NSA And GCHQ ‘Covertly Plant Vulnerabilities In Internet Encryption’

The latest leaks from Edward Snowden have hinted US and UK intelligence have covertly implanted zero-day flaws in widely used security software and broken encryption used by the most popular websites and online services.

A 10-year NSA programme called Bullrun has involved “an aggressive, multi-pronged effort” to break Internet encryption, including SSL, which many companies like Google, Facebook and Twitter use to protect users’ communications with HTTPS. Banks and most e-commerce sites also use SSL, a method of encryption proven to have been flawed numerous times in the past.

Thanks to a breakthrough in 2010, “vast amounts of encrypted internet data which have up till now been discarded are now exploitable,” a GCHQ document read.

Cracking modern web encryption

The NSA also “actively engages US and foreign IT industries to covertly influence and/or overtly leverage their commercial products’ designs”, whilst inserting “vulnerabilities into commercial encryption systems”, according to leaks to the Guardian.

The intelligence agencies are able to “leverage sensitive, cooperative relationships with specific industry partners” to sneak backdoors into software.

GCHQ, as part of its Edgehill programme, is hoping to have broken encryption used by 15 major Internet companies and 300 VPNs by 2015, the leaks suggested.

One internal document also suggested GCHQ was “responsible for identifying, recruiting and running covert agents in the global telecommunications industry”.

The fact that NSA and GCHQ are breaking encryption should come as no surprise. It has been the aim of intelligence agencies to do just that for years, the most famous operation being that of the Enigma during World War Two. They have also created encryption methods. GCHQ created what is now known as public key cryptography.

But targeting technology that businesses claim provides total security for the general public is a new paradigm, one that threatens the security and trust in the Internet.

“It has a long history, from Crypto AG (a Swiss crypto company that non-aligned countries used to source their government comsec kit) which turned out in the early 1990s to have been covertly owned by the NSA for forty years; to the attempts to declare all crypto research “born classified”; to the Clipper chip and key escrow; to tussles over export control,” Professor Ross Anderson, cryptography expert from the University of Cambridge, told TechWeekEurope.

“We thought we’d won the crypto wars, but they just went underground.

“The response to this can be partly an engineering one (creating hard-to-subvert tools, scrutinising standards more carefully) but it must be largely political. In the end it will have to involve something like a peace treaty. Killing people is easy, now we have drones and missiles and atom bombs and stuff, so we have agreements that governments and others don’t do it.

“Hacking computers is similarly easy and it’s not sensible to expect everyone to run military-grade defences any more than it’s reasonable for me to have to mount anti-aircraft missiles on the roof of my house.”

Shhh! Do our whistleblowers quiz, but keep it quiet…

Thomas Brewster

Tom Brewster is TechWeek Europe's Security Correspondent. He has also been named BT Information Security Journalist of the Year in 2012 and 2013.

View Comments

  • TIME TO DESTROY THE FILTHY AMERICANS

    I had posted a comment on an article titled “How to Oust Assad” in Foreign Affairs magazine. Someone using the handle “A Canned Ham” posted the following comment on my post:-

    -------START POST------
    “If you actually understood anything about the technology you are talking about, you'd understand how foolish you sound. You apparently don't even know what the word "microwave" means.

    Pro-Tip: the fact that something is electronic, does not automatically allow it to be controlled by "microwaves". “
    --------END POST--------

    To this I replied:-

    ---------START POST-------
    Fleck of filth, I have said nothing about anything electronic being "automatically" controllable by microwaves but things can be DESIGNED to be controllable by microwaves and anything electronic can be so designed. Old -fashioned landline telephones did not work in the microwave frequencies yet much of the time the telephone conversations they carried were at least part of the way carried on microwave circuits. I have written (IndianAirForcePilotsMurderDOTblogspotDOTcom ) that integrated circuit chips made in the United States have to provide for access to the National Security Agency which can control their operations by microwaves. Radar uses microwaves and radar can monitor various phenomena, such as density of the air though which they pass; there is nothing 'electronic' about the density of air except its ability to affect/modulate electromagnetic waves (microwaves are electromagnetic waves in a certain frequency range) passing through it. Variations in air density can be used and are routinely used by the National Security Agency for audio surveillance -- monitoring conversations anywhere even if there is nothing electronic or electrical anywhere in the vicinity. That is just a simple example. Radar can and does provide video images of remote objects and the National Security Agency also uses microwaves for video monitoring. Anything electronic or electrical has electromagnetic fields associated with it and the interaction of microwaves with them is two-way: microwaves can pick up the information in these electromagnetic fields and can transfer information sent over the microwaves to the electronic or electrical device. A stupid nigger like you (I know you are probably white but I use the term nigger to mean racially inferior as you are in comparison to me) should not venture to insult the world's greatest scientist. I have a degree in electrical engineering, two years of graduate work in electrical engineering and more higher education than anyone I knew on the Harvard University faculty. You are unfit even to be made into dog-food, unfit even to wipe my shoes with your tongue and as a filthy Untouchable, unfit to be allowed to walk on the same street I walk on.

