Category Archives: Encryption
How to Enable AES Encryption on Your Router – Laptop Mag
Encryption is a hotly-debated topic in Washington, but an essential part of web security everywhere else. For most of us, this starts with how were connecting to the internet -- our router. Each router has multiple encryption settings, of which AES/WPA2 is the hands-down winner when it comes to keeping each of us secure. Dated technologies, like WEP, arent much better than no protection at all, and sadly some older routers are set to that by default. Firmware updates should bring you into modern times, but you may still have to know what youre looking for.
Heres how its done, at least on my router.
1. In the address bar, enter the home address for your router and press enter. For mine, its 192.168.1.1, but depending on your router it could be 192.168.0.1, or another variation. If its neither of those, a quick Google search for [router brand] home address will get you where you need to be.
2. Log in, and press OK to proceed.
3. Click Wireless settings at the top of the page -- or something similar on your router.
4. Click Basic Security Settings -- or, just security settings or something similar.
5. Under Wi-Fi Security, select WPA2. WPA2 utilizes AES encryption, which is typically plenty for most households.
6. Click Apply at the bottom.
Original post:
How to Enable AES Encryption on Your Router - Laptop Mag
UK government is secretly planning to break encryption and spy on people’s phones, reveals leaked document – The Independent
Designed by Pierpaolo Lazzarini from Italian company Jet Capsule. The I.F.O. is fuelled by eight electric engines, which is able to push the flying object to an estimated top speed of about 120mph.
Jet Capsule/Cover Images
A humanoid robot gestures during a demo at a stall in the Indian Machine Tools Expo, IMTEX/Tooltech 2017 held in Bangalore
Getty Images
A humanoid robot gestures during a demo at a stall in the Indian Machine Tools Expo, IMTEX/Tooltech 2017 held in Bangalore
Getty Images
Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea
Jung Yeon-Je/AFP/Getty Images
Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea
Jung Yeon-Je/AFP/Getty Images
The giant human-like robot bears a striking resemblance to the military robots starring in the movie 'Avatar' and is claimed as a world first by its creators from a South Korean robotic company
Jung Yeon-Je/AFP/Getty Images
Engineers test a four-metre-tall humanoid manned robot dubbed Method-2 in a lab of the Hankook Mirae Technology in Gunpo, south of Seoul, South Korea
Jung Yeon-Je/AFP/Getty Images
Waseda University's saxophonist robot WAS-5, developed by professor Atsuo Takanishi
Rex
Waseda University's saxophonist robot WAS-5, developed by professor Atsuo Takanishi and Kaptain Rock playing one string light saber guitar perform jam session
Rex
A test line of a new energy suspension railway resembling the giant panda is seen in Chengdu, Sichuan Province, China
Reuters
A test line of a new energy suspension railway, resembling a giant panda, is seen in Chengdu, Sichuan Province, China
Reuters
A concept car by Trumpchi from GAC Group is shown at the International Automobile Exhibition in Guangzhou, China
Rex
A Mirai fuel cell vehicle by Toyota is displayed at the International Automobile Exhibition in Guangzhou, China
Reuters
A visitor tries a Nissan VR experience at the International Automobile Exhibition in Guangzhou, China
Reuters
A man looks at an exhibit entitled 'Mimus' a giant industrial robot which has been reprogrammed to interact with humans during a photocall at the new Design Museum in South Kensington, London
Getty
A new Israeli Da-Vinci unmanned aerial vehicle manufactured by Elbit Systems is displayed during the 4th International conference on Home Land Security and Cyber in the Israeli coastal city of Tel Aviv
Getty
Electrification Guru Dr. Wolfgang Ziebart talks about the electric Jaguar I-PACE concept SUV before it was unveiled before the Los Angeles Auto Show in Los Angeles, California, U.S
Reuters
The Jaguar I-PACE Concept car is the start of a new era for Jaguar. This is a production preview of the Jaguar I-PACE, which will be revealed next year and on the road in 2018
AP
Japan's On-Art Corp's CEO Kazuya Kanemaru poses with his company's eight metre tall dinosaur-shaped mechanical suit robot 'TRX03' and other robots during a demonstration in Tokyo, Japan
Reuters
Japan's On-Art Corp's eight metre tall dinosaur-shaped mechanical suit robot 'TRX03'
Reuters
Japan's On-Art Corp's eight metre tall dinosaur-shaped mechanical suit robot 'TRX03' performs during its unveiling in Tokyo, Japan
Reuters
Singulato Motors co-founder and CEO Shen Haiyin poses in his company's concept car Tigercar P0 at a workshop in Beijing, China
Reuters
The interior of Singulato Motors' concept car Tigercar P0 at a workshop in Beijing, China
Reuters
Singulato Motors' concept car Tigercar P0
Reuters
A picture shows Singulato Motors' concept car Tigercar P0 at a workshop in Beijing, China
Reuters
Connected company president Shigeki Tomoyama addresses a press briefing as he elaborates on Toyota's "connected strategy" in Tokyo. The Connected company is a part of seven Toyota in-house companies that was created in April 2016
Getty
A Toyota Motors employee demonstrates a smartphone app with the company's pocket plug-in hybrid (PHV) service on the cockpit of the latest Prius hybrid vehicle during Toyota's "connected strategy" press briefing in Tokyo
Getty
An exhibitor charges the battery cells of AnyWalker, an ultra-mobile chasis robot which is able to move in any kind of environment during Singapore International Robo Expo
Getty
A robot with a touch-screen information apps stroll down the pavillon at the Singapore International Robo Expo
Getty
An exhibitor demonstrates the AnyWalker, an ultra-mobile chasis robot which is able to move in any kind of environment during Singapore International Robo Expo
Getty
Robotic fishes swim in a water glass tank displayed at the Korea pavillon during Singapore International Robo Expo
Getty
