Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [nsa]

The National Security Agency (NSA) is a United States intelligence organization

0
votes
4answers
140 views

Why it bothers if someone can de-anonymize anonymous network (like Tor)?

So we all know that NSA has the ability to track down Tor, I2P and all those anonymous networks. I know it's a piece of old news, but the question always shows up in my mind. Which is why bother it? I ...
-1
votes
0answers
37 views

Side channel attacks in the wild?

I have read papers about Spectre and many other side channel attacks in various areas. With the exception of government agencies, for example the National Security Service, where have these side ...
0
votes
2answers
127 views

Best Source of Security Configuration Guidance

Over the years I have used a number of different sources of security configuration guidance for a spectrum of systems including for example: https://www.cisecurity.org/cis-benchmarks/ https://www....
2
votes
1answer
166 views

Imagine I found a fast algorithm for prime factorization. What to do? Who to contact? [closed]

I'm often playing around with prime numbers, just for fun. Imagine, I found an algorithm by accident that factorizes numbers into their prime parts exactly as fast as multiplicating them in the first ...
-2
votes
1answer
49 views

Network product (software and hardware) vendors independent from NSA in 2018 [closed]

Which vendors of network products like firewalls, routers, switches, VPN softwares and similar are likely to be free from backdoors, already built in surveillance capabilities, secretly broken ...
0
votes
4answers
1k views

Does the NSA/CIA have the capacity to crack AES?

I doubt anyone knows if they actually have this technology for certain, but from a technical perspective, does this seem like something the big agencies would have access to? AES has been out almost ...
0
votes
1answer
164 views

Can an OS .iso downloaded from Microsoft.com be compromised after the download?

I've have looked at and considered Question about potential ISO infection and ISO verification and How do I check the hash of an ISO? I've been concerned about security and I have been reading a lot ...
1
vote
0answers
66 views

Is there any 100% safe way to download an iso of Windows? [duplicate]

I've been concerned about security and I have been reading a lot about stuxnet and hearing a lot lately about the leaked NSA exploits and the more recent leaked exploits NYtimes and how they are ...
1
vote
2answers
230 views

What threat model implies any benefit to drug dealers using candy bar dumb phones for business with iPhones for personal use?

I mean if law enforcement or other state actors are surveiling their comms, it makes sense to have it be anonymous, but I just saw a guy who was obviously a drug dealer in the underground with an ...
2
votes
2answers
767 views

Who put the killswitch in the WannaCry ransomware? [closed]

The WannaCry ransomware contains a killswitch, a URL that when registered, caused the malware to shutdown. Question is, who put in the killswitch? Was it the bad guys? Was it the NSA? Could it have ...
1
vote
1answer
512 views

Privacy implications of Intel CPU's secret 3G communication (Anti Theft 3.0)

From what I understand pretty much all Intel CPUs produced since Sandy-Bridge have "secret" 3G capabilities in their IME (Intel Management Engine). This IME has full access to the memory bus and ...
4
votes
1answer
678 views

Internet security - how long does the NSA store data? [closed]

I am aware that the NSA collects unheard of amounts of data via cable-tapping programs such as OAKSTAR/STORMBREW/BLARNEY/FAIRVIEW and by other means. I also know that the NSA has very large and ...
3
votes
1answer
681 views

Can I use CloudFlare if I want to avoid NSA and FISA secret orders? [closed]

We're running a web service in Europe, secured with TLS and we're using private keys generated on our private hardware. We would like to use CloudFlare for DDoS protection and caching reverse proxy. ...
0
votes
1answer
148 views

Differences in classified data handling

Is the difference in the strength of the cryptographic algorithms the only difference between handling TOP SECRET and SECRET information? Say in NSA Suite B, the following is recommended: - SECRET: ...
-2
votes
1answer
147 views

How do government organizations eavesdrop on its citizens? [closed]

I know many governments perform this act for various reasons from state security to political gains. I heard more of them are performing SSL strip attacks and are listening to https communications as ...
1
vote
4answers
245 views

If the NSA forced every US Cert Authority to hand over their keys what would be the threat?

