The US National Security Agency (NSA) has released Phase One and Phase Two of its Zero Trust Implementation Guidelines.

The guidelines cover what's needed to achieve the Department of War's (DoW) targets for zero trust maturity.

Phase One and Phase Two aim to move an organization from discovery to target-level implementation by mapping out the activities, requirements, precursors and successors that are needed.

According to the NSA, the phased design of the guidelines means they're modular and highly customizable, allowing the implementation of both foundational and advanced activities, as well as the ability to tailor them to align with individual goals and constraints.

They build on the NSA's Primer and Discovery Phases, released earlier this month, and are aligned with existing federal frameworks, including the DoW CIO’s Zero Trust Framework.

What the zero trust guidelines get right

Brian Soby, CTO and co-founder of AppOmni, said there's a lot that the guidelines get right, adding that the move represents a positive step in helping organizations shore up identity security.

"The guidance pushes maturity beyond 'authenticate, then trust', toward ongoing decisions driven by what the user is doing, what privileges are being requested, and what resources are being touched," he said.

"That matters because the attacks that are winning right now are post-auth. Device posture and login checks are necessary, but against modern SaaS compromise they can be largely performative if you cannot detect abuse happening inside the session, inside the application."

Soby also praised the way that zero trust is presented as an operating model, not a product.

Policies are required to be centrally defined, consistently applied, continuously assessed, and enforced through co-ordinated policy decision points and policy enforcement points.

This includes requirements for real-time monitoring and automation to adapt as conditions change.

When it comes to User and Entity Behavior Analytics (UEBA), Soby noted the guidance takes the right approach, focusing on behavior baselining, analytics, and context enrichment so that anomalies are detected based on behavioral patterns and resource access, not just simplistic indicators like login location.

"That's the right direction. ‘We saw a new IP’ is a weak signal,” he commented. “The higher-signal story is what happened in the application: Privilege use, data access, configuration changes, creation of integrations, unusual exports, and lateral movement across SaaS capabilities.

"The higher-signal story is what happened in the application: Privilege use, data access, configuration changes, creation of integrations, unusual exports, and lateral movement across SaaS capabilities."

Why some zero trust efforts fall flat

Soby warned that most zero trust implementation projects are missing the core points. A key factor here is that they focus too heavily on zero trust network access (ZTNA) considerations, and ZTNA-only architectures are often easier to bypass.

Meanwhile, organizations fail to recognize that each application is its own policy decision point and policy enforcement point.

“This is the core point that gets ignored. The guidance treats policy decision points and policy enforcement points as essential building blocks that must be coordinated. The problem is that many organizations pretend the only real decision and enforcement happens at the identity provider or a proxy," he said.

"In reality, every application, SaaS or otherwise, is itself a policy decision point and policy enforcement point. The application decides what a user, integration, service account, or agent can do, and it enforces that decision.”

Soby noted this is “especially true” in cases where identities don’t “traverse the enterprise front door” - for example, with customers, partners, and external collaborators.

FOLLOW US ON SOCIAL MEDIA

The US National Security Agency (NSA) has released a cloud security guide aimed at helping organizations protect themselves against a growing wave of threats. 

Cloud computing continues to grow as organizations move their applications and data out of their own data centers and into the cloud. 

Research from Gartner predicts that, by 2028, as much as 70% of IT workloads will be running in a cloud environment, up from just 25% in 2023.

While cloud computing can be more secure than applications hosted on-premise, that doesn’t mean it is without its own particular risks, which are often underestimated.

Cloud security tips you need to know

As organizations continue to migrate more of their data and services to cloud environments, attackers will increasingly attempt to compromise those environments, the agency said.

“Using the cloud can make IT more efficient and more secure, but only if it is implemented right,” said Rob Joyce, NSA’s Director of Cybersecurity.

“Unfortunately, the aggregation of critical data makes cloud services an attractive target for adversaries.”

The NSA’s top ten cloud security mitigation strategies aim to inform cloud customers of the most important practices they can adopt.

Understand who is responsible for security

Problems can arise when customers assume the cloud service provider (CSP) is securing something – when it’s actually the customer’s job. The NSA said customers must understand the CSP’s shared responsibility model which identifies who is responsible for security.

That model will vary from service to service (it may be different for SaaS, PaaS, or IaaS) and will also vary by supplier, so pay close attention to documentation.

“Direct engagement with the CSP may sometimes be necessary to understand their service,” the NSA notes.

Secure your accounts

Identity and access management (IAM) are critical to securing cloud resources. 

Attackers will attempt to gain access to cloud services in many ways, perhaps by using phishing techniques to steal passwords, or by scooping up exposed credentials, or by beating weak authentication practices.

Once in, they can use over-generous account privileges to get further into the system.

To prevent this, cloud users should use identity and access management technologies including multifactor authentication and properly managed temporary credentials.

“Access control policies should be carefully configured to ensure users are granted the least privileges necessary,” the NSA said.

Think about your key management

Cloud suppliers will offer a number of ways of handling key management. 

These can range from relying on the cloud vendor for fully delegated server-side encryption, to a full client-side encryption method: often organizations will rely on the CSP for at least a portion of key management, encryption, and decryption.

Whichever route they choose, users need to understand the risks and benefits to each option and their roles and responsibilities.

Use network segmentation and encryption

The NSA said that Zero Trust network security practices should be used to protect organizational data.

End-to-end encryption of all data in transit to, from, and within the cloud is also key to protecting data in the cloud, the recommendations said.

“Be aware that data passed between customer resources in the cloud may traverse the internet, and take precautions to encrypt such data,” the guidance said.

Concentrate on data security in the cloud

Data stored in the cloud can be an attractive target for attackers looking either to steal or ransom it. 

That means using encryption and data access policies such as role-based access control and attribute-based access controls to protect information.

Both user and system accounts should only be given the minimal level of access needed to perform tasks by their cloud administrators, the NSA guidance said.

“Object storage is one of the most exploited data storage methods because of its popularity and how easily it can be misconfigured. Applying proper access policies to Object storage will prevent unintentional data exposure,” it said.

The NSA said organizations should consider enabling “soft delete” features to reduce the impact of accidental or malicious deletions.

Don’t forget your software pipeline

Continuous integration and continuous delivery (CI/CD) pipelines are frequently deployed in the cloud, which makes them highly valuable targets for attackers.  

Organizations should make sure they are using strong identity and access management policies, keeping tools up to date, auditing logs and implementing security scanning.

Think about implementing Infrastructure as Code

Infrastructure as Code (IaC) automates the deployment of cloud resources and this can reduce the chance of misconfigurations and “ghost assets” introduced by human error, the agency said. 

After deploying IaC, organizations should dynamically test deployed resources, ensure access and version controls are enabled, avoid manual changes, and continuously log and monitor resources, the NSA said.

Remember the added complication of hybrid multi-cloud

Hybrid cloud and multi-cloud environments bring a new set of security challenges with them. 

The risk is that using multiple clouds creates silos and skill gaps, which may lead to “configuration discrepancies, unnecessary data flows, insecure IAM, loss of visibility, and exploitable security gaps,” the NSA said.

The agency added that standardizing vendor-agnostic cloud tools helps organizations to maintain and monitor multiple environments.

Be aware of Managed Service Provider (MSP) security risks

Using an MSP effectively increases an organization’s attack surface, so you need to make sure that security is a priority when choosing an MSP. 

That means picking providers that comply with the security standards and practices important to you. Organizations should audit MSP accounts and operations in the environment, with a focus on privileged accounts.

Use cloud logs to spot trouble

Cloud systems involve many users accessing shared resources and services. This can make it hard for defenders to see what is really going on. 

But while cloud services do offer logging services, their default settings vary, so it’s important to make sure these are configured so that hackers cannot roam with impunity.

The NSA said security professionals can use tools, such as security information and event management (SIEM) systems, log analysis software, and anomaly detection services, to analyze the logs for indicators of compromise.

That might include unusual login attempts, network traffic patterns, and anomalous system events.

Hackers backed by China are breaking into the networks of US companies so they are able to launch destructive cyber attacks against critical infrastructure in the event of a major crisis or conflict.

In their attempts to gain access to systems the attackers are paying particular attention to network and IT staff who often hold the keys to the system.

The warning from the National Security Agency (NSA), FBI and the US Cybersecurity and Infrastructure Agency (CISA) is a remarkably detailed breakdown of how a Chinese state-backed group, known as Volt Typhoon, has compromised the networks of multiple critical infrastructure organizations across communications, energy, transportation systems, and water sectors.

The agencies said the hackers had maintained their access and footholds within some network for “at least” five years. Some victim companies are smaller organizations with few security skills, which provide critical services to larger organizations.

The hackers’ targets and behavior isn’t typical of cyber espionage or intelligence gathering operations, the agencies said – leading them to believe that the hackers are instead positioning themselves so they can disrupt operations across critical infrastructure in the event of potential geopolitical tensions or military conflicts with China.

What is striking about this is how careful they are and how much research they do.

According to the advisory, the Volt Typhoon group conducts extensive pre-compromise reconnaissance to learn about the target organization, its network, and its staff.

That includes searches for network information and “especially for information on key network and IT administrators”. In some instances, the agencies said they had observed Volt Typhoon actors targeting the personal emails of key network and IT staff.

They said the hackers have been observed strategically targeting the web browsing data of network administrators, “focusing on both browsing history and stored credentials” to help them target personal email addresses for further information – for example to discover any possible network modifications that may impact the threat actor’s persistence within victim networks.

The reconnaissance the attackers conduct helps them to gain access and also helps them avoid scrutiny.

“The intelligence gathered by Volt Typhoon actors is likely leveraged to enhance their operational security. For example, in some instances, Volt Typhoon actors may have abstained from using compromised credentials outside of normal working hours to avoid triggering security alerts on abnormal account activities,” the agencies said.

Targeting the accounts of IT staff is a common tactic for hackers because these accounts usually have much wider access than standard user accounts; this is why administrator accounts are usually more carefully protected by techniques such as multifactor authentication.

However, the level of research being done in these attacks reflects how this group is working to a different agenda to many others - and is a reminder to all organizations to make sure they have protection in place across these accounts.

The advisory said organizations should deliver security training tailored to network IT personnel/administrators and other key staff.

“For example, communicate that Volt Typhoon actors are known to target personal email accounts of IT staff, and encourage staff to protect their personal email accounts by using strong passwords and implementing MFA,” it said.

The advisory also gives more detail on how the hackers achieve their access to the networks and manage to stay hidden so long.

They gain initial access to the network by exploiting known or zero-day vulnerabilities in public-facing network appliances. These flaws might be in routers, virtual private networks and firewalls. After this they connect to the victim’s network via VPN for follow-on activities.

In particular, the hackers want to gain administrator credentials within the network. They often do this by exploiting privilege escalation vulnerabilities in the operating system or network services, or by stealing credentials unwisely stored on a public-facing network appliance.

The attackers try to find out more about the network including the “discreet extraction” of security event logs and the Active Directory database which contains data on user accounts, passwords in hashed form, and other sensitive data. They probably then use offline password cracking techniques to decipher these hashes, in order to gain further network access.

The agencies said the hackers are focused on gaining access to operational technology assets.

“This access enables potential disruptions, such as manipulating heating, ventilation, and air conditioning (HVAC) systems in server rooms or disrupting critical energy and water controls, leading to significant infrastructure failures (in some cases, Volt Typhoon actors had the capability to access camera surveillance systems at critical infrastructure facilities).”

The group is careful to stay hidden, limiting their activity after breaking inn, “suggesting their objective is to maintain persistence rather than immediate exploitation,” the advisory said, with the hackers revisiting targets over a number of years to confirm their access.

In one incident at an organization in the water industry, the attackers connected to the network via a VPN with administrator credentials they obtained and opened an RDP session with the same credentials to move laterally.

Over a nine-month period, they moved to a file server, a domain controller, an Oracle Management Server, and a VMware vCenter server. The aim was, most likely, to gain access to the nearby operational technology assets involved with water treatment.

Organizations globally have been urged to remain vigilant amid an ongoing hacking campaign that leverages office networking devices to target critical national infrastructure (CNI) assets. 

Research from Microsoft this week revealed that attacks carried out by Volt Typhoon, a Chinese state-sponsored group that commonly focuses on espionage and intelligence gathering, are specifically targeting CNI organizations. 

Microsoft said Volt Typhoon relies “almost exclusively” on living-off-the-land (LOTL) techniques and hands-on-keyboard activity. 

LOTL attacks typically see attackers compromise a victim’s system and use the systems and tools that are already installed to achieve their goals, rather than executing their own code or malware payloads, for example.

“To achieve their objective, the threat actor puts strong emphasis on stealth in this campaign,” said Microsoft, which assisted the Five Eyes investigation. 

“They issue commands via the command line to (1) collect data, including credentials from local and network systems, (2) put the data into an archive file to stage it for exfiltration, and then (3) use the stolen valid credentials to maintain persistence.”

As part of the campaign, Volt Typhoon has been observed blending into normal network activity by routing traffic through compromised small office and home office (SOHO) network equipment. This includes routers, firewalls, and VPN hardware.

Microsoft confirmed that a number of devices, including those manufactured by ASUS, Cisco, D-Link, Netgear, and Zyxel are at risk and urged owners of these devices to ensure interfaces are not exposed to the public internet to mitigate threats. 

“Owners of network edge devices should ensure that management interfaces are not exposed to the public internet in order to reduce their attack surface,” the firm said in a blog post. 

