Random Politics & Religion #00

The U.S. National Security Agency has figured out how to hide spying software deep within hard drives made by Western Digital, Seagate, Toshiba and other top manufacturers, giving the agency the means to eavesdrop on the majority of the world's computers, according to cyber researchers and former operatives.

That long-sought and closely guarded ability was part of a cluster of spying programs discovered by Kaspersky Lab, the Moscow-based security software maker that has exposed a series of Western cyberespionage operations.

Kaspersky said it found personal computers in 30 countries infected with one or more of the spying programs, with the most infections seen in Iran, followed by Russia, Pakistan, Afghanistan, China, Mali, Syria, Yemen and Algeria. The targets included government and military institutions, telecommunication companies, banks, energy companies, nuclear researchers, media, and Islamic activists, Kaspersky said.

The firm declined to publicly name the country behind the spying campaign, but said it was closely linked to Stuxnet, the NSA-led cyberweapon that was used to attack Iran's uranium enrichment facility. The NSA is the agency responsible for gathering electronic intelligence on behalf of the United States.

A former NSA employee told Reuters that Kaspersky's analysis was correct, and that people still in the intelligence agency valued these spying programs as highly as Stuxnet. Another former intelligence operative confirmed that the NSA had developed the prized technique of concealing spyware in hard drives, but said he did not know which spy efforts relied on it.

NSA spokeswoman Vanee Vines declined to comment.

Kaspersky published the technical details of its research on Monday, which should help infected institutions detect the spying programs, some of which trace back as far as 2001.

The disclosure could further hurt the NSA's surveillance abilities, already damaged by massive leaks by former contractor Edward Snowden. Snowden's revelations have hurt U.S. relations with some allies and slowed the sales of U.S. technology products abroad.

The disclosure of these new spying tools could lead to greater backlash against Western technology, particularly in countries such as China, which is already drafting regulations that would require most bank technology suppliers to proffer copies of their software code for inspection.

According to Kaspersky, the spies made a technological breakthrough by figuring out how to lodge malicious software in the obscure code called firmware that launches every time a computer is turned on. Disk drive firmware is viewed by spies and cybersecurity experts as the second-most valuable real estate on a PC for a hacker, second only to the BIOS code invoked automatically as a computer boots up.

"The hardware will be able to infect the computer over and over," lead Kaspersky researcher Costin Raiu said in an interview.

Though the leaders of the still-active espionage campaign could have taken control of thousands of PCs, giving them the ability to steal files or eavesdrop on anything they wanted, the spies were selective and only established full remote control over machines belonging to the most desirable foreign targets, according to Raiu. He said Kaspersky found only a few especially high-value computers with the hard-drive infections.

Kaspersky's reconstructions of the spying programs show that they could work in disk drives sold by more than a dozen companies, comprising essentially the entire market. They include Western Digital Corp, Seagate Technology Plc, Toshiba Corp, IBM, Micron Technology Inc and Samsung Electronics Co Ltd.

Western Digital, Seagate and Micron said they had no knowledge of these spying programs. Toshiba and Samsung declined to comment. IBM did not respond to requests for comment.

GETTING THE SOURCE CODE

Raiu said the authors of the spying programs must have had access to the proprietary source code that directs the actions of the hard drives. That code can serve as a roadmap to vulnerabilities, allowing those who study it to launch attacks much more easily.

"There is zero chance that someone could rewrite the [hard drive] operating system using public information," Raiu said.

Concerns about access to source code flared after a series of high-profile cyberattacks on Google Inc and other U.S. companies in 2009 that were blamed on China. Investigators have said they found evidence that the hackers gained access to source code from several big U.S. tech and defense companies.

It is not clear how the NSA may have obtained the hard drives' source code. Western Digital spokesman Steve Shattuck said the company "has not provided its source code to government agencies." The other hard drive makers would not say if they had shared their source code with the NSA.

Seagate spokesman Clive Over said it has "secure measures to prevent tampering or reverse engineering of its firmware and other technologies." Micron spokesman Daniel Francisco said the company took the security of its products seriously and "we are not aware of any instances of foreign code."

