Bob sent me a post from Slashdot which should serve as a wake-up call as to how difficult it is to protect yourself on the Internet if you are a mere mortal. They quote an Electronic Frontier Foundation report on how encryption is being subverted:
Another network-tampering threat to user safety has come to light from other providers: email encryption downgrade attacks. In recent months, researchers have reported ISPs in the US and Thailand intercepting their customers’ data to strip a security flag—called STARTTLS—from email traffic. The STARTTLS flag is an essential security and privacy protection used by an email server to request encryption when talking to another server or client.1
By stripping out this flag, these ISPs prevent the email servers from successfully encrypting their conversation, and by default the servers will proceed to send email unencrypted. Some firewalls, including Cisco’s PIX/ASA firewall do this in order to monitor for spam originating from within their network and prevent it from being sent. Unfortunately, this causes collateral damage: the sending server will proceed to transmit plaintext email over the public Internet, where it is subject to eavesdropping and interception.
This type of STARTTLS stripping attack has mostly gone unnoticed because it tends to be applied to residential networks, where it is uncommon to run an email server2. STARTTLS was also relatively uncommon until late 2013, when EFF started rating companies on whether they used it. Since then, many of the biggest email providers implemented STARTTLS to protect their customers. We continue to strongly encourage all providers to implement STARTTLS for both outbound and inbound email. Google’s Safer email transparency report and starttls.info are good resources for checking whether a particular provider does.
This is obviously way above my pay grade. Some of the comments at Slashdot argued that this problem was the result of user stupidity, as in using port 25, as opposed to port 465 or 587. However, bob makes some much broader points, and I would be curious to get reader reactions. This is a bit stream of consciousness, but Richard Smith, one of our resident IT experts, concurred, so this is presumably accessible to the tech savvy:
Google REALLY doesn’t like other people in their business line.
Read through and appreciate how convoluted their “claim” is. Email has always been a post card.
The encryption you can use to protect that is COMPLETELY separate from Google using “encryption” for gmail, or any other web based email.
In theory, if you use a resident program on your machine to encrypt a file and then email it, it can be “protected”, if the receiver takes the same precautions, un-encrypting it on a local, clean, machine.
Google just wants shit to work. They can paint on some encryption to brand it, but if that doesn’t work, for any number of technical reasons, it defaults back to no encryption between you and Google/webmail of any sort.
All the “encryption” can guarantee, at best, is that no one between you and google can read it (false/disputed claim). But, Google has to decrypt it to read it and then send it.
All it is is encryption between you and Google. Not between you and the recipient, as most people assume.
This is also about the https’ing “search requests”. Google wants to be the only people who know what you’re searching. The https isn’t to protect you, it’s to commoditize you. It stops your ISP from gathering your search info, maybe…
The NSA can just buy the info from Google then. It’s easier, all in one place. One stop black budget shopping.
That’s another whole ball of wax most people don’t get. Part of “secure” communication is being able (from google point of view) to be sure of the source. requiring a time stamped cert from some third party is a very good way to do that, if you wanted, to say, be able to introduce evidence for a trail.
Most of the “sytem” is also based on, “trusted” 3rd party certificatoins. But, control over the issuance of these security certs in laughable. They’ll give a cert to any dead guy. $2.95.
After finding that you can’t break in with a loophole, you then move onto cert manipulation where the MITM [man in the middle] accepts the cert meant for the user, and then issues a cert that that MITM generated, to the user machine.
It’s all Certified™ encrypted™, but all the cert and encryption are being done by a machine that is between you and your server, etc…The MITM is letting you use his machine, in effect.
The next step up is DNS poisoning, where you don’t even have to pay for a fake cert, you just set up a fake cert shop, and route all the traffic from the targeted machine through your poisoned DNS pool, which sends all cert requests to a place you can control.
It’s really is that bad, and trying to explain the logic of these fuckers is insane. Yes, in theory, some day, when the moon is right and there is enough pr0n flowing through your tor exit node, you could be anon.
The Tor mess sounds like a direct use of this ‘feature’.
19 comments
Comments are closed.
Yup. Not surprised. And if you encrypt your original e-mails, using PGP or GPG for example, then you’re automatically on a watch list.
How efficient.
Even if I GPG encrypt an email it still needs the header info to route the email. So much like cellphone metadata, you should be able to scrape the To/From (assuming the problem stated on Slashdot exists – where you have your emails not encrypted when sending to your provider from your email client).
This comes back to the trust issue – and Ed certainly doesn’t trust Google. And I’m not sure I can blame him. But at some point you are left with using something outside of email – direct encrypted messages. Where the secret is something you’ve literally handed off to the other person you are communicating with if you want to be 100% paranoid. If you are in the military, expect to do double encapsulated IPsec.
