6 ms·

ISIS Has a Smartphone App

70 points by ldidi 11y ago

deleted 11y ago
[deleted]
- harshreality 11y ago
  Is it productive for anyone here to track down the apk and look at it (and disclose findings)? This seems like an instance where the infosec community shouldn't shine a light on bad crypto. Let ISIS use (potentially) bad crypto if they want. Leave it to government(s) to identify and exploit weaknesses.
  - johansch 11y ago
    That is a good point...
    - johansch 11y ago
      ...so I deleted the top comment.
dang 11y ago
Url changed from http://techcrunch.com/2016/01/16/isis-app/ http://techcrunch.com/2016/01/16/isis-app/, which points to this.
- jevinskie 11y ago
  Can you please change the title to match Fortune's as well? Currently it is patently false.
  - dang 11y ago
    Sure.
mathgeek 11y ago
> Apple and Google could easily kick apps used to organize violence out of their official app stores. But would they be willing to build further barriers to usage directly into their mobile operating systems? This is a silly question for the Android side (and possibly the iOS side as well). That would be a monumental effort that would seem easily thwarted by simply installing your own version of the OS.
- CaptSpify 11y ago
  You wouldn't even need to install your own OS. You can just side-load
  - sfall 11y ago
    they are talking about restricting the OS from running third party or side loaded apps
    - jevinskie 11y ago
      Who is "they"?
      - mathgeek 11y ago
        The article that we're discussing.
- JupiterMoon 11y ago
  > Apple and Google could easily kick apps used to organize violence out of their official app stores. But would they be willing to build further barriers to usage directly into their mobile operating systems? Similarly car manufacturers should stop making models that are used as getaway vehicles for bank robberies... It sounds silly now I put this like that doesn't it.
- christianmann 11y ago
  > and possibly the iOS side as well This is exactly what jailbreaking fixes. By default, iOS does not allow you to install apps that are not published in the App Store.
wstrange 11y ago
Which I am sure the intelligence agencies are having a field day with. Nothing like rolling your own encryption. What are the chances it was created by one of the intelligence agencies?
- jug5 11y ago
  Chances are 10/10
- bhouston 11y ago
  > What are the chances it was created by one of the intelligence agencies? I came to the comment section to say that exact same thing. If I were one of those intelligence agencies it would be tempting to use the information right away but for it to be truly effective, you'd need to let it propagate pretty far. What a field day for intelligence agencies even if wasn't planned by them -- just one thing to bust and they have everything. Is this story even serious? Using modern smart phones for "business" at all doesn't seem like a good idea if you are in the cross hairs of a modern military force.
  - NetStrikeForce 11y ago
    > Is this story even serious? It will encourage potential criminals to communicate through a system that's just a honey trap, instead of using other more secure options.
- jacquesm 11y ago
  I don't actually notice anything about them rolling their own encryption in the article (it doesn't even mention encryption other than that they use telegram to spread the link). What are the chances if it is encrypted that they didn't actually roll their own encryption but used an open source implementation like PGP and made a wrapper around it? No reason to assume they're entirely dumb until the app has been dis-assembled and proven to be buggy (though I'd not make such a proof public, just let them continue to use it).
Mizza 11y ago
Would love a sample of this..
AdmiralAsshat 11y ago
Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of shady Russian download sites could one day save the world?
- soheil 11y ago
  I'd doubt users of an encryption app not using a simple checksum to verify its legitimacy before using it.
  - deleted 11y ago
    [deleted]
  - pen2l 11y ago
    Probably not true. E.g., do you think the average user of Tor takes this precaution? Thinking back to the times I have downloaded Tor, I never did that. It reminds me of a time when I wanted to get in touch with an HN user... they had their pgp key in their user page... I tried sending the email but it didn't work (formatting issues). Finally I reached this user and asked what was up with it... and he responded by saying, "Oh, noone in the past 10 years has made use of this!" And this is a pretty smart security guy. I think there are very, very few people who actually take the trouble of verifying checksums and everything. I used to do it /sometimes/ years ago, but it gets to be a hassle pretty quickly and you start taking shortcuts everywhere. A lot of us sort of plan to start doing it, but never actually do it. Kind of like exercising or eating healthy or whatever. :) Anyway, as for this news about ISIS having their own encrypted chat app - I'm happy to hear it. If they made it on their own, it's bound to have a good dozen holes that NSA will have no trouble poking through. :)