An employee shows a Samsung Electronics' Gear S3 Classic during Korea Electronics Show 2016 in Seoul, South Korea
Reuters
Visitors experience Samsung Electronics' Gear VR during the Korea Electronics Grand Fair at an exhibition hall in Seoul, South Korea
Getty
Amy Rimmer, Research Engineer at Jaguar Land Rover, demonstrates the car manufacturer's Advanced Highway Assist in a Range Rover, which drives the vehicle, overtakes and can detect vehicles in the blind spot, during the first demonstrations of the UK Autodrive Project at HORIBA MIRA Proving Ground in Nuneaton, Warwickshire
PA wire
Chris Burbridge, Autonomous Driving Software Engineer for Tata Motors European Technical Centre, demonstrates the car manufacturer's GLOSA V2X functionality, which is connected to the traffic lights and shares information with the driver, during the first demonstrations of the UK Autodrive Project at HORIBA MIRA Proving Ground in Nuneaton, Warwickshire
PA wire
Ford EEBL Emergency Electronic Brake Lights is demonstrated during the first demonstrations of the UK Autodrive Project at HORIBA MIRA Proving Ground in Nuneaton, Warwickshire
PA
Full-scale model of 'Kibo' on display at the Space Dome exhibition hall of the Japan Aerospace Exploration Agency (JAXA) Tsukuba Space Center, in Tsukuba, north-east of Tokyo, Japan
EPA
Miniatures on display at the Space Dome exhibition hall of the Japan Aerospace Exploration Agency (JAXA) Tsukuba Space Center, in Tsukuba, north-east of Tokyo, Japan. In its facilities, JAXA develop satellites and analyse their observation data, train astronauts for utilization in the Japanese Experiment Module 'Kibo' of the International Space Station (ISS) and develop launch vehicles
EPA
The robot developed by Seed Solutions sings and dances to the music during the Japan Robot Week 2016 at Tokyo Big Sight. At this biennial event, the participating companies exhibit their latest service robotic technologies and components
Getty
The robot developed by Seed Solutions sings and dances to music during the Japan Robot Week 2016 at Tokyo Big Sight
Getty
Government and industry are working together on a robot-like autopilot system that could eliminate the need for a second human pilot in the cockpit
AP
Aurora Flight Sciences' technicians work on an Aircrew Labor In-Cockpit Automantion System (ALIAS) device in the firm's Centaur aircraft at Manassas Airport in Manassas, Va.
AP
Stefan Schwart and Udo Klingenberg preparing a self-built flight simulator to land at Hong Kong airport, from Rostock, Germany
EPA
Read the original post:
UK government is secretly planning to break encryption and spy on people's phones, reveals leaked document - The Independent
Encryption: Securing Sensitive Data in Changing Corporate Environments – eSecurity Planet
As corporate data moves beyond the firewall and into the cloud and Internet of Things, encryption becomes more important than ever. We cover everything from encryption basics to solutions.
Data security has traditionally been seen as a matter of locking down data in a physical location, such as a data center. But as data migrates across networks, borders, mobile devices, and into the cloud and Internet of Things (IoT), focusing solely on the physical location of data is no longer relevant.
To prevent disclosure of sensitive corporate data to unauthorized people in this new corporate environment, data needs to be secured. Encryption and data masking are two primary ways for securing sensitive data, either at rest or in motion, in the enterprise. It is an important part of endpoint security.
Encryption is the process of encoding data in such a way that only authorized parties can access it. Using homomorphic encryption, sensitive data in plaintext is encrypted using an encryption algorithm, generating ciphertext that can only be read if decrypted.
In data masking, fake data replaces real data for users who should not have access to the real data, whether because of their role in the company or because they are attackers. Masking ensures sensitive data is obscured or otherwise de-identified.
Dynamic data masking can transform the data based on the user roles and privileges. It is used to secure real-time transactional systems and improve data privacy, compliance implementation, and maintenance.
With data masking, data is retained in its native form, and no decryption key is necessary. The resulting data set does not contain any references to the original information, making it useless for attackers.
Encryption scrambles data using nonreadable mathematical calculations and algorithms. An encryption system employs an encryption key generated by an algorithm. While it is possible to decrypt the data without possessing the key, significant computational resources and skills would be required if the encryption system is designed properly. An authorized recipient can easily decrypt the message with the key provided by the originator.
If the encryption key is lost or damaged, it may not be possible to recover the encrypted data from the computer. Therefore, enterprises need to set up rigorous key management processes, procedures, and technologies before implementing data encryption technologies.
Organizations should consider how key management practices can support the recovery of encrypted data if a key is lost or destroyed. Those planning on encrypting removable media need to consider how changing keys will impact access to encrypted storage on removable media, such as USB drives, and develop solutions, such as retaining the previous keys in case they are needed.
Encryption can be applied to endpoint drives, servers, email, databases, and files. The appropriate encryption depends upon the type of storage, the amount of data that needs to be protected, environments where the storage will be located, and the threats that need to be stopped.
Public key encryption is one use of public key cryptography, also known as asymmetric cryptography. Digital signature, in which a message is signed with the senders private key and can be verified by anyone who has access to the senders public key, is another well-known use of public key cryptography.
