NSA Crypto Revelations: 7 Issues To Watch

The Syrian Electronic Army: 9 Things We Know

What do the latest National Security Agency (NSA) leaks portend for privacy, the future of cryptography and people's use of encryption, as well as foreign businesses' trust of American-made technology hardware and software?

Documents leaked by NSA whistleblower Edward Snowden, and detailed Friday by the Guardian, The New York Times and ProPublica, have revealed an NSA decryption program, codenamed Bullrun, that has the ability to hack such protocols as HTTPS, VoIP and Secure Sockets Layer. SSL is used to protect today's sensitive Web transactions, including online banking and e-commerce.

"Project Bullrun deals with NSA's abilities to defeat the encryption used in specific network communication technologies," said a leaked NSA document. Leaked documents also revealed that the NSA has modified some commercial encryption products "to make them exploitable" and worked with "industry partners" -- meaning, U.S. technology firms -- to add known exploits or back door access to their software and hardware.

[ How badly will U.S. be hit by eroded international trust? Read NSA's Prism Could Cost U.S. Cloud Companies $45 Billion. ]

In the wake of the Bullrun leak, information security and cryptography experts are sounding off on the biggest resulting security repercussions, as well as questions that remain unanswered:

1. Back Doors Could Be Abused By Others.

The most recently published leaks suggest that the NSA has built back doors into well-known technology products including CryptoAG, Lotus Notes, and possibly Windows, and purposefully weakened encryption standards. "It's probably just a coincidence that Intel has a crypto random number generator called Bull Mountain," tweeted Jeffrey Carr, CEO of network defense firm Taia Global, referring to Intel's random number generator Bull Mountain, which of course bears a passing resemblance to the name of the NSA's Bullrun decryption program.

But what's to stop foreign intelligence agencies, criminal gangs or unscrupulous business rivals from finding and tapping the product back doors or cryptographic weaknesses designed by the NSA? In fact, Pro Publica, which bills itself as a "non-profit newsroom," said that it had chosen to publish the recent information on the NSA's capabilities precisely because of such questions.

"The potential for abuse of such extraordinary capabilities for surveillance, including for political purposes, is considerable," it said. "The government insists it has put in place checks and balances to limit misuses of this technology. But the question of whether they are effective is far from resolved and is an issue that can only be debated by the people and their elected representatives if the basic facts are revealed."

2. Press Reports Omitted Crucial Details.

None of last week's press reports included details from the leaked documents pertaining to precisely which products the NSA might have had back doors added, or which encryption algorithms the agency might have weakened. "I wish we knew more, there isn't enough detail in what's been released to really pin down what we're dealing with," said security researcher and encryption expert Adam Caudill via email. "We know the NSA has attacks -- we just don't know on what, specifically. Most of the things mentioned are systems with many components, not just single algorithms. Without knowing what algorithms, we are left to guess, and speculation can be dangerous."

3. NSA Documents Suggest Crypto Really Works.

Despite the NSA's capabilities, it isn't omniscient or "magical," and in fact faces some real-world encryption challenges, said Bruce Schneier, chief security technology officer of BT, writing in Friday's Guardian. Schneier revealed that for the past two weeks, he's been helping the Guardian review hundreds of top-secret NSA documents that were leaked by whistleblower Edward Snowden.

"How do you communicate securely against such an adversary?" said Schneier. "Snowden said it in an online Q&A soon after he made his first document public: 'Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on.'"

"The crypto is good. It's one of the few things we can rely on," echoed Jon Callas, CTO of Silent Circle and previously a co-founder of PGP, via email. "Snowden said that himself. It's the rest of the systems that need careful examination."

Some of the NSA's most recently revealed operating techniques likewise suggest that encryption still provides protection. "I am sure we'd all like to know more technical details about the weaknesses in the widely deployed ciphers and other algorithms, if there are any and especially if they are serious," said encryption expert Ivan Ristic, director of engineering at Qualys, via email. "But, actually, I don't think that's what is really important. First, we now understand the extent at which the NSA is working to bypass encryption, rather than attack it. I think that's very telling; we can conclude that encryption -- if implemented properly -- works as designed." 4. Networks Are More Vulnerable Than Endpoints.

Another takeaway from the recent NSA revelations is that some types of eavesdropping employed by the agency require proportionally greater resources, and are thus less likely to be used on a regular basis. "The primary way the NSA eavesdrops on Internet communications is in the network. That's where their capabilities best scale. They have invested in enormous programs to automatically collect and analyze network traffic," said Schneier. "Anything that requires them to attack individual endpoint computers is significantly more costly and risky for them, and they will do those things carefully and sparingly."

As that suggests, network infrastructure remains an especial weak point. "The NSA also attacks network devices directly: routers, switches, firewalls, etc. Most of these devices have surveillance capabilities already built in; the trick is to surreptitiously turn them on," said Schneier. "This is an especially fruitful avenue of attack; routers are updated less frequently, tend not to have security software installed on them, and are generally ignored as a vulnerability."

5. Embrace Well-Vetted Open-Source Tools.

People can protect themselves against casual NSA surveillance, but it's going to require more work. "I still believe that those that are willing to put some effort into maintaining their privacy can, though the level of effort has certainly increased over what I thought it was," Caudill said. "Precautions that I would have called paranoid and excessive today seem reasonable. Not everything can be hidden, of course, and especially not if you are singled out -- but there are still ways to protect yourself -- at least I hope that's true."

One strategy for defending against the NSA's digital dragnet is to tap well-regarded -- and thoroughly reviewed -- open source tools. "Clearly, this is a big affirmation of the importance of open source, and openness in general," said Qualys' Ristic. "Who's going to want to rely on proprietary software in the future? That would make no sense, given that government agencies are going to keep on doing what they were always been doing."

Furthermore, many security experts believe that open-source tools will provide people with their most reliable source of an application they can trust that implements an encryption algorithm that's known to be tough or impossible to break.

6. Complete NSA Resistance Is Futile.

But there's a caveat to that advice: the NSA can still eavesdrop on high-value targets, no matter what they do. Indeed, Schneier said that the NSA's TAO – Tailored Access Operations – group, which is charged with hacking into endpoints, has an array of tools which are almost impossible, even for trained security professionals, to find. "Your antivirus software won't detect them, and you'd have trouble finding them even if you knew where to look. These are hacker tools designed by hackers with an essentially unlimited budget," said Schneier. "What I took away from reading the Snowden documents was that if the NSA wants in to your computer, it's in. Period."

7. Foreign Businesses Will Think Twice About U.S. Goods, Cloud.

Will reports that the NSA has added back doors to equipment and software sold by U.S. technology firms lead businesses in other countries to avoid buying from American manufacturers? "I think it'll have a detrimental effect on both foreign and U.S. businesses when considering using U.S. products and services that may have been compromised by the NSA," said Taia Global's Carr via email.

Callas echoed that assessment, saying that the revelations would "undoubtedly" have an effect. Then again, the NSA isn't the only intelligence agency in the world, and when it comes to building back doors into commercial equipment, "we know that other countries are doing it, too," he said.

As a result, Ristic predicts all security vendors will face some bigger questions from their customers, as well as a push for carefully vetted open-source alternatives. "This is a big blow to the security industry, the cloud, and the IT industry in general; especially for the companies headquartered in the U.S.," he said. "Nothing's going to change over night, but we should expect to see big movement of data and services in the following months and years."