Mediaboss Marketing

Recently in an address at the Chief of Defence Intelligence annual conference 2023, National Security Adviser (NSA), Nuhu Ribadu remarked that the six-month-old administration of President Tinubu had inherited a bankrupt country which had resulted in budgetary constraints.

He further told the assembled ranks of defence spooks that it is important for you to know that we have inherited a very difficult situation, literally a bankrupt country, no money, to a point where we can say that all the money we are getting now, were paying back what was taken..

As an insider whose duties are at the nexus of issues of national security, the NSAs assessment of the economy must be taken seriously. Indeed President Tinubu confirmed as much a few days later in Saudi Arabia during a discussion with the Vice-President (country programmes) of the Islamic Development Bank Dr Mansur Mukhtar. Said the President at the occasion, We inherited serious liabilities but also assets from our predecessors, but we have no excuses.

Before the NSAs and President Tinubus statements, some of the presidents men namely Bayo Onanuga Bagudu Atiku, Wale Edun and Yemi Cardoso, had all made similar statements on the state of the economy. From all indications in the coming days and months, more of President Tinubus men will repeat the same mantra as the economy continues on its rapid descent and as the government continues to look out for odds.

But it is instructive that while President Tinubu and his men have continued to wax lyrical about the parlous state of the economy they met upon coming to power, Nigerians however observe that ironically by its actions the administration is exacerbating the situation.

It all started with the ill-considered decision by President Tinubu on his inaugural day to endorse the removal of subsidies on petroleum products and a merger of the exchange rates. As this was coming right on the heels of a debilitating ill-thought-out currency reform programme embarked upon by the previous administration of President Buhari in which millions of Nigerians were subjected to untold and undeserving hardships leading to personal and business bankruptcies, it was difficult for Nigerians to believe that the new administration meant well for the people and the country.

We have seen the effect of these policies in the galloping inflation figures rising up to 27% from the latest figures put out by the National Bureau of Statistics (NBS), and the ever-plummeting value of the naira against major currencies. This has led to continuous hardship on the people.

But what is even more galling for the people is that in the midst of its claims of meeting a bankrupt economy, the Tinubu administration is seen embarking on more of the injurious policies the previous administration did to the economy. Instead of prudent management of resources to reflect the lean times the Tinubu administration is on a profligate and reckless spending binge with what is left of the national commonwealth.

The supplementary budget submitted to the national assembly is a pointer to this fact. In all, a large chunk of the about N1.2 trillion budget is proposed for expenditure on luxuries for the president and the vice president.

With the benefit of what we have seen so far most Nigerians are now of the belief that the renewed hope slogan of the Tinubu administration promises more hardship than hope. The excuses being bandied about by its functionaries are clearly indicative of the fact that the administration is in the middle of a crisis of ideas, capacity and will. It is struggling to extricate itself from the spaghetti of contradictions it had created on the one hand and the quiet but ominous hostility of the Nigerian people on the other hand.

But the facts and reality cannot be hidden. The minister of finance, Wale Edun, recently admitted in a speech at a conference of the Institute of Chartered Directors recently that despite the assumptions that the economic policies embarked upon by the Tinubu administration will attract the favour of Western governments and institutions, Foreign investors have shown a reluctance in investing in the Nigerian economy. Invariably this means that without investors coming in, the naira will continue to weaken against major currencies leading to yet more inflation and attendant consequences on the economy. In its forecast for the Nigerian economy for 2024 and beyond, the Economist Intelligence Unit reports that High inflation, low economic growth and unpopular market reforms present substantial political stability risks. More and more Nigerians will fall into poverty as they will not be able to afford even the most basic of necessities for a decent existence.

As the majority of Nigerians are left to their own devices under the most punishing economic regime ever enacted in the country, the Tinubu administration is increasingly looking distinctively weak and vulnerable. Metaphorically in this context, the Tinubu administration is looking like a rabbit caught in the headlights of an approaching vehicle square and out of odds. Thus the NSAs speech which reads like a desperate plea for understanding and assurance to the armed forces can be viewed in this regard.

