Snowden Used the Linux Distro Designed For Internet Anonymity 171
Hugh Pickens DOT Com writes: "When Edward Snowden first emailed Glenn Greenwald, he insisted on using email encryption software called PGP for all communications. Now Klint Finley reports that Snowden also used The Amnesic Incognito Live System (Tails) to keep his communications out of the NSA's prying eyes. Tails is a kind of computer-in-a-box using a version of the Linux operating system optimized for anonymity that you install on a DVD or USB drive, boot your computer from and you're pretty close to anonymous on the internet. 'Snowden, Greenwald and their collaborator, documentary film maker Laura Poitras, used it because, by design, Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'
The developers of Tails are, appropriately, anonymous. They're protecting their identities, in part, to help protect the code from government interference. 'The NSA has been pressuring free software projects and developers in various ways,' the group says. But since we don't know who wrote Tails, how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it's bad for the NSA, it's safe to say it's good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. 'With Tails,' say the distro developers, 'we provide a tongue and a pen protected by state-of-the-art cryptography to guarantee basic human rights and allow journalists worldwide to work and communicate freely and without fear of reprisal.'"
The developers of Tails are, appropriately, anonymous. They're protecting their identities, in part, to help protect the code from government interference. 'The NSA has been pressuring free software projects and developers in various ways,' the group says. But since we don't know who wrote Tails, how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it's bad for the NSA, it's safe to say it's good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. 'With Tails,' say the distro developers, 'we provide a tongue and a pen protected by state-of-the-art cryptography to guarantee basic human rights and allow journalists worldwide to work and communicate freely and without fear of reprisal.'"
Cue NSA infilatration in 3...2.... (Score:5, Interesting)
May want to keep an eye out in the development community of the OS for a sudden influx of programmers "just wanting to help out." Or existing members suddenly driving new sports cars and acting strange.
Almost (Score:5, Interesting)
Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'
Traffic sniffing does not require files on the target and this is the biggest source of data for agencies like the NSA. It may protect you from key loggers being installed (unless they were inserted ahead of time).
I'm pretty sure that part of Snowden's leaked information showed that exploits are occurring at the hardware level as well as software. Entry points like LOM modules were explicitly called out in the leaked presentations.
I'd agree that forensics becomes extremely difficult, if not impossible (memory analysis can still occur). I don't agree that the systems are immune to malicious software at least in a general sense. Immunity would require a lot of control for the hardware running the OS, and monitoring to make sure things have not been tampered with. Relying on a repository build of an OS imaged is still a target for potential a MITM attack feeding a user a kitted image.
It's all good in my opinion, I'm just being picky about the terminology chosen. Immunity implies absolute safety, and very little in the world is absolute.
The Distant Future, Considered (Score:4, Interesting)
how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide
And that, ladies and gentleman, is how you play the Really Long Game.
Re:The NSA is becoming a new God for "True Believe (Score:5, Interesting)
Well, personally my first thought after reading the summary was "but how do you trust the BIOS?" A few years ago I'd have immediately said that's conspiracy theory and dismissed it (along with the other items you listed). But after a year of exposure to the Snowden and RSA revelations and everything else, it pains me to say these NSA questions aren't so far fetched any more.
Sure they may not be probable but they could be possible. No matter how rational you think you are, it really messes with one's mind. Subtle paranoia, if you will.
Re:Almost (Score:5, Interesting)
Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'
Traffic sniffing does not require files on the target and this is the biggest source of data for agencies like the NSA. It may protect you from key loggers being installed (unless they were inserted ahead of time).
All traffic sniffing will do is show they are talking to a TOR entree node. Everything is wrapped in multiple layeres of encryption between you and each of the nodes in between. Maybe they could tell from traffic analysis what type of traffic it is based on traffic profiling, streaming your pr0n over to will have a different profile than browseing a webpage wich will in tun be different than ssh, but they still won't know the end point and what the content is.
I'm pretty sure that part of Snowden's leaked information showed that exploits are occurring at the hardware level as well as software. Entry points like LOM modules were explicitly called out in the leaked presentations.
Yes but they would have to have had access to your computer to insert the hardware bugs. If you say pick up a cheap laptop at walmart paid for with cash they won't know who has it, and would not have inserted the bugs as they could not have known who would end up wih the computer.
I'd agree that forensics becomes extremely difficult, if not impossible (memory analysis can still occur).
if they are doing memory analysis thy have the computer in their posesion already and you probably have a much larger issues to worry over.
I don't agree that the systems are immune to malicious software at least in a general sense. Immunity would require a lot of control for the hardware running the OS, and monitoring to make sure things have not been tampered with.
Technically true. However you have to trust something, and as long as there has been know oppertunity to tamper with the computer you can assume your safe for most things.
Relying on a repository build of an OS imaged is still a target for potential a MITM attack feeding a user a kitted image.
That is why we have cryptographic signatures on repositories and iso images. If they can break a 4092 bit key in polynomial time we are f***ed anyway
Re:NSA boogeyman (Score:3, Interesting)
Really? There haven't been enough scandals yet?
- pressure to backdoor linux - http://www.itworld.com/open-source/383628/linus-father-confirms-nsa-attempt-backdoor-linux
- NSA/GCHQ have power points about trying to attack TOR exit nodes including with DOS attacks
- they hack sys admins
- they are suspected of introducing bugs into code bases (anonymous commit to the linux kernel which had a = instead of == allowing remote code exploit)
- they are known to have inserted hardware backdoors into US chips - most probably Intel and Via.
- they used NIST to cripple encryption and random number generation standards. (They fixed the s-boxes in DES, but they reduced the key length from 64 bits to 54 bits. They lobbied to reduce the number of passes in current crypto systems. The Dual_EC_DRBG is the backdoored random number standard they forced though.)
- They paid $10 million to RSA to set the default to this bad random number generation standard.
- They use porn browsing habits and other information they collect to discredit people they don't like - this includes Americans.
- They launch DoS attack against people they don't like. This includes people in anonymous and file shares using pirate bay. Anyone happening to use the same public IRC servers suffer too.
- They launch "false flag" operations - meaning they do something evil, blame someone else, and use that as an excuse to do the thing they originally wanted to do but couldn't (the equivalent of shooting your own troops, blaming the enemy, and launching a "counter attack").
- Joe Nachio former CEO of Qwest, was invited to Fort Meade and asked to do something blatantly illegal to which he said no. As a result, he lost the government contracts he expected to get, and the government arrested him for insider trading. He served 6 years in prison after being denied the right to defend himself because the programs in question were classified. (And you wonder why other telcos go along with the NSA's "requests")
- Lavabit (secure email provider) was strong armed into closing after they received an NSL to spy on Snowden's email. The form of the NSL required that ALL lavabit customers would be spied on.
These are just off the top of my head! How many demonstrations of evil do you need from those bastards? They are completely out of control.
Re:Tails is awesome (Score:4, Interesting)
Jesus -- I haven't done acid since my college days a quarter century ago. You should lay off it.
Big Lie -- you're whole post is this. You try to take on the mantle of a freedom loving defender of American virtue, when the fucking straight fact is, you are the biggest NSA shill there is, and the NSA is one of the biggest threats to the US Constitution in the entire world. We also have other Executive branch things that are pretty fucking bad, but the NSA is anti-constitution, thus anti-American, and your support for the NSA makes YOU anti-American.