Page 1,142«..1020..1,1411,1421,1431,144..1,1501,160..»

Now Apple takes a bite out of encryption-bypassing ‘spy clause’ in UK internet law – The Register

July 1, 2023 | Author: admin

Apple has joined the rapidly growing chorus of tech organizations calling on British lawmakers to revise the nation's Online Safety Bill which for now is in the hands of the House of Lords so that it safeguards strong end-to-end encryption.

"End-to-end encryption is a critical capability that protects the privacy of journalists, human rights activists, and diplomats," Apple argued in a statement to the media.

"It also helps everyday citizens defend themselves from surveillance, identity theft, fraud, and data breaches. The Online Safety Bill poses a serious threat to this protection, and could put UK citizens at greater risk."

Apple, you may remember, announced in December 2022 that it will provide end-to-end encryption (E2EE) for most iCloud services.

"Apple urges the government to amend the bill to protect strong end-to-end encryption for the benefit of all," the iGiant's statement on the internet bill continued.

The iGiant declined to address The Register's specific inquiries about what, if anything, the American titan will do should Parliament adopt the bill.

As the draft law is currently written, the UK's communications watchdog Ofcom will have the power to instruct chat app makers and other tech companies to monitor conversations and posts for child sexual abuse material and terrorism content. Such data should be blocked or deleted when found, and potentially even reported to the cops, the government hopes.

If that doesn't lead to apps watering down or backdooring their E2EE so that data can be inspected in transit, it may bring about automated on-device scanning, which could end up censoring people's private chats or leaking them to the authorities whether illegal activity was correctly or incorrectly detected. Such technology would be government-accredited, which means the app makers may have little choice over its eventual implementation.

Under that regime, an app or platform can't really say it offers truly strong E2EE on all messages if there's a chance those messages can be silently inspected by someone or some system outside the private conversation. There's a concern this all starts with tackling child abuse and terrorists something with which the population won't generally have a problem but will later lead to broader surveillance and censorship. It smacks of a government fed up with not being able to peer into private chatter whenever it feels necessary.

The Open Rights Group has a paper on the proposals here [PDF] if you want to read more about it. "According to an expert legal opinion, this bill would create the power to mandate some of broadest surveillance powers in any Western democracy," the body wrote in that document.

In February, encrypted chat service Signal said it will stop operating in the UK if the British government goes ahead with its Online Safety Bill as it stands.

And in April, other E2EE comms platforms Element, Session, Threema, Viber, WhatsApp, and Wire urged UK lawmakers to rethink the bill instead of "weakening encryption, undermining privacy, and introducing the mass surveillance of people's private communications."

Wikipedia, meanwhile, has called out another piece of the proposal that would require verification of visitors' ages, and said if the Online Safety Bill passes with the age-gating requirement, its site may no longer be available in the UK.

The controversial draft law, which the government claims will make the UK "the safest place in the world to be online," continues to face backlash because of its so-called "spy clause" [PDF].

This provision requires companies to intercept and block child sexual exploitation and abuse (CSEA) material and terror content "whether communicated publicly or privately." That means encryption applied to messages and anything else shared must be bypassed to allow scanning or scanning must occur prior to encryption or after decryption.

Those in favor of this E2EE workaround, as always, say it's to protect the children as Meta recently found out when an international group of law enforcement agencies urged the social media giant not to standardize strong E2EE on Facebook Messenger and Instagram. E2EE, according to the Virtual Global Taskforce, willprevent cops from fighting wait for it CSEA.

Apple is no stranger to this argument. In 2021, the fruiterer floated a plan to scan photos on people's iPhones for CSEA automatically as they uploaded stuff to iCloud.

The information security community and civil rights groups strongly opposed turning punters' own devices against them, and Apple ultimately ditched the plan. Instead it deployed communication safety tools in iOS 15.2.

Follow this link:
Now Apple takes a bite out of encryption-bypassing 'spy clause' in UK internet law - The Register

Read More..
Posted in Encryption | Leave a Comment

Encryption-less ransomware: Warning issued over emerging attack method for threat actors – ITPro

July 1, 2023 | Author: admin

Security researchers have issued a warning over the growing threat of encryption-less ransomware amid a period of evolving threats by sophisticated hacker groups.

Analysis from Zscaler revealed there has been a 40% increase in ransomware attacks over the last year and identified encryption-less ransomware techniques as one of the most noteworthy trends now observed among threat actors.

Across the year, 25 new ransomware families were identified using either double extortion or encryption-less techniques, highlighting the growing popularity of this method among cyber criminals.

In 2021, ThreatLabz observed 19 ransomware families that adopted double or multi-extortion approaches to their cyber attacks. This has since grown to 44 ransomware families observed, the firm said.