Let us face it; President Tinubus economic policies are lacking in the necessary fundamentals to transform the economy. As a result, Nigeria is really transiting on the way to economic and political perdition. The palliatives which the administration presented to cushion the effects of the harsh economic policies have proven to be largely inconsequential to the target groups. And there are no indications that after the first flurry of activities, the administration will be able to sustain it in the coming months.

Indeed the administration has found in the harsh economic policies a cynical tool for weaponization of poverty and as an enabler for political capture. The logic here is that the poorer people are made to be, the more they make themselves amenable to being manipulated politically.

Nigerias economic and political future has never been bleaker. The bandwidth for preventing a social explosion is shrinking by the day. The Tinubu administration must hasten to come to terms with this existential reality before it is too late.

Gadu can be reached via [emailprotected] or 08035355706 (texts only).

Views expressed by contributors are strictly personal and not of TheCable.

View original post here:
Tinubu met a bad economy but he's worsening it | TheCable - TheCable

Filippo Valsorda describes it as a call to arms to help fill in a page of cryptographic history.

The former Cloudflare/Golang cryptographer has announced a $12,288 bounty for finding the seeds of five elliptic curves produced by the NSA in 1999 that have since become an industry standard. Valsorda calls them the elliptic curves that power much of modern cryptography, noting that theyre used, among other things, for the certificates securing millions of websites. Theyve been augmented over the decades with even more utility-enhancing formulas and interfaces.

As Valsorda puts it, Theyre a big deal.

But was there a common English phrase used to create this foundational sequence? Valsorda says its creator left behind a cryptographic mystery, some conspiracy theories, and an historical password cracking challenge. And hes calling on the larger internet community to try to solve it.

Or as Valsorda put it on the social networking service formerly known as Twitter, Do you have a bunch of GPUs and passphrase brute-forcing experience? Crack the NSAs five SHA-1 hashes at the heart of NISTs elliptic curves, solve a cryptographic mystery, and earn $8k (tripled if donated to charity).

You can win half the bounty walking away with $6,144 just by correctly submitting one of the five seeds, according to Valsordas site. (Since Even one would make history.) The other half of the bounty goes to whoever submits all five.

And Valsorda will triple payout amounts if the winner names a U.S. 501(c)(3) charity to receive the money. (We reserve the right to veto charity choices dramatically incompatible with our values, but we wont be jerks about it.)

Thats a $18,432 donation for finding just one of the seeds and a $36,864 donation for finding all five. (Valsorda is putting up some of the money himself aided by generous matchers)

But more importantly? Its a chance to write yourself into the history of cryptography itself

It all started in September, when Steve Weis, who is both a cryptographer and a principal software engineer at Databricks, published a thought-provoking blog post. Weis notes the 1999 parameters are the most widely used elliptic curve cryptography standard (adopted in 2000 by the U.S. Department of Commerces official National Institute of Standards and Technology.)

But Revelations of NSA interference in cryptographic standards like Dual_EC_DRBG led to speculation of whether the NIST curve seeds could have been intentionally chosen with a weakness or backdoor known only to the NSA. The blog post notes at least one person raising this suspicion in a 1999 post to a Usenet discussion group about cryptography, and a more recent paper published in 2015 by math professors Neal Koblitz and Alfred Menezes.

Professor Menezes told Weis hed been given the seeds as early as 1997 by long-time NSA employee Jerry Solinas (known for authoring several cryptography standards). But Weis adds Unfortunately, Dr. Solinas died in early 2023 without publicly saying how the curve seeds were generated. Yet Weis has uncovered some tantalizing clues. One of Solinass contemporaries said that around 2013, Solinas had confided that the seed was something like

SEED = SHA1(Jerry deserves a raise.)

But Solinas had revealed even more, suggesting that the seed mightve been lost even to Solinas himself. After he did the work, his machine was replaced or upgraded, and the actual phrase that he used was lost, Weis writes. When the controversy first came up, Jerry tried every phrase that he could think of that was similar to this, but none matched.

Weis adds that after publishing his blog post, a fourth person came forward saying that in 2013, Dr. Solinas recalled to them that the seed phrase had two names in it, like Give Alice and Bob a raise.' Another source claimed Solinas told them the phrase included an arbitrary number that changed with each block of text encrypted. Since then Weis has even tried requesting any documentation under the Freedom of Information Act. (NIST claimed they had no documentation and the NSA ceased responding.)

