8 ms·

Another Hacker’s Laptop, Cell Phones Searched at Border

174 points by philipn 16y ago

pavel_lishin 16y ago
If I were him, I'd be tempted to make an image of his drive, and compare that to an image made after the agents tampered with it, to see what changes occurred in the process. But like he said, he couldn't even trust them physically. I'd be tempted to just toss them in the trash, if I could afford to easily replace them.
- tptacek 16y ago
  There's approximately 16 zillion places to stash code on a modern PC. You don't need to touch the hardware to make disk imaging ineffective.
  - nym 16y ago
    Can you explain?
    - morganpyne 16y ago
      I'm guessing he's referring to the possibility of putting code in one of the following places: motherboard BIOS (http://arstechnica.com/security/news/2009/03/researchers-demonstrate-bios-level-rootkit-attack.ars) other peripheral BIOS (keyboard anyone? http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/) additional hidden attached solid-state storage etc... Although, this does involve touching the hardware, just not the harddisk so perhaps I misunderstand also.
    - callahad 16y ago
      http://blog.ksplice.com/2010/10/hosting-backdoors-in-hardware/ http://blog.ksplice.com/2010/10/hosting-backdoors-in-hardwar... is interesting
- seltzered 16y ago
  I'd rather consider using truecrypt and do plausible deniability, and own hardware I don't have to get too emotional about keeping.
  - pavel_lishin 16y ago
    Sure, but the OS itself still has to be unencrypted, or at least the boot sector, right? Can't trust that, either, right?
    - AngryParsley 16y ago
      Yes, some code has to be unencrypted to use the passphrase to decrypt the rest of the disk. People who are serious about security will boot off a known-good USB drive or CD.
- mbreese 16y ago
  I'd just start FedEx'ing things and just take a book... Perhaps travel with just a SIM card and pickup a new phone when I landed. That's about the only thing you could really start to do.
  - jarin 16y ago
    You'll have to buy toner cartridges at your destination too, probably not a good idea to ship those anymore.
  - eli 16y ago
    I've heard that this is SOP for international lawyers. They don't want some border agent sniffing around confidential legal files.
    - bhousel 16y ago
      Yes, you heard correctly. I remember a talk at a past LegalTech conference where the panelists urged anyone doing a lot of traveling (especially to 'sensitive' parts of the world) to simply travel with a 'spare' laptop, and keep everything important on encrypted USB drives, which can be sent through the mail in tamper-resistant packaging. It solves several problems: 1. Confidential data won't be compromised during a border search, theft, accident, etc.. 2. You avoid the issue of being forced to give up your passwords to law enforcement. 3. If the laptop is confiscated, it can take months to get it back, so you wouldn't want that to happen to your main work machine.
- ralphc 16y ago
  Or just sell them, make back some of his investment, and have the people on the other end wonder why he's trading recipes or saying "OMG did you see that dress Kaitlin was wearing???".
jwu711 16y ago
That's completely ridiculous. Makes me want to travel even less now ...
- nubian 16y ago
  "The Fourth Amendment to the Constitution contains a border-related exception to unreasonable search and seizure laws, permitting searches at border checkpoints that wouldn't be permitted elsewhere. But federal statute 8 CFR 287.1 (a)(1-3) defines the border zone for enforcement purposes as encompassing an area within 100 miles of the actual border, with the possibility of extending it further under certain circumstances. This means that the US Border Patrol could conceivably set up random checkpoints asking travelers for a passport in places like Columbus, Ohio; Houston; or anywhere in the state of Florida. And, in fact, it appears that it has been doing exactly this." http://arstechnica.com/security/news/2008/10/aclu-23-of-us-population-lives-in-constitution-free-zone.ars http://arstechnica.com/security/news/2008/10/aclu-23-of-us-p...
  - wnoise 16y ago
    Well, it's not so much "contains" as "has had read into it".
mmaunder 16y ago
Border search exception (to the 4th amendment warrant requirement): http://en.wikipedia.org/wiki/Border_search_exception http://en.wikipedia.org/wiki/Border_search_exception In a similar vein, check out Exigent Circumstance: http://en.wikipedia.org/wiki/Exigent_circumstances http://en.wikipedia.org/wiki/Exigent_circumstances The text of the fourth amendment to the constitution: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."
- nubian 16y ago