Encryption-less ransomware attacks originally began with groups like Babuk and SnapMC, Zscalers study said. However, researchers have observed a host of new groups adopting this method, including RansomHouse, BianLian, and Karakurt.

Encryption-less ransomware attacks differ in technique from traditional methods, whereby threat actors compromise an organization, encrypt data, and demand a ransom for its recovery on the threat of publicly releasing stolen data.

This technique, also known as extortion-only attacks, essentially skips over the process of encryption, Zscaler said, while still maintaining the tactic of threatening to leak victims data online if they dont pay.

In doing this, threat actors are able to skip a laborious part of the attack process - encryption - while still achieving the same overall results and often generating larger profits from an attack.

Developing effective encryptor payloads also requires a level of software engineering expertise that may dissuade cyber criminals from considering ransomware operations.

This tactic results in faster and larger profits for ransomware gangs by eliminating software development cycles and decryption support, Zscaler said.

Among the most prolific groups currently employing this attack method is BianLian, according to research from LogPoint.

Analysis of the hacker groups operations in recent months shows that it has pivoted away from double extortion methods due to the emergence of publicly available decryptor tools, such as those released by Avast.

Upon the public release of a decryptor from Avast in January 2023, the group resorted to an intensified extortion-only modus operandi, with no system encryption, the security firm said.

Other groups known to have employed an extortion-only model in recent years include LAPSUS$ and the infamous Cl0p ransomware outfit.

During the GoAnywhere breach, Cl0p deviated from its traditional double extortion tactic and opted for a pure extortion attack.

It was also observed employing the pure extortion method during the MOVEit breach earlier this month which is believed to have affected numerous other organizations in what is the second major supply chain attack of the year.

Deepen Desai, global CISO and head of security research at Zscaler, said the growing trend of encryption-less ransomware techniques is enabling threat actors to operate unseen and often with impunity.

Ransomware authors are increasingly staying under the radar by launching encryption-less attacks which involve large volumes of data exfiltration, he said.

Although victims are still severely impacted by these attacks and incur significant financial burdens, the technique is often harder to detect and receives less attention from authorities because they do not lock files and systems.

Similarly, this method results in less downtime for affected organizations faced with a lengthy recovery process.

This lesser rate of disruption means that victims are less likely to report incidents, Zscaler warned.

Encryption-less extortion attacks tend to not disrupt their victims business operations - which subsequently results in lower reporting rates.

See the rest here:
Encryption-less ransomware: Warning issued over emerging attack method for threat actors - ITPro

Read More..
Posted in Encryption | Leave a Comment

Signal talks privacy, encryption, AI and more at TechCrunch Disrupt 2023s Security Stage – TechCrunch

July 1, 2023 | Author: admin

In our tech-driven world, the right to privacy once the cornerstone of democracy is disappearing at an alarming rate. But not everyone is keen on having Big Tech companies and nation-states surveilling every digital communication. This may be one reason why Signal, the end-to-end encrypted messaging app, has been downloaded more than 100 million times to date.

Signal Foundation, the apps nonprofit developer, is a staunch defender of privacy and security. Indeed, it said it would leave the United Kingdom rather than weaken its encryption. The organizations principles based on retaining as little user data as possible are a real rarity in security.

This is why were thrilled that Meredith Whittaker, president of the Signal Foundation, will join us for a session called Signal and the Future of Encrypted Messaging. Youll find it on the Security Stage at TechCrunch Disrupt 2023, which takes place on September 1921 in San Francisco.

We cant wait to talk with Whittaker about what it takes to run one of the worlds most ubiquitous security startups. Well focus on Signal both the organization and the product and how its become trusted and widely seen as the gold standard of end-to-end encrypted messaging apps.

Can Signals stellar reputation spur other startups to follow a similar path? If not, how do we protect that data so it cant be stolen or misused? Well also circle back to how governments justify their attempts to backdoor encryption and why fighting to protect encryption, and thus privacy, is essential.

Well also discuss Whittakers take on the harmful social consequences of artificial intelligence. At a recent conference in San Francisco, Whittaker spoke about the way big corporations use AI to wield technological power, and how these huge datasets can be used to surveil populations, calling AI a surveillance technology.

Join us for whats sure to be a reality check from an acclaimed expert who understands the real-world issues of privacy, security and AI.

Learn more about our speaker and her extensive qualifications for tackling these challenging topics below.

Meredith Whittaker, president of Signal, has more than 17 years of tech experience across industry, academia and government. Before joining Signal, she was the Minderoo Research Professor at NYU and served as the faculty director of the AI Now Institute, which she co-founded.

