Experts Warn on Wire-tapping of the Cloud

• Subscribe to PCF Networked Blog Daily Updates 
• Subscribe to our Twitter / Google / Yahoo Daily Updates

Leading privacy expert Caspar Bowden has warned Europeans using US cloud services that their data could be snooped on.

In a report, he highlights how the Foreign Intelligence Surveillance Act Amendment Act (FISAAA) allows US authorities to spy on cloud data.

This includes services such as Amazon Cloud Drive, Apple iCloud and Google Drive.

He told the BBC this heralded a new era of "cloud surveillance".

Foreign policy

Mr Bowden, former chief privacy adviser to Microsoft Europe, made a name for himself as a privacy advocate when the controversial Regulation of Investigatory Powers Act (RIPA) came into force in the UK in 2000.

Parliament accepted some of the amendments proposed by Mr Bowden as the then director of the Foundation for Information Policy Research.

Now he has turned his attention to US legislation and has co-authored the Fighting Cyber Crime and Protecting Privacy in the Cloud report which was recently presented to the European Parliament.

In it he said that FISAAA "expressly permits purely political surveillance", so that anyone with stored information relating to US foreign policy could find themselves of interest to the US authorities.

"Anyone who, for example, belongs to a campaign group which may oppose some aspect of US foreign policy, whether it be the Iraq war or climate change," he said.

The FISAAA was originally drafted in 2008, and was recently renewed until 2017. It was added on to existing legislation to take account of cloud computing, which was just emerging as a means of data storage.

"What's amazing is that nobody really spotted it for four years," said Mr Bowden.

"When FISAAA was extended to cover cloud computing, encrypting data to and from the cloud becomes irrelevant so it is surprising that nobody noticed this," he added.

Tiny supercomputer

Adam Mitton, a partner at law firm Harbottle & Lewis, agreed that the FISAAA could be a threat to privacy but questioned how much it was used.

 

"In theory there is a clear threat to the privacy of European citizens, but in reality the fact that it is obscure suggests that the threat isn't as great as it might be perceived," he said.

"If it was being used by an authority and having an impact on individual citizens, I think that the source of the information would come to light. The legislation is now five years old and I'm not aware of any case that has relied on it," he added.

Storing data in the cloud is becoming hugely popular not just for consumers who use it to keep photographs and other personal data safe but for businesses which are increasingly using cloud services to offer back-end processing power.

Under the FISAAA, US cloud providers can be compelled to release data from any citizen living outside of the US.

"The fibre-optic cable that carries the data is split and a miniature supercomputer scans all the data in real-time with any material of possible interest being instantly copied to the NSA [National Security Agency]," said Mr Bowden.

The court order is made in secret and remains secret - meaning it would not show up in things such as Google's transparency reports, which aim to document data requests from governments around the world.

"We have long known that the Americans can spy on foreign data but FISAAA extends this to reach inside the data centre. It allows the authorities to enact surveillance on a mass scale because it is wired into the infrastructure," Mr Bowden said.

A hearing on the European Parliament's findings of the report is due next month.

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

World’s Highest Resolution Surveillance System: 1.8 Gigapixel ARGUS-IS

• Subscribe to PCF Networked Blog Daily Updates 
• Subscribe to our Twitter / Google / Yahoo Daily Updates

DARPA and the USZ Army have taken the wraps off ARGUS-IS, a 1.8-gigapixel video surveillance platform that can resolve details as small as six inches from an altitude of 20,000 feet (6km). ARGUS is by far the highest-resolution surveillance platform in the world, and probably the highest-resolution camera in the world, period.

ARGUS, which would be attached to some kind of unmanned UAV (such as the Predator) and flown at an altitude of around 20,000 feet, can observe an area of 25 square kilometers (10sqmi) at any one time. If ARGUS was hovering over New York City, it could observe half of Manhattan. Two ARGUS-equipped drones, and the USZ could keep an eye on the entirety of Manhattan, 24/7.

