Monthly Archives: February 2017

A websitethat until very recently waspublished by Donald Trump's son-in-law has claimed thatUS spies are withholding their most sensitive intelligence from the White House.

For the past three weeks, according to a former National Security Agency (NSA) analyst and counter-intelligence officer, some the America's spy agencieshave begun withholdingintelligence from the Oval Officeamid fears"the Kremlin has ears inside" the White House situation room.

The claims follow reports thatNational Security Adviser Michael Flynn discussed lifting sanctions against Moscow with a Russian diplomat before Mr Trump took office.

An NSA official told the New York Observer it was holding back some of the "good stuff" from the White House, while onePentagon worker said: "There's not much the Russians don't know at this point. Since January 20, weve assumed that the Kremlin has ears inside the [situation room]."

The FBI is still investigating Gen Flynn's conversations with Russian Ambassador Sergey Kislyak.

Nine sources told theWashington Postthe pair had discussed sanctions imposed on Russia by outgoing President Barack Obama, despite Gen Flynn twice saying "no" in response to interview questionswhen asked if the sanctions, over Russias interference in the US election, were brought up.

In the past Mr Trump has been criticised for a perceived lack of respect for the intelligence community, while as President-elect he called the storm over Russian hacking of the election a "political witch-hunt".

The New York Observer's website is an amalgamation of several media brands bought by Mr Trump's son-in-law, Jared Kushner.

Mr Kushnerwas the owner of the news website until last month when he was named a senior White House adviser.

He is married to Mr Trump's eldest daughter, Ivanka.

More:
NSA so concerned over Donald Trump's ties to Russia they've 'withheld information from presidential briefings' - The Independent

Harold Thomas Martin III, 52, faces 20 counts of willful retention of national defense information.

The indictment alleges Martin removed classified documents from 1996 to 2016. He is accused of keeping documents in his home or car.

The documents include highly classified materials from the National Security Agency, the US Cyber Command, the CIA and the National Reconnaissance Office. Among the documents are ones that reveal US military gaps, capabilities and operations, as well as ones that contained foreign intelligence collection methods, targeting information and technical user materials.

Martin's attorney had no comment when contacted by CNN.

FBI investigators haven't concluded what Martin's motivation was for stealing the documents. At a hearing in late October a public defender representing Martin said his client was a hoarder who was "completely out of control."

Before his arrest in August, Martin worked as a contractor to the National Security Agency through consulting firm Booz Allen Hamilton, which fired him after he was charged. He has a long history working with sensitive government intelligence, and served in the US Navy and Naval Reserves for more than 10 years, reaching the rank of lieutenant.

The information he had digitally in his car, the feds said, was equivalent to approximately 50,000 gigabytes, enough to store 500 million documents containing images and text.

The government said Martin had a document "regarding specific operational plans against a known enemy of the United States and its allies." That document was not only classified but marked need-to-know only, and Martin should not have been privy to that information, prosecutors said in court filings.

Also found were files containing personal information of government employees, and an email chain with "highly sensitive information" on the back of which were handwritten notes "describing the NSA's classified computer infrastructure and detailed descriptions of classified technical operations."

Among the documents the FBI believes Martin stole were some detailing a hacking tool that the NSA developed to break into computer systems in other countries, law enforcement sources said when he was arrested. Documents detailing the tools were posted on the Internet in recent months, though no connection to Martin has been offered.

Martin's attorneys have argued previously in court that he is not a flight risk because he does not have his passport and has a wife and home in Maryland. They noted his military service.

Martin will make his next appearance in court on February 14.

CNN's Steve Almasy contributed to this report.

See the rest here:
Former NSA contractor indicted in stolen data case - CNN

WASHINGTON There is a new sheriff in charge of the United States of America who is more than willing to listen to law enforcement leaders about the issues they face in the communities that span far and wide across the country.

On Tuesday, one of those prominent voices at the nations capital was a man who has dedicated the last 30 years to protecting and serving the residents of North Carolinas North Star.

The invitation was part of a week-longtrip to the nations capital to attend the association's winter conference, where Page also met with fellow members of the NSA Immigration and Border Security Commission for a convened meeting.

Rockingham County Sheriff Sam Page was one of nearly a dozen sheriffs from the executive committee of the National Sheriffs Association on Feb. 7 that joined President Donald Trump in the White House to discuss immigration, border security and the leadership direction of the executive branch of government.

Vice President Mike Pence was also in attendance.

An NSA spokesperson told the Huffington Post on Saturday that the group who spoke with Trump wasa combination of leadership chosen by the association and certain elected officers who were requested by the White House.

