A Lesson in Personal and Professional Phone Security Responsibility

10/8/2017 from Wired. {abridged and removed overtly political jabs by DGL}
 
John Kelly's Hacked Phone Could Be a Major National Security Issue | WIRED

Politico reports that former Department of Homeland Security head and current chief of staff John Kelly used a personal smartphone, possibly for months, that was compromised. That is bad. Don't do that. The breach was apparently discovered over the summer, when Kelly gave the smartphone to White House tech support after having problems with it and struggling to successfully run software updates. Several questions remain unanswered, as to what type of phone Kelly was using, and what sort of access hackers may have had. The possibilities run the gamut—and have potentially serious consequences. "Having a phone compromised for several months definitely is not good," says David Kennedy, the CEO of TrustedSec, who formerly worked at the NSA and with the Marine Corps' signal intelligence unit. "To what extent and who compromised it is important. If it was just [run of the mill] malware it's probably not a big deal, but if it was a nation state, monitoring phone communications, emails, and other data is all possible."

How Kelly's phone was compromised matters a lot. There are myriad ways it could have happened, and some are relatively benign. If Kelly had an Android phone he may have gotten tricked into downloading a malicious app. Phishing links and attachments also pose a constant threat no matter what device you're on. From there, a petty criminal might have done something small, like secretly charging Kelly in-app fees or mining some relatively innocuous data. Nothing too alarming there. 'If he's in classified meetings and the phone is in his pocket, hackers could eavesdrop and listen to planning.' David Kennedy, Former NSA Analyst But there's also a whole gray market of security firms, like Zerodium and NSO Group, that sell mobile operating system exploits and espionage tools to governments around the world. Any attacker with awareness about their target—and deep pockets—could have used more sophisticated exploits to burrow deep into the device and start reconnaissance and data-gathering, even potentially masquerading as Kelly on his accounts, or taking them over to mislead his associates.

It's also hard to tell exactly how often and how long Kelly used the phone in question. Reports indicate that Kelly did primarily use his hardened, government-issued smartphone, even while he still had his apparently compromised personal phone around, but it's unclear how often he carried the extra device with him, and what he still relied on it for. A White House spokesman told POLITICO that Kelly "hadn’t used the personal phone often since joining the administration." It would be helpful to know how hard that "often" is working.

The incident was apparently considered serious enough to warrant a memo about the situation in September. A White House spokesman told WIRED, “Last December, General Kelly’s personal phone stopped working and he discontinued its use,” a statement that still leaves the exact timeline open for interpretation. Those details matter, because in a totally owned phone, hackers could have tracked his every move.  Regardless of the method {used}, Kelly's data would have definitely been at risk. Attackers could have used a keylogger to follow his every input. They would also potentially had access to his physical location through GPS and cell ID data. If he stored any sensitive files on the device, needless to say, they would have been exposed. But even assuming that Kelly did no confidential or nationally important work on the personal phone, even if he simply used it to play Candy Crush, it still would have posed a major threat. Attackers can surreptitiously take over a smartphone's microphone and camera, a particular concern given that Kelly takes meetings at the highest levels of national security. "If he's in classified meetings and the phone is in his pocket, hackers could eavesdrop and listen to planning," Kennedy notes.

{DGL:  here is a scenario that is relevant to the "average" citizen.  You give your phone to someone you know because they want to make a call or they want to play a game.  They download a "kid monitor" program without your knowledge.  They enter their phone number as the recipient and turn the program on in the background, and in the settings they set the program to autostart.  Now your phone is set up to do everything talked about above!  Though national security was the topic above, your security, your home's security, the security of your kids and grandkids, etc is relevant to you.}

There are some protections against that sort of snooping, like device lockers in the West Wing where staffers are encouraged to leave their phones, and Sensitive Compartmented Information Facilities, where officials shed all their devices before discussing truly secret issues of national security. But human error is a problem. People don't always comply with SCIF protocols. "Most people, even though data breaches and surveillance are in the news every day, they still don’t really understand that they could be targeted—they always think that it will never happen to them," says Larry Johnson, the CEO of security firm CyberSponse who was a special agent in the Secret Service for 24 years and worked on cybersecurity in the White House. "It’s like everything in security, it’s not convenient to be secure, but once you walk into the White House you have to be cognizant of all of the things around you and anything that isn't quite right." Experts say that it's surprising that Kelly in particular used a potentially compromised phone, given his past military and command service. Still, it's possible that Kelly was lucky, and whatever malware was on his phone just served him malicious ads and tried to trick him out of some money. If it really was the worst case scenario, though, one or a handful of nation states may have gained valuable intelligence that could haunt the United States for years. Without more information—and none seems forthcoming—we'll never know just how worried we should be.

Equifax Breach

I have been making mental notes about the Equifax security breach, intending to write a post on the issues involved; however, AskLeo! beat me to it.  You know that I like AskLeo! because he is accurate and his writing is understandable but accurate- well, most of the time it is accurate.  In the Equifax case, I will never be able to write about the issue better than Leo.  So, here's the link, and Leo is where I am at on this:  https://askleo.com/equifax-breach-means/?awt_l=8ysdX&awt_m=JgW.cUt4a3dfbL&utm_source=newsletter&utm_campaign=20170919&utm_medium=email&utm_content=featured

Problem with Spectrum Cable knocking out or damaging your home network

A number of household in our region are experiencing one or more of the following, especially when it is raining or going to rain in the area:

• The entire house network goes down.
• Network components are damaged:  routers, TVs, receivers (requiring total replacement or servicing)  The damage seems almost random, with some devices on the network, such as the cable modem, unaffected.  With routers, maybe only one port is damaged, along with the ports of devices attached to that port via ethernet.
• Surge protectors "flip," but the surge is not detected as "incoming" from the power outlets.
• TV reception is erratic.
• Phone performance is erratic.

Here is what is happening:  The cable to your house is serving power to your house network components (via cable and then out through the ethernet cables) that is at the very high end of what is acceptable.  When it is going to rain or is raining in the area, the temperature naturally drops by, say, 8 degrees F.  This affects the cable power into your house, raising the effective power over what your house components can handle. The result is the list above.

Solution:  If you have the above symptoms, Spectrum service needs to be called.  The service person needs to measure the cable power.  If it is too high at your house, ie at the high end of normal then s/he will have to insert a device at the connector to your house that will lower the power further down into the safe range.

Note that, as of today, Spectrum is aware of the problem and they may change the power at a central level.  I'm not sure that will work because everyone has a different distance to the house and different cables to the house.  Lowering the power at a central point might impact those with long distances or small cable sizes.  Also, those who have had the power lowered at their house may find the signal power lowered too much.  We'll see.

Please communicate this to your friends and neighbors.    

Would you believe it-a built-in never being able to update Windows 10 to new Versions

There was a Windows 10 version, 1511 hat was one of the initial versions of Windows 10, during the time when the offer was available to go from Windows 7 or 8 to Windows 10.  In fact, the general release schedule is:

• Version 1507, released 5/29/2015, retired 5/9/2017
• Version 1511, called "the November Update" released 11/10/2015
• Version 1607, called "the Anniversary Update" released 8/2/2016
• Version 1703, called "the Creators Update" released 4/5/2017

The problem is, if you  want to update from Version 1511- yes update, not upgrade- to Version 1607, you can't!  For some reason an update route is not provided!  If you want to update to Version 1703 from version 1511, you can, but you have to wipe away all your installed programs; data is saved, but not programs.

