6 ms·
Steve Gibson suggests [1] that direct access means, direct access to their internet pipes, effectively tapping or mirroring their content for analysis. He says
by WestCoastJustin 13y ago
Steve Gibson suggests [1] that direct access means, direct access to their internet pipes, effectively tapping or mirroring their content for analysis. He says that "direct access" has more meaning to non-techies than saying they "are listening at the upstream router". Very interesting podcast too. The $20 million per collection point, is to build the secure secret rooms [2] at their [google, facebook, apple, microsoft, etc] telecom providers, slip the fibers, and for all the gear they need to do it. He even suggests this is legal, since it is the open internet and anyone is allowed to peer into the traffic, since this is not actually in any of their [google, facebook, apple, microsoft, etc] data centers, but at the peering level.
[1] http://twit.tv/show/security-now/408 http://twit.tv/show/security-now/408
[2] http://en.wikipedia.org/wiki/Room_641A http://en.wikipedia.org/wiki/Room_641A
- mpyne 13y agoWas the wording on the slide "direct access to"? I remember there being a "directly from the servers", but that wording has to be interpreted in the context of what it means to someone in the intel community (like the NSA). And I'm 80% sure that what it means in that context is that the source of the data received has no middleman. I.e. they pull Google's records straight from Google, not from a wiretap or SIGINT, just like for Facebook, PalTalk, etc.
- jdp23 13y agoThe wording was indeed "collection directly from the servers". [1] Robert O'Harrow et. al.'s followon article from the Washington post had more details [2] Intelligence community sources said that this description, although inaccurate from a technical perspective, matches the experience of analysts at the NSA. From their workstations anywhere in the world, government employees cleared for PRISM access may “task” the system and receive results from an Internet company without further interaction with the company’s staff.... According to a more precise description contained in a classified NSA inspector general’s report, also obtained by The Post, PRISM allows “collection managers [to send] content tasking instructions directly to equipment installed at company-controlled locations,” rather than directly to company servers. The companies cannot see the queries that are sent from the NSA to the systems installed on their premises, according to sources familiar with the PRISM process. [1] http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server-collection-facebook-google http://www.guardian.co.uk/world/2013/jun/08/nsa-prism-server... [2] http://www.washingtonpost.com/world/national-security/us-company-officials-internet-surveillance-does-not-indiscriminately-mine-data/2013/06/08/5b3bb234-d07d-11e2-9f1a-1a7cdee20287_print.html http://www.washingtonpost.com/world/national-security/us-com...
- slg 13y agoI am not a network expert, but won't most of that data still be encrypted through SSL? If that is the case, it would be almost useless since sites like Facebook and Google have made the transition to defaulting to using SSL.
- tptacek 13y agoYes. Not only that, but Google and Facebook, both of whom have been tarred by the PRISM story, have gone way out of their way to make SSL/TLS more pervasive in the real world, to the point where their efforts are resulting in huge improvements to clientside software.
- Zigurd 13y agoThe problem is that cleartext can't be trusted in the cloud. The only way to really restore confidence is to enable truly private endpoint-to-endpoint secured real time and store-and-forward communication.
- pwf 13y agoAlmost useless, unless you have the keys.
- tptacek 13y agoNobody has ever presented any evidence ever that NSA has Google's SSL/TLS keys. Not only that, but Google has (a) pinned their public keys so that the browser binary itself can reject bogus- but- signed certificates, and (b) pushed heavily to enable forward secrecy in TLS, which means that even if you compromise their key, you can't decrypt sessions without being an active man in the middle.
- skwirl 13y agoIt seems that what PRISM is to some people has slipped away from what was originally reported to a world of conjecture. What you are saying is possible (although I think $20 million is way too cheap) but it does not fit in with what we have heard from the media and the tech industry. The NSA also would have had to crack the SSL encryption algorithms for this to be useful, and that revelation would eclipse by an order of magnitude anything else that has been reported thus far, in my opinion.
- chris_mahan 13y agoIf the NSA could crack SSL encryption (and why not, they are code-breakers first), or if they could simply acquire the keys (from the ssl providers, from google, from whomever), would they let you know? If you were in their shoes, had immunity, guys with guns, and billions of dollars, would you not find the weakest link and exploit it? For saving the children from terrorists, of course.
- XorNot 13y agoIf the NSA had teleportation (and why not, they engage in a lot of research and development), or if they could just make people invisible, would they let you know?
- chris_mahan 13y agoThey would definitely not let us know. OMG you are so right: they would tell us nothing!
- daeken 13y agoHonestly, I have to take anything that Steve Gibson says with a massive grain of salt. Remember, this is the man who claimed that raw sockets would destroy the Internet. Given that his suggestions are 100% speculation, I'd be willing to put any amount of money on the line that it's nonsense.