ReportWire

Tag: encryption

  • Geofence Warrants Ruled Unconstitutional—but That’s Not the End of It

    Geofence Warrants Ruled Unconstitutional—but That’s Not the End of It

    The 2024 US presidential election is entering its final stretch, which means state-backed hackers are slipping out of the shadows to meddle in their own special way. That includes Iran’s APT42, a hacker group affiliated with Iran’s Islamic Revolutionary Guard Corps, which Google’s Threat Analysis Group says targeted nearly a dozen people associated with Donald Trump’s and Joe Biden’s (now Kamala Harris’) campaigns.

    The rolling disaster that is the breach of data broker and background-check company National Public Data is just beginning. While the breach of the company happened months ago, the company only acknowledged it publicly on Monday after someone posted what they claimed was “2.9 billion records” of people in the US, UK, and Canada, including names, physical addresses, and Social Security numbers. Ongoing analysis of the data, however, shows the story is far messier—as are the risks.

    You can now add bicycle shifters and gym lockers to the list of things that can be hacked. Security researchers revealed this week that Shimano’s Di2 wireless shifters can be vulnerable to various radio-based attacks, which could allow someone to change a rider’s gears remotely or prevent them from changing gears at a crucial moment in a race. Meanwhile, other researchers found that it’s possible to extract the administrator keys to electronic lockers used in gyms and offices around the world, potentially giving a criminal access to every locker at a single location.

    If you use a Google Pixel phone, don’t let it out of your sight: An unpatched vulnerability in a hidden Android app called Showcase.apk could give an attacker the ability to gain deep access to your device. Exploiting the vulnerability may require physical access to a targeted device, but researchers at iVerify who discovered the flaw say it may also be possible through other vulnerabilities. Google says it plans to release a fix “in the coming weeks,” but that’s not good enough for data analytics firm and US military contractor Palantir, which will stop using all Android devices due to what it believes was an insufficient response from Google.

    But that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A US federal appeals court ruled last week that so-called geofence warrants violate the Fourth Amendment’s protections against unreasonable searches and seizures. Geofence warrants allow police to demand that companies such as Google turn over a list of every device that appeared at a certain location at a certain time. The US Fifth Circuit Court of Appeals ruled on August 9 that geofence warrants are “categorically prohibited by the Fourth Amendment” because “they never include a specific user to be identified, only a temporal and geographic location where any given user may turn up post-search.” In other words, they’re the unconstitutional fishing expedition that privacy and civil liberties advocates have long asserted they are.

    Google, which collects the location histories of tens of millions of US residents and is the most frequent target of geofence warrants, vowed late last year that it was changing how it stores location data in such a way that geofence warrants may no longer return the data they once did. Legally, however, the issue is far from settled: The Fifth Circuit decision applies only to law enforcement activity in Louisiana, Mississippi, and Texas. Plus, because of weak US privacy laws, police can simply purchase the data and skip the pesky warrant process altogether. As for the appellants in the case heard by the Fifth Circuit, well, they’re no better off: The court found that the police used the geofence warrant in “good faith” when it was issued in 2018, so they can still use the evidence they obtained.

    The Committee on Foreign Investment in the US (CFIUS) fined German-owned T-Mobile a record $60 million this week for its mishandling of data during its integration with US-based Sprint following the companies’ merger in 2020. According to CFIUS, “T-Mobile failed to take appropriate measures to prevent unauthorized access to certain sensitive data,” in violation of a National Security Agreement the company signed with the committee, which assesses the national security implications of foreign business deals with US companies. T-Mobile said in a statement that technical issues impacted “information shared from a small number of law enforcement information requests.” While the company claims to have acted “quickly” and “in a timely manner,” CFIUS claims T-Mobile “failed to report some incidents of unauthorized access promptly to CFIUS, delaying the Committee’s efforts to investigate and mitigate any potential harm.”

    The 12-year saga that is the prosecution of Kim Dotcom inched forward this week with the New Zealand justice minister approving the US’s request to extradite the controversial entrepreneur. Dotcom created the file-sharing service Megaupload, which US authorities say was used for widespread copyright infringement. The US seized Megaupload in 2012 and indicted Dotcom on charges related to racketeering, copyright infringement, and money laundering. Dotcom has denied any wrongdoing but lost an attempt to block the extradition in 2017 and has been fighting it ever since. Despite the justice minister’s decision, Dotcom vowed in a post on X to remain in the country where he’s been a legal resident since 2010. “I love New Zealand,” he wrote. “I’m not leaving.”

    The growing scourge of deepfake pornography—explicit images that digitally “undress” people without their consent—may have finally hit a major legal roadblock. San Francisco’s chief deputy city attorney, Yvonne Meré—and the City of San Francisco by extension—has filed a lawsuit against the 16 most popular “nudification” websites. These sites and apps allow people to make explicit deepfake images of virtually anyone, but they have increasingly been used by boys to make sexual abuse material of their underage female classmates. While several states have criminalized the creation and distribution of AI-generated sexual abuse material of minors, Meré’s lawsuit effectively seeks to shut down the sites entirely.

    Andrew Couts

    Source link

  • Apple to Allow Rivals to Access ‘Tap and Go’ Technology

    Apple to Allow Rivals to Access ‘Tap and Go’ Technology

    Apple will allow rival companies to operate wallet technology on its iPhones free-of-charge for a decade, European Union regulators said on Thursday, in the latest overhaul prompted by local rules.

    Apple’s mobile wallet allows iPhone users to pay for products in-store and online using its own-brand Apple Pay. Until now, Apple has not made its near-field communication (NFC) technology, which allows phones to communicate with payment terminals, available to rival developers—causing the EU to warn in 2022 that restricting access to this technology qualifies as an abuse of market power.

    Apple’s concession ends a two-year dispute between the Big Tech giant and the European Commission over the company’s payment technology. This change, first proposed by Apple in December, means the smartphone maker will avoid billions of dollars in fines and a formal declaration by Brussels that it has broken EU rules.

    “[Apple’s commitment] opens up competition in this crucial sector, by preventing Apple from excluding other mobile wallets from the iPhone’s ecosystem,” EU competition chief Margrethe Vestager said in a statement.

    “From now on, competitors will be able to effectively compete with Apple Pay for mobile payments with the iPhone in shops. So consumers will have a wider range of safe and innovative mobile wallets to choose from.” The changes will last for at least 10 years and apply only to users who live in the European Union, as well as Iceland, Liechtenstein, and Norway.

    Apple’s decision to widen access to NFC will mean developers in Europe will be able to deploy the technology inside iOS apps for uses including car keys, corporate badges, hotel keys, and event tickets, Apple spokesperson Julien Trosdorf told WIRED.

    “Apple Pay and Apple Wallet will continue to be available in the EEA for users and developers,” he added.

    For years, Apple has kept a tight grip on the technology available to the millions of people using its devices. But intense scrutiny in the EU and new rules have caused the smartphone maker to make several significant changes to the way it operates.

    In response to EU complaints, the company will now have to allow alternative app stores onto iPhones and iPads, creating competition for the Apple App Store for the first time. The company will also have to offer “choice screens” when users buy a new Apple device, giving them an option to install Apple’s own-brand apps or third-party alternatives. The company is also appealing an almost $2 billion fine which focuses on the rules and restrictions imposed on third-party developers building iOS apps.

    Morgan Meaker

    Source link

  • How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

    How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

    Yet Google and its hardware partners argue privacy and security are a major focus of the Android AI approach. VP Justin Choi, head of the security team, mobile eXperience business at Samsung Electronics, says its hybrid AI offers users “control over their data and uncompromising privacy.”

    Choi describes how features processed in the cloud are protected by servers governed by strict policies. “Our on-device AI features provide another element of security by performing tasks locally on the device with no reliance on cloud servers, neither storing data on the device nor uploading it to the cloud,” Choi says.

    Google says its data centers are designed with robust security measures, including physical security, access controls, and data encryption. When processing AI requests in the cloud, the company says, data stays within secure Google data center architecture and the firm is not sending your information to third parties.

    Meanwhile, Galaxy’s AI engines are not trained with user data from on-device features, says Choi. Samsung “clearly indicates” which AI functions run on the device with its Galaxy AI symbol, and the smartphone maker adds a watermark to show when content has used generative AI.

    The firm has also introduced a new security and privacy option called Advanced Intelligence settings to give users the choice to disable cloud-based AI capabilities.