  The government has decided that the "border" extends 100 miles inland from official land/sea borders. This apparently covers 2/3rds to 4/5ths of the U.S. population. Coverage on the 100-mile-thick ACLU-dubbed "Constitution-Free Zone": Wired: http://www.wired.com/threatlevel/2008/10/aclu-assails-10/ http://www.wired.com/threatlevel/2008/10/aclu-assails-10/ Ars Technica: http://arstechnica.com/security/news/2008/10/aclu-23-of-us-population-lives-in-constitution-free-zone.ars http://arstechnica.com/security/news/2008/10/aclu-23-of-us-p... (Note the entire land area of the Hawaiian islands are covered, as is the entire state of Florida.) I think it's probably even worse than that, though, because International airports count as "borders" no matter how far inland. So I would not be surprised to see this extended to a 100-mile radius of all international airports as well, which would cover almost everybody.
  - _delirium 16y ago
    I remember being pretty surprised by this when I was a kid, and we had to stop at a checkpoint on I-10 in West Texas, where it turns away from the Mexican border (eastbound) to head into central Texas. I recall thinking that it must be some sort of emergency, like they were looking for an escaped criminal or something, because surely those kinds of checkpoints aren't allowed in a free country in routine circumstances?
  - smackfu 16y ago
    This case was actually at the border though, which no one would dispute falls under the specific Constitutional item.
Super74 16y ago
Let me get this straight. This is a person who has openly admitted to knowing how to hack banking systems among others, then travels to countries like Abu Dhabi and the Dominican Republic to present that information. We are surprised that he is searched at the border to the US? He was treated politely, not physically harmed and had his hardware returned. Sounds like the government is finally doing their job. Maybe there are "certain" people out there throwing his name around and the government was obligated to look into this. I would not support gross negligence by our government and this sounds like normal procedure to me, given the extenuating circumstances.
- blhack 16y ago
  I think it would have been less of a problem if they had allowed him to be present while they were searching his hardware.
- jdp23 16y ago
  i suspect that many people on HN have the skills to break into quite a few computer systems, and travel to places that are hotbeds of computer crime such as New York, SF, and of course internationally. does that mean we should all be detained and have our computers ad phones taken away and searched whenever we go within 100 miles of a border?
  - ghostwunder 16y ago
    a good number of us don't have wired writing about us. a good number of us don't care enough. a good number of us are just cooler versions of dilbert. being detained really means free coffee and donuts.
  - bhickey 16y ago
    You're right, this place is rife with technological supermen. Give me a sawzall and an acetylene torch and I could 'hack' the Gibson.
- updog 16y ago
  No, try again. You did not "get it straight" at all. You seem to have a strong (negative) opinion on the matter, yet you demonstrate a very poor grasp of some basic infosec concepts. You should perhaps consider reserving judgement when that is the case. Not only did he NOT "admit to knowing how to hack banking systems", but he was not presenting anything related to that in Abu Dhabi. He was speaking, ironically enough, on privacy. Last year he demonstrated a weakness in how website encryption is handled. He did not hack any banks. Banks, among other things, use HTTPS, so the author used them as an easy example. This also does not breach those sites in any way, it just allows for eavesdropping and attacking end users. Here is why your short-sighted attitude towards legitimate security research is highly foolish. There are people who find and disclose these vulnerabilities and work with vendors to fix them (indeed, Moxie ensured that his bug was fixed before he even went public with it). There are also people who do NOT work to get them fixed, keep them underground, and use them to exploit people. So, you vilify and harass the guys getting the bugs fixed and they drop out of the game. Who does that leave as the only group in possession of that information? Yeah, now your networks and your infrastructure is getting owned, and there is no one left to tell you how or why. If you think the "bad guys" DON'T already have this knowledge, and are not using it to their advantage, you are very mistaken.
snissn 16y ago
slightly relevant: To protect his privacy and that of his clients, Mitnick encrypts all the confidential data on his laptops, transmits it over the Internet for storage on servers in the U.S., and wipes it from the computer before returning from any international trips, just in case officials decide to search or seize his equipment. He also encrypts his hard drive. And now, he says he is going to keep a "clone" of his MacBook at home so he will have an exact duplicate of it if it is ever seized. http://news.cnet.com/8301-1009_3-10054569-83.html http://news.cnet.com/8301-1009_3-10054569-83.html
- sev 16y ago
  Why would he tell people where he keeps the clone?
  - davidwparker 16y ago
    To make people think he's keeping it there but he really isn't? A bluff?
    - sev 16y ago
      That's what I thought for a sec...and then realized he probably wouldn't prefer to be searched, even if they weren't going to find anything.
    - RyanMcGreal 16y ago