So, even if you had automatic update on the entire time from the installation of Version 1511, as I did, Version 1607 may not have installed.  Why?  There is no rational reason that Microsoft can give.  If you don't have Version 1607 installed, you can't ever get to any future version of Windows  without doing a "clean install," where you have to reinstall all of your applications.

To find this out, I spent 2 weeks with Microsoft support, first at level 1 for a week, then at level 2, then doing phone tag for a week to get a level 3 person to talk to (that is about as high as you can go).  The total number of hours spent by Microsoft support was probably 3 hours.   However, the total time for level 3 was about 30 seconds, not counting having to listen to my consternation that the situation I described above actually exists.  At the beginning of the conversation I told the level 3 person what my version was, so the conversation would have been 10 seconds, but that person still logged on to my computer and checked the version for himself.  Then he just said that I couldn't update to any level without deleting all my programs.  That was all!  When I asked if I could see a knowledgebase article describing this situation, he said there was an internal article, but not an external article.  When I asked why it wasn't publicized, there was no answer.  (Ha!)  When I asked why level 1 didn't know about this, he said he didn't know.

That's two rants this week.  I must not be in a good mood.

By the way, no native English speaker in the chain of support, which I bet is part of the problem.Level 1, 2, and 3 could be continents away. Is that right, Microsoft?

The fault is yours, not the Russians!

Yes, I'm frustrated.  All the stuff in the news about Russian hacking.  The root causes of all the security breaches, whether email accounts, databases, or documents, are two:

1. Someone clicked on something they shouldn't (phishing)
2. Someone leaked information the shouldn't have, either because it was ethically wrong or it was legally wrong. 

Folks, this is a human problem, not a technology problem. And it is not 'their' fault.  Whether it is Hillary's server, the Democrat server, any of Hillary's comrade's emails, or documents released from undisclosed resources, the fault lies with the Democrats, Hillary, Hillary's comrades, or the deep state; it is not the fault of the Russians.  The "Russians" is just a euphemism for those out there that are trying to get information.  The Russians may in fact be Russians, but from a technological certainty, any one with a little technological black hat experience can fake the origin as Russians.

The lesson you need to take away from all this is that your clicking, your use of simple or the same password across multiple sites, your lax administration of your own IT environment, which allows any flash drive to insert bad stuff into your computer or take information out of your computing devices, is going to be the source of your security problems.

This whole episode in this country's history, and the whole assessment of your own security posture, is built on a lie if you don't follow the reasonable, responsible rules for internet security.  You are at fault; stop shifting the blame!

An Internet of Things (IoT) Router for the Home

Over the years I've discussed routers in several posts. Most recently I talked about the need for a total house router that will protect your Internet of Things (IoT) Technically, I'm not really discussing the Internet of Things, but the Intranet of Things, ie, the stuff connected to your internal network, or Intranet.)

This kind of router is the Next Generation Firewall (NGFW).  I've said that I could not find a router or firewall that was in the "home" price range; they were all $1000 or more and always stand-alone firewalls.

Norton has come out with a home solution.  It is called the Norton Core Router (Amazon link) .  I do not have this router.  However, the literature reads like this device has the functions required to protect your IoT.  You should take a look at it, especially if you are in a "greenfield" environment, such as a new home or small business, or you are replacing your router because you are changing providers.  Again, a disclaimer... I haven't used this device.

Important Reference Page for Windows 10 update errors

I've experienced a spat of Windows 10 upgrade errors in the past month.  In addition, people are reporting that their Windows 10 machines are "freezing" during operation or startup.  Their computer is useless.  The problem seems associated with either the incremental upgrades or with the big upgrade, "Creators Version." (version 1703, Builds 10.0.15063 and up)  

In other blog entries I have been and will be reporting on specific situations, but here I want to document an important reference page for Windows upgrade errors.  This entry is not for the casual user; it's for the IT pro.  But I need to refer to it on a regular basis, so I am putting it in my blog.  For those of you that are IT proficient, this page will be useful.  

https://docs.microsoft.com/en-us/windows/deployment/upgrade/resolve-windows-10-upgrade-errors

I'm working pretty much full time on computers with upgrade problems.  Some are diagnosed with hardware issues, some are related to the fast start option, coupled with partial upgrades in progress, and some are undiagnosed.  

Samba has security issue similar to Wannacry

Samba is a way for Linux machines to communicate with Windows machines and networks.  Before your eyes glaze over, this means all Apple products, all smartphones, and all hybrid networks that mix Windows with those devices.  (Have you seen smb when you connect your device to a windows network?)  Oh... there's a section in the following that talks about ALL devices.  Interesting, because my router has a smb mode as well.  The router is Linux-based, so it has a smb configuration for windows computers to get to the network flash drive or network printer attached to its USB port.  And you thought you were safe if you didn't use Windows!

Here is a good article that is provides background on the problem.

Samba vulnerability brings WannaCry fears to Linux/Unix

searchsecurity.techtarget.com/news/450419712/Samba-vulnerability-brings-WannaCry-fears-to-Linux-Unix

Researchers warn that many Linux and Unix systems contain a Samba vulnerability that could eventually lead to attacks similar to WannaCry or worse, if IT pros don't remediate quickly.

According to the Samba security advisory, the vulnerability (CVE-2017-7494) affects versions 3.5 (released March 1, 2010) and newer. The Samba vulnerability is remotely exploitable and could allow "a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it."

Nick Bilogorskiy, senior director of threat operations at Cyphort, said although there are no active exploits in the wild, the damage from this Samba vulnerability could be steep.

"Because this vulnerability allows remote code execution, attackers will have full control over a compromised machine, and any payload is possible," Bilogorskiy told SearchSecurity. "For example, [an attacker could] drop a backdoor, steal data from the system, spy on the user, attack other systems or try to encrypt all data for a ransom."

Nick Bilogorskiy

Lane Thames, senior security researcher at Tripwire, said exploiting the Samba vulnerability "is a little more difficult than the SMB vulnerability targeted by WannaCry."

"For example, to exploit CVE-2017-7494 an attacker must find a vulnerable system, then find the path of an appropriate file share on the system, and the attacker must be either authenticated with the vulnerable Samba server or the share must be available to be written to without authentication," Thames told SearchSecurity. "Regardless, enterprises should move fast to patch this vulnerability and ensure that no unnecessary Samba services are exposed to the internet."

Samba vulnerability remediation

Research from Rapid7 Labs said attacks on this Samba vulnerability could come over the same port 445 used to access SMB on Windows machines, but port 139 could also expose endpoints to attack. Rapid7 suggested "organizations should review their firewall rules to ensure that SMB/Samba network traffic is not allowed directly from the internet to their assets."  {dgl note:  remember in class I talked about a 3 tiered approach- three different computers in series- to protect against malicious attacks.  This is one of the reasons for that approach:  to protect ports.  New routers should actually have a two tier design to accomplish the same thing.  OR you can become an export at router configuration. :-))

A patch has been released and the Samba advisory also noted a potential workaround for those who can't patch right away. Samba said adding the argument "nt pipe support = no" to the global section of the Samba configuration file will mitigate the threat, but could have the added consequence of disabling "some expected functionality for Windows clients."

Thames said the enterprise space will be "concerned with their file and print server systems running on top of Linux and Unix operation systems that use Samba," but warned that storage solutions "can also pose significant risks."