There are three primary types of encryption solutions: full disk encryption, volume/virtual disk encryption, and file/folder encryption. When selecting encryption types, enterprises should consider the range of solutions that meet their security requirements, not just the type that is most commonly used.
The top features that enterprises should consider when choosing an encryption system include centralized policy management, application and database transparency, low latency, key management interoperability, support for hardware-based cryptographic acceleration, support for compliance regulations, and monitoring capabilities.
There are many factors to consider when selecting storage encryption solutions, such as the platforms they support, the data they protect, and the threats they block. Some involve installing servers and software on the devices to be protected, while others can use existing servers, as well as software built into devices operating systems.
Unfortunately, encryption can result in loss of functionality or other issues, depending on how extensive the changes are to the infrastructure and devices. When evaluating solutions, enterprises should compare the loss of functionality with the gain in security capabilities and decide if the tradeoff is worth it. Solutions that require extensive changes to the infrastructure and end user devices should generally be used only when other options cannot meet the enterprises security needs.
An encryption protocol is a series of steps and message exchanges designed to achieve a specific security objective.
To ensure compatibility and functionality, enterprises should use standard-conforming encryption protocols such as Internet Protocol Security (IPSec), Secure Socket Layer (SSL), Transport Layer Security (TLS), Secure Shell (SSH), Secure/Multipurpose Internet Mail Extensions (S/MIME), and Kerberos. Each has advantages and disadvantages. Some overlap in functionality, but each tends to be used in different areas.
IPSec provides encryption at the IP packet level and requires low-level support from the operating system and a configured server. Since IPSec can be used as a tunnel to secure packets belonging to multiple users and hosts, it is useful for building virtual private networks and connecting remote machines. The next-generation Internet Protocol, IPv6, comes with IPSec built in, but IPSec also works with IPv4.
SSL and TLS work over the Transmission Control Protocol (TCP) and link up with other protocols using TCP, adding encryption, server authentication, and authentication of the client. TLS is an upgrade to SSL that strengthens security and improves flexibility. SSL and TLS are the primary method for securing Web transactions, such as the use of https instead of http in URLs. A widely used open-source implementation of SSL is OpenSSL.
S/MIME is a standard for public key encryption and signing MIME data. With S/MIME, administrators have an e-mail option that is more secure than the previously used Simple Mail Transfer Protocol (SMTP). S/MIME brings SMTP to the next level, allowing widespread e-mail connectivity without compromising security.
SSH is the primary method of securing remote terminals over the internet and for tunneling Windows sessions. SSH has been extended to support single sign-on and general secure tunneling for TCP streams, so it is often used for securing other data streams. The most popular implementation of SSH is the open-source OpenSSH. Typical uses of SSH allows the client to authenticate the server, and then the user enters a password to authenticate the user. The password is encrypted and sent to the other system for verification. To prevent man-in-the-middle attacks, in which communication between two users is monitored and modified by an unauthorized third party, SSH records keying information about servers with which it communicates.
Kerberos is a protocol for single sign-on and user authentication against a central authentication and key distribution server. Kerberos works by giving authenticated users tickets, granting them access to various services on the network. When clients then contact servers, the servers can verify the tickets. Kerberos is a primary method for securing and supporting authentication on a local area network. To use Kerberos, both the client and server have to include code since not everyone has a Kerberos setup, complicating the use of Kerberos in some programs.
Most of the major security firms provide data encryption software for the enterprise. Here is a sampling of available enterprise data encryption software, which includes full disk encryption (for more in-depth discussions of vendors who provide full disk encryption, see eSecurity Planets articles 7 Full Disk Encryption Solutions to Check out and Full Disk Encryption Buyers Guide):
Check Point Full Disk Encryption Software Blade provides automatic security for data on endpoint hard drives, including user data, operating system files, and temporary and erased files. Multifactor pre-boot authentication ensures user identity, while encryption prevents data loss from theft.
Dell Data Protection Encryption Enterprise enables IT to enforce encryption policies, whether the data resides on the system drive or external media. Designed for mixed vendor environments, it also will not interfere with existing IT processes for patch management and authentication.
HPE SecureData Enterprise uses both encryption and data masking to secure corporate data. HPE SecureData de-identifies data, rendering it useless to attackers, while maintaining usability and referential integrity for data processes, applications, and services. It uses Hyper Format-Preserving Encryption, a high-performance format-preserving encryption.
IBM Guardium Data Encryption provides encryption capabilities to help enterprises safeguard on-premises structured and unstructured data and comply with industry and regulatory requirements. This software performs encryption and decryption operations with minimal performance impact and requires no changes to databases, applications, or networks.
McAfee (Intel Security) Complete Data Protection provides its own encryption tools and supports Apple OS X and Microsoft Windows-native encryption, system encryption drives, removable media, file shares, and cloud data. It also integrates with McAfees other enterprise security tools, such as data loss prevention.
Microsoft BitLocker Drive Encryption provides encryption for Windows operating systems only and is intended to increase the security surrounding computer drives. Having BitLocker integrated with the operating system addresses the threats of data theft or exposure from lost, stolen, or inappropriately decommissioned computers.
Sophos SafeGuard Encryption is always on, allowing for secure collaboration. Synchronized encryption protects data by continuously validating the user, application, and security integrity of a device before allowing access to encrypted data.
Symantec Endpoint Encryption provides endpoint encryption and removable media encryption with centralized management, as well as email, file share, and command-line tools. It also integrates with the companys data loss prevention technology.
