Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×

Comment Information Sharing & Analysis Organization?! (Score 1) 29

The actual FCC noticel [FCC notice] has:
(6) Plans With Information Sharing and Analysis Organizations.
Plans to incorporate relevant outputs from Information Sharing and Analysis Organizations (ISAOs) as elements of the licensee's security architecture. Plans should include comment on machine-to-machine threat information sharing, and any use of anticipated standards for ISAO-based information sharing.

What's an ISAO? Here's what the DHS has to say. Short summary: Big Brother.

Comment Is what the FBI ask Apple feasible, or not ? (Score 2, Insightful) 400

There is something that does not add up in Apple's discourse at http://www.apple.com/customer-...

Specifically, the FBI wants us to make a new version of the iPhone operating system, circumventing several important security features, and install it on an iPhone recovered during the investigation. In the wrong hands, this software — which does not exist today — would have the potential to unlock any iPhone in someone’s physical possession.

The FBI may use different words to describe this tool, but make no mistake: Building a version of iOS that bypasses security in this way would undeniably create a backdoor.

I read what the FBI asks as: install a piece of code that allows the phone's content to be examined. I see no middle ground between

1) running such piece of code (probably: after getting it signed by Apple) is possible without the owner's passcode; the iPhone is in fact already backdoored, with Apple holding the key, the FBI wants Apple to exploit the vulnerability/open the backdoor, and Apple does not want to bow, because that's against their policy.

2) running a piece of code signed by Apple also requires he owner's passcode; then the solution pushed by the FBI just can't work.

If the facts where 2, Apple could just state this to the FBI, showing the source code as proof. The FBI would have no choice but take it as fact (perhaps they would ask a change in the future, but it would not help immediately for this iPhone). I conclude the true story is 1, and Apple slightly misrepresents things stating the FBI wants the creation of a backdoor, when there's already one, only well locked and never previously used for nefarious purposes.

Comment Police post plausible statement (Score 1) 415

Apparently the Rhode Island State Police posted a photo and plausible statement:

https://www.facebook.com/Rhode...

The post says the canine is "trained to detect electronic devices".

That does not look as bogus a claim as training specifically for storage media: the chemicals used in the soldering, cleaning, and IC packaging conceivably could have a detectable smell.

Comment The whole thing is unsubstantiated FUD (Score 1) 282

The whole thing is unsubstantiated FUD. I base my judgment on the slides at
https://media.blackhat.com/us-13/us-13-Stamos-The-Factoring-Dead.pdf

The whole argument boils down to:
a) there has recently been huge progress [*] in solving the Discrete Log Problem over fields of small characteristic;
b) progress in solving the DLP have historically implied progress in factorization, and vice versa;
c) factorization breaks RSA, and solving the DLP breaks DSA;
d) thus RSA and DSA are dead, move to ECDSA.

The fallacy of it is that in b) and c), the DLP is exclusively over fields of huge characteristics (thousands of bits), making the algorithms in a) powerless. The slides do not hint at the faintest research lead towards moving to huge characteristics. Best argument is that "renewed interest could result in further improvements".

One the positive side, the author is honest: "I’m not a mathematician, I just play one on stage".

    François Grieu

[*] See e.g. this recent paper and its references
Razvan Barbulescu, Pierrick Gaudry, Antoine Joux, Emmanuel Thomé: A quasi-polynomial algorithm for discrete logarithm in finite fields of small characteristic
http://hal.inria.fr/docs/00/83/54/46/PDF/quasi.pdf

Comment The report's author are pretty convincing (Score 1) 133

The original report says about the last vulnerability discussed (but not disclosed)

Indicators such as covert positioning, the use of special parameters, absence of log messages, facilitation of persistence, and apparent lack of legitimate purpose suggest that this vulnerability could be classified as a symmetric backdoor if malicious intent were to be established (which it has not).

I like the tone: they stop short of stating this is a deliberate backdoor of the worst kind, but give extremely convincing argument that it is one.

Comment Re: Jupiter Tape? (Score 2) 621

There's a huge difference between this claim and lawful intercept on demand -- meaning that a formal request is made to the Telco to intercept such and such number for a period of time, then the calls are re-routed to special recording equipment.

In this case you'd need to have active real-time recording capability for every call made on every switch in the entire national phone network. You'd also have to hide this capability from the techs who work on the switches and/or swear them all to secrecy. That would be tens of thousands of switches, and many thousands of technicians.

Leaving aside the fact that you'd have to re-engineer the switches themselves, since they were not designed to support this kind of logging (no storage capacity, limited CPU, etc.)

All it would take at this point is a single wagging tongue or a Wikileaks dump to break the whole thing open. Since we've seen this happen for much smaller wiretapping deployments, I'm skeptical that you could pull anything like it off without everybody knowing.

What you can do is monitor trunk lines (which is what happened in the case of the Folsom Street tap, mentioned above) and you can certainly build your own wireless interception hardware. But this is a very different thing than what TFA claims.

Comment Re:Jupiter Tape? (Score 2) 621

For the Boston Marathon bombers, this would have been a perfect investigative tool. Once you have the phone number of a target, you simply scan backwards through all of their recorded calls.

When I say nobody needs to mine the data, I don't mean nobody every looks at it. I simply mean that you don't mine it in real time. You simply record the text along with the call metadata, and wait until you have some specific targets to investigate. At that point you construct a graph from that starting point, and go back to listen to the relevant calls.

I think you're overestimating the need for voice recognition. People with burner phones still leave records. After the fact you'd look for obvious connections, paying particular attention to numbers classified as likely disposables.

(I have no doubt that some of this already happens at the metadata level, anyway. The question here is whether they actually record call contents to go with it.)

Comment Re:Jupiter Tape? (Score 3, Informative) 621

Nobody needs to actively mine the data. The goal would be to collect it. Once you've collected it, you have the ability to follow leads you wouldn't have been able to follow had you not captured it in the first place.

You become aware that an individual may be a person of interest. Ordinarily you'd begin your investigation at that point. With this technology you can now go 'back in time' and figure out not only who that person spoke with, but exactly what was said in those calls. It would be incredibly useful.

I could even see Executive Branch lawyers convincing themselves that this was legal, provided the communications were not actually accessed without some sort of due process.

Of course, the problem with this theory is that it would be very hard to implement, since it would require massive and detectable changes to local telco infrastructure. On the other hand, intercepting wireless communications could be done without any such tampering, provided that the government could obtain a database of SIM credentials for decryption.

Comment Do not judge us from what we show! (Score 2) 85

The taken-down images, and the promotional video around 2:53
http://pages.ciphercloud.com/AnyAppfiveminutesdemo.html?aliId=1
make it clear that in these promotional materials, identical plaintext leads to identical ciphertext.

Ciphercould's DMCA takedown notice
http://meta.crypto.stackexchange.com/a/258/555
rebuts that as wrong ("Ciphercloud's product is not deterministic"), with a key point at the beginning of page 3:
"[detractor] implies that what was perceived from a public demo is Ciphercould's product offering".

Ciphercould's position is: you misjudged us from what we have shown, which is not the real thing.

Slashdot Top Deals

Recent research has tended to show that the Abominable No-Man is being replaced by the Prohibitive Procrastinator. -- C.N. Parkinson

Working...