Microsoft helped the NSA bypass encryption, new Snowden leak reveals

http://rt.com/usa/microsoft-nsa-snowden-leak-971/

by psibi • 13 years ago

298 114 13 years ago

_b8r0• 13 years ago

The sad thing about all of this is that Microsoft were pretty much forced into this position (so we're told) by the authorities.

In the process these leaks have just destroyed pretty much any credibility Microsoft's online services had, which form large parts of their strategy (according to the recent Ballmer memo).

It also makes you wonder about the OS and other software they produce, which isn't a good place for MS to be in.

mtgx2• 13 years ago

On what legal grounds was Microsoft "forced" to provide access to unencrypted data before encryption (effectively nullifying the security that they promised to their customers)? So how were they forced? Legally? Illegally/blackmail?

CALEA seems to say that companies don't have to decrypt data for authorities. I guess it's very convenient that they give it to them before they encrypt it then:

http://paranoia.dubfire.net/2010/09/calea-and-encryption.htm...

And this seems to be a "team sport", and that implies willing collaboration, not being forced to do it. More like something "fun" they're doing together.

tzs2• 13 years ago

A company doesn't have to decrypt to meet their CALEA obligations. If CALEA is the sole legal authority for a particular communications interception, that would be the end of it. However, I've seen nothing that indicates that CALEA is the legal authority behind the NSA interceptions.

fnordfnordfnord2• 13 years ago

So how were they forced?

Well, we can't really know (they won't answer FOIA requests!). We can only make guesses.

Could be they were just asked. Western Union gave telegrams to the NSA just for the asking.

Some people would argue that Microsoft has enjoyed favorable treatment by the courts. Maybe there was a quid pro quo somewhere along the way.

NSA has strategically placed employees/agents in other companies. Why not Microsoft?

mikevm• 13 years ago

I'm not sure why you're picking on Microsoft. The credibility of pretty much every large US-based tech services company is probably destroyed. The fact that we only saw the big service providers (MS, Google, etc...) on those slides doesn't mean that the other companies are free from the hands of the NSA.

Do you think that the NSA has no access to Dropbox?

testing12341234• 13 years ago

I'm not sure why you're picking on Microsoft.

One of the key facets of the the Xbox One is the Kinect as an always on device. As another poster pointed out, Microsoft has been quick to answer the privacy related questions that have been asked about this situation with the claim that the system has been built with privacy as a focus. As such, the reliability of those claims in light of this new leak appears to be relevant.

For example, given a court order, would Microsoft be required to:

1.) Provide law enforcement with Kinect data. (everything from as simple as "there were two people in the room" to "here is a live stream of the room"

2.) Be bound by gag orders not allowing Microsoft to reveal the existence of item 1.

3.) Be forced/coerced/enticed to provide bulk "wiretapping" of Kinect data.

Additionally, there is the question of "expectation of privacy". Many of the current privacy laws are based on this concept. However, could the courts decide that there is no expectation of privacy when a video and audio recording device has been placed in a private area, with full knowledge of the owner, also with knowledge that the data will be sent to a third party?

While these items might seem fringe (and before these leaks, I may have agreed), the scope of the current leaks seems to imply that these questions should at least be considered (even if a person chooses ultimately to accept the risk).

brudgers3• 13 years ago

Enterprise relies on companies such as RedHat and Oracle to some extent in lieu of conducting code analysis and to certain types of security testing.

It would be rather surprising if they were not at least approached by Federal agencies such as NSA and FBI.

To put it another way, because Microsoft has a closed source model, the intelligence agencies took the approach described in the article. From that, it may be a mistake to conclude that the strategy pursued with Microsoft was the only strategy pursued. It just happens to be one that would pass across the desk of an analyst, rather than someone on the operations side.

Viewed as an intelligence operation, it would be grossly unprofessional of such agencies not to have placed moles within the open source community, or for those moles to be seen as highly skilled contributors on open source projects. The three letter agencies have decades of experience infiltrating both commercial organizations and those motivated by something other than money.

