3 ms·

The article buries the lede pretty badly. >The government’s explanatory note says that the Bill could force a manufacturer to ... install government software o

The article buries the lede pretty badly. >The government’s explanatory note says that the Bill could force a manufacturer to ... install government software on it If the bill passes, using a phone purchased in Australia is no longer secure. I know my security threat model excludes manufacturer-installed root kits - is there a reasonable strategy for mitigating this risk? Buying a phone in the US and importing it yourself is one, but that seems very awkward. edit: reading the actual text, there's some protection in section 317ZG, which prohibits the law from being used to cause "systematic weakness" or "systematic vulnerability", but explicitly carves out an exception for targeting specific devices. So for a specific example, the bill would allow the Australian government to compel Apple to secretly push an over-the-air update to backdoor a specific device of interest. >The mere fact that a capability to selectively assist agencies with access to a target device exists will not necessarily mean that a systemic weakness has been built. Yeah, the bill is definitely designed to allow exactly the scenario I described. They're after using the code-signing keys and technical expertise of device manufacturers and communication program developers to target individual devices with encryption backdoors. >Likewise, a notice may require a provider to facilitate access to information prior to or after an encryption method is employed, as this does not weaken the encryption itself. Definitely planning on backdooring devices and reading the messages pre-encryption and post-decryption.

rstuart4133 8y ago
> Definitely planning on backdooring devices and reading the messages pre-encryption and post-decryption. They actually explicitly said that was the aim. From https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla... : > This includes accessing communications at points where it is not encrypted. I am an Australian, and I have been listening to the Minister for months tell everybody they were going to do something about encryption, but then categorically ruling out weakening crypto with back doors. I wondered what he was on about. Now I know I guess. In case it's not obvious, they aren't just targeting phones. Anything with an app store or automatic updates is fair game. So this includes Microsoft updating Windows and Edge, Google updating Chrome and Chromebooks, and of course all of Apple's products. They don't have the expertise to write the software bugs to do this of course - but the bill allows for this by making provision for forcing the tech companies to provide whatever technical assistance is required (and encourages them to go further by providing voluntary assistance). I see a few comments here that seem to think that encryption on (eg, Signal, PGP, encrypted hard disks, bimetrics) will save you. The entire point of these provisions is to get to the data when it is not decrypted, which it must be if you want to use it. Nothing will save you on these devices - once the bug is installed they are an open book. Possibly more open than you imagine, as they can turn on the microphone, camera, gps without you knowing. Since there are commercial organisations they are targeting, I expect once they roll over they will do it in the most efficient way possible. Which is to say I expect it will be automated - something like the law enforcement agency will provide a MAC or some other unique identified and a few minutes later the bug is installed and sending data back. What that means it is will be highly centralised, meaning you can compromise just a few people and/or pieces of equipment and you have the keys to the entire thing. A spy machine that can track everyone - it's an impossibly attractive target. I can't imagine state actors like Russia or China not to turning a gift like that from the democracies into something useful. They are arguably sticking to the letter their promise not to back door encryption, but in reality they are legislating a centralised system that can see even banking password, everything you read, and everything you say, and everywhere you have been. It's pretty much the same outcome. Way to go, guys.
- cmroanirgo 8y ago
  > once they roll over they will do it in the most efficient way possible Yes. To be clear, Telstra has installed devices of mass surveillance. So, this new bill is about undoing the 'snowden world' as you suggest. From this article: https://theintercept.com/2016/10/23/endace-mass-surveillance-gchq-governments/ https://theintercept.com/2016/10/23/endace-mass-surveillance... This clearly shows how an Australian company was giving assistance in the construction of the hardware for a NZ company, Endace: https://theintercept.com/document/2016/10/23/medusa-weekly-status-report/ https://theintercept.com/document/2016/10/23/medusa-weekly-s... "Both prototype boards have been returned to Sourceman in Aussie with DDR memory issues and PCB baord issues" [Their typo]. Telstra has Endace hardware installed for the purpose of monitoring Australians: https://theintercept.com/document/2016/10/23/sprint-endace-lawful-intercept/ https://theintercept.com/document/2016/10/23/sprint-endace-l... "The packet capture abilities... sold to Telstra"
  - rstuart4133 8y ago
    A few years ago I read references to LEA Racks (Law Enforcement Agency Racks) being installed into every NBN POI. I think I saw it in the NBN design documents, but a few years later I could not find it again so who knows. After getting over the initial shock of the implications, I put my engineering hat on and then it was "of course there are LEA racks, you idiot". I presume when the TIA was written (1979) getting a tap involved filing a request with Telecom who then raised a work order for some department, and it wormed it's way down the management layers until some worker was directed to install the thing. If I was in charge of optimising that process, I too would have created LEA Racks, filled it with gear and told the LEA's "here, you look after it, and try not to bother me again". I'd be amazed if the process hasn't been automated to the extent ASIO doesn't now have a button in Canberra somewhere they can press to tap phone or internet connection. There is no doubt in my mind commercial forces will mean Apple, Google and Microsoft go down the same road. Someone who had a hand in drafting this bill has dreams of a future where the old telephone line taps will become part of ancient history - it's all done via bugs installed at the touch of a button onto the end users devices. I doubt their idea of utopia will last for very long. The likes of Russia and China must be delighted with the idea of democracies building a surveillance of the likes they could only dream about, and then handing it to them on a platter by just leaving it in control of just few humans easily manipulated with social engineering hacks, and a few machines they can focus enormous resources at cracking. That's if it lasts that long. It's trivially easy to bypass now by simply using Open Source. The timing is bad for them as Debian has just added the final nail making that all possible by creating the first ecosystem using repeatable builds. If anyone is wondering why Open Source is the solution - it's because the root cause of the problem is they are putting control in a central choke point. Compromise that choke point in a way that no one notices you have own whatever it controls. The people in charge believe they can fix that by heavily fortifying the choke point. But as the saying goes, every man has his price, as oddly does every computer and every SIM. If you are centralising, you are making the worth of what the choke point controls higher and higher, then eventually you will hit that price. They have created something that can reveal every banking password, every confidential email discussing corporate takeovers worth billions, all trade secrets and government secrets. Open source solves that (as indeed did world the TIA was born into with its work orders involving many people) by making the cost scale. Over time there are thousands of programmer looking at the source in Debian - that's why it's called Open. You have to compromise every one of those programmers.

