7 ms·

American Hackers Helped UAE Spy on Al Jazeera Chairman, BBC Host

129 points by thefounder 8y ago

dmix 8y ago
If I was a journalist covering any sort of geopolitical stuff I'd 100% have my phone reviewed by infosec experts regularly and change devices frequently. And ideally use separate phones for external work related contacts, day-to-day in-office work, and personal life.
- neilv 8y ago
  Were I that journalist, the first thing I'd do would be to soil my drawers, because I'm not brave enough to operate with some of those kinds of potential adversaries. But, a hypothetical braver me would then know (from my alternate universe life as a techie) that I can't trust any of my devices much, in any case, no matter how many experts review them or how many burners I cycle, and that I should use the devices accordingly.
- steve19 8y ago
  Journalists are not paid enough to buy disposable iPhones frequently.
  - CharlesColeman 8y ago
    > Journalists are not paid enough to buy disposable iPhones frequently. If I were Apple, I'd give journalists all the "disposable" iPhones they need to swap them frequently for free. My only condition would be to periodically inspect them for hacking activity, or have them specially instrumented to detect it. It would be a good way to ferret out state-actor zero days (or increase the security of the platform by making state-actors horde exploits even more jealously).
    - bigiain 8y ago
      I like this idea. Apple could do it practically for free too, if it was something like "Any accredited journalist can trade their iPhone for a refurb at any Apple store at any time. We'd appreciate, but not require, some information about the general areas of stories you cover and any threats you're suspicious might be focused on you."
      - munk-a 8y ago
        Eeeeh... except, if a journalist was enrolled in this program then Apple would (almost certainly) know which journalists were getting new phones and various three-letters could pressure Apple into loading targeted software into phones for specific journalists. Also, this comment isn't intended to touch the question of Apple's trustworthiness so please don't wave downvote over that, I am merely stating that such a system would _really_ motivate three-letters to put an immense amount of pressure into compromising such a system (whether they did so with or without Apple's co-operation can remain untouched).
        rosser 8y ago
        If the program were set up as above, such that any accredited journalist could walk into any Apple Store at any time and do the thing, the logistical challenges in having custom, pre-compromized phones on-hand everywhere ("Why aren't we just grabbing those from normal inventory? Isn't that weird?"), or having to bake a "Glenn Greenwald" image onto the phone when he walked in, would probably be noticed. EDIT: What's to stop Mr. Greenwald from sending a buddy from an old job to swap a new device on his behalf?
        munk-a 8y ago
        Because they'd need to be an accredited journalist, and the presenting of any kind of proof to that end would be enough for three-letter agencies to wiggle their way into a compromise of the system - including the fact that glenn may send his old buddy frank in to collect his phone, so better give either one of them one of the tainted ones. I misread the original proposal a bit and had assumed it'd be a mail-in-service, but with even determination the three-letter folks could probably leave spiked devices in the stores glenn would be likely to walk into. This is more reasonable but I still have reservations.
  - pytyper2 8y ago
    These would be business expenses and would hopefully be reimbursed. You didn't interpret the suggestion in a very charitable way.
- rosser 8y ago
  A smartphone is already the wrong tool if you're in that job. The baseband is a de facto rootkit.
  - tptacek 8y ago
    No, it's not. This is a myth that refuses to die, and like the "one big thing" everyone seems to "know" about mobile security.
    - rosser 8y ago
      You obviously know vastly more about security than I do, but I don't understand how a black box with DMA doesn't implicitly compromise the rest of the device, for people whose threat models might include state-level actors — and particularly their shadier bits. EDIT: Is it just a matter of there being easier/cheaper vectors? Also, phrasing.
      - kasey_junk 8y ago
        https://www.synopsys.com/dw/dwtb.php?a=hsic_usb2_device https://www.synopsys.com/dw/dwtb.php?a=hsic_usb2_device Most modern smartphones use usb for baseband comms. I’m no expert but I don’t think the DMA thing hasn’t been true widely for a very long time.
        rosser 8y ago
        I'm finding product briefs for 4G and 5G basebands listing host DMA capabilities, so it's still enough of a thing to keep vendors offering it.
        tptacek 8y ago
        You should use, exclusively, modern iPhones or, if you have an expert to help set it up, a flagship Google Android phone. I'm sure there are lots of off-brand Android phones that have basebands with full DMA access and no meaningful IOMMU configuration.
- gpm 8y ago
  If it was me I would just assume that my phone was compromised, that the mobile network is compromised, and that any wifi network I'm on is compromised. Cheap semi-disposable laptop + trustworthy encryption (edit: Probably with OpenBSD as the OS) is the best you can do, and if I don't have encryption I trust for the task at hand a wired network. It's unfortunate that wireless networks apparently uniformly have terrible encryption and poor security. There is no fundamental reason this needs to be the case.
  - tptacek 8y ago
    Giving a journalist an OpenBSD laptop to replace their modern iPhone (or, I suppose, carefully-configured expert-vetted flagship Google Android phone) would be a really good way to get them owned up. For most users, laptops are much less secure than iOS devices. Most of the security engineering in OpenBSD protects users from other users, which is not a security barrier that matters to 90% of endpoint users. Most of the security engineering a modern smartphone protects a single user's applications from each other, which very much does matter.
- dontbenebby 8y ago