It is the definition of “observe” in this case that will blow your mind, though. With an imaging unit that totals 1.8 billion pixels, ARGUS captures video (12 fps) that is detailed enough to pick out birds flying through the sky, or a lost toddler wandering around. These 1.8 gigapixels are provided via 368 smaller sensors, which DARPA/BAE says are just 5-megapixel smartphone camera sensors. These 368 sensors are focused on the ground via four image-stabilized telescopic lenses.

The end result, as you can see in the (awesome) video above, is a mosaic that can be arbitrarily zoomed. In the video, a BAE engineer zooms in from 17,500 feet to show a man standing in a parking lot doing some exercises. A white speck is a bird flying around. You can’t quite make out facial features or license plates (phew), but I wonder if that would be possible if ARGUS was used at a lower altitude (during a riot, say).

ARGUS’s insane resolution is only half of the story, though. It isn’t all that hard to strap a bunch of sensors together, after all. The hard bit, according to the Lawrence Livermore National Laboratory (LLNL), is the processing of all that image data. 1.8 billion pixels, at 12 fps, generates on the order of 600 gigabits per second. This equates to around 6 petabytes — or 6,000 terabytes — of video data per day. From what we can gather, some of the processing is done within ARGUS (or the drone that carries it), but most of the processing is done on the ground, in near-real-time, using a beefy supercomputer. We’re not entirely sure how such massive amounts of data are transmitted wirelessly, unless DARPA is waiting for its 100Gbps wireless tech to come to fruition.

The software, called Persistics after the concept of persistent ISR — intelligence, surveillance, and reconnaissance — is tasked with identifying objects on the ground, and then tracking them indefinitely. As you can see in the video, Persistics draws a colored box around humans, cars, and other objects of interest. These objects are then tracked by the software — and as you can imagine, tracking thousands of moving objects across a 10-square-mile zone is a fairly intensive task. The end user can view up to 65 tracking windows at one time.

The ARGUS system in its entirety produces one million terabytes per day — all of which is stored by the Army for future use. We’re a bit skeptical about PBS’s crazy figure (a million terabytes is an exabyte), but in theory most of that data is actually meta data — the coordinates and other identifying features of the thousands (millions?) of objects being tracked by ARGUS.

The original goal was to deploy ARGUS in Afghanistan, but that never came to pass. It isn’t entirely clear what ARGUS’s future is; it was meant to be mounted on Boeing’s high-altitude A160 Hummingbird helicopter (pictured right), but the chopper has since been scrapped. If ARGUS is to be deployed, it will most likely be strapped to the underbelly of a Predator drone. Where it will be used, however, with the war in Afghanistan apparently winding down, is another question entirely. Its efficacy in a military setting would be unsurpassed, but it’s easy to imagine how ARGUS could be used here at home in the US, too.

Via ExtremeTech

(Mildly Edited by PCF Web desk)

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

’Red October’: Global Cyber-Spy Network Uncovered by Russian Experts

• Subscribe to PCF Networked Blog Daily Updates 
• Subscribe to our Twitter / Google / Yahoo Daily Updates

A sophisticated cyber-espionage network targeting the world’s diplomatic, government and research agencies, as well as gas and oil industries, has been uncovered by experts at Russia’s Kaspersky Lab.

The system’s targets include a wide range of countries, with the primary focus on Eastern Europe, former Soviet republics and Central Asia – although many in Western Europe and North America are also on the list.

“The majority of infections are actually from the embassies of ex-USSR country members located in various regions such as Western Europe and even in North America – in the US we have few infections as well. But most infections are concentrated around Russia,” Vitaly Kamluk, chief malware expert at Kasperky Lab, told RT, adding that in Europe, the hardest-hit countries are apparently Beligum and Switzerland.

In addition to attacking traditional computer workstations, ‘Rocra’ – an abridgment of ‘Red October,’ the name the Kaspersky team gave the network – can steal data from smartphones, dump network equipment configurations, scan through email databases and local network FTP servers, and snatch files from removable disk drives, including ones that have been erased.

Unlike other well-known and highly automated cyber-espionage campaigns, such as ‘Flame’ and ‘Gauss,’ Rorca’s attacks all appear to be carefully chosen. Each operation is apparently driven by the configuration of the victim’s hardware and software, native language and even document usage habits.

