Items from security-related news (E115.Jul-2013)
The price for zero day exploits is sky-rocketing, and hackers
world-wide pore over every detail of commonly used software, seeking
the small wedge to drive through corporate and government defenses.
Users who rely on encryption built into Microsoft products may be
surprised to learn that Microsoft is alleged to provide
"pre-encryption" data to NSA, thus bypassing the expected
communication privacy.
XMission is located only about 15 miles from the new NSA data center in Utah,
but its CEO is determined to keep his customer's data out of the facility,
and away from state and local governments, unless due process is followed,
consistent with the US Constitution. Cipher subscribers may be interested
to know that this newsletter is emailed to them through XMission servers.
The US restricts commerce with some countries, and they must restrict
resellers from moving products to the banned nations. Yet Internet security
technology for monitoring networks seems to be used in two of those places.
"Leaks shed light on how spy agency may use supercomputers, gigantic hard drives." Are there exabytes, zetabytes, or yottabytes behind the new walls?
Many people are upset about the revelations of NSA surveillance, but
lost in the attention are the judges of the secret courts who feel that
they are reviled without opportunity to explain themselves.
US Senators of both political parties are asking for disclosure of more
information about government communications surveillance.
Much of the US population was surprised to learn that information about their
phone calls goes directly from their phone provider to government databases.
The US Defense Secretary complained about China's attempts to learn US secrets. The complaints preceded Snowden's information about US cyberespionage in Europe.
The talks about cyberattacks were motivated by their economic impact on the US,
which Gen. Keith B. Alexander of NSA described as "the greatest transfer of wealth in history." Alexander is a proponent of offensive cyberwarfare.
Apple's new security system, using passwords and verification codes, provides
security for some user interactions with the company, but not the iCloud
storage system.
By Nicole Perlroth and David E. Sanger
The New York Times
Jul 12, 2013
James Risen
The New York Times
Jul 11, 2013
Rory Carroll in Salt Lake City
The Guardian
Jul 9, 2013
Ellen Nakashima
The Washington Post
Jul 8, 2013
Tony Semerad
The Salt Lake Tribune
June 29, 2013
(Cipher readers may be interested in the several articles published
in the SL Tribune about the new data center).
Carol D. Leonnig, Ellen Nakashima and Barton Gellman
The Washington Post
Jun 30, 2013
Ellen Nakashima
The Washington Post
Jun 29, 2013
Ellen Nakashima
Washington Post
Jun 6, 2013
Ernesto Londoño
The Washington Post
Jun 1, 2013
David E. Sanger and Mark Landler
The New York Times
Jun 2, 2013
Julianne Pepitone
CNN Money
May 30, 2013