Sleepless in Midland

BIOS in the motherboard -- NSA spy gadgets worthy of a James Bond movie

Well, actually the coolest James Bond gadgets were weapons, but there must have been some spy tools in his Aston Martin's bonnet.

Anyway, NSA has a fine line of kits for the serious spy. Spiegel has the ANT (Advanced Network Technology) catalog -- see NSA's Secret Toolbox: Unit Offers Spy Gadgets for Every Need. A few samples:

Rigged monitor cable - A cable that allows the spy to see what's on the subject's monitor.

Active GSM base station -- Allows the user to mimic a cell phone tower to capture calls.

USB plugs -- Devices that look like thumb drives but capable of sending and receiving data undetected via radio link.

Dropmire -- A bug meant to be placed in an encrypted fax machine.

BIOS in the motherboard -- ANT malware in the BIOS which would survive a hard drive wipe or operating system replacement.

For pricing see Spiegel.

Companies that have a choice are are willing to move their data outside U.S because of NSA snooping

Common sense told us this would happen. So it really can't be called an "unforeseen consequence."

Canada-based cloud hosting provider Peer 1 Hosting surveyed 300 UK and Canadian companies and found that 25% of those businesses are now moving their data outside the U.S. because of NSA security concerns. Meanwhile, a whopping 77% of decision-makers at these companies say they would sacrifice data performance and speed in favor of a more secure connection.

See Thanks, NSA: 25% of UK and Canadian businesses are moving data outside the US, says report at Pando.com. Via .

But how about those of us who live here? A VPN service might provide an encrypted pipeline through which to surf the web. But any service subject to U.S. jurisdiction would likely have to submit all their users' internet traffic to federal agencies under a blanket order. There's a chance that lawmakers might try to protect us with some statute prohibiting the practice without a warrant. But it's worthwhile to remember that little old laws didn't stop J. Edgar Hoover.

Updated 4/26/2017: John Mason emails to point to a new article comparing VPNs at thebestvpn.com.  Thanks John.

American tech companies feeling heat from customers want limits on government internet spying

Gamers must be reeling from the news that US and British spying agencies have been snooping on internet games. See Agency spies snooped on online gaming worlds, including World of Warcraft, Second Life and Xbox Live:

In fact, there have been so many FBI, CIA, and Pentagon spooks kicking around as elves, Orcs and supermodels, a "deconfliction" group is needed to avoid them all colliding into each other, according to the newly released, top-secret documents.

Short on the heals of that revelation we learn that eight big U.S. tech firms put an open letter online to the President and Congress asking for transparency and oversight of government internet spying. They must be feeling the heat from their customers. And they probably have good reason to worry. It seems like an easy entry point for some foreign competitors who might offer privacy and steal away customers.

Actually, there's some irony here. As NakedSecurity writer Lee Munson remarks, many of the same principles espoused by the tech coalition could be applied to themselves given how much of individuals' private data outfits like Google and Facebook collect.

As for the spy agencies, one has to wonder whether they have separate departments in which the agents do nothing but play games on the internet all day. Government agencies are probably big on giving awards to workers. Do you suppose they give them rewards for achieving the upper levels in the online games they play? What a job.

While we're at it, we might also give some thought to the agents who sit in a windowless office all day long searching porn sites for illegal content. That could very well be a career climax for many of them.

Bruce Schneier on NSA Spying

There's an interesting interview posted at Bruce Schneier: NSA Spying Is Making Us Less Safe, and the part about back doors in over the counter software is particularly interesting in light of NSA predilection to spy on citizens. Here's an excerpt:

There have been many allusions to NSA efforts to put back doors in consumer products and software. What’s the reality?
The reality is that we don’t know how pervasive this is; we just know that it happens. I have heard several stories from people, and am working to get them published. The way it seems to go, it’s never an explicit request from the NSA. It’s more of a joking thing: “So, are you going to give us a back door?” If you act amenable, then the conversation progresses. If you don’t, it’s completely deniable. It’s like going out on a date. Sex might never be explicitly mentioned, but you know it’s on the table.

But what sorts of access, to what products, has been requested and given? What crypto is, and isn’t, backdoored or otherwise subverted? What has, and hasn’t, been fixed?
Near as I can tell, the answer on what has been requested is everything: deliberate weakenings of encryption algorithms, deliberate weakenings of random number generations, copies of master keys, encryption of the session key with an NSA-specific key … everything.
NSA surveillance is robust. I have no inside knowledge of which products are subverted, and which are not. That’s probably the most frustrating thing. We have no choice but to mistrust everything. And we have no way of knowing if we’ve fixed anything.