"Most of these storage devices use embedded Linux and Samba for their file sharing functionalities. Moreover, it is these types of devices that are likely to be the most troublesome for us with this vulnerability," Thames said. "Enterprise server vendors are moving fast to push out patches to enterprise customers for this Samba vulnerability. However, [network-attached storage] vendors might not move so quickly on this and in some cases they might not even issue patches for this."

Samba vs. WannaCry

Craig Williams, senior technical leader at Cisco Talos, said the comparisons between this Samba vulnerability and WannaCry "are due to the fact that both of these issues affected the same protocol."

"Samba is basically what [Linux/Unix] systems use to talk to Windows file stores and printers," Williams told SearchSecurity. "That said, to date we have not seen a worm or even an exploit with a ransomware payload though this could change at any second."

Bilogorskiy said although WannaCry makes better headlines, the better comparison was to EternalBlue -- the SMB vulnerability exploited by WannaCry -- because "right now we are dealing with a vulnerability, not malware yet."

"If a worm is discovered exploiting this Samba vulnerability, then yes, WannaCry comparisons are warranted and there are ways how it may even be worse than WannaCry. WannaCry hit Windows systems, more than 60 days after the patch. Most of them had auto-update enabled and were not vulnerable," Bilogorskiy said. "Any Samba worm may hit Linux and Unix servers, where most do not have auto-update enabled. In fact some of these Unix systems work for years without any maintenance. Also, unlike workstations, most of them are always on, users never power them off. So [there are] more online unpatched targets for a worm to infect."

How to Install Teamviewer

Teamviewer is one of dozens of computer programs/device apps that provide a way for you to log on to another device, see its screen, and "run" the other device.  Prime competitors are GoToAssist, LogMeIn, and Chrome Remote Desktop.  For a list of free apps, see https://www.lifewire.com/free-remote-access-software-tools-2625161.

I use teamviewer for the reasons discussed in the above article.  To install teamviewer on your device, go to your app store or go to https://www.teamviewer.com.  For the latter site, you will see a "Download Free for friends and family" button on the home page.  Click on that to start the download.  Depending on your browser and its settings, you might get a pop up.  Do whatever it says that results in downloading the executable.  Once downloaded, start the install process.  The exact instructions on starting this install depend on the operating system you are using and the browser or download system you are using.  I'll leave it to you to know how to start an install for your situation.

During the install, there might be one or more dialog boxes that have radio button options.  You will want "for personal use" and "basic installation."  Click through the buttons until the installation is complete.  Once complete TeamViewer will pop up.  Usually there is an ad in front of the business part of Teamviewer.  Just delete that ad.  You can close the teamviewer app at this point until you are ready to use it. But, before closing it, I recommend pinning the app to your taskbar or dock.  If you are using a smart device, then you put it on a page that you use for important utilities.

To use Teamviewer, click on the icon or search in your applications for Teamviewer.  Click on the icon.  Up pops the Teamviewer interface.

On the left side will be entries for "Your ID" and "Password".  That is the information someone who is going to make a connection to your computer needs to help you.  If you are helping someone else, then you will put that other person's ID into the Partner ID field on the right side.  You will then click Connect to Partner.  The session will initialize and a dialog box will pop up asking for the other person's password.  Enter that and you should get access to your friend's computer.

Home Security IoT Class 8 Notes.

The notes for the final class are here.

Wrong Instructions on AT&T: Linking an email client to AT&T email

If you use att (att.net at least, maybe bellsouth.net) as your email provider
-- and --
You want to link your email account to a client email application (Outlook, your smartphone)
-- and --
You want to keep a copy of the email on the att server (maybe you share an account with your spouse)
--then--
AT&T has apparently changed how to do the link that account using IMAP, but the company hasn't changed the instructions or notified you on how to do it.

Specifically, the instructions are at:  https://www.att.com/esupport/article.html#!/email-support/KM1086159

The erroneous instruction is:

• For IMAP accounts, enter imap.mail.att.net for the Incoming mail server, and smtp.mail.att.net for the Outgoing mail server.

 If you follow the instructions and get an error about contacting the server that says, in part "*OK[capability IMAP 4rev1ID move namespace x-ID-ACLID", then you have entered the wrong email server information.  (Why such gobble-de-gook for error messages?  I guess the coders think they are all so much smarter than we are.  NOT!  Such coding just wastes everyone's time.)

To be brief, the correct entries for the inbound and smtp server are:

• imap.mail.yahoo.net

• smtp.mail.yahoo.net

att vs yahoo does make a big difference.  

Do this only if you get the error.  Apparently the change is dependent on the client application and even the version of the client application.  

Backing up or saving Gmail on your local computer

So you've moved to gmail.  Then you realize that all gmail is retained unless you trash it.  Good!  But then you are concerned that "something" might happen and some of your emails you want to keep might be lost.  That isn't likely, but let's address that.  Here are ways:

1. Use a client email program, such as Outlook or Thunderbird.  Configure your email connection as IMAP (Important!).  Every so often, start your email program and do a receive.  All messages from the last time you did it will be downloaded.  Because you are using IMAP, the messages will not be removed from the gmail server.  You've got a complete archive.
2. If you just occasionally have a message you want to save, you can "easily" save it to Google Drive.  
1. But first, you have to be using Google Drive.  There is a tutorial in the Youtube list to the right on how to install Google Drive on your device (from phone to super computer).  When this is done, all documents, etc will be physically mirrored to your device as well as be on the google servers.  (I should mention that, in the video, the lecturer starts the discussion by saying that he wants to share photos.  Well, you don't share and edit photos in Google Drive.  Google Drive has some features to save you from the mistake of putting pictures on Google Drive, but just don't save pictures to Google Drive.  Save pictures to Google Photo instead.)  
2. Here is a second dependency:  You have to be logged on to Google through Google Chrome.  Don't log on just to email.  Logging on to Google through Chrome automatically logs you on to all the Google applications, even Youtube.  That's necessary to use this feature I'm discussing.  (To log on to Google Chrome, click the setting chevron for Google Chrome.  The first thing at the top of settings is where you log on to Google Chrome.)  
3. Here is a third dependency: you have to be using Google Cloud Print.  To make sure you are using it, go to the Chrome settings, go to the bottom, and click on the Advanced link.  This will reveal more settings.  Near the bottom of these settings is a heading "Google Cloud Print."  Click on the Manage button and start it.  From now on, you can print from anywhere you are to your home printer, or, at least in my case, any of a couple dozen places.  Close when done. 
4. Now, back to saving the email.  Start a "Print" of your email, any way you want.  From that page, there is a button underneath the default printer name called "Change." Click on that.  In that list is the entry "Save to Google Drive."  Clicking on this will cause your print to generate a PDF file that will be saved to your Google Drive.  That document will find its way down to your computer during the Google Drive synch process. Click Print to initiate this process.  

The nightmare scenario caused by the Windows 8 through Windows 10 fast startup option and what to do about it

I have just had to endure one of the most miserable "repair jobs" of my career of 60 years.  There was this laptop with Windows 10.  The power was interrupted when the computer was shutting down AND it was ready to do the restart after a partial install of an update.  The symptoms of the resulting problem were that the computer would not boot.  It would get to the blue window screen just at the start of boot and just spin and spin.  Night and day.  I won't go into all the details on my effort to recover from this problem.  You can read about some of what I did by searching on "deleting the hiberfil.sys and "Windows fast start up."  I used all my skill with a Ubuntu live disk as well as various Windows recovery options and a Windows recovery disk.  I was able to get read and write the hard drive by using a combination of applications in Ubuntu, but that only got the drive to the point where I could get Windows to go into its own recovery mode without relying on the recovery DVDs.