The meeting was the first of its kind between the National Sheriffs Association and a sitting president. Members of the meeting were also invited into the Oval Office following the roundtable talk with the president.

Page also presented Trump with a red hat in the president's office, with white lettering that read, Sheriffs for Trump.

We appreciate you being where you are at, said Page to President Trump during the open discussion that focused on several topics, including the opioid epidemic across the nation, border security and illegal immigration.

The first responsibility of government is to protect its people as we are elected by the people and you are elected by the people, we got that. When you said there is a new sheriff in town, we relate to that. You are about the rule of law we haven't seen that in many years and we appreciate that.

Page has been a vocal leader over the last six years in regards to advocating that the U.S. Government enforces existing federal law to protect national borders specifically to help eliminate illegal drug trade.

The Sheriff also shared with the President his appreciation for John F. Kelly, who was named the fifth United States Secretary of Homeland Security on Jan. 20.

He went to the border, Page said. He looked at the assets and he asked the law enforcement down there whats going on and what can we do to help fix this situation down here. Youve got a good team and youre putting together a good team and you have the support of sheriffs from across the country and we appreciate what you are doing.

Page, who was elected as sheriff of Rockingham County in 1998, also served as the President of the North Carolina Sheriffs Association during the 2010-11 term.

The former Eden Police officer planned to stay in Washington DC until Feb. 9.

The sheriff also has scheduled meetings with Rep. Mark Walker and Sen. Richard Burr during his visit to the capital.

Contact Joe Dexter at (336) 349-4311, ext. 6139and follow @DexterJoe_RCN on Twitter.

More:
Sheriff Page, NSA leaders, meet with President Trump at White House - Greensboro News & Record

Google Project Zero's Gal Beniamini details four key errors he used to bypass Knox's kernel protections on a Galaxy S7 edge.

Google's Project Zero hackers have detailed several high-severity flaws that undermined a core defense in Samsung's Knox platform that protects Galaxy handsets in the enterprise.

Since launching Knox in 2013, the platform has been certified for internal use by UK and US government departments, including the US DoD and NSA. Given these certifications, defense-in-depth mechanisms should be rock solid.

But according to Project Zero's Gal Beniamini, who last year tore apart Android's full disk encryption, a Knox hypervisor designed to protect the Linux kernel during runtime can be subverted multiple ways.

Beniamini details four key errors he used to bypass Knox's kernel protections on a Galaxy S7 edge with Samsung's Exynos chipset. They're rather serious given that compromising the kernel would allow an attacker to access system data, hide malware, change system behavior, or take over the system.

While Android's Trusted Boot protects the integrity of the kernel during boot, it doesn't protect the kernel after it's booted and running. This shortcoming was why Samsung introduced its Knox hypervisor, known as Real-time Kernel Protection or RKP, which uses the ARM TrustZone to create a "secure world" walled from the "normal world".

Samsung fixed the six RKP issues reported by Beniamini in its January Android patch and lists them as memory corruption, information disclosure, privilege escalation, and authentication bypass bugs.

As Beniamini explains, since Knox v2.6, Samsung devices implemented an exploit-mitigation feature called Kernel Address Space Layout Randomization (KASLR), which should prevent an attacker predicting the address the kernel is loaded to. However, a simple coding error by Samsung made it possible to calculate the location.

"This security feature introduces a random 'offset', generated each time the device boots, by which the base address of the kernel is shifted. Normally, the kernel is loaded into a fixed physical address, which corresponds to a fixed virtual address in the VAS of the kernel. By introducing KASLR, all the kernel's memory, including its code, is shifted by this randomized offset, also known as a 'slide'," explains Beniamini.

However, as he notes, since all of the kernel is shifted by a single slide value, "leaking any pointer in the kernel which resides at a known offset from the kernel's base address would allow us to easily calculate the slide's value".

Beniamini says most Android devices correctly implement a function known as ktpr_restrict to hide a pointer's value using the anonymizing format specifier %pK, specifically with an upper case K. As Beniamini has previously highlighted, all kernel pointers printed using %pK are hidden. However, Samsung "rather amusingly" used a lowercase k.

"This allows us to simply read the contents of pm_qos, and subtract the pointer's value from its known offset from the kernel's base address, thus giving us the value of the KASLR slide," he explains.

Beniamini details three other RKP mitigations he got around, and several recommended steps Samsung could take to shield it from future attacks.

The rest is here:
Google Project Zero: How we cracked Samsung's DoD- and NSA-certified Knox - ZDNet