SoylentNews is people
SoylentNews
Submission Preview
No link to story available
Pluralistic: China Hacked Verizon, AT&T and Lumen Using the FBI’s Backdoor (07 Oct 2024) – Pluralist
████ # This file was generated bot-o-matically! Edit at your own risk. ████
Pluralistic: China hacked Verizon, AT&T and Lumen using the FBI’s backdoor (07 Oct 2024) – Pluralistic: Daily links from Cory Doctorow [pluralistic.net]:
Today's links
- China hacked Verizon, AT&T and Lumen using the FBI's backdoor [pluralistic.net]: There's no such thing as a backdoor that only works when 'good guys' use it.
- Hey look at this [pluralistic.net]: Delights to delectate.
- This day in history [pluralistic.net]: 2004, 2009, 2014, 2019
- Upcoming appearances [pluralistic.net]: Where to find me.
- Recent appearances [pluralistic.net]: Where I've been.
- Latest books [pluralistic.net]: You keep readin' em, I'll keep writin' 'em.
- Upcoming books [pluralistic.net]: Like I said, I'll keep writin' 'em.
- Colophon [pluralistic.net]: All the rest.
China hacked Verizon, AT&T and Lumen using the FBI's backdoor (permalink [pluralistic.net])
State-affiliated Chinese hackers penetrated AT&T, Verizon, Lumen and others; they entered their networks and spent months intercepting US traffic – from individuals, firms, government officials, etc – and they did it all without having to exploit any code vulnerabilities. Instead, they used the back door that the FBI requires every carrier to furnish:
In 1994, Bill Clinton signed CALEA into law. The Communications Assistance for Law Enforcement Act requires every US telecommunications network to be designed around facilitating access to law-enforcement wiretaps. Prior to CALEA, telecoms operators were often at pains to design their networks to resist infiltration and interception. Even if a telco didn't go that far, they were at the very least indifferent to the needs of law enforcement, and attuned instead to building efficient, robust networks.
Predictably, CALEA met stiff opposition from powerful telecoms companies as it worked its way through Congress, but the Clinton administration bought them off with hundreds of millions of dollars in subsidies to acquire wiretap-facilitation technologies. Immediately, a new industry sprang into being; companies that promised to help the carriers hack themselves, punching back doors into their networks. The pioneers of this dirty business were overwhelmingly founded by ex-Israeli signals intelligence personnel, though they often poached senior American military and intelligence officials to serve as the face of their operations and liase with their former colleagues in law enforcement and intelligence.
Telcos weren't the only opponents of CALEA, of course. Security experts – those who weren't hoping to cash in on government pork, anyways – warned that there was no way to make a back door that was only useful to the "good guys" but would keep the "bad guys" out.
These experts were – then as now – dismissed as neurotic worriers who simultaneously failed to understand the need to facilitate mass surveillance in order to keep the nation safe, and who lacked appropriate faith in American ingenuity. If we can put a man on the moon, surely we can build a security system that selectively fails when a cop needs it to, but stands up to every crook, bully, corporate snoop and foreign government. In other words: "We have faith in you! NERD HARDER!"
NERD HARDER! has been the answer ever since CALEA – and related Clinton-era initiatives, like the failed Clipper Chip program, which would have put a spy chip in every computer, and, eventually, every phone and gadget:
https://en.wikipedia.org/wiki/Clipper_chip [wikipedia.org]
America may have invented NERD HARDER! but plenty of other countries have taken up the cause. The all-time champion is former Australian Prime Minister Malcolm Turnbull, who, when informed that the laws of mathematics dictate that it is impossible to make an encryption scheme that only protects good secrets and not bad ones, replied, "The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia":
https://www.zdnet.com/article/the-laws-of-australia-will-trump-the-laws-of-mathematics-turnbull/ [zdnet.com]
CALEA forced a redesign of the foundational, physical layer of the internet. Thankfully, encryption at the protocol layer – in the programs we use – partially counters this deliberately introduced brittleness in the security of all our communications. CALEA can be used to intercept your communications, but mostly what an attacker gets is "metadata" ("so-and-so sent a message of X bytes to such and such") because the data is scrambled and they can't unscramble it, because cryptography actually works, unlike back doors. Of course, that's why governments in the EU, the US, the UK and all over the world are still trying to ban working encryption, insisting that the back doors they'll install will only let the good guys in:
https://pluralistic.net/2023/03/05/theyre-still-trying-to-ban-cryptography/ [pluralistic.net]
Any back door can be exploited by your adversaries. The Chinese sponsored hacking group know as Salt Typhoon intercepted the communications of hundreds of millions of American residents, businesses, and institutions. From that position, they could do NSA-style metadata-analysis, malware injection, and interception of unencrypted traffic. And they didn't have to hack anything, because the US government insists that all networking gear ship pre-hacked so that cops can get into it.
