The Daily Parker

Politics, Weather, Photography, and the Dog

Great security, guys

Via Schneier, it seems that our security services have not done a great job at, you know, security:

[J]ust how bad is the CIA’s security that it wasn’t able to keep [accused leaker and former CIA sysadmin Joshua] Schulte out, even accounting for the fact that he is a hacking and computer specialist? And the answer is: absolutely terrible.

The password for the Confluence virtual machine that held all the hacking tools that were stolen and leaked? That’ll be 123ABCdef. And the root login for the main DevLAN server? mysweetsummer.

It actually gets worse than that. Those passwords were shared by the entire team and posted on the group’s intranet. IRC chats published during the trial even revealed team members talking about how terrible their infosec practices were, and joked that CIA internal security would go nuts if they knew. Their justification? The intranet was restricted to members of the Operational Support Branch (OSB): the elite programming unit that makes the CIA’s hacking tools.

Oh dear. We used to have the best tools and people in the world. Now it just looks like we have a bunch of tools.

That time when the CIA made encryption products

For about 50 years, the CIA and its (West-) German equivalent, the BND, owned Crypto AG in Switzerland, giving them access to the secrets of dozens of countries:

From 1970 on, the CIA and its code-breaking sibling, the National Security Agency, controlled nearly every aspect of Crypto’s operations — presiding with their German partners over hiring decisions, designing its technology, sabotaging its algorithms and directing its sales targets.

Then, the U.S. and West German spies sat back and listened.

They monitored Iran’s mullahs during the 1979 hostage crisis, fed intelligence about Argentina’s military to Britain during the Falklands War, tracked the assassination campaigns of South American dictators and caught Libyan officials congratulating themselves on the 1986 bombing of a Berlin disco.

Greg Miller, the Washington Post reporter who broke the story in the US, followed up today with some insight into the bureaucratic bullshit that nearly scuttled the deal, and would go on to help our intelligence services miss that 9/11 was about to happen:

The CIA comes across as an overbearing elder, impatient with its more timid counterpart, dismissive of its intermittent objections. CIA officials “made the rules as they went along,” according to the history, “and were much more inclined to ask forgiveness than permission.”

The NSA was full of people who were technically brilliant but struggled to grasp the potential of the operation, impeded efforts to expand its scope and at times put the program’s secrecy in jeopardy with sloppy tradecraft.

“NSA people traveled in true name, and sent far more people to meetings than CIA felt was advisable from a security standpoint,” the CIA history says. “One of the continuing irritants on the CIA side was this apparent lack of appreciation for traditional [agency] clandestine operational procedures.”

“Between the CIA and the NSA there were always disputes about which of these services had the say,” a senior BND official said in that agency’s history of the operation. “CIA saw itself as the one in charge and emphasized this by having a CIA man posted at the operation in Munich,” the location of a CIA base for overseeing Crypto.

Yesterday, NPR's Fresh Air broadcast an extensive interview with Miller, that ended with this chilling thought:

When you learn something, when you learn about something terrible that's happening - in South America, for instance, many of the governments that were using Crypto machines were engaged in assassination campaigns. Thousands of people were being disappeared, killed. And I mean, they're using Crypto machines, which suggests that the United States intelligence had a lot of insight into what was happening. And it's hard to look back at that history now and see a lot of evidence of the United States going to any real effort to stop it or at least or even expose it.

To me, the history of the Crypto operation helps to explain how U.S. spy agencies became accustomed to, if not addicted to, global surveillance. This program went on for more than 50 years, monitoring the communications of more than 100 countries. I mean, the United States came to expect that kind of penetration, that kind of global surveillance capability. And as Crypto became less able to deliver it, the United States turned to other ways to replace that. And the Snowden documents tell us a lot about how they did that. Instead of working through this company in Switzerland, they turned their sights to companies like Google and Apple and Microsoft and found ways to exploit their global penetration. And so I think it tells us a lot about the mindset and the personalities of spy agencies as well as the global surveillance apparatus that followed the Crypto operation.

Think about Crypto AG when you install Kaspersky Anti-Virus or install a Huwei device on your network. Just think about it.

Lunchtime links

Even when I work from home, I have a lot to do. At least I don't have a commute today, giving me extra time to catch up later:

And now, back to work.

After all, who's really signing this contract, anyway?