    Google says it “has a long history of protecting user data privacy,” adding that this applies to its AI features powered on-device and in the cloud. “We utilize on-device models, where data never leaves the phone, for sensitive cases such as screening phone calls,” Suzanne Frey, vice president of product trust at Google, tells WIRED.

    Frey describes how Google products rely on its cloud-based models, which she says ensures “consumer’s information, like sensitive information that you want to summarize, is never sent to a third party for processing.”

    “We’ve remained committed to building AI-powered features that people can trust because they are secure by default and private by design, and most importantly, follow Google’s responsible AI principles that were first to be championed in the industry,” Frey says.

    Apple Changes the Conversation

    Rather than simply matching the “hybrid” approach to data processing, experts say Apple’s AI strategy has changed the nature of the conversation. “Everyone expected this on-device, privacy-first push, but what Apple actually did was say, it doesn’t matter what you do in AI—or where—it’s how you do it,” Doffman says. He thinks this “will likely define best practice across the smartphone AI space.”

    Even so, Apple hasn’t won the AI privacy battle just yet: The deal with OpenAI—which sees Apple uncharacteristically opening up its iOS ecosystem to an outside vendor—could put a dent in its privacy claims.

    Apple refutes Musk’s claims that the OpenAI partnership compromises iPhone security, with “privacy protections built in for users who access ChatGPT.” The company says you will be asked permission before your query is shared with ChatGPT, while IP addresses are obscured and OpenAI will not store requests—but ChatGPT’s data use policies still apply.

    Partnering with another company is a “strange move” for Apple, but the decision “would not have been taken lightly,” says Jake Moore, global cybersecurity adviser at security firm ESET. While the exact privacy implications are not yet clear, he concedes that “some personal data may be collected on both sides and potentially analyzed by OpenAI.”

    Kate O’Flaherty

    Source link

  • Proton Is Launching Encrypted Documents to Take On Google Docs

    Proton Is Launching Encrypted Documents to Take On Google Docs

    Yen says Proton has been internally using the system for the last month and is now ready to roll it out to consumers. “I feel it is relatively polished,” Yen says. To compete with other online document editors, he says, the team also built in collaboration functionality from the beginning. This includes real-time editing by multiple people, commenting, and showing when someone else is viewing the document.

    In April, Proton acquired encrypted note-taking app Standard Notes, which is a separate product from Docs. “It’s actually not ‘take Standard Notes and stick it into Proton,’” Yen says, adding that the encryption architecture of the two were different, and Proton Docs is “more or less a ground-up, clean build in Proton’s ecosystem on our software stack.” (WIRED was unable to test the Docs before it was launched).

    The big difference Proton is adding when compared to Google Docs is the encryption—something that is challenging to do at scale and also harder when a document has multiple people editing it at the same time. Yen says it’s not just the contents of documents that are being encrypted, so are other elements like keystrokes, mouse movements, and file names and paths.

    The company, which last month announced it is moving toward a nonprofit status, uses open source encryption, and Yen says building the Docs system required encryption key exchange and synchronization to happen across multiple users. Part of this was possible, Yen says, because last year the company added version history for documents stored in its Drive system, which the Docs are built on top of.

    There are relatively few—if any—major end-to-end encrypted document editors online. Other existing services, which WIRED has not tried, include CryptPad and various note-taking or notepad-style apps. There are also apps that encrypt files locally on your machine, such as Cryptee and Anytype.

    Recently, Proton has been moving quickly to launch new encrypted products—adding cloud storage, a VPN, a password manager, and calendar alongside its original ProtonMail email service. The company has also faced scrutiny over some information it has provided to law enforcement, such as recovery emails that have been added to accounts. It changed some of its policies in 2021 after being ordered to collect some user metadata. While the company is based outside of the US and EU, it still responds to thousands of Swiss law enforcement requests.

    Ultimately, Yen says, the company is trying to offer as many private alternatives to Big Tech services, particularly Google, as it can. “Everything Google’s got, we’ve got to build as well. That’s the road map. But the challenge, of course, is the order in which you do it,” Yen says. “In some sense, taking privacy to a more mainstream audience also requires going further afield, trying different things, and being a bit more adventurous in the things that we build and things that we launch.”

    Matt Burgess

    Source link

  • Cryptographers Are Discovering New Rules for Quantum Encryption

    Cryptographers Are Discovering New Rules for Quantum Encryption

    The original version of this story appeared in Quanta Magazine.

    Say you want to send a private message, cast a secret vote, or sign a document securely. If you do any of these tasks on a computer, you’re relying on encryption to keep your data safe. That encryption needs to withstand attacks from code breakers with their own computers, so modern encryption methods rely on assumptions about what mathematical problems are hard for computers to solve.

    But as cryptographers laid the mathematical foundations for this approach to information security in the 1980s, a few researchers discovered that computational hardness wasn’t the only way to safeguard secrets. Quantum theory, originally developed to understand the physics of atoms, turned out to have deep connections to information and cryptography. Researchers found ways to base the security of a few specific cryptographic tasks directly on the laws of physics. But these tasks were strange outliers—for all others, there seemed to be no alternative to the classical computational approach.

    By the end of the millennium, quantum cryptography researchers thought that was the end of the story. But in just the past few years, the field has undergone another seismic shift.

    “There’s been this rearrangement of what we believe is possible with quantum cryptography,” said Henry Yuen, a quantum information theorist at Columbia University.

    In a string of recent papers, researchers have shown that most cryptographic tasks could still be accomplished securely even in hypothetical worlds where practically all computation is easy. All that matters is the difficulty of a special computational problem about quantum theory itself.

    “The assumptions you need can be way, way, way weaker,” said Fermi Ma, a quantum cryptographer at the Simons Institute for the Theory of Computing in Berkeley, California. “This is giving us new insights into computational hardness itself.”

    This Message Will Self-Destruct

    The story begins in the late 1960s, when a physics graduate student named Stephen Wiesner started thinking about the destructive nature of measurement in quantum theory. Measure any system governed by the rules of quantum physics, and you’ll alter the quantum state that mathematically describes its configuration. This quantum measurement disturbance was a hindrance for most physicists. Wiesner, who took an unorthodox information-centric view of quantum theory, wondered whether it could be made useful. Perhaps it could serve as a form of built-in tamper protection for sensitive data.

    But Wiesner’s ideas were too far ahead of their time, and he left academia after graduate school. Fortunately, he’d discussed his ideas with his friend and fellow physicist Charles Bennett, who unsuccessfully tried to interest others in the subject for a decade. Finally, in 1979, Bennett met the computer scientist Gilles Brassard while swimming off the coast of Puerto Rico during a conference. Together, they wrote a groundbreaking paper describing a new approach to an important cryptographic task. Their protocol was based on quantum measurement disturbance, and needed no assumptions about the difficulty of any computational problems.

    Ben Brubaker

    Source link

  • My Memories Are Just Meta’s Training Data Now

    My Memories Are Just Meta’s Training Data Now

    In R. C. Sherriff’s novel The Hopkins Manuscript, readers are transported to a world 800 years after a cataclysmic event ended Western civilization. In pursuit of clues about a blank spot in their planet’s history, scientists belonging to a new world order discover diary entries in a swamp-infested wasteland formerly known as England. For the inhabitants of this new empire, it is only through this record of a retired school teacher’s humdrum rural life, his petty vanities and attempts to breed prize-winning chickens, that they begin to learn about 20th-century Britain.

    If I were to teach futuristic beings about life on earth, I once believed I could produce a time capsule more profound than Sherriff’s small-minded protagonist, Edgar Hopkins. But scrolling through my decade-old Facebook posts this week, I was presented with the possibility that my legacy may be even more drab.

    Earlier this month, Meta announced that my teenage status updates were exactly the kind of content it wants to pass on to future generations of artificial intelligence. From June 26, old public posts, holiday photos, and even the names of millions of Facebook and Instagram users around the world would effectively be treated as a time capsule of humanity and transformed into training data.

    That means my mundane posts about university essay deadlines (“3 energy drinks down 1,000 words to go”) as well as unremarkable holiday snaps (one captures me slumped over my phone on a stationary ferry) are about to become part of that corpus. The fact that these memories are so dull, and also very personal, makes Meta’s interest more unsettling.

    The company says it is only interested in content that is already public: private messages, posts shared exclusively with friends, and Instagram Stories are out of bounds. Despite that, AI is suddenly feasting on personal artifacts that have, for years, been gathering dust in unvisited corners of the internet. For those reading from outside Europe, the deed is already done. The deadline announced by Meta applied only to Europeans. The posts of American Facebook and Instagram users have been training Meta AI models since 2023, according to company spokesperson Matthew Pollard.