This isn't even the first time that CALEA back doors have been exploited by a hostile foreign power as a matter of geopolitical skullduggery. In 2004-2005, Greece's telecommunications were under mass surveillance by US spy agencies who wiretapped Greek officials, all the way up to the Prime Minister, in order to mess with the Greek Olympic bid:
https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004%E2%80%9305 [wikipedia.org]
This is a wild story in so many ways. For one thing, CALEA isn't law in Greece! You can totally sell working, secure networking gear in Greece, and in many other countries around the world where they have not passed a stupid CALEA-style law. However the US telecoms market is so fucking huge that all the manufacturers build CALEA back doors into their gear, no matter where it's destined for. So the US has effectively exported this deliberate insecurity to the whole planet – and used it to screw around with Olympic bids, the most penny-ante bullshit imaginable.
Now Chinese-sponsored hackers with cool names like "Salt Typhoon" are traipsing around inside US telecoms infrastructure, using the back doors the FBI insisted would be safe.
(Image: Kris Duda [flickr.com], CC BY 2.0 [creativecommons.org], modified)
Hey look at this (permalink [pluralistic.net])
- Juice Rescue ⚡🔌🚗 https://juice-rescue.org [juice-rescue.org]
Privacy and security in your messages https://opcandado.citizensandtech.org [citizensandtech.org]
The Fed Took $3k From You and Gave it to Jamie Dimon https://www.thebignewsletter.com/p/monopoly-round-up-the-fed-took-3k [thebignewsletter.com]
This day in history (permalink [pluralistic.net])
#20yrsago How the NSA broke crypto, and created civilian crypto industry https://www.schneier.com/blog/archives/2004/10/the_legacy_of_d.html [schneier.com]
#20yrsago Brewster Kahle: Universal access to all human knowledge is possible https://craphound.com/kahleweb20.txt [craphound.com]
#20yrsago HOWTO break Google Print DRM https://web.archive.org/web/20041011120549/http://vitanuova.loyalty.org/weblog/nb.cgi/view/vitanuova/2004/10/07/2 [archive.org]
#15yrsago Japanese court overturns Winny ruling, says file-sharing software is legal even if used for infringement https://web.archive.org/web/20091009232138/http://mdn.mainichi.jp/mdnnews/national/news/20091008p2a00m0na016000c.html [archive.org]
#15yrsago Robert E Howard collection, HEROES IN THE WIND: revisit your heroic past" rel="url2html-1825171">https://memex.craphound.com/2009/10/08/robert-e-howard-collection-heroes-in-the-wind-revisit-your-heroic-past/">past [soylentnews.org]
" rel="url2html-1825171">https://memex.craphound.com/2009/10/08/robert-e-howard-collection-heroes-in-the-wind-revisit-your-heroic-past/
#15yrsago The criticism that Ralph Lauren doesn’t want you to see! https://memex.craphound.com/2009/10/06/the-criticism-that-ralph-lauren-doesnt-want-you-to-see/ [craphound.com]
#15yrsago Scott Westerfeld’s Leviathan: kick-ass young adult steampunk series starts with a bang, a hiss and a clank https://memex.craphound.com/2009/10/06/scott-westerfelds-leviathan-kick-ass-young-adult-steampunk-series-starts-with-a-bang-a-hiss-and-a-clank/ [craphound.com]
#10yrsago Profile of Daniel Pinkwater, “Pynchon for kids” https://forward.com/culture/206667/how-daniel-pinkwater-became-my-own-personal-guru/ [forward.com]
#10yrsago Sore losers: How casinos went after two guys who found a video poker bug https://www.wired.com/2014/10/cheating-video-poker/ [wired.com]
#10yrsago Fixing the unfixable USB bug https://www.wired.com/2014/10/unpatchable-usb-malware-now-patchsort/ [wired.com]
#10yrsago 20 meaningful things you can do about climate change http://thischangeseverything.org/twenty-things-you-can-do-to-address-the-climate-crisis/ [thischangeseverything.org]
