Google Search

Showing posts with label spies. Show all posts
Showing posts with label spies. Show all posts

Tuesday, May 20, 2014

Keeping secrets in a world of spies and mistrust

Revelations of the extent of government surveillance have thrown a spotlight on the security -- or lack thereof -- of our digital communications. Even today's encrypted data is vulnerable to technological progress. What privacy is ultimately possible? In the 27 March issue of Nature, the weekly international journal of science, researchers Artur Ekert and Renato Renner review what physics tells us about keeping our secrets secret.

In the history of secret communication, the most brilliant efforts of code-makers have been matched time and again by the ingenuity of code-breakers. Sometimes we can even see it coming. We already know that one of today's most widely used encryption systems, RSA, will become insecure once a quantum computer is built.

But that story need not go on forever. "Recent developments in quantum cryptography show that privacy is possible under stunningly weak assumptions about the freedom of action we have and the trustworthiness of the devices we use," says Ekert, Professor of Quantum Physics at the University of Oxford, UK, and Director of the Centre for Quantum Technologies at the National University of Singapore. He is also the Lee Kong Chian Centennial Professor at the National University of Singapore.

Over 20 years ago, Ekert and others independently proposed a way to use the quantum properties of particles of light to share a secret key for secure communication. The key is a random sequence of 1s and 0s, derived by making random choices about how to measure the particles (and some other steps), that is used to encrypt the message. In the Nature Perspective, he and Renner describe how quantum cryptography has since progressed to commercial prospect and into new theoretical territory.

Even though privacy is about randomness and trust, the most surprising recent finding is that we can communicate secretly even if we have very little trust in our cryptographic devices -- imagine that you buy them from your enemy -- and in our own abilities to make free choices -- imagine that your enemy is also manipulating you. Given access to certain types of correlations, be they of quantum origin or otherwise, and having a little bit of free will, we can protect ourselves. What's more, we can even protect ourselves against adversaries with superior technology that is unknown to us.

"As long as some of our choices are not completely predictable and therefore beyond the powers that be, we can keep our secrets secret," says Renner, Professor of Theoretical Physics at ETH Zurich, Switzerland. This arises from a mathematical discovery by Renner and his collaborator about 'randomness amplification': they found that a quantum trick can turn some types of slightly-random numbers into completely random numbers. Applied in cryptography, such methods can reinstate our abilities to make perfectly random choices and guarantee security even if we are partially manipulated.

"As well as there being exciting scientific developments in the past few years, the topic of cryptography has very much come out of the shadows. It's not just spooks talking about this stuff now," says Ekert, who has worked with and advised several companies and government agencies.

The semi-popular essay cites 68 works, from the writings of Edgar Allen Poe on cryptography in 1841, through the founding papers of quantum cryptography in 1984 and 1991, right up to a slew of results from 2013.

The authors conclude that "The days we stop worrying about untrustworthy or incompetent providers of cryptographic services may not be that far away."

Journal Reference:

Artur Ekert, Renato Renner. The ultimate physical limits of privacy. Nature, 2014; 507 (7493): 443 DOI: 10.1038/nature13132

View the original article here

Tuesday, April 23, 2013

US soldiers and spies to get handheld biometric scanners

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Face being scanned. Image from ShutterstockUS soldiers and spies will soon be able to scan people's eyes, faces, thumbs and voices, at a distance, using everyday, commercially available smartphones - a boon for both the battlefield and for government snooping.

The biometrics company AOptix announced on Wednesday that the Pentagon has awarded it, along with CACI International Inc, a $3 million research contract to develop AOptix's Smart Mobile Identity devices for the US Department of Defense.

As Wired reported, the end result after two years of planned development will be a hardware peripheral and software suite that turns a regular smartphone into a device that scans and transmits data at distances not possible for current scanning technology.

AOptix's hardware is a peripheral that wraps around a smartphone, boosting the phone's sensing capabilities so that it can record biometric data.

Face scanning from mobile device. Image source: AOptix

Unlike the device currently used to scan, upload and transmit biometric data to the US military's wartime databases - the Handheld Interagency Identity Detection System (HIIDE) - the AOptix device can be operated single-handedly and will be as simple to use as a user-friendly smartphone application.

According to Wired, this new gadget will be able to scan faces at up to two meters away, irises from one meter, and voice from within a typical distance from a phone. Thumbprints will still require scanning against the phone's glass face.

AOptix executive Joey Pritikin told Wired that the system will be able to capture an iris in bright sunlight, which is a challenge for current biometric devices.

It will also be able to snap photos of a face or eye as soon as the phone focuses, without the need for the user to click, swipe or press.

It's easy to see the benefit of biometrics to troops. As early as the war in Iraq, fingerprint and iris scanners have been used to hire and maintain workforces, protect military bases and monitor inmates at detention centers.