Say the NSA hands Comodo an NSL and forces them to give up all their signing keys and whatever else they need. Then do this to every other CA company. What would be the side effects of this?
1
vote
1answer
87 views

Maximally using available bandwidth to masking data transfer and mitigate VPN correlation attacks

As of a week ago, I now find myself living in one of the more oppressively surveilled states in the world. I do not like this on ideological grounds. Therefore, I will acquire a vpn subscription for ...
4
votes
2answers
586 views

Hardening Tor/proxy chain by choosing the relays' countries

Tor is in fact just a proxy chain consisting of 3 proxies. A good enough reason to do the paperwork can be enough to deanonymize a user (the link is valid assuming all the relays' ISPs store logs). ...
0
votes
1answer
146 views

Does finding deleted thumbnails of webpages I visited mean that I am under surveillance?

I accidentally formatted my external HDD. Used several recovery programs and when it was recovered, I found many files that I have never stored them on that HDD, such as thumbnails of the images and ...
15
votes
1answer
4k views

What does the NSA's Recently Leaked “The Equation Group” Files do?

First Hand Details: TEG (The Equation Group) is NSA's team of hackers who'd write code to exploit systems worldwide. Some of the private files were recently dropped by a group called Shadow Brokers &...
3
votes
1answer
48k views

Is using “SHA-256 with RSA-2048 Encryption” a secure certificate hashing algorithm?

Is using "SHA-256 with RSA-2048 Encryption" a secure certificate hashing algorithm? I don't think it is. Two examples: nsa.gov [careers site] give.wfp.org
38
votes
4answers
10k views

How does IP address spoofing on the Internet work? Who can do it?

Someone recently told me that the NSA could impersonate pretty much anyone they want by using IP address spoofing on the Internet. But how would that work and to what extend is it true anyway? Could ...
1
vote
0answers
69 views

Can the NSA/FBI Recover Encrypted iPhone Contents by Decapping the Chips? [duplicate]

The NSA/FBI certainly has the ability to reliably decap microprocessors, surely has impressive microscopes that can map out those chips and insert probes, and probably has access to many of these chip'...
41
votes
2answers
9k views

Why hasn't anyone taken over Tor yet?

Tor is known to encrypt the transferred content and the meta information by layering the encryption. I know there have been correlation attacks that deanonymized some users by federal agencies. Why ...
5
votes
3answers
778 views

How often do high-end attackers actually use zero-day exploits?

Earlier this week the head of the NSA's Tailored Access Operations unit rather remarkably gave a presentation at the USENIX Enigma security conference. (News coverege here and here; video of the talk ...
65
votes
2answers
8k views

Why has the NSA had a hand in deciding on encryption standards?

The NSA has had a large hand in the design of at least two significant encryption standards: the Digital Encryption Standard, and its successor, the Advanced Encryption Standard. Because of their ...
9
votes
2answers
2k views

How the NSA can break trillions of encrypted Web and VPN connections

Based on Diffie-Hellman's negotiation of key exchange, why would it turn out that only a few primes are commonly used? What and who determines the prime? Would it not be safer to use a safe prime? (...
2
votes
1answer
151 views

(Theoretically) intercepting GCHQ's smartphone exploit

In the lastest Snowden interview, it was revealed that GCHQ used an exploit sent via SMS to gain access to smartphones, and that this 'exploit' goes unnoticed to the handset user. I was wondering if ...
1
vote
2answers
348 views

Is unclassified a classification?

The answer many sources provide is "technically, no, unclassified is not a classification", but they often are referring specifically to Unclassified SBU or FOUO. Besides that... any answer that ...
-2
votes
1answer
240 views

Government policy toward open source software? [closed]

What are the government policies, specially security organizations, regarding open source? Are they using these types of software? Also, there are some papers related to this topic? I have found: ...
3
votes
0answers
207 views

Can Google tech be trusted? [closed]

With the Snowden leaks, Google has been implicated in the activities of the NSA. There really is no way for ordinary citizens to know with certainty what the exact reality of this involvement is. In ...
-1
votes
3answers
1k views

If TLS 1.2 is considered unbreakable, why do the NSA and other agencies invest in supercomputers? [closed]

If a 2048-bit RSA key and a 256-bit AES key are considered to be unbreakable within the foreseeable future by any kind of computer, why do the NSA and other intelligence agencies invest in ...
11
votes
7answers
4k views

What's the safest way to transmit a message to another client through a server hidden from high level malicious users? [closed]

