Yes I think encryption's the main part of the solution, in the foreseeable future, while we are using computer networks like "the internet". I'm no expert, but I think something like PGP cannot be cracked even by powerful government computers.
However, there are other ways that governments can still effect intimidation and control. One is to outlaw any encryption that they cannot break. Another is to trace messages back to IP addresses (can that be prevented by encryption?) Others are: to attach bugs to computers while people leave them unattended; to take snapshots of screens; and to catch people in the act of creating encryption keys. I believe that in the end, even unbreakable encryption is not the final solution. Back in the days when instead of "Google Groups" we called this "Usenet" -- before Deja Vu, before Google Groups, and before Google -- the internet was a wonderful thing. I used it to get answers from around the world to help me in my modest software work at that time, and I'm sure it can still be used for that. I doubt that it's much better now than it was then, in its end results. When the web came along it brought ubiquitous pictures and speed of navigation, and those are very good, but pretty soon the corporations and governments started in with their encroachments. Now the internet (and the web) is being gradually taken over, by corporations, for advertising and selling software gimmicks, and by governments, for spying and controlling. Because of these takeovers, the internet is becoming less useful for the common people. Transmissions are bogged down with that advertising traffic, and user functionality is bogged down by distracting gimmicry. I've known some smart people who were unable to get past that, and so never got familiar with email. I imagine that there will be some way, somewhere sometime, that the common people can design their own communication systems that are not so vulnerable to such encroachments. What will be the characteristics of such communication systems? I suppose they will be decentralized and ever-changing. They might be primitive! The best communication is not best by high technology, but rather it is best by thoughtfulness, clarity of expression, and relevance -- characteristics that are mostly about content, not format. Often, they can be relevant without being fast. All this is why primitive systems, not just higher technological systems, are worthy of consideration. My opinions. -jrl On Thursday, November 14, 2013 1:13:09 PM UTC-8, Travis wrote: > > > > > > > > > > > > > http://www.wired.com/opinion/2013/11/this-is-how-the-internet-backbone-has-been-turned-into-a-weapon/ > Our Government Has Weaponized the Internet. Here’s How They Did It > > The internet backbone — the infrastructure of networks upon which internet > traffic travels — went from being a passive infrastructure for > communication to an active weapon for attacks. > > According to > revelations<http://www.theguardian.com/world/2013/oct/04/tor-attacks-nsa-users-online-anonymity>about > the QUANTUM program, the NSA can “shoot” (their words) an exploit at > any target it desires as his or her traffic passes across the backbone. It > appears that the NSA and GCHQ were the first to turn the internet backbone > into a weapon; absent Snowdens of their own, other countries may do the > same and then say, “It wasn’t us. And even if it was, you started it.” > > If the NSA can hack Petrobras, the Russians can justify attacking > Exxon/Mobil. If GCHQ can hack Belgicom to enable covert wiretaps, France > can do the same to AT&T. If the Canadians target the Brazilian Ministry of > Mines and Energy, the Chinese can target the U.S. Department of the > Interior. We now live in a world where, if we are lucky, our attackers may > be every country our traffic passes through except our own. > > Which means the rest of us — and especially any company or individual > whose operations are economically or politically significant — are now > targets. All cleartext traffic is not just information being sent from > sender to receiver, but is a possible attack vector. > > Here’s how it works. > > The QUANTUM codename is deliciously apt for a technique known as “packet > injection,” which spoofs or forges packets to intercept them. The NSA’s > wiretaps don’t even need to be silent; they just need to send a message > that arrives at the target first. It works by examining requests and > injecting a forged reply that appears to come from the real recipient so > the victim acts on it. > > In this case, packet injection is used for “man-on-the-side” attacks — > which are more failure-tolerant than man-in-the-middle > attacks<http://www.techdirt.com/articles/20131004/10522324753/>because they > allow one to observe and add (but not also subtract, as the > man-in-the-middle attacks do). That’s why these are particularly popular in > censorship systems. It can’t keep up? That’s okay. Better to miss a