Whittakers research and scholarly work helped shape global AI policy and shift the public narrative on AI to better recognize the surveillance business practices and the concentration of industrial resources that modern AI requires. Prior to NYU, she worked at Google for over a decade, where she led product and engineering teams and founded Googles Open Research Group. She also co-founded M-Lab, a globally distributed network measurement platform that now provides the worlds largest source of open data on internet performance.

Whittaker was one of the core organizers pushing back against Googles insufficient response to concerns about AI and its dangers, and she was a central organizer of the Google Walkout. Whittaker has advised the White House, the FCC, the city of New York, the European Parliament and many other governments and civil society organizations on privacy, security, artificial intelligence, internet policy and measurement. She recently completed a term as senior advisor on AI to the chair of the U.S. Federal Trade Commission.

Hear more conversations with leading experts on the Security Stage, which features topics like data protection, privacy regulations, information sharing, risk management and more. Its just one of the six new stages for six breakthrough sectors at Disrupt. Book your pass today!

Is your company interested in sponsoring or exhibiting at TechCrunch Disrupt 2023? Contact our sponsorship sales team by filling out this form.

Read more:
Signal talks privacy, encryption, AI and more at TechCrunch Disrupt 2023s Security Stage - TechCrunch

Read More..
Posted in Encryption | Leave a Comment

Cisco urges stop using weak crypto algorithms with OSPF – Network World

July 1, 2023 | Author: admin

To reduce the risk of service problems, Cisco is making it harder for organizations to use weak cryptographic algorithms when setting up authentication for OSPF packets on certain Catalyst Edge Platforms and Integrated Services Routers (ISR).

Newer versions of Ciscos IOS XE software (Release 17.11.1 and later) no longer support those algorithmsDES, 3DES, and MD5by default, Cisco stated in a field Notice.

Specifically, the algorithms are no longer default options for the open shortest path first v 3 (OSPFv3) protocol, which uses the IPsec secure socket API to add authentication to OSPFv3 packets that distribute routing information.

In order to continue to use such weak cryptographic encryption algorithms, explicit configuration is required, Cisco stated in a field Notice. Otherwise, OSPF neighborship will fail to establish and cause service disruption as a result.

These algorithms should be replaced with stronger algorithms, specifically Advanced Encryption StandardCipher Block Chaining (AES-CBC) for encryption and Service Hash Algorithm (SHA1 or SHA2) for authentication, Cisco stated.

Cisco says there is a workaround to the issue, but recommends against it.

Before customers upgrade the software to Cisco IOS XE Release 17.11.1 or later, update the OSPFv3 IPsec configuration to use strong cryptographic algorithms. However this command is only available in Cisco IOS XE Release 17.7.1 and later, and will only take effect after a reboot.

Cisco does NOT [emphasis Ciscos] recommend this option as these weak cryptographic algorithms are insecure and do not provide adequate protection from modern threats. This command should only be used as a last resort, the vendor stated.

Cisco recommends filing a Service Request if you have problems or questions.

IOS XE software runs on a wide variety of Cisco gear, but the notice applies only to the 1100 ISR, Catalyst 8000V Edge Software, and the Catalyst 8300, 9500, and 8500L Edge Platforms.

Follow this link:
Cisco urges stop using weak crypto algorithms with OSPF - Network World

Read More..
Posted in Encryption | Leave a Comment

Baltimore Police to encrypt radio transmissions and offer public access on 15-minute delay – Baltimore Sun

July 1, 2023 | Author: admin

Baltimores days of residents and reporters listening to live police radio traffic and monitoring developments in real-time are numbered.

Beginning Thursday, the Baltimore Police Department plans to encrypt its radio traffic and implement a 15-minute delay on live radio broadcasts available only on the Broadcastify platform, accessible online or via mobile app.

Old scanners will no longer pick up the police radio signal, officials said. Interested listeners instead must use Broadcastify, which comes at no cost to the department or to members of the public. A paid premium subscription to the site allows for access to archived radio footage.

Police officials said Thursday the move would enhance officer safety by preventing suspects from hearing strategies or monitoring the real-time activities of officers while also maintaining transparency for the public. Baltimore Police wont have access to alter or edit the radio transmission before it goes to Broadcastify.

But transparency and news media advocates worry it will present a barrier to the publics understanding of real-time events. Fifteen minutes doesnt sound like a long delay until its a critical incident or means no one left to interview at a scene, said Rebecca Snyder, the director of the Maryland-Delaware-DC Press Association.

Baltimore City spent time and effort becoming more accountable to the public, Snyder said. This is a step backward, saying, Well take care of it, dont you worry.

