5 ms·

It's ridiculous to think it's the US as it would be an attack on Red Hat a US company and an attack on Americans. It's a good way to be dragged in front of Cong

It's ridiculous to think it's the US as it would be an attack on Red Hat a US company and an attack on Americans. It's a good way to be dragged in front of Congress.

guinea-unicorn 3y ago
The US has backdoored RSA's RNG and thus endangered the security of American companies. It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies.
- 2OEH8eoCRo0 3y ago
  That is speculation and has never been confirmed.
  - occamsrazorwit 3y ago
    What type of confirmation do you want? The documents aren't going to be declassified in the next couple of decades, if ever. I've never heard anyone claim that Dual_EC_DRBG is most likely not intentionally backdoored, but there's literally no way to confirm because of how its written. If we can't analyze intention from the code, we can look at the broader context for clues. The NSA spent an unusual amount of effort trying to push forward an algorithm that kept getting shot down because it was slower than similar algorithms with no additional benefits (the $10 million deal specified it as a requirement [1]). If you give the NSA the benefit of the doubt, they spent a lot of time and money to... intentionally slow down random number generation?! As an American, I'd prefer a competent NSA than an incompetent NSA that spends my tax dollars to make technology worse for literally no benefit... [1] https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220 https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...
  - hex4def6 3y ago
    You are understating the level of evidence that points to the NSA being fully aware of what it was doing. To be clear, the method of attack was something that had been described in a paper years earlier, the NSA literally had a program (BULLRUN) around compromising and attacking encryption, and there were security researchers at NIST and other places that raised concerns even before it was implemented as a standard. Oh, and the NSA paid the RSA $10 million to implement it. Heck, even the chairman of the RSA implies they got used by the NSA: In an impassioned speech, Coveillo said RSA, like many in industry, has worked with the NSA on projects. But in the case of the NSA-developed algorithm which he didn’t directly name, Coviello told conference attendees that RSA feels NSA exploited its position of trust. In its job, NSA plays two roles, he pointed out. In the information assurance directorate (IAD) arm of NSA, it decides on security technologies that might find use in the government, especially the military. The other side of the NSA is tasked with vacuuming up data for cyber-espionage purposes and now is prepared to take an offensive role in cyber-attacks and cyberwar. “We can’t be sure which part of the NSA we’re working with,” said Coviello with a tone of anguish. He implied that if the NSA induced RSA to include a secret backdoor in any RSA product, it happened without RSA’s consent or awareness. https://www.networkworld.com/article/687628/security-rsa-chief-nsa-exploited-position-of-trust-should-spin-out-security-tech-group.html https://www.networkworld.com/article/687628/security-rsa-chi...
- fragmede 3y ago
  What about the time it was shown they did the reverse (hardened security using math only they knew at the time) for DSA
  - Dylan16807 3y ago
    What about it? There's an implicit "always" in their second sentence, if you're confused by the wording. They aren't positing the equivalent of the guard that only lies.
    - fragmede 3y ago
      It's an interesting story for those who haven't heard about that an think the NSA could only be up to evil. You may not have read it as the guard only ever lies, but that doesn't stop people from thinking that anyway.
      - Dylan16807 3y ago
        It's an interesting story, but I still don't know what you wanted as an answer to "What about".
        2OEH8eoCRo0 3y ago
        They were responding to: > It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies. With an example of them doing exactly that.
        Dylan16807 3y ago
        This is addressed very directly by the second paragraph of my first comment. Please adjust your response to take that into account.
        fragmede 3y ago
        why are you so fight-y? do you have to be right, or have the last word? what is it?
- tveita 3y ago
  Notably that was a "no-one-but-us" backdoor, that requires a specific secret key to exploit. We'll see when someone analyzes the payload further, but presumably this backdoor also triggers on a specific private key. If not there are ways to do it that would look far more like an innocent mistake, like a logic bug or failed bounds check. I can see some arguments that might persuade the NSA to run an attack like this - gathers real world data on detection of supply attacks - serves as a wake-up call for a software community that has grown complacent on the security impact of dependencies - in the worst case, if no one finds it then hey, free backdoor
AimHere 3y ago
Hardly ridiculous. You say that as if members of US government agencies didn't plot terror attacks on Americans (Operation Northwood), steal the medical records of American whistleblowers (Ellsberg), had to be prevented from assassinating American journalists (Gordon Liddy, on Jack Anderson), collude to assassinate American political activists (Fred Hampton), spy on presidential candidates (Watergate), sell weapons to countries who'd allegedly supported groups who'd launched suicide bombing attacks on American soldiers (Iran-Contra), allow drug smugglers to flood the USA with cocaine so that they could supply illegal guns to terrorists abroad on their return trip (Iran-Contra again) and get caught conducting illegal mass-surveillance on American people as a whole (Snowden). Among others. It's super-naive to suggest that government agencies wouldn't act against the interest of American citizens and companies because there might be consequences if they were caught. Most of the instances above actually were instances where the perpetrators did get caught, which is why we know about them.
- 2OEH8eoCRo0 3y ago
  I love being called naive.
  - QuantumG 3y ago
    Whisper it to me lover.
  - SadTrombone 3y ago
    Seems like an appropriately used descriptor here.
- jonathankoren 3y ago
  You don’t even have to be this conspiratorially minded to believe the NSA is a legitimate suspect here. (For the record, I think literally every intelligence agency on Earth is plausible here.) You kind of lost the thread when you say, “act against the interests of American citizens and companies”. Bro, literally anyone could be using xz, and anyone could be using Red Hat. You’re only “acting against Americans” if you use it against Americans. I don’t know who was behind this, but a perfectly plausible scenario would be the NSA putting the backdoor in with an ostensibly Chinese login and then activating on machines hosted and controlled by people outside of the US. Focusing on a specific distro is myopic. Red Hat is popular.
mrb 3y ago
Have you forgotten about the Snowden leaks exposing the surveillance on Americans by the American govt?
- threeseed 3y ago
  Every country spies on its own citizens. By comparison America is actually quite timid compared to other countries e.g. UK and the widespread CCTV network.
  - bpye 3y ago
    I'd say that CCTV is quite different to wiretapping. You (generally) wouldn't have the expectation of privacy in a public place, most people would expect that phone calls, messages, etc do remain private. Now, GCHQ is no better than the NSA for that either, but I don't think CCTV is a good comparison.
- silpol 3y ago
  While his leaks expose surveillance, he was useful idiot https://en.wikipedia.org/wiki/Useful_idiot https://en.wikipedia.org/wiki/Useful_idiot in hands of Assange club. And it might be event of his saving was trigger for Putin to start war. So no, I'd better see whole camaraderie before court and sentenced. Regardless of 'heroism'. And yes, most of modern supporters of Wikileaks / Assange / Snowden / etc, chanting 'release Assange' and 'pardon Snowden' are useful idiots in hands of tyrannies like BRICS club.
asveikau 3y ago
I'm not very inclined to think this is the US govt, however, you should better acquaint yourself with the morals of some members of Congress. I think the best reason to doubt USG involvement is the ease with which somebody discovered this issue, which is only a month or two old. I feel like NSA etc. knows not to get caught doing this so easily.
mardifoufs 3y ago
Yeah as we know, intelligence agencies are very often held accountable in the US. As witnessed by all the individuals that got charged or punished for uh... nevermind.

