Friday 21 June 2013

WikiLeaks Says It Is Working to Negotiate Asylum in Iceland for Snowden

WASHINGTON — WikiLeaks activists in Iceland are discussing with government officials there the possibility of asylum for Edward J. Snowden, the former National Security Agency contractor who disclosed hundreds of classified documents on N.S.A. surveillance, Julian Assange, the founder of the antisecrecy group, said Wednesday.
“We are in touch with Mr. Snowden’s legal team and are in the process of brokering his asylum in Iceland,” Mr. Assange said in a conference call with reporters. He said both the legal and practical obstacles were under review by Mr. Snowden’s lawyers and supporters.
A spokeswoman for Iceland’s embassy in Washington confirmed that the government had been approached by advocates for Mr. Snowden but would not comment further.
Mr. Snowden, 29, whose leak of National Security Agency documents has shaken American officials and fueled a public debate about government surveillance, is believed to be in hiding in Hong Kong. He has acknowledged that he is likely to be prosecuted for the unauthorized disclosures and has expressed both interest in asylum in Iceland and concern about whether he would be safe there.
American officials have confirmed that Mr. Snowden is under investigation, but he has not been charged publicly. Indictments are sometimes kept secret to avoid alerting the defendant. 
Mr. Assange himself understands the complications of hiding out from possible criminal prosecution. As of Wednesday, he had spent a year in Ecuador’s embassy in London, where he fled to avoid being sent to Sweden to face questioning in a sexual offense investigation. He and WikiLeaks are the subjects in a separate leak inquiry by a federal grand jury in Alexandria, Va., and he has expressed concern that Sweden might send him to the United States to face charges.
Christopher L. Blakesley, a law professor at the University of Nevada Las Vegas, said that Iceland “would be a smart choice” for Mr. Snowden, because authorities there have shown sympathy for the cause of freedom of information and might act favorably on his asylum request.
Obama administration officials, meanwhile, are discussing whether the most contentious N.S.A. program revealed by Mr. Snowden — the agency’s routine collection of data on most telephone calls made in the United States — might be changed to mollify critics who believe it invades Americans’ privacy. One proposal would require the phone companies themselves to store the call data for five years and make it available to government investigators.
But the Federal Bureau of Investigation director, Robert S. Mueller III, warned Wednesday that such a change would slow investigators as they seek to stop terrorist attacks.
“The point being that it will take an awful long time,” Mr. Mueller told the Senate Judiciary Committee.
The National Security Agency director, Gen. Keith B. Alexander, hinted Tuesday at a House hearing that he was evaluating changes to the domestic calling log program and raised the issue of “speed in crisis” as a major disadvantage.
In his testimony, Mr. Mueller provided more details about why national security officials were wary of changing the system. First, he said, under current law companies are not required to retain such records, and some dispose of them in much less than five years. Second, rather than being able to instantly query the complete database to see who a suspect has been in contact with, he said, investigators would have to present legal paperwork to a half-dozen carriers and wait for them to gather and provide the records.
“In this particular area, where you’re trying to prevent terrorist attacks, what you want is that information as to whether or not that number in Yemen is in contact with somebody in the United States almost instantaneously so you can prevent that attack,” Mr. Mueller said. “You cannot wait three months, six months, a year to get that information, be able to collate it and put it together.”
Mr. Mueller did not explain why it would take so long for telephone companies to respond to a subpoena for phone data linked to a particular number, especially in a national security investigation.
Lawmakers also pressed Mr. Mueller to explain what attacks, if any, had been prevented by the N.S.A. surveillance programs disclosed by Mr. Snowden.
Mr. Mueller referred — in greater detail than was provided at Tuesday’s hearing — to newly declassified information linking the program to a case in which several men in San Diego were discovered to have sent about $8,500 to the Shabab, a terrorist group in Somalia.
Specifically, he said, the N.S.A. identified a terrorist-linked phone number in East Africa and ran the number against the domestic calls database, discovering that the suspect number had been in contact with a telephone number in San Diego. Investigators then used other legal authorities to find the name and address of the person who used the line in San Diego, and then obtained an individual warrant to start monitoring that line.
But two senators who have been especially critical of the phone records collection, Ron Wyden of Oregon and Mark Udall of Colorado, both Democrats, disputed intelligence officials’ assertions that the program has been critical in thwarting terrorist attacks. “We have yet to see any evidence that the bulk phone records collection program has provided any otherwise unobtainable intelligence,” they said in a statement.
Also on Wednesday, the chairman of the Privacy and Civil Liberties Oversight Board, a federal panel that is reviewing the N.S.A. programs, said members would sponsor a public discussion of the issues raised next month.
“Based on what we’ve learned so far, we believe further questions are warranted,” said David Medine, the board’s chairman, who was confirmed by the Senate in May and almost immediately faced the debate over N.S.A. monitoring. The five-member board was briefed on the programs by intelligence officials last week.
Mr. Medine said the board planned eventually to issue a public report and recommendations on the N.S.A. programs.
Michael S. Schmidt contributed reporting.

