<story><title>NSA Chief Hacker Explains How to Avoid NSA Spying</title><url>http://techlog360.com/2016/01/nsa-chief-hacker-explains-how-to-avoid-nsa-spying/</url></story><parent_chain><item><author>nickpsecurity</author><text>He&amp;#x27;s misdirecting people. Sure this is good advice. The problem is they only protect upper layers of the stack. NSA TAO hits the lower ones, too. Some NSA tooling even attacks in ways that require TEMPEST-style shielding. An old enumeration of issues I put together shows more of the places they&amp;#x27;re hitting plus assurance activities that stopped their hackers in the past:&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;pastebin.com&amp;#x2F;y3PufJ0V&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;pastebin.com&amp;#x2F;y3PufJ0V&lt;/a&gt;&lt;p&gt;Suffice it to say, the TAO is going to breach most of what people use. What people in high-assurance security usually did was a combination of airgaps, embedded hardware, micro&amp;#x2F;separation kernels, things like serial ports to avoid DMA risk, and so on. You have to get all the attack surface out of the equation. Then, you make the TCB simple and strong for the rest.&lt;p&gt;It&amp;#x27;s more work than most will do. It also counters the mainstream favorites like Linux&amp;#x2F;BSD, at least usual usage. So, uptake of high-security methods stayed low enough for TAO to have an easy job. Snowden leaks haven&amp;#x27;t changed that: economic and social factors remain for proprietary and FOSS. So, follow this advice or not, they&amp;#x27;ll still probably get in because root problems are still there. Might stop others, though.</text></item></parent_chain><comment><author>meowface</author><text>Absolutely. His advice is accurate and something everyone should follow, but it really only scratches the surface. Presenting it as &amp;quot;follow these 6 weird tips to keep TAO out!&amp;quot; is an attempt to give a false sense of security.&lt;p&gt;That said, the NSA is technically in charge of defensive information security for the country, so he can&amp;#x27;t be dismissed as wholly disingenuous, either.</text></comment>
<story><title>NSA Chief Hacker Explains How to Avoid NSA Spying</title><url>http://techlog360.com/2016/01/nsa-chief-hacker-explains-how-to-avoid-nsa-spying/</url></story><parent_chain><item><author>nickpsecurity</author><text>He&amp;#x27;s misdirecting people. Sure this is good advice. The problem is they only protect upper layers of the stack. NSA TAO hits the lower ones, too. Some NSA tooling even attacks in ways that require TEMPEST-style shielding. An old enumeration of issues I put together shows more of the places they&amp;#x27;re hitting plus assurance activities that stopped their hackers in the past:&lt;p&gt;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;pastebin.com&amp;#x2F;y3PufJ0V&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;pastebin.com&amp;#x2F;y3PufJ0V&lt;/a&gt;&lt;p&gt;Suffice it to say, the TAO is going to breach most of what people use. What people in high-assurance security usually did was a combination of airgaps, embedded hardware, micro&amp;#x2F;separation kernels, things like serial ports to avoid DMA risk, and so on. You have to get all the attack surface out of the equation. Then, you make the TCB simple and strong for the rest.&lt;p&gt;It&amp;#x27;s more work than most will do. It also counters the mainstream favorites like Linux&amp;#x2F;BSD, at least usual usage. So, uptake of high-security methods stayed low enough for TAO to have an easy job. Snowden leaks haven&amp;#x27;t changed that: economic and social factors remain for proprietary and FOSS. So, follow this advice or not, they&amp;#x27;ll still probably get in because root problems are still there. Might stop others, though.</text></item></parent_chain><comment><author>petra</author><text>Great in depth post.&lt;p&gt;One question: What&amp;#x27;s your opinion on Qubes , or it&amp;#x27;s windows brethren Bromium[2] and blueridge Appguard[1] ?&lt;p&gt;Not against TAO , like you said it won&amp;#x27;t work, but maybe it&amp;#x27;s the best a regular person or small company can do ?&lt;p&gt;[1]&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.blueridge.com&amp;#x2F;index.php&amp;#x2F;products&amp;#x2F;appguard&amp;#x2F;consumer&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.blueridge.com&amp;#x2F;index.php&amp;#x2F;products&amp;#x2F;appguard&amp;#x2F;consume...&lt;/a&gt;&lt;p&gt;[2]&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.bromium.com&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.bromium.com&amp;#x2F;&lt;/a&gt;</text></comment>