There's a market niche available to some entrepreneur in some country free of ties with the U.S. to develop software and encryption programs without back doors. But as Schneier says, you can't trust anyone.

P.S. Article says Schneier is now helping Guardian decipher the Snowden documents.

Iran plots revenge if U.S. strikes Syria -- who the hell leaks this stuff?

The Wall Street Journal has the story. See Iran Plots Revenge, U.S. Says:

The Iranian message, intercepted in recent days, came from Qasem Soleimani, the head of Revolutionary Guards' Qods Force, and went to Iranian-supported Shiite militia groups in Iraq, according to U.S. officials.

Maybe this explains why Obama suddenly decided to seek Congressional approval instead of acting alone.

But why are we reading about this? If it was a leak, it shouldn't have been leaked. There's a former information source that is now useless. However, if it wasn't a leak but an official pronouncement then one has to wonder why the administration would do that. The Iranian spokesperson can't be right when he says it was meant to provoke Congress into authorizing a strike on Syria. That sort of threat would make most Congress members more reluctant to authorize a strike.

By the way, to the list of ways Obama has transformed the nation, add this one. He has made conspiracy theorists out of all of us.

surveillance on citizens -- Obama was against it before he was for it

Two from Propublica.

First. In The Surveillance Reforms Obama Supported Before He Was President, Kara Brandeisky tells how in 2007 Senator Obama co-sponsored a bill that would have ...

... that would have required the government to demonstrate, with “specific and articulable facts,” that it wanted records related to “a suspected agent of a foreign power” or the records of people with one degree of separation from a suspect. The bill died in committee. Following pressure from the Bush administration, lawmakers had abandoned a similar 2005 measure, which Obama also supported.

Fast forward to 2013:

We now know the Obama administration has sought, and obtained, the phone records belonging to all Verizon Business Network Services subscribers (and reportedly, Sprint and AT&T subscribers, as well). Once the NSA has the database, analysts search through the phone records and look at people with two or three degrees of separation from suspected terrorists.

(Emphasis added by me.)

So was he just trying to look good in 2007 or did he really mean it? And now that he's in charge he just wants to keep an eye on his subjects? Funny how George W. Bush, who Democrats told us back then was such a horrible person, set the standard by which Barack Obama is now trying to measure himself.

Second. In Is Your Neighbor a Democrat? Obama Has an App for That, Lois Beckett tells us --

The app, released last week, includes a Google map for canvassers that recognizes your current location and marks nearby Democratic households with small blue flags.

For each targeted address, the app displays the first name, age and gender of the voter or voters who live there: "Lori C., 58 F, Democrat."

Ostensibly the information provided by this app is supposed to help volunteers for Oama out in the field. But one has to wonder what kind of apps might be available to IRS and other federal workers who want to help sway elections.

memo to the NSA spy who loves me

We've been hearing about how you NSA folks are using your access to our phone calls and internet use to spy on your love interests. So this one is for you, the spy who loves me.

Hey babe, how's it going? I'd love to hear all about you when I have time, but since you are taking the time out of your busy workday to check in on me, I thought I would tell you a little about myself. I'm tall, handsome, fit, and get mistaken for Brad Pitt all the time. Don't pay any attention to that photo on my driver's license. I don't know where they get that crazy stuff -- it's government work, am I right?

I like long walks on the beach, picnics, romantic dinners, whispering sweet nothings in my loveint's ear, cuddling under the moonlight, making my loveint feel wanted and all that sh*t.

What are you wearing? Um, wait a second. Are you a dude? Not that there's anything wrong with that. But uh, you know what? This just isn't working. I think you should leave. Right now. It's not you, it's me.

But I still like you. As a friend. We'll talk someday. I'll call.

Nowhere to hide -- Use VPN for secure browsing and risk becoming NSA target

Some internet users prefer to use some sort of encrypting feature when in wi-fi hot spots to shield their browsing and communication from snoopers. And after the Edward Snowden disclosures about NSA spying, some writers were suggesting the use of Tor which encrypts and relays internet traffic through numerous points around the world.

The NSA claims that its focus is on individuals outside the U.S. But unfortunately for Tor users, the use of that program flags the user as being outside the U.S. even if they are in the U.S.

Maybe domestic services like Witopia would allow the user to escape being profiled as "outside the U.S." But that raises the second red flag -- encryption. According to the slide show linked by The Guardian, the training for the Xkeyscore program points at the use of encryption as an anomalous event. See jpg on the right.

So basically, individuals trying to stay safe on the internet are fair game for nosy bureaucrats.

But don't worry, it's for the government. Unfortunately, it hasn't helped catch a terrorist, but Team Obama will think of something to do with it, even if it's only for domestic political purposes. After all, government is simply the name we give to the things we choose to do together. [Visualize sarcastic smirk.]