The information extracted from infected networks is often used to gain entry into additional systems. For example, stolen credentials were shown to be compiled in a list for use when attackers needed to guess passwords or phrases.

The hackers behind the network have created more than 60 domain names and several server hosting locations in different countries – the majority of those known being in Germany and Russia – which worked as proxies in order to hide the location of the ‘mothership’ control server.

That malicious server’s location remains unknown, but experts have uncovered over 1,000 modules belonging to 34 different module categories.While Rocra seems to have been designed to execute one-time tasks sent by the hackers’ servers, a number of modules were constantly present in the system executing persistent tasks. This included retrieving information about a phone, its contact list, call history, calendar, SMS messages and even browsing history as soon as an iPhone or a Nokia phone is connected to the system.

The hackers’ primary objective is to gather information and documents that could compromise the security of governments, corporations or other organizations and agencies. In addition to focusing on diplomatic and governmental agencies around the world, the hackers also attacked energy and nuclear groups, and trade and aerospace targets.

No details have been given yet as to the attackers’ identity. However, there is strong technical evidence to indicate that the attackers are of Russophone origins, as Russian words including slang have been used in the source code commentaries. Many of the known attacks have taken place in Russian-speaking countries.

“It is bound to Russian language. We are currently uncertain which country is responsible for creating these malicious applications, but we are most certain the developers picked the Russian language. It is visible from the text links we extracted from the application. Some of them point to Russian origin. For example, the word used inside of the malware the word is ‘zakladka.’ In Russian it means a bookmark, or under cleared functionality it can refer to a backdoor functionality in some legitimate software. So that’s why we believe this work was used by Russian-speaking developers,” Kamluk told RT.

The hackers designed their own authentic and complicated piece of software, which has its own unique modular architecture of malicious extensions, info-stealing modules and backdoor Trojans. The malware includes several extensions and malicious files designed to quickly adjust to different system configurations while remaining able to grab information from infected machines.

These included a ‘resurrection’ module, which allowed hackers to gain access to infected machines using alternative communications channels and an encoded spy module, stealing information from different cryptographic systems such as Acid Cryptofiler, which has reportedly been used since 2011 by organizations such as NATO, the European Parliament and the European Commission.

The first instances of Red October malware were discovered in October 2012, but it has been infecting computers since at least 2007, Kaspersky Lab reported. The firm worked with a number of international organizations while conducting the investigation, including Computer Emergency Readiness Teams from the US, Romania and Belarus.

The EU is attempting to counter the huge rise in cyber-espionage by launching the European Cybercrime Center, which opened on Friday.

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter

Android apps 'leak' personal details

• Subscribe to PCF Networked Blog Daily Updates 
• Subscribe to our Twitter / Google / Yahoo Daily Updates

Millions of people are using Android apps that can be tricked into revealing personal data, research indicates. Scientists tested 13,500 Android apps and found almost 8% failed to protect bank account and social media logins. These apps failed to implement standard scrambling systems, allowing "man-in-the-middle" attacks to reveal data that passes back and forth when devices communicate with websites. Google has yet to comment on the research and its findings.

Researchers from the security group at Leibniz University of Hanover and the computer science department at the Philipps University of Marburg tested the most popular apps in Google's Play store. By creating a fake wi-fi hotspot and using a specially created attack tool to spy on the data the apps sent via that route, the researchers were able to:

• capture login details for online bank accounts, email services, social media sites and corporate networks
• disable security programs or fool them into labelling secure apps as infected
• inject computer code into the data stream that made apps carry out specific commands

An attacker could even re-direct a request to transfer funds, while making it look to the app user like the transaction was proceeding unchanged. Some of the apps tested had been downloaded millions of times, the researchers said. And a follow-up survey of 754 people suggests users could struggle to spot when they were at risk.

"About half of the participants could not judge the security state of a browser session correctly," the researchers wrote. "Most importantly, research is needed to study which counter-measures offer the right combination of usability for developers and users, security benefits and economic incentives to be deployed on a large scale."

(BBC)

Pakistan Cyber Force

Follow PCF on Facebook

Follow PCF on Twitter