ITSecurity.org

Technology Security Controls

Policy

Republicans storm ultra-secure “SCIF,” some with cell phones blazing [Update]

by

The US House of Representatives.

Enlarge / The US House of Representatives.
Wally Gobetz / Flickr

On Wednesday, Republican lawmakers committed a major breach of security guidelines when they carried cell phones as they tried to force their way into a secure room where a closed-door impeachment hearing with a Defense Department official was taking place.

At least one House member, Rep. Matt Gaetz of Florida, got inside the Sensitive Compartmented Information Facility (SCIF) in the basement of the House of Representatives. Despite strict rules barring all electronics inside such closed-off areas, Gaetz openly tweeted: “BREAKING: I led over 30 of my colleagues into the SCIF where Adam Schiff is holding secret impeachment depositions. Still inside—more details to come.”

After the tweet came under criticism, Gaetz later tweeted “sent by staff.” It remained unclear how the representative was able to communicate with his members of his staff.

Rep. Mark Walker of North Carolina also issued a tweet that said he was “in the SCIF.” A picture published by The New York Times showed a man identified as a House Republican holding up his phone as if taking pictures or video as he entered the secure room. A sign on the door of the room said, “Cameras and other recording devices prohibited without proper authorization.” The room has lockers outside the doors where people are required to store electronics before entering.

Lawyers said bringing phones into the secure area was a potential felony. Security officials, meanwhile, stressed how damaging the move could be to national security. The SCIF is designed to prevent electronic eavesdropping so members of Congress can receive sensitive information that is often classified. Often, the materials in the room reveal sensitive operations or show how intelligence officers collect information on adversaries. SCIFs are carefully controlled to prevent electronic signals or electronic devices from leaving the rooms. Chief among these restrictions is no unauthorized electronic devices.

Compromising national security

Cell phones in particular are known to be a risk since it’s easily within the means of a nation to infect both iOS and Android devices with full-featured spyware. From then on, the hackers can make the devices record audio and video, take pictures and download and upload files. Lawmakers are particularly prone to such attacks given the large amount of sensitive data they often have access to.

“Storming the SCIF without respecting the security protocols that require people to leave their electronic devices *outside* the space is actually compromising our national security,” Mieke Eoyang, who regularly used the room while she was a former staffer for several security-related congressional committees, wrote on Twitter. “Bringing electronic devices into a SCIF, and this SCIF in particular, is *very* problematic, especially when done by members of Congress.”

The event has parallels to a covertly made recording in the White House situation room last year by then-Trump administration staffer Omarosa Manigault Newman.

Update: Hours after the protest, Rep. Bennie Thompson, a Democrat representing Mississippi and the chairman of the Committee on Homeland Security, sent a letter to the Sergeant at Arms calling the event “an urgent security matter.”

“Such action is a blatant breach of security, violates the Oath all Members of Congress sign to gain access to classified information, and contravenes security controls established by the Director of the Central Intelligence Agency for the protection of classified information,” Thompson wrote. “The unprecedented breach of security raises serious concerns for Committee Chairmen, including me, responsible for maintaining SCIFs.”

Wednesday’s event occurred as members of the House Intelligence Committee were preparing to hear from Laura K. Cooper, the deputy assistant secretary of defense for Russia, Ukraine, and Eurasia. Chanting “let us in, let us in,” the protesting lawmakers prevented the hearing from proceeding. House Intelligence Committee Chairman Adam Schiff turned the protesters away and called on the sergeant-at-arms to break up the crowd.

According to the Associated Press:

Lawmakers described a chaotic scene. Rep. Debbie Wasserman Schultz, D-Fla., said she had just walked into the room when the Republican lawmakers blew past Capitol Police officers and Democratic staffers. The staff member who was checking identification at the entrance was “basically overcome” by the Republicans, she said.

“Literally some of them were just screaming about the president and what we’re doing to him and that we have nothing and just all things that were supportive of the president,” Wasserman Schultz said.

Sen. Lindsey Graham criticized his Republican colleagues for the tactic, calling them “nuts” to make a “run on the SCIF.”

“That’s not the way to do it,” he said.

The Republicans were protesting the closed-door hearings taking place in the impeachment process underway in the House. Only members of the House Intelligence Committee (which includes both Democrats and Republicans) have been permitted to attend hearings, though Rep. Schiff has pledged to make transcripts available after they have been scrubbed of any classified information. Some Republicans have claimed the restrictions resemble a Soviet-style proceeding, even though Republicans routinely held closed-door hearings when they controlled the House.