    Meta is not the only company turning my online history into AI fodder. WIRED’s Reece Rogers recently discovered that Google’s AI search feature was copying his journalism. But finding out which personal remnants exactly are feeding future chatbots was not easy. Some sites I’ve contributed to over the years are hard to trace. Early social network Myspace was acquired by Time Inc. in 2016, which in turn was acquired by a company called Meredith Corporation two years later. When I asked Meredith about my old account, they replied that Myspace had since been spun off to an advertising firm, Viant Technology. An email to a company contact listed on its website was returned with a message that the address “couldn’t be found.”

    Asking companies still in business about my old accounts was more straightforward. Blogging platform Tumblr, owned by WordPress owner Automattic, said unless I’d opted out, the public posts I made as a teenager will be shared with “a small network of content and research partners, including those that train AI models” per a February announcement. YahooMail, which I used for years, told me that a sample of old emails—which have apparently been “anonymized” and “aggregated”—are being “utilized” by an AI model internally to do things like summarize messages. Microsoft-owned LinkedIn also said my public posts were being used to train AI although some “personal” details included in those posts were excluded, according to a company spokesperson, who did not specify what those personal details were.

    Morgan Meaker

    Source link

  • How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet

    How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet

    “We ultimately got lucky that our parameters and time range was right. If either of those were wrong, we would have … continued to take guesses/shots in the dark,” Grand says in an email to WIRED. “It would have taken significantly longer to precompute all the possible passwords.”

    Grand and Bruno created a video to explain the technical details more thoroughly.

    RoboForm, made by US-based Siber Systems, was one of the first password managers on the market, and currently has more than 6 million users worldwide, according to a company report. In 2015, Siber seemed to fix the RoboForm password manager. In a cursory glance, Grand and Bruno couldn’t find any sign that the pseudo-random number generator in the 2015 version used the computer’s time, which makes them think they removed it to fix the flaw, though Grand says they would need to examine it more thoroughly to be certain.

    Siber Systems confirmed to WIRED that it did fix the issue with version 7.9.14 of RoboForm, released June 10, 2015, but a spokesperson wouldn’t answer questions about how it did so. In a changelog on the company’s website, it mentions only that Siber programmers made changes to “increase randomness of generated passwords,” but it doesn’t say how they did this. Siber spokesman Simon Davis says that “RoboForm 7 was discontinued in 2017.”

    Grand says that, without knowing how Siber fixed the issue, attackers may still be able to regenerate passwords generated by versions of RoboForm released before the fix in 2015. He’s also not sure if current versions contain the problem.

    “I’m still not sure I would trust it without knowing how they actually improved the password generation in more recent versions,” he says. “I’m not sure if RoboForm knew how bad this particular weakness was.”

    Customers may also still be using passwords that were generated with the early versions of the program before the fix. It doesn’t appear that Siber ever notified customers when it released the fixed version 7.9.14 in 2015 that they should generate new passwords for critical accounts or data. The company didn’t respond to a question about this.

    If Siber didn’t inform customers, this would mean that anyone like Michael who used RoboForm to generate passwords prior to 2015—and are still using those passwords—may have vulnerable passwords that hackers can regenerate.

    “We know that most people don’t change passwords unless they’re prompted to do so,” Grand says. “Out of 935 passwords in my password manager (not RoboForm), 220 of them are from 2015 and earlier, and most of them are [for] sites I still use.”

    Depending on what the company did to fix the issue in 2015, newer passwords may also be vulnerable.

    Last November, Grand and Bruno deducted a percentage of bitcoins from Michael’s account for the work they did, then gave him the password to access the rest. The bitcoin was worth $38,000 per coin at the time. Michael waited until it rose to $62,000 per coin and sold some of it. He now has 30 BTC, now worth $3 million, and is waiting for the value to rise to $100,000 per coin.

    Michael says he was lucky that he lost the password years ago because, otherwise, he would have sold off the bitcoin when it was worth $40,000 a coin and missed out on a greater fortune.

    “That I lost the password was financially a good thing.”

    Kim Zetter

    Source link

  • ‘TunnelVision’ Attack Leaves Nearly All VPNs Vulnerable to Spying

    ‘TunnelVision’ Attack Leaves Nearly All VPNs Vulnerable to Spying

    Researchers have devised an attack against nearly all virtual private network applications that forces them to send and receive some or all traffic outside of the encrypted tunnel designed to protect it from snooping or tampering.

    TunnelVision, as the researchers have named their attack, largely negates the entire purpose and selling point of VPNs, which is to encapsulate incoming and outgoing Internet traffic in an encrypted tunnel and to cloak the user’s IP address. The researchers believe it affects all VPN applications when they’re connected to a hostile network and that there are no ways to prevent such attacks except when the user’s VPN runs on Linux or Android. They also said their attack technique may have been possible since 2002 and may already have been discovered and used in the wild since then.

    Reading, Dropping, or Modifying VPN Traffic

    The effect of TunnelVision is that “the victim’s traffic is now decloaked and being routed through the attacker directly,” a video demonstration explained. “The attacker can read, drop or modify the leaked traffic and the victim maintains their connection to both the VPN and the internet.”

    The attack works by manipulating the DHCP server that allocates IP addresses to devices trying to connect to the local network. A setting known as option 121 allows the DHCP server to override default routing rules that send VPN traffic through a local IP address that initiates the encrypted tunnel. By using option 121 to route VPN traffic through the DHCP server, the attack diverts the data to the DHCP server itself. Researchers from Leviathan Security explained:

    Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway. When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.

    We use DHCP option 121 to set a route on the VPN user’s routing table. The route we set is arbitrary and we can also set multiple routes if needed. By pushing routes that are more specific than a /0 CIDR range that most VPNs use, we can make routing rules that have a higher priority than the routes for the virtual interface the VPN creates. We can set multiple /1 routes to recreate the 0.0.0.0/0 all traffic rule set by most VPNs.

    Pushing a route also means that the network traffic will be sent over the same interface as the DHCP server instead of the virtual network interface. This is intended functionality that isn’t clearly stated in the RFC. Therefore, for the routes we push, it is never encrypted by the VPN’s virtual interface but instead transmitted by the network interface that is talking to the DHCP server. As an attacker, we can select which IP addresses go over the tunnel and which addresses go over the network interface talking to our DHCP server.

    We now have traffic being transmitted outside the VPN’s encrypted tunnel. This technique can also be used against an already established VPN connection once the VPN user’s host needs to renew a lease from our DHCP server. We can artificially create that scenario by setting a short lease time in the DHCP lease, so the user updates their routing table more frequently. In addition, the VPN control channel is still intact because it already uses the physical interface for its communication. In our testing, the VPN always continued to report as connected, and the kill switch was never engaged to drop our VPN connection.

    The attack can most effectively be carried out by a person who has administrative control over the network the target is connecting to. In that scenario, the attacker configures the DHCP server to use option 121. It’s also possible for people who can connect to the network as an unprivileged user to perform the attack by setting up their own rogue DHCP server.

    The attack allows some or all traffic to be routed through the unencrypted tunnel. In either case, the VPN application will report that all data is being sent through the protected connection. Any traffic that’s diverted away from this tunnel will not be encrypted by the VPN and the internet IP address viewable by the remote user will belong to the network the VPN user is connected to, rather than one designated by the VPN app.

    Interestingly, Android is the only operating system that fully immunizes VPN apps from the attack because it doesn’t implement option 121. For all other OSes, there are no complete fixes. When apps run on Linux there’s a setting that minimizes the effects, but even then TunnelVision can be used to exploit a side channel that can be used to de-anonymize destination traffic and perform targeted denial-of-service attacks. Network firewalls can also be configured to deny inbound and outbound traffic to and from the physical interface. This remedy is problematic for two reasons: (1) A VPN user connecting to an untrusted network has no ability to control the firewall, and (2) it opens the same side channel present with the Linux mitigation.

    The most effective fixes are to run the VPN inside of a virtual machine whose network adapter isn’t in bridged mode or to connect the VPN to the internet through the Wi-Fi network of a cellular device. The research, from Leviathan Security researchers Lizzie Moratti and Dani Cronce, is available here.

    This story originally appeared on Ars Technica.