    - marcosdumay 11y ago
      Well, differently from you and your friend, ISIS does have somebody out to get them. It's very hard to think someone would get to the trouble of creating and using a secure chat application, but then fail to secure its distribution.
mhw 11y ago
And there go the arguments for putting back doors into commercial encrypted messaging platforms. When encryption is outlawed, only outlaws will have privacy.
deleted 11y ago
[deleted]
throaway1853 11y ago
Surely it can't be that hard to create a chat app with end to end encryption these days with all the open source libraries freely available for all kinds of applications...this is why I've always said banning encryption on major platforms like iOS/Android/Windows will get you nowhere when terrorists can just make their own encrypted chat apps if they really want to.
- pki 11y ago
  Sure, it's not hard, then you get into side channel, first-use-trust/update, MITM, etc territory.
- misiti3780 11y ago
  you could just fork signal[1], change the icon, and im sure the average ISIS soilder wouldnt know the difference [1] https://github.com/WhisperSystems/Signal-iOS https://github.com/WhisperSystems/Signal-iOS
johansch 11y ago
I don't think anything good can come from the HN community publicly analyzing this.
- krapp 11y ago
  That's never stopped us before.
totalkos 11y ago
Did I miss something? The article says the app can be downloaded via existing encrypted apps ... the app itself sounds like an RSS reader ... with the ground breaking feature of being able to adjust font size. Seriously???
christianmann 11y ago
> It can even be automatically updated whenever the app’s developers send out new versions of the program. This is another potential vulnerability. If the app does not check a good signature, then it may be vulnerable to malicious update delivery.
sofaofthedamned 11y ago
This is really stupid, surely? Even if it's not distributed via Google Play, Android will look at the package names of all installed apps. Therefore it's not difficult to find all the users with a subpoena to Google for these records.
- the8472 11y ago
  That assumes a phone-home feature that cannot be turned off.
  - etiam 11y ago
    Strictly speaking I guess a phone-home feature that isn't turned off would do just fine. Would be interesting to know how good the fighting parties are with that...
vegardx 11y ago
One would assume that all mobile cell towers would be a priority target. Given that they are not I think it's safe to assume that it's a goldmine for the intelligence services. Just imagine all the side channels they have access to if they get access to the cell network. Doesn't really matter if messages are encrypted on the wire if all phones in a certain area is backdoored through a trusted network. It's not hard to locate a cell tower from a safe distance.
tlogan 11y ago
I thought they can chat in Arabic and western intelligence agencies will have no clue what is going on. There is very very little knowledge of Arabic language (with slang and such) in western intelligence agencies. As far as I now, there is less than 2,500 Americans are studying Arabic at colleges across the country right now. And 80% of them will be kicked out from country by "Trumps" as terrorists :-)
- nkrisc 11y ago
  You can't possibly be serious.
  - mahouse 11y ago
    My own suggestion is to switch to pig latin.
  - jacquesm 11y ago
    He's got a point: http://news.investors.com/ibd-editorials/091213-670830-cia-job-applicants-tied-hamas-hezbollah-al-qaida.htm http://news.investors.com/ibd-editorials/091213-670830-cia-j...
deleted 11y ago
[deleted]
akerro 11y ago
It's time to ban encryption, so ISIS can't communicate safely.
qznc 11y ago
The title is wrong. It is not a chat app. At least the article does not mention "chat" at all. More like a news app for propaganda videos.
gunnm 11y ago
Elaborate honeypot operation?
mikeash 11y ago
Where does the article say this is an encrypted chat app? The description of the app says that it features news and videos, and the only discussion of chat that I can find is about using third-party encrypted services like Telegram (which gets three separate mentions) to communicate.
Lanari 11y ago
This article... 10/10 would click again... Here's the real story, the app is a mediocre app that you can download from an archive.org link from a news website supporting ISIS, I don't have time to try the app but I assume that it get RSS from the said website (one of those enter RSS link here and we give you an app probably). Well by a website I mean something.wordpress.com, yeah that's real hard to shut down I know...
AKifer 11y ago
The policy makers are always wrong if they assume terrorists will be like normal people, agreeing to follow the laws, they will always find a way to circumvent the rules, that only the good people freedom that will suffer.