Post updated at 16:44 California time to add details about Thompson’s letter.

Why big ISPs aren’t happy about Google’s plans for encrypted DNS

by

Why big ISPs aren’t happy about Google’s plans for encrypted DNS

Enlarge
Thomas Trutschel/Photothek via Getty Images

When you visit a new website, your computer probably submits a request to the domain name system (DNS) to translate the domain name (like arstechnica.com) to an IP address. Currently, most DNS queries are unencrypted, which raises privacy and security concerns. Google and Mozilla are trying to address these concerns by adding support in their browsers for sending DNS queries over the encrypted HTTPS protocol.

But major Internet service providers have cried foul. In a September 19 letter to Congress, Big Cable and other telecom industry groups warned that Google’s support for DNS over HTTPS (DoH) “could interfere on a mass scale with critical Internet functions, as well as raise data-competition issues.”

On Sunday, The Wall Street Journal reported that the House Judiciary Committee is taking these concerns seriously. In a September 13 letter, the Judiciary Committee asked Google for details about its DoH plans—including whether Google plans to use data collected via the new protocol for commercial purposes.

But Google says that these concerns are groundless. Despite insinuations from telecom companies, Google says, the company has no plans to switch Chrome users to its own DNS servers. And while Google didn’t mention it, the company has plenty of ways to monitor users’ browsing patterns with or without access to their DNS queries.

The telecom industry letter is confusing because it mashes together two different criticisms of Google’s DoH plans. One concern is that switching to encrypted DNS would prevent ISPs and others from spying on their users. The other is that, in the process of enabling DoH, Google will switch millions of users over to Google’s own DNS servers, leading to a dangerous concentration of control over DNS.

Understanding the debate is easier if we consider each of these concerns separately.

Google says it isn’t planning to switch users to its DNS

Let’s start with the second concern: that Google will switch Chrome users to its own DNS servers, giving Google concentrated power over DNS. Google’s response here is simple.

“Google has no plans to centralize or change people’s DNS providers to Google by default,” the company said in an email to Ars Technica. “Any claim that we are trying to become the centralized encrypted DNS provider is inaccurate.”

Google laid out its plans in detail in a September 10 blog post. Starting with version 78, Chrome will begin experimenting with the new DoH feature. Under the experiment, Chrome will “check if the user’s current DNS provider is among a list of DoH-compatible providers, and upgrade to the equivalent DoH service from the same provider,” Google wrote. “If the DNS provider isn’t in the list, Chrome will continue to operate as it does today.”

One possible reason for confusion on this point is that Mozilla is planning a more aggressive rollout of the technology. The company is planning to gradually shift all of its users to DoH—whether or not their existing DNS provider supports it. The shift will make Cloudflare the default DNS provider for many Firefox users, regardless of the DNS settings of the underlying OS.

Mozilla has more latitude to do this because most surveys show Firefox with single-digit market share—and Firefox isn’t a major DNS provider in its own right. So there’d be little basis for antitrust scrutiny if Mozilla shifts its users over to a new DNS provider. The same move could raise antitrust concerns if Google started switching Chrome users over to its own DNS. But Google says it has no plans to do that.

DNS over HTTPS means ISPs can’t spy on their users

Google CEO Sundar Pichai.

Enlarge / Google CEO Sundar Pichai.
Simon Dawson/Bloomberg via Getty Images

Telecom companies also raised a second concern that applies even if Google doesn’t shift anyone to its own DNS servers. Put simply: the lack of DNS encryption is convenient for ISPs.

ISPs sometimes find it useful to monitor their customers’ Internet traffic. For example, queries to malware-associated domains can be a signal that a customer’s computer is infected with malware. In some cases, ISPs also modify customers’ DNS queries in-flight. For example, an easy way to block children from accessing adult materials is with an ISP-level filter that rewrites DNS queries for banned domains. Some public Wi-Fi networks use modified DNS queries as a way to redirect users to a network sign-on page.

Some ISPs also use DNS snooping for more controversial purposes—like ad targeting or policing their networks for copyright infringement.

Widespread adoption of DoH would limit ISPs’ ability to both monitor and modify customer queries. It wouldn’t necessarily eliminate this ability, since ISPs could still use these techniques for customers who use the ISP’s own DNS servers. But if customers switched to third-party DNS servers—either from Google or one of its various competitors—then ISPs would no longer have an easy way to tell which sites customers were accessing.