    Dan Goodin, Ars Technica

    Source link

  • CipherDriveOne Kryptr Achieves Common Criteria Certification

    CipherDriveOne Kryptr Achieves Common Criteria Certification

    New Strong Encryption Software Recognized For Passing NIAP Testing Required For The Digital Battlefield


    SAN JOSE, Calif., May 6, 2024 (Newswire.com)
    –
    KLC Group Inc. proudly announces the achievement of the Common Criteria certification for its latest product, CipherDriveOne Kryptr. This certification marks a significant milestone in data security and solidifies CipherDriveOne Kryptr’s position as a leading solution for protecting the government’s classified information arena.

    CipherDriveOne Kryptr is a robust Software Full Disk Encryption (SwFDE) product that utilizes FIPS 140-2 certified crypto algorithms, including AES-256-bit encryption. Combined with CipherDriveOne pre-boot hardware-based Disk Encryption (HwFDE), this forms two independent layers of data at rest, ensuring up to top-secret level security for sensitive data across various platforms. What sets CipherDriveOne Kryptr apart is its Windows, Linux, and Hypervisor support and versatile authentication options, offering single, two-factor, and multifactor authentication capabilities.

    The key benefits for organizations:

    • Pre-boot Locking. Before your operating system boots up, it’s protected. CipherDriveOne Kryptr verifies your identity and fortifies your entire hard drive against unauthorized access. Your data stays safe and secure, always.

    • Custom User Roles. With support for up to four unique user roles, CipherDriveOne Kryptr empowers you to customize access and permissions, putting you in control of your device using username/password and smart cards.

    • Rules-based Configurations. With highly configurable login, password, and lock-out functions, including a Dead man’s switch, CipherDriveOne Kryptr can match the requirements of the highest security policies.

    • Offers Secure Erase. With a simple “crypto erase” function, the software can wipe your hard drive clean, permanently erasing sensitive data.

    • Audit and Logging. Administrators can easily stay compliant by reviewing audit logs and authentication reports, ensuring easy adherence to privacy compliance laws.

    “Our Kryptr team has worked tirelessly to develop CipherDriveOne Kryptr, ensuring that it meets the rigorous standards set forth by Common Criteria,” adds Kurt Lennartsson, CEO at KLC Group. “This certification validates our efforts and reaffirms our dedication to providing the US government and defense industry customers with the most secure encryption solutions available.”

    The certification also means that CipherDriveOne Kryptr will be listed on the NSA CSfC (National Security Agency Commercial Solutions for Classified) website, further enhancing its credibility and visibility within the industry.

    “We are thrilled to receive the Common Criteria certification for CipherDriveOne Kryptr,” says John Myung, President of KLC Group. “This recognition underscores our commitment to pushing cutting-edge encryption solutions for the Commercial Solutions for Classified programs.”

    CipherDriveOne Kryptr is currently available for Windows 10/11 and RedHat Linux 8/9, catering to many users across different platforms.

    Common Criteria listing: https://www.niap-ccevs.org/Product/Compliant.cfm?PID=11399

    For more information about CipherDriveOne Kryptr and its security features, visit. 
    https://cipherdriveone.com/cipherdriveone-kryptr

    Source: KLC Group Inc

    Source link

  • Sarcophagus Is a Dead Man’s Switch for Your Crypto Wallet

    Sarcophagus Is a Dead Man’s Switch for Your Crypto Wallet

    The system, says Hamilton, is designed to be “anti-fragile,” meaning it depends on no party’s good will to achieve its end. Nobody but the originator and recipient have access to the contents of the file, all other parties are financially incentivized to cooperate, and redundancies ensure the payload is always available. “Little strings of data control our lives,” says Hamilton. Because humans are “gooey”—that is, unreliable and prone to mistakes—the only sensible protection for those strings is cryptography, he adds.

    There are various other ways, says Hamilton, that Sarcophagus might be applied outside of a crypto setting. A digital dead man’s switch could be used by a whistleblower to release incriminating material or by a dissident or journalist who suspects a threat to their life, as a kind of SOS. In a more mundane context, it could be used to pass account credentials from one generation of employees to the next.

    ILLUSTRATION: ALBERTO MIRANDA

    Sarcophagus has received $6 million in funding to date from investors including Placeholder, Blockchange, and Hinge Capital. The project is managed by a decentralized autonomous organization, or DAO—a collective that governs the Sarcophagus treasury and development process through a system of community voting. In its present state, Sarcophagus is best described as an “early beta,” says Hamilton. The service is operational but not widely used, and it does not generate significant revenue—only a small cut of every payment.

    One barrier to broader adoption is that recipients must already have access to a crypto wallet, whose credentials are used to decrypt the data payload. There is an option to create a new wallet for someone, along with a PDF walking them through the process for accessing it, but a level of crypto literacy would certainly help.

    As the generation of people comfortable with crypto grows older and begins to reckon more seriously with their mortality, Hamilton thinks a larger subset will begin to understand the need for a service like Sarcophagus. “Millennials are just starting to think about this problem,” he says. Hamilton imagines that more accessible services will be built atop Sarcophagus technology, too. These “boomer products,” as Hamilton calls them, one of which his own team is developing, will abstract away some of the technical complexity, such that people won’t realize they are using crypto infrastructure. (Although there is an inevitable trade-off between security and convenience.)

    In any case, says Hamilton, the present system—whereby credentials to high-value crypto wallets might be stored in bank vaults protected by armed guards—approaches the absurd. The “billion-dollar file cabinet” has to go, says Hamilton. “We are still relying on heavy metal doors and guys with guns when cryptography itself can act as a steel wall of incredible thickness.”

    This article originally appeared in the May/June 2024 issue of WIRED UK.

    Joel Khalili

    Source link

  • Apple’s iMessage Encryption Puts Its Security Practices in the DOJ’s Crosshairs

    Apple’s iMessage Encryption Puts Its Security Practices in the DOJ’s Crosshairs

    The argument is one that some Apple critics have made for years, as spelled out in an essay in January by Cory Doctorow, the science fiction writer, tech critic, and co-author of Chokepoint Capitalism. “The instant an Android user is added to a chat or group chat, the entire conversation flips to SMS, an insecure, trivially hacked privacy nightmare that debuted 38 years ago—the year Wayne’s World had its first cinematic run,” Doctorow writes. “Apple’s answer to this is grimly hilarious. The company’s position is that if you want to have real security in your communications, you should buy your friends iPhones.”

    In a statement to WIRED, Apple says it designs its products to “work seamlessly together, protect people’s privacy and security, and create a magical experience for our users,” and adds that the DOJ lawsuit “threatens who we are and the principles that set Apple products apart” in the marketplace. The company also says it hasn’t released an Android version of iMessage because it couldn’t ensure that third parties would implement it in ways that met the company’s standards.

    “If successful, [the lawsuit] would hinder our ability to create the kind of technology people expect from Apple—where hardware, software, and services intersect,” the statement continues. “It would also set a dangerous precedent, empowering government to take a heavy hand in designing people’s technology. We believe this lawsuit is wrong on the facts and the law, and we will vigorously defend against it.”

    Apple has, in fact, not only declined to build iMessage clients for Android or other non-Apple devices, but actively fought against those who have. Last year, a service called Beeper launched with the promise of bringing iMessage to Android users. Apple responded by tweaking its iMessage service to break Beeper’s functionality, and the startup called it quits in December.

    Apple argued in that case that Beeper had harmed users’ security—in fact, it did compromise iMessage’s end-to-end encryption by decrypting and then re-encrypting messages on a Beeper server, though Beeper had vowed to change that in future updates. Beeper cofounder Eric Migicovsky argued that Apple’s heavyhanded move to reduce Apple-to-Android texts to traditional text messaging was hardly a more secure alternative.

    “It’s kind of crazy that we’re now in 2024 and there still isn’t an easy, encrypted, high-quality way for something as simple as a text between an iPhone and an Android,” Migicovsky told WIRED in January. “I think Apple reacted in a really awkward, weird way—arguing that Beeper Mini threatened the security and privacy of iMessage users, when in reality, the truth is the exact opposite.”

    Even as Apple has faced accusations of hoarding iMessage’s security properties to the detriment of smartphone owners worldwide, it’s only continued to improve those features: In February it upgraded iMessage to use new cryptographic algorithms designed to be immune to quantum codebreaking, and last October it added Contact Key Verification, a feature designed to prevent man-in-the-middle attacks that spoof intended contacts to intercept messages. Perhaps more importantly, it’s vowed to adopt the RCS standard to allow for improvements in messaging with Android users—although the company did not say whether those improvements would include end-to-end encryption.