  IIRC most of these exploits require either physical access, or clicking a link in an email or text. I'm not sure anyone will burn a no interaction zero day on a human rights journalist. I suspect that kind of thing is hoarded by the big boys for when life and limb are on the line.
  - gpm 8y ago
    True, but if you're a journalist I can't imagine how you avoid clicking on links sent to you reliably. And if something 'important' comes your way you might just elevate yourself to the "big boy" level of exploits.
  - tptacek 8y ago
    A "click a link in an email" exploit is probably not too expensive to burn on a journalist, and "click this link in this email" is absolutely one of the top 3 attack vectors for ordinary users.
    - Macross8299 8y ago
      A a security-conscious journalist paranoid enough to use burner phones hardly qualifies as an "ordinary user", even if they aren't traditionally technical.
      - tptacek 8y ago
        Lots of people do all sorts of theatrical security things without having any real savvy for the real threats they face.
        dontbenebby 8y ago
        >Lots of people do all sorts of theatrical security things without having any real savvy for the real threats they face. For example, switching to a dumbphone makes them likely to be more insecure, since they usually operate on 2 or 3g and offer zero encryption.
Bhilai 8y ago
It's probably a lot more lucrative to work on such projects than may be working for the NSA while doing the exactly same things but aren't there laws that prevent ex-spies and hackers to work for foreign governments ?
- rcMgD2BwE72F 8y ago
  If governments / law makers cared, they would react. I remember when the French government learnt that all the top officials of the country where tapped by the NSA, including the President (https://fr.wikipedia.org/wiki/Espionnage_de_l%27%C3%89lys%C3%A9e_par_la_NSA https://fr.wikipedia.org/wiki/Espionnage_de_l%27%C3%89lys%C3...). France did absolutely nothing.
  - bilbo0s 8y ago
    >France did absolutely nothing... ...that we know about.
    - soraminazuki 8y ago
      Sure, but doing nothing publicly does mean a lot.
  - 0xADEADBEE 8y ago
    I mean you say nothing, but they did start building their own secure chat app [0] with a view to making it mandatory for all government officials. [0] - https://www.businessinsider.com/france-building-encrypted-messaging-app-2018-4/?r=AU&IR=T https://www.businessinsider.com/france-building-encrypted-me...
- souprock 8y ago
  These people started off working for an American company with a contract in UAE. Once they were there, UAE replaced that company with a local one. You could say that they should have seen that coming. They are well aware that they now can't return to previous employers. They have little chance of getting their security clearances restored.
NeoBasilisk 8y ago
I wonder how many of these hackers "just liked to solve interesting problems" for work.
- tptacek 8y ago
  Too many. Your comment probably sounds like snark to a lot of people but touches on a very real problem.
- ganoushoreilly 8y ago
  For a lot of them they do like the challenge, it's what drives many agency analysts/operators, but for many it was the lure of money. Packages up to half a million depending on your former position/credentials, free housing and more were throw about like candy. Some of those leaving the agencies were former military or newly hired GS9's. You can see how the monetary lure would pull you out. A bigger problem that has persisted is why are they leaving the domestic agencies? What needs to change for retention there?
munk-a 8y ago
Hey America, do you think you might find a bit of time to persecute these Americans that are being such obviously terrible actors? Sure, the crime wasn't on US soil and so-and-so but... I feel like in the modern world it'd really help America's cred to actually try and take action against these terrible actors. The fact that these folks were former three-letter probably means there's some contract somewhere out there where they signed away all their rights forever. (Also, I get that America is probably fine with this sort of hacking, given that it targeted "the evil" but why not just prosecute these folks for the image of it)
- gpm 8y ago
  I don't like the way this is written. The US is a country of laws. They should only prosecute people for breaking the law. Part of breaking a law is being subject to its jurisdiction. If you want someone to be charged who you don't think should be able to advocate for changing the law to catch future transgressions, not prosecuting them anyways. Alternatively advocate for supporting foreign law enforcement agencies who do have jurisdiction (it seems to me the British should have a good claim here). But it turns out that this is probably illegal under current US law, which specifies a jurisdiction not limited to US soil. A protected computer under the CFAA is defined to include the following (18 U.S.C. § 1030(e)(2)) > a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; Recall that US journalists were targeted. I strongly suspect that qualifies as "foreign communication of the United States".
- boomboomsubban 8y ago
  If you read their earlier investigation, the employees aren't any more terrible than the average NSA rep, and the firm is mostly careful about making an Emarati operative actually perform the attacks on people from the US making prosecution difficult. The FBI was investigating as of January at least.
  - Gibbon1 8y ago
    I would think running your own foreign espionage operation as an American citizen would get you 25 to life. Or should.
craftyguy 8y ago
Can we not turn HN into /r/politics? Or, if we are, be very up-front about HN supporting political 'news' and gossip?
- pvg 8y ago
  This report is not scare-quoted news or gossip.
- sonnyblarney 8y ago
  It's news (not 'news' or 'gossip') about hackers on 'hacker news'.
Simple_Guy 8y ago
When I was a kid I did dream of being a cyber-mercenary. Given that the US recognise cyberspace as being a battlespace, would being a hacker for another country count as being a mercenary. Would that make you a combatant?
tibbydudeza 8y ago
And they are bleating about China and Huawei.
Latteland 8y ago
Why isn't it illegal for Americans to hack into phones in other countries?