I suspect it is easier to turn an open source hacker than a diplomat - not just ideologically but because the open source community lacks a state funded organized counter-intelligence apperatus.

psbp• 13 years ago

Dropbox was listed as "coming soon"

JonFish85• 13 years ago

I think it's wrong to say Microsoft was "forced" into this. In a sense, they made their own bed. I have to believe that the majority of Microsoft's money is based off of serving governments and huge corporations (Windows + Office). It just makes sense that they'll want to keep those relationships.

Spooky23• 13 years ago

It's not in Microsoft's interest to function as defacto agents of the US government. They are compelled by law to do what the Feds want -- just like would would be if you we're providing a service.

Think about the impact of the NSA leaks on Microsoft's business. Globally, every customer or potential customer of Microsoft needs to ask whether they can trust Micrsoft as a business partner. Not a good place to be on for a software company transitioning to a cloud services company.

flyinRyan10• 13 years ago

Good. Big companies are the only thing in the US with even the remotest of hopes of stopping or slowing this down. And they're not going to bother unless it's actually costing them money.

So I hope it hurts them, I hope it makes them and all the other companies bleed until they do something.

nr0mx• 13 years ago

Puts this in an entirely different light, doesn't it:

Even when ostensibly not functioning, the Xbox One can run in a low-powered state, ready to be snapped on at a moment's notice. That's something Microsoft was showing off last week as an asset. The only on-switch Microsoft showed for waking the machine from its low-power state was a voice command... "Xbox On." The Xbox One could only hear that if the Kinect was already, always listening. The idea that the Kinect might always be listening got people reaching for their tin foil or vowing to not let an Xbox One into their home.

Microsoft is now seeking to calm concerns that the new Kinect might spy. "We are designing the new Kinect with simple, easy methods to customize privacy settings, provide clear notifications and meaningful privacy choices for how data will be used, stored and shared," the Microsoft rep told me.

"We know our customers want and expect strong privacy protections to be built into our products, devices and services, and for companies to be responsible stewards of their data. Microsoft has more than ten years of experience making privacy a top priority. Kinect for Xbox 360 was designed and built with strong privacy protections in place and the new Kinect will continue this commitment. We’ll share more details later."

http://kotaku.com/xbox-ones-kinect-can-turn-off-microsoft-sa...

Not sure I'd want the Xbox One in my house after this fiasco.

seferphier• 13 years ago

I agree. sadly, i doubt that many people would care about privacy concerns.

eliasmacpherson• 13 years ago

an always on microphone, with fixed hardware and software, phoning home at regular intervals has a big target sign painted on it.

kabdib• 13 years ago

Since the Xbox camera is connected to the console via a cable, you can verify whether data going over the wire. If the Xbox is off, you shouldn't see traffic. It's a /bunch/ different from traffic in a data center, which is essentially untraceable and can be cloned at many points.

Frankly I'd be more concerned about the microphones contained in ubiquitous and nearly unexaminable devices such as cell phones, and to a lesser degree laptops. (I imagine that many laptop mics are USB devices, so their traffic should be visible to drivers, the drawback being that once the traffic is on the mainboard, where it goes is less traceable).

RexRollman2• 13 years ago

I would expect, if this was even possible, that it wouldn't be turned on by default but only when requested. Otherwise, it would be too east to catch for the reasons you mention.

sharpneli• 13 years ago

In addition to what was stated by RexRollman it can easily store video/audio to be sent only at the next start of the xbox. "Downloading update" or "Syncing savegames" and no-one is going to notice the encrypted few megabytes of MP3 compressed audio.

mtgx2• 13 years ago

They wouldn't need to listen all the time, and how would you know when it's the right time to look? And even then most people won't be able to verify.

blhack2• 13 years ago

Not quite. You activate the xbox using a voice command. Unless the kinect has a speech processor in it (which is incredibly unlikely), then it is very probably sending the sound to the xbox.