Trend Micro Endpoint Encryption provides full disk encryption, folder and file encryption, and removable media encryption. It can also manage Microsoft BitLocker and Apple FileVault.
WinMagic SecureDoc Enterprise Server (SES) offers enterprises control over their data security environment, ensuring security and transparency in regular workflow. With full disk encryption and PBConnex technology, SES enables customers to streamline their IT processes.
In addition to these data encryption software solutions, enterprises could benefit from employing other encryption tools. An eSecurity Planet slideshow advises IT pros to build a portfolio of encryption tools to leverage each ones strengths. And for the DIY crowd, VeraCrypt offers an open source encryption option.
eSecurity Planet offers six tips for stronger encryption:
do not use old encryption ciphers
use longer encryption keys
encrypt in layers
store encryption keys securely
ensure that encryption implementation is done properly
consider external factors, such as digital signature compromise.
Increasingly, enterprises are adopting cloud computing and deploying Internet of Things (IoT) devices to improve efficiencies and reduce costs. However, these technologies can pose additional risks to corporate data.
Encryption could help secure the data, but not many enterprises are opting for that solution. For example, only one-third of sensitive corporate data stored in cloud apps is encrypted, according to a survey of more than 3,400 IT and IT security pros by the Ponemon Institute and Gemalto.
At the same time, close to three-quarters of respondents believe that cloud-based apps and services are important to their companys operations, and an overwhelming 81 percent expect the cloud to become more important in the near future.
Data encryption can be more challenging in the cloud because data may be spread over different geographic locations, and data is not on storage devices dedicated solely to an individual enterprise. One option is to require the cloud service provider to offer data encryption as part of a service level agreement.
Also, enterprises are increasingly using IoT devices, but few of them have security built in. One option to improve security is to encrypt the data that is transferred by IoT devices, particularly those that connect wirelessly to the network.
In sum, data encryption can be used to secure data at rest and in motion in the traditional enterprise environment, as well as the emerging environments of cloud computing and IoT deployments.
See more here:
Encryption: Securing Sensitive Data in Changing Corporate Environments - eSecurity Planet
News in brief: UHD Blu-ray encryption ‘cracked’; WhatsApp falls over; Gmail boosts phish protection – Naked Security
Your daily round-up of some of the other stories in the news
Encrypted copy protection on UHD Blu-rays have apparently been cracked for the first time and the content has appeared online but dont get too excited, as the disc thats been cracked isnt a hot Hollywood blockbuster. Its The Smurfs 2.
UHD Blu-rays are protected by AACS 2.0 encryption, which was developed and is used by IBM, Intel, Microsoft, Panasonic, Sony, Toshiba, Walt Disney and Warner Bros to protect their content, and has generally been described as impossible to crack.
Does this mean the torrent sites will soon be packed with ultra high-definition content? Not so fast: apparently the file size on the cracked version of The Smurfs 2.0 is a meaty 53GB, and the version of the film you get if you go poking about those dodgy corners of the web has some issues, including problems with the colour. Oh, and if you do go looking for it which of course we wouldnt recommend there are very few seeders, so it would take a long time to download.
Theres no documentation of how the encryption was broken, so wed also advise holding fire before accepting the claim that it has indeed been cracked.
WhatsApps billion-plus users couldnt use the encrypted messaging platform for several hourson Wednesday, with the peak of the problems hitting between 20:00GMT and 22:00GMT yesterday, according to data from service-monitoring websites including outage.report.
Users reported that they couldnt send or receive messages as WhatsApp, which is owned by Facebook, scrambled to fix the problem.
There was some speculation that the outage was due to a cyberattack, but by Thursday afternoon no evidence had surfaced to confirm that. WhatsApp itself didnt have anything to say about the cause of the outage, confining itself to apologising, but Dave Anderson at Dynatrace told the BBC he reckoned the outage was down to an update that went wrong.
Said Anderson: WhatsApp send a new version of the app to the stores every few days and theyre likely to be pushing code changes every hour to get ready for that. It only takes one line of code and the app will fail.
Hard on the heels of what seemed to be an extensive phishing attack masquerading as a Google Doc, Google has pushed out a new security feature for Gmail that aims to protect Android users from clicking on dodgy links designed to steal your details.
Writing on the G Suite Updates blog, Google explained that the feature will roll out shortly in the Android email app.
Once its arrived, if you click on a suspicious link, youll be shown a warning saying: The site you are trying to visit has been identified as a forgery, intended to trick you into disclosing financial, personal or other sensitive information.
Of course, you shouldnt drop your guard and expect a warning to keep you safe: youll have to remain vigilant and keep an eye out for those dodgy emails. Heres just one of our guides on how to keep yourself safe from the phishermen (and women).
Catch up with all of todays stories on Naked Security
Read the original:
News in brief: UHD Blu-ray encryption 'cracked'; WhatsApp falls over; Gmail boosts phish protection - Naked Security
Encryption keeping FBI from accessing thousands of lawfully seized smartphones: Comey – Washington Times
Nearly half of all smartphones and other digital devices lawfully seized by the FBI are useless to federal investigators because theyre protected with encryption, FBI Director James B. Comey told the Senate Judiciary Committee on Wednesday.
Of more than 6,000 devices obtained by the FBI between Oct. 1 and March 31, Mr. Comey said 46 percent were safeguarded by strong encryption that renders them unreadable to authorities.
That means half of the devices that we encounter in terrorism cases, in counterintelligence cases, in gang cases, in child pornography cases, cannot be opened with any technique, Mr. Comey told the Senate panel.
