Untangling the NSA’s latest alleged embarrassment

Last week, security researcher Mikko Hypponen found a notice on Github from an entity called Shadow Brokers, a reference to master of the galactic black market for information in the game Mass Effect. The notice was for an auction of exploits from the Equation Group (widely believed to be operated by the NSA).

The Github auction included two files. One was free and open for examination. The other, Shadow Brokers said, was for “the party which sends most bitcoins” to their payment address and who would then get the decryption information. The free samples showed that the exploits were quite real, and alarmingly powerful.

The free samples also helped researchers figure out that the exploits had been snatched from an external staging server and not the NSA itself, as many headlines this week incorrectly suggested… in a breach that happened three years ago. See, there’s nothing in the dump was newer than October, 2013.

Of course, the press is having its usual, confused feeding frenzy about anything and everything hacking and infosec, leading most people to believe that the NSA itself had actually been hacked. Well, the NSA has not been hacked; the New York Times headline asking if the NSA has been hacked and the Atlantic’s stupid “Yup! The NSA Got Hacked” are as egregiously irresponsible as they are uninformed.

Think of it like this: Your local Safeway uses a separate company to buy beer for its store. That buyer “stages” some of Safeway’s beer in a storage unit, which is robbed. Only the storage unit was burgled — but the newspapers are saying that Safeway was robbed, making everyone think the Safeway store was broken into and its security compromised.

Although, there is one thing here: This might solidify a link between Equation Group and NSA: The Washington Post confirmed the authenticity of the tools with two anonymous ex-NSA employees.

The auction page had been sitting there for two days before Hypponen tweeted his discovery. It has since has been removed by Github, as well as Pastebin and Tumblr.

It read, in part:

“How much you pay for enemies cyber weapons? Not malware you find in networks. Both sides, RAT + LP, full state sponsor tool set? We find cyber weapons made by creators of stuxnet, duqu, flame. Kaspersky calls Equation Group. We follow Equation Group traffic. We find Equation Group source range. We hack Equation Group. We find many many Equation Group cyber weapons. You see pictures. We give you some Equation Group files free, you see. This is good proof no? You enjoy!!! You break many things.”

Shadow Brokers added, “If our auction raises 1,000,000 (million) btc total, then we dump more Equation Group files, same quality, unencrypted, for free, to everyone.”

Unfortunately for Shadow Brokers, the auction hasn’t exactly been a hit. Losing bidders don’t get their money back, and the kitty is only up to 1.5 BTC ($862).

Alex Rice, CTO at bug bounty platform HackerOne, told CSO Online that Shadow Brokers had given a fortune in 0day away for free in that sample file. The exploits could’ve sold for “north of six figures” each on the grey market to governments (Hacking Team, for example, was a grey market operator). In an incredibly detailed post, Risk Based Security thought the pilfered attacks would’ve pulled in between $200,000 and a million dollars — and that’s if they’d sold the booty to “good guy” bug bounty buyers.

At Lawfare, Nicholas Weaver explained that the freebie file included eight different exploits and some dead-serious implants that circumvent firewalls, among other things. He also said that the exploits “appear to target Fortinet, Cisco, Shaanxi Networkcloud Information Technology (sxnc.com.cn) Firewalls, and similar network security systems.”

The fact that this is all from 2013, which continues to get overlooked in reporting and armchair-activist hysteria alike, is important. This week’s headlines saying “oh noes the bad tools are being used now” are bit hyperbolic in light of the fact that these tools are three years old and have likely been used “in the wild” (to a very limited extent) since.

Some of my colleagues in the press are falling all over themselves with another genuine NSA-whodunnit on their hands. So, who is the culprit? Lawfare had three great, rational, sensible, and far-too-practical-for-CNN answers to the question:

“At present, there appear to be three possibilities:

• (1) An insider stole this data.
• (2) An adversary somehow exfiltrated data from a Top Secret system.
• Or (3) an NSA operator, seriously breaches operational security protocols and copied all these files—presumably a substantial part of an ‘ops disk’—onto an unclassified system for attack staging and then left it there for four months.”

While the sideshows of conspiracy theories and government hyperbole spin-up, Risk Based Security wrote an extremely grounded post. It included this salient section about the timing of it all:

“While technical evidence may be completely lacking and speculation ruling the day, it cannot be ignored that the timing of this leak in the current U.S. political climate is suspect. With the last few weeks of U.S. news dominated by Donald Trump and questionable ties to Russia and Vladimir Putin, as well as Trump’s speeches calling for Russia to hack U.S. government resources (in jest or not), it begs the question if the Equation Group leaks are part of a political agenda.