“By proxying through these devices, Volt Typhoon enhances the stealth of their operations and lowers overhead costs for acquiring infrastructure.”

Marc Burnard, senior consultant for information security research at Secureworks, said that targeting network devices is a common tactic employed by threat actors such as Volt Typhoon, which is also tracked as ‘Bronze Silhouette’.

This enables the group to ‘blend in’ to network traffic and operate behind the scenes with impunity, thereby gaining a stronger foothold and compromising additional assets. 

“From our first-hand observations, we determine the group to have a consistent focus on operational security including a minimal intrusion footprint, defense evasion techniques, and use of compromised infrastructure,” he said. 

“Think of a spy going undercover, their goal is to blend in and go unnoticed. This is exactly what Bronze Silhouette does by mimicking usual network activity.”

Burnard added that these tactics highlight the group’s “operational maturity and adherence to a modus operandi” that focuses specifically on reducing the likelihood of detection. 

Five Eyes response to Chinese hacking threat

The campaign by Volt Typhoon has prompted Five Eyes security agencies to issue an urgent warning to critical infrastructure organizations. 

The UK’s National Cyber Security Centre (NCSC) issued a joint statement with the equivalent authorities from the US, Canada, Australia, and New Zealand calling for heightened vigilance amid the ongoing attacks. 

“It is vital that operators of critical national infrastructure take action to prevent attackers hiding on their systems, as described in this joint advisory with our international partners,” said Paul Chichester, director of operations at the NCSC. 

“We strongly encourage UK essential service providers to follow our guidance to help detect this malicious activity and prevent persistent compromise.”

According to Microsoft, the purpose of the campaign by Volt Typhoon appears to have broader geopolitical goals amid rising tensions between the US and China. 

The group has been active since mid-2021, the firm revealed, and has already targeted critical infrastructure organizations in the United States and Guam, a key site for US military activities in the Pacific. 

“Microsoft assesses with moderate confidence that this Volt Typhoon campaign is pursuing development of capabilities that could disrupt critical communications infrastructure between the United States and Asia region during future crises.”

The US Department of Justice (DoJ) has revealed details of a joint operation in which Western agencies used a custom tool to destroy a decades-old Russian malware operation.

Use of a tool named ‘PERSEUS’ nullified a worldwide network of devices that had been infected with the Snake malware by threat actors in the group Turla.

A number of agencies including the NSA, FBI, and the Cybersecurity and Infrastructure Security Agency (CISA) led the operation codenamed ‘Medusa’.

Snake had been used to exfiltrate sensitive information from devices across 50 or more countries, including NATO governments and journalists, but the FBI-created PERSEUS was used to force the malware to overwrite its data without damaging infected devices.

Turla has been linked directly with the Federal Security Service of the Russian Federation (FSB) and has used Snake since 2003.

“For 20 years, the FSB has relied on the Snake malware to conduct cyber espionage against the United States and our allies – that ends today,” said Matthew G. Olsen, assistant attorney general, at the Justice Department’s National Security Division. 

“The Justice Department will use every weapon in our arsenal to combat Russia’s malicious cyber activity, including neutralizing malware through high-tech operations, making innovative use of legal authorities, and working with international allies and private sector partners to amplify our collective impact.”

Snake is able to function on Windows, macOS, and Linux under a high level of stealth, and has been operated in a tactical manner to hit specific targets.

It was found and destroyed on multiple US-based systems through a search warrant authorizing remote access to computers believed to have been compromised by the malware.

On some occasions, Turla was observed to have sent Snake to victims multiple times to ensure infection and exfiltration of data.

A joint cyber security advisory by the agencies described the malware as “the most sophisticated cyber espionage tool in the FSB’s arsenal”.

The malware’s network communications are encrypted and fragmented, and it has its own HTTP and TCP protocols that have allowed it to operate unseen on top legitimate networks.

In the wild, it has been found intercepting each client-to-server packet in a TCP session to check for Snake-specific instructions.

Snake can redirect all relevant packets to its own process function while redirecting all other packets to their respective applications to avoid detection.

Turla, based in Russia, has previously hijacked Iranian cyber espionage resources to launch masked attacks on Western victims.

Researchers at Microsoft Threat Intelligence, which tracks Turla under the name Secret Blizzard, also included findings that the group engaged in cyber warfare across Ukraine in its report marking a year since Russia’s invasion.

The DoJ has urged organizations to review its joint advisory for advice on Snake detection and remediation.

It noted that a keylogger has often been deployed with Snake, which hackers could use to steal passwords even after the first malware package has been nullified.

The National Security Agency (NSA) has recommended only using 'memory safe' languages, like C#, Go, Java, Ruby, Rust, and Swift, in order to avoid exploitable memory-based vulnerabilities.

The agency explained that memory issues in software make up a large portion of exploitable vulnerabilities. Due to this concern, the authority has advised developers to consider moving from programming languages with little or no memory protection, like C and C++, to a memory safe language.

Memory-safe languages provide various degrees of memory usage protections, and the agency recommended using code hardening defences, like tool analysis or operating system configurations, as well. By doing this, many memory vulnerabilities can be prevented, mitigated, or made harder for cyber actors to take advantage of.

The US security agency underlined that exploitable software vulnerabilities are still frequently based on memory issues. This includes overflowing a memory buffer or leveraging issues with how software allocates and deallocates memory.

Popular languages, like C or C++, provide a lot of freedom and flexibility when it comes to memory management, said the NSA. Here, the programmer must perform the checks on memory references and if they make a mistake, it can lead to exploitable memory-based vulnerabilities.

“While the use of added protections to non-memory safe languages and the use of memory safe languages do not provide absolute protection against exploitable memory issues, they do provide considerable protection,” stated the NSA. “Therefore, the overarching software community across the private sector, academia, and the US Government have begun initiatives to drive the culture of software development towards utilising memory safe languages.”

The NSA did say software analysis tools are able to detect instances of memory management issues, while operating environment options can provide protection too. However, it underlined the protection offered by memory safe software languages can prevent or mitigate most memory management issues.

Despite the warning, however, transitioning to memory safe languages, for many businesses, is not practical. “There are trillions of lines of code being used today written in C/C++ making it impossible to consider rewriting it all into a memory safe language,” said professor John Goodacre, director of the UKRI’s Digital Security by Design (DSbD) challenge and professor of computer architectures at the University of Manchester.

“Even when new code uses such languages, it's inevitable that it will be relying on code written in an unsafe language through its use of libraries or an operating system. Further, many of the higher-level languages are sandboxes by their runtime making them unsuitable for many classes of applications.”

Goodacre explained that in DBsD, an initiative supported by the British government, a new approach known as CHERI has been applied to both Arm and Risc-V prototype chips. He said this makes the hardware itself memory safe and brings memory safety to existing software and offers resilience and security features for new code.

“The risk from memory unsafe code is significant with around 70% of ongoing reported vulnerabilities rooted in such issues,” said Goodacre. “Moving to CHERI enabled hardware will not only block exploitation of these memory safety vulnerabilities, but it also offers developers new capabilities that reduce the risk that bugs find their way into production, increasing developer productivity.”

Cyber security specialists at the US government have warned critical infrastructure network defenders to "adopt a heightened state of awareness" against Russian state-sponsored cyber attacks.

The Federal Bureau of Investigation (FBI), Cyber Security and Infrastructure Security Agency (CISA), and the National Security Agency (NSA) issued a joint advisory on Tuesday providing an overview of the commonly used tactics and techniques used by Russian state-backed threat actors so the security community can take a more proactive stance on threat hunting.

The trio of federal agencies said these Russian hackers typically exploit flaws in popular enterprise products, listing known issues in products including Cisco routers (CVE-2019-1653), Oracle WebLogic (CVE-2020-14882), Citrix (CVE-2019-19781), Pulse Secure (CVE-2019-11510), and Microsoft Exchange (CVE-2020-0688).

"Russian state-sponsored APT actors have also demonstrated sophisticated tradecraft and cyber capabilities by compromising third-party infrastructure, compromising third-party software, or developing and deploying custom malware," the joint advisory reads. "The actors have also demonstrated the ability to maintain persistent, undetected, long-term access in compromised environments - including cloud environments - by using legitimate credentials.

"In some cases, Russian state-sponsored cyber operations against critical infrastructure organisations have specifically targeted operational technology (OT)/industrial control systems (ICS) networks with destructive malware."

Organisations are recommended to apply a range of mitigations to ensure functional resilience and lower the risk of compromise. These include measures such as confirming reporting processes, minimising personnel gaps in security coverage, following industry best practices for identity and access management, and proactively monitoring threat feeds for patches.

Because Russian threat actors have a history of lingering in networks undetected for long periods of time, the FBI, NSA, and CISA recommend all critical infrastructure organisations to also implement robust log collection and retention, to aid incident investigations, and to proactively look for behavioural irregularities such as password spray attempts and detecting use of compromised credentials.

The trio of agencies also highlighted a number of incidents in recent history where Russian state-sponsored hackers have been found to attack local governments and critical infrastructure.

From September 2020 to "at least" December 2020, Russian attackers targeted "dozens" of state, local, tribal, and territorial governments, as well as aviation networks, succeeding in extracting data from multiple victims.

They also pointed to Russia's instruction campaign in the US' energy sector between 2011 and 2018, deploying malware specially crafted for critical infrastructure environments and stealing data related to the industry.

"When the FBI, CISA and NSA team up to issue a joint alert about Russian state-sponsored APTs, every security team on the planet needs to sit up and take notice," said Dr Süleyman Özarslan, co-founder of Picus Security to IT Pro. "This alert highlights the seriousness and prevalence of ongoing malicious cyber operations by Russian state-sponsored APT actors. It should also be of great assistance to the cybersecurity community in reducing the risk posed by these threats."

The advisory comes as US officials join Russia's representatives in Geneva to discuss Russia's potential invasion of Ukraine, a country which was also on the receiving end of Russian hackers targeting critical infrastructure between 2015 and 2016, the advisory noted.

Cyber security expert and former CISA director Chris Krebs suggested the timing of the advisory's publication could be interpreted as a warning to US organisations to prepare for the Geneva talks to go south, which they reportedly are after eight hours of discussions.

The National Security Agency (NSA) has issued guidance for enterprises whose users encrypt their Domain Name System (DNS) requests. It’s advised administrators to block external DNS providers supporting a key encryption standard called DNS over HTTPS (DoH).

DoH encrypts requests made using the DNS protocol, which resolves web addresses to IP addresses, so browsers and other software know where to find them. DNS requests are traditionally unencrypted, meaning anyone snooping on a network connection, like a public Wi-Fi hotspot, could monitor someone's browsing habits and hijack their destinations.

DoH encrypts those requests using the same HTTPS protocol that websites use to encrypt and verify browser sessions, blocking snoopers. However, the NSA warns it can provide a false sense of security.

For example, it only encrypts the initial request, not the traffic sent afterward, meaning a snooper could still detect the IP addresses a victim is visiting and infer their browsing habits that way.

The agency also warns that the DNS resolver, which serves the DNS request, still decrypts the request to fulfill it.

There’s another danger in using external DNS resolvers that support DoH, the advisory says. Querying them directly bypasses any protections an enterprise DNS resolver has in place, such as filtering malicious websites.

The NSA suggests companies block unauthorized external DoH resolvers and only use their enterprise DNS resolvers when supporting DoH. It also recommends breaking and inspecting any traffic encrypted using TLS to block unauthorized DoH requests.

DoH is likely to gain more traction thanks to increased support from browser vendors. Mozilla launched default DoH support for US users in February 2020, and Microsoft has also tested support using its Windows 10 client.

Last May, the Department of Homeland Security's Cybersecurity & Infrastructure Security Agency (CISA) warned federal CIOs that they were legally bound to use its internal EINSTEIN network security system for resolving DNS queries, even though it didn’t yet support encrypted requests. However, CISA issued a request for information last year to explore an upgrade to its DNS resolver, which would support DNS encryption.

DoH isn't the only DNS encryption option available. Another, called DNS over TLS, uses the Transport Layer Security mechanism to encrypt DNS requests.

Oblivious DoH (ODoH), another standard proposed by CloudFlare and Apple, would improve security by introducing a proxy between the client and the resolver to obfuscate request traffic.

The NSA noted that it didn’t address DNS over TLS or ODoH in its guidance.

The NSA guidance failed to mention another technology, dnscrypt-proxy. Dnscrypt-proxy is based on the OpenDNS-developed dnscrypt encryption technology, which achieves similar outcomes to ODoH.

The National Security Agency (NSA) has advised those involved in sensitive lines of work, as well as the privacy-conscious, to deactivate many common smartphone features to prevent leaking insights from their location data.

Equipment such as wireless sniffers can be used to track your location data through any combination of GPS and wireless signals such as Wi-Fi and Bluetooth, even if mobile phone service is deactivated, the NSA has claimed.

Even if all wireless radios are disabled on your smartphone, various sensors on your device provide sufficient data to calculate location, while Bluetooth settings in some devices mean it can never truly be disabled, betraying your data.

The risk extends beyond smartphones, to Internet of Things (IoT) devices and fitness trackers as well as smart medical devices and built-in vehicle communications. Apps and social media services, meanwhile, may collect and aggregate data that exposes a user’s information. Many of these request permission for location and other resources that are not needed for their functioning.

“Location data can be extremely valuable and must be protected. It can reveal details about the number of users in a location, user and supply movements, daily routines (user and organizational), and can expose otherwise unknown associations between users and locations,” the advisory said.

