CES: Intel unveils Edison, a Quark-based computer the size of an SD Card

Intel is pushing forward with technology to enable the Internet of Things and wearable technology, by unveiling a tiny computer the same size as an SD card at CES.

Dubbed Edison, it is based on Intel's 22nm Quark processor, which the firm launched at its IDF conference last year, and is intended to be embedded into other devices and objects to make them more intelligent and connected.

Inside Edison, the 400MHz Quark processor is combined with WiFi and Bluetooth low-energy wireless interfaces for connectivity, and also has built-in LPDDR2 memory and flash storage. Because the Quark chip is x86-based, it can support Linux and other operating systems to run sophisticated high-level applications, Intel claimed.

Edison, which is set to be available this summer, will be compatible with developer tools used by the 'maker' community, meaning that it should be relatively quick and simple to build software to run on the device.

Intel intends Edison to enable rapid innovation and product development by a range of inventors, entrepreneurs and product designers, according to chief executive Brian Krzanich.

"Wearables are not everywhere today because they aren't yet solving real problems and they aren't yet integrated with our lifestyles. We're focused on addressing this engineering innovation challenge. Our goal is, if something computes and connects, it does it best with Intel inside," he said.

Autodesk said it was adding support for Edison to its 123D Circuits, an online circuit design and development tool. The move follows Intel's launch of a single-board computer based on Quark technology, called Galileo.

Read More

NSA Can Turn iPhones in Spying Tools: Expert

A well-known privacy advocate has given the public an unusually explicit peek into the intelligence world's tool box, pulling back the curtain on the National Security Agency's arsenal of high-tech spy gear. 

Independent journalist and security expert Jacob Appelbaum told a hacker conference in Germany that the NSA could turn iPhones into eavesdropping tools and use radar wave devices to harvest electronic information from computer even if they weren't online. 

Appelbaum told hundreds of computer experts gathered at Hamburg's Chaos Communications Conference that his revelations about the NSA's capabilities "are even worse than your worst nightmares." "What I am going to show you today is wrist-slittingly depressing," he said. 

Even though in the past six months there have been an unprecedented level of public scrutiny of the NSA and its methods, Appelbaum's claims -- supported by what appeared to be internal NSA slideshows -- still caused a stir. 

One of the slides described how the NSA can plant malicious software onto Apple's iPhone, giving American intelligence agents the ability to turn the popular smartphone into a pocket-sized spy. 

Another slide showcased a futuristic-sounding device described as a "portable continuous wave generator," a remote controlled device which -- when paired with tiny electronic implants -- can bounce invisible waves of energy off keyboards and monitors to see what is being typed even if the target device isn't connected to the internet. 

A third slide showcased a piece of equipment called Nightstand, which can tamper with wireless internet connections from up to 8 miles away. An NSA spokeswoman Vanee Vines said that she wasn't aware of Appelbaum's presentation, but that in general should would not comment on "alleged foreign intelligence activities." 

"As we've said before: NSA's focus is on targeting the communications of valid foreign intelligence targets -- not on collecting and exploiting a class of communications or services that would sweep up communications that are not of bona fide foreign intelligence interest to the US government." 

The documents included in Appelbaum's presentation were first published by German magazine Der Spiegel. 

Appelbaum and Der Spiegel have both played an important role in the disclosures of NSA leaker Edward Snowden, but neither has clarified whether the most recent set of slides came from Snowden.

Read More

NSA can spy on offline computers wirelessly, says security expert

A well-known privacy advocate has given the public an unusually explicit peek into the intelligence world's tool box, pulling back the curtain on the National Security Agency's arsenal of high-tech spy gear.

Independent journalist and security expert Jacob Appelbaum on Monday told a hacker conference in Germany that the NSA could turn iPhones into eavesdropping tools and use radar wave devices to harvest electronic information from computer even if they weren't online.

Appelbaum told hundreds of computer experts gathered at Hamburg's Chaos Communications Conference that his revelations about the NSA's capabilities "are even worse than your worst nightmares."

"What I am going to show you today is wrist-slittingly depressing," he said.

Even though in the past six months there have been an unprecedented level of public scrutiny of the NSA and its methods, Appelbaum's claims - supported by what appeared to be internal NSA slideshows - still caused a stir.

One of the slides described how the NSA can plant malicious software onto Apple Inc.'s iPhone, giving American intelligence agents the ability to turn the popular smartphone into a pocket-sized spy.

Another slide showcased a futuristic-sounding device described as a "portable continuous wave generator," a remote controlled device which - when paired with tiny electronic implants - can bounce invisible waves of energy off keyboards and monitors to see what is being typed even if the target device isn't connected to the Internet.

A third slide showcased a piece of equipment called NIGHTSTAND, which can tamper with wireless Internet connections from up to 8 miles away.