Top Eight Security Tips for Windows 8



Microsoft is releasing Windows 8, the newest version of the Windows operating system, for general availability on October 26. Although Windows 8 offers enhanced security features, it also raises new security concerns because of changes to the graphical user interface and a new online app store. We’re offering the following eight security tips to help you stay secure as you move to Windows 8.

1. Exercise caution with apps for the new Windows 8 user interface (formerly known as Metro)

Some familiar applications have been completely re-written for the new Windows 8 UI. As a result they may work completely differently, despite looking the same. For example, an application historically delivered as an executable could now be entirely web-based. This impacts the visibility your existing security and monitoring tools have into these apps.

2. Use the Windows 8 style UI version of Internet Explorer

By default, plugins are disabled, blocking a major target for exploit kits and Blackhole attacks.

3. Make sure your security vendor can flag malicious Windows 8 UI apps

Windows 8 UI apps have important differences from regular applications, and your security product should be able to distinguish the two. The security product should correctly flag malicious or modified Windows 8 UI applications (tampered, modified, invalid license).

4. Disable hard drive encryption hibernation

Hard drive encryption is a cornerstone of data protection. If possible, disable the hibernation option in Windows 8 through group policy, as it doesn’t always work well with encryption.

5. Make sure your hardware carries the “Designed for Windows 8” logo

To carry this logo, hardware must be UEFI compliant. This means you can take advantage of the secure boot functionality available in Windows 8. Secure boot is designed to ensure the pre-OS environment is secure in order to minimize the risk from boot loader attacks.

6. Make application control a priority

The Windows 8 app store makes application control increasingly important for both malware prevention and productivity control. While the Windows Store will be secured, history shows that malicious apps are likely to slip through. Disable the use of apps that aren’t relevant to your organization.

7. Treat Windows RT (ARM) devices like any other mobile devices

Make sure you impose the same security levels on Windows RT devices as all others. You should have the ability to control, track, remote wipe and encrypt them.

8. Review application permissions in the Windows Store

Applications in the Windows Store must list any resources they require. Carefully review these permissions in the details tab as some will grant access by default to your location information, calendar, etc.

Windows 8: Redmond’s Safest Operating System Ever?

 
With its Windows 8 operating system Microsoft has introduced sweeping changes to the desktop  environment. While much of the discussion around Redmond’s new operating system has been around the naming convention of its Modern UI interface and its touch-friendly tiles, it’s equally helpful to
examine Windows 8 from a security standpoint. Technology Features 

Secure Boot

The first feature owners of a new Windows 8 PC will benefit from is known as Secure Boot. All new PCs that are certified for Windows 8 must utilize the UEFI (Unified Extensible Firmware Interface) standard, rather than a traditional BIOS. UEFI must be configured to only launch boot loaders that are signed by trusted authorities. Vendors shipping Windows 8 certified machines will trust Microsoft’s signature, but are not prohibited from including others or allowing end-users to import their own.

This change will go a long way towards ending traditional boot sector malware. Going back to the 1980s MBR-based viruses and other malware have been able to hide simply due to the fact they are able to load before the operating system. Whatever your opinion on how this may restrict operating system choice,
ultimately, it’s a win for security. Immediately after Microsoft’s boot loader is launched it will validate the
signature of the Windows kernel and continue to the next new optional boot component, ELAM.

ELAM (Early Load Anti Malware) 

It is designed to enable security vendors to  validate non-Windows components loaded during startup. In addition to the Windows kernel verifying that all boot driver signatures are valid, a bare-bones
anti-malware engine may also be used to check drivers before they are loaded. Exactly how effective the feature will be against today’s sophisticated threats remains to be seen, but it’s a step in the right direction, and could prove useful in rootkit cleanup (e.g. in preventing malicious components from being loaded).
The last new boot component is known as Measured Boot and requires the PC to have a Trusted Platform Module (TPM) which is also enabled. All components loaded during the boot process will record measurements, such as how long they took to initialize, to the TPM.

After the boot is complete the results can be sent to a trusted external entity to verify that only wanted code was executed and that it behaved in an expected manner. Few computers today ship with TPMs and this seems like it could be highly error-prone. It remains to be seen whether the benefit will outweigh the
overhead, and additional cost.
Microsoft has also beefed up some of the more traditional exploit mitigation technologies introduced in Windows Vista and 7. Address space layout randomization (ASLR), data execution prevention (DEP) and heap randomization have all been updated to strengthen their protection against buffer overflow and
other stack-based attacks. For something nearly invisible to users, this should help to harden Windows against attacks.