NSA's XKeyscore captures our internet usage

Glenn Greenwald keeps twisting the knife. In XKeyscore: NSA tool collects 'nearly everything a user does on the internet' dated 7/31/13, he describes a program which can "allow analysts to search the metadata as well as the content of emails and other internet activity, such as browser history, even when there is no known email account (a "selector" in NSA parlance) associated with the individual being targeted." Click to see the slide show which was supposed to be part of an XKeyscore training program.

Greenwald quotes an NSA statement:

"The implication that NSA's collection is arbitrary and unconstrained is false," the agency said. "NSA's activities are focused and specifically deployed against -- and only against -- legitimate foreign intelligence targets in response to requirements that our leaders need for information necessary to protect our nation and its interests."

Presumably Edward Snowden's focus was an exception to that sweeping generalization.

Many Americans were instilled with a healthy fear of a government spying into our personal affairs from a required reading of one or more of George Orwell's prophetic books. And since we've already seen important government agencies co-opted for political purposes, most Americans are thoroughly intimidated. It's a sad situation we're in when the best we can hope for is that our internet activities are inconspicuous enough to fly under the NSA radar.

Mike Conaway and the bill to limit NSA snooping

Representative Justin Amash (R-Michigan) co-sponsored a bill described at his website thusly:

H.R. 2399, the Limiting Internet and Blanket Electronic Review of Telecommunications and Email Act (LIBERT-E Act), restricts the federal government’s ability under the Patriot Act to collect information on Americans who are not connected to an ongoing investigation. The bill also requires that secret Foreign Intelligence Surveillance Act (FISA) court opinions be made available to Congress and summaries of the opinions be made available to the public.

Those who argue in favor of the snooping haven't been very convincing. Every profession wants access to tools that make their work easier, and it's no different with the NSA. However, keeping the snoops out of the lives of "Americans who are not connected to an ongoing investigation" seems perfectly reasonable. But a majority of the House members voted against it.

For a short summation of how overly intrusive the NSA's metadata searches are see this article at USAToday.com.

Let's take a glance at the voting record. Looks like our own Texas District 11 Congressman Mike Conaway voted against it.

What makes this particularly significant is the recollection of a discussion heard on the radio a couple of years ago when Mr. Conaway was a guest on a local drive-time show. He was there complaining about the FBI's attempt to serve a legitimately obtained search warrant on a Congressman's office (not Conaway's). Congressional offices, you see, should be exempt, according to Conaway. The FBI backed down.

Rules are for the little people.

Reporter Sharyl Attkisson’s computer breached -- it could happen to anyone

James Rosen of Fox News was in the spotlight recently for being the target of Eric Holder's Department of Justice email grabs. He probably wasn't the only reporter targeted at Fox News.

But this one at CBS really is intriguing. Sharyl Attkisson is a reporter there who was actively pursuing the mysteries of Fast and Furious and the Benghazi terrorist attack. The Obama administration has made it clear they want both of those topics to disappear. Now we learn that her office and home computers were mysteriously hacked. See this from CBSnews.com Sharyl Attkisson on computer hacking: "I'm outraged".

"The unauthorized party accessed the CBS computer at my home on multiple occasions, and specifically in December, they used sophisticated methods to cover their tracks, meaning they tried to remove the indications of their previous unauthorized activity," she said. "We're not prepared to talk more about the who's and who did this today, but the intruder is considered highly skilled and used very sophisticated methods."

Emphasis mine. More:

Speaking of the invasion of the computers, Attkisson said, "When any unauthorized party comes into the home of an American -- whether it's a private citizen or a journalist -- and searches through their computers, inserting or removing material for whatever their reason is, it's a very serious and disturbing matter.

"I'm outraged that anyone would do such a thing and CBS News takes all of this very seriously."

That's good news that CBS News is taking it seriously. It was only last month that Attkisson was in jeopardy of losing her job over her aggressive coverage of the Obama admin. See Top Obama official’s brother is president of CBS News, may drop reporter over Benghazi coverage. Maybe the prospect of a government spy job on her made it too untimely to give her the pink slip.

In any event, the problem with these sophisticated spyware programs, the FBI's CIPAV for example, is that they are undetectable by the off-the-shelf anti virus programs. And the really frightening aspect about this whole thing is the possibility that we all may have that type spyware lurking in our hard drives just waiting for the command to forward it to the NSA, the FBI, Eric Holder, Obama, China, or even the kid down the street.

Attkisson and CBS should do us all a favor and publish a way for us ordinary slobs to sniff out spyware like that on our own computers.