      I thought analysts took a dim view of security by obscurity.
      - ams6110 16y ago
        I think the dim view is on using obscurity as your only or main security approach. However leading attackers down blind alleys, in addition to having real security measures in place, doesn't seem to me to be entirely worthless (IANA Security Analyst).
  - philwelch 16y ago
korch 16y ago
I wish this unconstitutional and overly broad border search policy would be cancelled. Besides the chilling effect on the broader American surveillance society, it's also not very useful, and is even dangerous to national security. Only dumb criminals and people of interest are going to actually keep real data on their computing devices when crossing the US border. The smart ones will use any of the innumerable, trivial counter measures. Border searches like this also opens the US up to a counter-intel attack. There's nothing to stop foreign agents from planting fake intel they want intercepted at the border, then watching what the watchers do with it, and thereby inferring how the US knows what they know. I wouldn't worry about any kind of hyperbolic, sci-fi eavesdropping bugs being installed surreptitiously on personal hardware. The chances of their bugs being found, reversed engineered, and then used against them is too great of a risk for the US to regularly bug traveller's computers. So almost all of this Constitutionally questionable seized data is useless, and not even worth collecting at the border. Besides, there are far more efficient and precise means of getting the data of targeted people than using airports for dragnets. Ultimately the government's policy is just more ineffective security theater pandering to the terrorism hysteria and the defense industry profits. It's a total waste of our tax budget, needless harassment of citizens of the world, and it helps the growing culture of xenophobia in America more than it helps actual law enforcement.
blhack 16y ago
Interestingly, I just had a discussion with my roomate about this. We were sitting in a coffee shop, and he was mad at himself because he forgot the latest copy of a game he is working on at the house... Why is this a problem at all anymore? Hosting is cheaap. I have a linux VPS at linode that I pay $20/mo for and almost everything that i do is stored there. Honestly, the only things I can think of that aren't stored on that machine (which trades nightly rsyncs with another machine with a different provider and on a different network) are minecraft, my music collection, some photos, and a journal that I just started keeping a couple of weeks ago (gets encrypted with 256bit AES and lives in the home dir on my laptop). My point is that there is absolutely no reason to keep anything on your local machine anymore, at least not ones that I can think of. Why not keep a server in the basement, and then just run SSH with X11 forwarding? Keep a cheap, disposable machine with you and if something like this happens, sell it and buy a new one. It's really sad that this is even an issue, but I do think that there are solutions to it.
- mcav 16y ago
  Do you do your work on that linode directly (via ssh), or do you just use it for syncing?
  - blhack 16y ago
    Directly via SSH.
- SoftwareMaven 16y ago
  There's no excuse for data loss, but the inconvenience of trying to work remotely from an aircraft is very significant (heck, it wasn't even possible a couple of years ago). Sad that Obama has continued the Bush legacy of trouncing our freedoms at the border. There needs to be a better balance between government power and civil rights at the border that still allows the government to manage what is coming and going.
- kristiandupont 16y ago
  Funny, I keep a lot of stuff local because I want to make sure I have access to it when I am out somewhere, but my music collection is now http://www.grooveshark.com http://www.grooveshark.com
lusis 16y ago
I was a bit surprised by the fact that he didn't want his name revealed in the article. It's not like some people don't know who he is. [edit] decided to respect Moxie's request in the article and remove a small bit of identifiable info
- _corbett 16y ago
  as he goes by Moxie socially as well, doesn't want his true name to be revealed is a bit sensational
  - lusis 16y ago
    True. I guess unless he's legally changed his name the feds and anyone who's cut him a check obviously already knows who he is.
dalore 16y ago
> “I can’t trust any of these devices now,” says Marlinspike, who asked that Threat Level not report his real name. “They could have modified the hardware or installed new keyboard firmware.” I thought when you get searched they have to keep your possessions within your view at all times.
- Zak 16y ago
  I believe that's generally true for the TSA, but not customs.
jdietrich 16y ago
It could be worse. Here in the UK, they would have locked him up for refusing to hand over his passwords. The Regulation of Investigatory Powers Act makes it a specific criminal offence and people have been imprisoned for it. Personally, I'm worried that I might get locked up for refusing to decrypt the contents of /dev/urandom. I think we need to wake up to the fact that there are a lot of people in power who would prefer that strong cryptography be the exclusive preserve of government.
