The macosxhints Forums

The macosxhints Forums (http://hintsforums.macworld.com/index.php)
-   The Coat Room (http://hintsforums.macworld.com/forumdisplay.php?f=8)
-   -   Can mac users be spied on using PROMIS software? (http://hintsforums.macworld.com/showthread.php?t=84623)

macuserhere 01-20-2008 10:29 PM

Ben-Menashe is not a complete liar. I don't see it as black and white. Many of his claims have checked out: see Vanunu, Maxwell, Iran-Contra etc.

Anyway this is turning into a political argument which it wasn't intended to be ... I just wanted to know how secure the computer system is for macs. It looks like it's a case of backing the data up and being aware that anyone can spy on your computer if you use the internet.

And I believe man landed on the moon :)

fazstp 01-20-2008 10:52 PM

oops, what happened? Sorry wrong thread for some reason.

ArcticStones 01-21-2008 05:39 AM

.
As I recall, the NSA has publicly posted a number of excellent guidelines to system security. (You’re welcome to search and download those.)

I do not have an inbred trust of government agencies, particularly those dealing in the intelligence field. However, in this instance I am actually inclined to believe that the NSA’s involvement is benevolent.

Why? A vast number of American companies are, in one way or another, involved as providers to the military sector. The NSA has a vested interest in keeping those systems secure.

Which means closing, rather than opening, back doors.

What ThreeDee writes seems to confirm that.

-- ArcticStones
.

Mikey-San 01-21-2008 06:41 AM

Quote:

written in the cryptic language "C"
This is the stupidest thing I have read in weeks, period.

I won't get into the NSA debate, since that's all over the Internet, but C is not some kind of impenetrable cryptic construct. Typical conspiracy theorist stuff, taking one or two pieces of disturbing truth and then freaking out like a defective toy robot.

I'd love to see the inside of this guy's apartment. I wonder how many deadbolts are on his door.

http://content.imagesocket.com/image...oil_hat2a8.jpg

ArcticStones 01-21-2008 06:49 AM

.
Macuserhere, one little matter of protocol: Unless these articles are public domain, they should not be quoted at such length. Rather, copyright material should be linked to, summarised, and/or quoted briefly.

:) ArcticStones

macuserhere 01-21-2008 08:42 AM

Quote:

Originally Posted by ArcticStones (Post 444164)
.
As I recall, the NSA has publicly posted a number of excellent guidelines to system security. (You’re welcome to search and download those.)

I do not have an inbred trust of government agencies, particularly those dealing in the intelligence field. However, in this instance I am actually inclined to believe that the NSA’s involvement is benevolent.

Why? A vast number of American companies are, in one way or another, involved as providers to the military sector. The NSA has a vested interest in keeping those systems secure.

Which means closing, rather than opening, back doors.

What ThreeDee writes seems to confirm that.

-- ArcticStones
.

I don't agree. I think the NSA is spying on us and the NSA in turn are being spied on. I also think NSA is aware of this and for political reasons doesn't do anything about it. As I've said it's mostly a matter of politics what you believe. Suffice it to say, I've read all these articles by this guy, Myers, pertaining to this, plus articles by others about PROMIS (Bollyn is one author), and because they all agree with each other on the basics, I tend to agree with them. I think that inaccuracies such as C+ being a complex language or not* really doesn't change the substance of the theories in the main article, and dwelling on them and pointing them out as the basis of one's skepticism is like looking at the speck of sand in a bucket of pebbles and saying the presence of sand disproves the bucket is full of pebbles.

And I guess that people with the ability to know whether macs can be spied on, mainly experts who work for Apple, would not divulge this for obvious reasons. They want to protect the company and not reveal things that would make its customers lose confidence in their product (although we don't have much choice anyway, and also Apple may not have had a choice either). Anyway, I just threw that out there as I thought it might spark some interesting discussion by Apple 'insiders' who could give details about the security of macs or how to make them more secure and clear up that ambiguity about macs in the last part of the article in the OP. But it seems to have sparked off more of a political debate than a technological debate so perhaps I was better off posting this in a technologically-minded conspiracy forum in the first place.