An NSA spokeswoman Vanee Vines said that she wasn't aware of Appelbaum's 

presentation, but that in general should would not comment on "alleged foreign intelligence activities."

"As we've said before:  NSA's focus is on targeting the communications of valid foreign intelligence targets - not on collecting and exploiting a class of communications or services that would sweep up communications that are not of bona fide foreign intelligence interest to the U.S. government," Vines said.

The documents included in Appelbaum's presentation were first published by German magazine Der Spiegel Sunday and Monday.

Appelbaum and Der Spiegel have both played an important role in the disclosures of NSA leaker Edward Snowden, but neither has clarified whether the most recent set of slides came from Snowden.

Der Spiegel's revelations related to a division of the NSA known as Tailored Access Operations, or TAO, which is painted as an elite team of hackers specializing in stealing data from the toughest of targets.

Citing internal NSA documents, the magazine said Sunday that TAO's mission was 

"Getting the ungettable," and quoted an unnamed intelligence official as saying that TAO had gathered "some of the most significant intelligence our country has ever seen."

Der Spiegel said TAO had a catalog of high-tech gadgets for particularly hard-to-crack cases, including computer monitor cables specially modified to record what is being typed across the screen, USB sticks secretly fitted with radio transmitters to broadcast stolen data over the airwaves, and fake base stations intended to intercept mobile phone signals on the go.

Additionally, the magazine reported the NSA was intercepting computer deliveries to install spying abilities on them, and suggested the agency was "compromising the technology and products of American companies" like Dell and Microsoft.

Read More

Bedford’s RSA under fire after NSA allegations

Cybersecurity experts and privacy advocates are continuing to press Bedford cybersecurity company RSA to reveal more details about its relationship with the National Security Agency’s spying program, with some critics calling for a boycott of the company’s upcoming annual convention.

A Dec. 20 Reuters article suggested that RSA, a division of the data storage giant EMC Corp. of Hopkinton, received $10 million from the NSA to modify one of its cybersecurity products, Bsafe, in a way that would allow the spy agency to get around computer safeguards and access sensitive data. Critics contend RSA has failed to clarify what its specific business dealings were with the NSA.

“I would want to see a clear statement from EMC about what software they’re using, and what algorithms they’re using,” said Matthew Green, assistant research professor of computer science at Johns Hopkins University, referring to the compromised computer formula and other security products.

RSA and EMC each declined to comment Friday.

The product in question, Bsafe, is a widely used software tool designed to prevent hackers from breaking into software applications and stealing data. It gives users a choice of several formulas that generate random numbers needed to encrypt data. 

Moreover, the RSA encryption software is used throughout EMC’s products, raising the possibility that data stored on EMC systems might be vulnerable.

The Reuters story said RSA installed a computer algorithm selected by the NSA into Bsafe, and made it the default number generator, so that it would more likely be used by customers. That could give the NSA the means to break into applications protected by the RSA product.

Earlier this year, leaks by former government contractor Edward Snowden revealed that the NSA had designed such an encryption formula and made it available to the cybersecurity industry.

The Reuters article is the first account suggesting that RSA was paid to be complicit in using the NSA algorithm. The story quoted some in the industry who questioned whether RSA was duped into using the encryption tool by the NSA.

This past weekend, RSA acknowledged it had worked with the NSA on a computer code for its security products, as far back as 2004 — well before anyone had an inkling of the widespread snooping the agency would conduct.

But RSA said, “We have never entered into any contract or engaged in any project with the intention of weakening” its security products or introduced vulnerabilities that others could exploit.

Earlier in 2013, RSA did acknowledge that the security formula in Bsafe was flawed, and suggested clients stop using the default number generator.

The company’s statement, however, has failed to mollify many critics, who complained the company did not address some of the allegations in the Reuters story.

Now, just eight weeks before the company hosts its annual conference, one of the computer security industry’s most prestigious events, RSA is facing a growing backlash, from cyber professionals and privacy advocates alike.

 

Two prominent speakers have withdrawn from the conference, and talk of a boycott of the RSA Conference is spreading on social media.

“There are going to be economic consequences, especially outside the United States. 

The boycott of the RSA Conference is just the tip of the iceberg,” said Nicco Mele, a technology and policy expert at the Harvard Kennedy School.

Indeed, one of the first cybersecurity experts to withdraw from the conference was Mikko Hypponen, a well-known privacy specialist and chief research officer at the Finnish company F-Secure. Soon thereafter, Josh Thomas, an executive with Atredis Partners in Houston, also canceled his talk at the RSA Conference.

“I feel absolutely no need to go to that conference and speak, and by my actions and my words to further the RSA brand,” said Thomas, who worked for more than a decade developing artificial intelligence software for the Army and cryptographic software for the Pentagon.

