NSA Paid a Huge Security Firm $10 Million to Keep Encryption Weak

Gizmodo ^ | 20 dec 2013 | Gizmodo

[James C. Bennett]

Reuters reports that the NSA paid massive computer security firm RSA $10 million to promote a flawed encryption system so that the surveillance organization could wiggle its way around security. In other words, the NSA bribed the firm to leave the back door to computers all over the world open.

Thanks to documents leaked by Edward Snowden, we already knew the NSA played a central role in promoting a flawed formula for generating random numbers, which if used in encryption, essentially gives the spies easy access to computing systems. A piece of RSA software, bSafe, became the most significant vector for the security flaw. The encryption tools which hundreds of millions of people rely on to protect the private information are significantly weaker as a result.

The sickening revelation is that the NSA paid RSA to make sure that the formula got into the software just the way they wanted it to. Both the NSA and RSA haven't directly acknowledged the deal, but Reuters claims to have thoroughly vetted it with sources inside the security company.

The report is just the latest which shows that—in an effort to collect as much information as possible—the NSA has been systematically undermining security infrastructure for decades. While some of Reuters' sources appear to think that RSA was duped by the government, it seems pretty clear now that the company knew what it was doing when it entered into a secret contact with the NSA. Disgusting.

[LaRueLaDue]

OpenBSD, OpenSSH, OpenVPN, OpenSMPTD, Gnu PG, etc.

[Graewoulf]

Impeachment File for the 2014 Impeachment of “B. Hussein Obama,” aka Barry Soetoro, a documented legal citizen of the Sovereign Nation of Indonesia.
________

Documentation File for the 2014 Impeachment of John Boehner for Dereliction of Congressional Duty by Speaker Boehner for failure to appoint a Special NSA Investigator.

[freedomfiter2]

As a patriot, I want the government weak enough that the citizens can replace it by force if necessary.

[freedomfiter2]

Our government is the kind of government our founders went to war to get rid of.

[ThunderSleeps]

I think RSA just died as a company. Who will ever trust them again? My company uses them, nearly dropped them after they were hacked not long ago and we all had to get new fobs. I’ll bet we are off RSA within a few weeks.

[expat1000]

PGP FREE: I would think the Windows XP version runs fine on 7 & 8 as well http://www.pgpi.org/products/pgp/versions/freeware/

PGP COMMERCIAL: http://www.symantec.com/encryption

I think it *does* have all the functionality most people need, but the free version is not quite as user friendly as most people are used to. I never tried the commercial one.

I don’t know why people that need encryption don’t use it more. For me, I don’t really need it and figure its use would raise all kinds of red flags, so that’s the trade-off.

The free version for sure, if obtained from a reliable source and verified does not have any backdoors.

[TigersEye]

The free version for sure, if obtained from a reliable source and verified does not have any backdoors.

Thank you for the answer and the additional comments about PGP. Haven't seen it mentioned in such a long time I wondered if it had been neutralized by the advances of time and technology.

It occurred to me also that using it would act like a red flag. OTOH if I used it for all communications that's all they would have to be suspicious of.

[ColdSteelTalon]

When you purposefully make week encryption so the NSA can crack it, then other code crackers will be able to crack it.

RSA and EMC have opened themselves up to a huge lawsuit. Especially since they touted that their security was well designed. It could not be if it had a flaw in it that RSA purposefully encoded in it.

[ColdSteelTalon]

The best thing to do is find a company that has programmers that have not kowtowed to any government, and that writes encryption without back doors or flaws in the algorithm.

I have heard there are former American citizens who renounced their citizenship so that they could legally write such encryption software.

[null and void]

Nut-job Conspiracy Theory Ping!

To get onto The Nut-job Conspiracy Theory Ping List you must threaten to report me to the Mods if I don't add you to the list...

[PGalt]

Thanks for the ping; post; thread. Very interesting. BTTT!

[Bikkuri]

Linus' father confirms NSA attempt at backdoor in Linux

When my oldest son [Linus Torvalds] was asked the same question: “Has he been approached by the NSA about backdoors?” he said “No”, but at the same time he nodded. Then he was sort of in the legal free. He had given the right answer …everybody understood that the NSA had approached him.

[James C. Bennett]

You’re welcome!

[Travis McGee]

[SunkenCiv]

Thanks James C. Bennett.

[Hardastarboard]

massive computer security firm RSA

Funny. I've never heard of them. Oracle, IBM, SAP, Red Hat, Microsoft, yada, yada, yes. RSA?

[EEGator]

Easily the best surfing / FBI flick. :)

[Patriot95]

Very true, but the difference is the leadership in those countries is not dumb enough to get caught. Unless Snowden was Obama’s way of dumping more of our secrets and destroying our reputation...

[GOPJ]

Disgusting. I assume RSA is either part of NSA or their finished. Or both.

[jpsb]

"So now who does anybody trust when it comes to operating system security?"

And Open Source OS that you compile yourself would be the safest bet. Since thousands of eyes are looking at the source code. Just make sure any libraries you compile with are Open Source too.