Security, backdoors and control.

WttWColorEye_forBlogThe FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor. And while the government may argue that its use would be limited to this case, there is no way to guarantee such control. Apple letter to customers

Encryption is a way to keep private information private in the digital world. But there are government actors, particularly here in the US, that want access to our private data.
The NSA has been snooping our data for years. Backdoors have been snuck into router encryption code to make it easier to break.
Today at M3AAWG we had a keynote from Kim Zetter, talking about Stuxnet and how it spread well outside the control of the people who created it.
I commend Tim Cook for his stand against the US Government and his insistence on protecting the data of all iPhone users. The feds are strongly arguing the encryption breaking code would only be used for This One Phone. But can we really trust them with our data or believe they wouldn’t use this in another situation? Or as a way to access data that they can’t currently access through the NSA surveillance program?
It’s a little strange for me to be stating this. It feels weird. I grew up in a suburb about 10 miles outside of DC. My father worked as a civil servant for the DoD. My Friend’s dads were diplomats, senate-confirmed federal appointees and secret service agents. A CIA agent lived across the street and I regularly swam in their pool. Generals were regular visitors to our house. My first job out of high school was in a federal regulatory agency. Government wasn’t bad. It was, on the whole, a force for good. Even some of the dumb seeming things ($1000 hammers) weren’t fails, they were reasonable if you understood the context.
Government wasn’t the enemy and generally had a good reason for the things they did.
Now I’m not as sure as I was then. The government has done some things I don’t really understand. And even when I try and put them in the context of the environment I grew up I still don’t think it’s a good thing. Pervasive monitoring is bad and I don’t think our digital property should be any less secure than our physical property.
I understand and can even sympathize with why the FBI is asking for what they want. But I also support Tim Cook and his efforts to protect all iPhone users. Maybe the FBI would only use the code for this phone. But what about other governments? What about other players in the space? If Apple provides this for the US government, what’s to prevent other governments from getting their hands on it? If the RSA can be hacked and have their root keys stolen then we’re all vulnerable. Apple had one of the iPhone 4 prototypes stolen out of a bar.
If you leave a backdoor unlocked anyone can use it. Putting backdoors in code, sharing keys and creating software to allow one person to compromise security only makes all of us less secure. Stuxnet tells us that malicious software spreads further than we expect and once it exists it can easily escape any control.

Should you publish DMARC?
Getting unblocked at Outlook.com

Related Posts

Security vendors and trust.

A big part of my predictions for 2016, that I’ll publish shortly, is that security is going to be a huge issue. I think we’re really going to see receivers expecting senders to have their houses in order when it comes to sending mail.
Of course, some filter companies need to get their houses in order to. Yesterday, a security researcher went public with problems in the TrendMicro anti-virus appliance. These vulnerabilities would let any email sender remotely execute code on the recipients machine with no interaction of the user. They also exposed all the passwords on the machine to the outside world.
Even worse, Trend doesn’t seem to understand the urgency to fix this. They have started releasing patches for the exploits, but there are significant problems with the patched versions as well.
If you’re a Trend user, you may want to consider other vendors for desktop security. I know that no security is perfect and that other vendors have problems, too. But shipping a password manager that exposes all passwords is just incompetence. It seems like a corporate lack of understanding of what their business is and how to actually create security software.
Even worse is that lack of urgency from the Trend folks as the security researchers are explaining the problem. I don’t care if the person receiving the report was the janitor, anything that says security exploit should be escalated to someone who can determine if the report is valid.
Compare Trend’s reaction to this to Juniper’s reaction to discovering a backdoor in their code in December. First off, Juniper found the exploit during a routine code review. That alone tells you Juiper is continually monitoring their code security. Second, Juniper was reasonably open about the issue, with executives posting blogs and security posting advisories talking about the issue. More importantly, they shared how they were going to fix it and prevent it from happening again.
Security is such a large issue right now. We have to be able to trust our vendors to do what they’re selling us. Every vendor is going to make mistakes and have vulnerabilities. No code and no developer is perfect. I do expect, though, that vendors will take exploits seriously and act fast in order to correct the problem. I’m not seeing that sense of urgency with Trend.
 

Read More

Protecting customer data

There have been a number of reports recently about customer lists leaking out through ESPs. In one case, the ESP attributed the leak to an outside hack. In other cases, the ESPs and companies involved have kept the information very quiet and not told anyone that data was leaked. People do notice, though, when they use single use addresses or tagged addresses and know to whom each address was submitted. Data security is not something that can be glossed over and ignored.
Most of the cases I am aware of have actually been inside jobs. Data has been stolen either by employees or by subcontractors that had access to it and then sold to spammers. There are steps that companies can take to prevent leaks and identify the source when or if they do happen.

Read More

Peeple, Security and why hiding reviews doesn't matter

There’s been a lot of discussion about the Peeple app, which lets random individuals provide reviews of other people. The founders of the company seem to believe that no one is ever mean on the Internet and that all reviews are accurate. They’ve tried to assure us that no negative reviews will be published for unregistered users. They’re almost charming in their naivety, and it might be funny if this wasn’t so serious.
The app is an invitation to online abuse and harassment. And based on the public comments I’ve seen from the founders they have no idea what kind of pain their app is going to cause. They just don’t seem to have any idea of the amount of abuse that happens on the Internet. We work with and provide tools to abuse and security desks. The amount of stuff that happens as just background online is pretty bad. Even worse are the attacks that end up driving people, usually women, into hiding.
The Peeple solution to negative reviews is two fold.

Read More