Previously RSA earned a reputation for fighting the government’s efforts to weaken encryption tools. In the 1990s, under Jim Bidzos, former chief executive, it helped quash an NSA program to get telecommunications companies to adopt a chip that would make government eavesdropping easier.

Now its credibility is being called into question.

“What can RSA say? You caught us here, but we haven’t done it anywhere else? You can trust us?” said Bruce Schneier, author of multiple books on data security and privacy.

More broadly, said Schneier, the NSA spying scandal is taking a toll on the American technology industry.

For instance, he said, Cisco Systems Inc. said last month that customers in emerging markets are buying less of its equipment out of concern about built-in back doors that could let US spies access their data.

A bid by AT&T Inc. to buy the British cellphone company Vodafone Group PLC has faced pushback from European regulators worried about NSA infiltration of American telecommunications.

“This is the poison of what NSA has done,” said Schneier. “They’ve destroyed trust on the Internet.”

Meanwhile, some smaller security companies that offer similar products to the RSA Bsafe tool kit may stand to benefit. One such firm is Security Innovation Inc. of Wilmington, which offers its own security algorithm to keep applications safe.

As a result of the Snowden leaks “you are seeing everyone rethinking and reevaluating the relationships they have,” said Ed Adams, chief executive of Security Innovation. “It’s an opportunity for smaller security companies.”

Adams said that RSA has reached out to Security Innovation about potentially working with his company. That could be a way for RSA to add additional security formulas to its technology.

Adams did not provide details on what that partnership would involve.

While he would also like to see RSA respond to critics with more information, Adams doesn’t fault RSA in this case. It’s often impossible to know the motivations and intentions of the NSA when performing contract work for that and other government agencies.

“This is the yin and yang that you always have to manage when you are trying to do business with the government,” said Adams, whose company worked extensively with government spy agencies until it spun off that business unit in 2005 and sold it to Raytheon Co. in 2008. “You are always caught between two different missions.”

Read More

Why I cover my iPhone and laptop camera

Almost all of us use an electronic device with a camera on a daily basis. Be they on a smartphone, laptop or desktop computer, these cameras follow us everywhere.

What might surprise you though is that they can be used to spy on you remotely, and that the warning lights can be disabled.

Perhaps you're reading this article using a smartphone while on the toilet (almost a third of people admit to surfing the web there).

Now think again about that camera staring back at you. Where else do you position your computer, tablet or smartphone's camera, and what might someone see if they watched you constantly? Perhaps it's your bedroom antics, your daily nude stroll around the house or you picking your nose.

Because of this, and following an article I wrote about IT security experts using Post-it notes, electrical tape, Band-Aids and cigarette papers to secure their computer web cameras from hackers, I started covering up the cameras of my two laptops, desktop and smartphone in April.

This was in addition to already making use of anti-virus and other security software on my devices. A New York Times security writer also recently divulged that they did this too.

I, like many others, close the blinds at night, so I figured I should probably put some sort of blind on my devices if I cared about my privacy. When I needed to use them for video conferencing or the occasional "selfie", I could just take the tape off. It made perfect sense, even though it wasn't as practical as I had hoped.

Friends and work colleagues who saw the tape over my mobile's front- and back-facing camera laughed at me and called me "paranoid" and "crazy". This was about two months before revelations concerning mass surveillance conducted by the world's Western spy agencies came out. 

I wrote the April article after reading another one about a 17-year-old boy from NSW's mid-north coast who, when he was 14, began hacking into peoples' computers using a program called Remote Administration Tools and remotely activating their web cameras. Discussion threads on forums discussing the use of such tools, or RATs, overflow with webcam screenshots, to celebrate both "hot female slaves" and "ugly slaves".  

While writing the April article, I was reminded of a family friend who permanently used a greeting card to cover their external web camera, and of another article a former colleague of mine wrote in 2010 at ZDNet about a pioneer of public-key cryptography using tape over his laptop's web camera.

I recalled calling these people paranoid and crazy too. That was because they used Apple MacBooks, which uses a web camera that most people have understood to be "hard-wired" to the green light in a way that means that if it's in use it is illuminated so that you know it's active.

But new research from Johns Hopkins University in the US provides the first public confirmation that it's possible to covertly activate a MacBook's camera - without triggering the light - and demonstrates how. While the research focused on MacBook and iMacs released before 2008, the authors say similar techniques would probably work on more recent computers from a wide variety of vendors.

In fact, evidence already exists on hacker forums about people who have successfully been able to disable the warning light of web cameras on a number of vendors' device without much difficulty. Even a former FBI agent admitted recently that the agency has been capable of doing it for several years. 

 A US school was also found in 2010 to have, apparently accidentally, stored 30,000 laptop webcam images and 27,000 screenshot images while students were either at school or at home. Closer to home, schools using government-supplied laptops in 

Queensland were in May last year found by the Courier Mail newspaper to have software on them that took time-stamped screenshots, monitored printing, visits to websites and keystrokes of students.