So you will [again, this is speculation] be seeing constant traffic flowing across the USB cable.

cabalamat• 13 years ago

We are designing the new Kinect with simple, easy methods to customize privacy settings, provide clear notifications and meaningful privacy choices

    Do you want your information to be given to the NSA?
    [ ] Yes
    [X] Yes

brudgers3• 13 years ago

Answer "Yes" to send information to the NSA or "No" if you have something to hide.

rimantas2• 13 years ago

No no. It is like this:

  Do you agree that your information will given to the NSA?
    [ ] Yes, I agree
    [X] No, I don't mind.

mikeash• 13 years ago

Easy workaround would be to put it on a power strip or similar, and just switch it hard off whenever you're not using it. No amount of cleverness is going to make it able to spy on you without electricity (assuming any battery would be rapidly spotted by teardowns). As a bonus, you'll save a little electricity too.

Not that we should have to do this....

bitdestroyer• 13 years ago

In addition to that, you can purchase smart power strips that detect the drop/increase in power on one plug and turn off/on the other plugs.

I've been using one of these for several years now for our entertainment center. You just have to be sure you turn off any devices you don't want the power hard cut from before you turn off the television.

sixothree• 13 years ago

It's almost as if the device was designed with surveillance in mind.

DrCybrex• 13 years ago

Someone definitely had the telescreen in mind over there. Scary.

fnordfnordfnord2• 13 years ago

It was, targeted advertising, or at least that's the excuse.

http://consumerist.com/2013/07/08/the-xbox-one-will-use-kine...

http://bgr.com/2012/06/12/microsoft-xbox-kinect-targeted-adv...

brudgers3• 13 years ago

The photons look about the same to me. At the other end of the data hose, someone is using information about me for their benefit. Governments are one form of enterprise by which individuals may strive to accumulate and express power, corporations are another.

I am ambivalent in regards to ranking one over the other because I cannot file a FOI request with Microsoft or Google or Apple or HP or Yahoo, etc.

Microsoft just makes great headlines, particularly in the tech community where people such as myself, who very likely never planned on purchasing an Xbox One can express outrage over its design. I thought the architecture was crap from the beginning.

Peaker• 13 years ago

The threat is to democracy. If corporations violate your privacy, democracy is not in serious danger.

If the government does, democracy is.

sanderjd• 13 years ago

On the bright side, the government might actually start taking the NSA concerns seriously if it starts having a detectable effect on the profitability of one of the country's most important growth industries. It seems like it's already becoming a reality in terms of foreign markets, but a reasonably large domestic boycott of a marquee next generation console would be bigger.

flyinRyan10• 13 years ago

This is probably the most important point in the whole thread. Honestly, the debate about whether the new X-box will spy on you or not is irrelevant. In fact, it would be even better if there were a massive boycott and Microsoft weren't even guilty. They'd be in the position of knowing it isn't true and having no way to prove it. I'm sure they'd have a very large interest in getting things like PRISM shut down at that point.

geuis2• 13 years ago

It's a low level, hardware only capability. It'll even work when the Xbox isnt connected to the internet. You're making an unfounded statement that simply because the XO can listen for an "on" command while hibernating that it's being used to listen and transmit everything it sees and hears. This is explicitly not true and again, just your personal unfounded fear-mongering assertion.

drgath• 13 years ago

He never said it -does- transit data, and is just implying that it -can-.

flyinRyan10• 13 years ago

How can you call it a "fear-mongering assertion" given everything that's been revealed recently? It's certainly well within the realm of possibility even if some might find it unlikely.

bernardom• 13 years ago

Holy cow. I can just imagine having one for the kids, then trying to avoid talking about anything important in the living room, then...

It's a telescreen. (http://en.wikipedia.org/wiki/Telescreen)

Ygg2• 13 years ago

Welcome to Brave New 1984.

avn2109• 13 years ago

This is exactly, literally the device imagined by Orwell in 1984, which he called a telescreen.

kirualex• 13 years ago

Well that puts their whole "We don't exploit your data like Google do" into perspective.

maaaats• 13 years ago

Does it? This isn't Microsoft exploiting data for their own benefit, not comparable. (Not that I like MS sharing the data)

Amadou• 13 years ago

"Our data abuses are better than Google's!" Innovation at work.

insuffi2• 13 years ago

I find it interesting that no USA-based news source is covering this.

tzs2• 13 years ago

Among US-based news sources covering this: The New York Times, NBC News, New York Daily News, CBS News, NPR, Chicago Tribune, ABC.

insuffi2• 13 years ago

Huh.