That is a big problem, he added. And so the shadow continues to fall.
Lawmakers have weighed options to alleviate the FBIs so-called going dark problem for years. Myriad security and privacy concerns hindered attempts to legislate encryption during former President Obamas tenure in office, however, all the while Apple and Google enabled the widespread rollout of digital encryption by enabling the feature by default on their bestselling smartphones.
The Obama administration was not in a position where they were seeking legislation, Mr. Comey told lawmakers Wednesday. I dont know yet how President Trump intends to approach this. I know he spoke about it during the campaign, I know he cares about it, but its premature for me to say.
Indeed, Mr. Trump encouraged a boycott against Apple last year when federal investigators found themselves unable to obtain data from an encrypted iPhone recovered from the scene of a terror attack in San Bernardino, California. The FBI ultimately accessed the evidence with the help of outside security researchers, albeit at a cost of $900,000, Senator Dianne Feinstein, California Democrat, said at Wednesdays hearing.
Ms. Feinstein asked the FBI director if the government should legislate encryption Wednesday, to which he responded: we arent there now.
Weve had very good, open and productive conversations with the private sector over the last 18 months about this issue, because everybody realized we care about the same things, Mr. Comey said Wednesday. We all love privacy. We all care about public safety.
What we want to work with manufacturers on is to figure out how can we accommodate both interests in a sensible way? How can we optimize the privacy, security features of their devices and allow court orders to be complied with? Were having some good conversations. I dont know where theyre going to end up, frankly. I could imagine a world that ends up with legislation saying, if youre going to make devices in the United States, you figure out how to comply with court orders, or maybe we dont go there. But we are having productive conversations, right now I think, Mr. Comey said.
Read the original:
Encryption keeping FBI from accessing thousands of lawfully seized smartphones: Comey - Washington Times
Are we heading for a new encryption war? – ZDNet
Government agencies want their own backdoor into communications.
More details of how the UK's new surveillance law will operate have been revealed, in details about the use of encryption.
Under draft regulations to support the new Investigatory Powers Act, the government will be able to issue 'technical capability notices' to companies with more than 10,000 UK users to make it easier for police, spy agencies and other government bodies to access their customers' communications.
In particular, the regulations require companies to provide and maintain "the capability to disclose, where practicable, the content of communications or secondary data in an intelligible form and to remove electronic protection applied by or on behalf of the telecommunications operator to the communications or data, or to permit the person to whom the warrant is addressed to remove such electronic protection."
Those powers means it will be extremely difficult for tech companies and ISPs in the UK to offer their own end-to-end encryption services to their customers. That's because end-to-end encryption only allows the sender and the recipient of the communications to read the message: it is hidden from the company that sends it, as well as from other prying eyes.
The leaked paper was revealed by the Open Rights Group, and the group's executive director Jim Killock said the powers could be used to force companies to limit encryption, and that when these powers are used, it would be done in secret.
"There needs to be transparency about how such measures are judged to be reasonable, the risks that are imposed on users and companies, and how companies can challenge government demands that are unreasonable", he said.
"Businesses and the public need to know they aren't being put at risk. Sometimes, surveillance capabilities may be justified and safe: but at other times, they might put many more people - who are not suspected of any crime - at risk."
Police and intelligence agencies have long worried about losing the ability to intercept the communications of criminals and terrorists, who are able to plot in secret using encrypted messaging apps. It's a legitimate concern, but not one that is likely to be addressed by this legislation.
Criminals are simply going to switch to services based in other countries, or find even more obscure ways to communicate. And it may also make us less secure. The events of the last year have shown that criminals and state-sponsored hackers are always looking for ways to access and steal communications. Forcing the UK to use weaker forms of secure messaging will make the job of foreign spies and crooks much easier.
And those ISPs and tech companies that are obliged to hold our unencrypted messages? Effectively they will have a big red target painted on them forever more. If hackers and intelligence agencies know that these companies have the means to decode any messages on their network, then cracking their security becomes a priority.
Still, it's also important to consider the international perspective here: most secure messaging apps are not based in the UK, but in the US and the rest of the world, where the UK's law will have little impact. For these companies the UK is just one market among many, and they won't change their tech strategy just for one goverment, especially if their own goverment imposes no such demands.
So it's highly unlikely that the messaging apps we use, in our millions, every day, will be stripped of their end-to-end encryption anytime soon. UK phone companies and ISPs offering such services will simply shrug, and point out they did not add the encryption in the first place and therefore have no way of removing it. That's a big hole in the legislation.
However, there is another international dimension to consider. It could be that some countries will take the UK's law as a blueprint for their own surveillance laws (and the row over encryption is just one element of the legislation which also includes a legal framework for police and intelligence agencies to hack smartphones, PCs, tablets or computer infrastructure and requires ISPs to retain details of the internet browsing history of the entire country for 12 months.)
If enough countries decide they want similar legislation in place (the UK laws go further than similar laws in other democratic countries) and do not want companies in their jurisdiction offering end-to-end encryption then it may become harder for many people to use encryption as they do today.
That may make it easier to police and intelligence agencies to track criminals but at a cost to the security of the majority (and it would still be all but impossible to stop the use of end-to-end encryption completely).
But already, the idea of some kind of encryption legislation seems to be gaining traction in the US again; could we be heading back towards the sort of 'crypto wars' fought in the 1990s?
The UK's lone stand against encryption is unlikely to succeed, but it may point to bigger battles ahead.