The Register is one of many news outlets to put that theory forward, in addition to hundreds of Twitter denizens. This is the type of speculation that is important to discuss, but prudence demands that it remain part of the discussion until evidence surfaces.”

Of course, Edward Snowden struck a few suggestive poses on Twitter while confirming the validity of the finds (hey, it’s a living). The sycophantic elite cooed; The Intercept released code from deep in their years-old and coveted treasure trove of Snowden files that matched a couple exploits in the dump.

The Intercept triggered another simultaneous release — of public anger at the organization’s hoarding of critical information on tracking malware strains.

https://t.co/SPena9rsLO You guys sat on documents that included instructions for “track[ing] [the] use of [NSA malware]” for *three years* ?

— Andreⓐ (@puellavulnerata) August 20, 2016

Hacker Matt Suiche has a great post with an ex-NSA analyst, who had many great points, including this one:

“Technically speaking, Edward Snowden is also just speculating and the only major leak we have heard of from the NSA was actually from him and he was an insider. And that media tend to take every ‘speculative statements’ he makes as a “fact” (which is true, many of my friends complained about it) — especially since the NSA cannot confirm or deny any of those ‘facts’ publicly.”

And that’s a much needed dose of common sense in this whole NSA circus revival.

VW aims for an EV that goes 300 miles on a 15-minute charge

In the wake of its emissions scandal and lawsuit with US authorities, German automaker Volkswagen has been pushing its electric concept vehicles and rushing its 84-mile-per-battery E-Golf into the consumer market. But for range and convenience rivaling Tesla’s lineup, VW’s first entry in its next generation of EV will be revealed to the public at the Paris motor show in October, a company chairman told German magazine WirstschaftWoche. While the car’s compact Golf-like size combined with the roomy Passat-like interior space is promising, the real kicker is the recharge speed the company’s engineers are aiming for: Plug the car in for 15 minutes and it should be able to drive for 300 miles.

That’s the plan, VW Group CEO Matthias Müller confirmed to Autocar, with a pricetag they hope to be lower than a comparable combustion-engine car. Which will be wonderful if it arrives from the production line as advertised at the end of 2018 or beginning of 2019, a hopeful date mentioned by the chairman, though Müller only affirmed a 2025 target for the car’s release. But even the Tesla Supercharger can only manage to refill 50 percent of its battery after 20 minutes, equivalent to 115 to 126 miles. The range VW is boasting is in line with their estimates for that of its Modular Electric Platform (MEB) proposed for its BUDD-e microbus concept back in January, which claimed to charge 80 percent of its 373-mile maximum in 15 minutes.

The VW-owned Porsche boasted the same rate for its sportsy Model E electric car, which they announced would roll off assembly lines in 2019. But as TechCrunch points out, further research into and technical development of an 800-volt charging method is necessary for the performance vehicle to reach that refilling speed. Meanwhile, Tesla’s existing Model S can net up to 58 miles per hour from a 240-volt socket and an aftermarket second in-car charger, hitting its own 80 percent mark in about four hours. It’s not up to the rate that VW is claiming, but it’s a tested standard without additional infrastructure or a dedicated Supercharger station.

Regardless, the VW chairman told WirstschaftWoche that the unnamed EV sedan will be the first in a lineup of “New Urban Vehicles” designed to use MEB. It will include a city-ready SUV, a coupe, a small delivery van akin to the previously-announced BUDD-e concept minibus and a luxury sedan.

Via: TechCrunch

Source: Autocar

Apple CEO Tim Cook Sells More Than $35M in Stock

Apple CEO Tim Cook recently sold more than $35 million worth of Apple stock, according documents filed with the SEC this week.

Cook sold 334,000 shares at prices ranging from $107.21 to $107.69, netting himself almost $36 million dollars.

Apple also sold more than 656,000 shares on Tim Cook’s behalf, an amount over $70 million, to settle the tax liability for the RSUs that vested earlier this week as he reached his five-year anniversary as CEO of Apple.

Cook on Wednesday unlocked awarded stock bonuses worth more than $100 million for both his time spent at Apple and the company’s performance under his leadership, earning 1,260,000 total shares.

