It was a great embarrassment for Microsoft when hackers broke into email accounts of
40 million Hotmail users.
But what was even more embarrassing was the discovery that Microsoft really hates security.
That’s what happened when security researchers started disassembling versions of Windows
from 95 to 2000 to investigate Microsoft CryptoAPI for security flaws.
Turns out this was very important because: a) Windows was bathing in security holes
b) it was the most popular operating system worldwide.
A recipe for disaster.
CryptoAPI is an interface built into Microsoft’s operating system that helped developers deploy
encryption in their software running on Windows.
It was a very useful tool because it would enable encryption for things like online credit
card transactions or transmission of personal data.
The only problem was that at this time, the US government under Clinton administration
classified encryption as munition, casting a ban on all exports of strong encryption.
Every piece of cryptographic software had to comply with the Department of Defense regulations.
What was the reason behind this idea?
To protect us from terrorism, of course.
Even before 9/11, the Defense Department threw all its money on this talking point.
The attacks were just a turning point for getting Congress to officially approve of
their methods.
Banning encryption would allow the intelligence agencies to spy on their targets in the process
of making everyone’s computers less secure.
Naturally, the U.S. government hated Windows CryptoAPI.
So Microsoft had to implement solutions.
In order to ship the same version of Windows worldwide, anyone who wanted to build encryption
software on Windows had to seek approval from Microsoft.
They would be bounded to never export such software outside of U.S. borders and abide
by the U.S. legislature.
To enforce this mechanism, Microsoft would issue digital signatures that could only be
verified by Microsoft’s signing keys.
This would grant developers permission to deploy their encryption modules.
However, a British researcher discovered that Microsoft was cryptographically signing its
CryptoAPI with two keys.
This means two separate entities could approve software running inside Windows.
One of those entities was Microsoft.
The identity of the other one remained a mystery.
But then Microsoft shipped a Service Pack 5 for WindowsNT4.
Somebody down the chain of command at Microsoft forgot to remove information revealing the
true identity of both of the signing keys.
Chief security scientist at Ontario-based Cryptonym Andrew Fernandes found the names
of the two keys.
One was simply called “_KEY”.
And the other was… “_NSAKEY”.
There is only one thing the NSA stands for in the cyber world.
And this meant that the community of cryptography experts and privacy advocates exploded.
They declared this key belongs to the NSA and Fernandes himself said this second key
would allow the agency to install crucial security components on computers without users
approval.
That was it.
Every copy of Windows 95, 98, NT4 and Windows 2000 had essentially built-in backdoor for
the National Security Agency.
Or did it?
Microsoft immediately denied all accusations as just pure conspiracy theories with no grounds
in facts.
But who cares what Microsoft says.
They are busted and are trying to make us trust them rather than our own eyes.
Well.
Microsoft was not alone.
Not all security researchers were on board with this theory.
Many experts argued that it would be unlikely for this _NSAKEY to be a backdoor for the
intelligence agency.
If the NSA wanted to compromise Windows, they could have just went to Microsoft directly
and make them sign their spying tools for them.
Or just give them the key.
Or anything other than putting a copy of a key that’s meant to be so secret that it
is has the name of the NSA imprinted on it and could be found by anyone debugging CryptoAPI.
The most plausible explanation was that if the key was indeed for the NSA, it would only
be there to help them secretly secure their own government computers running on Windows.
But this was in time before the Patriot Act and when Snowden was still an edgy Republican.
Most people believed NSA didn’t spy on domestic communications on hundreds of millions of
Americans.
BOY WERE THEY WRONG.
So what was Microsoft’s explanation?
Well the first response was that the _NSAKEY is just a backup and the name is just unfortunate.
To which everyone responded with: “yeah, right.”
I was thinking about creating a second channel but I was wondering what I should name it.
But I got an idea now: The Hated One NSA.
Totally not NSA.
So that didn’t work.
So Microsoft officials said the name is there because the NSA is the technical review authority
for the U.S. export controls.
And the key is just to make sure Windows products are complaint with the export laws.
That’s quite a leap from just being backup, but okay.
But critics doubted that Export Administration Regulations would specifically require a backup
key.
So Microsoft said the second key is used for signing software on computers operating outside
of U.S. borders.
This would make sense.
But there was no record of the second key being used to sign any cryptographic module.
Microsoft never backed down from its position.
The _NSAKEY is not a backdoor because Microsoft doesn’t build backdoors for the government.
It would be against who they are.
And you don’t have to worry about anymore because Microsoft changed the name of the
_NSAKEY to _KEY2.
If someone gets mad at a company shipping a software update for a hardware issue, just
remind them how Microsoft once fixed a security vulnerability by renaming a file.
In April 28th 2000, Microsoft ended the discussion once and for all with a claim that the discussion
is just “spiraling into the realm of conspiracy theory” and all further questions went unanswered.
So who’s right?
Well, despite Microsoft’s terrible PR job, we have no evidence of anything beyond the
name of the key.
We don’t have a confirmation that the _NSAKEY ever actually belonged to the NSA or was used
by the NSA.
The name of a key file doesn’t suggest anything and everything beyond it is just a speculation.
The U.S. government eventually lifted the restrictions on exports of encryption and
open source cryptography.
Mostly due the fact the government lost a major case against Daniel Bernstein from Berkeley
who argued restrictions on source code distribution are a violation of the first amendment.
This case cemented a precedent that software source code is speech.
Ironically for Windows and the U.S. government, the existence of the _NSAKEY rendered the
export restrictions completely useless.
Researchers discovered that while changing the main _KEY results in making Windows unbootable,
replacing the _NSAKEY allows a user to install their own encryption software bypassing all
restrictions.
After this, existence of a third key was discovered, but this didn’t help clear the waters by
a bit.
Does this mean there are no backdoors in Windows?
No.
NSA leaks from Edward Snowen revealed that Microsoft is indeed closely cooperating with
intelligence agencies.
Microsoft helped the NSA circumvent its encryption and built in pre-encryption access to Outlook
and Hotmail.
They also gave NSA backdoor access to their cloud storage and enabled the agency to collect
audio and video calls on Skype.
Microsoft also closely cooperated with the FBI and CIA.
When the leaks first came out, Microsoft, like everyone else in Silicon Valley, denied
all knowledge of the NSA programs.
But this time, they really had to, because Snowden leaks also revealed there was a gag
order that forced US companies to lie in public about their cooperation with spies.
The moral of this story is that the confusion and uncertainty about government mass surveillance
is mainly due to the fact the NSA has a dual mission – cyber security and signals intelligence.
That means the same government agency is tasked with protecting your data and stealing your
data.
For making you more secure and less secure at the same time.
The best way to solve this schizophrenia would be to break up the NSA and have a separate
agency tasked with securing online communications and a separate one for intercepting them.
Both would have equal budgets.
This would force spies to focus on their targets, rather than indiscriminately collect information
of everybody and violate their privacy and freedom in the process.
At the same time, the agency tasked with cybersecurity could closely work on strengthening open source
cryptography and securing it against attacks from powerful foreign adversaries and future
quantum computing.
So you can have privacy and security and liberty at the same time.
All you need to do is to break up the spies.