The Baltimore Police Departments move follows other large agencies across the country, including in Denver; Chicago; Washington, D.C.; Louisville, Kentucky; Nashville, Tennessee; Las Vegas, New Orleans and cities in California. Its also under consideration in New York City and Indianapolis.

Louisville Metro Police, like Baltimore Police, implemented a 15-minute delay last year, saying it would allow officers to keep scenes as safe as possible. Others have opted to encrypt the transmissions entirely, or to block them off to everyone except for some media outlets.

[Baltimore Police moving to encrypt scanner transmissions, keeping public from hearing calls]

Baltimore officials said they had discussed encrypting the radio broadcast altogether and giving trusted media partners a radio to listen live, but determined the best route was to ensure access to the transmissions for the entire public just on a delay.

Breaking News Alerts

As it happens

Be informed of breaking news as it happens and notified about other don't-miss content with our free news alerts.

This is the way we feel like we can strike a balance said Eric Melancon, Baltimore Polices deputy commissioner of the compliance bureau. Were ensuring were protecting our officers, ensuring that the radio transmissions are still accessible and transparent to the public. But again, doing it in a way thats much more modernized, and in a practice that matches other large jurisdictions.

Melancon said the department had consulted with the U.S. Department of Justice and the citys consent decree monitoring team. The city entered a consent decree with the Justice Department in 2017 to address unconstitutional policing practices identified in a 2016 report. The DOJ and monitoring team, he said, found the move was in alignment with the consent decrees goals of transparency.

All radio communications will be available on the 15-minute delay, with one exception: The departments Special Weapons and Tactics team, known as a SWAT team, will not be broadcast, officials said.

The timed encryption, police said, also will make communicating with other law enforcement agencies easier, since some partner agencies already have encrypted radio transmissions.

The move has led to pushback in other cities from transparency advocates, such as journalism groups. The Radio Television Digital News Association, a professional organization for broadcast and digital journalists, for example, has said the consequence of encryption is to prevent the public from accessing information about the activities of police in real-time.

These communications provide individuals and newsrooms with essential updates on issues happening in their communities, such as violent crime, hazardous conditions or officer-involved shootings, the organization said on its website. The move to encrypt police scanners puts the public and the newsrooms that serve them by seeking and reporting the truth at risk.

Snyder, too, said its important for transparency advocates to be vigilant and be sure the notion of encroaching on transparency in the name of safety doesnt become overused.

Read this article:
Baltimore Police to encrypt radio transmissions and offer public access on 15-minute delay - Baltimore Sun

Read More..
Posted in Encryption | Leave a Comment

Apple criticizes UK bill that could require scanning of encrypted messages – Ars Technica

July 1, 2023 | Author: admin

Getty Images | NurPhoto

Apple has joined the growing number of organizations opposed to the UK's pending Online Safety Bill, saying the proposed law threatens the end-to-end encryption that protects private messages.

"End-to-end encryption is a critical capability that protects the privacy of journalists, human rights activists, and diplomats," Apple said in a statement reported by the BBC yesterday. "It also helps everyday citizens defend themselves from surveillance, identity theft, fraud, and data breaches. The Online Safety Bill poses a serious threat to this protection, and could put UK citizens at greater risk. Apple urges the government to amend the bill to protect strong end-to-end encryption for the benefit of all."

The BBC quoted a government spokesperson as saying that "companies should only implement end-to-end encryption if they can simultaneously prevent abhorrent child sexual abuse on their platforms."

Though the bill isn't yet finalized, UK regulator Ofcom provided an update this month on how it is preparing for its expanded regulatory role, saying the bill is in "the final stages of the parliamentary process." The bill, which includes criminal penalties like imprisonment, was approved by the House of Commons in January and is nearing approval in the House of Lords.

The bill is expected to be changed, but it's not clear whether the changes will eliminate concerns about mandated scanning of encrypted messages. The BBC article on Apple's opposition to the bill said there is "a growing expectation... that changes may be made to part of the bill which critics say could be used to mandate scanning. These could be included in a package of amendments to be revealed in the coming days. But it is not clear what the detail of those changes might be, or if they will satisfy the concerns of campaigners."

Signal said it will stop providing services in the UK if it's forced to weaken the privacy of its encrypted messaging system. The Meta-owned WhatsApp also told the BBC last year that it would refuse to lower the security of its messaging service.

We contacted Apple about its stance on the UK bill today and will update this article if we get any further information.

Apple faced backlash from privacy advocates and security experts in 2021 when it announced a plan to scan iPhones for child sexual abuse images. Apple initially defended the plan but later abandoned it.