* And Linux being open source (more eyes can pick up anomalies than fewer ones can) does make it less likely for the software to have been compromised. That makes me have faith in that system although I wouldn't have a clue as to how to operate that software.
Quote:

We don't know where the constants came from in the first place. We only know that whoever came up with them could have the key to this backdoor. And we know there's no way for NIST -- or anyone else -- to prove otherwise.

This is scary stuff indeed ...more....
.

Craig R. Arko 01-21-2008 09:25 AM

There is always paper and pencil. ;)

macuserhere 01-21-2008 10:13 AM

Or use Linux and keep clear of the random-number generator Dual_EC-DRBG.

Backdoor to Vista

Quote:

Schneier on Security

A blog covering security and security technology.

« Friday Squid Blogging:
December 17, 2007
Dual_EC_DRBG Added to Windows Vista

Microsoft has added the random-number generator Dual_EC-DRBG to Windows Vista, as part of SP1. Yes, this is the same RNG that could have an NSA backdoor.

It's not enabled by default, and my advice is to never enable it. Ever.

EDITED TO ADD (12/18): I should make this clear that the algorithm is available as a program call. It is not something that the user can enable or disable.
I've narrowed the backdoor to this random number generator:
random number generator.

Quote:

Did NSA Put a Secret Backdoor in New Encryption Standard?
11.15.07 | 12:00 AM

Random numbers are critical for cryptography: for encryption keys, random authentication challenges, initialization vectors, nonces, key-agreement schemes, generating prime numbers and so on. Break the random-number generator, and most of the time you break the entire security system. Which is why you should worry about a new random-number standard that includes an algorithm that is slow, badly designed and just might contain a backdoor for the National Security Agency [more]
Look at the date of that blog entry and the date of the Wired article; it seems this issue is very current.

Do macs use this random number generator? And what are the implications of the new macs that have the option of switching to a Windows OS?

Another article about NIST and the random number generator:

NIST encryption standard may have NSA backdoor
Quote:


Security experts: NIST encryption standard may have NSA backdoor


By Ryan Paul | Published: November 17, 2007 - 05:45PM CT

According to security experts, an algorithm for generating random numbers that is included in an official standard documented by the National Institute of Standards and Technology (NIST) could potentially include a backdoor planted by the NSA.

[..]

The NSA's support for the algorithm does seem somewhat suspicious, particularly in light of its relative weaknesses compared to the others in the standard. Schneier recommends that developers avoid using Dual_EC-DRBG and notes that "both NIST and the NSA have some explaining to do."
Why is NIST/NSA pushing an inferior logarithm onto computer makers?

Craig R. Arko 01-21-2008 10:18 AM

I'd prefer OpenBSD for a maximum security platform.

http://www.openbsd.org/index.html

cwtnospam 01-21-2008 10:35 AM

Quote:

Originally Posted by macuserhere (Post 444202)
I've narrowed the backdoor to this random number generator:
random number generator.

From that link:
Quote:

Back in 1996, an early version of SSL was broken because of flaws in its random-number generator.
Essentially, this is what I said in post # 12. In this case, Netscape had to close the hole, whether or not it was due to an NSA backdoor.

There will always be the possibility that some one could be spying on you, and they may or may not be using computers to do it. If you're worried that somebody might be, get a router and use Little Snitch. That will add a couple of difficult layers of defense for them to penetrate.

fazstp 01-21-2008 01:55 PM

Quote:

Originally Posted by macuserhere (Post 444185)
I don't agree. I think the NSA is spying on us and the NSA in turn are being spied on. I also think NSA is aware of this and for political reasons doesn't do anything about it.

Open source intelligence. Interesting concept. Do you really think they would knowingly share/leak information to a third party which they probably wouldn't even share with another government department? Disinformation maybe.

ThreeDee 01-21-2008 03:54 PM

Let me say this:

Any computer can be spied upon, no matter what. Even with some super-complex firewall, anti-intrusion programs, etc, even if there is no actual NSA backdoor, someone is always going to find a way in. Security programs just make it harder for someone to hack into your system. There are possibly many other flaws and holes to exploit. It might be pretty difficult to find them, but it is possible.