See original here:
Are we heading for a new encryption war? - ZDNet
Encryption is Back in the Saddle Again – Niskanen Center (press release) (blog)
May 4, 2017 by Ryan Hagemann
A little over three months into 2017 and encryption is once again coming into focus.
Yesterday, in testimony before the Senate Judiciary Committee, FBI director James Comey was asked about the ongoing Going Dark problem. He noted that thus far, in just the first three months of this year, almost half of all pending cases at the FBI involved devices or systems that cannot be opened with any technique available to the federal law enforcement agency. He went on to note a collision between privacy and security, but stopped short of supporting a legislative mandate, arguing that while the encryption issue may require a legislative solution, it was premature for him to say anything definite. Sen. Dianne Feinstein (D-CA), however, was certain of her position, and noted her intention to reintroduce last years Compliance with Court Orders Act, co-sponsored with Sen. Richard Burr (R-CA) (around the 3:06:00 mark). For a more detailed analysis on the ins-and-outs of that bills many flaws, see here, here, and here.
The Burr-Feinstein legislation will undoubtedly set the tone for one extreme of the forthcoming encryption debate. Id wager that on the other end of the spectrum well hear a lot of the same talking points we heard during the height of the Apple vs FBI fight from this time last year. The same folks armed with the same messages are going to be entrenching themselves on the same battle-wearied policy hills, lobbing the same talking points at one another. Once more, the perfect is set to be the enemy of the good.
Maybe this time, however, we can aim to lift the voices of the moderate middle on this issuethose stakeholders that have all-too-unfortunately been drowned out by the more sensationalized messages from the polar extremes that often dominate the headlines. Instead of business-as-usual in the encryption debate, moderates on both sides of the debate need to signal support for the only other legislative proposal that has the political viability and compromise-oriented policy prescription necessary to defuse the Burr-Feinstein bill: the McCaul-Warner Digital Security Commission.
Ive written about the Commission a lot over the past year and a half, but it remains as clear today as it did then that this approach is the only viable path forward towards achieving compromise on the encryption debate. Talks between the FBI and the technology industry, according to Comey, have been good, but he remains uncertain as to whereif anywhere those conversations will lead. Those types of behind-the-scene stalemates are likely the reason a lot of tech companies, including Facebook and Apple, have signaled support for McCaul-Warner. If Burr-Feinstein is poised to move, its more imperative than ever that both encryption supporters and centrist politicians start putting their weight behind the only bill that respects the complexity of the issues involved in this debate.
The ebb and flow of policy priorities can sometimes feel cyclical, but few issues are as perennial as encryption (though net neutrality may give it a run for its money). As we prepare for yet another ride on this perpetual motion policy merry-go-round, its worth remembering that in between the polar extremes lies a significant moderate majority. In the event a political opportunity or necessity arises, the McCaul-Warner Commission is likely going to appeal more to those policymakers than either the do nothing approach or Burr-Feinstein. Despite all the loud voices in the encryption debate, it may be that silent moderate majority that ends up as the real heroes in this debate.
Go here to see the original:
Encryption is Back in the Saddle Again - Niskanen Center (press release) (blog)
IoT Time Preview: Encryption – IoT Evolution World (blog)
In this weekly series, well be previewing chapters of IoT Time: Evolving Trends in the Internet of Things for you to read in the hopes that youll like it enough to read the whole thing.
IoT Evolution, the leading media brand for the Internet of Things (IoT), has published a book outlining more than 150 of the leading trends in the IoT industry, entitled IoT Time: Evolving Trends in the Internet of Things. The book, written by IoT Evolution Editorial Director, Ken Briodagh, seeks to explore the factors that have shaped the recent past of the developing industry and use those to predict the trends that will drive the next period of growth. Each of the trends is explicated and illustrated with a case study or product review that supports each position.
In this weekly series, well be previewing chapters for you to read in the hopes that youll like enough to read the whole thing. To do just that, for free,click here. Alternatively, theres a paperback version available on Amazon for $14.99.
Chapter 18: Encryption Trend: Education is needed Connected Device Security a Mystery to 61 Percent of Consumers A recent survey of more than 1,000 consumers has illustrated the spread of the IoT among consumers, but it also points out some serious security concerns. The survey by BullGuard, a provider of mobile and internet security, said that about a quarter of consumers were planning to buy IoT devices in the next 12 months. BullGuard found that 58 percent of consumers are very concerned or highly concerned about potential hacking and data theft carried out against their connected devices, and 37 percent have already experienced a security incident or privacy problem. According to the survey, 68 percent of respondents are concerned about security risks like viruses, malware and hackers and 65 percent expressed concern over data collected by device manufacturers being inappropriately used or stolen.
The IoT industry has yet to establish common security standards among devices. Smart device manufacturers tend to adopt their own approach to security while updates to ensure device security are often too technical and complex for consumers to carry out, even those who are technically literate. This study revealed that 24 percent of consumers with advanced technical skills are not confident in their ability to keep their connected devices secure.
These vulnerabilities have been acknowledged by intelligence agencies across the world. In recent testimony to the US Senate, James Clapper, US Director of national intelligence, said, In the future, intelligence services might use the [Internet of Things] for identification, surveillance, monitoring, location trackingor to gain access to networks or user credentials.
Paul Lipman, CEO, BullGuard said, Most of us have been working with internet connected devices such as computers, smartphones and tablets for some time, but the Internet of Things is changing our perception of personal security, for both ourselves and our data. Its not just those who consider themselves technophobes that have these concerns tech savvy users are saying the same.
