industryterm:internet security

How Libertarian theology and Trump are destroying the Internet — and America – Alternet.org
▻https://www.alternet.org/2019/01/how-libertarian-theology-and-trump-are-destroying-the-internet-and-america

https://www.alternet.org/wp-content/uploads/2019/01/shutterstock_1157861293.jpg

With speeds up to 100 times faster than current 4G cellular data, 5G will make possible everything from driverless cars to cell-connected long-distance drones to precision remote surgery. The amount of data flowing through our cellular systems will explode, along with places it can be used and the uses to which it can be applied.

Remote applications that are currently too difficult to wire for high-speed internet or won’t work well at 4G speeds will easily become remotely controlled, spreading the internet revolution to every device in the home, office, and even remote workplaces.

Along with all this data will, inevitably, come hackers, both criminal and state-sponsored. The amount of data that it now takes a third of a year to harvest with 4G can be scooped up in a single day using 5G.

Given that the U.S. government invented the internet (yes, Al Gore did co-author the legislation) and has a huge stake in its security, doesn’t it make sense that our government should provide, at least in framework and standards, for its security?

But, no. Trump and Pence want to do to the FCC what they’ve done to the EPA, the Department of the Interior, the FDA, and to oversight of our banking systems.

According to Trump and his billionaire libertarian owners, the safety and security of America is not the proper role of government. Not our air, our water, our public lands, or even our internet.

“Just turn it all over to the billionaires,” they say. “What could possibly go wrong?”

FCC Chairman Ajit Pai, the former Verizon lawyer, even went so far as to say that “the market, not government, is best positioned to drive innovation and leadership” with regard to internet security.

Meanwhile, the President’s National Security Telecommunications Advisory Committee—after looking at how 5G will blow open data operations across the country—wrote just three months ago that “the cybersecurity threat now poses an existential threat to the future of the nation.”

#Cybersécurité #Libertariens #Idéologie_californienne #5G #Normalisation

THE RISE OF THE CYBER-MERCENARIES
What happens when private firms have cyberweapons as powerful as those owned by governments?
▻https://foreignpolicy.com/2018/08/31/the-rise-of-the-cyber-mercenaries-israel-nso
▻https://foreignpolicymag.files.wordpress.com/2018/08/1_cyber_weapon_final1.jpg?w=1024&h=1536&crop=0,0,0

he first text message showed up on Ahmed Mansoor’s phone at 9:38 on a sweltering August morning in 2016. “New secrets about torture of Emiratis in state prisons,” it read, somewhat cryptically, in Arabic. A hyperlink followed the words. Something about the number and the message, and a similar one he received the next day, seemed off to Mansoor, a well-known human rights activist in the United Arab Emirates. He resisted the impulse to click on the links.

Instead, Mansoor sent the notes to Citizen Lab, a research institute based at the University of Toronto specializing in human rights and internet security. Working backward, researchers there identified the hyperlinks as part of a sophisticated spyware program built specifically to target Mansoor. Had he clicked on the links, the program would have turned his phone into a “digital spy in his pocket,” Citizen Lab later wrote in a report—tracking his movements, monitoring his messages, and taking control of his camera and microphone.

But the big revelation in the report wasn’t so much the technology itself; intelligence agencies in advanced countries have developed and deployed spyware around the world. What stood out was that Citizen Lab had traced the program to a private firm: the mysterious Israeli NSO Group. (The name is formed from the first initials of the company’s three founders.) Somehow, this relatively small company had managed to find a vulnerability in iPhones, considered to be among the world’s most secure cellular devices, and had developed a program to exploit it—a hugely expensive and time-consuming process. “We are not aware of any previous instance of an iPhone remote jailbreak used in the wild as part of a targeted attack campaign,” the Citizen Lab researchers wrote in their report.