According to the privacy-focused Open Rights Group, the proposed law could make the UK "the first liberal democracy to require the routine scanning of people's private chat messages." However, the group said the bill could be improved with a small change.

"Removing the word 'privately' from the draft legislation could preserve the security and privacy of billions of messaging app users," the Open Rights Group said, referring to a requirement to identify illegal content in private messages.

The UK's proposed law focuses heavily on terrorism content and child sexual abuse content. The bill text says that Ofcom may issue notices to service providers requiring them to "use accredited technology to identify CSEA [child sexual exploitation and abuse] content, whether communicated publicly or privately by means of the service, and to swiftly take down that content."

Ofcom would be authorized to issue "information notices" requiring recipients to provide Ofcom with "any information that they require for the purpose of exercising, or deciding whether to exercise, any of their online safety functions."

A person or technology provider that receives a notice requiring information "commits an offence if, in response to an information notice, the person provides information which is encrypted such that it is not possible for Ofcom to understand it, or produces a document which is encrypted such that it is not possible for Ofcom to understand the information it contains," the bill says.

The Open Rights Group organized an open letter signed this week by "over 80 national and international civil society organizations, academics, and cyberexperts." It says the bill would require client-side scanning software that "intercepts chat messages before they are encrypted, and as the user is uploading their images or text."

The required "scanning software would have to be pre-installed on people's phones, without their permission or full awareness of the severe privacy and security implications," the letter said. "The underlying databases can be corrupted by hostile actors, meaning that individual phones would become vulnerable to attack." The letter further said the bill "would infringe the rights to privacy to the same extent for the Internet's majority of legitimate law-abiding users as it would for potential criminals."

Continued here:
Apple criticizes UK bill that could require scanning of encrypted messages - Ars Technica

Read More..
Posted in Encryption | Leave a Comment

Baltimore Police scanner will be encrypted, delayed starting in July – The Baltimore Banner

July 1, 2023 | Author: admin

Several years after the plan became public, the Baltimore Police Department is moving ahead with switching to encrypted radio systems and devices, delaying public access to live audio streams of police activity.

Starting July 6 at approximately 3 a.m., police officers will begin carrying two types of encrypted radios, according to an internal memo reviewed by The Banner. Baltimore City would become one of the first large jurisdictions in the state to delay communications to the general public by 15 minutes.

The department planned to upgrade to encrypted radio systems in 2019, according to an article in The Baltimore Sun, but it was not discussed publicly until it was disclosed the following year by a city councilman. The switch ended up being pushed back due to the COVID-19 pandemic.

At the time, Baltimore Police said they were following national best practices by encrypting radio channels, saying it would protect potential victims and witnesses, while also enhancing officer safety. At the time, police said they would also provide equipment to established media as we work to be transparent while balancing public safety and privacy.

The 15-minute delay will air through Broadcastify, an online platform that streams scanner radio communication, to modernize the police departments management of its radio communications, improve interoperability and enhance officer safety, according to BPD.

Broadcastify presents us with the opportunity to focus on officer safety, said Deputy Commissioner Eric Melancon. It also assists with interagency operability since many neighboring agencies are already under encryption.

Adam Jackson, CEO of Leaders of a Beautiful Struggle, a grassroots think tank that advances the public policy interests of Black people in Baltimore, said the BPD and other departments around the state are already not transparent enough when it comes to disclosing information, including public records.

The fact that they would choose this as an opportunity as a way to be more opaque is deeply concerning and against the police accountability legislation thats passed over the past couple of years, Jackson said. And so this is actually the opposite direction of where the police department says it wants to go.

Leaders of a Beautiful Struggle was part of the Maryland Coalition for Justice & Police Accountability that advocated to get Antons Law named for Anton Black, an unarmed Black teenager who was killed in a police encounter on the Eastern Shore in 2018 passed in 2021. It gives citizens greater access to police misconduct and personnel records.

Jackson said his organization has fought with BPD over civilian oversight and ensuring records of police misconduct are disclosed, and an encrypted scanner is a continuation of that battle.

The Police Department wants to continue to insulate itself from public criticism, he said. This is just an effort to make their processes less visible to the public and cant serve the greater good.

Sign Up for Alerts

Get notified of need-to-knowinfo from The Banner

Ok

Dan Shelley, president and CEO at the Radio Television Digital News Association, a professional organization for broadcast and digital journalists, said the use of encrypted scanners is becoming pervasive across the country.

Were in a position at the moment where its almost like playing whack-a-mole. As soon as we find out and try to work with local media and local public safety agencies to try to resolve issues surrounding the encryption of these dispatch communications, another pops up somewhere else, Shelley said. It really is becoming what I would describe as an epidemic.

