Tag Archives: Eric King

Spooky Spooky Mobile

Spooky Spooky Mobile
Hacking thyne own file
Upload and Download
And as you have your chatter
I met a Telco
That would not give its data
So I took their servers
And gave it a little patch
(Goosy, Goosy, Gander)

Yes, when we look at the article ‘US and UK accused of hacking Sim card firm to steal codes‘ (at http://www.bbc.com/news/technology-31545050) I seem to resort to nursery rhymes. There is method to my madness, just as my madness could be regarded as methodical (to the smallest degree). I read the article with other eyes, perhaps you did too? The first part is seen here “The Intercept alleges that the hack organised by Britain’s GCHQ and the US National Security Agency (NSA) began in 2010, and was organised by operatives in the “Mobile Handset Exploitation Team”. Neither agency has commented directly on the allegations“, now, I will continue on the premise that this fact is true (not whether it is correct). In 2010 there was still a massive hunt for this bearded dude underway named Osama something or other. For this part I need to take you on a side trip ‘Banking Giant HSBC Sheltered Murky Cash Linked to Dictators and Arms Dealers‘ (at http://www.icij.org/project/swiss-leaks/banking-giant-hsbc-sheltered-murky-cash-linked-dictators-and-arms-dealers). The issue might be ‘news’ now, but it had been known in the intelligence industry for some time. After 2008 several individuals with additional limitations on moral and ethics were willing to assist the grey area of free trading in setting up funds. This group had ALWAYS existed, greed is such an easy tool to grow under, yet, the fact that some would be willing to be the money orchard for terrorist organisations is decently novel. 2008 had made many hungry so some would be willing to get at what they wanted, more money. A problem that has existed for a long time, so the premise to get access to mobiles so that possible lines of communications would be uncovered make perfect sense.

The trail goes further, you see, most people have a contract, or stay with the same provider for years, this not an issue for the hunters. You (roughly 99.99993243% of the mobile users) are not an issue, but how to find the rest? Hope on some random lucky draw? Governments rely on income from lotteries, not rely on getting a price in that same way. So getting a hold of ALL Sims is a much better solution. It made perfect sense. Do I like it? I actually do not care, I lead one of the dullest mobile lives and I believe that some people must be hunted down. So to go all out on ‘Yes’, hunt them down and ‘No’, you cannot monitor me, seems to be both hypocrite and sanctimonious all in one package. In addition, I tend to not break the law, which makes it even easier. So let’s get back to the article!

The next part is seen here “A Gemalto spokeswoman said the company was unable to verify whether there had indeed been a breach, and highlighted that other Sim manufacturers could also have been targeted. She added: “We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such highly sophisticated techniques to try to obtain Sim card data””, so we see two parts, one that the known provider is not the only provider, were they all targeted?

Linked to this is: “Eric King, deputy director of the campaign group Privacy International, said the NSA and GCHQ had “lost sight of what the rule of law means and how to weigh what is necessary and proportionate”“. This sounds nice in theory, but after taking a look at the Privacy International site, I see him as (only) slightly sanctimonious. all this on surveillance and SIGINT (the Five Eyes group), yet, they have ZERO visibility on the issue that I have on the exchange of data on a global scale by large corporations and how people are almost lulled into a sleepy state of just agreeing with it all, not to mention the other versions of the Lenovo ‘Superfish’ instances that we have not seen brought to daylight yet. It seems that governments are not allowed any options, whilst the propulsion of greed from large corporations and their data remains uninhibited by using the ‘US-EU Safe Harbor Framework‘ (at http://genomebiology.com/2014/15/8/430), when we consider the quote “A multinational seeking approval must submit its global policies and practices to a ‘lead’ EU data protection authority (DPA) – typically in the country of its European headquarters. Once the lead DPA gives its ‘stamp of approval’, a mutual recognition scheme among most EU member states facilitates approval by other relevant DPAs. To date, over 50 corporations have received BCR approval” When we see the list (at http://ec.europa.eu/justice/data-protection/document/international-transfers/binding-corporate-rules/bcr_cooperation/index_en.htm), we see NOVARTIS, which gives us a direct link to Natixis (and the massive amounts of links that they have). Ernst & Young and Motorola among others, so how can one satellite locations allow indirectly to move data across other borders, or make them accessible for query? Is it not interesting that Privacy International has not been looking at that (as far as I could tell), so do you see the issue I have with their ‘statement’?