    I repeat what I said in my original post:-

    DESTROY WASHINGTON & NEW YORK NOW

    Whenever I write about defending against the United States, the CIA, via RAW and similar entities in Pakistan, carries out terrorist attacks or border incidents to replace it with defence against Muslims, Pakistan or China.

    (Aug 17 ‘13) I have discussed how the United States can disable or explode India’s nuclear warheads while they are in storage, in transit, mounted on a missile or while the missile is in flight, by using microwave signals from satellites to control the electronic circuitry that triggers the warhead (just as microwave signals control the electronic circuitry in a cell phone to make the cell phone do whatever it does) and suggested measures to defend against it. The exploding of a torpedo while it was being loaded on an Indian submarine was done the same way, to make India switch from Russian to Western submarines just as over a thousand Indian air force aircraft have been crashed, most by microwave signals from satellites, with the participation of RAW which is a branch of the CIA. The publicity blitz about an American-built Super-Hercules landing in Ladakh to show China India’s “might” has the same purpose. IndianAirForcePilotsMurderDOTblogspotDOTcom .

    (Aug 21 ‘13) A question posted on my comment, under the name Hemanth Kumar, says:

    “If what you say is correct, how did they manage to target their microwaves toward a specific torpedo? Why didn't the other torpedo explode?”

    My answer: “Fleck of filth,

    It is like asking how do microwaves manage to make only one cell phone ring -- why don't all the cell phones in the area ring. In any case, while being loaded, only one torpedo at a time would have been exposed to the microwaves. But even if multiple objects are accessible, the microwaves can trigger one or more depending on need. These are digital circuits and the microwaves act by operating the circuits, not by their sheer energy as in a microwave oven. The microwave signals from a satellite can do a lot more than trigger the warhead. They can do anything those in control of the weapon ( in this case the Indian navy) can do and a lot more. Microwave signals from satellites can operate any computer, for example, and do anything the computer owner can do and a lot more.

    The above question is from an agency seeking intelligence -- it may be an Indian agency or some other -- and I have said above what I have already said at various times.”

    In fairness, the above question is not as stupid as what was said by a former head of the Southern Naval command of the Indian Navy in an article in the Hindu.

    By microwave signals from satellites, the United States can send Trojan viruses to the digital circuitry of a weapon (or any other military or civilian system) with which it can communicate from a command and control server and have the Trojan do various things to the warhead -- such as trigger the warhead -- at any point in time; the Trojan can be sent to the weapon at any point in the weapon’s life and used possibly years after it was sent to the weapon. The Indian torpedo that exploded may have been infected with the Trojan years earlier. That is not to say that a Trojan was used to explode this torpedo. Microwave signals can control a weapon in real time and leave no trace.

    The main point is that Indians turn a blind eye to any act of hostility or sabotage by the Americans and are committed to absolute slavery to their American masters. Attached to my press releases is a file of CIA Director Michael Hayden and former chairman of India’s Joint Intelligence Committee, K. Subrahmanyam, coming on line on August 9, 2008 and trying to recruit me for the CIA. This file has been attached to my press releases thousands of times -- and can be accessed, for example, via IndiasLegitimateRulerSatishChandraDOTblogspotDOTcom where I have shown that India‘s government is a proxy for the CIA -- but the pieces of dog-faeces that are India’s government and media firmly close their eyes to it and its implications. Any ‘investigation’ of the submarine explosion can only be a farce.