An AI demonstration website will show you photos of people who don't exist:

You encounter so many people every day, online and off-, that it is almost impossible to be alone. Now, thanks to computers, those people might not even be real. Pay a visit to the website This Person Does Not Exist: Every refresh of the page produces a new photograph of a human being—men, women, and children of every age and ethnic background, one after the other, on and on forever. But these aren’t photographs, it turns out, though they increasingly look like them. They are images created by a generative adversarial network, a type of machine-learning system that fashions new examples modeled after a set of specimens on which the system is trained. Piles of pictures of people in, images of humans who do not exist out.

It’s startling, at first. The images are detailed and entirely convincing: an icy-eyed toddler who might laugh or weep at any moment; a young woman concerned that her pores might show; that guy from your office. The site has fueled ongoing fears about how artificial intelligence might dupe, confuse, and generally wreak havoc on commerce, communication, and citizenship.

Ian Bogost goes from this to a discussion of alienation in crowds, and the delights of urban civilization. But I'm still stuck on the face generator. I might want to meet this person, for example, but she isn't even imaginary:

Here's a video explaining how it works:

Working from home is still working

While I do get to sign off a bit earlier today, I might not read all of these articles until tomorrow:

Finally, despite today's near-record low temperatures in Chicago, we expect a 12°C increase from earlier this morning until tomorrow afternoon. Hey, if this is the only day all winter that even flirts with -18°C, I'm happy.

Boy, he sure learned his lesson

In just one more example of the president slipping his leash, thanks to the Republican trolls in the Senate giving him permission to do so, the Justice Department said it found prosecutors recommendations for Roger Stone's sentence "shocking." Three Assistant US Attorneys immediately quit the case:

Jonathan Kravis, one of the prosecutors, wrote in a court filing he had resigned as an assistant U.S. attorney, leaving government entirely. Aaron S.J. Zelinsky, a former member of special counsel Robert S. Mueller III’s team, said he was quitting his special assignment to the D.C. U.S. Attorney’s Office to prosecute Stone, though a spokeswoman said he will remain an assistant U.S. attorney in Baltimore.

Adam Jed, also a former member of Mueller’s team, asked a judge’s permission to leave the case like the others, though gave no indication of resigning his job.

None provided a reason for their decisions.

Uh huh. Thanks, WaPo. ("Three people left their office in haste this afternoon after their work area became engulfed in flames. None provided a reason for their decisions.")

Greg Sargent says the president's strategy is "designed to get you to surrender:"

In the end, many of President Trump’s ugliest degradations — the nonstop lying, the constant efforts to undermine faith in our political system, the relentless delegitimization of the opposition — often seem to converge in some sense on a single, overarching goal:

To get you to give up.

To give up on what, exactly? On the prospects for accountability for Trump, via mediating institutions such as the media, or via other branches of government, or even via the next election, and more broadly, on the very notion that our political system is capable of rendering outcomes that have not been thoroughly corrupted to their core.

Meanwhile:

Fun times. Fun times. At least we can take some comfort in Japanese railway station psychology.

Fast, Cheap, Good: pick two

I don't often use profanity on this blog, but this morning I am moved to call the Iowa Democratic Party's leaders a bunch of fucking morons. Last night we saw the results of the IDP picking "fast" and "cheap" for critical infrastructure in the most important election cycle in a generation. Now the national Party will go into New Hampshire with a black eye and no end of razzing from the Tweeter in Chief.

It's not just that the IDP chose "fast and cheap" instead of, you know, "good." It's also that everyone in the Democratic Party, from Puerto Rico to Nome, knows what a fucking big deal this election is. Presumably someone involved in this debacle might have done some contingency planning. Like, for example, having enough volunteers on the phones in case something happened with the app.

We've had years to prepare for last night's Iowa Caucuses. Perhaps not a full four years—they changed caucus rules a bit and added verification steps to prevent fraud—but certainly longer than two months. That's how long it took to write the mobile app the Party commissioned to make this the smoothest Caucuses ever, according to reports in NPR and the New York Times. That and $60,000, which gets you two junior developers and a journeyman team lead for two months, tops.

I've run multi-million-dollar software projects (including one in Des Moines 15 years ago), and my back-of-the-envelope estimate for an app to tabulate caucus results that needs to run perfectly on election night came to about $300,000 for a fast project (4-5 months) or $200,000 if it could take 9-10 months. A budget of $60,000 might, perhaps, cover just the coding, not UI testing, app distribution, security testing, project management, integration testing, API deployment, load testing, or testing the testing (i.e., test validation). And the $200k budget doesn't include $20,000 in infrastructure charges to ensure adequate capacity on election night.