few > than to not work at all. > > Nicholas Weaver is a researcher at the International Computer Science > Institute in Berkeley and U.C. San Diego (though this opinion is his own). > He focuses on network security as well as network intrusion detection, > defenses for DNS resolvers, and tools for detecting ISP-introduced > manipulations of a user’s network connection. Weaver received his Ph.D. in > Computer Science from U.C. Berkeley. > > The technology itself is actually pretty basic. And the same techniques > that work on on a Wi-Fi network can work on a backbone wiretap. I > personally coded up a packet-injector from scratch in a matter of hours > five years ago, and it’s long been a staple of DefCon > pranks<http://airpwn.sourceforge.net/Airpwn.html> > . > > So how have nations used packet injection, and what else can they do with > it? These are some of the known uses. > Censorship > > The most infamous use of packet injection prior to the Snowden leaks was > censorship, where both internet service providers (ISPs) and the Great > Firewall of China > <http://en.wikipedia.org/wiki/Golden_Shield_Project>injected TCP > reset <http://www.icir.org/vern/papers/reset-injection.ndss09.pdf>packets > (RST) to block undesired traffic. When a computer receives one of > these injected RST packets, it closes the connection, believing that all > communication is complete. > > Although public disclosure forced ISPs to stop this behavior, China > continues to censor with injected resets. It also injects the Domain Name > System (DNS) — the system all computers use to turn names such as “ > www.facebook.com” into IP addresses — by inserting a fake reply whenever > it sees a forbidden name. (It’s a process that has caused collateral > damage<http://www.sigcomm.org/sites/default/files/ccr/papers/2012/July/2317307-2317311.pdf>by > censoring non-Chinese internet traffic). > User Identification > > User cookies, those inserted by both advertising networks and services, > also serve as great identifiers for NSA targeting. Yet a web browser only > reveals these cookies when communicating with such sites. A solution lies > in the NSA’s QUANTUMCOOKIE attack, which they’ve utilized to de-anonymize > Tor users. > > A packet injector can reveal these cookies by replying to an unnoticed web > fetch (such as a small image) with a HTTP 302 redirect pointing to the > target site (such as Hotmail). The browser now thinks “hey, should really > go visit Hotmail and ask it for this image”. In connecting to Hotmail, it > reveals all non-secure cookies to the wiretap. This both identifies the > user to the wiretap, and also allows the wiretap to use these cookies. > > So for any webmail service that doesn’t require HTTPS encryption, > QUANTUMCOOKIE also allows the wiretap to log in as the target and read the > target’s mail. QUANTUMCOOKIE could also tag users, as the same redirection > that extracts a cookie could also set or modify a cookie, enabling the NSA > to actively track users of interest as they move across the network — > although there is no indication yet that the NSA utilizes this technique. > User Attack > > The NSA has a > collection<https://www.schneier.com/blog/archives/2013/10/the_nsas_new_ri.html>of > FOXACID servers, designed to exploit visitors. Conceptually similar to > Metasploit’s WebServer browser autopwn > mode<http://www.rapid7.com/db/modules/auxiliary/server/browser_autopwn>, > these FOXACID servers probe any visiting browser for weaknesses to exploit. > > All it takes is a single request from a victim passing a wiretap for > exploitation to occur. Once the QUANTUM wiretap identifies the victim, it > simply packet injects a 302 redirect to a FOXACID server. Now the victim’s > browser starts talking to the FOXACID server, which quickly takes over the > victim’s computer. The NSA calls this QUANTUMINSERT. > > The NSA and GCHQ used this technique not only to target Tor users who read > *Inspire* (reported to be an Al-Qaeda propaganda magazine in the English > language) but also to gain a > foothold<http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html>within > the Belgium telecommunication firm Belgicom, as a prelude to > wiretapping Belgium phones. > > One particular > trick<http://boingboing.net/2013/11/11/gchq-used-fake-slashdot-linke.html>involved > identifying the LinkedIn or Slashdot account of an intended > target. Then when the QUANTUM system observed individuals visiting > LinkedIn<http://www.spiegel.de/international/world/ghcq-targets-engineers-with-fake-linkedin-pages-a-932821-2.html> > or > Slashdot, it would examine the HTML returned to identify the user before > shooting an exploit at the victim. Any page that identifies the users over > HTTP would work equally well, as long as the NSA is willing to write a > parser to extract user information from the contents of the page. > > Other possible QUANTUM use cases include the following. These are > speculative, as we have no evidence that the NSA, GCHQ, or others are > utilizing these opportunities. Yet to security experts they are obvious > extensions of the logic above. > > *HTTP cache poisoning.