My apologies, for some reason the only sites google showed on this issue were .co.uk.

anaptdemise• 13 years ago

It isn't on their front page...

xedarius• 13 years ago

Then I start thinking about when Microsoft were being dragged through the competition and monopolies commission in the US, was this the US Government showing Microsoft what would happen if they didn't cooperate.

Sharlin• 13 years ago

A half-serious conspiracy theory: The feds "encouraged" Microsoft to acquire Skype so as to obtain decrypted access to the communications.

mafribe• 13 years ago

Skype belonged to EBay before. But I agree, acquiring a global communication provider like Skype makes a lot of sense form a snooper's point of view.

walls2• 13 years ago

It happened before MS acquired them.

http://www.networkworld.com/community/blog/project-chess-hel...

RexRollman2• 13 years ago

This whole thing makes me very suspicious of Apple's and Microsoft's whole disk encryption technologies. I can't help but wonder if back doors have been inserted into the products.

Osmium4• 13 years ago

Not impossible, but some smart people have been looking, at least for Apple's FileVault 2:

http://www.schneier.com/blog/archives/2012/08/an_analysis_of...

Paper here:

http://eprint.iacr.org/2012/374.pdf

Currently, there seem to be three vectors:

1) Weak passwords

2) If you opt-in to store a recovery key with Apple

3) If attacker has physical access to machine, and machine is powered on (direct memory access via Thunderbolt or Firewire) (Edit: seems like this is not the case, see below)

But no backdoor has been found (yet!)

dmix3• 13 years ago

3) If attacker has physical access to machine, and machine is powered on (direct memory access via Thunderbolt or Firewire)

I'm curious if this could be addressed with software protections somehow? Something that triggers memory wipes and automatic shutdowns?

gecko• 13 years ago

    3) If attacker has physical access to machine, and
       machine is powered on (direct memory access via
       Thunderbolt or Firewire)

This may have changed, but turning on FileVault used to disable DMA in many situations (laptop had been suspended being a key one) until the user logged back in. Not that this isn't a vector, but it's actually a very narrow one; you basically need the person to already be logged in at the time you want to steal the keys.

andrewgleave• 13 years ago

Take a look at Alex Ionescu's "Ninja's and Harry Potter" talk from NoSuchCon this year [1].

He specifically mentions he could access the FileVault key of a machine by having physical access, and discovered two secret keys (KPPW and KPST) one of which is enabled when the input buffer is "SpecialisRevelio" [2].

It's a very interesting deck to read through.

[1] http://www.nosuchcon.org/talks/D1_02_Alex_Ninjas_and_Harry_P... [2] http://harrypotter.wikia.com/wiki/Specialis_Revelio

blhack2• 13 years ago

Why not just a backdoor in the OS? I mean...if we're seriously considering that apple would put a backdoor into FileVault, why not just put one in the OS proper?

FileVault could be some hypothetical magic uncrackable encryption with a keyspace bigger than the known universe...and it would never matter if there was a backdoor in the OS.

codev• 13 years ago

Of course there are back doors, like the well known NSAKEY one [1] in Windows. Apple also seem to have backdoors into encryption on both Mac and iOS [2].

If you want your data to be reasonably secure against someone who casually steals it then they're fine but if you want to be secure against government employees, or even well connected corporations, then Apple & Microsoft solutions are not very useful.

[1] https://en.wikipedia.org/wiki/NSAKEY [2] http://news.cnet.com/8301-13578_3-57583843-38/apple-deluged-...

Osmium4• 13 years ago

Regarding [2], it's not clear yet what Apple does here: it looks like they bruteforce the iPhones when requested by the relevant authorities (possibly using a custom bootrom) and specifically not via a backdoor. If there was a backdoor, presumably Apple wouldn't have a backlog of requests[3]. Though no one really knows, and presumably it's always possible Apple will intentionally compromise their security in future if they get tired of having to bruteforce all these phones.

