3 ms·

> Thus, I think the correct reaction to this is more towards the "oops... that wasn't a good idea" than "everybody panic!" "Oop..."? - Is that what you'd write

by jlg23 9y ago

> Thus, I think the correct reaction to this is more towards the "oops... that wasn't a good idea" than "everybody panic!" "Oop..."? - Is that what you'd write on the graves of dissidents whose efforts to communicate securely were subverted by a keylogger in an audio driver? Too much over the top? The HN-compatible version: Actual reverse engineering can be punished by law in most of the first world (through the illegal status of tools that can be used to circumvent access restrictions). Of course, this is close to impossible to prove when all you publish is the security advisory and thus nobody really cares. "Oops..." someone accidentally just made a recording & backup of all the evidence against you :) There is no "correct" reaction, only individually justified reactions and if you can afford to just say "oops..." you may consider yourself lucky.

sillysaurus3 9y ago
"Oop..."? - Is that what you'd write on the graves of dissidents whose efforts to communicate securely were subverted by a keylogger in an audio driver? A smart dissident wouldn't be using a Windows laptop to write things that could get themselves killed. It's not a diss on Windows, but rather basic opsec: if you want to be secure, you need to know what every part of your system is doing. Or at least rely on the fact that open source maintainers have examined every part of the system. One basic protection is to boot into Tails, where an audio driver like this won't have an effect.
- alphonsegaston 9y ago
  Under authoritarianism, one's status as a dissident exists entirely at the whims of the regime. If you're recommending everyone use Tails after the pattern of someone like Stallman, I get your point. Otherwise, you're putting some absurd standard on people who might be otherwise be incredibly courageous but lack technical understanding to a degree that seems like victim-blaming.
  - sillysaurus3 9y ago
    It's an observation that if you're using a stock Windows installation to post inflammatory remarks about the regime you live under, you're gonna have a bad time. An audio driver logging your keystrokes is 0.1% of your concern at best. Of course dissidents are courageous and deserve sympathy. That's not quite the point, though.
    - jlg23 9y ago
      Yes, the victims should have known. I strongly suspect (and hope) that you are just trolling, so in a very short form: * "It's an observation" that you eat babies. This statement is just as valid as yours. I mean, "it's an observation" (tm). Read: Well, duh, yeah, whatever you say. Come back when you have a point. * "posting inflammatory remarks" is not activism. Activists have no time for this BS, they do actual political work. * Spend a few weeks in a developing country before you give advice to people who live there. Here in my house I can get you an apartment for $200/mo (2 bedrooms, hot water, gas, electricity and "internet" inclusive). But be aware: Best phone you can purchase in a 3h-radius runs Android 4; next place to buy a laptop that halfway works as expected with a vanilla linux distro: 6 to 10h driving. Modern hardware costs at least twice as much as in 1st world. * Before talking, take over responsibility for OPSEC in a place like mine: Nobody within hours that can help someone with a problem with tails but me (well, you, since you just volunteered); next linux-expert? At least a day's travel. Still want to advise for a non win/osx-solution? I'm looking forward to hear why and how this should work. Too much work? Well, then at least show me that at least half of your friends and family adhere to the standards you expect from unknown people who live in circumstance you obviously have no clue about. Until you do that: You're trolling. PS: I've been teaching OPSEC to activist since 1996. I'm using Linux since 1997 and FreeBSD since 1999. I happen to know a thing or two about windows as well.
problems 9y ago
This is just an escalation attack, not one which is remotely exploitable. You still need access to the machine in order to take advantage of this and by the time you have access to the machine you can run your own keylogger if you'd like. The only increased risk here is the ability to look back into the past. Which is bad on its own, but let's not exaggerate. This didn't get any dissidents killed. Nor is it likely to.

by jlg23 9y ago

sillysaurus3 9y ago

"Oop..."? - Is that what you'd write on the graves of dissidents whose efforts to communicate securely were subverted by a keylogger in an audio driver? A smart dissident wouldn't be using a Windows laptop to write things that could get themselves killed. It's not a diss on Windows, but rather basic opsec: if you want to be secure, you need to know what every part of your system is doing. Or at least rely on the fact that open source maintainers have examined every part of the system. One basic protection is to boot into Tails, where an audio driver like this won't have an effect.

alphonsegaston 9y ago
Under authoritarianism, one's status as a dissident exists entirely at the whims of the regime. If you're recommending everyone use Tails after the pattern of someone like Stallman, I get your point. Otherwise, you're putting some absurd standard on people who might be otherwise be incredibly courageous but lack technical understanding to a degree that seems like victim-blaming.
- sillysaurus3 9y ago
  It's an observation that if you're using a stock Windows installation to post inflammatory remarks about the regime you live under, you're gonna have a bad time. An audio driver logging your keystrokes is 0.1% of your concern at best. Of course dissidents are courageous and deserve sympathy. That's not quite the point, though.
  - jlg23 9y ago
    Yes, the victims should have known. I strongly suspect (and hope) that you are just trolling, so in a very short form: * "It's an observation" that you eat babies. This statement is just as valid as yours. I mean, "it's an observation" (tm). Read: Well, duh, yeah, whatever you say. Come back when you have a point. * "posting inflammatory remarks" is not activism. Activists have no time for this BS, they do actual political work. * Spend a few weeks in a developing country before you give advice to people who live there. Here in my house I can get you an apartment for $200/mo (2 bedrooms, hot water, gas, electricity and "internet" inclusive). But be aware: Best phone you can purchase in a 3h-radius runs Android 4; next place to buy a laptop that halfway works as expected with a vanilla linux distro: 6 to 10h driving. Modern hardware costs at least twice as much as in 1st world. * Before talking, take over responsibility for OPSEC in a place like mine: Nobody within hours that can help someone with a problem with tails but me (well, you, since you just volunteered); next linux-expert? At least a day's travel. Still want to advise for a non win/osx-solution? I'm looking forward to hear why and how this should work. Too much work? Well, then at least show me that at least half of your friends and family adhere to the standards you expect from unknown people who live in circumstance you obviously have no clue about. Until you do that: You're trolling. PS: I've been teaching OPSEC to activist since 1996. I'm using Linux since 1997 and FreeBSD since 1999. I happen to know a thing or two about windows as well.

problems 9y ago

This is just an escalation attack, not one which is remotely exploitable. You still need access to the machine in order to take advantage of this and by the time you have access to the machine you can run your own keylogger if you'd like. The only increased risk here is the ability to look back into the past. Which is bad on its own, but let's not exaggerate. This didn't get any dissidents killed. Nor is it likely to.