoft

Songwriter Claims He Was Exploited By Google... But A Few Seconds Of Logical Thinking Disproves That

from the ok,-let's-work-this-through dept

A bunch of folks have sent in the latest PR attempt by some musicians in the recording industry to force Google to pay unsustainable rates to keep their music on YouTube. Pete Waterman, who apparently co-wrote the Rick Astley "Rick Roll" song Never Gonna Give You Up has come out saying that Google "exploited" him, because he earned a grand total of £11 last year, even while the video was a hit on YouTube.

There are probably more details here, because no one actually says how much Google paid overall. For example, part of the problem may simply be the deal that Waterman himself signed concerning his royalties. But, more to the point, it's not Google that's doing any exploiting at all. Here's the simple logic process to run through (which Waterman and all the folks supporting this PR stunt failed to do):

• How much attention did Waterman's song get last year thanks to YouTube?
• Fine, take away YouTube. How much attention would Waterman and his song have received last year

Yup. No one would be talking about Waterman or his song at all in the absence of YouTube and the rickrolling phenomenon. The only "exploiting" being done is now, by Waterman, because he got totally lucky in that a bunch of internet jokesters happened to pick his song (mainly for how bad it is) to use as part of an internet joke. He deserves to get paid for that? It could have just as easily been any other ridiculous pop hit in the 80s. And, if it had been, then no one would be talking or caring about Waterman at all.

Furthermore, it was never YouTube making use of the music, but it was all these people on the internet, adopting the meme. YouTube was just the platform they used for it. So, no, Waterman wasn't exploited by YouTube in the slightest, though he seems to have no trouble at all trying to exploit the fact that he got lucky and whine about it -- even though it's the only reason his name is now in the news again.

Filed Under: exploit, pete waterman, rickroll, videos
Companies: google