It's ridiculous to think it's the US as it would be an attack on Red Hat a US company and an attack on Americans. It's a good way to be dragged in front of Congress.

guinea-unicorn 3y ago

The US has backdoored RSA's RNG and thus endangered the security of American companies. It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies.

2OEH8eoCRo0 3y ago
That is speculation and has never been confirmed.
- occamsrazorwit 3y ago
  What type of confirmation do you want? The documents aren't going to be declassified in the next couple of decades, if ever. I've never heard anyone claim that Dual_EC_DRBG is most likely not intentionally backdoored, but there's literally no way to confirm because of how its written. If we can't analyze intention from the code, we can look at the broader context for clues. The NSA spent an unusual amount of effort trying to push forward an algorithm that kept getting shot down because it was slower than similar algorithms with no additional benefits (the $10 million deal specified it as a requirement [1]). If you give the NSA the benefit of the doubt, they spent a lot of time and money to... intentionally slow down random number generation?! As an American, I'd prefer a competent NSA than an incompetent NSA that spends my tax dollars to make technology worse for literally no benefit... [1] https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220 https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9...
- hex4def6 3y ago
  You are understating the level of evidence that points to the NSA being fully aware of what it was doing. To be clear, the method of attack was something that had been described in a paper years earlier, the NSA literally had a program (BULLRUN) around compromising and attacking encryption, and there were security researchers at NIST and other places that raised concerns even before it was implemented as a standard. Oh, and the NSA paid the RSA $10 million to implement it. Heck, even the chairman of the RSA implies they got used by the NSA: In an impassioned speech, Coveillo said RSA, like many in industry, has worked with the NSA on projects. But in the case of the NSA-developed algorithm which he didn’t directly name, Coviello told conference attendees that RSA feels NSA exploited its position of trust. In its job, NSA plays two roles, he pointed out. In the information assurance directorate (IAD) arm of NSA, it decides on security technologies that might find use in the government, especially the military. The other side of the NSA is tasked with vacuuming up data for cyber-espionage purposes and now is prepared to take an offensive role in cyber-attacks and cyberwar. “We can’t be sure which part of the NSA we’re working with,” said Coviello with a tone of anguish. He implied that if the NSA induced RSA to include a secret backdoor in any RSA product, it happened without RSA’s consent or awareness. https://www.networkworld.com/article/687628/security-rsa-chief-nsa-exploited-position-of-trust-should-spin-out-security-tech-group.html https://www.networkworld.com/article/687628/security-rsa-chi...
fragmede 3y ago
What about the time it was shown they did the reverse (hardened security using math only they knew at the time) for DSA
- Dylan16807 3y ago
  What about it? There's an implicit "always" in their second sentence, if you're confused by the wording. They aren't positing the equivalent of the guard that only lies.
  - fragmede 3y ago
    It's an interesting story for those who haven't heard about that an think the NSA could only be up to evil. You may not have read it as the guard only ever lies, but that doesn't stop people from thinking that anyway.
    - Dylan16807 3y ago
      It's an interesting story, but I still don't know what you wanted as an answer to "What about".
      - 2OEH8eoCRo0 3y ago
        They were responding to: > It is naive to think that US intelligence agencies will act in the best interest of US citizens or companies. With an example of them doing exactly that.
        Dylan16807 3y ago
        This is addressed very directly by the second paragraph of my first comment. Please adjust your response to take that into account.
        fragmede 3y ago
        why are you so fight-y? do you have to be right, or have the last word? what is it?
tveita 3y ago
Notably that was a "no-one-but-us" backdoor, that requires a specific secret key to exploit. We'll see when someone analyzes the payload further, but presumably this backdoor also triggers on a specific private key. If not there are ways to do it that would look far more like an innocent mistake, like a logic bug or failed bounds check. I can see some arguments that might persuade the NSA to run an attack like this - gathers real world data on detection of supply attacks - serves as a wake-up call for a software community that has grown complacent on the security impact of dependencies - in the worst case, if no one finds it then hey, free backdoor