When asked how they would rate their computer skills, the majority of respondents described themselves as intermediate or advanced. More than 80 percent said they are capable of setting up their own router, yet when asked if they have changed their router password, almost half denied it. A third admitted that they dont know how, and 60 percent do not know how to configure a router to keep a home network secure.
Consumers are clearly not equipped to handle the myriad of security risks presented by connected devices, said Lipman. With devices such as security cameras, alarm systems and door locks now being connected to the internet, physical security is becoming as much of a consideration for consumers as data security. Keeping these devices secure is absolutely imperative.
Trend: Devices are too vulnerable IoT Devices Still Terrible at Security In a recent study, security firm ForeScout has shown that it takes fewer than three minutes to hack many common Enterprise IoT devices. This in-depth analysis shows the dangers posed by enterprise IoT devices, and seems to reveal that most can act as points of entry into critical enterprise networks. This IoT Enterprise Risk Report was based on research by white hat hacker Samy Kamkar.
IoT is here to stay, but the proliferation and ubiquity of these devices in the enterprise is creating a much larger attack surface -- one which offers easily accessible entry points for hackers, said Michael DeCesare, president and CEO, ForeScout Technologies. The solution starts with real-time, continuous visibility and control of devices the instant they connect -- you cannot secure what you cannot see.
Kamkar's research focused on seven common enterprise IoT devices: IP-connected security systems, smart HVAC and energy meters, video conferencing systems and connected printers, among others. According to his observations from a physical test situation and analysis from peer-reviewed industry research, these devices pose significant risk to the enterprise. That risk comes mostly because the majority of them are not built with embedded security. Of the few devices that did have some security protocols, Kamkar said many were operating with dangerously outdated firmware.
One of the vulnerabilities discovered was via a physical hack Kamkar performed, giving him access to an enterprise-grade, network-based security camera. The camera was entirely unmodified and running the latest firmware from the manufacturer, and was still vulnerable and ultimately allowed for the planting of a backdoor entryway that could be controlled outside the network.
Key findings of the report: The identified seven IoT devices can be hacked in as little as three minutes, but can take days or weeks to remediate. Should any of these devices become infected, hackers can plant backdoors to create and launch an automated IoT botnet DDoS attack, much like whats been happening over the last week. Cybercriminals can leverage jamming or spoofing techniques to hack smart enterprise security systems, enabling them to control motion sensors, locks and surveillance equipment. With VoIP phones, exploiting configuration settings to evade authentication can open opportunities for snooping and recording of calls. Via connected HVAC systems and energy meters, hackers can force critical rooms (e.g. server rooms) to overheat critical infrastructure and ultimately cause physical damage.
Thanks to vulnerabilities like the ones revealed here, bad actors are now easily able to use insecure devices to gain access to secure networks, and ultimately other enterprise systems chock full of tasty bank account information, personnel files and proprietary business information.
Trend: Good crypto could be an answer Cryptography Enables Turnkey Security for Connected Devices Developers of IIoT and connected embedded systems can now design in an added level of trust while also bringing their products to market faster, thanks to a recently released product from Maxim Integrated products. With the increase in cyber attacks on critical connected infrastructures, security can no longer be an afterthought in system design. In a recent survey conducted by Electronic Design of 2,200 electronic engineers, 60 percent of respondents said security in their products is very important, and 96 percent think that security will either have the same or more importance for their products.
The Maxim MAXQ1061 is designed with an integrated comprehensive cryptographic toolbox that provides full support for a wide spectrum of security needs, ranging from key generation and storage, to digital signature and encryption up to SSL/TLS/DTLS. It can also support secure boot for most host processors. To withstand extreme industrial environments, the MAXQ1061 is tested to operate from -40 degrees to more than 109 degree Celsius and is available in TSSOP-14.
The MAXQ1061 provides a hardware root of trust; its comprehensive set of cryptographic functions fulfill the key security requirements of the embedded systems of tomorrow, said Christophe Tremlet, Executive Business Manager, Embedded Security, Maxim Integrated. With the MAXQ1061, our customers have a trusted device that will not only guarantee the integrity and authenticity of the system, but also secure communications.
The MAXQ1061 embeds 32KB of user programmable secure EEPROM for storing certificates, public keys, private and secret keys, and arbitrary user data. The EEPROM is managed through a flexible file system, enabling custom security policy enforcement. Its cryptographic algorithms include ECC (up to NIST P-521), ECDSA signature generation and verification, SHA-2 (up to SHA-512) secure hash, AES-128/-256 with support for ECB, CBC, and CCM modes, and MAC digest. The MAXQ1061 also provides a separate hardware AES engine over SPI, supporting AES-GCM and AES-ECB modes, and that can be used to off-load a host processor for fast stream encryption.
The MAXQ1061 provides ideal hardware security to complement our software solution for the Floodgate Defender Appliance allowing customers to easily secure their legacy equipment economically, said Ernie Rudolph, EVP, Icon Labs.
Trend: More breaches means more focus on security Kontron Releases IoT Security Platform Kontron recently released a new hardware and software security platform for IoT environments that uses multi-layer encryption and real-time analytics to secure points across the network and detect rogue devices. A report commissioned by AT&T recently found that in the past two years, vulnerability scans increased in IoT devices by 458 percent. IBMs X-Force, a team of ethical hackers, recently hacked into the building automation system (BAS) of a so-called smart building occupied by a business with multiple offices across the U.S. The vulnerabilities that the team exploited would have given them access to all the BAS units of the company and its branch offices. As a result of their testing, the team came up with a fundamental list of security procedures, like avoiding storage of passwords in clear text form, which BAS operators should follow to reduce the possibility of future breaches.