Suppose you're constantly being menaced by high profile hackers and agencies that try to intercept messages sent between you and a friend. The question is: what's the safest way to send messages to ...
-1
votes
2answers
195 views

High Level NSA Target, Help/Feasibility [closed]

I would like to know the feasibility of certain kinds of attacks. To be clear, assume the target is a high-level priority of the NSA. Is an OS such as tails useless against root-kits/keyloggers, etc? ...
0
votes
1answer
170 views

TrueCrypts full Disk Encryption still secure? [duplicate]

I'm wondering because it only uses RIMPEMD-160 with just 3000 iterations. Isn't that somewhat low and weak? Even though I saw the NSA document that the NSA were not able to break TrueCrypt in 2012.
7
votes
2answers
714 views

Does HTTPS protect you from fingerprinting by the NSA?

We've established that, for all intents and purposes, HTTPS hides what page you visit on a given server from NSA backbone wiretapping, but not the domain itself. But that's only IP / domain ...
11
votes
4answers
4k views

Does HTTPS encryption on a site prevent the NSA from knowing you visited its domain / the URL?

The reason I ask whether HTTPS protects the metadata of your Internet activity from a wiretapping entity on the backbone like the NSA or not, is the following scenario: Say I am browsing the ...
0
votes
2answers
125 views

Can prism know even data outside the US Data centers?

I would like to know whether the US Prism can know even the data outside of the US Data centers. For example, If I have my own servers and all the data in Indian servers but I have been using some ...
-2
votes
2answers
135 views

Can I ever hope to be secure using a cell phone or any mobile device? [closed]

I love my phone, it's small, I can bring it everywhere, I can access the wealth of human knowledge online, and do so much more. But with the recent light of the NSA and other world government agencies,...
-2
votes
1answer
366 views

How can Tor be considered a standard tool for achieving anonimity, given that it is created by the government? [duplicate]

Tor network is considered to be a main tool for achieving network anonymity. But it is of common knowledge, that Tor was created by programmers in US Navy. Yet the main "spy" on the net is considered ...
170
votes
4answers
21k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
3
votes
2answers
434 views

Protecting against GCHQ port scans: How does TCP stealth work?

Today I read the first time about a draft of TCP Stealth which should serve as a protection against GCHQ and NSA vulnerability scanning(Source: https://en.wikipedia.org/wiki/TCP_Stealth): The ...
2
votes
1answer
89 views

Possibility of using CA as an attack point by governmental organizations under their pressure

I was always concerned about the model of trust behind CA stuff we use . Well, for most of us, it is OK to trust them, since they are reliable organizations with a bunch of solid experience. ...
5
votes
3answers
825 views

How can the NSA remotely turn on your iPhone?

If the iPhone is actually off and not in sleep mode, how can it be remotely turned on if no software is running and network communications aren't even activated until the device boots?
44
votes
5answers
9k views

HTTPS still NSA-safe? [closed]

There are exerpts, that say that using https can be broken by the NSA by now. So is https still a solution for secure web-browsing? source: http://www.digitaltrends.com/web/nsa-has-cracked-the-...
13
votes
2answers
3k views

Snowden: “The NSA can remotely turn on your iPhone.”

Watching the Snowden interview last night, Brian Williams asks him what degree of control the NSA has over smartphones -- in particular, whether or not they can remotely turn them on in order to ...
4
votes
2answers
2k views

How can NSA implants and backdoors be detected? [closed]

It has been a while now since the Snowden revelations of various NSA malware and backdoors. For instance: March 12, 2014: NSA has developed implants to take over targeted computers’ microphones and ...
4
votes
1answer
612 views

How does the NSA restrict public access to cryptography?

In Bruce Schneier's book Applied Cryptography (1994?) he writes The NSA uses its power to restrict the public availability of cryptography, so as to prevent national enemies from employing ...
6
votes
2answers
2k views

Is 1password vulnerable to NSA spying? [closed]

In light of the recent heartbleed vulnerability, I'm thinking of switching to a service like 1Password. However, I don't know how to evaluate the risk of NSA (or other government) spying. So, two ...
3
votes
3answers
280 views

How can NSA see everything without us noticing that? [closed]

Here's one thing that keeps bugging me ever since I heard about the NSA revelations. From what I heard, NSA built a system that basically sees most of the internet, made of many subsystems which ...