Oh, there were no recovery points.

I spent over an hour on the phone with Microsoft update tech support.  I knew more than they did and their final conclusion was that I would have to use the "reinstall Windows 10 keeping the user data" option.

That worked.  Of course, I have to reinstall all the user applications.  In this case, one of the applications is not easy to install because it is an older app.

The lesson is:  The Windows fast startup option is a death trap!  I recommend enduring the longer start up times that result from not using fast startup, where the system creates a hiberfil.sys you don't know about and that locks up the computer if the computer shuts down at the "wrong time."

Instructions:   Turn off fast startup:

1. Search for and open “Power options” in the Start Menu.
2. Click “Choose what the power buttons do” on the left side of the window.
3. Click “Change settings that are currently unavailable.”
4. Under “Shutdown settings” make sure “Turn on fast startup” is disabled. (no checkmark).

As an extra precaution, start an administrator cmd or powershell session and run "powercfg -h off.  That turns off the system's inclination to create a hiberfil.sys.  

Home Security IoT Class 7 Notes

The class 7 notes for the Home Security IoT class are here.

Two factor authentication for your social security account

Social Security has a web site where you can review all your social security taxable income, your medicare taxable income, your social security personal details, and all your benefits, month by month.  That's just to name a few kinds of information that are there.  I've talked about two factor authentication in several blogs.  It is a security feature that is a pain in the neck.  If you use this feature, you have to sign on with your user id and password and then, if you use a device that the web site doesn't recognize, or "just because" you will have to enter some code that is sent by text or sent to your email address.  This is before you are able to "log in" to the site.  Although a pain, I hope you can see that it protects against someone else using your user id and password to access your social security information.  Below is an announcement of an improvement of the social security web site two factor authentication process:  the ability to get the two factor code on email.  To date, you could only get the two factor code by text message.   

On June 10, 2017, we will add a second method to check your identification when you sign in to mySocial Security. This is in addition to the first layer of security, your username and password. Right now, you don’t have to do anything for this new process. But you may want to sign in to your account

 to make sure you remember your username and password. Then, when you sign in on or after June 10, you will be able to choose either your cell phone or your email address as your second identification method. Using two ways to identify you when you log on will help better protect your account from unauthorized use and potential identity fraud.

3D Printing Example: radically new jet engine

I talked about 3D printing in class, about how the technology will move to exotic materials and eventually a build process similar to the ones used by semiconductor manufacturers.  This link is an example of what is being done today:  https://www.wired.com/2017/05/ge-turbofan-huge-jet-engine/?mbid=nl_52017_p1&CNDID=29643548

Spectrum DNS Servers for our area

When you want to go to a web page on the internet, your first stop will be a server defined by Spectrum that will take the url (web address) you supply and translate that to an IP address on the internet.  That server's function is similar to that of your router, which supplies IP addresses on your household intranet.  The function is called DNS (Domain Name Server).  Typically, your computer will obtain the IP address of those servers (yes, there is that first step) automagically; however, if you are having trouble connecting to the internet, you might try entering the following for primary and secondary DNS servers in your network adapter settings:

Warning:  the following DNS numbers are wrong. These are the numbers you will be given if you ask Charter/Spectrum help. 

• Primary:  24.178.162.3
• Secondary:  66.189.0.100

The correct numbers are:

• Primary:  71.10.216.1
• Secondary:  71.10.216.2

I apologize for the wrong information... but then Charter has a problem to fix.

Full instructions on how to do this for Windows 10 can be found at http://www.windowscentral.com/how-change-your-pcs-dns-settings-windows-10.  For Mac:  http://www.macworld.com/article/2824564/slow-internet-edit-your-dns-settings.html.   Both references also provide alternate Primary and Secondary addresses to use.  In fact, I use those alternate addresses myself.  

How do spammers harvest email addresses ?

This is a paste from a review article.  It is, in some ways, such as discussing UseNets, out of date, but I post it here more to remind me to update it when I have time and, in the meantime, as a IoT Security class discussion starter.

How do spammers harvest email addresses ?

By Uri Raz

There are many ways in which spammers can get your email address. The ones I know of are :

1. From posts to UseNet with your email address.
   Spammers regularily scan UseNet for email address, using ready made programs designed to do so. Some programs just look at articles headers which contain email address (From:, Reply-To:, etc), while other programs check the articles' bodies, starting with programs that look at signatures, through programs that take everything that contain a '@' character and attempt to demunge munged email addresses.
   There have been reports of spammers demunging email addresses on occasions, ranging from demunging a single address for purposes of revenge spamming to automatic methods that try to unmunge email addresses that were munged in some common ways, e.g. remove such strings as 'nospam' from email addresses.
   As people who where spammed frequently report that spam frequency to their mailbox dropped sharply after a period in which they did not post to UseNet, as well as evidence to spammers' chase after 'fresh' and 'live' addresses, this technique seems to be the primary source of email addresses for spammers.
2. From mailing lists.
   Spammers regularily attempt to get the lists of subscribers to mailing lists [some mail servers will give those upon request],knowing that the email addresses are unmunged and that only a few of the addresses are invalid.
   When mail servers are configured to refuse such requests, another trick might be used - spammers might send an email to the mailing list with the headers Return-Receipt-To: or X-Confirm-Reading-To: . Those headers would cause some mail transfer agents and reading programs to send email back to the saying that the email was delivered to / read at a given email address, divulging it to spammers.
   A different technique used by spammers is to request a mailing lists server to give him the list of all mailing lists it carries (an option implemented by some mailing list servers for the convenience of legitimate users), and then send the spam to the mailing list's address, leaving the server to do the hard work of forwarding a copy to each subscribed email address.
   [I know spammers use this trick from bad experience - some spammer used this trick on the list server of the company for which I work, easily covering most of the employees, including employees working well under a month and whose email addresses would be hard to findin other ways.]
3. From web pages.
   Spammers have programs which spider through web pages, looking for email addresses, e.g. email addresses contained in mailto: HTML tags [those you can click on and get a mail window opened]
   Some spammers even target their mail based on web pages. I've discovered a web page of mine appeared in Yahoo as some spammer harvested email addresses from each new page appearing in Yahoo and sent me a spam regarding that web page.
   A widely used technique to fight this technique is the 'poison' CGI script. The script creates a page with several bogus email addresses and a link to itself. Spammers' software visiting the page would harvest the bogus email addresses and follow up the link, entering an infinite loop polluting their lists with bogus email addresses.
   For more information about the poision script, see http://www.monkeys.com/wpoison/
4. From various web and paper forms.
   Some sites request various details via forms, e.g. guest books & registrations forms. Spammers can get email addresses from those either because the form becomes available on the world wide web, or because the site sells / gives the emails list to others.
   Some companies would sell / give email lists filled in on paper forms, e.g. organizers of conventions would make a list of participants' email addresses, and sell it when it's no longer needed.
   Some spammers would actually type E-mail addresses from printed material, e.g. professional directories & conference proceedings.
   Domain name registration forms are a favourite as well - addresses are most usually correct and updated, and people read the emails sent to them expecting important messages.

