13 ms·
“Turkey coup plotters' use of 'amateur' app helped unveil their network”
- Roritharr 10y agoI guess the next Coup attempt will need a CTO...
- cm3 10y agoOr just don't use tools you don't understand enough to rely on in such a critical use case. My viewpoint is from a very developer's perspective, and rebels may not all possess the needed technical insight, but this looks like amateur hour. They must have trusted some technical person's advice in their organization, if they're a group, and you could be right that they were missing a sufficiently skilled CTO for such an operation.
- rtpg 10y agoOK so don't use tools you don't understand is step one. But now, the coup needs a way to communicate. E-mail's because we know it's insecure. Now what? You research, and find this app, and then.... Feel like this isn't very actionable advice.
- TeMPOraL 10y agoCoups aren't a new invention, they were happening since people first organized into a society. Securing an organization is not a purely, or even primarily, a computer problem. Newest "encrypted" chatapp du jour is only a distraction, and should be at best treated as a shiny replacement for walkie-talkies. If someone is so stupid to base the security of their op on a chat app, frankly, they deserve to fail.
- tamana 10y agoEmail with gpg is about the most secure content format available to the general public, and stable for 20 years. Needs some setup tho
- MBCook 10y agoThe barrier on PGP or GPG is EXTREMELY high for a bunch of normal people on various kinds of cell phones. I can see why someone found an app that someone thought was secure and everyone went with it.
- cookiecaper 10y agoIt works pretty smoothly with K-9 Mail + APG.
- allendoerfer 10y agoNot good enough, you still have metadata, which in this case is gold. "So you were messaging General X, while he was performing the coup. Would you like to tell us more about this, maybe during some waterboarding?"
- bad_user 10y agoEmail addresses are not necessarily identifiable. Use a VPN or TOR and setup a Gmail account. Or maybe buy a prepay GSM card with 3G bandwidth included, and use it while moving through town.
- matheweis 10y agoHave you actually tried to set up an anonymous gmail account recently? Because I think you'll find that it is borderline impossible. Gmail's algorithms end up requiring SMS authentication when you're working over tor, which essentially deanonymizes you or requires the additional step of getting a burner phone for SMS; neither of which is good and probably will get you on all sorts of lists...
- allendoerfer 10y agoAdditionally: "Burner phone" does not work in many countries. Where I am you cannot anonymously buy a prepaid phone.
- cm3 10y agoIf you read the alleged chat logs of how they coordinated the event, you will see that there was little coordination to begin with, regardless of the medium. If there had been proper planning, they first of all wouldn't have used a chat room, and they also wouldn't have used a tool that logs chats. This is not how military commanders instruct their troops in the field.
- joshpadnick 10y agoI'm really curious. What is the wise CTO's recommendation for a coup's way to securely message? As one of the other commenters said, WhatsApp and Signal still rely on third parties to host the system. But doesn't Signal simply have each device generate a private key that it claims it never knows about so even if the Signal server were hacked it still wouldn't compromise existing keys? PGP (or Keybase.io) seems like too much work for non-techies. I'm not as familiar with Telegram. In the end, could you do any better than a trusted third party providing a protocol it claims generates keys on your device and doesn't share them?
- colechristensen 10y agoHave the NSA design one for you through a front and have the Americans on your side (publicly or not). It really depends on who you are trying to depose. I wouldn't trust any device if you were going against the interests of America / NATO, there are just too many opportunities for side channels. Likewise if it were using Chinese hardware against China. Assume you're compromised in either situation regardless of how secure your encryption seems to be.
- at-fates-hands 10y ago>>Likewise if it were using Chinese hardware against China Article from 2015 talking about phones shipping from Chinese manufacturers with backdoors already installed: 26 Android Phone Models Shipped with Pre-Installed Spyware http://thehackernews.com/2015/09/android-smartphone-malware.html http://thehackernews.com/2015/09/android-smartphone-malware....
- Spooky23 10y ago> What is the wise CTO's recommendation? Shut the fuck up and wait for instruction. When you're in the conspiracy stage, you need a cell like structure to protect the conspiracy against double agents and detection. When you go live, you decapitate the local flavor of secret police, arrest the leader, and start rounding up or killing the key players. Then talk.
- 10y ago
- BadassFractal 10y agoI was semi-certain they were going to talk about Telegram, turns out I was wrong though, phew.