[3] http://www.informationweek.com/security/encryption/apple-iph...

kybernetyk• 13 years ago

The best part is when OS X asks you if you want to store the encryption 'recovery key' on Apple's servers ...

nthj• 13 years ago

1) That's probably a perfectly reasonable option for my grandma. *

2) It provides Apple a fallback when some idiot loses 6 figures worth of IP. “We understand sir, you see, if you had chosen to backup your recovery key with us we would be able to help you”

* or would be, if the NSA wasn't spying on everything.

9h1d9j809s• 13 years ago

This is fine, since you have the option to decide. For most people it's okay to store the key on Apples servers. You are still protected if your computer is lost/stolen, for example.

And if you want to be safe from the government, just select "No".

MacsHeadroom• 13 years ago

Microsoft has a free program (for Law Enforcement) called COFFEE which, among other things, bypasses Bitlocker full-disk encryption.

You can find the Torrent at Wikileaks: https://wikileaks.org/wiki/Microsoft_COFEE_%28Computer_Onlin...

nivla• 13 years ago

I have come across COFFEE before, its just a forensic tool. It doesn't do anything more than what 3rd party tools can do. It looks like a toolkit put together for investigators. Do you have any source to support that it can decrypt/bypass Bitlocker encryption? I couldn't find any information online.

[1] https://en.wikipedia.org/wiki/Computer_Online_Forensic_Evide...

rca• 13 years ago

This reminds me about something one of my teacher (a very stallman-like guy in his views) told us about encase. It's an (apparently) fairly common suite of tools used by law enforcement agencies around the world for forensic analysis. In the description of their decryption module (http://www.guidancesoftware.com/encase-forensic.htm#tab=2) they claim to be able to decrypt quite a few whole-disk encryption schemes. Now it's hard to imagine that they would put an outright lie on their website but there could be several explanations for that. I think the consensus among the students was that they were exaggerating quite a bit, and were only capable to do it upon some specific circumstances (weak passwords, setup errors, various cryptographic edge cases, etc). However the other obvious explanation was that some kind of backdoors were built among those schemes (you can notice the absence of common open source stuff like luks or truecrypt in the list) and that there's accords between some vendors and governmental agencies (via this software) to allow for access into their encryption schemes. I was fairly skeptical back then, but now I'm not so sure... There might be a combination of the two explanations. Someone well-versed into cryptography might be able to tell if some of those products have well-known vulnerabilities.

Edit : the site seems to have some difficulties, here's the google cache http://webcache.googleusercontent.com/search?q=cache:JZEtYXR... The description of the decryption suite is in the module tab.

FridayWithJohn2• 13 years ago

Yet another reason to stick to open source.

rimantas2• 13 years ago

Ok, I have full open-source stack and run a cloud service on it. I also give NSA full access to my servers. How does open-source helps there?

hypercube• 13 years ago

Why does the NSA have full access to your servers? Even if they manually wiretap your server it would require manual intervention, and is thus a good protection against blanket surveillance.

FridayWithJohn2• 13 years ago

You're missing the point completely. You would at least know when someone is "poking around your data".

By law they would have to get a warrant... ie: actually obtain some real proof that you are up to no good. A lot better than this current blanket case scenario.

flyinRyan10• 13 years ago

That's nothing more than the illusion of security. Nearly anyone using open source is using a distro. Do you imagine distro maintainers would willingly go to jail rather than putting in backdoors in the binaries they release?

pavs• 13 years ago

I feel so stupid and so ashamed of myself for all the time I have thought of everything Richard Stallman had to say about privacy and security concern as a "neck-beard, tin-foil hat, nutjob".

He was right all along, it was us who didn't care enough to understand what he was saying and its importance.

ds9• 13 years ago

No need to feel bad, I used to get a lot of snarking for being a Stallman fan.

It is a basic principle of security to assume that any power an adversary has, will be used against one's interests. People misunderstand this; I have seen it called a fallacy. But it's not a claim that it's always true, rather that it's what one must assume in order to have the best practicable assurance of security /privacy.