And for the 110% paranoid – get a Novena laptop (for $2200 and don’t expect it to be fast) so you don’t get taken by device firmware that has been replaced by the NSA.
Also, DNS [cache] poisioning? That’s not so easy. The tests I’ve seen needs a lot of traffic (like a gig) at least in basic brute forcing of colliding with the ID in the query, unless you are using and older version of Bind. And it’s even harder with low TTL’s (as long as the caching servers don’t “upgrade” them to a much higher value). Still a lot of caches will accept the 30 second TTL I set. Again, more of the problem is your local ISP.
Email has always been the equivalent of a post card. If that card passes though you, you can read it. the message is right on the outside. There is no “envelope” to protect the contents.
If you put the message on the post card in a code, aka, “encryption”, than it can, it theory, be protected.
When you sign onto google webmail, and “encrypted” channel is opened between your machine and google.
Google can still read the message. And lets say you send that plain email message, via an “encrypted” google connection to a yahoo email user, it goes between gmail and yahoo in plain text. Still a post card.
Good article and analysis. Thanks.
This would all be largely a non issue if our government weren’t so corrupt, so totally captured. Digital privacy, or the exploitation of it, is deemed highly profitable by TPTB for one and a symbol of power for another, and as long as that remains the case in these dystopian circumstances we will get precious little of it.
I’m interested in exactly what Obama thinks he is going to get out of his public so called net neutrality stance. Since he always has an egg in his mouth if not running down his chin, it is a given he is a fox in a hen house. The idea that he simply wants to to what’s right is absurd, a non starter.
So his actual motive is of interest. Something is happening. Possibly some of the players are not happy about other players getting the keys to the car (or at least to the gas peddle). Or the NSA can do it’s job better and more easily if there is at least a pretense of neutrality. Or possibly he knows his request will go nowhere by the next administration, so it’s inexpensive PR, but frankly, for him to even bother with such dissimulation is unusual these days so it is more likely that something darker is going on.
So, does ISP utility designation make it easier or harder to do this sort of stuff? The answer to net neutrality lies there.
Bottom line: there is no “secure” when using the internet (in terms of government spooks and internet service and content providers). Never was. They can watch and/or modify everything, and they do. Was like hiring Russian contractors to build a US embassy. Like, duh.
Best thing that could happen is to clear that up for everybody.
Agreed. There is no “secure”.
These technobabble arguments always evolve into geek circle jerks about what might, theoretically, in some circumstances, be possible.
In theory, fusion…
The quickest way around this ISP flag stripping is to use a VPN, which encrypts your http data between yourself and the VPN’s servers, which will be outside of your ISP’s control, and if you’re smart in Germany or Sweden or somewhere they don’t pull so much of this crap.
I use one for all my browsing. My ISP has no business knowing what websites I’m visiting, and if the NSA wants to hover up all my encrypted http data they can have a field day. The idea that my encrypted data is going to be of any interest to them in 10 years or whenever they’re going to finally be able to decrypt it with their quantum computers is just silly. I mean I’m not happy about it obviously but apparently we have to triage our efforts at privacy. If the NSA wants to know how much porn I watch they can wait. If they want to see what “subversive” sites I visit, like NC for example, they can wait.
We live in a totalitarian state we just don’t know it yet.
“if you’re smart in Germany or Sweden or somewhere they don’t pull so much of this crap.”
VPN out of the country? So you have an encrypted channel running overseas?
That’s right inside NSA authority. They ARE watching that,
I don’t think it’s in anybody’s best interests to elaborate upon this subject in public. Short version. It’s much easier to compromise the router/server than it is to decrypt the volume of information the NSA and Google is getting their hands on. The more widely used a certain form of encryption is the greater the chance that it’s already been broken. If there is an encryption method that could maintain strict comsec it isn’t likely to ever be in the hands of the general public.
” don’t think it’s in anybody’s best interests to elaborate upon this subject in public.”
Private would be better?
LSS, there is nothing you do “online” that is secure. Nothing.
Yes, in theory, if you are one of the Very Serious People, with a bunch of crypto geeks at your disposal, it’s possible to be either “secure” or “anonymous”. Both, at the same time, takes 4 times the geek power.
But, even the above average user can’t even begin to protect himself/herself.
The whole discussion gets bogged down in theoretical technicalities, branding and competition.
Assume everything is wide open, because it is.
“It’s much easier to compromise the router/server”
Yes, especially when it’s your router or server. The ISP’s are doing what would be called an MITM if they weren’t ISPs. They would also be in jail. Trillion year sentence, based on just the ‘attacks’ of the last few moments.