5. Via an Ident daemon.
   Many unix computers run a daemon (a program which runs in the background, initiated by the system administrator), intended to allow other computers to identify people who connect to them.
   When a person surfs from such a computer connects to a web site or news server, the site or server can connect the person's computer back and ask that daemon's for the person's email address.
   Some chat clients on PCs behave similarily, so using IRC can cause an email address to be given out to spammers.

6. From a web browser.
   Some sites use various tricks to extract a surfer's email address from the web browser, sometimes without the surfer noticing it. Those techniques include :
1. Making the browser fetch one of the page's images through an anonymous FTP connection to the site.
   Some browsers would give the email address the user has configured into the browser as the password for the anonymous FTP account. A surfer not aware of this technique will not notice that the email address has leaked.
2. Using JavaScript to make the browser send an email to a chosen email address with the email address configured into the browser.
   Some browsers would allow email to be sent when the mouse passes over some part of a page. Unless the browser is properly configured, no warning will be issued.
3. Using the HTTP_FROM header that browsers send to the server.
   Some browsers pass a header with your email address to every web server you visit. To check if your browser simply gives your email address to everybody this way, visit http://www.cs.rochester.edu/u/ferguson/BrowserCheck.cgi
   It's worth noting here that when one reads E-mail with a browser (or any mail reader that understands HTML), the reader should be aware of active content (Java applets, Javascript, VB, etc) as well as web bugs.
   An E-mail containing HTML may contain a script that upon being read (or even the subject being highlighted) automatically sends E-mail to any E-mail addresses. A good example of this case is the Melissa virus. Such a script could send the spammer not only the reader's E-mail address but all the addresses on the reader's address book.
   http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html
   A web bugs FAQ by Richard M. Smith can be read at http://www.tiac.net/users/smiths/privacy/wbfaq.htm

7. From IRC and chat rooms.
   Some IRC clients will give a user's email address to anyone who cares to ask it. Many spammers harvest email addresses from IRC, knowing that those are 'live' addresses and send spam to those email addresses.
   This method is used beside the annoying IRCbots that send messages interactively to IRC and chat rooms without attempting to recognize who is participating in the first place.
   This is another major source of email addresses for spammers, especially as this is one of the first public activities newbies join, making it easy for spammers to harvest 'fresh' addresses of people who might have very little experience dealing with spam.
   AOL chat rooms are the most popular of those - according to reports there's a utility that can get the screen names of participants in AOL chat rooms. The utility is reported to be specialized for AOL due to two main reasons - AOL makes the list of the actively participating users' screen names available and AOL users are considered prime targets by spammers due to the reputation of AOL as being the ISP of choice by newbies.
8. From finger daemons.
   Some finger daemons are set to be very friendly - a finger query asking for john@host will produce list info including login names for all people named John on that host. A query for @host will produce a list of all currently logged-on users.
   Spammers use this information to get extensive users list from hosts, and of active accounts - ones which are 'live' and will read their mail soon enough to be really attractive spam targets.

9. AOL profiles.
   Spammers harvest AOL names from user profiles lists, as it allows them to 'target' their mailing lists. Also, AOL has a name being the choice ISP of newbies, who might not know how to recognize scams or know how to handle spam.
10. From domain contact points.
    Every domain has one to three contact points - administration, technical, and billing. The contact point includes the email address of the contact person.
    As the contact points are freely available, e.g. using the 'whois' command, spammers harvest the email addresses from the contact points for lists of domains (the list of domain is usually made available to the public by the domain registries). This is a tempting methods for spammers, as those email addresses are most usually valid and mail sent to it is being read regularily.
11. By guessing and cleaning.
12. Some spammers guess email addresses, send a test message (or a real spam) to a list which includes the guessed addresses. Then they wait for either an error message to return by email, indicating that the email address is correct, or for a confirmation. A confirmation could be solicited by inserting non-standard but commonly used mail headers requesting that the delivery system and/or mail client send a confirmation of delivery or reading. No news are, of coures, good news for the spammer.
    Specifically, the headers are -
     Return-Receipt-To: which causes a delivery confirmation to be sent, and
     X-Confirm-Reading-To: which causes a reading confirmation to be sent.
    Another method of confirming valid email addresses is sending HTML in the email's body (that is sending a web page as the email's content), and embedding in the HTML an image. Mail clients that decode HTML, e.g. as Outlook and Eudora do in the preview pane, will attempt fetching the image - and some spammers put the recipient's email address in the image's URL, and check the web server's log for the email addresses of recipients who viewed the spam.
    So it's good advice to set the mail client to *not* preview rich media emails, which would protect the recipient from both accidently confirming their email addresses to spammers and viruses.
    Guessing could be done based on the fact that email addresses are based on people's names, usually in commonly used ways (first.last@domain or an initial of one name followed / preceded by the other @domain)
    Also, some email addresses are standard - postmaster is mandated by the RFCs for internet mail. Other common email addresses are postmaster, hostmaster, root [for unix hosts], etc.
13. From white & yellow pages.
    There are various sites that serve as white pages, sometimes named people finders web sites. Yellow pages now have an email directory on the web.
    Those white/yellow pages contain addresses from various sources, e.g. from UseNet, but sometimes your E-mail address will be registered for you. Example - HotMail will add E-mail addresses to BigFoot by default, making new addresses available to the public.
    Spammers go through those directories in order to get email addresses. Most directories prohibit email address harvesting by spammers, but as those databases have a large databases of email addresses + names, it's a tempting target for spammers.
14. By having access to the same computer.
    If a spammer has an access to a computer, he can usually get a list of valid usernames (and therefore email addresses) on that computer.
    On unix computers the users file (/etc/passwd) is commonly world readable, and the list of currently logged-in users is listed via the 'who' command.
15. From a previous owner of the email address.
    An email address might have been owned by someone else, who disposed of it. This might happen with dialup usernames at ISPs - somebody signs up for an ISP, has his/her email address harvested by spammers, and cancel the account. When somebody else signs up with the same ISP with the same username, spammers already know of it.
    Similar things can happen with AOL screen names - somebody uses a screen name, gets tired of it, releases it. Later on somebody else might take the same screen name.
16. Using social engineering.
    This method means the spammer uses a hoax to convince peopleinto giving him valid E-mail addresses.
17. A good example is Richard Douche's "Free CD's" chain letter. The letter promises a free CD for every person to whom the letter is forwarded to as long as it is CC'ed to Richard.
    Richard claimed to be associated with Amazon and Music blvd, among other companies, who authorized him to make this offer. Yet hesupplied no references to web pages and used a free E-mail address.
    All Richard wanted was to get people to send him valid E-mail addresses in order to build a list of addresses to spam and/or sell.
18. From the address book and emails on other people's computers.
    Some viruses & worms spread by emailing themselves to all the email addresses they can find in the email address book. As some people forward jokes and other material by email to their friends, putting their friends' email addresses on either the To: or Cc: fields, rather than the BCc: field, some viruses and warms scan the mail folders for email addresses that are not in the address book, in hope to hit addresses the computer owner's friends' friends, friends' friends' friends, etc.
    If it wasn't already done, it's just a matter of time before such malware will not only spam copies of itself, but also send the extracted list of email addresses to it's creator.
    As invisible email addresses can't be harvested, it's good advice to have the email addresesses of recipients of jokes & the like on BCc:, and if forwarded from somebody else remove from the email's body all the email addresses inserted by the previous sender.
19. Buying lists from others.
    This one covers two types of trades. The first type consists of buying a list of email addresses (often on CD) that were harvested via other methods, e.g. someone harvesting email addresses from UseNet and sells the list either to a company that wishes to advertise via email (sometimes passing off the list as that of people who opted-in for emailed advertisements) or to others who resell the list.
    The second type consists of a company who got the email addresses legitimately (e.g. a magazine that asks subscribers for their email in order to keep in touch over the Internet) and sells the list for the extra income. This extends to selling of email addresses acompany got via other means, e.g. people who just emailed the companywith inquiries in any context.
    The third type consist of technical staff selling the email address for money to spammers. There was a news story about an AOL employee who sold AOL email addresses to a spammer.
20. By hacking into sites.
    I've heard rumours that sites that supply free email addresses were hacked in order to get the list of email addresses, somewhatlike e-commerce sites being hacked to get a list of credit cards.