“Mitigations reduce, but do not eliminate, location tracking risks in mobile devices. Most users rely on features disabled by such mitigations, making such safeguards impractical. Users should be aware of these risks and take action based on their specific situation and risk tolerance.”

The organisation, speaking to the sensitive nature of the work done by US security officials and others in sensitive roles, added that users should apply mitigations to the greatest possible extent.

Those concerned about compromising their location data should disable location services as well as Bluetooth and Wi-Fi when these services aren’t needed. Airplane mode should also be enabled when devices aren’t in use.

In addition, apps should be given as few permissions as possible, including setting privacy settings to ensure apps are not using or sharing location data. Users should also avoid using apps related to location if possible since these inherently expose user location data.

Among other changes, advertising permissions should also be disabled to the greatest possible extent and the advertising ID should be reset on a regular basis, weekly at a minimum. This is in addition to using a virtual private network (VPN), turning off features that allow you to track a lost or stolen device, and minimise web browsing.

Update your Windows 10 computers now — the latest set of patches from Microsoft includes one for a scary flaw that was handed over by the US National Security Agency (NSA).

Ahead of this month's Patch Tuesday, rumours swirled of a serious cryptographic flaw. Yesterday the source of the discovery was revealed to be the NSA, which not only spotted the vulnerability but handed it over to Microsoft rather than making use of it itself. That's a departure from how the NSA would normally treat such discoveries and indicates not only the seriousness of the bug but also a desire to "turn over a new leaf" and start sharing its research into security rather than undermining it for surveillance purposes.

Indeed, the NSA said it wasn't the first time it had reported a vulnerability to Microsoft, but it previously refused credit.

The serious flaw in Microsoft's CrytpoAPI could be used to spoof a code-signing certificate to digitally sign malicious code, making it look as though it was from a trusted source. "The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider," Microsoft notes in the security notice. "A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software."

The NSA said that the flaw undermines trust in the widely used Public Key Infrastructure (PKI) and could impact everything from HTTPS connections and signed emails to signed code, across companies, home users and governments. "This kind of vulnerability may shake our belief in the strength of cryptographic authentication mechanisms and make us question if we can really rely on them. Fortunately, we can," Neal Ziring, Technical Director at the NSA Cybersecurity Directorate, said in a blogpost. "[The flaw] reflects a weakness in the implementation of one subtle aspect of PKI certificate validation. The technology and standards are sound; it is one implementation that needs repair."

Thankfully, Microsoft and the NSA both said there was no evidence that the flaw had been spotted or used by hackers. "This month we addressed the vulnerability CVE-2020-0601 in the usermode cryptographic library, CRYPT32.DLL, that affects Windows 10 systems," said Mechele Gruhn, Principal Security Program Manager at the Microsoft Security Research Centre, in a blog post. "This vulnerability is classed Important and we have not seen it used in active attacks."

However, now that the details are public, we can expect that to change. "The consequences of not patching the vulnerability are severe and widespread," the NSA said in a statement. "Remote exploitation tools will likely be made quickly and widely available. Rapid adoption of the patch is the only known mitigation at this time and should be the primary focus for all network owners."

The flaw impacts Windows Server as well as Windows 10, which is used on 400 million computers globally — but the patch is already available as part of Microsoft's monthly updates. “Customers who have already applied the update, or have automatic updates enabled, are already protected,” said Jeff Jones, a senior director at Microsoft, in a statement.

Of course, patching takes time for larger organisations. The NSA recommended via a statement that companies prioritise endpoints that are essential or widely used, such as web servers or DNS servers, as well as those with a high risk of exploitation, in particular those directly exposed to the internet and those used by privileged accounts.

While the notification of the flaw by the NSA will be welcome to Microsoft and its users, whether this signals a new era of cooperation remains to be seen. Chris Morales, Head of Security Analytics at Vectra, notes that different motivations could be in play, regardless of the agency's plans to "turn over a new leaf". "Kudos to the NSA for informing Microsoft and to Microsoft for quickly reacting," he said. "I’d be interested to understand what makes this exploit worth reporting to Microsoft instead of keeping for their personal arsenal as they have in the past.

"It could be because many of those previous tools leaked and have caused widespread damage across multiple organisations," he said. "It could be because there was a concern other would find this vulnerability themselves and it was dangerous enough to warrant remediation instead of weaponising. Or it just could be the NSA already has enough other methods for compromising a Windows system and doesn’t need it."

If it is a sign of cooperation to come, then it's to be welcomed and shows how the government can help security, said Allan Liska, Senior Solutions Architect at Recorded Future. "This reporting is also likely a direct result of the revamped Vulnerability Equities Process (VEP) at NSA," he adds. "The goal of the revamped program is to prioritise public interest in reporting security flaws and protecting core systems and infrastructure. Certificate signing is critical to the trust of software applications in both the public and private sectors, so this reporting certainly meets the “critical” threshold." He noted it's not known how long the NSA has been aware of the vulnerability, but it was reported to Microsoft a few weeks ago.

The NSA has been hit by yet another data leak, as over 100GB of sensitive, classified data was exposed through shoddy security practises.

The leak came from a virtual copy of a hard drive belonging to US Intelligence and Security Command (INSCOM), an intelligence organisation operating within both the US Army and the NSA.

The virtual disk image was discovered by UpGuard cyber risk research director Chris Vickery on an unprotected public Amazon S3 server, meaning that anyone who knew the web address where the data was stored could freely access it.

Unsecured S3 buckets are a frequent cause of embarrassing data breaches for many companies and government organisations. The personal details of two million Dow Jones customers were exposed in a similar fashion earlier this year, as were customers of Accenture and the WWE.

"Regrettably, this cloud leak was entirely avoidable," UpGuard said in a blog post announcing the discovery, "the likely result of process errors within an IT environment that lacked the procedures needed to ensure something as impactful as a data repository containing classified information not be left publicly accessible."

"Plainly put, the digital tools needed to potentially access the networks relied upon by multiple Pentagon intelligence agencies to disseminate information should not be something available to anybody entering a URL into a web browser," the post said. "Although the UpGuard Cyber Risk Team has found and helped to secure multiple data exposures involving sensitive defense intelligence data, this is the first time that clearly classified information has been among the exposed data."

The drive in question contained a trove of data related to a US military project codenamed 'Red Disk', a failed cloud collaboration and content sharing platform designed to let field troops access real-time intelligence data from the Pentagon, including satellite and drone imagery.

The drive also included hashed passwords for internal systems, as well as private keys belonging to third-party INSCOM defence contractors for accessing "distributed intelligence systems". Multiple areas of the drive were marked 'Top Secret', with some sections even bearing the 'NOFORN' designation, indicating that they were to be kept secret even from the US government's foreign intelligence allies.

IT Pro has reached out to the NSA to ask why the appropriate protections were not taken, and will update this piece when we hear back.

Kaspersky has refuted claims its software could be used by the Russian government to spy on US intelligence operatives, indicating that pirated Microsoft Office software is to blame instead.

Following allegations that Russia's FSB intelligence agency used its antivirus software to infiltrate the PC of an NSA contractor and steal top-secret exploit code, the Russian security firm released the preliminary results of its own investigation into the incident.

According to the company's detailed timeline, Kaspersky's antivirus software detected samples of malware created by the Equation group - a highly-sophisticated hacking group widely suspected of ties to the NSA - on the PC of a US user in September 2014.

"Following these detections, the user appears to have downloaded and installed pirated software on his machines, as indicated by an illegal Microsoft Office activation key generator," the company explained. "To install and run this keygen, the user appears to have disabled the Kaspersky products on his machine ... Executing the keygen would not have been possible with the antivirus enabled."

This keygen, the company claimed, was in fact a Trojan, which dropped a "full blown backdoor" onto the subject's PC, which "may have allowed third parties access to the user's machine".

After the user re-enabled their anti-virus installation, the software blocked the backdoor. It also began detecting previously unknown variants of the Equation malware, including a 7zip archive. This archive was promptly sent back to Kaspersky Lab HQ for analysis, at which point it was found to contain "multiple malware samples and source code for what appeared to be Equation malware".

Upon discovery, this was reported to CEO Eugene Kaspersky. The company said that the archive and its contents were deleted from all of Kaspersky's systems and was not shared with anyone else. It also stated that "Kaspersky Lab has never created any detection of non-weaponized (non-malicious) documents in its products based on keywords like 'top secret' and 'classified'."

In short, the company appears to be implying that its software was turned off by an NSA contractor in order to install a pirated version of Office 2013, which contained a backdoor. This backdoor could then have been used by the FSB to gain access to the NSA's Equation exploits, as opposed to the exploits being turned over by Kaspersky Lab itself exploits which were promptly deleted from its files, the company said, when it discovered what they were.

This story has drawn a mixed response from the cybersecurity community; F-Secure chief research officer Mikko Hypponen has subtly hinted that the lure of keeping hold of sophisticated nation-state malware may have been too much for Kaspersky to resist.

Ex-black hat-turned-pen-tester Kevin Mitnick, however, said that the company's account more plausible than alternative explanations.

"The investigation is still ongoing," Kaspersky stated, "and the company will provide additional technical information as it becomes available. We are planning to share full information about this incident, including all technical details with a trusted third party as part of our Global Transparency Initiative for cross-verification."

Canada's cyber defence agency has made the source code for its internal malware prevention tool publicly available to help in the fight against online threats.

The Communications Security Establishment, which is essentially Canada's equivalent to GCHQ in the UK, has released its "Assemblyline" tool as "an opportunity for the cyber security community to take what CSE has developed and build upon it to benefit all Canadians".

The tool is described as a highly configurable early warning system that is able to alert agents to malicious files when they are received.

An example given by the CSE describes how a financial officer may receive an email from an external sender that includes a password-protected zip file containing a word document and spreadsheet. This email may then be passed on to three colleagues within the department.

"Assemblyline will start by examining the initial email," the CSE explained in a statement. "It automatically recognizes the various file formats and triggers the analysis of each file. In this example, the Word document contains embedded malware, although the financial officer is unaware of this. The whole file is given a score when the analysis of each file is complete."

High scores will trigger alerts to a security analyst, who would then manually examine a file and disarm the malware to prevent it spreading further.

The main benefit of the system is its scalability, according to the CSE, as the tool is able to automatically rebalance workloads depending on the volume of data, making it an ideal catch-all solution for enterprises.

"Assemblyline was built using public domain and open-source software; however the majority of the code was developed by CSE," the statement added. "It does not contain any commercial technology, but it is easily integrated into existing cyber defence technologies. As open-source software, businesses can modify Assemblyline to suit their requirements."

The complete program is available on bitbucket to anyone who owns an account.

It's relatively uncommon for a national security agency to willingly share its tools with the world. The UK's GCHQ released the source code for its graph database program Gaffer in 2015, which is able to sift through vast amounts of data and analyse information to determine patterns.

At the time GCHQ promised further contributions to the open source community, but has yet to release any more of its toys to the public.

The National Security Agency in the US also has 32 projects running on GitHub, although these are mostly outdated programs, or specialist tools such as a GPS tracker, and are fairly useless as business tools. For the NSA's most high profile projects, you'll need to turn to the Shadow Brokers.

Image: Bigstock

Russian state-sponsored hackers stole highly classified US cyber security information from the NSA in 2015, it has been claimed.

According reports from the Wall Street Journal and Washington Post, the breach occurred when a person working in the US spy agency's "elite hacking unit" Tailored Access Operations (TAO) loaded the information onto their home computer.

TAO is the division of the NSA that "develops tools to penetrate computers overseas to gather foreign intelligence", according to the Washington Post's sources. In particular, the information taken by the person involved included hacking tools that were being developed to replace those considered compromised in the Snowden leaks.

It's currently unclear if the individual was an independent contractor, as claimed by the WSJ, or an employee, as claimed by the Washington Post, but they are unified in their claim that Kaspersky Lab antivirus software installed on the individual's computer was used as the conduit to identify and access the material.

Kaspersky Lab has hit back at the allegations, reiterating it "does not have inappropriate ties to any government, including Russia, and the only conclusion seems to be that Kaspersky Lab is caught in the middle of a geopolitical fight".

The statement also hints at what some independent security researchers had speculated that its software detected the programmes brought home by the individual and classified them as threats, uploading their signatures and other information to its database of threats.

The Washington Post claims the incident, which resulted in the person being removed from their post in November 2015, is still under investigation.

This is the latest in a series of embarrassing breaches for the NSA. While the leaks from Edward Snowden in May 2013 may be the most famous, another contractor Harold Martin was arrested last year in relation to a separate 2013 breach. Then, in 2016, hacking group Shadow Brokers stole a vast cache of hacking tools, once again linked to TAO, from the NSA and leaked them to the public.

These latest reports haven't been confirmed by the NSA, however, with the agency telling Reuters: "[We] never to comment on our affiliates or personnel issues."

Colour me shocked. It appears the NSA has been collecting a treasure trove of hacks for Windows, both desktop and servers, covering all versions of the OS bar Windows 10. And this toolbox of capabilities, which also included ways to get into banking and other related systems, has leaked to the public.

I suspect your jaw isn't gaping in surprise. What's followed has been just as predictable.

First, there's shock that the NSA might have built such a collection of exploits. Sorry, what do you expect the NSA to be doing? Creating toolkits that can be used against undesirables is what it exists for. Injecting custom spyware onto the laptop of a terrorist could bring up incredibly useful intelligence information, after all.