rstuart4133 8y ago

> Definitely planning on backdooring devices and reading the messages pre-encryption and post-decryption. They actually explicitly said that was the aim. From https://www.homeaffairs.gov.au/consultations/Documents/explanatory-document.pdf https://www.homeaffairs.gov.au/consultations/Documents/expla... : > This includes accessing communications at points where it is not encrypted. I am an Australian, and I have been listening to the Minister for months tell everybody they were going to do something about encryption, but then categorically ruling out weakening crypto with back doors. I wondered what he was on about. Now I know I guess. In case it's not obvious, they aren't just targeting phones. Anything with an app store or automatic updates is fair game. So this includes Microsoft updating Windows and Edge, Google updating Chrome and Chromebooks, and of course all of Apple's products. They don't have the expertise to write the software bugs to do this of course - but the bill allows for this by making provision for forcing the tech companies to provide whatever technical assistance is required (and encourages them to go further by providing voluntary assistance). I see a few comments here that seem to think that encryption on (eg, Signal, PGP, encrypted hard disks, bimetrics) will save you. The entire point of these provisions is to get to the data when it is not decrypted, which it must be if you want to use it. Nothing will save you on these devices - once the bug is installed they are an open book. Possibly more open than you imagine, as they can turn on the microphone, camera, gps without you knowing. Since there are commercial organisations they are targeting, I expect once they roll over they will do it in the most efficient way possible. Which is to say I expect it will be automated - something like the law enforcement agency will provide a MAC or some other unique identified and a few minutes later the bug is installed and sending data back. What that means it is will be highly centralised, meaning you can compromise just a few people and/or pieces of equipment and you have the keys to the entire thing. A spy machine that can track everyone - it's an impossibly attractive target. I can't imagine state actors like Russia or China not to turning a gift like that from the democracies into something useful. They are arguably sticking to the letter their promise not to back door encryption, but in reality they are legislating a centralised system that can see even banking password, everything you read, and everything you say, and everywhere you have been. It's pretty much the same outcome. Way to go, guys.