    Andy Greenberg, Andrew Couts

    Source link

  • Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private

    Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private

    The third new feature, which is not enabled by default and which Signal recommends mainly for high-risk users, allows you to turn off not just your number’s visibility but its discoverability. That means no one can find you in Signal unless they have your username, even if they already know your number or have it saved in their address book. That extra safeguard might be important if you don’t want anyone to be able to tie your Signal profile to your phone number, but it will also make it significantly harder for people who know you to find you on Signal.

    The new phone number protections should now make it possible to use Signal to communicate with untrusted people in ways that would have previously presented serious privacy risks. A reporter can now post a Signal username on a social media profile to allow sources to send encrypted tips, for instance, without also sharing a number that allows strangers to call their cell phone in the middle of the night. An activist can discreetly join an organizing group without broadcasting their personal number to people in the group they don’t know.

    In the past, using Signal without exposing a private number in either of those situations would have required setting up a new Signal number on a burner phone—a difficult privacy challenge for people in many countries that require identification to buy a SIM card—or with a service like Google Voice. Now you can simply set a username instead, which can be changed or deleted at any time. (Any conversations you’ve started with the old username will switch over to the new one.) To avoid storing even those usernames, Signal is also using a cryptographic function called a Ristretto hash, which allows it to instead store a list of unique strings of characters that encode those handles.

    Amid these new features designed to calibrate exactly who can learn your phone number, however, one key role for that number hasn’t changed: There’s still no way to avoid sharing your phone number with Signal itself when you register. The fact that this requirement persists even after Signal’s upgrade will no doubt rankle some critics who have pushed Signal’s developers to better cater to users seeking more complete anonymity, such that even Signal’s own staff can’t see a phone number that might identify users or hand that number over to a surveillance agency wielding a court order.

    Whittaker says that, for better or worse, a phone number remains a necessary requisite as the identifier Signal privately collects from its users. That’s partly because it prevents spammers from creating endless accounts since phone numbers are scarce. Phone numbers are also what allow anyone to install Signal and have it immediately populate with contacts from their address book, a key element of its usability.

    In fact, designing a system that prevents spam accounts and imports the user’s address book without requiring a phone number is “a deceptively hard problem,” says Whittaker. “Spam prevention and actually being able to connect with your social graph on a communications app—those are existential concerns,” she says. “That’s the reason that you still need a phone number to register, because we still need a thing that does that work.”

    Andy Greenberg

    Source link

  • Britain’s got some of Europe’s toughest surveillance laws. Now it wants more

    Britain’s got some of Europe’s toughest surveillance laws. Now it wants more

    Press play to listen to this article

    Voiced by artificial intelligence.

    LONDON — The U.K. already has some of the most far-reaching surveillance laws in the democratic world. Now it’s rushing to beef them up even further — and tech firms are spooked.

    Britain’s government wants to build on its landmark Investigatory Powers Act, a controversial piece of legislation dubbed the “snooper’s charter” by critics when introduced back in 2016.

    That law — introduced in the wake of whistleblower Edward Snowden’s revelations of mass state surveillance — attempted to introduce more accountability into the U.K. intelligence agencies’ sprawling snooping regime by formalizing wide-ranging powers to intercept emails, texts, web history and more.

    Now new legislation is triggering a fresh outcry among both industry execs and privacy campaigners — who say it could hobble efforts to protect user privacy.

    Industry body TechUK has written to Home Secretary James Cleverly airing its complaints. The group’s letter warns that the Investigatory Powers (Amendment) Bill threatens technological innovation; undermines the sovereignty of other nations; and could unleash dire consequences if it sets off a domino effect overseas.

    Tech companies are most concerned by a change that would allow the Home Office to issue notices preventing them from making technical updates that might impede information-sharing with U.K. intelligence agencies. 

    TechUK argues that, combined with pre-existing powers, the changes would “grant a de facto power to indefinitely veto companies from making changes to their products and services offered in the U.K.” 

    “Using this power, the government could prevent the implementation of new end-to-end encryption, or stop developers from patching vulnerabilities in code that the government or their partners would like to exploit,” Meredith Whittaker, president of secure messaging app Signal, told POLITICO when the bill was first unveiled. 

    The Home Office, Britain’s interior ministry, remains adamant it’s a technical and procedural set of tweaks. Home Office Minister Andrew Sharpe said at the bill’s committee stage in the House of Lords that the law was “not going to … ban end-to-end encryption or introduce a veto power for the secretary of state … contrary to what some are incorrectly speculating.”

    “We have always been clear that we support technological innovation and private and secure communications technologies, including end-to-end encryption,” a government spokesperson said. “But this cannot come at a cost to public safety, and it is critical that decisions are taken by those with democratic accountability.”

    Encryption threat

    Despite the protestations of industry and campaigners, the British government is whisking the bill through parliament at breakneck speed — risking the ire of lawmakers.

    Ministers have so far blocked efforts’ to refine the bill in the House of Lords, the U.K.’s upper chamber. But there are more opportunities to contest the legislation coming and industry is already making appeals to MPs in the hopes of paring it back in the House of Commons.

    Some companies including Apple have threatened to pull their services from the UK if asked to undermine encryption under Britain’s laws | Feline Lim/Getty Images

    “We stress the critical need for adequate time to thoroughly discuss these changes, highlighting that rigorous scrutiny is essential given the international precedent they will set and their very serious impacts,” the TechUK letter states.

    The backdrop to the row is the fraught debate on encryption that unfolded during the passage of the earlier Online Safety Act, which companies and campaigners argued could compel companies to break encryption in the name of online safety. 

    The bill ultimately said that the government can call for the implementation of this technology when it’s “technically feasible” and simultaneously preserves privacy. 

    Apple, WhatsApp and Signal have threatened to pull their services from the U.K. if asked to undermine encryption under U.K. laws. 

    Since the Online Safety Act passed in November, Meta announced that it had begun its rollout of end-to-end encryption on its Messenger service.

    In response, Cleverly issued a statement saying he was “disappointed” that the company had gone ahead with the move despite repeated government warnings that it would make identifying child abusers on the platform more difficult. 

    Critics see a pincer movement. “Taken together, it appears that the Online Safety Bill’s Clause 122 is intended to undermine existing encryption, while the updates to the IPA are intended to block further rollouts of encryption,” said Whittaker.  

    Beyond encryption 

    In addition to the notice regime, rights campaigners are worried that the bill allows for the more permissive use of bulk data where there are “low or no” expectations of privacy, for wide-ranging purposes including training AI models.

    Lib Dem peer Christopher Fox argued in the House of Lords that this “creates an essentially new and essentially undefined category of information” which marks “a departure from existing privacy law,” notably the Data Protection Act.

    Director of campaign group Big Brother Watch, Silkie Carlo, also has issues with the newly invented category. With CCTV footage or social media posts for example, people may not have an expectation of privacy, “[but] that’s not the point, the point is that that data taken together and processed in a certain way, can be incredibly intrusive.”

    Big Brother Watch is also concerned about how the bill deals with internet connection records — i.e. web logs for individuals for the last 12 months. These can currently be obtained by agencies when specific criteria is known, like the person of interest’s identity. Changes to the bill would broaden this for the purpose of “target discovery,” which Big Brother Watch characterizes as “generalized surveillance.”  

    Members of the House of Lords are also worried about the bill’s proposal to expand the number of people who can sanction spying on parliamentarians themselves. Right now, this requires the PM’s sign-off, but under the bill, the PM would be able to designate deputies for when he is not “available.” The change was inspired by the period in which former PM Boris Johnson was incapacitated with COVID-19.

    The bill will return to the House of Lords on January 23, before heading to the House of Commons to be debated by MPs | Tolga Akmen/AFP via Getty Images

    “The purpose of this bill is to give the intelligence agencies a bit of extra agility at the margins, where the existing Rolls Royce regime is proving a bit clunky and bureaucratic,” argues David Anderson, crossbench peer and author of a review that served as a blueprint for the bill. “If you start throwing in too many safeguards, you will negate that purpose, and you will not solve the problem that bill is addressing.” 

    Anderson proposed the changes relating to spying on MPs and peers are necessary “if the prime minister has got COVID, or if they’re in a foreign country where they have no access to secure communications.” 

    This could even apply in cases where there’s a conflict of interest because spies want to snoop on the PM’s relatives or the PM himself, he added.

