Secret contract tied NSA and security industry pioneer

Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.

via Exclusive: Secret contract tied NSA and security industry pioneer | Reuters.

RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.

An interesting link came up in the Slashdot comment section.  From: [Cfrg] Requesting removal of CFRG co-chair

I’d like to request the removal of Kevin Igoe from CFRG co-chair.

The Crypto Forum Research Group is chartered to provide crypto advice to IETF Working Groups. As CFRG co-chair for the last 2 years, Kevin has shaped CFRG discussion and provided CFRG opinion to WGs.

Kevin’s handling of the “Dragonfly” protocol raises doubts that he is performing these duties competently. Additionally, Kevin’s employment with the National Security Agency raises conflict-of-interest concerns.

LOL. No one trusts the NSA anymore.

Academics should not remain silent on hacking

NIST’s standard for random numbers used for cryptography, published in 2006, had been weakened by the NSA. Companies such as banks and financial institutions that rely on encryption to guarantee customer privacy depend on this standard. The nature of the subversions sounds abstruse: the random-number generator, the ‘Dual EC DRBG’ standard, had been hacked by the NSA so that its output would not be as random as it should have been. That might not sound like much, but if you are trying to break an encrypted message, the knowledge that it is hundreds or thousands of times weaker than advertised is a great encouragement.

via Academics should not remain silent on hacking : Nature News & Comment.

GSMA Creates Remotely Managed SIM For M2M Applications

To fix this issue, the GSMA has developed a non-removable SIM that can be embedded in a device for the duration of its life, and remotely assigned to a network. This information can be subsequently modified over-the-air, as many times as necessary.

The GSMA says its new SIM can reduce ongoing operational and logistical costs. Replacing one SIM is not going to break the bank, but replacing a few million could make a dent in any budget, it reckons.

via GSMA Creates Remotely Managed SIM For M2M Applications.

Solar Cells Could Help Windows Generate Power

The Oxford team, led by physicist Henry J. Snaith, made their solar cells using perovskites, a class of mineral-like crystalline materials that has recently grabbed much attention among researchers in photovoltaics. Perovskites have properties similar to inorganic semiconductors and show sunlight-to-electricity conversion efficiencies of more than 15%.

via Solar Cells Could Help Windows Generate Power | Chemical & Engineering News.

MisoSMS: New Android Malware Disguises Itself as a Settings App, Steals SMS Messages

MisoSMS infects Android systems by deploying a class of malicious Android apps. The mobile malware masquerades as an Android settings app used for administrative tasks. When executed, it secretly steals the user’s personal SMS messages and emails them to a command-and-control (CnC) infrastructure hosted in China. FireEye Mobile Threat Prevention platform detects this class of malware as “Android.Spyware.MisoSMS.”

via MisoSMS: New Android Malware Disguises Itself as a Settings App, Steals SMS Messages | FireEye Blog.

Once the app is installed, it presents itself as “Google Vx.” It asks for administrative permissions on the device, which enables the malware to hide itself from the user, as shown in Figure 2.

Right there is a clue that something is not right.

Avaya builds massive Wi-Fi net for 2014 Winter Olympics

Adding to the challenge, “We expect these people to be carrying and using multiple wireless devices,” says Frohwerk. “In Vancouver, we only had to provision one device per user. This means that we really have to have the capability to support up to 120,000 users on the Sochi Wi-Fi network, without issues or interruptions.”

via Avaya builds massive Wi-Fi net for 2014 Winter Olympics – Network World.

It’s interesting that they have to provision devices to users.  Is this done manually?  Here’s more….

In Sochi, Avaya’s Wi-Fi network will be split into five virtual SSID-based networks. There will be one network for the athletes, two for media (one free, one paid), one for Olympics staff, and one for dignitaries.

Each group will have its own access password, and extra layers of password protection will be added where needed. The Wi-Fi traffic will be distributed using about 2,000 802.11n access points across the Olympics Game sites; including inside the stands for the first time.

Each SSID will need its own range of frequencies so having 5 seems like it would present problems trying to figure out where to place access points so their radio transmissions don’t step on each other.  Also there doesn’t seem to be any provisions made for their customers, the people paying to attend these events.

Imgur Wiped Out By Sky Broadband Torrent Site Blocking

Sky regularly pull IP addresses listed on our DNS servers and adds them to their block list. This block list is then used by an advanced proxy system that redirects any requests to the blacklisted IP addresses to a webserver that the ISP owns which returns a blocked page message,” YIFY explains.

Therefore, when YIFY began using CloudFlare servers in Australia, Sky pulled these IP addresses and blocked them in the mistaken belief that they were YIFY’s. Since Imgur uses the same IP addresses, Sky’s automated blocking took the site offline, to the huge disappointment of countless customers.

via Imgur Wiped Out By Sky Broadband Torrent Site Blocking | TorrentFreak.

What happens to the posts you don’t publish?

This paternalistic view isn’t abstract. Facebook studies this because the more its engineers understand about self-censorship, the more precisely they can fine-tune their system to minimize self-censorship’s prevalence. This goal—designing Facebook to decrease self-censorship—is explicit in the paper.

So Facebook considers your thoughtful discretion about what to post as bad, because it withholds value from Facebook and from other users. Facebook monitors those unposted thoughts to better understand them, in order to build a system that minimizes this deliberate behavior.

via Facebook self-censorship: What happens to the posts you don’t publish?.