At the start of the year, Shelley called radio encryption his organizations biggest issue in 2023, pointing to big-city police departments in New York City and Chicago that had either joined the growing trend of departments making the move or planned to do so.

By June 2021, at least 10 cities and localities had adopted police radio encryption, including Palo Alto, California; Scott County in Minnesota; and Prince William County in Virginia, according to the Reporters Committee for Freedom of the Press. Now, dozens of agencies have made the switch across the country.

In Baltimore, police already have secure channels that they can switch to, and officers can often be heard coordinating to take conversations to their cellphones.

According to a representative from Scan the Police, a group on Twitter that monitors scanner traffic in Baltimore City, during chases, barricade situations or other larger operations, supervisors will usually tell officers to utilize the encrypted channels police already have. But officers will frequently fail to stick to that channel, which presumably exists for their own safety, said the groups representative, who asked not to be identified out of fear for her safety because she has received multiple threats.

It could be assumed that part of encryption is a correction for officers not staying to the encrypted channel when asked to, but lack of compliance seems like a problem the department should handle internally rather than by cutting transparency, she said.

Melancon said that city agencies, like the Baltimore City Fire Department, have already made the switch to encrypt their radio systems and devices. The switch by police will push the department forward in recommended compliance from the Federal Partnership for Interoperable Communications, he said.

He also said the BPD will continue to use its fully encrypted channel for SWAT and tactical communications.

After the killing of George Floyd, a Black man who died in 2020 because a police officer held his knee on Floyds neck, police departments around the country became increasingly interested in implementing similar policies, limiting access to transmissions that have been public for decades, Shelley, of the Radio Television Digital News Association, said.

With police departments across the country suddenly facing more scrutiny over their practices, instead of trying to become more transparent, theyre doing the opposite and using whatever excuse and resources they can find to become much more secretive about what theyre doing, Shelley said.

He believes that some communication should be encrypted, such as hostage situations or other strategic law enforcement activity that requires tactical protection of officers. But in cases like when a plume of smoke arises or a neighborhood shooting occurs, all members of the public should have access, he said.

While some jurisdictions across the country have now totally encrypted all channels, others like Baltimore, have delayed their transmissions by 15 to 30 minutes or have at least provided some special accommodation to journalists and media.

Shelley said a move like this is counterintuitive to public safety, adding that in a city like Baltimore, where the murder rate was one of the highest in the citys history last year with population taken into consideration coupled with a history of questionable law enforcement practices, he understands why a police department or a city would want to be become less transparent about their activities.

It makes them look bad, he said. But its not about whether youre being portrayed in a positive light. Its about whether youre doing your jobs. And one key way to do that is to build public trust, and you dont build public trust by doing everything in secret.

Investigative reporter Justin Fenton contributed to this article.

Read more:
Baltimore Police scanner will be encrypted, delayed starting in July - The Baltimore Banner

Read More..
Posted in Encryption | Leave a Comment

Researchers Use Power LED to Extract Encryption Keys in … – HackRead

July 1, 2023 | Author: admin

The cybersecurity researchers from the Ben-Gurion University of the Negev and Cornell University have revealed how a side-channel attack targeting a smart card readers power LED can recover encryption keys.

This ground-breaking method can help adversaries extract encryption keys from a device simply by analyzing the video footage of its power LED. This happened because the CPUs cryptographic computations can change the power consumption of a device and impact the brightness of its power LED.

This ingenious attack method leverages the connection between a devices power consumption and the brightness of its power LED. Adversaries can obtain secret keys from the RGB values as the LEDs brightness changes when the CPU performs cryptographic operations.

They exploited the flickering of the power LED during this operation and used their understanding of the card readers inner workings to decode the keys and gain access.

The team conducted two side-channel cryptanalytic timing attacks using this video-based cryptanalysis method. After examining the video footage of the power LED, they recovered a 256-bit ECDSA key from the smart card using a compromised internet-connected security camera. They placed the camera at a distance of 16 meters from the smart card reader.

Next, they recovered a 378-bit SIKE key from a Samsung Galaxy S8 by analyzing the video footage of the power LED of Logitech Z120 USB speakers connected to the USB hub they used to charge the Galaxy S8.

This is caused by the fact that the power LED is connected directly to the power line of the electrical circuit, which lacks effective means (e.g., filters, voltage stabilizers) of decoupling the correlation with the power consumption, researchers explained in their report.

But, this technique is not as simple as it seems because merely observing the LED with a camera cannot help recover security keys, even if the frame rate is considerably high. To record the rapid changes in an LEDs brightness using a standard webcam or smartphone camera, turning on the rolling shutter effect is essential, as this is when camera sensors start recording images line by line.