According to former intelligence operatives, the NSA has multiple ways of obtaining source code from tech companies, including asking directly and posing as a software developer. If a company wants to sell products to the Pentagon or another sensitive U.S. agency, the government can request a security audit to make sure the source code is safe.

"They don't admit it, but they do say, 'We're going to do an evaluation, we need the source code,'" said Vincent Liu, a partner at security consulting firm Bishop Fox and former NSA analyst. "It's usually the NSA doing the evaluation, and it's a pretty small leap to say they're going to keep that source code."

Kaspersky called the authors of the spying program "the Equation group," named after their embrace of complex encryption formulas.

The group used a variety of means to spread other spying programs, such as by compromising jihadist websites, infecting USB sticks and CDs, and developing a self-spreading computer worm called Fanny, Kasperky said.

Fanny was like Stuxnet in that it exploited two of the same undisclosed software flaws, known as "zero days," which strongly suggested collaboration by the authors, Raiu said. He added that it was "quite possible" that the Equation group used Fanny to scout out targets for Stuxnet in Iran and spread the virus.

They should have watched that movie Hackers !

Dang it, Fone. You couldn't even bother to find a picture of me? Fine, I'll provide my own.

Expats looking to minimize their income-tax bill may want to pack up and move to Bulgaria.

While there’s no such thing as tax-free living, some places have better tax structures for expats than others—and the tiny Balkan nation is one of them.

A new report from AIRINC, a firm that collects and analyzes data on international mobility that’s based in Cambridge, Mass., shows certain countries offer distinct advantages when it comes to expats paying taxes.

To determine the best and worst countries for expatriate taxpayers, AIRINC looked at 125 countries and compared marginal tax rates—that is, the tax rate you would pay on an additional dollar of income. The data firm applies that to what they define as “high income married expatriate individuals.”

While many countries have tax systems that include income tax, some locales offer expats a lower tax rate to encourage more globetrotters to settle down. Spain, for example, allows qualifying expats to pay a flat 24.75% tax on gross income for the first five years, which is substantially lower than the maximum 51.9% marginal rate. In Japan, certain employer reimbursements for expats can be made either tax-free or at a reduced tax cost.

The study didn’t include countries such as Saudi Arabia and Kuwait, which don’t *** individual income tax on expats. It’s also important to keep in mind that expats from the U.S.—and even tiny Eritrea—tax income earned overseas. That’s on top of the taxes that would apply from local authorities.

The results: The best tax locations are Bulgaria and Kazakhstan, both with a flat income-tax rate of 10%. The worst country was Slovenia, with a 61.10% marginal rate for married taxpayers, followed by Belgium, with a 59.60% marginal rate.

In Slovenia, the income tax rate is 50%–on top of that, employees pay a deductible social-security contribution of 22.1%, explains Patrick Jurgens, director of global tax research and consulting at AIRINC.

Still, sometimes there’s a trade-off for higher taxes (gasp!). Sweden once had the highest tax rates in the world, and is one of the “worst” locations according to the study. But the Scandinavian nation has also been much lauded for its social services like health care and education.

I just noticed how the "best" locations are some of the worst places in the world to live.

I just noticed how the "best" locations are some of the worst places in the world to live.

Like I said, the article is very misleading.

But it is accurate that these countries are trying to boost patriotism to their countries from wealthier citizens. Which is a smart thing to do for these countries, as some of these people have income that meets or exceeds some of these national budgets.

You specifically blocked me because I kept persistently using all those nasty facts and reasoned arguments.

(and a lot of other words that I'll be told to edit out again)

I think you said I'm the only person you've blacklisted, too, which is very telling when you apparently have no problems with others.

A huge majority of your opinions are based in knee-jerk propaganda that has the survival chances of rice paper in a blast furnace.

Some are quite livable. Hong Kong, Guatemala, Bolivia.

Some are even affordable, Guatemala and Bolivia.

Some I can find on a map but am clueless about. Mauritius, Madagascar, Paraguay.

They are also some of the countries with the least public funding as well. It's easy to meet or exceed your budget if it only includes keeping the lights on at the tax office.