That number consists of 980,000 tenure-based RSUs and an allotment of 280,000 shares awarded because Apple’s shareholder return reached 61%, putting it in the top-performing third of the S&P 500 index.

Tim Cook continues to hold more than 1.3 million shares of Apple stock following the sale, which is worth more than $140 million.

Tag: Tim Cook
Discuss this article in our forums

Samsung Galaxy Note 7 accessories are now available at ShopAndroid

ShopAndroid is now full of the best Samsung Galaxy Note 7 accessories, so check them out!

If you’ve recently picked up the Galaxy Note 7, odds are that you have been looking around at some accessories to pick up for it. Luckily, ShopAndroid has you covered with all of your needs, from cases to battery packs, Bluetooth speakers, memory cards and much more. We’ve got top brands like SanDisk, Belkin, Seidio and more in stock, and some pretty great bundles as well.

Whether it is protection that you seek for the phone or something to keep it mounted in the car, we’ve got you covered. Be sure to head over to the ShopAndroid Store for all your Galaxy Note 7 accessory needs, and remember, orders over $50 ship for free!

See at ShopAndroid

Android 7.0 and the Snapdragon 800 — a conundrum

You’ll have to get Android 7.0 for the Nexus 5 from XDA. Let’s try to figure out why.

Many of us are sad that the Nexus 5 isn’t getting any official update to Android 7.0. Especially when we watched and saw Google continue to build device trees in the code for Hammerhead — that means someone, somewhere, was working on it. And when Sony announced which phones were going to receive an update to Android 7.0, many noticed that the Xperia Z3 wasn’t on the list. While the idea that phones from 2014 not getting updated late in 2016 isn’t particularly surprising, the fact that the Z3 was part of Sony’s Android Concept Initiative — a fancy name for an Android 7.0 Beta program — but didn’t make the cut and that Google was working on Nougat for the Nexus 5 then just suddenly stopped was.

The situation has the internet asking the obvious question — why? The answer is that the Z3 and Nexus 5 actually can’t officially run Android 7.0, even though could as a beta. Read on. It will all make sense.

Android platform updates aren’t as important to consumers as we make them out to be. Here at Android Central we get excited about anything new and shiny, we tell you as soon as we can (often after you already know because leaks happen) and then we all get excited together. The reality is that Google Play Services and monthly patches will let you do everything you do on your phone for a long time, and by the time a must-have app comes out that requires the next version of Android you’ll probably have a new phone or the update.

We can still want it, but this is just how things go until someone Google steps forward and changes it. Then you’ll hear talk about Google’s iron fist and EU complaints and God knows what else. The status quo sucks, but it still is the status quo.

Android 7.0 has no official support for the Snapdragon 800.

For the Android 7.0 update, in particular, we need to look no further than the requirements and the hardware of the Xperia Z3 or Nexus 5 (and plenty of other phones) for a likely answer about why certain phones aren’t able to be updated. We can’t confirm this using official statements or documents or a fancy slide, but we’re sure enough to talk about it and why it worked out the way it did.

Android 7.0 in AOSP has removed support for the MSM8974 chipset. The Snapdragon 800 SoC uses this chip along with the Adreno 330 GPU. This means phones (and tablets — hello, Nexus 7) using the Snapdragon 800 are not supported. But this doesn’t explain why the Z3 was able to run the beta, and run it well. For that, Google Play compatibility comes into the picture.

Nobody from any of the companies involved is talking about these issues, and requests for an official statement haven’t been returned, but the internet has some clues about it all. Here we see Ola Olsson, of Sony Mobile Communications, talk a bit about it in a comment on Google+.

Yeah, this is sad but we don’t want to play the blame game which means that we can’t say more about the technical limitations. Even if we really wanted to give you N on the z3(c), we wouldn’t [have] been able to do it. Not if we wanted to pass the Google CTS.

You’ll find similar responses elsewhere, and this is Sony not throwing anyone under the bus and handling things in a professional, corporate way. The important thing there is the mention of Google CTS.

Google CTS is the Compatibility Testing Suite used to make sure a device can be certified to use Google Play. Android is a free application platform that anyone can take and use in any way it likes, but Google Play is not. It’s a true for-profit commercial venture and Google has full and complete control over everything associated with it.