This leaves what Weis calls a long shot chance: trying to brute force guess short English phrases and see if any collide with a seed from the specifications.

And of course, this inspired Valsorda

Weis succinctly summarizes whats at stake here. Whenever a controversy about the NSA arises among the cryptographic community, it resurfaces a question that has been open for 25 years: How were the NIST ECDSA curve parameters generated?

Valsorda is skeptical that the NSA repeated its interference the way theyd done with the Dual_EC_DRBG standard (noting that earlier standards compromised design immediately stuck out like a sore thumb and library authors had to be paid to implement it.) Valsordas blog post points out that that incident suggests the NSA is kinda bad at backdoors, not magical. But he believes that because of the speculation, some fear, uncertainty, and doubt persists around the otherwise pretty good NIST curves that would be good to clear up

The effort is continuing. On Oct. 8 Valsorda updated the post to include a link to a massive list of nearly 12,000 potential target hashes that cover 99% of the probability space for each of the prime order curve seeds. Valsorda wrote on Mastodon that the list was based on the hypothesis that maybe instead of increasing a counter, the seed/hash itself was increased until a valid one was found.

And of course, theres been a lively discussion on Valsordas Mastodon feed.

@jerry absolutely deserves a raise.

But mixed in with the comical banter, Valsorda has answered some important questions like the user who asked For the uninformed, the seeds being found wont impact the security of using these curves at all?

Valsordas answer? Nope, if anything it would make them more trustworthy, although most cryptographers I know dont think thats necessary.

Valsorda also explained how standardizing on these curves allowed more speedy and accurate encryption than self-generated curves and lets us write well optimized, safer implementations. While you could try generating your own original encryption parameters, the security margin you get from forcing an attacker to crack a few thousand parameters instead of one is just a dozen bits.

And so back on his personal blog, Valsorda is now cheering on an unseen internet community who may finally solve this long-standing mystery. We dont actually care how you find the seeds, Valsorda wrote. It can be brute forcing, clever guessing, sleuth work tracking down NSA employees (dont get arrested), or even recovering that old backup of when you used to work at NIST. If you dont want us to, we wont ask questions.

May the hashrate be ever in your favor, and lets fill out a page of cryptographic history.

See the original post here:
Crack a 1999 NSA Cryptography Standard and Win a Bounty - The New Stack

A new cybersecurity guidance from the National Security Agency is calling on network defenders of the Department of Defense, Defense Industrial Base and National Security System to implement zero trust security on their information technology devices.

NSA on Thursday published an information sheet recommending device security assessment and enhancement through zero trust principles including real-time inspection, remote access protection and patch management.

The cybersecurity information sheet, or CSI, discusses the device pillar of the ZT framework, which ensures that hardware that is within an environment or connecting to resources undergoes strict location, enumeration, authentication and assessment.

An organizations registered IT hardware and software should be inventoried along with their versions and patch levels. They should also be part of acceptance testing and deprovisioning before retirement.

Agencies must regularly check their devices compliance to internal policies and general standards, and update their configuration and firmware versions if necessary, NSA said. Obsolete encryption could lead to easy accessibility and subsequently data breach.

The CSI is also applicable to non-government organizations that could face threats from sophisticated malicious actors, according to NSA.

Read more here:
NSA Cybersecurity Information Sheet Pushes for Zero Trust Security in DOD Devices - Executive Gov

A new advisory from signals intelligence and cybersecurity experts at the National Security Agency (NSA) highlights the top 10 most common cybersecurity misconfigurations in large organisations including regular exposure of insecure Active Directory Certificate Services.

It comes as the NSAs Cybersecurity Director Rob Joyce warned that if your infrastructure cant survive a user clicking a link, you are doomed.

"Im the director of cybersecurity at NSA and you can definitely craft an email link I will click he added on X writing as generative AI models make it far easier for non-native speakers to craft convincing phishing emails and as such campaigns remain highly effective for threat actors.

