3 ms·

China breached Google a while back. The NSA also hacked google wide open by decrypting/man in the middle SSL/TLS. I remember when that was disclosed Google went

China breached Google a while back. The NSA also hacked google wide open by decrypting/man in the middle SSL/TLS. I remember when that was disclosed Google went on a rampage implementing site-to-site/machine-to-machine SSL so that it's not relying on single point of failure SSL/TLS termination. A lot of people have selective memory when it comes to security issues. And those breaches are multimillion record breaches. The China one was bad enough for google to terminate the entire link to china and pull out entirely.

dekhn 4y ago
From my read of the NSA sections of the snowden docs, they didn't decrypt anything- they observed the Google front end that talked to the user was the end of the TLS chain and from there, inside Google's networks, the front end talked to its backends without any encryption, so as long as you had physical access to Google's network (which included intercontinental fiber) you could trivially sniff packets. https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i... I can't find the article now but it had a picture of an NSA presentation with what was obviously a bigtable RPC (spend enough time debugging protocol buffers and stubby). From what I can glean, it seems likely that they tapped an undersea cable carrying Google's traffic between a frontend and a backend, although that's speculation.
- monocasa 4y ago
  They did both. They tapped private inter-DC fiber of Google's that wasn't encrypted. Additionally they had a cute hack that could crack Diffie Hellman at a cost of about $100M a prime (and most of the internet at the time used the same primes). So most TLS/IPSEC/SSH etc was wide open to them too if they could catch the handshake.
  - dekhn 4y ago
    Can you point me at the DH crack? This? https://www.theregister.com/2015/10/19/nsa_crypto_breaking_theory/ https://www.theregister.com/2015/10/19/nsa_crypto_breaking_t... I don't recall that ever being associated with breaking Google traffic although I recall there were some Google SSL changes around the time which may be related. I simply haven't seen any direct evidence, while a packet dump on a slide is direct evidence.

dekhn 4y ago

From my read of the NSA sections of the snowden docs, they didn't decrypt anything- they observed the Google front end that talked to the user was the end of the TLS chain and from there, inside Google's networks, the front end talked to its backends without any encryption, so as long as you had physical access to Google's network (which included intercontinental fiber) you could trivially sniff packets. https://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html https://www.washingtonpost.com/world/national-security/nsa-i... I can't find the article now but it had a picture of an NSA presentation with what was obviously a bigtable RPC (spend enough time debugging protocol buffers and stubby). From what I can glean, it seems likely that they tapped an undersea cable carrying Google's traffic between a frontend and a backend, although that's speculation.

monocasa 4y ago
They did both. They tapped private inter-DC fiber of Google's that wasn't encrypted. Additionally they had a cute hack that could crack Diffie Hellman at a cost of about $100M a prime (and most of the internet at the time used the same primes). So most TLS/IPSEC/SSH etc was wide open to them too if they could catch the handshake.
- dekhn 4y ago
  Can you point me at the DH crack? This? https://www.theregister.com/2015/10/19/nsa_crypto_breaking_theory/ https://www.theregister.com/2015/10/19/nsa_crypto_breaking_t... I don't recall that ever being associated with breaking Google traffic although I recall there were some Google SSL changes around the time which may be related. I simply haven't seen any direct evidence, while a packet dump on a slide is direct evidence.