For surveillance, biometrics has been more of a mixed bag.

As it is, the use of biometrics at borders is already threatening the security of undercover spies (and terrorists, or anybody traveling under assumed identity for any reason).

Wired reported in April that, pre-9/11, deep-undercover CIA operatives could use and toss false passports "like hand wipes," picking up new, fraudulent passports at local CIA stations.

Biometrics and linked databases are making that impossible, Wired reports, quoting an ex-spook who says that simply crossing the border with a real identity and then picking up a fake one in-country to conduct covert operations is presenting risks:

"When you go to check into a hotel room for a meeting with an asset, or even rent a car to drive to the meeting - or hold the meeting in the car - many hotels and car rental agencies upload their customer data, including passport number, to immigration every day... Most countries are looking for visa overstays. But when you show up on the list as never having entered the country... it brings the police around to ask questions."

Wired notes that, particularly in "hostile" places such as Iran, where the interior ministry's computers are assumably hard-wired into airline passenger lists and hotel guest lists, the use of false passport and travel data is a dangerous gambit.

Of course, "hostile" is a relative term. There are many who view the current state of über surveillance in the US, for example, as invasive, at best, and contemptuous of civil liberties, at worst.

It's understandable that government intelligence groups such as the CIA or the MI6 would be concerned for the safety of their deep-undercover agents.

AOptix hasn't identified which specific arms of US military or intelligence are gearing up to use the new biometrics scanners.

NSABut as normal Jane Doe citizens, particularly in these surveillance-happy post-9/11 days, it's a little scary to imagine ever-easier biometric scanning in the hands of outfits such as, say, the US's National Security Agency, which already has an insatiable hunger for data.

That's evidenced by the Utah Data Center, the vast facility the NSA is constructing to intercept, decipher, analyze, and store pretty much everything we do and everything we say, whether our communications are dragged up from undersea cables of international, foreign and domestic networks or pinched from the sky as relayed by satellite.

Do we really want US intelligence outfits to be able to identify us via biometrics, at a distance, and squirrel our movements away in their mind-bogglingly expansive data warehouses?

We have no choice in the matter, between the creation of hummingbird drones and the upcoming handheld scanners.

Let's just hope that more countries don't follow Canada's example and ban masks at protests.

Follow @LisaVaas
Follow @NakedSecurity

Facial scan image from Shutterstock. Image of man scanning other man's face from AOptix.


View the original article here

Saturday, July 2, 2011

Hackers 'should fight cyber spies'

Britain faces losing its position at the leading edge of technology unless news ideas are developed to fight cyber attacks, according to the Institute for Security and Resilience Studies.

The group, based at University College London, says the government needs to develop more innovative ideas to tackle the problem rather than simply adopting a “sticking plaster” approach.

It follows high profile attacks on the Serious and Organised Crime Agency and attacks allegedly from “bedroom hackers” in Britain on the CIA and US Senate.

In a report to be published by the think-tank, chaired by Lord Reid, the former Defence Secretary, will say that without urgent action Britain could lose its position as a “location of choice for global technology corporations” and leave it reliant on systems based abroad over which it would have “little or no influence.”

Lord Reid said terrorism now had to be regarded in a “far deeper and wider strategic context” and added: "Cyberspace not only enhances the capacity to learn but also creates a target rich environment for the terrorist.”

He is writing to the Chancellor of the Exchequer, the Foreign Secretary and the Defence Secretary calling on them to establish a “Cyber-Resilience Task Force” to bring together their best brains in government, industry and academia.

The task force would look at how to train and recruit computer experts from outside the mainstream, including former hackers who want to help fight off attacks from Chinese and Russian spies and from organised criminal gangs.

It would seek to increase the number of professionals fighting cyber attacks by selecting, training, educating, and testing “competent individuals” for the public, private and academic sectors.

Another idea involves encouraging innovation through “Cyber Enterprise Zones” for entrepreneurs.

Ideas should be shared with other countries and “open source” applications to fight cyber crime should be shared with others in the field, the report says.

The task force would also advise the top-level National Security Council on the financial risks of new hacking techniques.

It would echo the role of the US Cyber Security Co-ordinator who has direct links with the Office of Management and Budget in the White House.

The think-tank, set up by Lord Reid in 2008, includes Baroness Manningham-Buller, the former head of MI5, Admiral Lord Boyce, the former Chief of the Defence Staff, and Michael Chertoff, former US Secretary of Homelands Security.

Cyber attacks are currently fought by the Office of Cyber Security and the Cyber Security Operations Centre based at GCHQ.

Last year the government announced a “transformative programme for cyber security,” including a £500m injection, as part of the National Security Strategy.


View the original article here