    Amendments proposed by peers at the committee stage were uniformly rejected by the government. 

    The bill will return to the House of Lords for the next stage of the legislative process on January 23, before heading to the House of Commons to be debated by MPs.

    “Our overarching concern is that the significance of the proposed changes to the notices regime are presented by the Home Office as minor adjustments and as such are being downplayed,” reads the TechUK letter.

    “What we’re seeing across these different bills is a continual edging further towards … turning private tech companies into arms of a surveillance state,” says Carlo.

    Laurie Clarke

    Source link

  • Inside the police force scouring the internet to save abused children

    Inside the police force scouring the internet to save abused children

    EUROPOL HEADQUARTERS, THE HAGUE — “Please knock. Do not enter,” said the sign on the door of Europe’s heavily-secured law enforcement headquarters in the Netherlands.

    Inside, detectives were staring at their computers, examining a video of a newborn girl being molested. 

    A group of international detectives was trying to identify details — a toy, a clothing label, a sound — that would allow them to rescue the girl and arrest those who sexually abused her, recorded it and then shared it on the internet.

    Even a tiny hint could help track down the country where the baby girl was assaulted, allowing the case to be transferred to the right police authority for further investigation. Such details matter when police are trying to tackle crimes carried out behind closed doors but disseminated online across the world.

    Finding and stopping child sex offenders is gruesome and frustrating most of the time — yet hugely rewarding sometimes — police officers part of the international task force at the EU agency Europol told POLITICO. 

    Offenders are getting better at covering their digital tracks and law enforcement officials say they don’t have the tools they need to keep up. The increasing use of encrypted communication online makes investigators’ work harder, especially as a pandemic that kept people at home and online ramped up a flood of abuse images and videos.

    In 2022, social media giant Meta Platforms found and reported 26 million images on Facebook and Instagram. Teenagers’ favorite apps Snapchat and TikTok respectively filed over 550,000 and nearly 290,000 reports to the U.S. National Center for Missing and Exploited Children, an organization acting as a clearing house under U.S. law for child sexual abuse material (CSAM) content that technology firms detect and spot.

    The European Commission in December also ordered Meta to explain what it was doing to fight the spread of illegal sexual images taken by minors themselves and shared through Instagram, under the EU’s new content-moderation rulebook, the Digital Services Act (DSA).

    Politicians across the world are keen to act. In the European Union and the United Kingdom, legislators have drafted laws to dig up more illegal content and extend law enforcement’s powers to crack down on child sexual abuse material.

    But those efforts have ignited a fierce public debate on what takes precedence: granting police new abilities to go after offenders or preserving privacy and protections against states’ and digital platforms’ mass online surveillance.

    The scale of the problem

    The Europol task force has met twice a year since 2014 to accelerate investigations to identify victims, most recently in November. It has almost tripled in size to 33 investigators representing 26 countries including Germany, Australia and the United States. 

    “You might recognize things that are in the images or you might recognize the sounds in the background or the voices. If you do that together with multiple nationalities in one room, it can be really effective,” said Marijn Schuurbiers, head of operations at Europol’s European Cybercrime Centre (EC3).

    Still, too often detectives feel like they’re swimming against the tide, as the amount of child sexual abuse material circulating online surges.

    Europol created a database in 2016 and this system now holds 85 million unique photos and videos of children, many found on pedophile forums on the “dark web” — the part of the internet that isn’t publicly searchable and requires special software to browse.

    “We can work hours and hours on end and we’re still scratching the surface. It’s terrifying,” said Mary, a national police officer from a non-EU country with 17 years of experience. She requested not to use her last name to protect her identity while doing investigative work. 

    The task force in November went through 432 files, each containing tens of thousands of images, and found the most likely country for 285 of the children abused in the images. Police believe it likely identified 74 of the victims, three of whom were rescued by the time of publication. Two offenders were arrested. 

    “We have some successes. But all I can see is those we can’t help,” Mary said. 

    Many Western agencies outside of the U.S. are restricted by privacy provisions in the software they use like facial recognition tools. They often have to make do with a mix of manual analysis and freely accessible tools they can get from the internet.

    “If you have like thousands or hundreds of thousands or even millions of pictures, it’s basically impossible to go manually through them, one by one,” said Schuurbiers. 

    Since 2017, the agency has regularly been asking for public help to identify objects in images like plastic bags and a logo on a school uniform. Europol said it has gotten 27,000 tips from internet sleuths including investigative outlet Bellingcat, some of which led to 23 kids being identified and five offenders being prosecuted.  

    Groups on the “dark web” remain the principal place where offenders share illegal content, according to Europol. 

    But police and child protection hotlines are seeing a growing number of images cropping up on popular and accessible platforms like Facebook, Instagram, Snapchat and Instagram. The pandemic made this worse as more children and teenagers also joined social media and gaming websites where offenders got better at grooming victims and blackmailing them into making sexual content.

    Law enforcement agencies around the world have also sounded the alarm that offenders are also connecting with minors and exchanging illegal content on encrypted messaging apps like WhatsApp, Signal and iMessage, making it extremely challenging to find the content. WhatsApp, for instance, scans the photos and descriptions users but is unable to monitor their highly secure messages.

    Finding more child sexual abuse material

    The crisis of child sexual abuse material proliferating online has got governments pushing through sweeping new legislation to make it possible for law enforcement to investigate more online material and use artificial intelligence tools to help them. 

    The European Commission has proposed a law that could force tech companies like Meta, Apple and Google to scan messages and content stored in the cloud for images of abuse — and even for conversations of offenders seeking to manipulate minors upon a judge’s order. The companies would have to report the content, so it could end up with Europol or other national investigators, and then remove it.

    The United Kingdom recently passed the Online Safety Act, which some legal experts say would allow the country’s platform regulator Ofcom to force companies to break encryption to find sexual abuse. Government and Ofcom officials have said companies would not currently be forced to monitor content because tools to bypass encryption and also preserve privacy do not exist at the moment.

    Both plans have sparked widespread backlash among digital rights activists, tech experts and some lawyers. They fear the laws effectively force tech firms to ditch encryption, and that indiscriminate scanning will lead to mass surveillance.

    Negotiations on the EU draft law remain on thin ice, with politicians and member countries clashing over how far to go in hunting down potential illegal child abuse. And Brussels also finalized in December a new law, the Artificial Intelligence Act, governing how law enforcement will be able to use AI tools like facial recognition software to go through footage and images. 

    Still, EU lawmakers have already significantly expanded Europol’s powers to build new artificial intelligence tools and handle more data. Under the Digital Services Act, Europol and national police will also be able to swiftly compel tech companies to remove publicly accessible illegal content and hand over information about users posting such images.

    Anne, a Europol investigator, said she doesn’t keep count of the number of kids she’s identified in her 12 years working in the field — but she remembers them. She requested not to use her last name to protect her investigative work.

    “The thing that I will always remember from my cases is the images,” she said. “They stay in my head.”

    Clothilde Goujard

    Source link

  • UK dials up fight with Meta over encryption

    UK dials up fight with Meta over encryption

    Press play to listen to this article

    Voiced by artificial intelligence.

    LONDON — The gloves are off in the U.K. government’s deepening spat with tech giant Meta.

    On Wednesday, Britain’s Home Secretary Suella Braverman unveiled a fresh campaign aimed at making the Mark Zuckerberg-led tech giant rethink its plan to roll out end-to-end encryption on Facebook and Instagram — a move she says will hamper the police’s ability to catch pedophiles.

    At a background briefing for reporters on Tuesday, Home Office officials used graphic language to describe the types of child sexual abuse material that they say risks going undetected if Meta goes ahead with its plans. A video put together as part of the campaign features a victim of child sex abuse appealing directly to Meta chief Mark Zuckerberg to rethink plans to roll out encryption.

    The National Crime Agency has estimated that making messages on Facebook Messenger and Instagram end-to-end encrypted will wipe out more than 85 percent of the platforms’ reports of online child sexual abuse material.

    Meta, which aims to finalize the encryption rollout by the end of the year, has said it plan to continue policing its platforms for grooming and the sharing of child abuse content. It will do this by, for example, watching for suspicious behavior from accounts and providing a range of controls to help kids avoid harm.

    But Braverman said she’s not yet been convinced that these measures will make up for the shortfall in reports that the encryption changes are expected to bring about, prompting her to write to the tech giant in July asking it to stop its encryption rollout if it can’t give stronger assurances.