The list is a useful guidebook to those seeking to secure IT estates and is no doubt based in part on the NSAs extensive experience of breaching services, as well as support defending CNI. To The Stack, it is also a crisp reminder that strict organisational discipline is critical for cyber hygiene.

Too many network devices with user access via apps or web portals still hide default credentials for built-in administrative accounts. (Cisco, were looking at you, you, you. (Others are also regularly guilty.) The problem extends to printers and scanners with hard coded default credentials on them but are set up with privileged domain accounts loaded so that users can scan and send documents to a shared drive).

NSA says: Modify the default configuration of applications and appliances before deployment in a production environment . Refer to hardening guidelines provided by the vendor and related cybersecurity guidance (e.g., DISA's Security Technical Implementation Guides (STIGs) and configuration guides)

More specifically on default permissions risks, NSA says it regularly says issues with configuration of Active Directory Certificate Services (ADCS); a Microsoft feature used to manage Public Key Infrastructure (PKI) certificates, keys, and encryption inside of AD environments.

Malicious actors can exploit ADCS and/or ADCS template misconfigurations to manipulate the certificate infrastructure into issuing fraudulent certificates and/or escalate user privileges to domain administrator privileges it warns, pointing to ADCS servers running with web-enrollment enabled; ADCS templates where low-privileged users have enrollment rights and other associated issues with external guidance on a handful of known escalation paths here, here and here.

Ensure the secure configuration of ADCS implementations. Regularly update and patch the controlling infrastructure (e.g., for CVE-2021-36942), employ monitoring and auditing mechanisms, and implement strong access controls to protect the infrastructure. Disable NTLM on all ADCS servers. Disable SAN for UPN Mapping. If not required, disable LLMNR and NetBIOS in local computer security settings or by group policy.

Already have an account? Sign in

See more here:
Top 10 misconfigurations: An NSA checklist for CISOs - The Stack

FORT MEADE, Md. - The Cybersecurity and Infrastructure Security Agency (CISA), National Security Agency (NSA), Federal Bureau of Investigation (FBI), and international partners released an updated Cybersecurity Information Sheet (CSI) to provide additional guidance for technology manufacturers to ensure their products are secure by design and default.

The joint CSI adds guidance to the Shifting the Balance of Cybersecurity Risk: Principles and Approaches for Secure by Design Software report published in April 2023. The new guidance provides more detail on the three secure by design and default principles as they apply to both software manufacturers and their customers.

We need to continue working together to proactively design, build, and deploy secure products for our critical systems, said Rob Joyce, NSA Cybersecurity Director. The implementation of secure by design and default principles not only increases the security posture of manufacturers products, but customers as well.

As indicated in the CSI, the authoring agencies recognize the contributions from private sector partners in advancing secure by design and default implementation. The new CSI is intended to continue enabling international conversation about key priorities, investments, and decisions necessary to achieve a future where technology is safe, secure, and resilient by design and default.

The agencies recommend software manufacturers implement the strategies outlined in the CSI to take ownership of the security outcomes of their customers through secure by design and default principles. The agencies also advise that recommendations in this CSI apply to manufacturers of artificial intelligence (AI) software systems and models.

CISA authored the CSI in collaboration with the Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the United Kingdoms National Cyber Security Centre (NCSC-UK), Germanys Federal Office for Information Security (BSI), Netherlands National Cyber Security Centre (NCSC-NL), the Computer Emergency Response Team New Zealand (CERT NZ) and New Zealands National Cyber Security Centre (NCSC-NZ), the Korea Internet & Security Agency (KISA), Israels National Cyber Directorate (INCD), Japans National Center of Incident Readiness and Strategy for Cybersecurity (NISC) and Computer Emergency Response Team Coordination Center (JPCERT), the Network of Government Cyber Incident Response Teams (CSIRT) Americas, the Cyber Security Agency of Singapore (CSA), and the Czech Republics National Cyber and Information Security Agency (NKIB).

Read the full report here. Visit our full library for more cybersecurity information and technical guidance.

NSA Media Relations MediaRelations@nsa.gov 443-634-0721

Continued here:
NSA and Partners Issue Additional Guidance for Secure By Design ... - National Security Agency