70 points by ldidi 11y ago

deleted 11y ago

[deleted]

harshreality 11y ago
Is it productive for anyone here to track down the apk and look at it (and disclose findings)? This seems like an instance where the infosec community shouldn't shine a light on bad crypto. Let ISIS use (potentially) bad crypto if they want. Leave it to government(s) to identify and exploit weaknesses.
- johansch 11y ago
  That is a good point...
  - johansch 11y ago
    ...so I deleted the top comment.

dang 11y ago

Url changed from http://techcrunch.com/2016/01/16/isis-app/ http://techcrunch.com/2016/01/16/isis-app/, which points to this.

jevinskie 11y ago
Can you please change the title to match Fortune's as well? Currently it is patently false.
- dang 11y ago
  Sure.

mathgeek 11y ago

> Apple and Google could easily kick apps used to organize violence out of their official app stores. But would they be willing to build further barriers to usage directly into their mobile operating systems? This is a silly question for the Android side (and possibly the iOS side as well). That would be a monumental effort that would seem easily thwarted by simply installing your own version of the OS.

CaptSpify 11y ago
You wouldn't even need to install your own OS. You can just side-load
- sfall 11y ago
  they are talking about restricting the OS from running third party or side loaded apps
  - jevinskie 11y ago
    Who is "they"?
    - mathgeek 11y ago
      The article that we're discussing.
JupiterMoon 11y ago
> Apple and Google could easily kick apps used to organize violence out of their official app stores. But would they be willing to build further barriers to usage directly into their mobile operating systems? Similarly car manufacturers should stop making models that are used as getaway vehicles for bank robberies... It sounds silly now I put this like that doesn't it.
christianmann 11y ago
> and possibly the iOS side as well This is exactly what jailbreaking fixes. By default, iOS does not allow you to install apps that are not published in the App Store.

wstrange 11y ago

Which I am sure the intelligence agencies are having a field day with. Nothing like rolling your own encryption. What are the chances it was created by one of the intelligence agencies?

jug5 11y ago
Chances are 10/10
bhouston 11y ago
> What are the chances it was created by one of the intelligence agencies? I came to the comment section to say that exact same thing. If I were one of those intelligence agencies it would be tempting to use the information right away but for it to be truly effective, you'd need to let it propagate pretty far. What a field day for intelligence agencies even if wasn't planned by them -- just one thing to bust and they have everything. Is this story even serious? Using modern smart phones for "business" at all doesn't seem like a good idea if you are in the cross hairs of a modern military force.
- NetStrikeForce 11y ago
  > Is this story even serious? It will encourage potential criminals to communicate through a system that's just a honey trap, instead of using other more secure options.
jacquesm 11y ago
I don't actually notice anything about them rolling their own encryption in the article (it doesn't even mention encryption other than that they use telegram to spread the link). What are the chances if it is encrypted that they didn't actually roll their own encryption but used an open source implementation like PGP and made a wrapper around it? No reason to assume they're entirely dumb until the app has been dis-assembled and proven to be buggy (though I'd not make such a proof public, just let them continue to use it).

Mizza 11y ago

Would love a sample of this..

AdmiralAsshat 11y ago

Alrawi can’t be downloaded from Google Play. Instead it must be installed from shady back alleys of the Internet. Well, there's your obvious solution. Get a copy of the APK, wrap it with some spyware, then propagate the bugged version. If ISIS won't host the source or can't provide an "official" outlet to grab it, you've got no way of knowing whether your version is legit or not. Who'd have thought the paradigms of shady Russian download sites could one day save the world?

soheil 11y ago
I'd doubt users of an encryption app not using a simple checksum to verify its legitimacy before using it.
- deleted 11y ago
  [deleted]
- pen2l 11y ago
  Probably not true. E.g., do you think the average user of Tor takes this precaution? Thinking back to the times I have downloaded Tor, I never did that. It reminds me of a time when I wanted to get in touch with an HN user... they had their pgp key in their user page... I tried sending the email but it didn't work (formatting issues). Finally I reached this user and asked what was up with it... and he responded by saying, "Oh, noone in the past 10 years has made use of this!" And this is a pretty smart security guy. I think there are very, very few people who actually take the trouble of verifying checksums and everything. I used to do it /sometimes/ years ago, but it gets to be a hassle pretty quickly and you start taking shortcuts everywhere. A lot of us sort of plan to start doing it, but never actually do it. Kind of like exercising or eating healthy or whatever. :) Anyway, as for this news about ISIS having their own encrypted chat app - I'm happy to hear it. If they made it on their own, it's bound to have a good dozen holes that NSA will have no trouble poking through. :)
  - marcosdumay 11y ago
    Well, differently from you and your friend, ISIS does have somebody out to get them. It's very hard to think someone would get to the trouble of creating and using a secure chat application, but then fail to secure its distribution.