User-Facing Features

So far all of the features we’ve evaluated have been “behind the scenes” work that shouldn’t impact day-to-day users of Microsoft’s latest OS. We will now explore how this new approach interacts with those users.

SmartScreen

SmartScreen, a technology Microsoft introduced in Internet Explorer 9, has now been expanded to cover all executables downloaded onto Windows 8 systems. SmartScreen is designed to take a checksum of an EXE and compare it to Microsoft’s cloud database of known good and bad application checksums. If the result is unknown, Microsoft will warn the user before execution that this program could be malicious and is of unknown provenance. Microsoft insists this feature protected millions of IE 9 users from harm, but I remain unconvinced.

In testing it reminded me of a constant false alarm that triggered scary messages frequently enough on innocent files that I learned to ignore the warnings and, occasionally, put myself in harm’s way.
Consumers will be happy to hear that Microsoft is now including basic anti-virus  protection courtesy of its Windows Defender tool. While most businesses require more comprehensive protection, not to mention centralized control, reporting and updating, home users will likely appreciate the basics being thrown in for no extra charge.
 
Microsoft’s free home anti-virus product, Security Essentials, hasn’t fared all that well in recent independent testing, but it should be good enough for most home users, and would likely stop freshly installed copies of Windows from being instantly compromised.

DirectAccess

DirectAccess was a nifty new VPN solution when first added to Windows 7, with one problem. It required IPv6 to operate, resulting in almost zero adoption. Windows 8 is taking another crack at it, but this time with IPv4 support. The concept of an always-on VPN is a good one and could likely go a long way towards protecting corporate users who frequently get online at unsecured WiFi hotspots at airports, hotels and coffee shops.

Windows To Go

Another security effort aimed at mobile users in enterprise environments is Windows To Go. This feature allows an enterprise licensed Windows 8 user to  take their entire desktop with them on a USB memory stick. It appears that Windows To Go is intended to go head to head with virtual desktop initiatives (e.g. booting from your PC from any PC that supports USB booting). Access to hard disks and other potentially dangerous peripherals is disabled when in To Go mode, but all of your files, preferences and programs are
there for your convenience. I could certainly see this being a safer option for companies who want employees to be able to connect from home PCs without opening up VPN access to untrusted home computers.

Modern User Interface

Last, but not least, is the much discussed Modern Interface and associated security features. Modern is based on the App Store concept that Apple pioneered with iOS. All applications (with one caveat) must be installed directly from Microsoft and must meet Microsoft’s privacy and safety standards.Walled gardens sound good, but the devil is in the details especially when you compare Apple’s approach with that of Google. Google Play has evolved into a safer world, but it has been plagued with many more issues that seem to result from Google trying to exercise less control and offer a more open playing field. Enterprise environments will have the option to load their own trusted certificate onto devices that will allow side-loading of applications. This is similar to iOS and is far more controlled than the tick-box approach that allows for a wild West of unknown applications being loaded on Android.

When applications are viewed in Microsoft’s store a granular list of requested permissions is available, similar to what is seen on Android devices. This list, however, is only available if you select the Details tab. There is no prompting to raise awareness of this privacy feature. This may be a good thing  as asking users to make decisions too frequently leads to the “always saying yes” problem that plagues SmartScreen, but it would be beneficial if the permissions appeared on the default installation screen rather than hidden behind a tab.

 IE 10 Windows 8

  introduces a new dual personality version of Internet Explorer 10. While IE is largely unchanged in “Desktop” mode, it operates in a far more limited mode when used as a Modern UI application.

The Modern UI IE eschews support for plugins, with the rare exception of a whitelist that allows Adobe Flash (which is native to IE 10) to execute on a Microsoft managed list of sites. With that comes the inability to patch when Adobe announces their availability as users will need to wait for a Microsoft update rollup. Enterprises that require Java or other proprietary plugins will find, in most cases, they will need to use Desktop mode, erasing most of the  advantages offered by the Modern UI.

The Safest Windows Ever In summary, Windows 8 isn’t blazing any innovative trails into a perfectly secure future; still, it offers improvements that can and will lead to a safer Windows experience. I don’t see anything (other than the new IE interface) that truly concerns me. The big question that remains is this: will enterprises with their investment in training and legacy hardware embrace an entirely new user interface so soon on the heels of Windows 7 deployments? I don’t think the incremental improvements in security will sway this decision, but there is no doubt that this is the safest Windows operating system ever.