C++ London Uni with Tom Breza, Oliver Ddin and Tristan Brindle
▻http://cppcast.libsyn.com/c-london-uni-with-tom-breza-oliver-ddin-and-tristan-brindle

Tom arrived in London at age 22 with £200 to his name, not knowing a single person. After 6 months Tom managed to start business - PC Service, that provides IT support to SMBs and runs it since then. Tom’s team help many customers from small businesses to top celebrities and Royal Families. Now with over 20 years of experience, Tom set his mind on new challenges and decided to learn software development, specifically C++ and helps others to learn through C++ London Uni. Oliver has been a C++ hater since 2008 - fortunately, that all changed with C++11 and he’s firmly an enthusiast now. He’s spent his time doing everything from embedded devices to network engineering and now Internet security related endeavours. He’s a big proponent of writing software in a style driven by some form of (...)

▻http://traffic.libsyn.com/cppcast/cppcast-152.mp3?dest-id=282890

IGCI : Interpol Global Complex for Innovation

http://www.interpol.int/extension/design_sqli/design/design_sqli/images/logo.png

The INTERPOL Global Complex for Innovation (IGCI) is a cutting-edge research and development facility for the identification of crimes and criminals, innovative training, operational support and partnerships.
Located in Singapore, the IGCI complements our General Secretariat in Lyon, France, and enhances the Organization’s presence in Asia.

Three domains of activities:

(1) Digital security
– Boosting cybersecurity and countering cybercrime;
– A forensics laboratory to support digital crime investigations;
– Research to test protocols, tools and services and to analyse trends of cyber-attacks;
– Development of practical solutions in collaboration with police, research laboratories, academia and the public and private sectors;
– Addressing issues such as Internet security governance.

(2) Capacity building and training
– Research into training and methodology and the transfer of this research into police activities on the ground;
– Classroom, field and online training programmes for National Central Bureaus;
- Anti-corruption training, particularly in sport;
– Quality standards and accreditation.

(3) Operational and investigative support
– Identifying and addressing emerging crime threats, for example, Asian Organized crime;
– A platform for disaster victim identification;
– Incident response and major events support;
– A Command and Coordination Centre operations room reinforces those already in place in Lyon and in Buenos Aires, Argentina. This presence in three continents provides truly global operational support to our member countries.

It has been officially inaugurated in April 2015:

En français : Complexe Mondial INTERPOL pour l’Innovation : CMII

▻http://www.interpol.int/fr/Centre-des-m%C3%A9dias/Nouvelles/2015/N2015-039

Plusieurs organisations internationales étaient également représentées à la cérémonie d’ouverture, de même que des partenaires clés du secteur privé, parmi lesquels Entrust Datacard, Kaspersky Lab, NEC, Safran Morpho et Trend Micro Ltd.

En créant le CMII, INTERPOL s’assure d’être le mieux placé pour aider les polices du monde entier à lutter contre les nouvelles menaces grâce à l’innovation et la formation. Le CMII offrira un appui opérationnel et en matière de police scientifique, et contribuera au renforcement des capacités et à la mise au jour des cybermenaces.

Video presentation:

▻https://www.youtube.com/watch?t=45&v=0bJoICnTF9A

#Singapore
#INTERPOL
#cybersecurity
#cybercrime

Attention, ça va faire mal à SeenThis :

▻https://blog.mozilla.org/security/2015/04/30/deprecating-non-secure-http

« 1) Setting a date after which all new features will be available only to secure websites 2) Gradually phasing out access to browser features for non-secure websites, especially features that pose risks to users’ security and privacy. »

#HTTPS #Internet_security #privacy #Firefox #Mozilla

12月29日のツイート
▻http://twilog.org/ChikuwaQ/date-141229

My Tweeted Times tweetedtimes.com/ChikuwaQ?s=rgp - top stories by ggreenwald, ioerror, rosselin posted at 12:00:06

Top story: Inside the NSA’s War on Internet Security - SPIEGEL ONLINE www.spiegel.de/international/…, see more tweetedtimes.com/ChikuwaQ?s=tnp posted at 10:00:09

Papier is out! paper.li/ChikuwaQ/13277… Stories via @kiuchi_midori @gacougnol @yumitolesson posted at 09:13:45

#Obama Lets #N.S.A. Exploit Some #Internet Flaws, Officials Say
▻http://www.nytimes.com/2014/04/13/us/politics/obama-lets-nsa-exploit-some-internet-flaws-officials-say.html

WASHINGTON — Stepping into a heated debate within the nation’s intelligence agencies, President Obama has decided that when the National Security Agency discovers major flaws in Internet security, it should — in most circumstances — reveal them to assure that they will be fixed, rather than keep mum so that the flaws can be used in espionage or cyberattacks, senior administration officials said Saturday.