Then there's the public horror that the NSA didn't tell Microsoft about the exploits. Why is anyone surprised? Sure, it's good practice for security researchers to tell Microsoft (or Apple, Facebook, Google, whoever) that they've uncovered a security hole. There are processes in place by which such reports are made, the vendor is given time to patch things and issue an update, and then the exploit is made public once the patch has been issued. It's all very gentlemanly, and some companies even offer financial rewards.

Would I expect the NSA to tell Microsoft about the exploits? Of course not. Keeping such flaws hidden from Microsoft meant they were exploitable for as long as possible.

No-one is suggesting the NSA, or any other equivalent organisation, is using these tools against the wider population. I don't think there have been mass deployments of EmeraldThread or EternalRomance or EclipsedWing or any of the other rather charming codenames. (Nasty1 and Nasty2 and ReallyNasty3 just don't have the same ring to them.)

But then we come onto the real problems. The tools have now been released into the wild, and it doesn't take much effort to download them. This means there will be a flood of script kiddies trying them out and targeting everyone from NASA to the takeaway down the street. That's a whole pile of grief no-one needed.

It would be interesting to analyse which antivirus packages would protect you against these exploits. My hunch, backed by discussions with friends in the industry, is almost none. As they say about financial results, past performance is no guarantee of future results.

Even so, now the toolkit has leaked, it's of much less use to the NSA, and any other organisations that might have had access to it. That can't be a good thing. Don't confuse that statement with any desire on my part to see government-mandated encryption backdoors being forced into end user applications. I see a difference between what an organisation such as the NSA or GCHQ does and the far more widespread misuse of data-snooping that we have seen in the UK. And my distrust of the ability of government departments, including the NHS, to keep massive datasets secure has almost no limits.

Then we come to Microsoft's interesting claim that these exploits have been patched already, but only very recently. One wonders whether the NSA told Microsoft about the leak once it knew its toolkit was compromised and Microsoft went into top gear to get fixes out as soon as possible.

It does mean, of course, that the old mantra about running only the most current and fully patched versions of applications and operating systems is as true today as it has ever been. Microsoft rather coyly states that "Of the three remaining exploits, EnglishmanDentist', EsteemAudit', and ExplodingCan', none reproduces on supported platforms, which means that customers running Windows 7 and recent versions of Windows or Exchange 2010 and newer versions of Exchange are not at risk." So if you're on XP, you're on your own.

It's also true that we've managed to get ourselves into a situation where OSes are so complex that it is now effectively impossible to ensure they are secure. The approach taken by Apple's iOS, forcing a walled garden approach on the developers and the execution of code, is arguably the most secure widespread end user platform available. But that still doesn't mean that the core OS itself is secure. Is open source the answer? Maybe, but exploits are found there too.

You may be thinking I'll use this final paragraph to deliver the answer. Sadly, there isn't one. If GCHQ or the NSA want to access my computers, they will either hack their way in, use a backdoor that we don't know about, or just turn up with a warrant and remove every device fitted with a mains plug. And there is nothing I, or you, can do.

This article originally appeared in PC Pro.

More than five million cyber attacks originated from a series of exploit archives dumped onto the internet between April and June this year, according to Kaspersky Lab.

Its software blocked more than five million attacks based on hacking group Shadow Brokers' exploit dumps, but the rate of attacks using these tools is growing; more than 80% were detected during the last 30 days of the quarter.

"The threat landscape of Q2 provides yet another reminder that a lack of vigilance is one of the most significant cyber dangers," said Kaspersky Lab security expert Alexander Liskin.

"While vendors patch vulnerabilities on a regular basis, many users don't pay attention to this, which results in massive-scale attacks once the vulnerabilities are exposed to the broad cyber criminal community."

Shadow Brokers has already had a huge impact of the security landscape. The mysterious group began releasing huge troves of offensive malware and cyber weapons last year, many of which were allegedly created and used by US intelligence agencies such as the NSA.

The latest dump, which occurred in April this year, included a number of highly sophisticated tools. It was considered by many experts to be one of the most dangerous and damaging leaks in cyber security history.

Alongside codenamed exploits including DarkPulsar, OddJob and FuzzBunch, the dump included the EternalBlue exploit targeting elements of the Windows OS. This malware in particular was an instrumental part of the WannaCry ransomware that nearly crippled organisations including the NHS, before it was stopped by security researcher Marcus Hutchins.

The National Security Agency (NSA) has opened an account on open source code repository GitHub, meaning developers are able to contribute to and use many of the organisation's innovations in their projects.

Although the NSA is the most secretive of US intelligence agencies, it currently has 32 projects listed on its NSA Technololgy Transfer Program GitHub account (first spotted by The Next Web), of which most are flagged as "coming soon".

A lot of the projects that are available were developed quite some time ago and are not likely to be recent things the NSA is working on, but closed items that are no longer being used. However, that doesn't mean they won't be useful to other organisations looking to boost their code.

The Next Web flags SELinux (Security-Enhanced Linux) as one such project that has been part of the Linux kernal for years and although it may not be helpful for most companies, a tool such as qgis-latlontools-plugin, which is described as "QGIS tools to capture and zoom to coordinates (including MGRS), using decimal, DMS, and WKT notation. Provides external map support and MGRS conversion routines," could be useful for mapping applications, using the plugin to extract coordinates from a map, for example.

It's unlikely many of the NSA's high profile projects will appear on its GitHub account anytime soon, but this is certainly a step forward in the NSA's attempts to be more transparent and open about what it's doing.

The first indicator of this was in 2013 when it opened a Twitter account, just after Edward Snowden issued security leaks regarding the NSA's questionable tactics.

US spy agency the NSA allegedly had the tools to hack into interbank messaging system SWIFT via third party providers, according to documents released by hacking group Shadow Brokers last Friday.

SWIFT has since said there is no evidence suggesting its core messaging services or network have been compromised after Reuters reported that the Shadow Group documents indicated that the NSA had accessed SWIFT through service providers (service bureaux) that offer access to the system in the Middle East and Latin America.

In a media FAQ, the organisation said: "SWIFT is in close contact with the service bureaux concerned to verify that they are aware of the allegations and have appropriate preventative measures in place." The Belgium-based organisation allows over 200 organisations to send messages about financial transactions to each other and sends payment orders between institutions' accounts.

The tools were linked to vulnerabilities discovered in versions of Microsoft's Windows operating system. Cybersecurity expert Matt Suiche, of Comae Technologies, detailed in a blog post that "Windows Vista/2008 is out of support since Monday [12 April], and Windows XP/2003 has been unsupported for more than [three] years. This means that security vulnerabilities found on those systems will never be corrected."

However, Microsoft said in a security update that all but three of the published exploits had already been patched. Those three, 'EnglishmanDentist', 'EsteemAudit', and 'ExplodingCan', don't work on Windows operating systems that are still in support. But Microsoft has not announced how it learned of the vulnerabilities, though it usually gives credit to those who find bugs.

SWIFT said: "The allegations suggest there may have been attempts to gain unauthorised access to data at two service bureaux. The exploits do not target SWIFT's infrastructure or data. There is no impact on SWIFT's infrastructure or data, and there is no evidence to suggest that there has been any unauthorised access to SWIFT's network or messaging services.

"Customers should pay close attention their own security and take security into consideration when selecting a service bureau and working with other third party providers."

Yahoo's alleged scanning of user emails on behalf of the US government could undermine the newly agreed Privacy Shield data regulations if they turn out to be true.

Ireland's data protection commissioner, which is the lead European regulator on privacy issues for Yahoo, is making inquiries as to whether any European citizens may have been affected.

"Any form of mass surveillance infringing on the fundamental privacy rights of EU citizens would be viewed as a matter of considerable concern," the regulator said in a statement.

According to bothReutersandThe Times(subscription required), European politicians have called on the European Commission to investigate the matter, with lawyers saying a legal challenge to the Privacy Shield agreement, which was settled on earlier this year, is now more likely.

In the US, the legality of Yahoo's reported actions has also been called into question.

Patrick Toomey, a staff attorney with the American Civil Liberties Union (ACLU), toldIT Pro: "Based on [Reuters's initial report] the order issued to Yahoo appears to be unprecedented and unconstitutional. The government appears to have compelled Yahoo to conduct precisely the type of general, suspicionless search that the Fourth Amendment was intended to prohibit."

In this country, however, it has been claimed this behaviour may not be illegal even if UK citizens were among the subjects of the alleged spying.

Privacy International legal officer Camilla Graham Wood toldIT Pro: "The information on the scanning of emails by Yahoo remains sparse. It is important to note that similar powers exist in the United Kingdom, in the form of the Investigatory Powers Bill. There has been little public debate about how intrusive such powers are. The fault lies with the Government in failing to clearly inform the public about the broad spectrum of powers that will be authorised by the Investigatory Powers Bill.

"We do not know if the UK Government has already requested that companies scan their customers' emails on a bulk scale, but we do know that this will be possible under the Investigatory Powers Bill, if we look at powers such as Technical Capability Notices."

IT Pro contacted two telcos known to have used Yahoo's email services, either in the past or currently Sky and BT to find out if their customers may be among those who allegedly had their data scanned.

A BT spokesman said: "Yahoo have stated they are a law abiding company and comply with the laws of the United States." Sky did not respond to IT Pro's request for comment.

According to The New York Times, Yahoo was forced by a secret court order adapted existing software, which scans for spam and images of child abuse being sent to Yahoo Mail addresses, "to search for messages containing a computer 'signature' tied to the communications of a state-sponsored terrorist organisation", citing "several people familiar with the matter".

"With some modifications, the system stored and made available to the [FBI] a copy of any messages it found that contained the digital signature," theNYT reported.

"The order was unusual because it involved the systematic scanning of all Yahoo users' emails rather than individual accounts," the newspaper added.

Several other tech companies, including Google, Facebook, Microsoft and Twitter said they had never received this kind of request and that if they had, or do in the future, they would fight the order in court.

05/10/2016: Yahoo 'snooped on users' emails and passed data to the NSA'

Yahoo has secretly been scanning its customers' emails and sending information contained in them to the NSA, according to aReuters report.

Three former Yahoo employees and a fourth person "appraised of the events" allegedly toldReuters the beleaguered company last year "secretly created a software programme to search all [Yahoo Mail] customers' incoming emails for specific information provided by the US intelligence officials".

The details of the case are a little hazy beyond this information Reuters was unable to determine what keywords or information were being scanned for, what information (if any) was handed over, or whether any other email providers were asked to comply with the same order.

However, the news agency's sources did indicate that the decision to comply with the request was one of the reasons the company's then-CIO, Alex Stamos, resigned in June 2015.

In a statement to Reuters, a spokesperson said: "Yahoo is a law abiding company, and complies with the laws of the United States."

The situation has riled both privacy campaigners and the tech community at large.

Jim Killick, executive director of the Open Rights Group, toldIT Pro: "This could be very damaging for Yahoo and will no doubt affect the trust its customers have in their services. Surveillance should be carried out through a transparent legal framework and only in response to warrants.

"While there may be a need for companies to scan incoming emails for malware and spam ... they should not indiscriminately spy on customers who are not suspected of any crime. Yet again we need more transparency about how companies are working with law enforcement and security agencies."

Rafael Laguna, CEO of Open-Xchange said: "The integrity of Yahoo as an email provider is in tatters. As a user, if you're not having your details leaked online you can be sure the US government is rifling through your emails and attachments. This utter disregard for the consent of law abiding citizens is shocking but it is something the NSA and GCHQ increasingly believe they can do with impunity."

Only last month Yahoo confirmed a hack in late 2014 obtained 500 million people's usernames and passwords, with the search giant blaming a "nation state actor".

Hackers have targeted some Cisco customers using a new vulnerability found thanks to leaked NSA cyber tools.

The tools were released in August by a hacker group dubbed ShadowBrokers and are confirmed to belong to the Equation Group which has strong ties with the NSA. It is the second such vulnerability to be found by Cisco as a result of the data dump made by the hackers; Cisco has already fixed a flaw in the SNMP implementation in its ASA firewalls.

Cisco has warned its customers that all versions of its IOS, IOS XE and IOS XR software are vulnerable to one of the many exploits released on August 15. The networking firm hasn't revealed which of its customers may have already been breached but the issue impacts firewalls, routers and switches made by the firm, enabling hackers to get hold of critical and confidential information from its customers.

"The vulnerability is due to insufficient condition checks in the part of the code that handles IKEv1 security negotiation requests. An attacker could exploit this vulnerability by sending a crafted IKEv1 packet to an affected device configured to accept IKEv1 security negotiation requests," the firm said in a security advisory blog.

But despite stating that its incident response team was aware of exploitation of the vulnerabilities of those customers running affected platforms, Cisco hasn't yet developed a patch for the flaw and has said no workarounds are available. Instead, it has released IPS signatures and Snort rules to mitigate the risks for its customers.

The exploit is called BENIGNCERTAIN and is made up of three binaries, each of which can be exploited to obtain RSA private key data and VPN configuration details if used against Cisco PIX firewalls.

Cisco isn't the only networking company to have exploits revealed. The ShadowBrokers data dump included exploits for Juniper and Fortinet, amongst others.

French Caldwell, former Gartner fellow and chief evangelist at GRC apps company MetricStream, warned other spy agencies particularly the other Five Eyes members that they too are vulnerable to a similar hack.

"If the NSA was hacked, the chances that they too have been targeted are certainly more than 50-50," he said.

The perpetrator of the Shadow Brokers breach at the NSA may in fact by an English-speaking insider at the American agency, rather than a Russian hacker collective, as first presumed.

