29 avril 2017 par maty185
The NSA Has Inserted Its Code Into Android OS, Or Three Quarters Of All Smartphones:
ARTICLE DE Bloomberg BusinessWeek
Security-Enhanced Android: NSA Edition
By Mark Milian
July 03, 2013
Tech giants listed as part of the National Security Agency’s Prism spying program have gone to some lengths to convince the world they aren’t in bed with the U.S. government. Google (GOOG) has filed a request with the U.S. Foreign Intelligence Surveillance Act court asking permission to disclose more information about the government’s data requests. So there’s a certain irony that NSA programmers are now refining code that Google has approved for the company’s mobile operating system, Android. Google spokeswoman Gina Scigliano confirms that the company has already inserted some of the NSA’s programming in Android OS. “All Android code and contributors are publicly available for review at source.android.com,” Scigliano says, declining to comment further.
Through its open-source Android project, Google has agreed to incorporate code, first developed by the agency in 2011, into future versions of its mobile operating system, which according to market researcher IDC runs on three-quarters of the smartphones shipped globally in the first quarter. NSA officials say their code, known as Security Enhancements for Android, isolates apps to prevent hackers and marketers from gaining access to personal or corporate data stored on a device. Eventually all new phones, tablets, televisions, cars, and other devices that rely on Android will include NSA code, agency spokeswoman Vanee’ Vines said in an e-mailed statement. NSA researcher Stephen Smalley, who works on the program, says, “Our goal is to raise the bar in the security of commodity mobile devices.”
In a 2011 presentation obtained by Bloomberg Businessweek, Smalley listed among the benefits of the program that it’s “normally invisible to users.” The program’s top goal, according to that presentation: “Improve our understanding of Android security.”
Vines wouldn’t say whether the agency’s work on Android and other software is part of or helps with Prism. “The source code is publicly available for anyone to use, and that includes the ability to review the code line by line,” she said in her statement. Most of the NSA’s suggested additions to the operating system can already be found buried in Google’s latest release—on newer devices including Sony’s (SNE) Xperia Z, HTC’s (2498:TT) One, and Samsung Electronics’ (005930:KS) Galaxy S4. Although the features are not turned on by default, according to agency documentation, future versions will be. In May the Pentagon approved the use of smartphones and tablets that run Samsung’s mobile enterprise software, Knox, which also includes NSA programming, the company wrote in a June white paper. Sony, HTC, and Samsung declined to comment.
“Apple (AAPL) does not accept source code from any government agencies for any of our operating systems or other products,” says Kristin Huguet, a spokeswoman for the company. It’s not known if any other proprietary operating systems are using NSA code. SE for Android is an offshoot of a long-running NSA project called Security-Enhanced Linux. That code was integrated a decade ago into the main version of the open-source operating system, the server platform of choice for Internet leaders including Google, Facebook (FB), and Yahoo! (YHOO). Jeff Zemlin, the executive director of the Linux Foundation, says the NSA didn’t add any obvious means of eavesdropping. “This code was peer-reviewed by a lot of people,” he says.
The NSA developed a separate Android project because Google’s mobile OS required markedly different programming, according to Smalley’s 2011 presentation. Brian Honan, an information technology consultant in Dublin, says his clients in European governments and multinational corporations are worried about how vulnerable their data are when dealing with U.S. companies. The information security world had been preoccupied with Chinese hacking until recently, Honan says. “With Prism, the same accusations can be laid against the U.S. government.”
The bottom line: The NSA is quietly writing code for Google’s Android OS. Google says anyone has the right to do so.
Milian is a reporter for Bloomberg News in San Francisco.
« Over a decade ago, it was discovered that the NSA embedded backdoor access into Windows 95, and likely into virtually all other subsequent internet connected, desktop-based operating systems. However, with the passage of time, more and more people went « mobile », and as a result the NSA had to adapt. And adapt they have: as Bloomberg reports, « The NSA is quietly writing code for Google’s Android OS. »
Careless mistake reveals subversion of Windows by NSA.
« A CARELESS mistake by Microsoft programmers has revealed that special access codes prepared by the US National Security Agency have been secretly built into Windows. The NSA access system is built into every version of the Windows operating system now in use, except early releases of Windows 95 (and its predecessors). The discovery comes close on the heels of the revelations earlier this year that another US software giant, Lotus, had built an NSA « help information » trapdoor into its Notes system, and that security functions on other software systems had been deliberately crippled. » http://www.heise.de/tp/artikel/5/5263/1.html
Google Challenges Surveillance Gag Order: Squares NSA Secrecy Against First Amendment
« It appears that unlike the president, whose rating is plunging in the aftermath of PRISM-gate, US corporations are not eager to double down on their privacy intrusive ways, and some are becoming increasingly concerned about what all the recent exposure may do to their bottom line. Such as Google, which earlier today became only the first company to challenge the long-standing gag order issued by the secretive Foreign Intelligence Surveillance Court (FISA), arguing that the company has a First Amendment right to speak about information it is forced to give to the government. From Google: « Greater transparency is needed, so today we have petitioned the Foreign Intelligence Surveillance Court to allow us to publish aggregate numbers of national security requests, including FISA disclosures, separately. » And yes, GOOG, which once upon a time pretended its motto is « don’t evil » and since transformed it to « be evil, just don’t get caught », still refer to « constitutional rights » – how quaint. » http://www.zerohedge.com/news/2013-06-18/google-challenges-surveillance-gag-order-squares-nsa-secrecy-against-first-amendment