But Mr. Obama carved a broad exception for “a clear national security or law enforcement need,” the officials said, a loophole that is likely to allow the N.S.A. to continue to exploit security flaws both to crack encryption on the Internet and to design cyberweapons.

#failles #surveillance

2014-04-12
▻http://hroy.eu/notes/openssl-11

Wall Street Journal: The encryption flaw that punctured the heart of the Internet this week underscores a weakness in Internet security: A good chunk of it is managed by four European coders and a former military consultant in Maryland.

To answer some of the astonishing comments I made yesterday, the lack of contributors to the project is baffling. So: the whole Internet relied on 10 volunteers and 1 employee and nobody helped them?

I guess this sort of comes back to one of the essential question in Free Software: how do you get the users to fund it? For some kind of software, this can be difficult; but in the case of OpenSSL I would have thought this to be an easy thing, since so many banks and web companies intensively rely on it.

But apparently, they didn’t care at all if this (...)

Meet the people who hold the keys to worldwide internet security via @stephane
The Guardian | James Ball 28/02/2014
▻http://www.theguardian.com/technology/2014/feb/28/seven-people-keys-worldwide-internet-security-web

Voilà la cérémonie qui a lieu tous les trois mois, pour s’assurer de l’intégrité du #DNS ; apparemment l’#Icann prépare un nouveau système de vérification (d’ici trois à cinq ans), qui rendra la perte ou la corruption de la « clé maître » beaucoup plus dangereuse pour la #sécurité de l’#Internet.

It might be a fairly typical office scene, were it not for the extraordinary security procedures that everyone in this room has had to complete just to get here, the sort of measures normally reserved for nuclear launch codes or presidential visits. The reason we are all here sounds like the stuff of science fiction, or the plot of a new Tom Cruise franchise: the ceremony we are about to witness sees the coming together of a group of people, from all over the world, who each hold a key to the internet. Together, their keys create a master key, which in turn controls one of the central security measures at the core of the web. Rumours about the power of these keyholders abound: could their key switch off the internet? Or, if someone somehow managed to bring the whole system down, could they turn it on again?

http://static.guim.co.uk/sys-images/Guardian/Pix/pictures/2014/2/26/1393416638927/A-smartcard-is-handed-ove-011.jpg

The keyholders have been meeting four times a year, twice on the east coast of the US and twice here on the west, since 2010. Gaining access to their inner sanctum isn’t easy, but last month I was invited along to watch the ceremony and meet some of the keyholders – a select group of security experts from around the world. All have long backgrounds in internet security and work for various international institutions. They were chosen for their geographical spread as well as their experience – no one country is allowed to have too many keyholders. They travel to the ceremony at their own, or their employer’s, expense.

What these men and women control is the system at the heart of the web: the domain name system, or DNS.

#cybersécurité surtout donc (et #spectacle de... dixit Bruce Schneier : « This process is both technical and political, which makes it extra complicated… ») un peu de #NSA et de #gouvernance_internet aussi.

Hier j’ai écrit un truc sur la #résilience (que j’ajouterai ici quand il sera en ligne), mais cet article m’avait échappé, too bad.

The east and west coast ceremonies each have seven keyholders, with a further seven people around the world who could access a last-resort measure to reconstruct the system if something calamitous were to happen. Each of the 14 primary keyholders owns a traditional metal key to a safety deposit box, which in turn contains a smartcard, which in turn activates a machine that creates a new master key. The backup keyholders have something a bit different: smartcards that contain a fragment of code needed to build a replacement key-generating machine. Once a year, these shadow holders send the organisation that runs the system – the Internet Corporation for Assigned Names and Numbers (#Icann) – a photograph of themselves with that day’s newspaper and their key, to verify that all is well.