Fairfax Media also reported last year that Melbourne-based Rentasaur leased laptops with software on them that tracked a user's location and had the capability to capture imagery.

So should you tape your web camera too or is it like putting your head in the sand? It's up to you, but you need to be able to make an informed decision. Don't consider it a crazy act: Vulnerabilities exist in devices and security can be reverse-engineered. And don't think that just because you use Apple or any other brand you're safe.

Now I just need to find a practical way of taping up the microphones... glue anyone?

Read More

Hacking, the 2014 version

An IDF C4I Corps soldier monitors for hacker activity

A more connected world means more opportunities for individuals and businesses to communicate and make connections – and more opportunities for hackers to hijack computer resources for their own nefarious ends. In 2014, say three top security experts, expect more and more sophisticated attacks, as hackers take advantage of both smart home technology, and the increased concern and desperation among those seeking work. 

As has been the case in recent years, say Andrei Dolkin, Yariv Lenczer, and Avishag Danieli – among the top experts at Israeli security company CyberArk – “social engineering” will remain a prime method for hackers to get control of users’ computers. Sophisticated attacks are already de rigueur for many users, as hackers send out links that look for all the world like the “real thing,” with messages from banks, on-line stores, “official” looking sites, or even friends and relatives.  

Once clicked, though those links lead back to a web location where, once a user connects, they download a piece of malware that will give the hacker total and utter control over the hapless victim’s computer or device. Once in charge, hackers can enroll a victim computer – or, in most cases, their whole network – into a botnet system, the combined processing power of which is used to conduct hacking attacks against banks and government servers, to send out reams of spam, to steal credit card or other financial data, and so on.

Social engineering, say the experts, has proven to be one of the most important and useful arrows in the hackers’ quiver, because the victim “voluntarily” installs the malware onto a device – thus saving the hacker the trouble of having to get past anti-virus or other protective software. If some is good, more must be better – so, say the experts, expect more and more sophisticated social engineering attacks in the coming year.

One sad twist on the social engineering phenomenon, say the experts, is the vulnerability of the masses who have been out of work for months, or even longer. Following the advice of “how to get a job” gurus, many are using business-oriented networking sites like LinkedIn to connect with others, and spread the word that they are seeking work. But using social engineering tactics, hackers have already managed to infiltrate these groups and steal information, logins, and other data – which they promptly used to rip off victims, their families, and their LinkedIn connections.

In one case, say the experts, a hacker joined a closed LinkedIn group and claimed to have a high-level security clearance in a U.S. intelligence agency. Trusting the hacker, users in the group unveiled information that they should have kept private – and found that their credit cards and bank accounts had been compromised. Other hackers target employees of specific companies, building a network of LinkedIn of employees, and send out links to malware. In other cases, hackers have joined groups of LinkedIn users seeking jobs, and talked members into clicking on links that installed malware on their devices.

In response to press articles about the phenomenon, LinkedIn said that when it came to social engineering, there was little they could do. “We recommend members connect only with people that they know and trust,” a company spokesperson said. “All Internet users should of course be aware of the fact that there are bad guys out there who unfortunately resort to things like phishing attacks, and that people should use common sense and tools available to them to ensure that they don’t fall prey.”

A related social engineering trick hackers are using against the unemployed, said the experts, was targeting workers in industries and companies where cutbacks or layoffs have been announced. Capitalizing on the panic of the newly-unemployed – or those who fear they will be next – hackers distribute links to phony networking groups, support sites, headhunter sites, and even legal rights information sites. Needless to say, all those who fall for the trick find that their devices are “owned” by the hacker.

Another major trend, said the experts, will be the expansion of “cybercrime-as-a-service.” Similar to other one-stop web services, CAAS entails a customer trying to break into sites or databases of rivals – to gather information or for more destructive purposes – logging onto a cybercrime portal where they will be able to order the actions and activities they want. “Access to privileged accounts, we believe, will be one of the ‘hottest’ hacker products in the coming year,” said Dolkin. “We already saw this trend in 2013, in the case of the hacker Andrew James Miller, who used privileged accounts to get into numerous U.S. government sites.”

As if preying on the unemployed wasn’t enough, the CyberArk team said, homeowners who have set up “smart” devices” in their homes need to be concerned that they are protected as well. “Electricity meters, Smart TVs, smart air conditioners, and more are all Internet-connected now,” said Dolkin. These devices use the same connectivity technology as routers and modems – meaning that they have built-in passwords and user-logins.

Andrey Dulkin

Changing the password on a smart refrigerator (already a hot item in the Far East, these fridges can tell you when you are out of milk or have too many leftovers) is probably the last thing anyone would think of – but a smart appliance owner’s neglect or apathy is gold to a hacker. “It’s not just the refrigerator or an individual smart appliance that is at risk,” Dolkin added. “The entire house is networked, usually using the same router, so once a hacker is in, they can access other components of the network.”