- husein10 16y ago
  Just bc those in power prefer something does not mean that their systems have the ability to enforce these preferences. Whitfield Diffie showed the world that cryptography is NOT the exclusive preserve of the government.
- mbreese 16y ago
  You know, if you ever wanted to keep something really hidden, naming it /dev/urandom (or some variant thereof) would be a good way to go.
  - weavejester 16y ago
    Or perhaps "one-time-pad.txt" :)
    - alextgordon 16y ago
      You could actually encrypt your data using a standard algorithm, then construct a "pad" such that they combine to make a seemingly benign plaintext. No way to prove that your ciphertext is anything other than the other half of the pad (though I'm not a cryptographer :) ).
- LiveTheDream 16y ago
  TrueCrypt has a plausible deniability feature[1] which would allow you to provide an alternate password to your encrypted drive which opens a safe container (e.g. no secret stuff). [1] http://www.truecrypt.org/docs/?s=plausible-deniability http://www.truecrypt.org/docs/?s=plausible-deniability
jwr 16y ago
I find it amazing that there is so little outrage at what is happening in the USA. The country that paints itself as an example of freedom and democracy and aspires to spreading those values around the world is the same country that: * kidnaps and tortures people, * sets up a military prison with no civillian oversight, outside any legal jurisdiction, where it keeps people indefinitely, * kills people in various countries using missiles launched from drones, * interrogates its citizens as they come back from abroad, threatening them with detention or not letting them into the country, * tightly controls the media and what information gets released from war zones, * has a lawless "zone" extending 100 miles from its border, where laws are unclear, and people can be searched without warrant, * seizes computers, accesses and copies data, threatens people so that they give up their passwords, * uses scare tactics on security researchers (see story above) and whistleblowers (see all the wikileaks stories) I come from a former-communist country that was under the Soviet influence. We fortunately no longer are. I think what I listed above is very visible to people like me, but somehow it goes under the radar of most Americans. I see it as classical secret police tactics, utilized in all totalitarian regimes, while Americans seem to see it as a necessary nuisance to "combat terrorism". I find it even more amazing that instead of fighting back, people just discuss workarounds. Ship your data via FedEx, keep it online, wipe your drives, carry a laptop with an empty drive… This works today, but the way things are developing, it might not work tomorrow! Wake up, people. In comparison to things I listed above the whole ridiculous story about the "naked scanners" is just a joke.
- RyanMcGreal 16y ago
  What amazes me is that the great swath of Obama supporters who decried the Bush administration's civil rights abuses are strangely quiet about the continuation of those abuses today. (Caveat: I'm not American, but if I was, I would have held my nose and voted for Obama in 2008.)
  - jwr 16y ago
    But look at the greater problem: Obama or not, people don't actually do anything. Sure, there will be some forum discussions, but that's pretty much it. The EFF and ACLU seem to be the only organized movements that actually try to do anything. In the political landscape these issues just do not appear.
husein10 16y ago
A word of caution to those keeping data on 3rd party machines... http://www.schneier.com/blog/archives/2007/06/third_party_con.html http://www.schneier.com/blog/archives/2007/06/third_party_co... Also, note that this article is from 2007 and the law may have changed slightly since then.
ahi 16y ago
Seems like they buried the lede. In the simple minds of the Feds he was connected to the Wikileaks crew.
alanh 16y ago
Things like this, along with laptop theft, are excellent reasons to encrypt your home folder. This is pretty easy with built-in software on both Windows 7 & Mac OS X (and I’m sure common Linux distros). One caveat is that encrypted home folders tend to take maybe 1.2× the space of an unencrypted home folder, so delete some videos & music if you’re on an SSD or otherwise constrained HDD.
Mithrandir 16y ago
http://www.googlesharing.net/ http://www.googlesharing.net/ Moxie's awesome addon/proxy.
ck2 16y ago
If it took them "a few hours" then essentially they cloned the hard drive, sector based.
cakeface 16y ago
I wonder if the government is targeting this hacker for his involvement in Whisper Systems, http://www.whispersys.com/ http://www.whispersys.com/. Their main products are easy to use encryption software for calls and texts on android smartphones. From what I can recall the gov really does not want ubiquitous encryption for voice communication in the US. It totally breaks down the whole wiretapping paradigm.