If your address was harvested and you get spammed, the following pages could assist you in tracking the spammer down :

1. MindSpring's page explaining how to get an email's headers
   http://help.mindspring.com/features/emailheaders/extended.htm
2. The spam FAQ, maintained by Ken Hollis.
   http://gandalf.home.digital.net/spamfaq.html

3. The Reporting Spam page, an excellent resource.
   http://www.ao.net/waytosuccess/

4. Reading Mail headers.
   http://www.stopspam.org/email/headers/headers.html
5. Julian Haight's Spam Cop page.
   http://spamcop.net/

6. Chris Hibbert's Junk Mail FAQ.
   http://www.fortnet.org/WidowNet/faqs/junkmail.htm

7. Sam Spade, Spam hunter.
   http://samspade.org/

8. WD Baseley's Address Munging FAQ
   http://members.aol.com/emailfaq/mungfaq.html

9. Fight Spam on the Internet site
   http://spam.abuse.net/
10. The Spam Recycling Center
    http://www.spamrecycle.com/
11. The Junk Busters Site
    http://www.junkbusters.com/

12. The Junk Email site
    http://www.junkemail.org/

13. BCP 30: Anti-Spam Recommendations for SMTP MTAs
    http://www.faqs.org/rfcs/bcp/bcp30.html

14. FYI 28: Netiquette Guidelines
    http://www.faqs.org/rfcs/fyi/fyi28.html
    
    FYI 35: DON'T SPEW
    A Set of Guidelines for Mass Unsolicited Mailings and Postings
    http://www.faqs.org/rfcs/fyi/fyi35.html

Several sites on the web will help in tracing spam :

1. Pete Bowden's list of traceroute gateways
   http://www.missing.com/traceroute.html
   To find traceroute gateways in any country, visit here.
   http://www.traceroute.org/

2. Allwhois.com gates to whois on any domain world-wide
   http://www.allwhois.org/

3. Alldomains.com site - links to NICs worldwide.
   http://www.alldomains.com/
   A similar page can be found at
   http://www.forumnett.no/domreg.html

4. The Coalition Against Usolicited Commerical E-mail.
   http://www.cauce.org/
   The European CAUCE.
   http://www.euro.cauce.org/en/index.html
   The Coalition Against Unsolicited Bulk Email, Australia.
   http://www.caube.org.au/
   The Russian Anti-Spam organization.
   http://www.antispam.ru/

5. No More Spam - ISP Spam-Blocking Interferes With Business
   http://www.byte.com/columns/digitalbiz/1999/04/0405coombs.html
6. Removing the Spam, By Geoff Mulligan, Published by Addison Wesley, ISBN 0-201-37957-0
   A good book about handling spam.

Legal resources :

1. FTC Consumer Alert - FTC Names Its Dirty Dozen: 12 Scams Most Likely to Arrive Via Bulk email
   http://www.ftc.gov/bcp/conline/pubs/alerts/doznalrt.htm
2. Report to the Federal Trade Commision of the Ad-Hoc Working Group on Unsolicited Commercial Mail. http://www.cdt.org/paper/report-federal-trade-commission-ad-hoc-working-group-unsolicited-commercial-email?quicktabs_4=1
3. Pyramid Schemes, Ponzi Schemes, and Related Frauds
   http://www.impulse.net/~thebob/Pyramid.html

4. The AOL vs. Cyberpromo case
   http://legal.web.aol.com/decisions/dljunk/cyber.html
   
   Nine New Lawsuits Press Release.
   http://legal.web.aol.com/decisions/dljunk/ninepress.html

5. "Intel scores in email suit", by Jim Hu, CNET News.com.
   http://www.news.com/News/Item/0,4,29574,00.html?st.ne.ni.lh
6. The John Marshall Law School spam page
   http://www.jmls.edu/cyber/index/spam.html

7. First amendment issues related to UBE, by Paul L. Schmehl.
   http://www.utdallas.edu/~pauls/spam_law.html
8. U.S. Anti-Spam Laws
   http://www.the-dma.org/antispam/statespamlaws.shtml

9. The UK Data Protection Law
   http://www.dataprotection.gov.uk/

10. The Italian Anti-Spam Law
    http://www.parlamento.it/parlam/leggi/deleghe/99185dl.htm

11. The Austrian Telecm Law
    http://www.parlament.gv.at/pd/pm/XX/I/texte/020/I02064_.html

12. The Norwegian Marketing Control Act
    http://www.forbrukerombudet.no/id/11039810.0

Pasted from <http://www.private.org.il/harvest.html> 

Military Encryption-Breaking Computer Project Exposed

{This is an article from "The Intercept" with the url https://theintercept.com/2017/05/11/nyu-accidentally-exposed-military-code-breaking-computer-project-to-entire-internet/. The reason to include it in this blog is to demonstrate that the "deep state" is both insecure with respect to its weapons for cyberwarfare and that it is developing tools to defeat all methods of privacy. The combination is sobering with respect to individual and group rights and safety. I'm not saying that the work is bad, but that there are bad people in the deep state that have agendas that include stupidity and political ends, both to the detriment of the us. If I have a comment about the text, based on my experience with these technologies, I will comment in brackets.}

In early December 2016, Adam was doing what he’s always doing, somewhere between hobby and profession: looking for things that are on the internet that shouldn’t be. That week, he came across a server inside New York University’s famed Institute for Mathematics and Advanced Supercomputing, headed by the brilliant Chudnovsky brothers, David and Gregory. The server appeared to be an internet-connected backup drive. But instead of being filled with family photos and spreadsheets, this drive held confidential information on an advanced code-breaking machine that had never before been described in public. Dozens of documents spanning hundreds of pages detailed the project, a joint supercomputing initiative administered by NYU, the Department of Defense, and IBM. And they were available for the entire world to download.

The supercomputer described in the trove, “WindsorGreen,” was a system designed to excel at the sort of complex mathematics that underlies encryption, the technology that keeps data private, and almost certainly intended for use by the Defense Department’s signals intelligence wing, the National Security Agency. WindsorGreen was the successor to another password-cracking machine used by the NSA, “WindsorBlue,” which was also documented in the material leaked from NYU and which had been previously described in the Norwegian press thanks to a document provided by National Security Agency whistleblower Edward Snowden. Both systems were intended for use by the Pentagon and a select few other Western governments, including Canada and Norway.

Adam, an American digital security researcher, requested that his real name not be published out of fear of losing his day job. Although he deals constantly with digital carelessness, Adam was nonetheless stunned by what NYU had made available to the world. “The fact that this software, these spec sheets, and all the manuals to go with it were sitting out in the open for anyone to copy is just simply mind blowing,” he said.