Earlier this month, attackers revealed they had managed to gain access to cyber weapons from the Equation Group, widely thought to be the NSA's own state hacking collective. They circulated 300 files online detailing zero-day exploits - several of which have been confirmed as genuine - and auctioned off a second, encrypted cache to the highest bidder.

It was initially theorised that the hackers were foreign operatives with the most popular theory being that they were Russian. This was spurred on by the fact that the Pastebin post from the perpetrators was in broken English.

However, linguistic analysis by Shlomo Aragon, professor of Computer Science and director of the Linguistic Cognition Laboratory at the Illinois Institute of Technology (IIT) suggested that the author of the post is actually a native English-speaker trying to disguise the fact they are anglophone.

"The texts contain a variety of different grammatical errors that are not usual in the English of US native speakers," writes Aragon in a post on Taia Global. These include the omission of definite and indefinite articles ("a" and "the"), the omission of infinitive "to" (e.g., "I want get" instead of "I want to get") and confusion of tenses.

However, he points out that, while there are grammatical errors, there are no spelling errors, irrespective of how complex the word is. Additionally, the grammatical errors are inconsistent and the author uses plenty of idioms, even though they do contain mistakes in grammar. This has let Aragon to the conclusion that "the author is most likely a native speaker of US English who is attempting to sound like a non-native speaker by inserting a variety of random grammatical errors".

Separately, others have come to the conclusion that the perpetrator is an NSA insider.

Cyber security professional and white hat hacker Matt Suiche said in a post on Medium that a former NSA analyst had come to him with this theory, speaking on the condition of anonymity.

After discussions with this source, several points were put forward suggesting the "hackers" were in fact a single person working from within the NSA. These include the fact that the name ShadowBrokers originally comes from the computer game Mass Effect, and that the NSA Tailored Access Operations (TAO) group, where the cyber weapons stolen are thought to come from, apparently has a "big gaming culture"

Also, the depository containing the NSA TAO toolkit is reportedly stored on a separate network that is not connected to the internet at all (which would impede someone trying to hack from the outside).

The "TAO Team had severe concerns about how easy it was to just walk out with the data on a USB drive" and a native English-speaker could easily fake broken English to make themselves sound Russian (although Suiche does not go into as much detail as Aragon in terms of analysis).

However, Suiche does concede "this is only a possible scenario" and "the discussion is open".

Juniper Networks is dropping a piece of security code believed to have been developed by the US National Security Agency (NSA) for eavesdropping.

The company announced in December that it had found two backdoors in software that relies on Dual Elliptic Curve (Dual EC) technology, which appeared in 2012 and 2014.

Hovav Shacham, one of the researchers at the University of California, San Diego, who discovered the vulnerability, said the one introduced in 2014 was quite straightforward, according to Reuters.

However, the 2012 code altered the mathematical constant in the company's Netscreen products, allowing the creator to eavesdrop on communications, Shacham and his team claimed.

A separate curve constant, required for some federal contracts and provided by the NSA, was exposed in the documents released by whistleblower Edward Snowden to be the key to the backdoor.

Questions about DEC were raised back in 2007, but Juniper decided to use it anyway the following year. The company issued a patch back in December 2015, which reverted back to this 2008 code, however it is now set to remove the technology all together.

While no culprit has been officially named, Nicholas Weaver, from the International Computer Science Institute and UC Berkley, told Reuters that the NSA is a logical suspect for the development of the original 2008 backdoor, which may have been displaced in the 2012 and 2014 incidences by either top-level hackers or other countries' spy agencies.

In a blog post, Juniper Networks said: "After a detailed review, there is no evidence of any other unauthorised code in ScreenOS [the software used in Netscreen] nor have we found any evidence of unauthorised code in Junos OS [the primary Juniper OS]."

"After review of commentary from security researchers and through our own continued analysis, we have identified additional changed Juniper will make to ScreenOS," the company continued.

It then added: "We will replace Dual_EC and ANSI X9.31 in ScreenOS 6.3 with the same random number generation technology currently employed accross our broad portfolio of Junos OS products. We intend to make these changes in a subsequent ScreenOS oftware release, which will be made available in the first half of 2016.

"The investigation into the origin of the unauthorised code continues."

US whistleblower Edward Snowden has revealed that UK intelligence agency GCHQ has the tools to hack into and control phones without the owners being aware they are being tracked.

He explained that authorities can implement tools - called Dreamy Smurf, Nosey Smurf, Paranoid Smurf and Tracker Smurf - by sending a smartphone an encrypted text message.

"Dreamy Smurf is the power management tool which means turning your phone on and off without you knowing," Snowden said."Nosey Smurf is the 'hot mic' tool. For example if it's in your pocket, [GCHQ] can turn the microphone on and listen to everything that's going on around you - even if your phone is switched off because they've got the other tools for turning it on."

He explained that Tracker Smurf is a geo-location tool that could potentially allow GCHQ to follow smartphone users better than using standard cellular location towers.

Paranoid Smurf is a self-protection tool that can be used to stop you getting rid of the other tools on a device. If you spot something strange is going on with your device and take it to a phone shop to fix the problem, for example, Paranoid Smurf would hide the evidence so technicians wouldn't find anything wrong.

Snowden spoke to the BBC's Panorama programme from his base in Russia, where he ran away to after leaking other snooping allegations about the GCHQ and US's National Security Agency (NSA).

The NSA also have a similar set of tools to use in the fight against terrorism, Snowden said. The US security organisation reportedly spent $1bn on the tools to respond to terrorists' increased use of smartphones.

Although he did not specifically say the GCHQ and NSA wanted to partake in mass surveillance, they have both invested in software that would allow them to hack into devices in order to track what you're saying, what you're doing and where you are.

"They want to own your phone instead of you," he said.

The UK government commented: "All of GCHQ's work is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the Parliamentary Intelligence and Security Committee. All our operational processes rigorously support this position."

US telecoms giant AT&T has been working with the National Security Agency (NSA) for decades to help it carry out mass internet surveillance, according to recent reports.

Leaked NSA documents dated between 2003 and 2013 reveal AT&T has been 'highly collaborative' and had 'an extreme willingness to help' the spy agency to track US citizens.

The New York Times and ProPublica said AT&T gave the NSA access to billions of the American public's emails as they flowed through its US network and also provided the technical expertise needed by the NSA to tap into communications at the UN's headquarters in New York.

The budget for carrying out such operations was double that of other large surveillance operations, part of which was spent on installing equipment in 17 of AT&T's US-based internet hubs. This is much more than the NSA implemented on competitor Verizon's network, which, it has been claimed, shows a closer relationship between AT&T and the spy agency.

Although ProPublica didn't mentioned AT&T as the company involved in such a high-level of spying, the evidence presented by the NSA pointed directly at the telecoms giant, which has mobile, internet and other network-based services in the US.

AT&T spokesman, Brad Burns told the New York Times: "We do not voluntarily provide information to any investigating authorities other than if a person's life is in danger and time is of the essence."

Former agency contractor Edward Snowden provided the NSA's documents to the New York Times and ProPublica. They also revealed Verizon, one of America's other largest telcos had been working with the spy agency on a project called Stormbrew that involved pulling data from the company's fibre-optic cables.

A spy programme known as Project Echelon has been tapping into billions of phone calls a year for the last half-century, according to a campaigning journalist writing for The Intercept.

The scheme was jointly-run by US agency NSA and British agency GCHQ, and signalled the advent of mass surveillance by ushering in an age of "Big Brother"-style snooping, according to one source.

Starting in 1966, the project leapt into life when the NSA fronted the money for the GCHQ to build a station in Bude, Cornwall, capable of intercepting satellite communications from Intelsat, the first commercial communications satellite network.

Journalist Duncan Campbell and fellow reporter Jim Bamford located a second site in Yakima, America, that intercepted US-Asia communications.

Campbell wrote: "At the dawn of the era of mass surveillance, almost 50 years ago, the ECHELON stations at Bude and Yakima were the global mass surveillance system."

The Echelon system was automated, and able to sift through vast swathes of data from these satellites to sort and categorise it all.

Speaking to a former Lockheed (now Lockheed Martin) employee in the late 1980s who was responsible for managing NSA databases at a new site in California, Campbell learned how Echelon was spying on politicians, and his source also shared plans for the IT system underpinning the project.

He wrote: "The plans showed how ECHELON, also called Project P415, intercepted satellite connections, sorting phone calls, telex, telegraph and computer signals.

"Although the internet was then in early infancy, what was carried digitally was covered. The way ECHELON had been designed, she said, demonstrated the targeting of U.S. political figures was not an accident."

Campbell added that the scale of the operation had shocked him.

"The NSA and its partners had arranged for everything we communicated to be grabbed and potentially analyzed," he said. "ECHELON was at the heart of a massive, billion-dollar expansion of global electronic surveillance for the 21st century."

However, Campbell's expose of the spying programme in 1988 was ignored for 11 years, until the European Parliament commissioned an investigation in 1999.

Though the parliament mandated extensive action against mass surveillance in 2001, a few days later the Twin Towers were destroyed in the 9/11 terrorist attack.

"Any plans for limiting mass surveillance were buried with the victims of 9/11," wrote Campbell.

Since Edward Snowden's revelations about the NSA laid bare the extent of spying programmes against US and European citizens, public interest has spiked in privacy, and some of the documents leaked actually confirmed Campbell's reports.

GCHQ and the NSA stand accused of reverse-engineering consumer anti-virus software in order to hide their operations, it has been revealed.

Hacking efforts by UK spy body GCHQ have been stymied in the past by security vendors such as Kaspersky Labs, according to a warrant renewal request published by The Intercept.

The warrant states that the Russian AV company in particular continues to "pose a challenge" to GCHQ, and that the agency's goal is to be able to "exploit such software and to prevent detection of [their] activities".

In order to circumvent this type of security, the agency examined various elements of it for vulnerabilities, using a technique known as Software Reverse Engineering.

As part of the "computer network exploitation" tactics covered by the warrant, GCHQ likewise examined popular forum software vBulletin, which the document claims is "widely used to run terrorist web forums".

It is also, however, used to run and maintain a huge majority of legitimate forums such as NEOGAF and SomethingAwful, and SRE methods have previously yielded the recovery of an unspecified number of user credentials.

As these SRE techniques could potentially constitute "an infringement of copyright", GCHQ requires a legally-protecting warrant from the government that must be renewed every six months.

It was one such renewal request, dated from 2008, that was published today as part of the Snowden files. It is unclear whether this practise of reverse-engineering security software is still common, as well as what GCHQ hoped to achieve in the process.

The warrant also notes that the agency's success in reverse-engineering strategies have led to developing capabilities against Cisco routers. This allows UK spies entry into the Pakistan Internet Exchange, where they have "access to almost any user of the internet inside Pakistan".

The NSA has also been undertaking similar projects. In a briefing from 2010, also part of the Snowden files, the US spy agency's "Project CAMBERDADA" was revealed to be intercepting malware-flagging email traffic between end-users and anti-virus vendors.

This information is used to compile a list of malware that vendors like Kaspersky have not yet adapted to combat. The agency's Tailored Access Operation unit then "repurpose the malware", allowing them piggyback access to machines and networks.

Kaspersky has been a notable opponent of state-sponsored intrusion. The Russian company had a hand in detecting and flagging multiple examples of suspected government malware such as the Gauss, Flame and Stuxnet viruses.

Earlier this month, the company discovered that it had itself been hit by the Duqu 2.0 worm, which founder Eugene Kaspersky believes to be a "nation-state sponsored campaign".

The company said in a statement that "we find it extremely worrying that government organizations are targeting security companies instead of focusing their resources against legitimate adversaries."

It decried the fact that government divisions are "actively working to subvert security software that is designed to keep us all safe."

Along with Kaspersky Labs, a total of 23 vendors were listed in the presentation on a slide jauntily titled "more targets!" These included Bit-Defender, Avast, Avira and Checkpoint, with examples from multiple US-allied countries although none from within the US itself, or the UK.

However, while this may come as a shock to some, others in the infosec community are less than astonished. Ben Johnson, Chief Security Strategist for Bit9 + Carbon Black, points out that "AV tools can be bought and pulled apart by anyone".

He notes the logic of GCHQ's operations, asking "is it really a surprise that intelligence agencies try to circumvent technologies that might prevent them from collecting information? Or test these technologies for weaknesses?"

He likens this probing of vendor proficiency to real-world combat tactics; "In the hacker world as well as the military world before conducting any operation it is vital to test offensive tools against defensive capabilities".

China and Russia have copies of Edward Snowden's leaked documents by hacking the NSA itself before the whistleblower even arrived in Russia, according to security expert Bruce Schneier.

He believes lax security controls at the US spy agency, rather than Snowden residing in Russia, being responsible for allowing foreign countries to get their hands on top secret documents.

The countries also have sophisticated hacking capabilities that far outstrip journalists' abilities to protect the leaked documents, Schneier wrote in Wired yesterday.

"The vulnerability is not Snowden; it's everyone who has access to the files," wrote Schneier.

"China and Russia had access to all the files that Snowden took well before Snowden took them because they've penetrated the NSA networks where those files reside.

"Remember that Snowden was able to wander through the NSA's networks with impunity."

He pointed to Russia's alleged hack of the White House network earlier this year, as well as suspected hacks from China on US government databases.

He added that journalists protecting the files after receiving them from Snowden would have struggled to fend off government-backed cyber hackers.

"It's been open season on the computers of the journalists Snowden shared documents with since this story broke in July 2013," he claimed.