mhw 11y ago

And there go the arguments for putting back doors into commercial encrypted messaging platforms. When encryption is outlawed, only outlaws will have privacy.

deleted 11y ago

[deleted]

throaway1853 11y ago

Surely it can't be that hard to create a chat app with end to end encryption these days with all the open source libraries freely available for all kinds of applications...this is why I've always said banning encryption on major platforms like iOS/Android/Windows will get you nowhere when terrorists can just make their own encrypted chat apps if they really want to.

pki 11y ago
Sure, it's not hard, then you get into side channel, first-use-trust/update, MITM, etc territory.
misiti3780 11y ago
you could just fork signal[1], change the icon, and im sure the average ISIS soilder wouldnt know the difference [1] https://github.com/WhisperSystems/Signal-iOS https://github.com/WhisperSystems/Signal-iOS

johansch 11y ago

I don't think anything good can come from the HN community publicly analyzing this.

krapp 11y ago
That's never stopped us before.

totalkos 11y ago

Did I miss something? The article says the app can be downloaded via existing encrypted apps ... the app itself sounds like an RSS reader ... with the ground breaking feature of being able to adjust font size. Seriously???

christianmann 11y ago

> It can even be automatically updated whenever the app’s developers send out new versions of the program. This is another potential vulnerability. If the app does not check a good signature, then it may be vulnerable to malicious update delivery.

sofaofthedamned 11y ago

This is really stupid, surely? Even if it's not distributed via Google Play, Android will look at the package names of all installed apps. Therefore it's not difficult to find all the users with a subpoena to Google for these records.

the8472 11y ago
That assumes a phone-home feature that cannot be turned off.
- etiam 11y ago
  Strictly speaking I guess a phone-home feature that isn't turned off would do just fine. Would be interesting to know how good the fighting parties are with that...

vegardx 11y ago

One would assume that all mobile cell towers would be a priority target. Given that they are not I think it's safe to assume that it's a goldmine for the intelligence services. Just imagine all the side channels they have access to if they get access to the cell network. Doesn't really matter if messages are encrypted on the wire if all phones in a certain area is backdoored through a trusted network. It's not hard to locate a cell tower from a safe distance.

tlogan 11y ago

I thought they can chat in Arabic and western intelligence agencies will have no clue what is going on. There is very very little knowledge of Arabic language (with slang and such) in western intelligence agencies. As far as I now, there is less than 2,500 Americans are studying Arabic at colleges across the country right now. And 80% of them will be kicked out from country by "Trumps" as terrorists :-)

nkrisc 11y ago
You can't possibly be serious.
- mahouse 11y ago
  My own suggestion is to switch to pig latin.
- jacquesm 11y ago
  He's got a point: http://news.investors.com/ibd-editorials/091213-670830-cia-job-applicants-tied-hamas-hezbollah-al-qaida.htm http://news.investors.com/ibd-editorials/091213-670830-cia-j...

deleted 11y ago

[deleted]

akerro 11y ago

It's time to ban encryption, so ISIS can't communicate safely.

qznc 11y ago

The title is wrong. It is not a chat app. At least the article does not mention "chat" at all. More like a news app for propaganda videos.

gunnm 11y ago

Elaborate honeypot operation?

mikeash 11y ago

Where does the article say this is an encrypted chat app? The description of the app says that it features news and videos, and the only discussion of chat that I can find is about using third-party encrypted services like Telegram (which gets three separate mentions) to communicate.

Lanari 11y ago

This article... 10/10 would click again... Here's the real story, the app is a mediocre app that you can download from an archive.org link from a news website supporting ISIS, I don't have time to try the app but I assume that it get RSS from the said website (one of those enter RSS link here and we give you an app probably). Well by a website I mean something.wordpress.com, yeah that's real hard to shut down I know...

AKifer 11y ago

The policy makers are always wrong if they assume terrorists will be like normal people, agreeing to follow the laws, they will always find a way to circumvent the rules, that only the good people freedom that will suffer.