#10yrsago 10% of Americans have 10 or more alcoholic drinks every day https://www.washingtonpost.com/news/wonk/wp/2014/09/25/think-you-drink-a-lot-this-chart-will-tell-you/ [washingtonpost.com]
#10yrsago $35 Firefox OS smartphone – back to the drawing board https://arstechnica.com/gadgets/2014/10/testing-a-35-firefox-os-phone-how-bad-could-it-be/ [arstechnica.com]
#5yrsago For the first time ever, taxes on the 400 richest Americans were lower than taxes on everyone else https://www.nytimes.com/interactive/2019/10/06/opinion/income-tax-rate-wealthy.html [nytimes.com]
#5yrsago Supreme Court greenlights lawsuit over Amazon’s wage-theft from warehouse workers https://www.reuters.com/article/us-usa-court-amazon-com/u-s-supreme-court-rejects-amazon-warehouse-worker-wage-appeal-idUSKBN1WM1FI/ [reuters.com]
#5yrsago Bernie Blindness: a subreddit for noting the way press narratives ignore or smear Bernie Sanders https://www.reddit.com/r/bernieblindness/top/ [reddit.com]
#5yrsago Checkm8: an “unstoppable” Iphone jailbreaking crack https://arstechnica.com/information-technology/2019/09/developer-of-checkm8-explains-why-idevice-jailbreak-exploit-is-a-game-changer/ [arstechnica.com]
#5yrsago After an injunction against Pacifica radio, New York’s WBAI is back on the air https://twitter.com/2600/status/1181423565389942786 [twitter.com]
#5yrsago How the “Varsity Blues” admissions scam punished deserving, hard working kids so that mediocre kids of the super-rich could prosper https://memex.craphound.com/2019/10/08/how-the-varsity-blues-admissions-scam-punished-deserving-hard-working-kids-so-that-mediocre-kids-of-the-super-rich-could-prosper/ [craphound.com]
#5yrsago Facebook’s 2016 election billboards: Buy all your elections with us! https://twitter.com/MarietjeSchaake/status/1180166896294887424 [twitter.com]
#5yrsago Podcast: Why do people believe the Earth is flat? https://ia601006.us.archive.org/35/items/Cory_Doctorow_Podcast_311/Cory_Doctorow_Podcast_311_-_Why_do_people_believe_the_Earth_is_flat.mp3 [archive.org]
#5yrsago The cloud vs humanity: Adobe terminates every software license in Venezuela, keeps Venezuelans’ money https://helpx.adobe.com/la/x-productkb/policy-pricing/executive-order-venezuela.html [adobe.com]
#5yrsago How this fine gentleman convinced me to donate $300 to Elizabeth Warren https://memex.craphound.com/2019/10/06/how-this-fine-gentleman-convinced-me-to-donate-300-to-elizabeth-warren/ [craphound.com]
#5yrsago The corrupt Brazilian prosecutors who locked up Lula now want to release him, to make him less sympathetic https://memex.craphound.com/2019/10/06/the-corrupt-brazilian-prosecutors-who-locked-up-lula-now-want-to-release-him-to-make-him-less-sympathetic/ [craphound.com]
#5yrsago Hi-rez, open-licensed recreation of the 1968 Disneyland souvenir map https://ia803109.us.archive.org/7/items/disneylandmap1968_201910/DisneylandMap1968Full.jpg [archive.org]
Upcoming appearances (permalink [pluralistic.net])
- “Come distruggere il capitalismo della sorveglianza” (Pisa/Remote), Oct 12
https://www.internetfestival.it/programma/come-distruggere-il-capitalismo-della-sorveglianza/ [internetfestival.it]OKFN Tech We Want Online Summit (Remote), Oct 18
https://okfn.org/en/events/the-tech-we-want-online-summit/ [okfn.org]SOSS Fusion (Atlanta), Oct 22
https://sossfusion2024.sched.com/speaker/cory_doctorow.1qm5qfgn [sched.com]Eagle Eye Books (Decatur), Oct 23
https://eagleeyebooks.com/event/2024-10-23/cory-doctorow [eagleeyebooks.com]TusCon (Tucson), Nov 8-10
https://tusconscificon.com/ [tusconscificon.com]International Cooperative Alliance (New Delhi), Nov 24
https://icanewdelhi2024.coop/welcome/pages/Programme [icanewdelhi2024.coop]