"While they have been taking extraordinary pains to secure those computers, it's almost certainly not enough to keep out the world's intelligence services."

Schneier's article was written in response to a Sunday Times front page story claiming MI6 has had to pull spies out of operations because Russia had cracked more than one million encrypted documents held by Snowden.

The story has since been widely panned by media, with other journalists pointing out inaccuracies such as the claim Snowden had fled to Russia in fact, he had been in Moscow en route to South America when the US revoked his passport, allowing Russia to hold him in transit.

Moreover, he said he left his documents with a contact in Hong Kong, pouring doubt on the article's claim he had the files when he landed in Russia.

Schneier said: "It's a terrible article, filled with factual inaccuracies and unsubstantiated claims about both Snowden's actions and the damage caused by his disclosure."

The cryptographer said he had no doubt Snowden had encrypted the documents before landing in Russia, just as the whistleblower has claimed, because it's sensible and easy to do.

The US House of Representatives has voted to end the NSA's widespread surveillance of American citizens.

Members voted 338 to 88 to support the USA Freedom Act, a measure that amends and extends parts of 2001's much-discussed USA Patriot Act.

One of its clauses is the banning of the NSA from bulk-collecting US citizens' phone records, emails and web addresses.

According to Representative Goodlatte, the Judiciary Committee chair, one of the bill's driving forces, the NSA's blanket surveillance "has not ceased, and will not cease, unless and until Congress acts to shut it down".

This mass-scale data collection was the source of much controversy when it was revealed by Edward Snowden in 2013.

The ex-NSA contractor leaked huge amounts of info related to programmes like PRISM and MYSTIC, and fled to Russia to avoid government sanctions.

The methods and scale of these spying operations led to a federal appeals court deeming them illegal last week, and both rulings have been met with support from privacy advocate groups.

Although the bill has now been passed by the House, it must still be ratified by the Senate in order to make it onto the statute books, having already received presidential approval.

However, current Senate majority leader Mitch McConnell has previously introduced bills designed to extends the NSA's powers rather than curtail them.

There are those in the Senate in favour of the bill, though, and both Senators Rand Paul and Ron Wyden have previously threatened to filibuster extensions of Patriot Act powers.

The NSA's bulk collection of phone data is illegal, the US Court of Appeals has ruled, overturning a landmark 2013 ruling.

The interception of phone call data, which began in 2006, is thought to have targeted European companies and world leaders including German chancellor Angela Merkel.

However, the existence of the programme did not become apparent until two years ago, when whistleblower Edward Snowden leaked details to the public.

The US government argued successfully in the first instance that section 215 of the Patriot Act permitted bulk collection of call metadata, which reveals who or what device is making or receiving calls, but not the content of these conversations.

In the new hearing, though, judge Gerard Lynch determined this was not the case and that the actions of the NSA were illegal.

However, he did not rule the behaviour was illegal under the constitution, as claimed by the American Civil Liberties Union.

Consequently it has not ordered the intelligence organisation to stop the practice but urged the US Congress to take action.

Section 215 of the Patriot Act, and the permission for the NSA's bulk phone data collection given by a secret national security court, are valid until 1 June this year, after which time the US government must vote on whether or not to extend it.

According to the BBC, leaders of the House of Representatives, the lower house in US government, would prefer to pass a bill ending the bulk collection of phone records, but statements made by the leader of the upper house, the Senate, have reportedly pointed towards a desire to extend the Patriot Act and bulk phone data collection.

The full text of the Court of Appeals' ruling can be read here.

Edward Snowden isn't in Russia after all, if you believe Google Maps, which thought he'd set up shop in the White House until recently.

Anyone hovering over the President's home on the mapping tool would see 'Edwards Snow Den' slap bang in the middle of the building.

In fact, it was hacker Bryan Seely who was responsible for Maps' mistake, exploiting a loophole in its listings process.

To set up the listing, Seely said he created a business in Google that he could send and receive mail to. Google then sent a postcard to the address with a verification code.

He then deleted this address from his account, using another Google account to claim the business. By going through the phone verification process, he found he could move the business to wherever he liked - in this case to the White House.

Although Edwards Snow Den is listed as having a Seattle phone number, he managed to change all the other details without too much trouble, which obviously caused a lot of chatter.

As Microsoft knows, if Google ever finds a public security vulnerability in any other company, it gives them 90 days to correct the flaw. Yet Google has had over a year to close this hole that allows anyone to post a place on Google Maps, and hadn't dealt with it.

Previously, Seely has set up other businesses linked to the FBI and Secret Service. He wanted to use the method again to show that Google hadn't fixed the loophole.

Seely said that although Google does a lot of things right and is a great company, when it doesn't takes things like this seriously, it's disappointing. "It's disheartening. It's like finding out your favorite company is a piece of sh**," he told Search Engine Land.

Not only does it make Google look bad, it also misleads customers into thinking they are genuine businesses and could be used maliciously by others.

Amnesty International is taking the government to the European Court of Human Rights over its mass surveillance of UK citizens.

The organisation claims the government's practice of mass surveillance goes against human rights, and has issued the legal challenge with another nine bodies.

All object to the government's methods of interception, collection, inspection, distribution and retention of communications "without any judicial authorisation," their filing said.

Their complaint is based on revelations leaked by ex-NSA contractor Edward Snowden, who revealed information on secret US data collection programmes like PRISM, collecting communications data including emails, text messages, phone calls and social media without permission.

The court filing mentioned Tempora, Upstream and PRISM as three of the mass surveillance programmes it was hoping to stop, saying the operations were making it increasingly difficult for Amnesty International to carry out its work.

While based in the US, the PRISM and Upstream programmes extended to UK-held data. Meanwhile Tempora is the UK's own GCHQ programme, giving spooks access to vast swathes of data on millions of people.

"It is thanks only to Edward Snowden's revelations, and the scant disclosures we and the other claimants have been able to prise from the government, that we know anything whatsoever about what the intelligence services are up to," said James Welch, Legal Director for Liberty.

The filing also detailed how a closed hearing took place, outlining Amnesty International and the other applicants' concerns, but none of the bodies were invited to attend because of the sensitive nature of the country's security.

Nick Williams, Amnesty International's legal counsel said: "The UK government's surveillance practices have been allowed to continue unabated and on an unprecedented scale, with major consequences for people's privacy and freedom of expression. No-one is above the law and the European Court of Human Rights now has a chance to make that clear."

Carly Nyst, legal director of Privacy International, added: "Mass surveillance is a violation of our fundamental rights. Intercepting millions of communications every day, and secretly receiving millions more from the NSA by the back door is neither necessary nor proportionate."

A privacy lawsuit brought against Facebook by 25,000 people begins today, with the social network being accused of illegally tracking user data.

The class action case also alleges that the tech giant took part in the NSA's PRISM programme, which raked personal data from the servers of major US companies with their apparent agreement.

While Facebook denies any involvement, the claimants hope the case will improve tech companies' attitudes to data protection.

Campaigner Max Schrems said in an AFP interview: "We are asking Facebook to stop mass surveillance, to [have] a proper privacy policy that people can understand, but also to stop collecting data of people that are not even Facebook users.

"There is a wide number of issues in the lawsuit and we hope to kind of win all of them and to get a landmark case against US data-gathering companies."

Schrems claims Facebook has taken a "Wild West" approach to data protection, and the case concerns its treatment of non-US data stored on its Dublin servers.

The compensation requested by claimants - 360 per user adds up to 9 million.

Judges will decide whether Facebook is guilty of breaking EU law in its policy on data use, sharing data with external apps and tracking users on external pages, among other issues.

Facebook hasn't commented publicly on the case, but CEO Mark Zuckerberg denied any involvement in the NSA PRISM scheme back in 2013.

The campaign is being financed by litigation firm Roland Prozessfinanz and the company's 20 per cent fee will be deducted from the total damages awarded.

The Wikimedia Foundation is suing the NSA and US Department of Justice because it believes the spy agency's mass surveillance programmes violate freedom of speech laws.

Eight organisations have signed the documents, calling for the NSA to shut down its large-scale surveillance operation that tracks data flowing to and from the US to protect its 500 million monthly users.

Lila Tretikov, executive director of the Wikimedia Foundation, said in a blog post on the New York Times: "The NSA's mass surveillance of Internet traffic on American soil often called "upstream" surveillance violates the Fourth Amendment, which protects the right to privacy, as well as the First Amendment, which protects the freedoms of expression and association.

"We also argue that this agency activity exceeds the authority granted by the Foreign Intelligence Surveillance Act that Congress amended in 2008."

The blog post goes on to explain that Wikipedia's users have the right to browse and upload articles to Wikipedia anonymously and without prejudice. The NSA snooping on its users could break confidentiality, especially in countries where governments are repressive and this could lead Wikipedia's users not to post topical information to the website.

"By tapping the backbone of the internet, the NSA is straining the backbone of democracy. By violating our users' privacy, the NSA is threatening the intellectual freedom that is central to people's ability to create and understand knowledge," she continued.

"Privacy is an essential right. It makes freedom of expression possible, and sustains freedom of inquiry and association. It empowers us to read, write and communicate in confidence, without fear of persecution. Knowledge flourishes where privacy is protected."

SIM card maker Gemalto has shared details of its investigation into claims British and US securities services hacked the company to steal billions of encryption keys.

Privacy International blasts security services

"GCHQ has lost it's way. In stealing the SIM card encryption keys of millions of mobile phone users they have shown there are few lines they aren't willing to cross," the charity told IT Pro.

"Hacking into law-abiding companies, spying on their employees and stealing their data should never be considered 'fair game.'

"The mentality of 'Act first, worry about the law later' has to come to an end. Unrestrained, unregulated Government spying of this kind is the antithesis of the rule of law and they must be held accountable for their actions."

The two agencies are said to have joined forces to set up a specialist Mobile Handset Exploitation Team (MHET) in April 2010, documents by The Intercept revealed. The unit's mission was to target vulnerabilities in mobile devices.

Operatives worked to infiltrate Dutch company Gemalto, which produces 2 billion SIM cards a year and serves 450 telecoms operators across the globe, it was claimed.

A top secret slide (below) confirmed the NSA and GCHQ had gained access to Gelmato's network and mined the private communications of engineers and sales employees.

The claims are the latest in a long line of revelations to have been made public by NSA whistleblower Edward Snowden.

By stealing encryption keys, the intelligence agencies were able to monitor mobile communications without approval from telecom companies and foreign governments, all without being traced.

In a statement published on 25 February, the organisation said it has reason to believe the NSA and GCHQ were behind a series of attempts made in 2010 and 2011 to hack into the company and its network.

"At the time we were unable to identify the perpetrators but we now think they could be related to the NSA and GCHQ operation," the statement reads.

"These intrusions only affected the outer parts of our networks - our office networks - which are in contact with the outside world.

"The SIM encryption keys and other customer data in general, are not stored on these networks," the statement added.

Therefore, it denied claims the security services were able to steal the SIM encryption keys because the NSA and GCHQ appear to have only succeeded in breaching its office networks.

Instead, Gemalto's investigation into the matter has suggested the NSA and GCHQ may have targeted other parts of its SIM card supply chain to get access to the encryption keys, rather than via its own network.

Furthermore, it also denies that it ever sold SIM cards to four out of the 12 operators listed in the leaked documents.

Gemalto described the attacks as as "serious and sophisticated", but said no signs of malicious activity were observed anywhere else in its networks.

"No breaches were found in the infrastructure running our SIM activity or in other parts of the secure network which manage our other products such as banking cards, ID cards or electronic passports," the statement continued.

"We are conscious that the most eminent state agencies, especially when they work together, have resources and legal support that go far beyond that of typical hackers and criminal organisations.

"And, we are concerned that they could be involved in such indiscriminate operations against private companies with no grounds for suspicion," the statement concluded.

When the allegations first came to light last week, Gelmato said in a statement that the security services appear to have tried to reach as many mobile phones as possible.

"We cannot at this early stage verify the findings of the publication and had no prior knowledge that these agencies were conducting this operation," the firm said.

"We take this publication very seriously and will devote all resources necessary to fully investigate and understand the scope of such sophisticated techniques."

This article was originally published on 25/2/15 and updated on the same day to include details of Gemalto's investigation.

The Investigatory Powers Tribunal (IPT) has declared British intelligence services acted unlawfully by accessing the personal communications data gathered by the US National Security Agency (NSA).

The IPT, set up 15 years ago to oversee the activities of GCHQ, MI5 and MI6, ruling follows a complaint made by several civil liberties organisations, including Amnesty International, Privacy International, Bytes for All and Liberty.

The Tribunal said the way intelligence was shared between GCHQ and the NSA's Prism surveillance programme was unlawful up until December 2014, because the rules governing the practice were kept secret.

Post-December 2014, this was no longer the case, as the details of it were made public through the work of the Tribunal.

The existence of Prism came to light in a series of disclosures by NSA whistleblower Edward Snowden during the summer of 2013.

Through the programme, it's alleged the NSA was able to access data used by the a wide range of tech giants, including Microsoft, Yahoo, Google and Facebook, and share it with GCHQ if needed.

As a result of today's outcome, Privacy International and Bytes for All have asked for further clarification from the court regarding the interception and collection of their communications data.

If it transpires that their data was unlawfully collected before December 2014, the parties are set to demand its immediate deletion.

They also want to challenge the assertion that GCHQ's activities after December 2014 were lawful, and have vowed to lodge an application with the European Court of Human Rights on this point.

Eric King, deputy director of Privacy International, said the ruling should put an end to security agencies acting like they can operate outside of the law.