- cm3 10y agoDoesn't really matter. If you're doing something that's risking your or someone else's lives, you better be sure about the security aspects of a tool. Neither WhatsApp nor Signal are it because you're still trusting a 3rd party way more than is healthy for an operation like a coup. I've read some of the alleged chat logs, and the whole event looks haphazard and little planned. Therefore, it's no wonder that they would coordinate in an unsafe medium (WhatsApp). If what we're being told is the truth, that is.
- darawk 10y agoSo, you think they should have rolled their own secure messaging app before starting their coup?
- azernik 10y agoIf at least some of the intelligence apparatus had been on board, they could probably have used whatever tools are standard for professional spies.
- cookiecaper 10y agoThey probably should've gone old-school and kept their plots strictly to meatspace. It's a lot simpler that way. Any digital supplementation should've been seriously restrained, relying on pre-determined, inconspicuous code phrases buried within an otherwise innocuous conversation.
- cm3 10y agoYeah, and assuming the chat logs are real, they now have a hard time to construct plausible deniability after the fact. But, what the people of Turkey seem to ignore is that soldiers are trained to take orders, and there aren't many around who would refuse, even if they're opposed to the action.
- smaili 10y agoFor those wondering, it's an app called byLock - https://bylockapp.wordpress.com https://bylockapp.wordpress.com
- deleted 10y ago[deleted]
- sasas 10y agoFrom the app description [1] Extreme security with your fingerprint . Your fingerprint encrypts your call. Use this application for secure communication. This application uses industry leading encryption techniques .. Super Secure Free Calls available TFA states that the app author was listed as 'David Keynes of Beaverton, Oregon'. Looking at the text from the author's Wordpress site [2] and app description, one could possibly come to the conclusion that the author is not a native english speaker (or has substandard grammar skills). 'David Keynes' a non native english speaker? Putting that together with claims of 'Super Secure Free Calls'. Something doesn't add up here.. [1] https://apkpure.com/bylock-secure-chat-talk/net.client.by.lock https://apkpure.com/bylock-secure-chat-talk/net.client.by.lo... [2] https://bylockapp.wordpress.com/ https://bylockapp.wordpress.com/
- chendies 10y agoThere are also hardly any search queries on Google trends [1], and less than 10 total tweets in Turkish between 2014-01-01 and 2016-07-16 [2]. Very strange, indeed. [1] https://www.google.com/trends/explore?date=2014-01-01%202016-07-18&q=bylock https://www.google.com/trends/explore?date=2014-01-01%202016... [2] https://twitter.com/search?q=%22bylock%22%20lang%3Atr%20since%3A2014-01-01%20until%3A2016-07-15&src=typd https://twitter.com/search?q=%22bylock%22%20lang%3Atr%20sinc...
- mustaflex 10y agoone of the tweet says: beware people in the government, these guys use some app called bylock, I hope you haved "cracked" it already. another(from a gulenist it seems) says, guys don't use the same app for communications over and over, try to be more diverse (talk about an app called kakao)
- osaatcioglu 10y agoI was translating the same messages* :) Obviously, this app was known by public. So, I am not sure if they would risk themselves to use it to plan something illegal. Yet, things in Turkey are getting very amateurish in every aspects for the last decade. So, luckily for the sake of bits and pieces of Turkish democracy, this coup attempt was also amateurish. However; I have the tendency to believe that Erdoğan knew that they were working on something nasty and he might had even encouraged it indirectly. So that, he could control it and benefit from it. I must say that I have biased opinions against Erdoğan. *@pazartesi2014 says @kuscusencer ByLock programınıda umarım çözmüssünüzdür Reis paralelciler buna sardılar şimdi -- @kuscusencer I hope you have decrypted the ByLock app, Reis (an informal expression, meaning superior). Gulenci People have started use this. And this guy seems like from the movement @nifaksavar Arkadaslar sürekli aynı servis sağlayıcıyı kullanmayın bylock kakao vb.. --- Friends, don't always use the same service provider bylock, kakao etc..
- aaron695 10y agoVIA Reddit - Turkish Television shows secret codes from the coup which are actually GTA IV Cheat Codes http://i.imgur.com/D96MaPw.gifv http://i.imgur.com/D96MaPw.gifv I'm not sure stories from the region are always accurate....
- sasas 10y agoDo you have a link to the reddit thread to share?
- fatihpense 10y agoIt is funny and everyone in Turkey laughs at them. By the way this is a private television not state tv. There is also no clean hands right now. However these all shouldn't make this coup attempt seem less serious.