Somebody famous once said: If you want it done right you’ve got to do it yourself.
except in most cases now days, its out side of your control now.
or how do you protect your self when you shop at a brick and mortar store and their security is a sieve? and that same store is tracking you ever where you go in it. they even provide helpful hints of products you migyht be interested in
https://bitmessage.ch/
Tor by another name. You’re placing all your ‘trust’ in bitmessage, and don’t really have anyway of knowing who they are, or what might be broken or ‘broken on purpose’. That’s assuming the whole thing isn’t just a honey-pot to begin with.
And even if they started with the best of intentions, that can change quickly. All it takes is a few bad actors inside and/or a brand new or overlooked ‘zero day’ vulnerability to bring the secure very suddenly, into the insecure.
Since no one has mentioned it in this thread’s context, allow me to do so:
Once upon a time, people conducted nearly all of their long-distance (i.e. anything beyond face-to-face meetings) via letters sent through either private mail (courriers) or public mail. Though, in all the most sensitve cases, there was always a certain risk of surveillance and disclosure involved, the vast majority of nearly everyone’s mail went through without any snooping into it at all. No one noted and collected the sender-and-destination ( i.e. “meta”) data, either. Only in rare cases did someone intercept and open and inspect a letter’s contents. So, since today, nearly all (*) of the analogue of such past communcations passes via inte-rnetworks of some sort, all of that vast communication is now not only vulnerable to interception, we now know that in all but rare cases, part or all of the data (esp. the meta-data) is intercepted and subject to storage and more or less later inspection.
That means that the ordinary correspondent of the 15th through 19th and, up to late 20th century, enjoyed a degree of privacy in his communications that we can now only envy. True, we can now communicate over vast distances at a speed that makes even a telegraph line seem crude. But we’ve given up on personal privacy. Some people naively argue that we “traded” one for the other. To believe that is to make a virtue of “necessity”–it’s a form of intellectual surrender. No one offered us any choice in these matters, no one proposed any such “trade-off”, with any real option to decline and keep a status quo ante. The entire premiss of the discussion here is that, unlike over centuries past, our hopes for , even our hopes, for personal privacy in personal communications are now completely futile. So, we’ve surrendered this and, with that, so much else besides.
But this is all just the prelude. We’ve also surrendered even the commonly-accepted assumption that we have a right to such privacy and that encroachments on it are an outrage to our most important rights–rights which no government had–it was taught, over generations–any right to violate preemptorily. To be lawful, inspections had to be predicated on a case-by-case showing of cause for interception and inspection, and this had to be done in and by formal means–courts, magistrates, etc. In other words, permission wasn’t granted by default, it had to be specifically requested and granted. Though that is of course the ideal, the actual practice was, compared to what we all meekly accept today as inevitable, another example of what we can only look on with envy.
Except for custom-made hardware and shared custom software, nearly every networked computer user is obliged to make his machine and its contents an open book to the manufacturer–and, by extension, any and all powers and interests, public or private, which can impose their will on that manufacturer–for purposes of the obligatory up-dates, without which the computer’s connectivity and software falls into a state of outmoded disutility–up to the point of being of simply failing to measure up to the new standards of acceptability over networks. So, in this way, too, privacy interests are surrendered at the point of sale.
There is now in place virtually everything necessary to operate on a full-on Orwellian “Ninteen Eighty-Four” mode of supersurveillance in which nearly everything we do and communicate is subject to presumptive supervision, inspection and storage for whatever uses — esp. against us–that those in positions of authority see fit to find convenient. Not only this, but, as we see here everyday, the social and material conditions of the lives of many of us are worsening considerably by the year or even, for some, by the month. We’re not only financially poorer, we’re both spiritually and intellectually poorer and less free, less able to determine for ourselves how we shall live and with what objectives and purposes. These strictures are severe and being made more severe–with violent means more and more the manner by which this is all enforced.
We really ought to be stunned at the degree to which we’ve gradually been reduced by the growth of a supercentralized and superpowerful set of arrangements in politics, finance and social relations. It’s properly scandalous and terrifying if we thought about it, so, here, as so often elsewhere, we try not to think about it.
All we “need” to be virtually indistinguishable from the sorry conditions of, say, Mexico or Egypt, or any of so many other places like these nations is a few changes in what little remains in personnel and practices that, somehow, still leave an illusion of freedom from outright and undisguised full repression and control.
Should your IP address be close to your home?
Ours used to be, but now our IP addresses on our computers show that of a city in a state several states north of ours.
Is that unusual? Or problematic? Or weird? Or just a nothingburger?
Anyone? :-)
IP geolocation frequently is wildly inaccurate (thought experiment: what should the location of a cell phone’s IP be?) and of course can’t penetrate proxies.