Following the news that Amber Rudd’s Call for Whatsapp Messages to be Available to security services. IT security experts from Avast, CipherCloud, DomainTools, AlienVault, Tenable Network Security, Tripwire, Comparitech.com and FireMon commented below.
Tony Anscombe, Ambassador and Senior Security Evangelist at Avast:
“If you build a back door, it’s there for everybody to access. And if you store that data you collect, even in encrypted form, how secure is it? All these data breaches we hear about show our privacy is regularly being breached by hackers, so the action suggested by the Home Secretary would only open us all up to further invasions of privacy.
“A lot of these terrorist organisations are already well resourced. It would be naïve of us to think that by removing the public methods of encryption which we use to protect our identity, our freedom of speech and to keep us safe from persecution, that those terrorist organisations will not develop alternative methods to encrypt their communications. If this were to happen, we’d only be pushing these people further underground, presenting a greater challenge to security intelligence services.”
David Berman, Director of Cloud Security at CipherCloud:
– Encryption is less of a technology and more of a concept or idea. Ideas are hard to control. Bad and good actors have used encryption over the course of history to communicate securely. Governments and businesses need to keep secrets too. Encryption is a highly effective way to protect legitimate rights and interests.
– Controlling encryption is equivalent to controlling math. Modern encryption schemes (such as AES-256) are publicly available and can be implemented with skills of a college-level math major. If providers of secure messaging in western countries are forced to install backdoors, then bad actors will get their secure apps from regions where UK and US government enforcement do not reach. Preventing clever people anywhere in the world from applying readily available encryption or developing their own encryption schemes is impossible.
– Legitimate users will be hurt if government demands backdoors. If there are any backdoors to data protection, it is inevitable that hackers will steal and exploit them. The very existence of government backdoors would undermine the confidence in security from firms in western countries. Other countries will quickly fill the gap. Encryption plays a critical role in online privacy, ecommerce and the cloud. Undermining the trust in personal data protection will hurt businesses and users alike.
We live in scary times and should never underestimate the challenges we all face in deterring terror. But latching onto simplistic solutions that will not work, does not make us safer. In fact, if we undermine the effectiveness of our critical digital security mechanisms and damage an important industry, we will be handing the terrorists a victory. For these and many other reasons, this idea simply won’t work and will have no impact on those seeking to commit acts of terror.”
Kyle Wilhoit, Senior Security Researcher at DomainTools:
The ultimate victims are the end user and the organization required to comply with embedding vulnerabilities to allow for backdoors. Having embedded vulnerabilities leaves the end user vulnerable to criminals who leverage the backdoor that the organization willingly put into place. You can’t necessarily control who finds or uses this vulnerability once the application is distributed and used.”
Javvad Malik, Security Advocate at AlienVault:
Gavin Millard, EMEA Technical Director at Tenable Network Security:
“As with traditional IT equipment, it’s important connected devices are kept up to date, applying fixes the vendors release in a timely manner.”
David Meltzer, Chief Technology Officer at Tripwire:
Lee Munson, Security Researcher at Comparitech.com:
“Great headlines the lot of them, especially for politicians who like to curry favour with the electorate by pandering to, well, anything of note really.
“In this case, however, we find the Home Secretary seriously out of her depth with her suggestion that a back door should be placed in all encrypted messaging services, a claim made all the more laughable by her assertion that this could be accomplished with hashtags. Perhaps she intends to tweet #no_more_encryption and then sit back and watch the magic happen?
“Her crazy idea that a system could feature end-to-end encryption and a back door at the same time (which means it’s no longer end-to-end and available to anyone who, good or bad, who can find said backdoor) is almost as baffling as the notion that terrorists would then continue using that service regardless.
“Everyone knows that once one service is known to be broken, the bad guys will simply move onto the next. In the meantime, it is ordinary, law-abiding citizens who will be wondering whether their current government, or the next, or the one after that, is spying on their mundane but no less privacy-deserving lives.
“Equally, businesses will get the jitters too, wondering whether Amber Rudd wishes to weaken their ability to communicate with clients in other, less paranoid, countries, or unravel all the hard work and funds they have invested into the secure web payments they offer their customers.”
Paul Calatayud, CTO at FireMon:
“The problem with backdoors is they are essentially a request for access to applications or systems using alternative means than the front door. Many companies spent a lot of time protecting the front doors of their products. Backdoors by design allow those with keys access, but like the analogy, it also means attackers can attempt to penetrate and hack these backdoor systems. In essence, backdoors compromise the security of the products allowing for potential broad exploitation to occur. Those with keys can also lose their keys. Who in the government would be responsible for protecting the keys to these back doors? What if I attack those with these keys? Or more commonly, what if a contract working for a government decides to steal these keys and perhaps flee to Russia? Sounds familiar to other events that have occurred.
“Let’s turn our attention to WhatsApp. Yes, this communication application has built-in security enabling end to end encryption. If the bad guys feel that this application has been compromised by government officials and backdoors become available, this leads to a simple response by the bad guys, use a different application. WhatsApp is a third party application on a mobile device. Nothing prevents the bad guys from moving to a lesser known third party application. Plus, anyone that is looking to compete with WhatsApp may see this new backdoor feature as an opportunity to compete, promoting the lack of backdoor in their product as a true for the people product.
“Backdoors can have a negative financial impact to those companies providing these security type products.”
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.