174 points by philipn 16y ago

If I were him, I'd be tempted to make an image of his drive, and compare that to an image made after the agents tampered with it, to see what changes occurred in the process. But like he said, he couldn't even trust them physically. I'd be tempted to just toss them in the trash, if I could afford to easily replace them.

tptacek 16y ago
There's approximately 16 zillion places to stash code on a modern PC. You don't need to touch the hardware to make disk imaging ineffective.
- nym 16y ago
  Can you explain?
  - morganpyne 16y ago
    I'm guessing he's referring to the possibility of putting code in one of the following places: motherboard BIOS (http://arstechnica.com/security/news/2009/03/researchers-demonstrate-bios-level-rootkit-attack.ars) other peripheral BIOS (keyboard anyone? http://www.semiaccurate.com/2009/07/31/apple-keyboard-firmware-hack-demonstrated/) additional hidden attached solid-state storage etc... Although, this does involve touching the hardware, just not the harddisk so perhaps I misunderstand also.
  - callahad 16y ago
    http://blog.ksplice.com/2010/10/hosting-backdoors-in-hardware/ http://blog.ksplice.com/2010/10/hosting-backdoors-in-hardwar... is interesting
seltzered 16y ago
I'd rather consider using truecrypt and do plausible deniability, and own hardware I don't have to get too emotional about keeping.
- pavel_lishin 16y ago
  Sure, but the OS itself still has to be unencrypted, or at least the boot sector, right? Can't trust that, either, right?
  - AngryParsley 16y ago
    Yes, some code has to be unencrypted to use the passphrase to decrypt the rest of the disk. People who are serious about security will boot off a known-good USB drive or CD.
mbreese 16y ago
I'd just start FedEx'ing things and just take a book... Perhaps travel with just a SIM card and pickup a new phone when I landed. That's about the only thing you could really start to do.
- jarin 16y ago
  You'll have to buy toner cartridges at your destination too, probably not a good idea to ship those anymore.
- eli 16y ago
  I've heard that this is SOP for international lawyers. They don't want some border agent sniffing around confidential legal files.
  - bhousel 16y ago
    Yes, you heard correctly. I remember a talk at a past LegalTech conference where the panelists urged anyone doing a lot of traveling (especially to 'sensitive' parts of the world) to simply travel with a 'spare' laptop, and keep everything important on encrypted USB drives, which can be sent through the mail in tamper-resistant packaging. It solves several problems: 1. Confidential data won't be compromised during a border search, theft, accident, etc.. 2. You avoid the issue of being forced to give up your passwords to law enforcement. 3. If the laptop is confiscated, it can take months to get it back, so you wouldn't want that to happen to your main work machine.
ralphc 16y ago
Or just sell them, make back some of his investment, and have the people on the other end wonder why he's trading recipes or saying "OMG did you see that dress Kaitlin was wearing???".

jwu711 16y ago

That's completely ridiculous. Makes me want to travel even less now ...

nubian 16y ago
"The Fourth Amendment to the Constitution contains a border-related exception to unreasonable search and seizure laws, permitting searches at border checkpoints that wouldn't be permitted elsewhere. But federal statute 8 CFR 287.1 (a)(1-3) defines the border zone for enforcement purposes as encompassing an area within 100 miles of the actual border, with the possibility of extending it further under certain circumstances. This means that the US Border Patrol could conceivably set up random checkpoints asking travelers for a passport in places like Columbus, Ohio; Houston; or anywhere in the state of Florida. And, in fact, it appears that it has been doing exactly this." http://arstechnica.com/security/news/2008/10/aclu-23-of-us-population-lives-in-constitution-free-zone.ars http://arstechnica.com/security/news/2008/10/aclu-23-of-us-p...
- wnoise 16y ago
  Well, it's not so much "contains" as "has had read into it".

mmaunder 16y ago

Border search exception (to the 4th amendment warrant requirement): http://en.wikipedia.org/wiki/Border_search_exception http://en.wikipedia.org/wiki/Border_search_exception In a similar vein, check out Exigent Circumstance: http://en.wikipedia.org/wiki/Exigent_circumstances http://en.wikipedia.org/wiki/Exigent_circumstances The text of the fourth amendment to the constitution: "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized."