Flame, the spy virus

Getting spyware onto a computer is a trick in itself, and it seems that it would take a little bit of credulity and participation on the part of the victim. Maybe the victim was tempted to download some free, useful software. Or there's the trick of sprinkling infected USB flash drives in the parking lot of a target building and waiting for some curious employee to find one and insert it into a computer.

In any event, the latest cyberspy-craft we've learned about is Flame which was exposed by Kaspersky.ru. Excerpt:

It allows you to steal sensitive information, including the information output to the monitor, information about systems-installations, files stored on your computer, contact information of users and even audio recordings of conversations.

An independent study was initiated on the initiative of ITU and Kaspersky Lab, following a series of incidents on the other, as yet unknown malware, code-named Wiper, which has destroyed data on computers in countries of Western Asia. This malware is yet to be found; However, during the analysis of incidents of Kaspersky Lab specialists in cooperation with the International Telecommunication Union (ITU) have identified a new type of malware, now known as the Flame. According to the preliminary results of this zlovred is actively used for more than two years, from March 2010 onwards. Due to its complexity and focus on specific goals to date, it cannot be detected by any protective product.

It was found in Iran, according to Cnet.com, so one hopes the good guys built it and that any info coming out of it would help the right side. It would also seem to take a rather large computer network to filter and decipher all the raw data that gets collected. Otherwise some poor saps would have the dull job of listening to all the recordings, watching all the videos, and reading all the documents that got captured and transmitted via Flame.

One more interesting item from the Kaspersky article. This line:

However, it is already clear that the Flame may be distributed over a network in several ways, including through the use of the same vulnerability in print spooler service and the same method of infection via the USB device that uses the Stuxnet worm.

Bold added. It seems to confirm that the Stuxnet virus got on board via USB drives that found their way to the hands of the curious.

It's still a mystery as to who initiated Flame. Was it the U.S.? As Andrew Malcolm points out, the Obama campaign has willingly disclosed all sorts of information that should otherwise have been held close to the vest. Silence from the White House suggests there's no credit to be claimed.

What worries this blogger is whether each of our personal and business computers might be infected with some sophisticated virus, undetectable by typical anti-virus programs, just sitting there waiting for a signal from a criminal mastermind or the military of some non-friendly country. If it's just some spy watching all the videos we see on Youtube or reading all the chain letters that circulate through email then that's one thing. But if it's a program that could turn an infected computer into a beacon for killer drones, then that could be problematic.

Spy vs Spy

Funny how this spy cases come in opposing pairs. It's almost as if the countries involved are trying to one-up each other. First, a U.S. spy drone wanders over Iran, gets snagged and is showed off like a bowler's trophy.

Then Amir Mirza Hekmati, of Iranian lineage but born in Arizona, gets put on death row in Iran for alleged spying for the CIA. See Yahoo news. Any reports of a confession in Iran should be taken with several grains of salt. So when we read that he "admitted to having links with the CIA but denied any intention of harming Iran," we have to admire Mr. Hekmati for holding up that well under the kind of pressure they exert to get confessions.

Then along comes Livia Antonieta Acosta Noguera, the Venezuelan consul in Miami and formerly the second secretary at the Venezuelan Embassy in Mexico. InterAmericanSecurityWatch.com reported last month:

U.S. officials are investigating reports that Iranian and Venezuelan diplomats in Mexico were involved in planned cyberattacks against U.S. targets, including nuclear power plants.

Allegations about the cyberplot were aired last week in a documentary on the Spanish-language TV network Univision, which included secretly recorded footage of Iranian and Venezuelan diplomats being briefed on the planned attacks and promising to pass information to their governments.

Since she's a diplomat all they can do is boot her out of the country. And sure enough, that's what they did.

The CIA should arrange a going away present for her -- a nice thumb drive to use at her office back Venezuela.

Keep the enemy out of captured drones with Torx screws

It was inevitable that a U.S. drone would land in the the wrong hands. And if the drone builders haven't already taken measures to secure any secrets inside, here's what they should start doing.

Screw it together with Torx screws. Torx screws were the brain child of some meddling mechanic who must have thought Phillips screws weren't bad enough.

They take a special screwdriver designed just for them. And they are sneaky. If you don't squint they look like Phillips head screws. But use a Phillips screwdriver and it grinds down the heads making them impossible to remove.

So the Iranian rocket scientist starts trying to unscrew the thing with a Phillips screwdriver and ends up locking it even tighter.  Absolutely spy-licious.

And put some stink bombs in them just in case they do get one open. That'll teach 'em to mess with our toys.

Added later.You may think that was silly, but consider this. Fox News reported that the captured drone had a self destruct device on board. However, President Obama elected not to activate it.  Whether we like it or not, the guys on the assembly line and those crazy screw heads may be our last line of defense.