Is There A Positive Aspect To CIA Spying?

The latest release from WikiLeaks detailing how the CIA has allegedly stockpiled a plethora of tools to hack a variety of everyday devices, from phones, to televisions to cars, is a stark reminder about the fragile state of Internet security. 

The US government has amassed extraordinary hacking powers largely in secret, and this leak might just force us to grapple with whether we are comfortable with that.

The most widely reported aspect of the purported leak is the allegation that the CIA has myriad ways to hack popular smartphones like iPhone and Android devices, and that the agency could be allowing its hackers to take control of internet connected televisions and covertly listen in on conversations in people’s living rooms. 

This type of attack has been the worry of many privacy advocates for years, as more and more televisions and other household devices, collectively known as the Internet of Things, are increasingly connected to the Internet while always “listening”.

There was never a doubt that the US and other government around the world would quickly move to leverage the ability to exploit these features, as more and more consumer electronics companies have made them standard in all sorts of household items. 

The former Director of National Intelligence James Clapper even made clear in testimony to Congress last year. But just how often governments have exploited this type of technology is still largely unknown.

While many of the headlines accompanying these documents will send a shiver down the spine of readers, there is some good news in the WikiLeaks documents. 

Contrary to some early reports suggesting that the CIA can “defeat” popular end-to-end encrypted messaging apps like Signal and WhatsApp, the WikiLeaks release is further evidence that encryption does work to protect people’s privacy.

The documents do purport to show is that the CIA has a host of exploits to attack the operating systems of popular mobile devices like iPhones and Androids, a deeply worrying prospect, to be sure, but to “defeat” secure messaging apps, government hackers essentially have to gain access to your phone itself before they can read your messages. 

So if you’re using an app like Signal, the content of those communications are at least still likely protected from their vast surveillance nets that otherwise indiscriminately capture billions text messages and emails per day.

This is encouraging news. The Snowden revelations were so offensive to so many people because the government was secretly using mass surveillance to spy on hundreds of millions of people at once, the vast majority of them innocent. 

With countless users switching over to end-to-end communications in recent years, it means intelligence agencies like the CIA must target individuals one by one, which, in turn, means the cost for each surveillance target goes up, and forces them to prioritise a much smaller number of people.

Still, the amount of smartphone vulnerabilities and exploits detailed in these documents was shocking even to experts. “It certainly seems that in the CIA toolkit there were more zero-day exploits”, an exploitable vulnerability in software not known to the manufacturer, “than we’d estimated,” Jason Healey, a director at the Atlantic Council think tank, told Wired Magazine. He added: “If the CIA has this many, we would expect the NSA to have several times more.”

As Edward Snowden himself tweeted recently: “Why is this dangerous? Because until closed, any hacker can use the security hole the CIA left open to break into any iPhone in the world.” He called it “reckless beyond words.”

For years, civil society groups have been calling on US intelligence agencies to disclose these vulnerabilities to tech companies instead of hoarding them in secret. Intelligence agencies should help make the everyday devices we rely on safer, rather than less secure. 

The government has claimed that they run the vulnerabilities they know about through an interagency “equity process” to determine whether they should disclose and help fix them. But the surprising amounts of exploits in the WikiLeaks release suggests this process is either woefully inadequate or largely only exists on paper.

Undoubtedly, there will be a heated debate over WikiLeaks and the value of having these documents in the public record for the days and weeks to come, as any publication by WikiLeaks inevitably does. 

But whether Trump administration officials like it or not, the hacking powers of our government is a vital topic that needs much more public debate, and this latest release may end up fueling it.

But in the mean-time, perhaps you might download Signal.

Guardian:

 Assange Says CIA Lost Control Of Its Cyber Weapon Documents:

CIA leak 'absolutely' an 'inside job':           Signal: The Snowden-Approved Crypto App Comes to Android

 

 

« A Common Language For Sharing Intelligence On Cybersecurity Threats
New Malware Hides In Memory »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

RISA

RISA

RISA solutions help to secure networks, improve overall network security, and achieve government regulatory compliance.

Stratogent

Stratogent

Stratogent is a custom managed services organization based in San Mateo, California. We design, implement and support mission critical infrastructure

Ripjar

Ripjar

Ripjar is a global company of talented technologists, data scientists and analysts designing products that will change the way criminal activities are detected and prevented.

BitRaser

BitRaser

BitRaser serves your needs for a managed & certified data erasure solution that can support internal & external corporate audit requirements with traceable reporting.

Cymulate

Cymulate

Cymulate is a SaaS-based breach and attack simulation platform that makes it simple to know and optimize your security posture any time, all the time.

Skurio

Skurio

Skurio create cost-effective, intuitive and powerful Cloud based solutions to identify threats, detect data breaches outside the network and automate the response.

Seric Systems

Seric Systems

Seric is a technology business specialising in security, infrastructure and data management.

RIPS Technologies

RIPS Technologies

RIPS Technologies delivers automated security analysis for PHP applications as platform independent software or highly scalable cloud service.

CERT Tonga

CERT Tonga

CERT Tonga is the national Computer Emergency Response Team for Tonga.

Awake Security

Awake Security

Awake Security offer a security solution built on an AI platform that acts like the human brain to sense, detect, and respond to threats you may not even know exist.

X4 Technology

X4 Technology

X4 Technology is a leader in finding the very best technology talent for some of the world’s most innovative start-ups and globally recognised brands.

SIRP Labs

SIRP Labs

SIRP is a Risk-based Security Orchestration, Automation and Response (SOAR) platform that fuses essential cybersecurity information to enable a unified cyber response.

DNX Ventures

DNX Ventures

Based in Silicon Valley and Tokyo, DNX Ventures is an early stage VC for B2B startups in sectors including Cybersecurity.

Digitpol

Digitpol

Digitpol’s Cyber Crime Investigation experts investigate hacking incidents, ransomware, extortion and conduct security audits and IT upgrades.

Edgile

Edgile

Edgile is the trusted cyber risk and regulatory compliance partner to the world’s leading organizations, providing consulting, managed services, and harmonized regulatory content.

NASK

NASK

NASK is an integrator of telecommunications services. We provide advanced ICT security services, collocation and hosting, data centre services, and build corporate networks.