nubian 16y ago
The government has decided that the "border" extends 100 miles inland from official land/sea borders. This apparently covers 2/3rds to 4/5ths of the U.S. population. Coverage on the 100-mile-thick ACLU-dubbed "Constitution-Free Zone": Wired: http://www.wired.com/threatlevel/2008/10/aclu-assails-10/ http://www.wired.com/threatlevel/2008/10/aclu-assails-10/ Ars Technica: http://arstechnica.com/security/news/2008/10/aclu-23-of-us-population-lives-in-constitution-free-zone.ars http://arstechnica.com/security/news/2008/10/aclu-23-of-us-p... (Note the entire land area of the Hawaiian islands are covered, as is the entire state of Florida.) I think it's probably even worse than that, though, because International airports count as "borders" no matter how far inland. So I would not be surprised to see this extended to a 100-mile radius of all international airports as well, which would cover almost everybody.
- _delirium 16y ago
  I remember being pretty surprised by this when I was a kid, and we had to stop at a checkpoint on I-10 in West Texas, where it turns away from the Mexican border (eastbound) to head into central Texas. I recall thinking that it must be some sort of emergency, like they were looking for an escaped criminal or something, because surely those kinds of checkpoints aren't allowed in a free country in routine circumstances?
- smackfu 16y ago
  This case was actually at the border though, which no one would dispute falls under the specific Constitutional item.

Super74 16y ago

Let me get this straight. This is a person who has openly admitted to knowing how to hack banking systems among others, then travels to countries like Abu Dhabi and the Dominican Republic to present that information. We are surprised that he is searched at the border to the US? He was treated politely, not physically harmed and had his hardware returned. Sounds like the government is finally doing their job. Maybe there are "certain" people out there throwing his name around and the government was obligated to look into this. I would not support gross negligence by our government and this sounds like normal procedure to me, given the extenuating circumstances.

blhack 16y ago
I think it would have been less of a problem if they had allowed him to be present while they were searching his hardware.
jdp23 16y ago
i suspect that many people on HN have the skills to break into quite a few computer systems, and travel to places that are hotbeds of computer crime such as New York, SF, and of course internationally. does that mean we should all be detained and have our computers ad phones taken away and searched whenever we go within 100 miles of a border?
- ghostwunder 16y ago
  a good number of us don't have wired writing about us. a good number of us don't care enough. a good number of us are just cooler versions of dilbert. being detained really means free coffee and donuts.
- bhickey 16y ago
  You're right, this place is rife with technological supermen. Give me a sawzall and an acetylene torch and I could 'hack' the Gibson.
updog 16y ago
No, try again. You did not "get it straight" at all. You seem to have a strong (negative) opinion on the matter, yet you demonstrate a very poor grasp of some basic infosec concepts. You should perhaps consider reserving judgement when that is the case. Not only did he NOT "admit to knowing how to hack banking systems", but he was not presenting anything related to that in Abu Dhabi. He was speaking, ironically enough, on privacy. Last year he demonstrated a weakness in how website encryption is handled. He did not hack any banks. Banks, among other things, use HTTPS, so the author used them as an easy example. This also does not breach those sites in any way, it just allows for eavesdropping and attacking end users. Here is why your short-sighted attitude towards legitimate security research is highly foolish. There are people who find and disclose these vulnerabilities and work with vendors to fix them (indeed, Moxie ensured that his bug was fixed before he even went public with it). There are also people who do NOT work to get them fixed, keep them underground, and use them to exploit people. So, you vilify and harass the guys getting the bugs fixed and they drop out of the game. Who does that leave as the only group in possession of that information? Yeah, now your networks and your infrastructure is getting owned, and there is no one left to tell you how or why. If you think the "bad guys" DON'T already have this knowledge, and are not using it to their advantage, you are very mistaken.

snissn 16y ago

slightly relevant: To protect his privacy and that of his clients, Mitnick encrypts all the confidential data on his laptops, transmits it over the Internet for storage on servers in the U.S., and wipes it from the computer before returning from any international trips, just in case officials decide to search or seize his equipment. He also encrypts his hard drive. And now, he says he is going to keep a "clone" of his MacBook at home so he will have an exact duplicate of it if it is ever seized. http://news.cnet.com/8301-1009_3-10054569-83.html http://news.cnet.com/8301-1009_3-10054569-83.html