Along with these “new” threats, said the team, the “same old” threats will still be with us – just more so. More small business will be targeted by hackers (they are easier to “hit,” said the team), more organized crime groups will get involved in the very lucrative business of cybercrime, and more people and businesses will fall victim to hack attacks. “Our best advice,” said Dolkin, “is to get educated, and of course, never click on a link you’re not sure about.”

Read More

The NSA Had A Secret Deal With A Highly Influential Computer Security Firm

As a key part of a campaign to embed encryption software that it could crack into widely used computer products, the U.S. National Security Agency arranged a secret $10 million contract with RSA, one of the most influential firms in the computer security industry, Reuters has learned.

Documents leaked by former NSA contractor Edward Snowden show that the NSA created and promulgated a flawed formula for generating random numbers to create a "back door" in encryption products, the New York Times reported in September. Reuters later reported that RSA became the most important distributor of that formula by rolling it into a software tool called Bsafe that is used to enhance security in personal computers and many other products.

Undisclosed until now was that RSA received $10 million in a deal that set the NSA formula as the preferred, or default, method for number generation in the BSafe software, according to two sources familiar with the contract. Although that sum might seem paltry, it represented more than a third of the revenue that the relevant division at RSA had taken in during the entire previous year, securities filings show.
The earlier disclosures of RSA's entanglement with the NSA already had shocked some in the close-knit world of computer security experts. The company had a long history of championing privacy and security, and it played a leading role in blocking a 1990s effort by the NSA to require a special chip to enable spying on a wide range of computer and communications products.
RSA, now a subsidiary of computer storage giant EMC Corp, urged customers to stop using the NSA formula after the Snowden disclosures revealed its weakness.
RSA and EMC declined to answer questions for this story, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."

STORIED HISTORY
Started by MIT professors in the 1970s and led for years by ex-Marine Jim Bidzos, RSA and its core algorithm were both named for the last initials of the three founders, who revolutionized cryptography. Little known to the public, RSA's encryption tools have been licensed by most large technology companies, which in turn use them to protect computers used by hundreds of millions of people.
At the core of RSA's products was a technology known as public key cryptography. Instead of using the same key for encoding and then decoding a message, there are two keys related to each other mathematically. The first, publicly available key is used to encode a message for someone, who then uses a second, private key to reveal it.
From RSA's earliest days, the U.S. intelligence establishment worried it would not be able to crack well-engineered public key cryptography. Martin Hellman, a former Stanford researcher who led the team that first invented the technique, said NSA experts tried to talk him and others into believing that the keys did not have to be as large as they planned.
The stakes rose when more technology companies adopted RSA's methods and Internet use began to soar. The Clinton administration embraced the Clipper Chip, envisioned as a mandatory component in phones and computers to enable officials to overcome encryption with a warrant.

RSA led a fierce public campaign against the effort, distributing posters with a foundering sailing ship and the words "Sink Clipper!"
A key argument against the chip was that overseas buyers would shun U.S. technology products if they were ready-made for spying. Some companies say that is just what has happened in the wake of the Snowden disclosures.
The White House abandoned the Clipper Chip and instead relied on export controls to prevent the best cryptography from crossing U.S. borders. RSA once again rallied the industry, and it set up an Australian division that could ship what it wanted.
"We became the tip of the spear, so to speak, in this fight against government efforts," Bidzos recalled in an oral history.

Read More

Will A Computer Decide Whether You Get Your Next Job?

In an effort to hire better job candidates, some companies are replacing paper resumes with tests designed to collect big data from job applicants. (AP)

Xerox runs 175 call centers around the world. In all, the centers employ more than 50,000 customer service agents who deal with questions about everything from cellphone bills to health insurance.

Teri Morse, who is in charge of recruiting all those people, says the company had a problem: It was hiring people who just weren't a good fit.

"People were in the training classes sharing with us that they weren't right for the position," she says. "You have to deal with a frustrated customer, hang up the phone and move on to the next, and not have to excuse yourself to go to the ladies' room and cry."

So a couple of years ago, Xerox hired a company to help the company do a better job of finding the right people

This company, called Evolv, began collecting lots of data about the people applying for jobs at Xerox call centers.

The applicants had to answer extensive surveys with questions like: "Which word better characterizes you: 'consistent' or 'witty'?"

Another question: "Can you name three pieces of computer hardware?"
Applicants were tested on pattern recognition and multitasking. They had to respond to a challenging customer service call.

Some of these people got hired. Not all of them were a good fit for the job. But the data gave the company a sense of which characteristics predicted that hires would be a good fit — and which didn't. Prior experience in a call center, for instance, didn't really matter.