He described to The Intercept how easy it would have been for someone to obtain the material, which was marked with warnings like “DISTRIBUTION LIMITED TO U.S. GOVERNMENT AGENCIES ONLY,” “REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO AND APPROVED BY THE DOD,” and “IBM Confidential.” At the time of his discovery, Adam wrote to me in an email:

All of this leaky data is courtesy of what I can only assume are misconfigurations in the IMAS (Institute for Mathematics and Advanced Supercomputing) department at NYU. Not even a single username or password separates these files from the public internet right now. It’s absolute insanity.

The files were taken down after Adam notified NYU.

Intelligence agencies like the NSA hide code-breaking advances like WindsorGreen because their disclosure might accelerate what has become a cryptographic arms race. Encrypting information on a computer used to be a dark art shared between militaries and mathematicians. But advances in cryptography, and rapidly swelling interest in privacy in the wake of Snowden, have helped make encryption tech an effortless, everyday commodity for consumers. Web connections are increasingly shielded using the HTTPS protocol, end-to-end encryption has come to popular chat platforms like WhatsApp, and secure phone calls can now be enabled simply by downloading some software to your device. The average person viewing their checking account online or chatting on iMessage might not realize the mathematical complexity that’s gone into making eavesdropping impractical.

The spread of encryption is a good thing — unless you’re the one trying to eavesdrop. Spy shops like the NSA can sometimes thwart encryption by going around it, finding flaws in the way programmers build their apps or taking advantage of improperly configured devices. When that fails, they may try and deduce encryption keys through extraordinarily complex math or repeated guessing. This is where specialized systems like WindsorGreen can give the NSA an edge, particularly when the agency’s targets aren’t aware of just how much code-breaking computing power they’re up against.
Adam declined to comment on the specifics of any conversations he might have had with the Department of Defense or IBM. He added that NYU, at the very least, expressed its gratitude to him for notifying it of the leak by mailing him a poster.

While he was trying to figure out who exactly the Windsor files belonged to and just how they’d wound up on a completely naked folder on the internet, Adam called David Chudnovsky, the world-renowned mathematician and IMAS co-director at NYU. Reaching Chudnovsky was a cinch, because his entire email outbox, including correspondence with active members of the U.S. military, was for some reason stored on the NYU drive and made publicly available alongside the Windsor documents. According to Adam, Chudnovsky confirmed his knowledge of and the university’s involvement in the supercomputing project; The Intercept was unable to reach Chudnovsky directly to confirm this. The school’s association is also strongly indicated by the fact that David’s brother Gregory, himself an eminent mathematician and professor at NYU, is listed as an author of a 164-page document from the cache describing the capabilities of WindsorGreen in great detail. Although the brothers clearly have ties to WindsorGreen, there is no indication they were responsible for the leak. Indeed, the identity of the person or persons responsible for putting a box filled with military secrets on the public internet remains utterly unclear.

An NYU spokesperson would not comment on the university’s relationship with the Department of Defense, IBM, or the Windsor programs in general. When The Intercept initially asked about WindsorGreen the spokesperson seemed unfamiliar with the project, saying they were “unable to find anything that meets your description.” This same spokesperson later added that “no NYU or NYU Tandon system was breached,” referring to the Tandon School of Engineering, which houses the IMAS. This statement is something of a non sequitur, since, according to Adam, the files leaked simply by being exposed to the open internet — none of the material was protected by a username, password, or firewall of any kind, so no “breach” would have been necessary. You can’t kick down a wide open door.

The documents, replete with intricate processor diagrams, lengthy mathematical proofs, and other exhaustive technical schematics, are dated from 2005 to 2012, when WindsorGreen appears to have been in development. Some documents are clearly marked as drafts, with notes that they were to be reviewed again in 2013. Project progress estimates suggest the computer wouldn’t have been ready for use until 2014 at the earliest. All of the documents appear to be proprietary to IBM and not classified by any government agency, although some are stamped with the aforementioned warnings restricting distribution to within the U.S. government. According to one WindsorGreen document, work on the project was restricted to American citizens, with some positions requiring a top-secret security clearance — which as Adam explains, makes the NYU hard drive an even greater blunder:

Let’s, just for hypotheticals, say that China found the same exposed NYU lab server that I did and downloaded all the stuff I downloaded. That simple act alone, to a large degree, negates a humongous competitive advantage we thought the U.S. had over other countries when it comes to supercomputing.

The only tool Adam used to find the NYU trove was Shodan.io, a website that’s roughly equivalent to Google for internet-connected, and typically unsecured, computers and appliances around the world, famous for turning up everything from baby monitors to farming equipment. Shodan has plenty of constructive technical uses but also serves as a constant reminder that we really ought to stop plugging things into the internet that have no business being there.

The WindsorGreen documents are mostly inscrutable to anyone without a Ph.D. in a related field, but they make clear that the computer is the successor to WindsorBlue, a next generation of specialized IBM hardware that would excel at cracking encryption, whose known customers are the U.S. government and its partners.

Experts who reviewed the IBM documents said WindsorGreen possesses substantially greater computing power than WindsorBlue, making it particularly adept at compromising encryption and passwords. In an overview of WindsorGreen, the computer is described as a “redesign” centered around an improved version of its processor, known as an “application specific integrated circuit,” or ASIC, a type of chip built to do one task, like mining bitcoin, extremely well, as opposed to being relatively good at accomplishing the wide range of tasks that, say, a typical MacBook would handle. One of the upgrades was to switch the processor to smaller transistors, allowing more circuitry to be crammed into the same area, a change quantified by measuring the reduction in nanometers (nm) between certain chip features. The overview states:

The WindsorGreen ASIC is a second-generation redesign of the WindsorBlue ASIC that moves from 90 nm to 32 nm ASIC technology and incorporates performance enhancements based on our experience with WindsorBlue. We expect to achieve at least twice the performance of the WindsorBlue ASIC with half the area, reduced cost, and an objective of half the power. We also expect our system development cost to be only a small fraction of the WindsorBlue development cost because we carry forward intact much of the WindsorBlue infrastructure.

{I specialized in ASIC design, development, and testing during my IBM career. 32 nm is old. The current technology is 10nm, represented by the Intel Cannonlake line. I think this level, 10nm, is just a shrink. More stuff might fit on a chip (die), but there are no fundamental changes from the previous generation. What this points out is that, especially with ASIC, the technology discussed here is "ancient." ASIC especially benefits from dimension shrinkage. My guess is that each chip has several RISC processors on it with control circuitry. (RISC processors were first use in commodity manufacturing in the early Mac computers. Today they are common in cell phones.) You can think of these computers as essentially a collection of fancy graphics cards, such as the ones produced by NVIDIA. I haven't included the pictures that go with this article, but they show "cooling." CMOS runs low power, typically requiring only air cooling. Is this showing water cooling? If so, then these ASICs are probably have some specialized super high speed circuits of the "bipolar technology." ASICS can mix CMOS and bipolar.}

Çetin Kaya Koç is the director of the Koç Lab at the University of California, Santa Barbara, which conducts cryptographic research. Koç reviewed the Windsor documents and told The Intercept that he has “not seen anything like [WindsorGreen],” and that “it is beyond what is commercially or academically available.” He added that outside of computational biology applications like complex gene sequencing (which it’s probably safe to say the NSA is not involved in), the only other purpose for such a machine would be code-breaking: “Probably no other problem deserves this much attention to design an expensive computer like this.” {No, image processing would be another option, such as massive facial recognition for an entire city.  In general, this configuration is a "cellular automaton."  Think of commanding a highly sophisticated attack by a swarm of drones.  Each drone is essentially a node of this computer.  Another very likely application is in the DeepDive project.}

Andrew “Bunnie” Huang, a hacker and computer hardware researcher who reviewed the documents at The Intercept’s request, said that WindsorGreen would surpass many of the most powerful code-breaking systems in the world: “My guess is this thing, compared to the TOP500 supercomputers at the time (and probably even today) pretty much wipes the floor with them for anything crypto-related.” Conducting a “cursory inspection of power and performance metrics,” according to Huang, puts WindsorGreen “heads and shoulders above any publicly disclosed capability” on the TOP500, a global ranking of supercomputers. Like all computers that use specialized processors, or ASICs, WindsorGreen appears to be a niche computer that excels at one kind of task but performs miserably at anything else. Still, when it comes to crypto-breaking, Huang believes WindsorGreen would be “many orders of magnitude … ahead of the fastest machines I previously knew of.”