Linked to the ‘alleged’ sim code heist is another article. This one is a lot older. It was from July 2013 and called “Millions of Sim cards are ‘vulnerable to hack attack’” (at http://www.bbc.com/news/technology-23402988), so, yes, when we see the quote “Karsten Nohl has said he has found a way to discover some Sims’ digital keys by sending them a special text message. He warned criminals could potentially use the technique to listen in on calls or steal cash“. So, yes getting the data from the sim makers directly would make a lot of sense (an ergonomically terrific solution), but this method might be less visible. So why was another method used. Now we get back to the beginning: “US and British intelligence agencies hacked into a major manufacturer of Sim cards in order to steal codes that facilitate eavesdropping on mobiles, a US news website says“, which News website? The fact that this news is followed by “The Intercept says the revelations came from US intelligence contractor turned whistle-blower Edward Snowden” gives another pause. What is actually happening? It seems to me that the Snowden stamp is making us chase ghosts (pun intended), but overall I see less and less reliability in these ‘spectacular revelations‘ and the press does not seem to be asking the questions they should be asking. The investigations that they should do, do not seem to be done. The ‘revelation‘ is made and then we see one party line response from GCHQ “However GCHQ reiterated that all its activities were “carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate”“, which is now linked to this, but there is no evidence that this has actually happened. The subtitle ‘Full investigation‘ seems to be a header without a factual link. That subtitle ends with some group shot and the by-line “Experts say that the alleged hack is a major compromise of worldwide mobile phone security“, is that actually the fact? Would phone security be compromised? It seems to me that the 2013 is a much larger threat to phone security and Google stopping its continued development to anything before Android KitKat is just an additional cause for alarm, how did the alleged government activities create more danger? It seems to me that the BBC has not illuminated parts that should have been illuminated. When we see “The UN’s telecoms agency – the International Telecommunications Union – said that it would now contact regulators and other government agencies worldwide to ensure they were aware of the threat“, is also an issue. When we consider the UK issue of telecom caps and the fact that nothing has been done for years, can we dimensionally see that awareness of the ITU could be regarded as a similar demure step is a valid question, yet the current article does not reflect on the earlier issue. The end of the latest article gives the one part that is important as I see it “But perhaps this latest leak has done more to highlight how a single company is in control of millions of people’s private data“. So was this an actual leak, or did someone figure out a possible issue with current technology and they added the ‘Snowden’ link to give it a little more fear. The last part could have been done by any decent technologist, no MIT degree required. So what about the one time mention of ‘a US news website says‘? Who was it and how come that this media courtier, depending on visibility is reduced to 5 words, which seemed a little odd to me from the very first time I read the message.

Leave a comment

Filed under IT, Media, Military, Science

The hungry Journalist games

Another day and another article on Sky News!

This all started a long time ago, but it seems that this article (at http://news.sky.com/story/1293651/internet-firms-take-legal-action-against-gchq), opens up new avenues to explore, aqs it already had taken the cake as one might say. There are issues for certain, they are on both sides, but what is this about?

The seven countries involved are the UK, the US, Germany, the Netherlands, South Korea and Zimbabwe. Let’s start by stating that this is an interesting group of nations to begin with. It was an article in Der Spiegel that set them off. Most sources seem to have copied and pasted the same message (Reuters Journalism as I tend to call it), one source also had this: “Their complaint follows in the wake of articles about mass surveillance published in the Guardian based on material released by Snowden“.

So again this could be a ‘Snowden’ story, but I want to take a look at another side and the quote by Eric King spokesperson (deputy director) of Privacy International who stated “It completely cripples our confidence in the internet economy and threatens the rights of all those who use it. These unlawful activities, run jointly by GCHQ and the NSA, must come to an end immediately

Is that the truth, or should the correct quote be “It completely undermines our support of optional criminal activities and threatens the opportunity of economic abuse for all who desire it. Their unlawful activities, run jointly by GCHQ and the NSA, must come to an end immediately, so that we may again focus on possibly deniable illicit profit

That is quite the change, isn’t it? Consider the following two issues. First the prices, for example ‘Greenhost’ offers the following:

Webhosting 120 GB storage and 1.2 TB data traffic for 132.75 euro’s a month and virtual data servers containing 50 GB storage and 1 TB bandwidth a month for 215 euro’s a month. Basically, just one account would fit the web space for most the ENTIRE Forbes top 50, not just one or two.

So, in light of recent events, I thought I had something here, the Dutch provider fits the bill, but then I got to Riseup, which no longer seemed to be active and the Chaos Computer Club (CCC) which seemed highly ideologically to me. More important, it did not fit the bill either. So am I barking up the wrong tree? (I have been wrong before you know!)