The actual rules and requirements needed for Android 7.0 CTS compliance are a bit of a mystery — either partners can’t talk about it or don’t want to talk about it — but we know the gist of it. Your product has to be able to run any app targeted for your platform version. That means if you’re using Android 7.0, you need to support any app designed for Android Nougat. You can check out the Android 6.0.1 CTS documentation if you’re curious. The Android 7.0 CTS documentation should live in the same place once it’s been updated.

During the beta testing for Android N — just after the release of version four — developers were told that Android N APIs were finalized and they could start targeting apps for them in Google Play. One of the things Android N does for developers is let them use the Vulkan and OpenGL ES 3.1 APIs with both the SDK and the NDK. For that, though, you need hardware support. The Snapdragon 800 does not offer hardware support for either, and apps not designed to fall back to an older version of OpenGL would not run.

Now, as mentioned, we don’t have access to the latest Android CTS documents. For Android 6.0.1, it said that hardware had to support OpenGL ES 1.0, 2.0 and 3.0 or 3.1. I’ve been told that was amended to say “support OpenGL ES 1.0, 2.0, 3.0 and either 3.1 or Vulkan,” but Google has said nothing officially. But this certainly explains why support for the Snapdragon 800 was removed and phones like the Nexus 5 and the Z3 aren’t going to see an official update, and I’m confident that this is the reason.

Android is open, but Google Play is not; there are rules involved.

This is a long, convoluted and confusing subject — much like Android updates in general. In the end, we know two things: the Sony Xperia Z3 will not be updated to Android 7.0 because it would not pass the CTS for technical reasons, and the Snapdragon 800 SoC does not offer OpenGL ES 3.1 support. The fact that no phone using the Snapdragon 800 or 801 (the 801 also uses the Adreno 330 GPU) has been announced as getting an update is a bit telling, too.

Let’s be honest — this sucks. As enthusiasts, we want to get an update even if it doesn’t change anything. The practical view that platform updates aren’t as important as we make them out to be is fine, and I do think it’s true, but that doesn’t satisfy the inner geek. But it’s also inevitable. Android has to advance and support new (and better) technologies like Vulkan. When these require hardware support, there has to be a cutoff. Maybe this time, the cutoff could have been avoided — the General Mobile 4G, an Android One device that uses the Snapdragon 410 and is in every way weaker on the hardware front than any phone running the Snapdragon 800 — already has Android Nougat and this throws a huge wrench into even the most plausible theory.

Is Google breaking its own rules here in regard to the CTS? Or is everything we have heard and think we know all bullshit and it really is some sinister plot to make us angry? (I’m fairly certain Google is breaking its own rules because it can, but I’m just as certain that everything is bullshit, so I still have no idea.)

The bottom line is that if you have a phone like the Xperia Z3, or the Nexus 5 or the Galaxy S5 and really want Android 7.0 Nougat, you’ll probably have to get it from the fine group building custom software for the phones on XDA.

NASA extends the Spitzer mission for two-and-a-half years

When the Spitzer telescope blasted off to space on August 25th, 2003, NASA didn’t think it would still be doing science by 2016. But since it’s alive and well 13 years later, the agency has granted it a two-and-a-half-year mission extension to make discoveries the astronomers “never imagined exploring with the spacecraft.” The space telescope’s next stage officially called the “Beyond phase” will begin on October 1st this year. It represents a period in the elderly spacecraft’s life fraught with engineering challenges due to its age.

First, since Spitzer travels slower than our planet, it’s now in a less-than-ideal position to continue communicating with its ground team. To make up for that, its antenna should always be pointed at higher angles toward the sun, which is risky, because the spacecraft is sensitive to heat. That’s also an issue since that would turn its solar panels away from the sun. Using energy until it’s almost depleted because the solar panels can’t absorb that much power will put great strain on the telescope’s batteries.

Spitzer’s mission has transformed over time, especially afer the helium coolant that was keeping its main scientific instruments cold ran out. Thankfully, its Infrared Array Cameras (IRAC) survived, so the agency has been using them to hunt for exoplanets and even early galaxies. “We never even considered using Spitzer for studying exoplanets when it launched,” NASA Spitzer’s Sean Carey said. “It would have seemed ludicrous back then, but now it’s an important part of what Spitzer does.” The telescope will continue what it’s been doing these past three years and will identify targets that its successor, the James Webb telescope, can observe more closely. James Webb — and its primary mirror that’s more powerful than Hubble’s — is slated to launch in October 2018.

Source: NASA