Oh, and:
What exactly is the NSA trying to find by spying on us? They can easily go through government files and find our SSN, credit card numbers, etc. without having to hack into our computers.

fazstp 01-21-2008 05:58 PM

1 Attachment(s)
It seems this goes much deeper than I gave credit. We're through the looking glass here, people...

ArcticStones 01-21-2008 06:25 PM

Re: The technological debate
 
Quote:

Originally Posted by macuserhere (Post 444185)
I don't agree. I think the NSA is spying on us and the NSA in turn are being spied on...

...I thought it might spark some interesting discussion by Apple 'insiders' who could give details about the security of macs or how to make them more secure... But it seems to have sparked off more of a political debate than a technological debate...

Agreed, the technological side of this debate is the interesting one. The rest is as much smoke & mirrors, opinions & conjecture as anything else. Also: I take what you said about the NSA above for granted. We live in an Age of Transparency -- and that is particularly true of digital aspects of our world.

Then again, I assume that all my digital communication passes through NSA filters (without attracting interest), be they word or phrase trigger filters or whatever.

I really do wish that I had the prerequisite knowledge to go into the technological side of this. But I don’t, so I readily admit that what I have ventured so far is mere conjecture. I’ll be reading with fascination the thoughts of those of you who are qualified do so.

Thanks for well-organised posts and links to a wealth of material on the subject! :)

-- ArcticStones

J Christopher 01-21-2008 07:16 PM

Considering that AES 128 is approved by the NSA for classified documents up to Secret, and AES 256 is approved for Top Secret, I consider it highly unlikely that these security measures have a backdoor for NSA or any other US government agency. Even if they did, the secrecy of the ability to do so would be so valuable that it could be utilized only extremely rarely such that only a handful of people in the world would be at risk of being compromised by such measures.

fat elvis 01-21-2008 07:46 PM

Is this really something that needs to be debated?

AT&T domestic spying

Uncle Sam trying to protect it's stool pidgeons

COINTELPRO

Yellow Dots on my resume?

Does NSA have a back door? Who cares! They can spy on us whenever they want.

ArcticStones 01-21-2008 07:58 PM

Quote:

Originally Posted by fat elvis (Post 444351)
Does NSA have a back door? Who cares! They can spy on us whenever they want.

Well, I certainly would like to know more about the relevant technologies, any inherent security weaknesses in my OS of choice, and what I can (or cannot) do to make my system more secure.

iampete 01-21-2008 08:05 PM

Quote:

Originally Posted by J Christopher (Post 444347)
Considering that AES 128 is approved by the NSA for classified documents up to Secret, and AES 256 is approved for Top Secret, I consider it highly unlikely that these security measures have a backdoor . . .

Maybe a back door isn't really needed, after all. From Wikipedia:
Quote:

In October 2005, Dag Arne Osvik, Adi Shamir and Eran Tromer presented a paper demonstrating several cache timing attacks against AES. . . . One attack was able to obtain an entire AES key after only 800 operations triggering encryptions, in a total of 65 milliseconds. This attack requires the attacker to be able to run programs on the same system that is performing AES.
Doesn't this imply that no matter how secure AES itself may be, it can be defeated in a de facto sense if the security incorporated into the computer has any unauthorized access "holes" at all? As previous posters have stated in different words, there is no absolutely certain firewall.

fat elvis 01-21-2008 08:11 PM

"The only secure computer is one that's unplugged, locked in a safe,
and buried 20 feet under the ground in a secret location... and i'm
not even too sure about that one"
-Dennis Huges, FBI.

I've heard this quote in many different forms...but Mr. Hughes (if he really exists ;)) will get credit this time.

I guess my "who cares" statement wasn't meant to disregard your quest for knowledge Arctic...but more to say that if they want to spy, "they" will find a way...and they have been finding ways.

I've read that it's possible to monitor one's activity by monitoring emitted radiation from CRT monitors. I'm not sure if anything similar exists for LCDs.

fazstp 01-21-2008 08:24 PM

Quote:

Originally Posted by fat elvis (Post 444355)
I've read that it's possible to monitor one's activity by monitoring emitted radiation from CRT monitors.

Monitor's flicker reveals data on screen

Seeing through walls


All times are GMT -5. The time now is 11:16 PM.

Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
Site design © IDG Consumer & SMB; individuals retain copyright of their postings
but consent to the possible use of their material in other areas of IDG Consumer & SMB.