sev 16y ago
Why would he tell people where he keeps the clone?
- davidwparker 16y ago
  To make people think he's keeping it there but he really isn't? A bluff?
  - sev 16y ago
    That's what I thought for a sec...and then realized he probably wouldn't prefer to be searched, even if they weren't going to find anything.
  - RyanMcGreal 16y ago
    I thought analysts took a dim view of security by obscurity.
    - ams6110 16y ago
      I think the dim view is on using obscurity as your only or main security approach. However leading attackers down blind alleys, in addition to having real security measures in place, doesn't seem to me to be entirely worthless (IANA Security Analyst).
- philwelch 16y ago

korch 16y ago

I wish this unconstitutional and overly broad border search policy would be cancelled. Besides the chilling effect on the broader American surveillance society, it's also not very useful, and is even dangerous to national security. Only dumb criminals and people of interest are going to actually keep real data on their computing devices when crossing the US border. The smart ones will use any of the innumerable, trivial counter measures. Border searches like this also opens the US up to a counter-intel attack. There's nothing to stop foreign agents from planting fake intel they want intercepted at the border, then watching what the watchers do with it, and thereby inferring how the US knows what they know. I wouldn't worry about any kind of hyperbolic, sci-fi eavesdropping bugs being installed surreptitiously on personal hardware. The chances of their bugs being found, reversed engineered, and then used against them is too great of a risk for the US to regularly bug traveller's computers. So almost all of this Constitutionally questionable seized data is useless, and not even worth collecting at the border. Besides, there are far more efficient and precise means of getting the data of targeted people than using airports for dragnets. Ultimately the government's policy is just more ineffective security theater pandering to the terrorism hysteria and the defense industry profits. It's a total waste of our tax budget, needless harassment of citizens of the world, and it helps the growing culture of xenophobia in America more than it helps actual law enforcement.

blhack 16y ago

Interestingly, I just had a discussion with my roomate about this. We were sitting in a coffee shop, and he was mad at himself because he forgot the latest copy of a game he is working on at the house... Why is this a problem at all anymore? Hosting is cheaap. I have a linux VPS at linode that I pay $20/mo for and almost everything that i do is stored there. Honestly, the only things I can think of that aren't stored on that machine (which trades nightly rsyncs with another machine with a different provider and on a different network) are minecraft, my music collection, some photos, and a journal that I just started keeping a couple of weeks ago (gets encrypted with 256bit AES and lives in the home dir on my laptop). My point is that there is absolutely no reason to keep anything on your local machine anymore, at least not ones that I can think of. Why not keep a server in the basement, and then just run SSH with X11 forwarding? Keep a cheap, disposable machine with you and if something like this happens, sell it and buy a new one. It's really sad that this is even an issue, but I do think that there are solutions to it.

mcav 16y ago
Do you do your work on that linode directly (via ssh), or do you just use it for syncing?
- blhack 16y ago
  Directly via SSH.
SoftwareMaven 16y ago
There's no excuse for data loss, but the inconvenience of trying to work remotely from an aircraft is very significant (heck, it wasn't even possible a couple of years ago). Sad that Obama has continued the Bush legacy of trouncing our freedoms at the border. There needs to be a better balance between government power and civil rights at the border that still allows the government to manage what is coming and going.
kristiandupont 16y ago
Funny, I keep a lot of stuff local because I want to make sure I have access to it when I am out somewhere, but my music collection is now http://www.grooveshark.com http://www.grooveshark.com

lusis 16y ago

I was a bit surprised by the fact that he didn't want his name revealed in the article. It's not like some people don't know who he is. [edit] decided to respect Moxie's request in the article and remove a small bit of identifiable info

_corbett 16y ago
as he goes by Moxie socially as well, doesn't want his true name to be revealed is a bit sensational
- lusis 16y ago
  True. I guess unless he's legally changed his name the feds and anyone who's cut him a check obviously already knows who he is.

dalore 16y ago

> “I can’t trust any of these devices now,” says Marlinspike, who asked that Threat Level not report his real name. “They could have modified the hardware or installed new keyboard firmware.” I thought when you get searched they have to keep your possessions within your view at all times.