In a regular setting, the camera will record the entire image sensor. Using the same technique, attackers can exploit the video camera of an internet-connected security camera or even an iPhone 13 camera to obtain cryptographic keys. Cybersecurity researchers have shown concerns as this attack method will help attackers surpass all barriers to exploit side channels, which so far were not possible. The methods non-intrusiveness makes it even more sinister.

However, as with every attack, there are some limitations to this one. For example, apart from being placed at a 16m distance, the camera should be in the direct line of sight view of the LED, and signatures should be recorded for 65 minutes.

Countering such attacks is possible if LED manufacturers add capacitors to reduce power consumption fluctuations. An alternate solution is covering the power LED with black tape to prevent information exposure.

Researchers have shared their explosive findings in a paper titled Video-Based Cryptanalysis: Extracting Cryptographic Keys from Video Footage of a Devices Power LED, available here (PDF).

See the rest here:
Researchers Use Power LED to Extract Encryption Keys in ... - HackRead

Read More..
Posted in Encryption | Leave a Comment

Proton Pass end-to-end encrypted password manager is here and … – 9to5Mac

July 1, 2023 | Author: admin

Back in April, Proton launched a beta for the service thats been one of the most requested by its users. Now Proton Pass, the end-to-end encrypted password manager has officially launched for all users on desktop and iOS/Android. And theres even a free version that includes storing unlimited credentials and notes.

Proton CEO Andy Yen shared the news in a blog post this morning:

Were happy to announce the global launch ofProton Pass, available now as a browser extension on most major browsers (Chrome, Firefox, Edge, Brave, and more) and iPhone/iPad and Android. As the name suggests, Proton Pass is a password manager, one of the most highly demanded services from the Proton community in our annual surveys since we first launched Proton Mail, ourencrypted email service, in 2014.

As we noted when the beta launched, not only does Proton Pass offer end-to-end encryption for your passwords, it does that for all fields including your email/username and web address, keeping you more secure.

Proton Pass also uses an open source, auditable design so anyone can verify the security of the platform. And Proton is planning to release the reports from independent security audits.

Proton Pass works with the most popular browsers Chrome, Firefox, Edge, and Brave on desktop and iOS/Android. However, no support for Safari at this time.

Also included with the paid Proton Pass is a built-in 2FA authenticator and there is a password import tool to seamlessly switch from your old password manager.

Proton Pass is now included with any of the companys individual or family plans but its also available for free for everyone.

With Proton Pass Free, you get unlimited logins and notes, unlimited devices, and 10 hide-my-email aliases.

Proton Pass Plus is being offered for $1/month (billed yearly) for life (normally $4.99/month) and includes unlimited logins and notes, unlimited devices, unlimited hide-my-email aliases, built-in 2FA authenticator, multiple vaults, and more.

FTC: We use income earning auto affiliate links. More.

Read more:
Proton Pass end-to-end encrypted password manager is here and ... - 9to5Mac

Read More..
Posted in Encryption | Leave a Comment

Encryption Key Management Software Market Analysis Of Growth … – EUAC

July 1, 2023 | Author: admin

New Jersey, United States Market Research Intellect has recently published a research report titled, Global Encryption Key Management Software Market Insight, Forecast To 2030 assessing various factors impacting its trajectory. The Global Encryption Key Management Software market report offers a high-quality, accurate, and comprehensive research study to equip players with valuable insights for making strategic business choices. The research analysts have provided a deep segmental analysis of the Global Encryption Key Management Software market on the basis of type, application, and geography. The vendor landscape is also shed light upon to inform readers about future changes in the market competition. As part of the competitive analysis, the report includes detailed company profiling of the top players of the Global Encryption Key Management Software market. Players can also use the value chain analysis and Porters Five Forces analysis offered in the report for strengthening their position in the Global Encryption Key Management Software market.

Leading players of the Global Encryption Key Management Software market are analyzed taking into account their market share, recent developments, new product launches, partnerships, mergers or acquisitions, and markets served. We also provide an exhaustive analysis of their product portfolios to explore the products and applications they concentrate on when operating in the Global Encryption Key Management Software market. Furthermore, the report offers two separate market forecasts one for the production side and another for the consumption side of the Global Encryption Key Management Software market. It also provides useful recommendations for new as well as established players in the Global Encryption Key Management Software market.