- fsniper 10y agoIt's so curious that, the coup attempters were advertised as using whatsapp on the 15th and the days following that. There were many screenshots of the aforementioned communications with hints to the events of the night, like, "Can someone get to the çamlıca and bring down all the anntenas?". These were probably true and were on the phones of the captured soldiers. http://www.ilgisel.com/uploads/8/2016/07/16/_578a394ac9c92.jpg http://www.ilgisel.com/uploads/8/2016/07/16/_578a394ac9c92.j... And now, they started using another app byLock? This smells like another attempt at falsifying data and diversion, which IMHO means they are creating false evidence for apprehending people they deem rivals. Currently there is an ongoing witch hunt in Turkey.
- afsina 10y agoAccording to the article, they abandoned using the application several months ago after they understand that it is compromised.
- fatihpense 10y agoAs far as I know, whatsapp group was between soldiers planning coup. Other app was used by a larger audience and has longer history.
- dovdov 10y agoAnd don't forget the GTA codes!! http://i.imgur.com/D96MaPw.gifv http://i.imgur.com/D96MaPw.gifv I wonder how much this Guardian article have cost.
- ersinesen 10y agoIt is apparent who pays for reports or articles: http://www.thetimes.co.uk/article/mp-paid-by-group-linked-to-turkey-coup-88x0s07vc http://www.thetimes.co.uk/article/mp-paid-by-group-linked-to... Do you have a secret agenda? What is your evidence or reasonning for such a claim?
- denfromufa 10y agoSo is this the evidence that is going to be submitted to US for extradition of Muhammed Fethullah Gülen?
- madaxe_again 10y agoWell, he's definitely guilty, so that should be fine - the TV said so, it's never wrong. You may be on to something there.
- ersinesen 10y agoFor those who claim the coup attempt was a theatre please watch: https://www.youtube.com/watch?v=MUBUInQK2us https://www.youtube.com/watch?v=MUBUInQK2us till the end if you can.
- throwaway7811 10y agoFor those under opression from the government it is not so easy to adopt the secure, but obscure solutions like GPG. The problem is that just installing GPG or setting up a secure communications hub can make you a target for further investigation. This discussion highlights how important it is that the normal messaging applications we use on daily basis become secure and protect the messages and identities of those communicating. This is not because you or I have something to hide or protect, but because other people in other countries do. And in order to keep themselves under the radar, they need to be using the same tools as we do.
- pknerd 10y agoNote for future coup plotters Next time either don't use technology or study a bit about the software security first before using it as a main communication channel.
- dharma1 10y agoChat groups, even if p2p and encrypted, are vulnerable. A single group member's unlocked phone can be captured, thus compromising all group communication
- TeMPOraL 10y agoShiny hipster chatapps from SV do not make the need for tried-and-true century-old OPSEC techniques disappear. Encryption in apps is not a replacement for compartmentalization, dividing into cells, using codenames, etc.
- fatihpense 10y agoThe thing is they were divided into cells, they were using codenames. I hope they made a mistake that reveals whole organisation in the app.
- ivoras 10y agoIt's important to remember that Turkish military in the post-empire had practically a mandate of rebelling against unconstitutional and Islamist governments. Their power to do so was largely removed recently ( https://en.m.wikipedia.org/wiki/Turkish_Armed_Forces https://en.m.wikipedia.org/wiki/Turkish_Armed_Forces)
- macspoofing 10y agoWhy is it important to remember that right now? I dislike Erdogan, but it isn't that simple. Did Erdogan really set up an unconstitutional Islamist government? Really really? You sound like you read the Wikipedia page last week.
- bitbanksy 10y agoNo wonder why Turkish police have raided the offices of the national science research council... The Scientific and Technological Research Council of Turkey (Tubitak) research projects in universities and the private sector and employs more than 1,500 researchers...
- al_chemist 10y agoI wouldn't trust Turkish proofs. They have a history of submitting fake evidence: http://rodrik.typepad.com/dani_rodriks_weblog/2012/10/did-microsoft-steal-its-fonts-from-the-turkish-army.html http://rodrik.typepad.com/dani_rodriks_weblog/2012/10/did-mi...
- vintermann 10y agoWhile you are at that blog, you might want to read Dani Rodrik's more recent discussions. FWIW, he does think Gulen was involved in the coup.
- hokkos 10y agoFor the WhatsApp part here is a detailed analysis :https://www.bellingcat.com/news/mena/2016/07/24/the-turkey-coup-through-the-eyes-of-its-plotters/ https://www.bellingcat.com/news/mena/2016/07/24/the-turkey-c...