A retail background was a predictor of success — except for people who worked as cashiers or in restaurants. Those people tended to do worse at the call centers.

The applicants had to answer extensive surveys with questions like: "Which word better characterizes you: 'consistent' or 'witty'?"

Another question: "Can you name three pieces of computer hardware?"

Applicants were tested on pattern recognition and multitasking. They had to respond to a challenging customer service call.

Some of these people got hired. Not all of them were a good fit for the job. But the data gave the company a sense of which characteristics predicted that hires would be a good fit — and which didn't. Prior experience in a call center, for instance, didn't really matter.

 A retail background was a predictor of success — except for people who worked as cashiers or in restaurants. Those people tended to do worse at the call centers.
With these new techniques, Xerox says it has been able to improve its hiring and significantly reduce turnover at its call centers.

Other companies that parse employee data are finding surprising results. Michael Rosenbaum of Pegged Software, a company that works with hospitals, says one piece of conventional wisdom is flat-out wrong: "We find zero statistically significant correlation between a college degree or a master's degree and success as a software developer."

Of course, using data to drive hiring decisions has its problems. Employers guided by data could wind up skipping over promising candidates. But Barbara Marder of the consulting firm Mercer points out that the way companies hire now has its own flaws. We like to hire people who are like us. People who went to schools we know. People who were referred to us by our friends.

"A lot of these new techniques do have the potential to eliminate biases," Marder says.

Read More

Major computer security firm RSA took $10 mln from NSA to weaken encryption - report

RSA SecureID electronic keys

The National Security Agency arranged a clandestine US$10 million contract with computer security power RSA that allowed the spy agency to embed encryption software it could use to infiltrate the company’s widely used products, Reuters reported.

Revelations provided by former NSA contractor Edward Snowden and first reported in September showed that the NSA created and perpetuated a corruptible formula that was ultimately a “back door” into encryption products.

Reuters later reported RSA became the lead distributor of the formula, installing it into a software tool known as BSAFE that is widely used to boost security in personal computers and other products.

Unknown then was the $10 million deal that set the NSA’s formula as the default method for the security measure - in which random numbers are generated on a key for access to a product - in BSAFE, according to Reuters’ sources. Though the sum of money for the deal seems low, it represented over a third of revenue the relevant division at RSA had made the previous year, according to security filings.

RSA was previously known for its crusading fights to protect computer security and privacy in the face of government interests, as it played a major role in blocking an effort by the NSA in the 1990s to require a special chip that would have enabled surveillance on many computer and communication products.

Following the September disclosure, RSA, now a subsidiary of computer storage company EMC Corp, privately warned thousands of its customers to immediately discontinue using all versions of company's BSAFE toolkit and Data Protection Manager (DPM), both using Dual_EC_DRNG (Dual Elliptic Curve Deterministic Random Bit Generator) encryption algorithm to protect sensitive data.

RSA and EMC would not comment to Reuters about the alleged deal, but RSA said in a statement: "RSA always acts in the best interest of its customers and under no circumstances does RSA design or enable any back doors in our products. Decisions about the features and functionality of RSA products are our own."

The NSA declined to comment.

Most of the dozen current and former RSA employees interviewed by Reuters cited the company’s move away from strictly providing cryptography products as a reason the ill-advised deal was made. Though several also said government officials deceived RSA by portraying the corrupt formula as secure.

"They did not show their true hand," said one source that knew of the NSA deal.

RSA’s advocacy for security

RSA’s history as pioneers of trusted cryptography goes back to the 1970s. Their encryption tools have been licensed by many major technology companies, which have used RSA products to secure hundreds of millions of personal computers around the world. Their core technology - public key cryptography - uses two keys rather than one to publicly encode messages, then privately reveal them.

Even in the earliest days of RSA’s existence, it quarreled with US intelligence entities that worried the dual-key format would block government access. As RSA’s products became more widespread, the contention rose. In the 1990s, the Clinton administration pushed the Clipper Chip, a mandatory piece of hardware in phones and computers that would have enabled officials to supersede encryption without a warrant. RSA led a campaign to block the Clipper Chip, arguing products so easily surveilled would cripple overseas sales of US tech products.

The White House then moved to advocating stronger export controls to keep top cryptography in the US, yet RSA again persuaded the industry to oppose the effort. The export restrictions were eventually discarded.

A new era 

ut the attacks of September 11, 2001, flipped some of the power dynamics. In addition, many top engineers of the old fights against the government left the company, and BSAFE was becoming an increasingly smaller share of the company’s revenue.

"When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, an top RSA engineer before he left in 2005. "It became a very different company later on."

By 2006, RSA was considered a prime government partner in the fight against overseas hackers.