Le Point avait rencontré l’une de ces personnes clés, si j’ose dire, de l’#Internet :
▻http://seenthis.net/messages/143108

Elles sont 21 en tout, trois groupes de sept, avec un minimum de trois personnes d’un même groupe réunies physiquement pour chaque « cérémonie » :

All but one of the 21 keyholders has been with the organisation since the very first ceremony. The initial selection process was surprisingly low-key: there was an advertisement on Icann’s site, which generated just 40 applications for 21 positions. Since then, only one keyholder has resigned: Vint Cerf

An Open Letter from US Researchers in Cryptography and Information Security
▻http://masssurveillance.info

Media reports since last June have revealed that the US government conducts domestic and international #surveillance on a massive scale, that it engages in deliberate and covert weakening of Internet security standards, and that it pressures US technology companies to deploy backdoors and other data-collection features. As leading members of the US #cryptography and information-security research communities, we deplore these practices and urge that they be changed.

“But there’s actually been a significant uptick this year in a completely different kind of attack, one that can be carried out by anybody, at a distance, using Internet route hijacking. [...] In practical terms, this means that Man-In-the-Middle BGP route hijacking has now moved from a theoretical concern to something that happens fairly regularly, and the potential for traffic interception is very real.”

▻http://www.renesys.com/2013/11/mitm-internet-hijacking

#BGP #Internet_security

Why you should be worried about the ITU’s bizarre claim to have a mandate over Internet security:
►http://www.techdirt.com/articles/20121004/02262820588/why-you-should-be-worried-about-itus-bizarre-claim-to-have-mandate-over-in - given the ITU’s governance track record, I’m very worried.

Twitter Réseaux sociaux

The Twitter Underground Economy: A Blooming Business | The Barracuda Labs Internet Security Blog

►http://www.barracudalabs.com/wordpress/?p=2989

The Twitter Underground Economy: A Blooming Business
– A study on Dealers, Abusers and fake Twitter Accounts
by Jason Ding, Research Scientist

Many people dream of becoming popular or famous, and Twitter provides an outlet to make this possible. Most Twitter users try the standard way to get popular and gain followers: constantly tweet funny quotes or comments, discuss breaking events, or disclose information that many people want (like Guy Adams did). However, some Twitter users look for unusual ways to make themselves appear more desirable and become popular faster. One of these ways is buying Twitter followers, which right or wrong, is a significantly growing trend.

Blacklist Bill allows Feds to remove websites from Internet
►http://www.digitaljournal.com/article/313463

The House version of the Internet Blacklist Bill was released October 26, 2011, with no effort to fix problems that existed in the Senate version. A violation of the First Amendment, it is contrary to official positions of internet freedom and censorship.

....

The S.968 bill is considered dangerous and short-sighted due to its broad writing that covers a multitude of issues, bringing danger to not only Internet security but is considered a serious threat to free online speech and innovation. The Censorship-galore Department describes it as an attempt to build the Great Firewall of America, requiring service providers to block access to certain websites.
This bill could shut down YouTube, Twitter and many other social websites that bring together the Occupy movements across the nation and world---any user-generated content site where the law can make the sites’ owners legally responsible for the posted content of its users.

Au bas mot 676 organisations certifient - mal - la #sécurité des sites #internet ; #cybersécurité #certification

An Attack Sheds Light on Internet Security Holes

▻http://www.nytimes.com/2011/04/07/technology/07hack.html

“The encryption used by many Web sites to prevent eavesdropping on their interactions with visitors is not very secure. This technology is in use when Web addresses start with “https” (in which “s” stands for secure) and a closed lock icon appears on Web browsers. These sites rely on third-party organizations, like Comodo, to provide “certificates” that guarantee sites’ authenticity to Web browsers.”

“But many security experts say the problems start with the proliferation of organizations permitted to issue certificates. Browser makers like Microsoft, Mozilla, Google and Apple have authorized a large and growing number of entities around the world — both private companies and government bodies — to create them. Many private “certificate authorities” have, in turn, worked with resellers and deputized other unknown companies to issue certificates in a “chain of trust” that now involves many hundreds of players, any of which may in fact be a weak link.”