Feeds

Infosec experts boycott RSA conflab over alleged 'secret' NSA contract

Pioneering security firm were allegedly paid $10m to use flawed algorithm

Protecting against web application threats using SSL

More security researchers are boycotting next month's US edition of the RSA Conference in protest against an alleged "secret deal" the company is said to have struck with the National Security Agency.

Last month Reuters reported that the NSA "secretly paid" RSA Security $10m in return for making the Dual_EC_DRBG random number generator algorithm the default option in its BSAFE cryptographic toolkit.

The news came from documents leaked by former NSA contractor Edward Snowden, the news agency reported.

In response, RSA issued a carefully worded denial that it had never knowingly put a backdoor in its BSAFE toolkit at the behest of the NSA or anyone else.

Reuters is standing by its story and many in the security community remain unconvinced by the EMC security division's response.

Security researchers first expressed concerns that Dual_EC_DRBG was flawed on purpose, in effect creating a back door, as far back as 2006 – but RSA only advised customers against using the technology last September.

Mikko Hyppönen, the respected chief research officer at Finnish net security firm F-Secure, cancelled his planned presentation at the 2014 RSA Conference, saying that RSA Security had continued to back the use of its flawed random number generator for years "despite widespread speculation that NSA had backdoored it."

Hyppönen had planned to deliver a talk on Governments as Malware Authors.

Hyppönen said he didn't expect other conference speakers to follow his lead and cancel planned gigs at the RSA Conference and for the move to influence EMC's policies. However the respected security researcher's stance has struck a chord and several other security researchers are boycotting the San Francisco edition of the RSA Conference, traditionally the infosec business's biggest single gathering, next month.

Seven other speakers have also cancelled their planned participation at RSA Conference USA, either in delivering talks or taking part in panels. The seven are: Jeffrey Carr, founder and chief exec of Taia Global; Josh Thomas of Atredis Partners; Chris Palmer, a software security engineer at Google; Adam Langley, a cryptographer who also works for Google; Chris Soghoian, principal technologist with the ACLU's Speech, Privacy and Technology Project; Alex Fowler, Mozilla's global privacy and public policy leader; and Marcia Hofmann, a digital rights lawyer at the ‪EFF‬.

Altogether 408 speakers are planned for the event.

RSA Conference organisers expressed disappointment over the planned withdrawal, telling the Washington Post that the protest was misplaced because the conference has "long been a neutral event". It expects to fill vacated slots with alternate speakers.

RSA, the EMC security division, owns and runs the RSA Conference. This issue of the growing boycott has sparked a wider debate in the security community. Martin ‪McKeay‬, a security evangelist at Akamai, explains why he'll still be going to the RSA Conference, and why it's unrealistic to expect many security firms who are locked in to multi-year exhibition deals to boycott the show, in a blog post here.

Robert Graham of Errata Security argues (below) that a boycott against RSA Conference - and by extension RSA's products - is necessary. He wrote:

The only thing stopping corporations from putting NSA backdoors into their products is the risk of getting caught. RSA got caught backdooring BSAFE. If nobody seems to care, if RSA doesn't suffer consequences, then nothing will stop other corporations from following suit.

The reason isn't that I'm upset at RSA, or think that they are evil. I think RSA was mostly tricked by the NSA instead of consciously making the choice to backdoor their products. Instead, what I care about is sending the message to other corporations, that they should fear this sort of thing happening to them. If you are a security company, and you get caught backdooring your security for the NSA, you should go out of business.

After confirming the cancellation of his appearance at the RSA Conference, Jeffrey Carr went further in also calling for an industry-wide boycott of RSA products.

"RSA cannot escape responsibility for offering a compromised BSAFE product for the last nine years by saying 'we just followed NIST' and 'our customers had a choice'," Carr writes. "This is a gross violation of its own mission statement not to mention its own illustrious history of defending the integrity of encryption against government attempts to weaken it." ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.