In other words, any competent person would have chosen "fast and good" or "cheap and good."

Plus, media outlets also report that the IDP kept the app's origins and code a secret, in complete contravention of basic principles of secure software design. Had they put the code up for review on GitHub, outside reviewers could have caught any technical problems far, far earlier.

So once again, the state of Iowa, a technology hub renowned the world over as a serious rival to Palo Alto, New York, and Bangalore, demonstrated exactly why they need to conduct a primary election on the same day as a few other states a bit later on in the season.

This election is ours to lose. And with this own-goal, you, the Iowa Democratic Party, are fucking making it happen.

Things of interest when I have the time to spend on them

Not just articles today, but also a whole HBO mini-series:

For yet another thing to worry about today, after this post and the one before it, the New Yorker has started a series about the last time democracy almost died. (Hint: it got better.)

In case you didn't have enough to worry about

Via Bruce Schneier, two Harvard undergraduates have demonstrated that the volume of easily-obtainable information from multiple, large-scale data breaches makes targeting people for cybercrime easier than you could have guessed:

The students found a dataset from a breach of credit reporting company Experian, which didn’t get much news coverage when it occurred in 2015. It contained personal information on six million individuals. The dataset was divided by state, so [students Dasha] Metropolitansky and [Kian] Attari decided to focus on Washington D.C. The data included 69 variables—everything from a person’s home address and phone number to their credit score, history of political donations, and even how many children they have.

But this was data from just one leak in isolation. Metropolitansky and Attari wondered if they could identify an individual across all other leaks that have occurred, combining stolen personal information from perhaps hundreds of sources.

There are sites on the dark web that archive data leaks, allowing an individual to enter an email and view all leaks in which the email appears. Attari built a tool that performs this look-up at scale.

“We also showed that a cyber criminal doesn’t have to have a specific victim in mind. They can now search for victims who meet a certain set of criteria,” Metropolitansky said.

For example, in less than 10 seconds she produced a dataset with more than 1,000 people who have high net worth, are married, have children, and also have a username or password on a cheating website. Another query pulled up a list of senior-level politicians, revealing the credit scores, phone numbers, and addresses of three U.S. senators, three U.S. representatives, the mayor of Washington, D.C., and a Cabinet member.

"We're two college students. If someone really wanted to do some damage, I'm sure they could use these same techniques to do something horrible," [Metropolitansky said].

As Schneier points out, "you can be sure that the world's major intelligence organizations have already done all of this."

This is also why we need government regulation or stricter liability laws around data breaches. Experian's sloppiness imperiled six million people, and has probably resulted in crime already. But they have no incentive to fix their issues. In fact, they didn't even reveal the breach for years.

Why transparency matters

Yesterday I bemoaned not only our depression-inducing lack of sunlight (predicted return of the sun: Sunday, maybe), but also Senate Republicans' efforts to hide or ignore information relevant to the impeachment trial now underway.

Another story about how a lack of transparency causes damage has come to light. The Washington Post reports that the Saudi attack on Post owner Jeff Bezos' phone was helped to great extent by Apple's refusal to report security defects:

A security report last week alleged that Bezos, who also owns The Washington Post, received a WhatsApp message laden with code that secretly snatched reams of personal data from his iPhone X. The message allegedly came from Mohammed bin Salman, the crown prince of Saudi Arabia. Security researchers say Bezos probably fell victim to the iPhone’s Achilles’ heel: Its defenses are so difficult to penetrate that once sophisticated attackers are in, they can go largely undetected.

That is in part because Apple employs a secretive approach to finding and fixing security flaws, researchers say, something that has generated debate in the security community.

Security researchers say iPhones and Androids have different approaches to security. They say they generally believe there are more bugs and vulnerabilities in Android. That may be because there are so many different versions, or “forks,” of Android. Google allows its myriad handset makers and others to customize the operating system.

That results in two security philosophies. In Android’s case, the researchers said, the more people who look for bugs, the more secure a system becomes. But Apple’s strategy follows the idea that less visibility into the software means fewer bugs will be discovered in the first place, making the overall operating system more secure. It takes skill, resources or both to find those bugs, which means hackers will typically use them sparingly to protect them from discovery.

Bruce Schneier has argued in favor of transparency for years. This is why. And why I only use Android devices.