    “Meta has failed to provide assurances that they will keep their platforms safe from sickening abusers,” Braverman said in a press release. “They must develop appropriate safeguards to sit alongside their plans for end-to-end encryption.”

    “We don’t think people want us reading their private messages so have spent the last five years developing robust safety measures to prevent, detect and combat abuse while maintaining online security,” said a Meta spokesperson.

    The company on Wednesday also published an updated report setting out these measures, such as restricting people over 19 from messaging teens who don’t follow them and using technology to identify and take action against malicious behaviour.

    A new front in the encryption fight

    The campaign, which is also backed by a slew of child protection groups and law enforcement bodies, is just the latest round of a bruising battle between U.S. tech companies and the U.K. government over encryption that has largely centered on Britain’s new draft internet rulebook, the Online Safety Bill.

    The bill, which passed its final parliamentary hurdle Tuesday, would empower Britain’s comms regulator Ofcom to force tech companies to monitor messenger apps for illegal child abuse content. That’s proven controversial, with dozens of cryptography experts saying that the powers would effectively undermine end-to-end encryption — tech that enables only the sender and receiver to view messages.

    Tech execs like Signal’s Meredith Whittaker and WhatsApp’s Will Cathcart have suggested they’d rather have their encrypted services blocked in the U.K. than undermine privacy for millions of users on their apps. 

    But Ofcom officials have previously said there’d be a high bar for them to mandate monitoring on encrypted apps, while any order for Meta to scan its messenger apps for content would prove highly contentious for the regulator. 

    That’s what’s prompted the U.K. government to lobby for Meta to rethink its plans in the first place.

    “We urge companies looking to introduce end-to-end encryption to their services to think carefully about the impact on younger, vulnerable users,” said Susie Hargreaves, chief executive of child protection group the Internet Watch Foundation in a statement. 

    Vincent Manancourt

    Source link

  • Keep Email Data Safe for Less Than $40 During Our Labor Day Sale, Now Through September 4 | Entrepreneur

    Keep Email Data Safe for Less Than $40 During Our Labor Day Sale, Now Through September 4 | Entrepreneur

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    Of the thousands of emails you send and sort through for yourself and your business, how many of them include important data? Since emails are typically a crucial part of business activities, it’s time to take backing them up seriously.

    Though it’s not often thought about, losing your emails would be catastrophic. That’s where the Individual Edition of Mail Backup X comes in, offering a convenient and affordable way to backup, archive, manage and convert your emails. During our Labor Day Sale, you can score this handy service for only $39.97 (reg. $179) with no coupon code required. This price drop only lasts until September 4 at 11:59 p.m. Pacific.

    More than 42,000 business and personal users are already taking advantage of Mail Backup X worldwide. It can help you safeguard your email data easily, as it works with major mail clients like Microsoft Outlook, Office 365, Microsoft Exchange, Thunderbird, Postbox, and Apple Mail. It can even backup from mail services like Gmail, Outlook.com, Yahoo, Office365, Microsoft Exchange, or any other service that supports IMAP protocol.

    Aside from backing up your emails, you’ll also enjoy features like Mail Backup X’s archive file viewer. That allows you to quickly search and view your emails from the archives, which are compressed to save you up to three times the amount of storage space. Plus, its archive allows for almost any file like .pst, .ost, .mbox, .olk, .eml, .rge, and more to be imported. No wonder CNET awarded Mail Backup X a perfect 5-star rating.

    You’ll also enjoy mirror backup, migration services that move mail into a new account in Office365, and 100% privacy. Enjoy peace of mind that your data is protected by military-grade AES 256-bit encryption and your own private key, meaning your personal or business email data is only visible to you.

    Keep your emails and business secure with Mail Backup X Individual Edition, now just $39.97 (reg. $179) during our Labor Day Sale. No coupon is necessary, but this deal only lasts until September 4 at 11:59 p.m. Pacific.

    Prices subject to change.

    Entrepreneur Store

    Source link

  • The Triitus Hyperclient, a CSfC Solution, Partners With CipherDriveOne, an NSA CSfC Hardware Data-at-Rest Layer

    The Triitus Hyperclient, a CSfC Solution, Partners With CipherDriveOne, an NSA CSfC Hardware Data-at-Rest Layer

    New Partnership Protects Cross-Domain Remote Users From Hackers and Ransomware Trying to Steal Sensitive Data on Laptops and Workstations


    SAN JOSE, Calif., May 16, 2023 (Newswire.com)
    –
    Triitus is a cutting-edge solution that is making waves in government cybersecurity. In partnership with KLC Group and using CipherDriveOne technology, Triitus adds to its position to meet the NSA CSfC Data-at-Rest requirements, ensuring its clients have the highest level of Data-at-Rest security possible. With the growing use of cross-domain platforms by defense contractors, military, and government, it is important for all to take necessary measures to protect their sensitive information.

    The Triitus Hyperclient is a powerful and secure solution for remote or mobile access to classified government systems. With a comprehensive set of capabilities, the Triitus Hyperclient provides an unmatched level of protection for existing networks. The Triitus Hyperclient provides secure isolation and leverages Hardware-Assisted Security, delivering robust protections over networks without impact to performance. Additionally, Triitus offers over-the-air management capabilities to administer and maintain the deployed solution. The result is easier centralization of management processes and effortless user experience when it comes to Virtual Desktop Infrastructure (VDI). On top of that, all this functionality works seamlessly on both thin and thick clients, so organizations can choose the right type based on their needs.

    CipherDriveOne, a KLC Group Company, adds an additional layer of key encryption and authentication on top of any OPAL 2.0 self-encrypting hard drives. The protection of the hard drive’s content is immediate, operating system agnostic and governed by a certified FIPS-140-2 level key encryption technology with the availability of single and two-factor authentication. The problem is that a self-encrypting hard drive is at its most vulnerable point when the computer is turned off and the data is at rest.  

    “Working with another industry leader on DAR will be a big win for government,” said Kurt Lennartsson. “We are pleased to layer CipherDriveOne software to meet and exceed the CSfC DAR standard.”

    With CipherDriveOne, the hard drive is locked with a pre-boot authentication software preventing the hard drive from being accessed by an unauthorized user. Once combined with any Common Criteria SSD, CipherDriveOne provides Triitus one full independent layer of encryption to meet the NSA’s CSfC Data-at-Rest requirement.

    “Triitus pushes the envelope in providing the highest level of security with the Triitus Hyperclient,” said Kevin Kuhns, COO. “We are pleased to partner with CipherDriveOne to provide a layer of full disk encryption per the CSfC DAR standard.”

    CipherDriveOne is FIPS and Common Criteria certified. It is listed on the NSA’s Commercial Solutions for Classified Program (CSfC) under Hardware Full Disk Encryption. Link: https://www.nsa.gov/Resources/Commercial-Solutions-for-Classified-Program/Components-List/#hw-fde

    About Triitus

    Triitus expertly develops and deploys configurable commercial off-the-shelf (COTS) cyber-defense products. Recognizing the need to bring critical data to the tactical edge, Triitus’ founder engineered the original design that Commercial Solutions for Classified (CSfC) concepts are now modeled on. CSfC implementations are a viable option for all federal enterprises wishing to untether and enhance the protection of classified work. Triitus empowers your personnel by providing management systems that support automated updates and granular control, secure access to classified networks, and fortify end-user devices that perform on par with commercial products. As leaders in the field, Triitus takes pride in being at the forefront of IC and DoD technical security innovation.  

    Chris Elliott
    Business Development Lead
    info@triitus.com

    About KLC Group and CipherDriveOne

    CipherDriveOne, a KLC Group Company, is an innovative Silicon Valley cybersecurity company. We are experts in software and hardware devices and network security products. CipherDriveOne takes an innovative approach to product design. Our primary goal is to design secure and privacy-oriented products for the Internet. Founded in 2007, KLC Group is headquartered in San Jose, California. Visit cipherdriveone.com for more information.

    KLC and CipherDriveOne PR Contact
    John C. Myung
    President
    john@klc-group.com 

    Source: KLC Group LLC

    Source link

  • Elon Musk Is Adding Calls and Encrypted Messaging to Twitter | Entrepreneur

    Elon Musk Is Adding Calls and Encrypted Messaging to Twitter | Entrepreneur

    Twitter is getting an upgrade with some brand-new features.

    CEO Elon Musk took to the platform on Tuesday to announce the release of several new additions, including encrypted messages and calling.

