5 ms·

Slide 6 of the presentation clearly shows that pretty much every government is in on the program, with heavy concentration in western Europe. One question, how

by jstalin 13y ago

Slide 6 of the presentation clearly shows that pretty much every government is in on the program, with heavy concentration in western Europe. One question, how did the dot in China get there? http://www.theguardian.com/world/interactive/2013/jul/31/nsa-xkeyscore-program-full-presentation http://www.theguardian.com/world/interactive/2013/jul/31/nsa...

jstalin 13y ago
And look at slide 17: "Show me all VPN startups in country X, and give me data so I can decrypt and discover users." Holy crap. Is all encryption broken?
- fabian2k 13y ago
  I find the "Show me all exploitable machines in country X" on page 24 pretty scary as well
- MichaelGG 13y ago
  There's no evidence that any encryption is broken (other than people misusing it (edit: or broken protocols like PPTP)). Anyone could do this kinda thing given enough motivation and money. Determining a VPN's users? Just monitor all inbound connections to the VPN service. Now you have the IPs of the users. The IP alone might be enough to know the user or a search on that IP might show them logging into other services that reveal their ID. Pretty simple.
- vabmit 13y ago
  I think so. Yes. IIRC, the first time I saw this leaked was a combo leak by a Navy Seal and a member of the Executive. The Seal leaked that they powered down Bin Laden's computers to take his hard drives after they shot him. The Executive member said that the drives were encrypted and it would take a few days to get the data. Jihadis are known to use a custom version of PGP with 2048bit RSA keys. They either used that, a COTS drive encryption program (unlikely), or reviewed and adapted an open source drive encryption program. In either of the likely scenarios they would have been using 2048bit RSA. Therefor, it is highly likely (due to the NSA having target motivation even if the drives weren't well encrypted) that the smooth barrier does not exist and the NSA can factor 2048bit RSA in a hours to days scale time frame. Also, it was leaked that NSA TAO had a 70%+ success rate compromising Chinese systems. Even with the tech companies giving them secret zero days for an extended period of time, anyone that has been a blackhat knows they're not getting to a 70% success rate through exploits. Therefor, it's highly likely they can decrypt VPN/SSH (TLS) traffic encrypted with AES256/RC4-128/3DES and/or the RSA/EC public cryptography used. As you noted the leaked slide seems to indicate that.
  - jstalin 13y ago
    Good info. Do you have any sources online you can point to?
    - vabmit 13y ago
      Navy Seal Leak: _No_Easy_Day_ available from Amazon: http://www.amazon.com/No-Easy-Day-Firsthand-ebook/dp/B008MG1E4A/ http://www.amazon.com/No-Easy-Day-Firsthand-ebook/dp/B008MG1... (Notice how he makes no mention of ISA even being there, or doing any SSE). I don't recall the source of the Executive comment. It was kind of buried in a news piece with a broad focus that I read. I'll look for it. Unfortunately, I can't recall the exact language to do a good search and find it. Sorry. But, here they are saying they have it, it's encrypted, and they can get it in "weeks or months" (despite the large number of drives/filesystems with presumably different keys): http://www.cbsnews.com/8301-31727_162-20059825-10391695.html http://www.cbsnews.com/8301-31727_162-20059825-10391695.html The Executive and Legislature couldn't keep something secret to save their lives. And, JSOC leaks like a fucking sieve. If I can't find that particular leak on the web, I'm sure there will be another one soon with the same info. Every guy likes to talk to pretty news reporters and seem important. Claimed 75%+ success rate attacking Chinese systems: http://www.scmp.com/news/hong-kong/article/1260306/edward-snowden-classified-us-data-shows-hong-kong-hacking-targets http://www.scmp.com/news/hong-kong/article/1260306/edward-sn... Asrar al-Mujahideen (the Jihadi PGP fork w/ 2048bit RSA): http://www.rbijou.com/2013/03/18/an-overview-of-jihadist-encryption-programs/ http://www.rbijou.com/2013/03/18/an-overview-of-jihadist-enc... The news coverage sucks something awful. The thing is having enough knowledge of mil/ir/tech/math to put all the leaks together.
  - MAGZine 13y ago
    Breaking RSA is just a matter of managing to factor prime numbers faster than anyone else, isn't it? Unless if there is some sort of oversight inside the RSA algorithm that allows the encryption to be broken easier. Do you have more information on the smooth barrier? I did a quick google but didn't see much relevant.
    - vabmit 13y ago
jstalin 13y ago
I just noticed that the presentation is from 2008. Imagine what capabilities they've added in the last five years.
deleted 13y ago
[deleted]
haakon 13y ago
And what about all the dots along Antarctica?
- jstalin 13y ago
  The only thing I can think of is satellites?
lifeformed 13y ago
Not to mention all those Antarcticans!
aschreyer 13y ago
Could be an embassy.