I still believe that the ISP’s are all about not complying as it is not about freedom, but about bandwidth (which directly translates into revenue), which seemed to fit the first part, but the others are not about that, which makes me wonder what is in play. Do you actually think that the NSA and GCHQ are about wasting time? So, is the Chaos Computer Club a waste of time? No, as far as I can tell, they are not. Are they a threat? Well, that remains the issue. They are hackers after all. Is it that farfetched that some people would want to keep track of some of these members? Let’s not forget that someone is feeding organised crime the knowledge that they need to avoid prosecution, when considering the power that both the Triades and the Russian Mafia have in the digital age area, looking into the CCC to some extent seems to be a given. However, knowing their skills, doing it in the way it is implied to have been done seems a little over the top as most of these hackers are pretty proud of themselves and they are for the most not in hiding. Let us not forget, they voice themselves to be about the freedom of the German people and the utter privilege of their data remaining private.

The fact is that this is an implied mess involving 7 countries, the next valid question becomes: ‘are they linked (beyond the accusation), or are they just a collection of elements?’

That question bares scrutiny, but should also indicate the view I have had of Snowden from the very beginning. I believe him to be a joke (and a bad one at that). Now, most of you will not believe this, but let us take a look at the EVIDENCE. I am not talking about some claim, but actual evidence partially on the common sense you and me hopefully tend to have.

1. The claims that he has made involves massive levels of access. Not the access a hacker will ever have, but the information from top level sources in the CIA, NSA and GCHQ. So were talking hacking into over dozens of top level secured servers, servers which are monitored 24/7. He, some hacker no one had ever heard from, did all that. These people behind the screens do NOT EVER give out passwords, do not give access, yet he had all the information and walked out of one of the most secure buildings in the world with all THAT data? This is a quote found in sources like ‘the Verge’ and ‘Wired’. I think we can agree that wired is a reputable source in regards to technology (at http://www.wired.com/2013/06/snowden-thumb-drive/) “‘There are people who need to use a thumb drive and they have special permission,’ an unnamed, ex-NSA official told the LA Times. ‘But when you use one, people always look at you funny.’” This is not unlike the view I have had for a year now. Let’s not forget, the NSA is the place where SELinux was developed, it was designed to keep close tabs on access control, specifically, who, where, how and with what. So ‘some’ technician, with the USB drive in the most secure server space on the planet is just not going to fly. The question I had from the very beginning is not how he did it, but what was actually at play here? The next part is assumption! Was it to give Booz Allan Hamilton more profit? That was my alleged first thought. If data was going to get ported to non-government institutions, this small caper could give BAH and whoever was getting oversight an easy and clean billion a year in revenue. That tactic, still ethically wrong, would have made perfect sense to me.

Here is how I see it and this is PURE assumption (I will get back to evidence in a minute for my next issue), consider the Microsoft disappointment with data collection plans for the Xbox One. We see some of the changes (at http://www.nytimes.com/2014/05/23/us/politics/house-votes-to-limit-nsas-collection-of-phone-data.html). The following quotes are essential here. The first one was from Jim Sensenbrenner, Republican of Wisconsin, “The N.S.A. might still be watching us, he added, but now we can be watching them“. It is a bold statement, but is it true; moreover, should they be watched? Yes, any intelligence operation needs oversight, which is fair enough in a democratic way of life, but how many should overlook this? Are the people in oversight not granted well above average powers and is it fair to any opposition party that they should have it?

2. What lies beneath this access is the amount of involvement. Prism is one of the named projects with supported links to Australia, the UK and the Netherlands, with Microsoft as a commercial partner. Really? One nation, known for clogs, cheeses, Hans Brinker and soccer is placed next to the NSA and the Commonwealth? It is a technological hub, no doubt about that, but it is the size of Maryland. So, this is just the first of several projects, involving secrecies that would be limited to the very top, most of it would not be written down and Snowden had it (as in having in past tense, details follow). The mention of projects like XKeyscore, Tempora, Project 6, Stateroom, Lustre and Muscular. They are not only different projects, but they are a scope of projects that would not ever be in one location to begin with. So, what is implied as ‘the top’ of data gathering and one IT person has it all? Is no one asking the questions the PRESS should have asked and openly doubted from the very beginning to begin with (a part that is not voiced in any way).

The funny part is that stateroom seems to be no more than the legal collection of information as EVERY government tends to collect diplomatic data and in his claim he made them ALL bitches to the NSA, they just do not know it. There is also a reference to Echelon, there are several references, but the one that matters is not named. A covert niche within the NSA and the name of the source is: Tom Clancy!