This kind of competitive security research is critical to the establishment of trust in the IoT industry, and has been a part of the IT security landscape for as long as weve had computers. More of these hackathons and white hat hacker events are needed, and their successes reported. As more vulnerabilities are fixed and patched, new ones become harder to find and the whole industry earns greater consumer and industrial trust. And therefore, it grows.
In this weekly series, well be previewing chapters for you to read in the hopes that youll like enough to read the whole thing. To do just that, for free,click here. Alternatively, theres a paperback version available on Amazon for $14.99.
Edited by Ken Briodagh
Read more here:
IoT Time Preview: Encryption - IoT Evolution World (blog)
Jakarta Declaration Calls on Governments to Recognize Legitimacy of Encryption – CircleID
Today in Indonesia, media leaders gathered at UNESCO's World Press Freedom Day event issued the "Jakarta Declaration" calling on governments of the world to recognize the importance of a free and independent media in creating "peaceful, just and inclusive societies". The declaration calls on governments to take steps to support the freedom of the press, and, in the midst of the many actions was this statement:
34. Recognise the legitimacy of the use of encryption and anonymisation technologies;
As a long-time advocate for the widespread usage of encryption to protect our personal communication, I was extremely pleased to see this statement included in the declaration.
My colleague Constance Bommelaer wrote in detail yesterday about WHY encryption is so critical for journalists:
The future of the free press is at risk: encryption is part of the solution
She ends the piece with this call to action:
Governments have a role too. We invite them to adopt the SecureTheInternet principles and to support strong encryption, not only to ensure the safety of journalists, but also as a technology that already allows us to do our banking, conduct local and global business, run our power grids, operate communications networks, and do almost everything else.
As we celebrate World Press Freedom Day, we must remember that journalists and their sources are taking enormous risks right now in making sure crucial stories get told.
In today's environment, where trust in online information is at an all-time low, we need free, safe and independent journalists more than ever. We all have a role to play, and encryption is one step to take us there.
We all DO have a role. And encryption is part of how we get there.
I encourage you all to share this news about the Jakarta Declaration; to share the Jakarta Declaration document itself; to learn more about encryption; and to help people understand why encryption is critical for securing our digital economy!
By Dan York, Author and Speaker on Internet technologies - and on staff of Internet Society. Dan is employed as a Senior Content Strategist with the Internet Society but opinions posted on CircleID are entirely his own. Visit the blog maintained by Dan York here.
Related topics: Policy & Regulation, Privacy, Security
Read more:
Jakarta Declaration Calls on Governments to Recognize Legitimacy of Encryption - CircleID
FBI Director: Criminal Use Of Encryption Is Skyrocketing – Vocativ
The FBI says almost half of its investigations are now impeded by suspects using phones or computers with encryption.
Its the latest escalation in a tough issue with no clear resolution:how should the FBI should deal with privacy-protecting consumer encryption a technology thats almost impossible to regulate or prohibit when criminals can also use it to impede investigations?
The shadow created by the problem we call going dark continues to fall across more and more of our work, FBI Director James Comey told the Senate Judiciary Committee in testimony Wednesday.
In the first six months of the current fiscal year meaning from October 1, 2016 and April 1, 2017 the FBIwascompletely unable to open a device 46% of the time, Comey said.
Thats an apparent jump from previous FBI figures. In November, the FBI told Vocativ that over the previous 10 month period, it had tried to unlock 6,814 phones, both for its own and local and state police investigations. Of the 2,095 that actually had passcodes enabled, it was unable to get into 885 different phones, or about42%.
The FBI didnt respond to request for more thorough updated figures.
The agency has famously struggled with smartphone security in the past. Notably, after an ISIS-inspired couple murdered 14 people in San Bernardino, California, in 2015, the FBI tried to legally compel Apple to create a fake update for an iPhone to break in and gather its contents as evidence. Apple staunchly resisted CEO Tim Cook said the request was the software equivalent of cancer and would set a devastating legal precedent before the FBI found a third-party company that it could hire to hack that particular phone.
And encryption has boomed in popularity in recent months. Both iPhones and Android devices are encrypted if their owner creates a passcode or fingerprint to open it. A number of popular messaging apps, including WhatsApp and iMessage, adopted strong end-to-end encryption in 2016, meaning those devices manufacturers dont possess a means to unlock the users message. And Signal, widely regarded by cybersecurity experts as the best user-friendly encrypted messaging service, has seen its downloads soar.
Its unclear what, if anything, Comey wants to change, however. Previous draft bills in Congress that would aim to outlaw encryption have been resoundingly mocked by technologists and never went before a vote, and many experts say such a bill would be an attempt to ban math.
Cryptography experts resoundingly agree that asking companies like Apple to build backdoors into an encrypted program a secret hack for law enforcement to be able to circumvent it would invariably open the door for hackers and malicious government actors. Comey did stress, however, that he wasnt pushing for backdoors.
We all love privacy, he said in the hearing, responding to Senator Orin Hatch (R-Utah). We all care about public safety. And none of at least people that I hang around with, none of us want backdoors. We dont want access to devices built-in in some way.
He did, however, admit it was difficult to come to such a solution. I dont know where theyre going to end up, frankly, he said.
Excerpt from:
FBI Director: Criminal Use Of Encryption Is Skyrocketing - Vocativ