    (Aug 22 ‘13) In response to the above, Defence Minister Antony on August 22 ‘13 said sabotage was not ruled out (the Navy chief had earlier ruled it out since he knew that the United States had caused the explosions by microwaves from satellites) and said the sinking has “cast a shadow on the capability of the Navy to safeguard interest in the vast coastlines and maritime area especially in the emerging security scenario in the Indian Ocean Region and extended region” to justify having given the United States an air force base in Trivandrum as Foreign Policy magazine has disclosed on July 29 ‘13 in an article titled “U.S. deploying jets around Asia to keep China surrounded” which can be found by a Google search with the title; this was a principal reason for the United States causing the explosions and sinking the Indian submarine with the prior knowledge of the Indian government. India is being made a full-fledged colony of the United States -- Manmohan Singh is doing it in the economic field by letting the Americans take over India economically -- and everyone in the Indian government works for this goal. India has NO defences against the United States -- the Army and Air Force are just as worthless as the Navy -- and by suppressing me with 24-hour satellite surveillance for the past 36 years with the full participation, with tremendous gusto, of the Indians, the United States has made sure that India has no defence against it. (The nuclear weapons I have had India’s nuclear forces emplace in U.S. cities are worthless unless I am directly in control of them).

    (Aug 23 ‘13) Just as the December 16 ‘12 gang rape of a 23-year old young woman in New Delhi by 6 people in which her male friend was beaten and tied up was staged by RAW to divert attention from what I wrote about the Anglo-American rape of India to Indians raping Indians, as I said at the time and was followed by a flurry of highly publicized gang rape cases, the gang rape of a 22 year old young woman in Mumbai now by 5 people in which her male friend was beaten and tied up and 4 of the 5 accused are reportedly Muslim has been staged by RAW to divert attention from what I have written in the two paragraphs above about the Anglo-American rape of India to Indians/Muslims raping Indians. This time the victim was made a “photojournalist” to keep the media collaborating in the Anglo-American rape of India and keep their eyes closed as I said above they do to the implications of the CIA director with K. Subrahmanyam trying to recruit me for the CIA. A PTI report quotes Kapil Sibal, who is also Law & Justice minister, on this gang rape but no one has reported he sits at CIA-supplied terminals to participate in crimes against me and against India and is senior enough in CIA-RAW to have been among the planners of this gang rape meant to ‘neutralise’ my two paragraphs above this one. India has only one enemy -- the United States, only one rapist -- the United States; the fleck of filth Sushma Swaraj who works for the CIA demands death penalty for rapists but India should demand death penalty for the United States and flecks of filth of the media deserve the death penalty, not rape.

    (Aug 27, 2013) If India’s nuclear forces explode India’s nuclear warheads emplaced in Washington and New York during the American attack on Syria without acknowledging they did it, no one will know whether Russia, China, North Korea or Pakistan did it. If the U.S. does identify India as the source and wants to retaliate (against what?), there is the standing warning that additional U.S. cities will be destroyed in case of any retaliation. This is a great opportunity to destroy the enemy even if the U.S. does not attack Syria -- though any day is a great day for destroying the enemy United States and India need not wait for an “opportunity”.

    (Sep 2 ‘13) If it is France, not the United States, which attacks Syria, Washington and New York should be destroyed as during an attack by the United States; destroying the United States is for its crimes against India, not Syria, including the suppression of India’s legitimate ruler with the help of 24-hour satellite surveillance for the past 36 years. IndiasLegitimateRulerSatishChandraDOTblogspotDOTcom

    Satish Chandra
    --------END POST--------

    Satish Chandra

  • The dystopian fantasies of yesteryear are now a reality. We’ve allowed the coming of an age where the civil liberties our forefathers fought so hard for are being eroded by the day. Freedom of Press, Freedom of Speech and Freedom of Assembly are mere ghostly images of their original intent. We’ve woken up to an Orwellian Society of Fear where anyone is at the mercy of being labeled a terrorist for standing up for rights we took for granted just over a decade ago. Read about how we’re waging war against ourselves at http://dregstudiosart.blogspot.com/2011/09/living-in-society-of-fear-ten-years.html

Recent Posts

Google Consolidates DeepMind And AI Research Teams

AI push sees Alphabet's Google saying it will consolidate its AI teams in its Research…

11 hours ago

Apple Pulls WhatsApp, Threads From China App Store

Beijing orders Apple to pull Meta's WhatsApp and Threads from its Chinese App Store over…

14 hours ago

Intel Foundry Assembles Next Gen Chip Machine From ASML

Key milestone sees Intel Foundry assemble ASML's new “High NA EUV” lithography tool, to begin…

19 hours ago

Creating Deepfake Porn Without Consent To Become A Crime

People who create sexually explicit ‘deepfakes’ of adults will face prosecution under a new law…

2 days ago

Google Fires 28 Staff Over Israel Protest, Undertakes More Layoffs

Protest at cloud contract with Israel results in staff firings, in addition to layoffs of…

2 days ago