New RSA Chief Executive Art Coviello, who declined an interview request with Reuters, signed on to adopt an algorithm called Dual Elliptic Curve - designed by the NSA - even before the formula was approved for government use. RSA’s use of the algorithm actually helped the NSA win approval with the National Institutes of Standards and Technology, which oversees government tech product usage.

RSA’s contract made Dual Elliptic Curve the default formula for producing random numbers in the company’s encryption tools. Former employees said given company business leaders approved the deal rather than technologists, no alarms were raised.

"The labs group had played a very intricate role at BSAFE, and they were basically gone," said labs veteran Michael Wenocur, who left RSA in 1999.

Though it privately urged customers to stop using the Dual Elliptic Curve following the September revelations, RSA has been publicly quiet about its relationship with the NSA.

The RSA deal again implicates a key strategy the NSA employs for enhanced surveillance, as shown by Snowden’s leaked documents: the weakening of security tools as a result of the agency’s “commercial relationships” with security and tech companies.

A review board established by the White House to investigate the NSA’s controversial surveillance operations said this week it believes the NSA should make changes to spying protocol, including measures that have usurped cryptography. 

Among the recommendations, the panel called for the US government to "fully support and not undermine efforts to create encryption standards," and "not in any way subvert, undermine, weaken or make vulnerable generally available commercial software."

 

 

Read More

Tech tools: Dell UltraSharp Ultra HD monitors

Dell has taken a leap into the future with a new 4K monitor that delivers four times the resolution of a regular Full HD computer screen.

With 4K televisions being touted around for ridiculous money, the idea of a 4K computer monitor may not be such as alien one.

There are two sizes – 32in and 24in – with a 28in version on the way. The monitors offer colour reproduction and high definition graphics that you won’t match with your regular HD screen.

While the current price tag of $1,399 for the 24in version may be a little pricey, the upcoming 28in version is expected to sell for under $1,000.
Dell.com

Read More

Rein in Your Creativity: 5 Productivity Tools for Designers

Creativity can be a blessing and a curse, depending on how you manage it. Very often individuals working in creative fields come up with spectacular ideas, but don't have the discipline or tools to implement them. Productivity relies on finding simple methods to complete tasks. Here are some of the best tools for designers to help reach their creative potential:

PrtScr

When working with a group of designers, it's handy to have a tool that can simplify the screen shot process. PrtScr is one of those helpful screen capture and annotation tools and its stylish interface and user-friendly function sets them apart from the competition.  PrtScr has a variety of functions aiding the capturing process, allowing you to make captions and scale images. Plus, this productivity tool is free!

Pomodairo

If a lack of time management is your downfall, Pomodairo will be your saving grace. 

Pomodairo is a timer and task management tool based on the Pomodoro timing method similar to that of a cooking timer. The app serves as a Pomodoro timer set with 25 minute productivity intervals. You can choose whether you want the tell-tale "tick tock" sound or just an alarm after 25 minutes.

This tool helps you to identify interruptions during your working intervals influencing your productivity so that you could take these factors into consideration when planning your daily tasks. This application also allows for short breaks in between these works session. Use Pomodairo for your design project by dividing your tasks into small sessions of 25 minutes each.

InvisionApp

Design is nothing without sharing your skills and expertise. Invisionapp gives you the chance to share mockups and demos through their various design phases with your fellow designers or colleagues. The Invision App is a next generation creative sharing tool where you could even link up sketches, wireframes and innovative designs.

This is ideal for designers trying to juggle various tasks at once and keep track of all the changes and developments made.

Evernote

Evernote can really boost your productivity if you know how to make the most of this application. One of the worst habits of creatives is getting lost in the information overload of their craft. Instead of focusing on the task at hand, they browse through tutorials, websites, articles and watch videos as a part of their procrastination. 

Evernote will help eliminate the temptation of having to read every article and follow every link by "saving it for later."

Evernote allows you to save pieces of inspiration by labeling them with particular tags. By installing the Evernote to your toolbar you will be able to 'bookmark' these pages, snippets or URLs by clicking the Evernote elephant icon. Bring some structure to your chaos by using Evernote as your online journal.

CC Cleaner

CC Cleaner  cleans up all the cluster and junk that accumulates on your PC. Through this clean-up service your will be able to be more productive purely because your computer will be smoother and faster once it's "clean" and organized.

Being a master of your craft can be tricky. Make use of these web applications and tools to simplify your work methods and keep you on track.

Read More

Drag-and-Drop Programming Tool Alice Updated

The developers of Alice have introduced a new version of their free drag-and-drop development tool as well as an online tutorial to help young students learn how to perform object-oriented programming.

Created at Carnegie Mellon University, Alice is a 3D programming environment that lets the user create animations and simple video games. The new version, Alice 2.4, is intended for students in lower grades; another edition, Alice 3.1, is primarily geared to learners in higher grade levels and universities.