{You'll probably have notice all the talk about AI. (artificial intelligence) The quote above is inaccurate. AI will be and has been implemented by architectures such as this. I know, I built several during my career. They are general purpose computers; they just work in a different way. More like neurons communicating with each other; hence the AI theme.}

But even with expert analysis, no one beyond those who built the thing can be entirely certain of how exactly an agency like the NSA might use WindsorGreen. To get a better sense of why a spy agency would do business with IBM, and how WindsorGreen might evolve into WindsorOrange (or whatever the next generation may be called), it helps to look at documents provided by Snowden that show how WindsorBlue was viewed in the intelligence community. Internal memos from Government Communications Headquarters, the NSA’s British counterpart, show that the agency was interested in purchasing WindsorBlue as part of its High Performance Computing initiative, which sought to help with a major problem: People around the world were getting too good at keeping unwanted eyes out of their data.

Under the header “what is it, and why,” one 2012 HPC document explains, “Over the past 18 months, the Password Recovery Service has seen rapidly increasing volumes of encrypted traffic … the use of much greater range of encryption techniques by our targets, and improved sophistication of both the techniques themselves and the passwords targets are using (due to improved OPSec awareness).” Accordingly, GCHQ had begun to “investigate the acquisition of WINDSORBLUE … and, subject to project board approval, the procurement of the infrastructure required to host the a [sic] WINDSORBLUE system at Benhall,” where the organization is headquartered.

Among the Windsor documents on the NYU hard drive was an illustration of an IBM computer codenamed “Cyclops,” (above) which appears to be a WindsorBlue/WindsorGreen predecessor. A GCHQ document provided by Snowden (below) describes Cyclops as an “NSA/IBM joint development.”

In April 2014, Norway’s Dagbladet newspaper reported that the Norwegian Intelligence Service had purchased a cryptographic computer system code-named STEELWINTER, based on WindsorBlue, as part of a $100 million overhaul of the agency’s intelligence-processing capabilities. The report was based on a document provided by Snowden.

The document does not say when the computer will be delivered, but in addition to the actual purchase, NIS has entered into a partnership with NSA to develop software for decryption. Some of the most interesting data NIS collects are encrypted, and the extensive processes for decryption require huge amounts of computing power.

Widespread modern encryption methods like RSA, named for the initials of the cryptographers who developed it, rely on the use of hugely complex numbers derived from prime numbers. Speaking very roughly, so long as those original prime numbers remain secret, the integrity of the encoded data will remain safe. But were someone able to factor the hugely complex number — a process identical to the sort of math exercise children are taught to do on a chalkboard, but on a massive scale — they would be able to decode the data on their own. Luckily for those using encryption, the numbers in question are so long that they can only be factored down to their prime numbers with an extremely large amount of computing power. Unluckily for those using encryption, government agencies in the U.S., Norway, and around the globe are keenly interested in computers designed to excel at exactly this purpose.

Given the billions of signals intelligence records collected by Western intelligence agencies every day, enormous computing power is required to sift through this data and crack what can be broken so that it can be further analyzed, whether through the factoring method mentioned above or via what’s known as a “brute force” attack, wherein a computer essentially guesses possible keys at a tremendous rate until one works. The NIS commented only to Dagbladet that the agency “handles large amounts of data and needs a relatively high computing power.” Details about how exactly such “high computing power” is achieved are typically held very close — finding hundreds of pages of documentation on a U.S. military code-breaking box, completely unguarded, is virtually unheard of.
A very important question remains: What exactly could WindsorBlue, and then WindsorGreen, crack? Are modern privacy mainstays like PGP, used to encrypt email, or the ciphers behind encrypted chat apps like Signal under threat? The experts who spoke to The Intercept don’t think there’s any reason to assume the worst.

“As long as you use long keys and recent-generation hashes, you should be OK,” said Huang. “Even if [WindsorGreen] gave a 100x advantage in cracking strength, it’s a pittance compared to the additional strength conferred by going from say, 1024-bit RSA to 4096-bit RSA or going from SHA-1 to SHA-256.”

Translation: Older encryption methods based on shorter strings of numbers, which are easier to factor, would be more vulnerable, but anyone using the strongest contemporary encryption software (which uses much longer numbers) should still be safe and confident in their privacy.

Still, “there are certainly classes of algorithms that got, wildly guessing, about 100x weaker from a brute force standpoint,” according to Huang, so “this computer’s greatest operational benefit would have come from a combination of algorithmic weakness and brute force. For example, SHA-1, which today is well-known to be too weak, but around the time of 2013 when this computer might have come online, it would have been pretty valuable to be able to ‘routinely’ collide SHA-1 as SHA-1 was still very popular and widely used.”

A third expert in computer architecture and security, who requested anonymity due to the sensitivity of the documents and a concern for their future livelihood, told The Intercept that “most likely, the system is intended for brute-forcing password-protected data,” and that it “might also have applications for things like … breaking older/weaker (1024 bit) RSA keys.” Although there’s no explicit reference to a particular agency in the documents, this expert added, “I’m assuming NSA judging by the obvious use of the system.”

Huang and Koç both speculated that aside from breaking encryption, WindsorGreen could be used to fake the cryptographic signature used to mark software updates as authentic, so that a targeted computer could be tricked into believing a malicious software update was the real thing. For the NSA, getting a target to install software they shouldn’t be installing is about as great as intelligence-gathering gifts come.

The true silver bullet against encryption, a technology that doesn’t just threaten weaker forms of data protection but all available forms, will not be a computer like WindsorGreen, but something that doesn’t exist yet: a quantum computer. In 2014, the Washington Post reported on a Snowden document that revealed the NSA’s ongoing efforts to build a “quantum” computer processor that’s not confined to just ones and zeroes but can exist in multiple states at once, allowing for computing power incomparable to anything that exists today. Luckily for the privacy concerned, the world is still far from seeing a functional quantum computer. Luckily for the NSA and its partners, IBM is working hard on one right now. {See https://www.engadget.com/2017/05/17/ibm-quantum-q-experience-qubits-most-powerful-processor-yet/ for the latest as of this post.}

Repeated requests for comment sent to over a dozen members of the IBM media relations team were not returned, nor was a request for comment sent to a Department of Defense spokesperson. The NSA declined to comment. GCHQ declined to comment beyond its standard response that all its work “is carried out in accordance with a strict legal and policy framework, which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight.”