cmroanirgo 8y ago
> once they roll over they will do it in the most efficient way possible Yes. To be clear, Telstra has installed devices of mass surveillance. So, this new bill is about undoing the 'snowden world' as you suggest. From this article: https://theintercept.com/2016/10/23/endace-mass-surveillance-gchq-governments/ https://theintercept.com/2016/10/23/endace-mass-surveillance... This clearly shows how an Australian company was giving assistance in the construction of the hardware for a NZ company, Endace: https://theintercept.com/document/2016/10/23/medusa-weekly-status-report/ https://theintercept.com/document/2016/10/23/medusa-weekly-s... "Both prototype boards have been returned to Sourceman in Aussie with DDR memory issues and PCB baord issues" [Their typo]. Telstra has Endace hardware installed for the purpose of monitoring Australians: https://theintercept.com/document/2016/10/23/sprint-endace-lawful-intercept/ https://theintercept.com/document/2016/10/23/sprint-endace-l... "The packet capture abilities... sold to Telstra"
- rstuart4133 8y ago
  A few years ago I read references to LEA Racks (Law Enforcement Agency Racks) being installed into every NBN POI. I think I saw it in the NBN design documents, but a few years later I could not find it again so who knows. After getting over the initial shock of the implications, I put my engineering hat on and then it was "of course there are LEA racks, you idiot". I presume when the TIA was written (1979) getting a tap involved filing a request with Telecom who then raised a work order for some department, and it wormed it's way down the management layers until some worker was directed to install the thing. If I was in charge of optimising that process, I too would have created LEA Racks, filled it with gear and told the LEA's "here, you look after it, and try not to bother me again". I'd be amazed if the process hasn't been automated to the extent ASIO doesn't now have a button in Canberra somewhere they can press to tap phone or internet connection. There is no doubt in my mind commercial forces will mean Apple, Google and Microsoft go down the same road. Someone who had a hand in drafting this bill has dreams of a future where the old telephone line taps will become part of ancient history - it's all done via bugs installed at the touch of a button onto the end users devices. I doubt their idea of utopia will last for very long. The likes of Russia and China must be delighted with the idea of democracies building a surveillance of the likes they could only dream about, and then handing it to them on a platter by just leaving it in control of just few humans easily manipulated with social engineering hacks, and a few machines they can focus enormous resources at cracking. That's if it lasts that long. It's trivially easy to bypass now by simply using Open Source. The timing is bad for them as Debian has just added the final nail making that all possible by creating the first ecosystem using repeatable builds. If anyone is wondering why Open Source is the solution - it's because the root cause of the problem is they are putting control in a central choke point. Compromise that choke point in a way that no one notices you have own whatever it controls. The people in charge believe they can fix that by heavily fortifying the choke point. But as the saying goes, every man has his price, as oddly does every computer and every SIM. If you are centralising, you are making the worth of what the choke point controls higher and higher, then eventually you will hit that price. They have created something that can reveal every banking password, every confidential email discussing corporate takeovers worth billions, all trade secrets and government secrets. Open source solves that (as indeed did world the TIA was born into with its work orders involving many people) by making the cost scale. Over time there are thousands of programmer looking at the source in Debian - that's why it's called Open. You have to compromise every one of those programmers.