I also used to get arguments like "MS/GOogle/$_BIG_TECH_CO wouldn't use their power against customers, it would be bad for business" or "...it would be illegal" or similar. The correct answer is that prudence dictates assuming the worst. Well, maybe I was too cynical, but it's hard to keep up with how bad things really are.

easytiger• 13 years ago

He was was some might call an extremist in his views. It is slowly becoming common sense. I guess that's why we see him as a visionary. He discarded many chances at fortunes to do what he believed to be right.

Not many like that left. I know I sold out already.

SonicSoul4• 13 years ago

going to try for devil's advocate angle.

could there be a case where the parties in a conversation are legitimate suspects? in such a case, why does it matter if it's Microsoft or some other private company that the NSA hires to break encryption?

it seems that the article is presenting the Microsoft / NSA relationship, and later states “If you look at what happened when Bush, Cheney and General Hayden – who was head of the NSA at the time – deliberately violated the law to eavesdrop on Americans without a warrant" which hints at a vague conclusion that Microsoft is helping to spy on citizens without a warrant.

possibly i missed something, so is the point that Microsoft (or any private company) should not do any work for NSA, or that it should not do it without a warrant, or that we can't trust it with anything because it did some work for the NSA? Or is that the details are still not disclosed so it's pure speculation?

fetbaffe4• 13 years ago

It is important for me as a customer of Microsoft. This means I will end all future contracts with them, because I'm not a US citizen.

NSA needs no warrant to wiretap me as a European and I'm not going to send my money to Microsoft so they can use that money to help a foreign government agency , that I or any of my fellow citizens have no oversight over, to spy on me.

That would be totally absurd.

tootie4• 13 years ago

Of course. If you are a legitimate suspect, any local police department can get a warrant to go inside your house and put your underpants in plastic bags and take them away. For that matter, they can cuff you and put you in jail. The question is what is the NSA doing without a warrant or rubber-stamped, secret, blanket warrants.

SonicSoul4• 13 years ago

correct. i'm just having a hard time with the point (or lack there of) in this post.. as far as i can tell it's something like: NSA = PRISM, therefore any company doing work for NSA = evil.

flyinRyan10• 13 years ago

could there be a case where the parties in a conversation are legitimate suspects?

It doesn't matter if they are. No one expects coffee shops to put microphones at every table on the off chance that a terrorist plot is planned there (how many mob hits could have been prevented back in the day).

We shouldn't accept the government listening in on digital communication just because it's easy.

SonicSoul4• 13 years ago

are you saying Microsoft helped to wiretap email?

Arnor• 13 years ago

"It's hard to square Microsoft's secret collaboration with the NSA with its high-profile efforts to compete on privacy with Google."

I think it squares quite nicely. Set your standards low enough...

peteri• 13 years ago

Sorry this is news folks? Really? See this from 2011/12

from http://www.infolaw.co.uk/newsletter/2012/01/microsoft-office...

However, the Patriot Act, introduced to protect US national security, can require that any US company (wherever data is held) must disclose data on demand to the US Government without the knowledge of the owner of the data, which is contrary to the UK Data Protection Act. Microsoft has been up-front in acknowledging that they cannot give that guarantee and this applies to data held in all their hosted solutions. As a result, in December 2011, BAE ditched plans to adopt Office365 because Microsoft could not guarantee the company’s data would not leave Europe, in spite of operating a data centre in Dublin.

tootie4• 13 years ago

What do they mean by bypass encryption? If I use outlook.com (or gmail.com or whatever) over https, then it's encrypted over the wire, but it's obviously decrypted on their servers. It's the only way that search could work. I assume if you are PGP encrypting your messages or something equivalent, it's still unbreakable.

herf• 13 years ago

https://en.wikipedia.org/wiki/Telescreen

geuis2• 13 years ago

Maybe I'm missing the source, but where's the source? These people keep writing stories about what's being revealed and "according to secret documents" this and that is shown. So where are these leaked documents?

If these media outlets are holding on to them to dribble and drab them out to make a buck, there's a huge problem with that. Everything should be out on a torrent or wikileaks for all to see.

Microsoft helped the NSA bypass encryption, new Snowden leak reveals

Related Stories