The new version was released to coincide with this month's international "Hour of Code," which ran Dec. 9 through 15 during Computer Science Education Week. That event is intended to introduce students as young as 6 to the basic concepts of computer science, demystify code, and show kids that they can become developers. The initiative is backed by multiple online self-guided tutorials that can be run on a browser, tablet or smartphone or used "unplugged" in classrooms without computers.

The Alice project has contributed an Hour of Code tutorial specifically using the new version. In the lesson, students learn how to set up scenes using characters and props and write program code for creating the animation of the characters within the scene.

The new version of Alice includes multiple feature tweaks and bug fixes, but the biggest change is the addition of characters from the Garfield comic strip, which can be used within the programs created by the students.

Wanda Dann, director of the Alice Project, said Alice is used in more than 15 percent of colleges and universities and has become a "popular teaching tool" in secondary schools. She said she expects the addition of Garfield, which appears in 2,100 newspapers around the world, to extend that reach to new students.

At the K-12 level Alice has been used by teachers at The Potomac School in McLean, VA and Desert Academy in Santa Fe, NM, among others.

Read More

A New Drawing Tool For Architects In A Digital Age

Morpholio Trace 2.0 gives architects a robust digital drawing platform, complete with canary yellow trace.

That depends, of course, on one’s definition of drawing. Does one, like Michael Graves who eulogized the state of the medium last year in an op-ed for the New York Times, define it as a kind of visual thinking, whereby thought is directly (and according to some, mystically) fused to the movements of the hand? For Graves and others, it's this intimate connection that is remorelessly severed by the imposition of the computer. Many disagree. Some see drawing is no longer integral to architectural design; or at least, it's once primary role is now secondary to digital platforms. Still, others think that drawing can be encompassed by the digital processes that have and continue to redefine the architectural profession.

 

All of which is to say, can an architect using a computer ever produce something akin to a napkin sketch? Morpholio Trace tackles this question head on. The Trace app, which debuted in Fall 2012, aimed to preserve the aura of drawing while helping the medium to make the digital leap it ostensibly needed. It did this by cleverly tapping into architects’ complicated love/hate relationship with drawing. Rather than present drawing as a rarified exercise thrust on architects and students, Trace folds it into their digital skillset. Users can draw directly on their tablets using "sheets" of canary yellow trace, then save and export their drawings to their work computer. Trace 2.0, which releases tomorrow, improves on its predecessor while straining to deepen the core Trace experience. 

 

Much of the new Trace is geared to recreating the tangible effects of drawing, the kinds of things that send Graves or Juhani Pallasmaa into excited praise or quiet rumination. “There’s nothing more intuitive than picking up a writing instrument or throwing on another sheet of trace paper,” says Mark Collins, one-fourth of the Morpholio team. The task with Trace, he explains, lay in translating that “intuitive” operability to the world of the app. But how exactly does architectural drawing, or more accurately, sketching benefit from this translation? For Collins, the digital environment’s inherent connectivity to social media networks can only be advantageous. Whereas a studio critique is a very isolated, exclusive event, a single Trace sketch can generate all manner of critical feedback and input from colleagues or fellow students. The trick, Collins adds, is to “seamlessly integrate those possibilities without burdening the designer with the abstraction that makes it all possible.”

 

The latest iteration of the app delivers a slew of updates that streamline the Trace platform. While the previous version allowed users to add up to eight layers of trace, one on top of the other, they could not access the layers that quickly became buried. Trace 2.0 allows users to manage layers and edit them with ease. Additionally, the team have added new tools such as zoom and pan, along with editing features like colors and line types.

 

The most conspicuous addition, however, are the twelve trace filters that, much like Instagram, apply an effect directly on top of the sketch or image. Several of the filters are takes on hand-drawn processes, like crosshatch and poche, as well as drawing instruments, from ink and marker presets to even grease pencil. These replicate the material qualities and unintentional side effects generated by hand drawing that critics say get lost in the medium’s digitalization. Meanwhile, effects like ‘Tile,’ which renders an image in 8-bit square tiles, play up the diagrammatic side of architectural sketching.

 

The new features enrich the interface Trace 1.0 introduced. At the same time, the improvements are part of a much more ambitious goal. As Morpholio co-creator Jeff Kenoff says, the Morpholio team conceived of Traces as a way to reclaim sketching for a new generation of architects. Ironically, drawing must be reclaimed from the computer itself—or, as Kenoff specifies, the desktop computer—which “hijacked [it] from the design process for years as it removed your hand from the actual line by forcing sketching with a mouse.”

Architects seem to be responding to Morpholio's message. Since its founding, the project, which began as a portable portfolio-cum-social media platform, has grown rapidly, and the Morpholio team expects its user count to surpass 1 million in 2015. According to Kenoff, Trace has been integral to that growth. Who says architect's don't draw?

Read More