Get a Full PDF Sample Copy of the Report: (Including Full TOC, List of Tables & Figures, and Chart) @ https://www.marketresearchintellect.com/download-sample/?rid=182608

Key Players Mentioned in the Global Encryption Key Management Software Market Research Report:

Microsoft, AWS, OpenBSD, Avery Oden, Hashicor GnuPG, Netlib Security, Fortanix, Gemalto, HyTrust

Global Encryption Key Management Software Market Segmentation:

Encryption Key Management Software Market, By Type

Encryption Key Management Software Market, By Application

All of the segments studied in the research study are analyzed on the basis of BPS, market share, revenue, and other important factors. Our research study shows how different segments are contributing to the growth of the Global Encryption Key Management Software market. It also provides information on key trends related to the segments included in the report. This helps market players to concentrate on high-growth areas of the Global Encryption Key Management Software market. The research study also offers a separate analysis of the segments on the basis of absolute dollar opportunity.

The authors of the report have analyzed both developing and developed regions considered for the research and analysis of the Global Encryption Key Management Software market. The regional analysis section of the report provides an extensive research study on different regional and country-wise Global Encryption Key Management Software markets to help players plan effective expansion strategies. Moreover, it offers highly accurate estimations on the CAGR, market share, and market size of key regions and countries. Players can use this study to explore untapped Global Encryption Key Management Software markets to extend their reach and create sales opportunities.

Inquire for a Discount on this Premium Report @ https://www.marketresearchintellect.com/ask-for-discount/?rid=182608

What to Expect in Our Report?

(1) A complete section of the Global Encryption Key Management Software market report is dedicated to market dynamics, which include influence factors, market drivers, challenges, opportunities, and trends.

(2) Another broad section of the research study is reserved for regional analysis of the Global Encryption Key Management Software market where important regions and countries are assessed for their growth potential, consumption, market share, and other vital factors indicating their market growth.

(3) Players can use the competitive analysis provided in the report to build new strategies or fine-tune their existing ones to rise above market challenges and increase their share of the Global Encryption Key Management Software market.

(4) The report also discusses competitive situations and trends and sheds light on company expansions and mergers and acquisitions taking place in the Global Encryption Key Management Software market. Moreover, it brings to light the market concentration rate and market shares of the top three and five players.

(5) Readers are provided with findings and conclusions of the research study provided in the Global Encryption Key Management Software Market report.

Key Questions Answered in the Report:

(1) What are the growth opportunities for the new entrants in the Global Encryption Key Management Software industry?

(2) Who are the leading players functioning in the Global Encryption Key Management Software marketplace?

(3) What are the key strategies participants are likely to adopt to increase their share in the Global Encryption Key Management Software industry?

(4) What is the competitive situation in the Global Encryption Key Management Software market?

(5) What are the emerging trends that may influence the Global Encryption Key Management Software market growth?

(6) Which product type segment will exhibit high CAGR in the future?

(7) Which application segment will grab a handsome share in the Global Encryption Key Management Software industry?

(8) Which region is lucrative for the manufacturers?

For More Information or Query or Customization Before Buying, Visit @https://www.marketresearchintellect.com/product/global-encryption-key-management-software-market-size-forecast/

Our Top Trending Reports

https://www.linkedin.com/pulse/socket-adapters-market-size-share-forecast-report

https://www.linkedin.com/pulse/snack-bars-market-size-share-forecast-report-2023

https://www.linkedin.com/pulse/smart-connected-wallets-market-size-share-forecast

https://www.linkedin.com/pulse/smart-wearable-entertainment-devices-services-market

https://www.linkedin.com/pulse/smart-plug-market-size-share-forecast-report-2023

https://www.linkedin.com/pulse/smart-gun-market-size-share-forecast-report-2023

https://www.linkedin.com/pulse/smart-connected-cooking-appliances-market-size-share

https://www.linkedin.com/pulse/industrial-separation-sifting-equipment-market-size

https://www.linkedin.com/pulse/electric-immersion-heater-market-size-share-forecast

https://www.linkedin.com/pulse/keratometer-market-size-share-forecast-report-2023

About Us: Market Research Intellect

Market Research Intellect provides syndicated and customized research reports to clients from various industries and organizations with the aim of delivering functional expertise. We provide reports for all industries including Energy, Technology, Manufacturing and Construction, Chemicals and Materials, Food and Beverage, and more. These reports deliver an in-depth study of the market with industry analysis, the market value for regions and countries, and trends that are pertinent to the industry.

Contact Us:

Mr. Edwyne Fernandes

Market Research Intellect

New Jersey (USA)

US: +1 (650)-781-4080 US

Toll-Free: +1 (800)-782-1768

Website: -https://www.marketresearchintellect.com/

Follow this link:
Encryption Key Management Software Market Analysis Of Growth ... - EUAC

Read More..
Posted in Encryption | Leave a Comment