What the Yahoo NSA might’ve looked for
The vague story about Yahoo searching emails for the NSA was cleared up today with various stories from other outlets [1]. It seems clear a FISA court order was used to compel Yahoo to search all their customer's email for a pattern (or patterns). But there's an important detail still missing: what specifically were they searching for? In this post, I give an example.The NYTimes article explains the search thusly:
Investigators had learned that agents of the foreign terrorist organization were communicating using Yahoo’s email service and with a method that involved a “highly unique” identifier or signature, but the investigators did not know which specific email accounts those agents were using, the officials said.What they are likely referring it is software like "Mujahideen Secrets", which terrorists have been using for about a decade to encrypt messages. It includes a unique fingerprint/signature that can easily be searched for, as shown below.
In the screenshot below, I use this software to type in a secret message:
I then hit the "encrypt" button, and get the following, a chunk of random looking text:
This software encrypts, but does not send/receive messages. You have to do that manually yourself. Continue reading
If you can't beat 'em...
A new ACG Research paper focuses on topics covering carrier-grade NFVi solutions, performance, and availability advantages over enterprise-grade versions.