Google Search

Showing posts with label secrets. Show all posts
Showing posts with label secrets. Show all posts

Tuesday, May 20, 2014

Keeping secrets in a world of spies and mistrust

Revelations of the extent of government surveillance have thrown a spotlight on the security -- or lack thereof -- of our digital communications. Even today's encrypted data is vulnerable to technological progress. What privacy is ultimately possible? In the 27 March issue of Nature, the weekly international journal of science, researchers Artur Ekert and Renato Renner review what physics tells us about keeping our secrets secret.

In the history of secret communication, the most brilliant efforts of code-makers have been matched time and again by the ingenuity of code-breakers. Sometimes we can even see it coming. We already know that one of today's most widely used encryption systems, RSA, will become insecure once a quantum computer is built.

But that story need not go on forever. "Recent developments in quantum cryptography show that privacy is possible under stunningly weak assumptions about the freedom of action we have and the trustworthiness of the devices we use," says Ekert, Professor of Quantum Physics at the University of Oxford, UK, and Director of the Centre for Quantum Technologies at the National University of Singapore. He is also the Lee Kong Chian Centennial Professor at the National University of Singapore.

Over 20 years ago, Ekert and others independently proposed a way to use the quantum properties of particles of light to share a secret key for secure communication. The key is a random sequence of 1s and 0s, derived by making random choices about how to measure the particles (and some other steps), that is used to encrypt the message. In the Nature Perspective, he and Renner describe how quantum cryptography has since progressed to commercial prospect and into new theoretical territory.

Even though privacy is about randomness and trust, the most surprising recent finding is that we can communicate secretly even if we have very little trust in our cryptographic devices -- imagine that you buy them from your enemy -- and in our own abilities to make free choices -- imagine that your enemy is also manipulating you. Given access to certain types of correlations, be they of quantum origin or otherwise, and having a little bit of free will, we can protect ourselves. What's more, we can even protect ourselves against adversaries with superior technology that is unknown to us.

"As long as some of our choices are not completely predictable and therefore beyond the powers that be, we can keep our secrets secret," says Renner, Professor of Theoretical Physics at ETH Zurich, Switzerland. This arises from a mathematical discovery by Renner and his collaborator about 'randomness amplification': they found that a quantum trick can turn some types of slightly-random numbers into completely random numbers. Applied in cryptography, such methods can reinstate our abilities to make perfectly random choices and guarantee security even if we are partially manipulated.

"As well as there being exciting scientific developments in the past few years, the topic of cryptography has very much come out of the shadows. It's not just spooks talking about this stuff now," says Ekert, who has worked with and advised several companies and government agencies.

The semi-popular essay cites 68 works, from the writings of Edgar Allen Poe on cryptography in 1841, through the founding papers of quantum cryptography in 1984 and 1991, right up to a slew of results from 2013.

The authors conclude that "The days we stop worrying about untrustworthy or incompetent providers of cryptographic services may not be that far away."

Journal Reference:

Artur Ekert, Renato Renner. The ultimate physical limits of privacy. Nature, 2014; 507 (7493): 443 DOI: 10.1038/nature13132

View the original article here

Monday, June 10, 2013

Many Amazon S3 cloud storage users are exposing sensitive company secrets, claims report

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Leaky bucket. Image from ShutterstockApproximately one in six buckets Amazon S3 storage buckets (of the 12,328 identified) are leaking sensitive data and company secrets, claims a new report.

Amazon Simple Storage Service (S3) is a web services interface for storing and retrieving static data from Amazon's cloud that gives developers a way to store and access, for example, server backups, company documents, web logs, and publicly visible content, including images and PDFs.

Such content is organized into "buckets", accessible at predictable URLs.

Here's the type of bucket information to which any interested party (or e-scumbag prone to network attack or black market vending) has free and open access if users have set the buckets to public access, according to Rapid7 Senior Security Consultant Will Vandevanter:

Personal photos from a medium-sized social media serviceSales records and account information for a large car dealershipAffiliate tracking data, click-through rates, and account information for an ad company’s clientsEmployee personal information and member lists across various spreadsheetsUnprotected database backups containing site data and encrypted passwordsVideo game source code and development tools for a mobile gaming firmPHP source code including configuration files, which contain usernames and passwordsSales “battlecards” for a large software vendor

Rapid7 Senior Security Consultant Will Vandevanter

Those are just some of the materials that Vandevanter, assisted by HD Moore and inspired by Robin Wood, gathered from 1,951 buckets they found open to public scrutiny.

The sheer number of files made it unrealistic to test the permissions of every single object, so a random sampling was taken instead. All told, we reviewed over 40,000 publicly visible files, many of which contained sensitive data.

Roughly, that's about one in six buckets that have been "left open for the perusal of anyone that's interested," he says.

Defining the security risks, Vandevanter says, is a no-brainer:

A list of files and the files themselves - if available for download - can reveal sensitive information. The worst case scenario is that a bucket has been marked as 'public', exposes a list of sensitive files, and no access controls have been placed on those files.

In situations where the bucket is public, but the files are locked down, sensitive information can still be exposed through the file names themselves, such as the names of customers or how frequently a particular application is backed up.

This isn't Amazon's fault, mind you. Amazon S3 buckets' default setting is private. Buckets set to "public" will list all files and directories to anybody who asks.

By default, buckets will have one of two predictable, publicly accessible URLs, Vandevanter says.

Using the two URL syntaxes he provides, users will either be denied access by a private bucket, or they'll be peering into the first 1,000 objects stored in a public bucket.

As for remedies, this one is straightforward, Vandevanter writes: "Check your buckets. If they're open, determine whether the content is something you don't mind exposing."

If your content should be kept private, check out Amazon's tutorial on how to lock it down.

Unfortunately, making a bucket private now doesn't extend to bucket versions stored away in Google indexing.

Time machine. Image from Shutterstock

Vandevanter recommends the Internet WayBackMachine to find previously open buckets. Also, he used a modified version of @mubix’s Metasploit module to find "a few hundred" currently private buckets that were previously open.

Here are Amazon's instructions on how to manage access control lists for objects in buckets.

Amazon, clearly, isn't at fault, as Vandevanter points out. The company has set the buckets to private by default, and it's published plenty of resources to instruct users on how to keep data safe.

A spirited discussion on Slashdot questions a) whether Vandevanter is vulnerable to prosecution over the classic security technique of testing doorknobs to see which are open and b) whether this is news at all, rather than a case of RTFM (Caution: Link may be NSFW).

In my opinion, a) let's hope not; enough already with the overzealous prosecutions of hackers a la Weev and Schwartz, et al. and b) that sounds about right.

Follow @LisaVaas
Follow @NakedSecurity

Will Vandevanter whiteboard image courtesy of Rapid7.
Leaky bucket and time machine images from Shutterstock.


View the original article here