ISPs could still see which IP addresses a customer had accessed, which would give them some information—this can be an effective way to detect malware infections, for example. But this is a cruder way to monitor Internet traffic. Multiple domains can share a single IP address, and domains can change IP addresses over time. So ISPs would wind up with reduced visibility into their customers’ browsing habits.

What would a switch mean?

But a switch to DoH would clearly mean ISPs had less ability to monitor and manipulate their customers’ browsing activity. Indeed, for advocates that’s the point. They believe users, not their ISPs, should be in charge.

Mozilla, which is pushing DoH more aggressively than Google, has taken steps to avoid creating too much chaos in the process. In July, Mozilla said that it wouldn’t enable DoH by default in the UK, where ISPs are planning to use DNS to implement legally mandated porn filtering.

Before enabling DoH, Firefox will check if a computer has parental control software installed. In enterprise settings, Mozilla will try to figure out if a switch to DoH will break corporate Intranet features that depend on using specific DNS servers. Firefox will continue using the existing DNS servers in these cases.

So far, Google is only enabling DOH for a select number of whitelisted DNS providers, so the switch shouldn’t cause too many problems. If the company goes beyond that, we can expect it to take measures similar to those Mozilla has taken.

In any event, it’s hard to see a policy problem here. ISPs’ ability to eavesdrop on their customers’ DNS queries is little more than a historical accident. In recent years, websites across the Internet have adopted encryption for the contents of their sites. The encryption of DNS is the natural next step toward a more secure Internet. It may require some painful adjustments by ISPs, but that hardly seems like a reason for policymakers to block the change.

Judge allows suit against AT&T after $24 million cryptocurrency theft

by

An AT&T store in New Jersey.

Enlarge / An AT&T store in New Jersey.
Michael Brochstein/SOPA Images/LightRocket via Getty Images

When Michael Terpin’s smartphone suddenly stopped working in June 2017, he knew it wasn’t a good sign. He called his cellular provider, AT&T, and learned that a hacker had gained control of his phone number.

The stakes were high because Terpin is a wealthy and prominent cryptocurrency investor. Terpin says the hackers gained control of his Skype account and tricked a client into sending a cryptocurrency payment to the hackers instead of to Terpin.

After the attack, Terpin asked AT&T to escalate the security protections on his phone number. According to Terpin, AT&T agreed to set up a six-digit passcode that must be entered before anyone could transfer Terpin’s phone number.

But the new security measures didn’t work. In January 2018, “an AT&T store cooperated with an imposter committing SIM swap fraud,” Terpin alleged in his August 2018 lawsuit against AT&T. The thieves “gained control over Mr. Terpin’s accounts and stole nearly $24 million worth of cryptocurrency from him.”

Terpin sued AT&T, seeking at least $24 million in actual damage and millions more in punitive damages. Terpin also asked the court to void terms in AT&T’s customer agreement that disclaim liability for security problems—even in cases of negligence by AT&T. Terpin argued that these boilerplate terms are unconscionable because customers never have an opportunity to negotiate them.

But AT&T asked the judge to dismiss the case, arguing that Terpin didn’t adequately explain how the phone hack led to the loss of his cryptocurrency. Terpin’s lawsuit provided no details about how Terpin had stored his cryptocurrency, how the hackers had gained access to it, or if they might have been able to carry out a similar attack without control of Terpin’s phone number. In any event, AT&T argued that it shouldn’t be held responsible for the misconduct of the hackers who actually carried out the theft of cryptocurrency.

A mixed ruling

On Thursday, Judge Otis Wright—a man we once depicted as a hulking green giant preparing to smash the copyright trolls at Prenda Law—issued a ruling that provided some reason for each side to celebrate.

Wright agreed with AT&T that Terpin had not adequately explained how the hack of his account led to the theft of his cryptocurrency or why AT&T should bear responsibility. As a result, he dismissed claims that relied on Terpin’s claimed $24 million loss.

However, Wright dismissed the claims with “leave to amend,” meaning that Terpin has 21 days to file a new version of his lawsuit that more fully explains how the cryptocurrency was stolen and why AT&T should be held responsible.

At the same time, Wright allowed the case to move forward with Terpin’s arguments against AT&T’s one-sided customer agreement. Wright hasn’t yet voided the terms, but he found Terpin’s arguments on the issue plausible enough to let the case continue.

“We are pleased the court dismissed most of the claims,” AT&T said in an emailed statement. “The plaintiff will have the opportunity to re-plead but we will continue to vigorously contest his claims.”