    Encrypted direct messaging should be available to users as soon as Wednesday, and calls will follow at a later undisclosed date.

    Musk first mentioned the addition of encrypted messaging in his “Twitter 2.0 The Everything App” plan in November 2022, after purchasing the platform in October 2022 for $44 billion.

    Since taking over Twitter, Musk has implemented paid verification, which was mentioned in his November plan, and last month he added the option for users to buy and sell stocks on the platform through his partnership with social trading company eToro.

    RELATED: ‘First Day of the Rest of Your Life’: More Twitter Layoffs Hit, Including Esther Crawford Who Slept In Office In Sleeping Bag

    Musk has been under fire for his “hard-core” leadership style after former employees reported grueling hours and sleeping on office floors. Additionally, since taking the helm, he has laid off nearly 6,000 workers, an 80% reduction of the company’s staff.

    Sam Silverman

    Source link

  • UK locks horns with WhatsApp over threat to break encryption

    UK locks horns with WhatsApp over threat to break encryption

    LONDON — Britain’s tough new plan to police the internet has left politicians in a stand-off with WhatsApp and other popular encrypted messaging services. Deescalating that row will be easier said than done.

    The Online Safety Bill, the United Kingdom’s landmark effort to regulate social media giants, gives regulator Ofcom the power to require tech companies to identify child sex abuse material in private messages.

    But the proposals have prompted Will Cathcart, boss of the Meta-owned messaging app, whose encrypted service is widely-used in Westminster’s own corridors of power, to claim it would rather be blocked in the U.K. than compromise on privacy.

    “The core of what we do is a private messaging service for billions of people around the world,” Cathcart told POLITICO in March when he jetted in to London to lobby ministers over the upcoming bill. “When the U.K., a liberal democracy, says, ‘Oh, it is okay to scan everyone’s private communication for illegal content,’ that emboldens countries around the world that have very different definitions of illegal content to propose the same thing,” he added.

    WhatsApp’s smaller rival, Signal, has also said it could stop providing services in the U.K. if the bill requires it to scan messages — echoing claims from the tech industry that date back more than a decade that they can’t create backdoors in encrypted digital services, even to protect kids online, because to do so opens the products up to vulnerabilities from bad actors, including foreign governments.

    “We can’t just let thousands of pedophiles get away with it. That wouldn’t be responsible or proportionate for a government to do,” Science and Technology Secretary Michelle Donelan told POLITICO in February.

    Ministers are keen to lower the temperature. But doing so will prove challenging, two former ministers told POLITICO on the condition of anonymity, given the likelihood of pushback from MPs, the complexity of the technology and the emotiveness of the issue.

    Easier said than done

    Finding a compromise is unlikely to be easy — and the row mirrors similar debates that are underway in the European Union and Australia over just how accountable tech platforms should be for potentially harmful content on encrypted services. 

    The debate over whether the requirements of the bill can be met while protecting privacy centers around “client-side scanning.” 

    While leaders at Britain’s National Cyber Security Centre and security agency GCHQ said last July they believe such technology can simultaneously protect children and privacy, other experts dispute their findings.

    A raft of cryptographers criticized the technique in a report called Bugs in Our Pockets in 2021 prompting tech giant Apple to abandon plans to introduce client-side scanning on its services. In Australia, the country’s eSafety Commissioner recently published a report highlighting how the likes of Microsoft and Apple had few, if any, mechanisms to track child sexual abuse material, including via their encrypted services.

    “This is not only companies really taking a blind eye to live crime scenes happening on their platforms, but they’re also failing to properly harden their systems and storage against abuse,” Australian eSafety Commissioner Julie Inman Grant told POLITICO. “It’s akin to leaving a home open to an intruder. Once that bad actor is inside the house, good luck getting them out.”

    WhatsApp’s smaller rival, Signal, has also said it could stop providing services in the U.K. if the bill requires it to scan messages | Damien Meyer/AFP via Getty Images

    Hacking risk

    Cybersecurity experts agree the U.K. bill’s demands are incompatible with a desire to protect encryption. They claim that privacy is not a fungible issue — services either have it or they don’t. And they warn that politicians should be wary of undermining such protections in ways that would make people’s online experiences potentially open to abuse or hacking.

    “In essence, end-to-end encryption involves not having a door, or if you want to use a postal analogy, not having a sorting office for the state to search. Client-side-scanning, despite the claims of its proponents, does seem to involve some kind of level of access, some kind of ability to sort and scan, and therefore there’s no way of confining that to good use by lawful credible authorities and liberal democracies,” Ciaran Martin, the former chief executive of the government’s National Cyber Security Centre said.

    Ministers insist that they support strong encryption and privacy, but say it cannot come at the cost of public safety. 

    Tech companies should be researching technology to identify child sex abuse before messages are encrypted, Donelan said. But the government also appears to be searching for a way to cool the row, and Donelan insisted the measure would be a “last resort.”

    “That element of the bill is like a safety mechanism that can be enacted, should it ever be needed to. It might never be needed because there might be other solutions in place,” she said.

    One official in the Department for Science, Innovation and Technology (DSIT), not authorized to speak on the record but familiar with government discussions, said DSIT wanted to find a way through and is having talks “with anyone that wants to discuss this with us.”

    Melanie Dawes, Ofcom’s chief executive, told POLITICO that any efforts to break encryption in the name of safety would have to meet stringent rules, and such requests would be made in only the most extreme situations. 

    “There’s a high bar for Ofcom to be able to require the use of a technology in order to secure safety,” she said.

    Lords debate

    Peers in the unelected House of Lords, the U.K. parliament’s revising chamber, waded into the issue Thursday.

    Richard Allan, a Lib Dem peer who was Facebook’s chief lobbyist in Europe until 2019, led the charge, saying tech companies will feel they’re “unable to offer their products in the UK under the bill.” He said undermining encryption opened the doors to hostile states and accused the government of playing a “high stakes game of chicken” with tech companies.

    But Beeban Kidron, a crossbench peer who has been leading much of the work in the Lords around child safety, said although she had some sympathy for Allan’s arguments, Big Tech companies had to do more to protect users’ privacy themselves.

    Wilf Stevenson, who is managing Labour’s response to the bill in the Lords, said he was not convinced the government’s plans were “right for the present day, let alone the future.” He added that under the bill “Ofcom is expected to be both gamekeeper and poacher,” with power to regulate tech companies and inspect private messages.

    But Stephen Parkinson, who is guiding the bill through the Lords on behalf of the government, defended the legislation. “The bill contains strong safeguards for privacy,” he said, echoing Donelan’s statement that powers to inspect messages were a “last resort” designed to be used only in cases of suspected terrorism and child sexual exploitation.

    Convincing ministers

    Messaging services including Signal and WhatsApp are hoping for a ministerial climbdown — but few see one coming.

    There is little prospect of large swathes of MPs, who will have the final say on the bill, riding to their rescue, according to two former ministers who have worked on the legislation. 

    “People are scared if they go in and fight over this, even for very genuine reasons, it could be very easily portrayed that they’re trying to block protecting kids,” one former Cabinet minister, a party loyalist, who worked on an earlier draft of the bill, said. 

    The second former minister said MPs “haven’t engaged with it terribly much on a very practical level” because it is “really hard.” 

    “Tech companies have made significant efforts to frame this issue in the false binary that any legislation that impacts private messaging will damage end-to-end encryption and will mean that encryption will not work or is broken. That argument is completely false,” opposition Labour frontbencher Alex Davies-Jones, said in a debate last June. 

    The widespread leaking of MPs’ WhatsApp messages has also undermined perceptions of the platform’s privacy credentials, the former Cabinet minister quoted above suggests. 

    “If you are sharing stuff on WhatsApp with people that’s inappropriate, there’s a good chance it’s going to end up in the public domain anyway. The encryption doesn’t stop that because somebody screenshots it and copies it and sends it on,” they lamented. 

    WhatsApp does have one ally in the former Brexit secretary and long-time civil liberties campaigner David Davis, though.

    “Right across the board there are a whole series of weaknesses the government hasn’t taken on board,” he told POLITICO of the bill.

    And on WhatsApp and Signal’s threats to leave the U.K., Davis thinks a point could be made.

    “Well, I sort of hope they do. The truth is their model depends on complete privacy,” he said.

    Update: This article has been updated to include comments from the latest House of Lords debate on the Online Safety Bill.

    Annabelle Dickson, Mark Scott and Tom Bristow

    Source link