"We must not allow agencies to continue justifying mass surveillance programs using secret interpretations of secret laws. The world owes Edward Snowden a great debt for blowing the whistle, and today's decision is a vindication of his actions," he said.

"But more work needs to be done. The only reason why the NSA-GCHQ sharing relationship is still legal today is because of a last-minute clean-up effort by Government to release previously secret arrangements'.

"That is plainly not enough to fix what remains a massive loophole in the law, and we hope that the European Court decides to rule in favour of privacy rather than unchecked State power."

James Welch, legal director for Liberty, added: "The Intelligence Services retain a largely unfettered power to rifle through millions of people's private communications and the Tribunal believes the limited safeguards revealed during last year's legal proceedings are an adequate protection of our privacy. We disagree, and will be taking our fight to the European Court of Human Rights."

The UK, US and Canadian governments are using data gleaned from hackers to spy on people, a report has revealed.

Documents leaked to The Intercept suggest the National Security Agency (NSA) is using data mined by hackers in their own snooping schemes in an initiative called Intolerant.

One leaked document explained the thinking behind the campaign, stating: "INTOLERANT traffic is very organised. Each event is labeled to identify and categorise victims. Cyber attacks commonly apply descriptors to each victim it helps herd victims and track which attacks succeed and which fail."

The documents went on to explain that hackers are stealing the emails of some of its targets and collecting their stolen data, meaning the investigating government agencies can get access to their targets' emails and gain other insights into who's being hacked.

They continued: "People who open attachments from unknown senders (gasp) or respond to 'Nigerian' money laundering emails aren't the only individuals on the internet being hacked.

"Some of our targets are also being targeted by outside forces, by state-sponsored and freelance hackers. Could your target's communications be the target of other countries or groups?"

The documents list a number of groups that have been spied upon using the techniques, including the Indian navy, Tibetan pro-democracy personalities and the Tibetan Government in Exile.

Other documents referred to a scheme named Lovely Horse that monitored security analyst and hacker Twitter accounts to gain insights into how to more effectively monitor targets.

"Analysts are potentially missing out on valuable open source information relating to cyber defence because of an inability to easily keep up to date with specific blogs and Twitter sources," the documents said.

The NSA's former research director has apologised for the body's endorsement of an insecure cryptography solution that was adopted by American businesses.

The NSA's support for the Dual Elliptic Curve Deterministic Random Bit Generator (Dual EC DRBG) was a key factor in the US National Institute of Standards and Technology (NIST) approving the tool as a trustworthy solution throughout the 2000s, encouraging businesses to use the system.

It was integrated into RSA Security's BSAFE toolkits, alongside others'.

However, researchers have since found plenty of backdoors allowing hackers to siphon off and decrypt data, rendering the tool useless.

The NSA's former research director, Michael Wertheimer, wrote in a letter published by the American Mathematical Society: "With hindsight, the NSA should have ceased supporting the Dual EC DRBG algorithm immediately after security researchers discovered the potential for a trapdoor.

"In truth, I can think of no better way to describe our failure to drop support for the Dual EC DRBG algorithm as anything other than regrettable."

The flaw was exposed by former government contractor Edward Snowden in 2013 in leaked documents and as a result, NIST removed the tool from its approved list in 2014.

"The costs to the Defense Department to deploy a new algorithm were not an adequate reason to sustain our support for a questionable algorithm," Wertheimer continued.

"Indeed, we support NIST's April 2014 decision to remove the algorithm. Furthermore, we realise that our advocacy for the Dual EC DRBG casts suspicion on the broader body of work the NSA has done to promote secure standards."

To add more fuel to the fire, it later came to light that the NSA may have paid RSA $10m to integrate its security solution into the software, although neither the NSA nor RSA have officially confirmed this.

Wertheimer was the NSA's research director from May 2010 until September 2014, according to his LinkedIn profile.

An email arrived in my inbox this week with the 'revelation' that Dropbox had complied with 268 law enforcement and government agency requests since January 2014.

Of those, only 91 of the customers concerned were informed regarding the legal process leading to this examination of their data. So far, so interesting, although not particularly surprising, as this kind of data privacy issue has been big news ever since the first trickle of Edward Snowden leaks began last summer.

It was also no surprise the email then went on to warn me that "many other cloud and data storage providers are receiving these kinds of requests every day," and - here comes the PR payload - there is "a way for cloud providers to extricate themselves from being in bed with the Feds."

That route involves customer-managed encryption keys.

While I happen to think that retaining control over encryption keys is a very good idea indeed, and have explained why very recently over at our sister publication Cloud Pro, I don't think it's all about Edward Snowden, Big Brother or the FBI knocking on your data storage door with a feather either.

Hanging the key management argument just on the spy scandal hook is, in my opinion, becoming increasingly dangerous. Mainly because the more people read this reasoning, the less impact it has and the less likely they are to take the matter seriously.

The real argument has more to do with due diligence, regulatory compliance, accidental data leakage and organised crime than anything else. Focusing on those arguments are far more likely to lead to change within the enterprise cloud security mindset.

I've been as guilty as anyone of suffering from OSS, AKA Obsessive Snowden Syndrome. However, it's time to stop.

There are far too many vested interests for it to continue, and I include myself and the rest of the technology media here, along with the primary defendant in the shape of the security vendors.

What Snowden did deserves our collective praise, and the increase of insecurity awareness as a result is important. Now, I would argue is the time to get back to basics and start remembering that it's all about the data. Secure that data effectively, and that includes having control and possession of your encryption keys, and you can ignore the hyperbole.

The US government threatened to fine Yahoo $250,000 every day if it didn't hand over user data to the NSA, according to recently unsealed court documents.

In a blog post, Ron Bell, general counsel of Yahoo, said the release of over 1,500 documents shed light on the firm's previously undisclosed fight with the NSA over user data access.

He said that the company "refused to comply with what we viewed as unconstitutional and overbroad surveillance and challenged the US Government's authority."

"Our challenge, and a later appeal in the case, did not succeed said Ron Bell. He added that court material showed "how we had to fight every step of the way to challenge the US government's surveillance efforts."

According to Bell, the court upheld laws preceding Section 702 of the FISA Amendments Act. This is more commonly known as Prism, which was revealed by former NSA contractor Edward Snowden.

"Despite the declassification and release, portions of the documents remain sealed and classified to this day, unknown even to our team," said Bell.

One document from May 2008 showed that the US government not only threatened to impose a $250,000 fine on Yahoo each day it didn't hand over data but would then double this fine each week the internet giant failed to turn over data. Unsurprisingly, Yahoo complied with the legal action.

Bell said that Yahoo's fight against the US government would continue.

"We are still pushing for the FISC to release materials from the 2007-2008 case in the lower court. The FISC indicated previously that it was waiting on the FISC-R ruling in relation to the 2008 appeal before moving forward. Now that the FISC-R matter is resolved, we will work hard to make the materials from the FISC case public, as well," he said.

He added that Yahoo would continue to "contest requests and laws that we consider unlawful, unclear, or overbroad".

Media mogul Rupert Murdoch has sparked a backlash after taking to Twitter over the weekend to criticise Google's privacy policies, comparing them unfavourably to the NSA.

The tweet, posted on 17 August, reads "NSA privacy invasion bad, but nothing compared to Google."

Predictably, Twitter users were quick to respond to the claim, bringing up Murdoch's own invasions of privacy with phone hacking at The News of the World newspaper, which led to its closure. Many pointed out the comments were hypocritical after his part in the paper's wrongdoing.

One respondent, @davidbadash, tweeted:

This is not the first time Murdoch has targeted the search engine, tweeting back in April: "Google attack on NSA extreme nerve. Google has more data on all of us and uses it. No evidence of NSA doing this. Ethical company?"

Also, in January 2012, he also blasted the company's role in movie piracy by tweeting: "Piracy leader is Google who streams movies free, sells advts around them. No wonder pouring millions into lobbying."

Edward Snowden has been awarded a three-year residency permit in Russia according to his lawyers.Former US Intelligence contractor Snowden is wanted in the US for leaking sensitive secrets to many high-profile newspapers in the UK and abroad, but sought asylum in Russia as it's one of the only countries that promised not to hand him in.Snowden fled to Hong Kong and then went on to Russia last year, when he was accused of leaking security secrets including controversial surveillance programmes run by the US National Security Agency (NSA) - such as PRISM - that gathered personal information from US citizens, including their email, phone and internet use.The former intelligence contractor lived in Moscow's Sheremetyevo airport before the country offered him asylum exactly a year before his residency permit began.Snowden's lawyer Anatoly Kucherena said: "The decision on the application has been taken and therefore, with effect from August 1, 2014, Edward Snowden has received a three-year residential permit. In the future, Edward himself will take a decision on whether to stay on (in Russia) on and get Russian citizenship or leave for the United States."Snowden is eligible to apply for citizenship in the country after he has been living there for five years. He will decide if he wants to stay and apply in 2018.The lawyer revealed that Snowden is being protected by private security guards to safeguard him from threats posed by the US, adding: "He leads a rather modest lifestyle, but nevertheless we proceed from the tone of statements that come from the US State Department and other political figures. The security issue should not be treated as a secondary one."It is thought that Snowden currently holds access to 1.7 million digital documents revealing information about the US' security schemes.

Apple's iOS mobile operating system contains numerous backdoors that allow hackers to bypass its PIN and password controls to steal users' personal data, a data forensics scientist has claimed.

Speaking at the Hackers of Planet Earth (HOPE) conferences last week, Jonathan Zdziarski shared with delegates details about various backdoors he claims to have found in iOS-running devices that could potentially be exploited by government agencies, such as the NSA.

During his presentation he flagged several mobile OS features that could make the OS vulnerable to government snooping, although he has since gone to great lengths to reiterate that he has not accused Apple of working with the NSA.

These include the "lockdownd", "Pcapd" and "mobile.file_relay", which it is claimed can side-step encrypted backups to plunder data on the behalf of third parties.

In a blog post, published in the wake of his appearance at the conference, he said Apple needs to explain to the 600 million people using iOS devices why this capability is included in the mobile operating system.

"At the same time, this is NOT a zero day and NOT some widespread security emergency. My paranoia level is tweaked, but not going crazy," he added.

"My hope is that Apple will correct the problem. Nothing less, nothing more. I want these services off my phone. They don't belong there."

The claims have been strenuously denied by Apple in a statement to iMore, where it was also quick to stress that it has never worked with any government agency to install a backdoor in one of its products.

"We have designed iOS so that its diagnostic functions do not compromise user privacy and security, but still provides needed information to enterprise IT departments, developers and Apple for troubleshooting technical issues," the statement reads.

"A user must have unlocked their device and agreed to trust another computer before that computer is able to access this limited diagnostic data.

"The user must agree to share this information, and data is never transferred without consent," it added.

NSA whistleblower Edward Snowden also spoke, via video link, at the conference this week, and urged attendees to use their skills and expertise to build anti-surveillance products.

Edward Snowden wants the cybersecurity industry to channel its expertise into creating technologies that prevent governments from snooping on their citizens' online activities.

Snowden, who has become a torchbearer for the anti-surveillance movement after systematically leaking details about US efforts to keep tabs on its residents, was speaking at the Hackers On Planet Earth (HOPE) conference in New York over the weekend.

During his presentation, he called on the audience to pool their resources to create anti-tracking technologies that will encrypt messages and allow people to communicate anonymously online.

"You in this room, right now have both the means and the capability to improve the future by encoding our rights into programmes and protocols by which we rely every day," he said.

"This is what a lot of my future work is going to be involved in."

His conference presentation was broadcast via video link from Russia, where Snowden was granted asylum in June 2013 in the wake of revelations he made about the activities of the US National Security Agency (NSA).

It is understood he has since found work in the country as an IT contractor, but according to a report on Reuters his Russian visa is due to expire at the end of this month.

If the Russian authorities decide not to extend his rights to say in the country, he faces being sent back to the US where he faces criminal charges over his decision to leak classified information about the NSA's activities.

In his most recent round of revelations, published last week, Snowden claimed nude photos accrued by the NSA during its surveillance activities were "routinely" passed around by some members of staff.

The claim was made during a seven hour interview with The Guardian newspaper, where he also shed some considerable light on his life in Russia.

Microsoft COO Kevin Turner has admitted the firm is in the midst of re-inventing itself as it looks to catch up to its competitors.

In a wide-ranging keynote at the firm's annual Worldwide Partner Conference, Turner talked about market share, how it plans on targetting the low-end space and what it's doing to combat snooping. He also revealed brief details about Windows Threshold.

Global device market share

Turner claimed Microsoft has changed the way it measures success in the device space as it now looks at the market as a whole. He conceded the firm has just 14 per cent of global device market share when PCs, smartphones and tablets are tallied.

"The reality is the world's shifted, the world's evolved," WinBeta reported Turner as saying.

"We now measure ourselves by total device space. We have a much bigger opportunity than we've ever had in the past to grow our business, but we have to rethink how we look at our business."

Windows vs Chromebooks

As part of Microsoft's strategy to increase market share, Turner announced that a $199 HP Stream Windows laptop will go on sale at the end of the year. However, he stopped short of sharing the device's specifications on-stage.

He also revealed an 11.6in Toshiba laptop, with a 32GB SSD, will retail at $249, and 7/8in Windows tablets will be launched with a price-point of $99.

"We are going to participate at the low-end," The Verge reported Turner as saying.

"We've got a great value proposition against Chromebooks, we are not ceding the market to anyone."