AimHere 3y ago

Hardly ridiculous. You say that as if members of US government agencies didn't plot terror attacks on Americans (Operation Northwood), steal the medical records of American whistleblowers (Ellsberg), had to be prevented from assassinating American journalists (Gordon Liddy, on Jack Anderson), collude to assassinate American political activists (Fred Hampton), spy on presidential candidates (Watergate), sell weapons to countries who'd allegedly supported groups who'd launched suicide bombing attacks on American soldiers (Iran-Contra), allow drug smugglers to flood the USA with cocaine so that they could supply illegal guns to terrorists abroad on their return trip (Iran-Contra again) and get caught conducting illegal mass-surveillance on American people as a whole (Snowden). Among others. It's super-naive to suggest that government agencies wouldn't act against the interest of American citizens and companies because there might be consequences if they were caught. Most of the instances above actually were instances where the perpetrators did get caught, which is why we know about them.

2OEH8eoCRo0 3y ago
I love being called naive.
- QuantumG 3y ago
  Whisper it to me lover.
- SadTrombone 3y ago
  Seems like an appropriately used descriptor here.
jonathankoren 3y ago
You don’t even have to be this conspiratorially minded to believe the NSA is a legitimate suspect here. (For the record, I think literally every intelligence agency on Earth is plausible here.) You kind of lost the thread when you say, “act against the interests of American citizens and companies”. Bro, literally anyone could be using xz, and anyone could be using Red Hat. You’re only “acting against Americans” if you use it against Americans. I don’t know who was behind this, but a perfectly plausible scenario would be the NSA putting the backdoor in with an ostensibly Chinese login and then activating on machines hosted and controlled by people outside of the US. Focusing on a specific distro is myopic. Red Hat is popular.

mrb 3y ago

Have you forgotten about the Snowden leaks exposing the surveillance on Americans by the American govt?

threeseed 3y ago
Every country spies on its own citizens. By comparison America is actually quite timid compared to other countries e.g. UK and the widespread CCTV network.
- bpye 3y ago
  I'd say that CCTV is quite different to wiretapping. You (generally) wouldn't have the expectation of privacy in a public place, most people would expect that phone calls, messages, etc do remain private. Now, GCHQ is no better than the NSA for that either, but I don't think CCTV is a good comparison.
silpol 3y ago
While his leaks expose surveillance, he was useful idiot https://en.wikipedia.org/wiki/Useful_idiot https://en.wikipedia.org/wiki/Useful_idiot in hands of Assange club. And it might be event of his saving was trigger for Putin to start war. So no, I'd better see whole camaraderie before court and sentenced. Regardless of 'heroism'. And yes, most of modern supporters of Wikileaks / Assange / Snowden / etc, chanting 'release Assange' and 'pardon Snowden' are useful idiots in hands of tyrannies like BRICS club.

asveikau 3y ago

I'm not very inclined to think this is the US govt, however, you should better acquaint yourself with the morals of some members of Congress. I think the best reason to doubt USG involvement is the ease with which somebody discovered this issue, which is only a month or two old. I feel like NSA etc. knows not to get caught doing this so easily.

mardifoufs 3y ago

Yeah as we know, intelligence agencies are very often held accountable in the US. As witnessed by all the individuals that got charged or punished for uh... nevermind.