by jstalin 13y ago

jstalin 13y ago

And look at slide 17: "Show me all VPN startups in country X, and give me data so I can decrypt and discover users." Holy crap. Is all encryption broken?

fabian2k 13y ago
I find the "Show me all exploitable machines in country X" on page 24 pretty scary as well
MichaelGG 13y ago
There's no evidence that any encryption is broken (other than people misusing it (edit: or broken protocols like PPTP)). Anyone could do this kinda thing given enough motivation and money. Determining a VPN's users? Just monitor all inbound connections to the VPN service. Now you have the IPs of the users. The IP alone might be enough to know the user or a search on that IP might show them logging into other services that reveal their ID. Pretty simple.
vabmit 13y ago
I think so. Yes. IIRC, the first time I saw this leaked was a combo leak by a Navy Seal and a member of the Executive. The Seal leaked that they powered down Bin Laden's computers to take his hard drives after they shot him. The Executive member said that the drives were encrypted and it would take a few days to get the data. Jihadis are known to use a custom version of PGP with 2048bit RSA keys. They either used that, a COTS drive encryption program (unlikely), or reviewed and adapted an open source drive encryption program. In either of the likely scenarios they would have been using 2048bit RSA. Therefor, it is highly likely (due to the NSA having target motivation even if the drives weren't well encrypted) that the smooth barrier does not exist and the NSA can factor 2048bit RSA in a hours to days scale time frame. Also, it was leaked that NSA TAO had a 70%+ success rate compromising Chinese systems. Even with the tech companies giving them secret zero days for an extended period of time, anyone that has been a blackhat knows they're not getting to a 70% success rate through exploits. Therefor, it's highly likely they can decrypt VPN/SSH (TLS) traffic encrypted with AES256/RC4-128/3DES and/or the RSA/EC public cryptography used. As you noted the leaked slide seems to indicate that.
- jstalin 13y ago
  Good info. Do you have any sources online you can point to?
  - vabmit 13y ago
    Navy Seal Leak: _No_Easy_Day_ available from Amazon: http://www.amazon.com/No-Easy-Day-Firsthand-ebook/dp/B008MG1E4A/ http://www.amazon.com/No-Easy-Day-Firsthand-ebook/dp/B008MG1... (Notice how he makes no mention of ISA even being there, or doing any SSE). I don't recall the source of the Executive comment. It was kind of buried in a news piece with a broad focus that I read. I'll look for it. Unfortunately, I can't recall the exact language to do a good search and find it. Sorry. But, here they are saying they have it, it's encrypted, and they can get it in "weeks or months" (despite the large number of drives/filesystems with presumably different keys): http://www.cbsnews.com/8301-31727_162-20059825-10391695.html http://www.cbsnews.com/8301-31727_162-20059825-10391695.html The Executive and Legislature couldn't keep something secret to save their lives. And, JSOC leaks like a fucking sieve. If I can't find that particular leak on the web, I'm sure there will be another one soon with the same info. Every guy likes to talk to pretty news reporters and seem important. Claimed 75%+ success rate attacking Chinese systems: http://www.scmp.com/news/hong-kong/article/1260306/edward-snowden-classified-us-data-shows-hong-kong-hacking-targets http://www.scmp.com/news/hong-kong/article/1260306/edward-sn... Asrar al-Mujahideen (the Jihadi PGP fork w/ 2048bit RSA): http://www.rbijou.com/2013/03/18/an-overview-of-jihadist-encryption-programs/ http://www.rbijou.com/2013/03/18/an-overview-of-jihadist-enc... The news coverage sucks something awful. The thing is having enough knowledge of mil/ir/tech/math to put all the leaks together.
- MAGZine 13y ago
  Breaking RSA is just a matter of managing to factor prime numbers faster than anyone else, isn't it? Unless if there is some sort of oversight inside the RSA algorithm that allows the encryption to be broken easier. Do you have more information on the smooth barrier? I did a quick google but didn't see much relevant.
  - vabmit 13y ago

jstalin 13y ago

I just noticed that the presentation is from 2008. Imagine what capabilities they've added in the last five years.

deleted 13y ago

[deleted]

haakon 13y ago

And what about all the dots along Antarctica?

jstalin 13y ago
The only thing I can think of is satellites?

lifeformed 13y ago

Not to mention all those Antarcticans!

aschreyer 13y ago

Could be an embassy.