Protecting data against government snooping

Turner reaffirmed Microsoft's commitment to protecting user data, noting it will take government authorities to court if necessary to protect information.

"We will not provide any government with encryption keys or assist their efforts to break our encryption. We will not engineer backdoors in the products," he was quoted as saying by Redmond magazine.

"We have never provided a business government data in response to a national security order. Never. And we will contest any attempt by the US government or any government to disclose customer content stored exclusively in another place. That's our commitment."

Windows Threshold

Little information was revealed about the next major edition of Windows, which is codenamed Threshold and is expected to be launched in Spring 2015.

Turner did claim the firm was listening to feedback from consumers and businesses and that the operating system will be a "great world-class enterprise OS."

New releases from whistleblower Edward Snowden have revealed that only 10 per cent of all communications data collected by the NSA came from the agency's targets.

The documents released by Snowden included 160,000 email and instant messaging conversations, as well as 7,900 files ripped from more than 11,000 online accounts. All of the info was collected during the NSA's highly controversial PRISM and Upstream projects.

According to analysis conducted by The Washington Post, nearly half of all the files contained details belonging to US citizens which had been "minimised" due to lack of a security threat.

A significant majority of the remaining 50 per cent were foreigners with no links to terrorist or criminal activities, such as tourists and visitors on business.

Among the documents that it pinched, the NSA found revelations about an overseas nuclear project, the military secrets of a foreign power and the identities of aggressive intruders into US computer networks, according to The Post.

Despite this, a far larger number of discoveries included the details of ordinary people's lives. Among them were divorce proceedings, tax documents, political and religious conversations and other private communications.

There are rules in place for most government agencies in the US when they intend to hack into someone's private life. Taps that are installed into phones by the FBI, for example, are switched off when a wife or child uses it.

The NSA, however, dredged up the names and details of every person in a chatroom their target entered. This included those who were logged into the room by default for just visiting the website.

According to a former agency analyst that spoke to the publication, the NSA taught their staff that only "reasonable belief" a target was foreign would be enough to justify spying on them.

Often people would be targeted for writing their emails or communications in a foreign language, despite millions of Americans not having English as their primary dialect, the documents detail.

The NSA would then push the boundaries outwards, so that every friend of a "foreigner" was guilty by association and warranted surveillance.

The Electronic Frontier Foundation has filed a complaint against the NSA, alleging it knew about the Heartbleed bug for years before the public learned of its existence.

The internet freedom campaign organisation claimed that the NSA chooses where and when it informs the security community about zero-day flaws and is aiming to get the spy agency to be more transparent.

In April, it was revealed by Bloomberg News that the NSA had secretly exploited the Heartbleed bug in the OpenSSL for at least two years before the public knew of its existence. The US government denied the report and said it had developed a Vulnerability Equities Process for deciding when to share knowledge of exploits with firms and the public.

The White House explained in a blog at the time this process was to disclose flaws and said it had "established a disciplined, rigorous and high-level decision-making process for vulnerability disclosure".

But in the same post said that the process had "no hard and fast rules".

The EFF said it had lodged a Freedom of Information request for records related to zero day flaws with both the NSA and the US Office of the Director of National Intelligence. It made the FOIA request on 6 May but has yet to have received any documentation. The privacy campaigners also want more detail on how intelligence agencies choose whether to disclose exploits.

"This FOIA suit seeks transparency on one of the least understood elements of the US intelligence community's toolset: security vulnerabilities," said EFF Legal Fellow Andrew Crocker. "These documents are important to the kind of informed debate that the public and the administration agree needs to happen in our country."

EFF Global Policy Analyst Eva Galperin said that while spy agencies held onto zero day exploits, the wider community was left defenceless against hackers and cybercriminals as well as unfriendly foreign governments.

"Since these vulnerabilities potentially affect the security of users all over the world, the public has a strong interest in knowing how these agencies are weighing the risks and benefits of using zero days instead of disclosing them to vendors," she said.

The National Security Agency (NSA), set up to combat foreign and domestic intelligence threats to the US, has had its reputation turned upside down since whistleblower Edward Snowden began to leak details of its clandestine activities.

In the past year, Snowden's leaks have revealed more than 40 separate intelligence campaigns undertaken by the NSA or its UK allies at GCHQ.

Among the most infamous was the news the NSA had been infiltrating the data centres of US technology companies - including Facebook, Microsoft and Google - and snatching user data from the traffic.

Upstream and PRISM, the names of the surveillance operations that conducted those clandestine acts, caused outrage throughout the technology industry and the world. People began to wonder if their data was truly safe in the hands of the big companies and on the internet.

The ripples of that discovery can still be felt today, as companies attempt to side-step their involvement or relocate their services to assuage worried customers.

Yet those two operations were only part of myriad of projects the NSA and GCHQ have undertaken. The details of many more have been released by Snowden over the past year, some of which you might never even have heard of.

Angry Birds

Nowhere is safe from the prying eyes of government agencies, it seems, not even much-loved mobile game Angry Birds.

As soon as a player opened up the game and began their bird-slinging adventures, algorithms within the game's code relayed their age, sex and other information to intelligence agents.

This is according to documents leaked from GCHQ, which revealed how it and the NSA had been working on ways to tap into mobiles and collect data through apps. Not just Angry Birds fell foul of the surveillance program: Google Maps, Facebook, Twitter and LinkedIn were also targeted.

"It effectively means that anyone using a smartphone is working in support of a GCHQ system," a secret 2008 report by the British agency said.

NoseySmurf

Also known by the names "TrackerSmurf" and "DreamySmurf", the NoseySmurf project tied into the Angry Birds scheme by tapping into mobile phones to scrape data from users.

The NSA spent over $1 billion (580 million) in its search to find more efficient tracking and piggybacking methods for infiltrating targeted devices. In one top-secret presentation, the agency describes a victim uploading an image to Facebook from their phone as a "Golden Nugget!!"

From the simple act of someone uploading a picture to a social media site, later slides say, agents could glean a victim's contacts, location, gender, age, income, ethnicity, education level and even number of children.

HappyFoot

HappyFoot was the codename for an operation designed to track internet users' movements by piggybacking onto their cookies and location data.

When a consumer visits a site cookies are enabled on their computer, allowing the site's company to tailor advertisements to them, something government snoops were keen to exploit.

Slides released by Snowden and published by the Washington Post revealed the NSA had been latching onto these cookies in order to identify possible targets for further hacking operations.

Using a unique cookie from Google called PREF, intelligence agents could pick out one person from a sea of internet data in order to focus on them specifically. The NSA slides indicated that Google complied with this action entirely after being compelled to by the US government.

Squeaky Dolphin

There's a prize for anyone who can understand the reasoning behind this codename. Squeaky Dolphin was an initiative thought up by the UK's GCHQ. It involved tapping into the cables carrying the world's web traffic in order to monitor what people are up to on social media.

Documents leaked to NBC news by Snowden revealed how British spies showed off their new invention to their US counterparts. GCHQ demonstrated how it could monitor YouTube in real time and collect addresses from the billions of videos watched every day.

Analysts demonstrated how, through a central information hub, they could determine which videos were popular in which cities and at what times, as well as what each demographic preferred to click on.

The UK spooks did mention to their allies that this program was for general trends only and not for spying on individuals, but there are as yet unconfirmed rumours GCHQ used the tech to target Twitter users with propaganda.

Gilgamesh

Unfortunately, this operation has nothing to do with the fifth king of Uruk Mesopotamia.

According both to documents released by Snowden and the testimony of a former drone operator, the NSA used telecommunications devices as targets for drone strikes.

Rather than confirming with operatives on the ground, said the whistleblower, the NSA would identify a target based on the geolocation of their phone and order an assassination.

The drone operator was adamant the technology was aiding the War on Terror but that civilians were "absolutely" being killed en masse by the strikes.

Terrorists cottoned on to the NSA's idea, though, and began to mix up their SIM cards to avoid being tracked. Commanders would switch them with footsoldiers and footsoldiers with civilians.

The NSA often located targets based on their activity levels and not on the content of the calls, resulting in, according to the former pilot "death by unreliable data."

EgotisticalGoat

EgotisticalGoat and its sister program, EgotisticalGiraffe, were designed to help facilitate attacks on people using the anonymous network Tor.

Techniques included targeting web browsers like Firefox and giving the NSA full control over a target's computer keystrokes, online activity and files.

The Tor network is relied upon by journalists, activists and campaigners around the world to maintain the secrecy of their communications and avoid reprisals from their respective governments.

The network, oddly enough, is provided with 60 per cent of its funding by the US government.

Agents operating EgotisticalGoat admitted the Tor network was too large for them to completely crack. In one top-secret presentation named "Tor Stinks" it stated "We will never be able to de-anonymize all Tor users all the time ... with manual analysis we can de-anonymize only a very small fraction of Tor users."

With more information to come from Snowden, who claims his leaks to date are just the tip of the iceberg, do we have more cause for concern over our data than ever before? Are all of these operations a gross misconduct or a necessary evil? Let us know what you think by emailing us at comments@itpro.co.uk.

Cisco's legal counsel has blasted the US government over accusations the NSA has been tampering with communications equipment.

The spy agency has reportedly been intercepting shipments of routers, switches and servers in order to hide their surveillance equipment.

Writing in a blog post, Cisco's legal counsel Mark Chandler said that the actions of the US government have overreached, "undermining the goals of free communication".

"Confidence in the open, global internet has brought enormous economic benefits to the United States and to billions around the world," said Chandler.

"This confidence has been eroded by revelations of government surveillance, by efforts of the US government to force US companies to provide access to communications of non-US citizens even when that violates the privacy laws of countries where US companies do business, and allegations that governments exploit rather than report security vulnerabilities in products."

Chandler said that it was Cisco's policy and practice not to work with any government, the US included, to weaken its products.

"When we learn of a security vulnerability, we respond by validating it, informing our customers, and fixing it.

"We react the same when we find that a customer's security has been impacted by external forces, regardless of what country or form of government or how that security breach occurred. We offer customers robust tools to defend their environments against attack, and detect attacks when they are happening. By doing these things, we have built and maintained our customers' trust.

"We expect our government to value and respect this trust."

Last December, eight technology companies expressed concern to US President Barack Obama and Congress that the US government's surveillance efforts as revealed by Snowden were harmful.

Chandler said that the revelations over hardware tampering were damaging and his firm should not expect the government to act in this manner.

"We comply with US laws, like those of many other countries, which limit exports to certain customers and destinations," said Chandler.

"We ought to be able to count on the government to then not interfere with the lawful delivery of our products in the form in which we have manufactured them. To do otherwise, and to violate legitimate privacy rights of individuals and institutions around the world, undermines confidence in our industry."

The NSA has been intercepting shipments of routers, switches and servers in order to hide their surveillance equipment, according to the people who exposed the agency's secret Prism spy project.

Journalist Glenn Greenwald made the revelations to a number of news sources while promoting his new book "No Place to Hide", which details more of the state secrets Edward Snowden revealed to him.

A June 2010 report from the head of the NSA's Access and Target Development department explains how the NSA would intercept packages, he alleges. The agency would then install surveillance equipment before resealing the packages so the changes were undetectable. The shipments would then be sent abroad.

When the equipment was finally received and installed it would then connect back to the NSA. The report states: "In one recent case, after several months, a beacon implanted through supply-chain interdiction called back to the NSA covert infrastructure. This call back provided us access to further exploit the device and survey the network."

The Guardian reports that for years the US government had warned companies not to trust Chinese routers manufactured by companies such as ZTE and Huawei because they "are built with backdoor surveillance functionality that gives the Chinese government the ability to spy on anyone using them."

The committee behind the claims explained that "private-sector entities in the United States are strongly encouraged to consider the long-term security risks associated with doing business with either ZTE or Huawei for equipment or services. Based on available classified and unclassified information, Huawei and ZTE cannot be trusted to be free of foreign state influence and thus pose a security threat to the United States and to our systems."

This led to Huawei eventually abandoning the US market. If Greenwald's claims are true, it now seems the US government was doing exactly the same.

A leaked email exchange between Google and the NSA suggests the two parties were working far more closely than the former has implied.

Al Jazeera has posted two sets of emails between NSA director general Keith Alexander and Google executives Sergey Brin and Eric Schmidt, dated from before the Snowden revelations last year, discussing company cooperation.

In one email, dated June 2012, Alexander invites Schmidt to a four-hour meeting on classified threats at a secure facility near San Jose. Alexander had already met with other industry executives, but wanted a separate meeting with the Google exec.

The emails are said to have been related to the NSA's Enduring Security Framework (ESF) program. The ESF project played a major role, according to Alexander, in thwarting BIOS attacks on American computer systems.

Schmidt, who has been critical of the NSA and declared its surveillance programs illegal, replies in friendly terms to Alexander: "So great to see you!" He writes. "I'm unlikely to be in California ... would love to see you another time."

Google co-founder Sergey Brin attended other ESF meetings, and was sent an email by Alexander to thank him for his participation in the programme: "Your insights, as a key member of the Defence Industrial Base, are valuable to ensure ESF's efforts have measurable impact."

When it was alleged the NSA had infiltrated Google's internal datacentres, the company spoke up in outrage. The firm has also reacted by making changes to its privacy policy, allowing it to inform users who are targeted by government data requests.

The disclosure by Al Jazeera has indicated that perhaps the companies in Silicon Valley know more than they are letting on. Indeed, earlier this year a senior lawyer for the NSA told The Guardian of how the major tech companies were fully aware of PRISM and its implications.