* Web browsers often cache critical scripts, such > as the ubiquitous Google Analytics script ‘ga.js’. The packet injector can > see a request for one of these scripts and instead respond with a malicious > version, which will now run on numerous web pages. Since such scripts > rarely change, the victim will continue to use the attacker’s script until > either the server changes the original script or the browser clears its > cache. > > *Zero-Exploit Exploitation.* The FinFly “remote monitoring” hacking tool > sold to governments includes exploit-free exploitation, where it > modifies<http://www.f-secure.com/weblog/archives/00002601.html>software > downloads and updates to contain a copy of the FinFisher Spyware. > Although Gamma International’s tool operates as a full man-in-the-middle, > packet injection can reproduce the effect. The injector simply waits for > the victim to attempt a file download, and replies with a 302 redirect to a > new server. This new server fetches the original file, modifies it, and > passes it on to the victim. When the victim runs the executable, they are > now exploited — without the need for any actual exploits. > > *Mobile Phone Applications.* Numerous Android and iOS applications fetch > data through simple HTTP. In particular, the “Vulna” Android advertisement > library was an > easy<http://www.fireeye.com/blog/technical/2013/10/ad-vulna-a-vulnaggressive-vulnerable-aggressive-adware-threatening-millions.html>target, > simply waiting for a request from the library and responding with > an attack that can effectively completely control the victim’s phone. > Although Google removed applications using this particular library, other > advertisement libraries and applications can present similar > vulnerabilities. > > *DNS-Derived Man-in-the-Middle.* Some attacks, such as intercepting HTTPS > traffic with a forged certificate, require a full man in the middle rather > than a simple eavesdropper. Since every communication starts with a DNS > request, and it is only a rare DNS resolver that cryptographically > validates the reply with DNSSEC, a packet injector can simply see the DNS > request and inject its own reply. This represents a capability upgrade, > turning a man-on-the-side into a man-in-the-middle. > > One possible use is to intercept HTTPS connections if the attacker has a > certificate that the victim will accept, by simply redirecting the victim > to the attacker’s server. Now the attacker’s server can complete the HTTPS > connection. Another potential use involves intercepting and modifying > email. The attacker simply packet-injects replies for the MX (Mailserver) > entries corresponding to the target’s email. Now the target’s email will > first pass through the attacker’s email server. This server could do more > than just read the target’s incoming mail, it could also modify it to > contain exploits. > > *Amplifying Reach.* Large countries don’t need to worry about seeing an > individual victim: odds are that a victim’s traffic will pass one wiretap > in a short period of time. But smaller countries that wish to utilize the > QUANTUMINSERT technique need to force victims traffic past their wiretaps. > It’s simply a matter of buying the traffic: Simply ensure that local > companies (such as the national airline) both advertise heavily and utilize > in-country servers for hosting their ads. Then when a desired target views > the advertisement, use packet injection to redirect them to the exploit > server; just observe which IP a potential victim arrived from before > deciding whether to attack. It’s like a watering hole attack where the > attacker doesn’t need to corrupt the watering hole. > > *** > > The only self defense from all of the above is universal > encryption. Universal encryption is difficult and expensive, but > unfortunately necessary. > > Encryption doesn’t just keep our traffic safe from eavesdroppers, it > protects us from attack. DNSSEC validation protects DNS from tampering, > while SSL armors both email and web traffic. > > There are many engineering and logistic difficulties involved in > encrypting all traffic on the internet, but its one we must overcome if we > are to defend ourselves from the entities that have weaponized the backbone. > > > > > __._,_.___ > > > > > > > __,_._,___ > > > -- -- Thanks for being part of "PoliticalForum" at Google Groups. For options & help see http://groups.google.com/group/PoliticalForum * Visit our other community at http://www.PoliticalForum.com/ * It's active and moderated. Register and vote in our polls. * Read the latest breaking news, and more. --- You received this message because you are subscribed to the Google Groups "PoliticalForum" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