Zak 16y ago
I believe that's generally true for the TSA, but not customs.

jdietrich 16y ago

It could be worse. Here in the UK, they would have locked him up for refusing to hand over his passwords. The Regulation of Investigatory Powers Act makes it a specific criminal offence and people have been imprisoned for it. Personally, I'm worried that I might get locked up for refusing to decrypt the contents of /dev/urandom. I think we need to wake up to the fact that there are a lot of people in power who would prefer that strong cryptography be the exclusive preserve of government.

husein10 16y ago
Just bc those in power prefer something does not mean that their systems have the ability to enforce these preferences. Whitfield Diffie showed the world that cryptography is NOT the exclusive preserve of the government.
mbreese 16y ago
You know, if you ever wanted to keep something really hidden, naming it /dev/urandom (or some variant thereof) would be a good way to go.
- weavejester 16y ago
  Or perhaps "one-time-pad.txt" :)
  - alextgordon 16y ago
    You could actually encrypt your data using a standard algorithm, then construct a "pad" such that they combine to make a seemingly benign plaintext. No way to prove that your ciphertext is anything other than the other half of the pad (though I'm not a cryptographer :) ).
LiveTheDream 16y ago
TrueCrypt has a plausible deniability feature[1] which would allow you to provide an alternate password to your encrypted drive which opens a safe container (e.g. no secret stuff). [1] http://www.truecrypt.org/docs/?s=plausible-deniability http://www.truecrypt.org/docs/?s=plausible-deniability

jwr 16y ago

I find it amazing that there is so little outrage at what is happening in the USA. The country that paints itself as an example of freedom and democracy and aspires to spreading those values around the world is the same country that: * kidnaps and tortures people, * sets up a military prison with no civillian oversight, outside any legal jurisdiction, where it keeps people indefinitely, * kills people in various countries using missiles launched from drones, * interrogates its citizens as they come back from abroad, threatening them with detention or not letting them into the country, * tightly controls the media and what information gets released from war zones, * has a lawless "zone" extending 100 miles from its border, where laws are unclear, and people can be searched without warrant, * seizes computers, accesses and copies data, threatens people so that they give up their passwords, * uses scare tactics on security researchers (see story above) and whistleblowers (see all the wikileaks stories) I come from a former-communist country that was under the Soviet influence. We fortunately no longer are. I think what I listed above is very visible to people like me, but somehow it goes under the radar of most Americans. I see it as classical secret police tactics, utilized in all totalitarian regimes, while Americans seem to see it as a necessary nuisance to "combat terrorism". I find it even more amazing that instead of fighting back, people just discuss workarounds. Ship your data via FedEx, keep it online, wipe your drives, carry a laptop with an empty drive… This works today, but the way things are developing, it might not work tomorrow! Wake up, people. In comparison to things I listed above the whole ridiculous story about the "naked scanners" is just a joke.

RyanMcGreal 16y ago
What amazes me is that the great swath of Obama supporters who decried the Bush administration's civil rights abuses are strangely quiet about the continuation of those abuses today. (Caveat: I'm not American, but if I was, I would have held my nose and voted for Obama in 2008.)
- jwr 16y ago
  But look at the greater problem: Obama or not, people don't actually do anything. Sure, there will be some forum discussions, but that's pretty much it. The EFF and ACLU seem to be the only organized movements that actually try to do anything. In the political landscape these issues just do not appear.

husein10 16y ago

A word of caution to those keeping data on 3rd party machines... http://www.schneier.com/blog/archives/2007/06/third_party_con.html http://www.schneier.com/blog/archives/2007/06/third_party_co... Also, note that this article is from 2007 and the law may have changed slightly since then.

ahi 16y ago

Seems like they buried the lede. In the simple minds of the Feds he was connected to the Wikileaks crew.

alanh 16y ago

Things like this, along with laptop theft, are excellent reasons to encrypt your home folder. This is pretty easy with built-in software on both Windows 7 & Mac OS X (and I’m sure common Linux distros). One caveat is that encrypted home folders tend to take maybe 1.2× the space of an unencrypted home folder, so delete some videos & music if you’re on an SSD or otherwise constrained HDD.

Mithrandir 16y ago

http://www.googlesharing.net/ http://www.googlesharing.net/ Moxie's awesome addon/proxy.

ck2 16y ago

If it took them "a few hours" then essentially they cloned the hard drive, sector based.

cakeface 16y ago

I wonder if the government is targeting this hacker for his involvement in Whisper Systems, http://www.whispersys.com/ http://www.whispersys.com/. Their main products are easy to use encryption software for calls and texts on android smartphones. From what I can recall the gov really does not want ubiquitous encryption for voice communication in the US. It totally breaks down the whole wiretapping paradigm.