This kind of phone hacking incident is of particular concern in the cryptocurrency world because of the non-reversibility of most virtual currencies. If a hacker steals funds from a conventional bank account, a fast-acting victim can usually get the transaction reversed and the funds restored. By contrast, if a hacker steals someone’s bitcoins, they’re likely to be gone permanently, since no one has the authority to cancel transactions once they’re committed to the blockchain.

As a result, cryptocurrency is much more of a “user beware” world than the conventional banking system. If you own a significant amount of cryptocurrency—and especially if you’re publicly known to have a significant amount of cryptocurrency—then it’s wise to store it in a way that doesn’t depend on the security of your phone number.

Tech firms “can and must” put backdoors in encryption, AG Barr says

by

Graffiti urging people to use Signal, a highly encrypted messaging app, is spray-painted on a wall during a protest on February 1, 2017 in Berkeley, California.

Enlarge / Graffiti urging people to use Signal, a highly encrypted messaging app, is spray-painted on a wall during a protest on February 1, 2017 in Berkeley, California.
Elijah Nouvelage | Getty Images

US Attorney General William Barr today launched a new front in the feds’ ongoing fight against consumer encryption, railing against the common security practice and lamenting the “victims” in its wake.

“The deployment of warrant-proof encryption is already imposing huge costs on society,” Barr claimed in remarks at a cybersecurity conference held at Fordham University Tuesday morning. Barr added that encryption “seriously degrades” law enforcement’s ability to “detect and prevent a crime before it occurs,” as well as making eventual investigation and prosecution of crime more difficult.

The existence of encryption means “converting the Internet and communications into a law-free zone” that criminals will happily take advantage of to do more crimes, Barr added, likening it to a neighborhood that local cops have abandoned.

The cost of encryption, he said, is measured in “victims” who might have been saved from crime if law enforcement had been able to lawfully intercept communications earlier.

He also accused tech firms of “dogmatic” posturing, saying lawful backdoor access “can be and must be” done, adding, “We are confident that there are technical solutions that will allow lawful access to encrypted data and communications by law enforcement, without materially weakening the security provided by encryption.”

A long-running battle

In his diatribe, Barr is only picking up where predecessors left off. In 2017, then-deputy AG Rod Rosenstein said in an interview that the tech community’s “absolutist position” on strong encryption impeded law enforcement and was “unreasonable.”

Federal law enforcement has been in a very public encryption face-off with consumer electronics companies, particularly Apple, since 2016.

In December, 2015, a gunman killed and seriously injured dozens of victims in an attack in San Bernardino, California. The FBI ended up in possession of the shooter’s iPhone during the investigation but was unable to unlock the device, as the attacker had been killed and therefore could not be compelled to share his PIN.

The FBI demanded Apple cooperate in unlocking the phone by building a backdoor, and the company effectively told the feds to go pound sand. (The FBI eventually accessed the phone without Apple’s help.)

The relationship between the FBI and companies such as Apple that promote encryption has remained frosty ever since. Last year, an FBI official called Apple “jerks” about encryption, accusing the company of an “evil genius” approach to thwarting law enforcement.

“Responsible” backdoors

Rosenstein proposed a so-called “responsible encryption” scheme back in 2017, a call Barr echoed.

“I am suggesting that it is well past time for some in the tech community to abandon the posture that a technical solution is not worth exploring and instead turn their considerable talent to developing products that will reconcile good cyber security to the imperative of public safety and national security,” Barr said.

FBI Director Christopher Wray said last year that developing a process for allowing government officials lawful entry into encrypted communications would “entail varying degrees of innovation by the industry,” but he said he didn’t “buy the claim that it’s impossible.”

But no matter how many times government officials try to will such an option into existence, what they claim to want isn’t actually possible. Security experts and product makers have said time and time again that introducing a backdoor—an access portal for a specific entity to gain access through—into an encryption scheme weakens the whole thing.

Apple CEO Tim Cook has repeatedly said consumer privacy is of paramount importance to his company and that it’s in “everyone’s best interest” for everyone to be “blocked out,” with no secret backdoors.

Senator Ron Wyden (D-Ore.) in a 2018 letter to Wray (PDF) said the quest for a way in to encrypted communications amounts to “a flawed policy that would harm America’s security, liberty, and our economy.”

“Building secure software is extremely difficult,” Wyden added, “and vulnerabilities are often introduced inadvertently in the design process. Eliminating these vulnerabilities is a mammoth task, and experts are unified in their opinion that introducing deliberate vulnerabilities would likely create catastrophic unintended consequences that could debilitate software functionality and security entirely.”