Is anyone starting to wake up now?

This is not about anything but the warped imagination that is not even close to a reality. Consider that every government has embassies and consulates, the Dutch have them, the Australians have them, so do the Brits and the Germans, not to mention the French and they have them too. Consulates and Embassies represent their governments. Consulates tend to be specific for people and companies, so that they have backups. Like getting home when your passport is stolen, or to help a company with a list of people they should talk to for starting to do business. Trade will always remain important anywhere. Embassies are more about ‘governing’ opportunities as I see them. The Dutch want to get first dibs on building a reliable bridge, so their ambassador talks the great talk. People skills is what it is all about and talking to the right people. There are other sides too, they try to resolve issues, like a Dutchman committing a crime in Melbourne (for example) and the Embassy tries to ‘help’ the Dutch person to get home again, or to assist local government with their investigation if need be. These people do work that they sometimes like and sometimes hate, it is a job that needs to be done. To get the best results some things need to remain confidential and secret and as such whether through encrypted ways or through other ways messages go back and front between a government and its local representatives and that needs a little more security. Some is as simple as a message of a first insight as to build a bridge; to keep the advantage this goes encrypted. It is the cost of business, plain and simple. There is no hidden agenda (other than national pride in trying to score the job). So, they do they do their job and they are not the NSA bitch in the process.

It is simple approach and the lie hidden within a truth was stated as “They are covert, and their true mission is not known by the majority of the diplomatic staff at the facility where they are assigned” Part of the truth is that the encryption specialist is usually not known, it is not a secret either, he used to be the person, who had one extra book with cyphers, he opened each page and set the encryption box and transmitted the information, often a NCO of communication (often has NATO duty reference A00x0). That person had two extra tasks and most in the diplomatic staff might not know, or better stated, they absolutely do not care.

When we saw the statements by certain key people in Australia or the UK they spoke the absolute truth. The small explanation I gave is done by all, the DSD (AUS), GCHQ (UK) and as I said it the Dutch have it too. It is a simple legally valid and required job that needs to be done, nothing secret about it, it is the cost of doing business and sometimes, to keep a lead profitable it sometimes gets handed over more secured, just like they do it at Microsoft (they just get heaps better equipment).

Another issue is the XKeyscore reference. Does such a thing exist, most likely! Now consider the implications of the following, there are mentions of 700 servers in 150 locations. The fact that it needs to intercept without visibility and analyse at the same time as a person does many things at the same time. Even if the best of the best was used (which likely is the case), then we are looking at a very select group trying to get a handle on perhaps no more than the most dangerous 2000 people on the planet. Does anyone believe that a system like this remains a secret if 4 Australian bases are involved? The next part can also be taken as a fact. Can anyone even guess the amount of bandwidth this takes? Most routers nearby the monitored person will truly get a beating, so whatever this is, it will show up. It is the scope that is claimed that makes no sense. Some in the NSA might find it nice if it was true, but the weak link in all this is the actual internet.

The last part of this is the kicker in this joke. If his life depends on it all, do you actually think he would ever part with the information? This came from the NY Times from October 2013 (at http://www.nytimes.com/2013/10/18/world/snowden-says-he-took-no-secret-files-to-russia.html) “Mr Snowden said he gave all of the classified documents he had obtained to journalists he met in Hong Kong, before flying to Moscow, and did not keep any copies for himself“, so his life depends on a journalist, who now has the thousands of documents?

Perhaps we should look at a much more likely explanation, the man has no value, the press is stretching the value of events, as they would and Snowden has played his part, I still think that the Chinese saw in him what I saw from the very beginning, a simple joke! They walked away and he had to flee to Russia who is keeping him around for entertainment and to piss of the Yanks (which they also regard as good entertainment). My issue is not him, but the fact that I see more wasted time and energy on laughable cases that keep us all away from actually moving forward. In this economy, as we are so stretched thin, rebuilding an economy is a first need, not waste time on some feigned attack on the ‘confidence in the internet economy‘ as Eric King puts it.

And for the love of whomever, let’s not compare Snowden and Assange, I completely oppose Assange and his view, but at least he seemed to believe in that what he did was a just cause and acted accordingly.

In the end this is just my view, but no one seems to be asking the questions the press are supposed to be asking. The Guardian and Der Spiegel seem to get a ‘free’ hand in boasting tons of data and a simple stamp ‘Snowden said it was so’ seems enough for people to just accept it.

4 Comments

Filed under IT, Law, Military, Politics