129 points by thefounder 8y ago

dmix 8y ago

If I was a journalist covering any sort of geopolitical stuff I'd 100% have my phone reviewed by infosec experts regularly and change devices frequently. And ideally use separate phones for external work related contacts, day-to-day in-office work, and personal life.

neilv 8y ago
Were I that journalist, the first thing I'd do would be to soil my drawers, because I'm not brave enough to operate with some of those kinds of potential adversaries. But, a hypothetical braver me would then know (from my alternate universe life as a techie) that I can't trust any of my devices much, in any case, no matter how many experts review them or how many burners I cycle, and that I should use the devices accordingly.
steve19 8y ago
Journalists are not paid enough to buy disposable iPhones frequently.
- CharlesColeman 8y ago
  > Journalists are not paid enough to buy disposable iPhones frequently. If I were Apple, I'd give journalists all the "disposable" iPhones they need to swap them frequently for free. My only condition would be to periodically inspect them for hacking activity, or have them specially instrumented to detect it. It would be a good way to ferret out state-actor zero days (or increase the security of the platform by making state-actors horde exploits even more jealously).
  - bigiain 8y ago
    I like this idea. Apple could do it practically for free too, if it was something like "Any accredited journalist can trade their iPhone for a refurb at any Apple store at any time. We'd appreciate, but not require, some information about the general areas of stories you cover and any threats you're suspicious might be focused on you."
    - munk-a 8y ago
      Eeeeh... except, if a journalist was enrolled in this program then Apple would (almost certainly) know which journalists were getting new phones and various three-letters could pressure Apple into loading targeted software into phones for specific journalists. Also, this comment isn't intended to touch the question of Apple's trustworthiness so please don't wave downvote over that, I am merely stating that such a system would _really_ motivate three-letters to put an immense amount of pressure into compromising such a system (whether they did so with or without Apple's co-operation can remain untouched).
      - rosser 8y ago
        If the program were set up as above, such that any accredited journalist could walk into any Apple Store at any time and do the thing, the logistical challenges in having custom, pre-compromized phones on-hand everywhere ("Why aren't we just grabbing those from normal inventory? Isn't that weird?"), or having to bake a "Glenn Greenwald" image onto the phone when he walked in, would probably be noticed. EDIT: What's to stop Mr. Greenwald from sending a buddy from an old job to swap a new device on his behalf?
        munk-a 8y ago
        Because they'd need to be an accredited journalist, and the presenting of any kind of proof to that end would be enough for three-letter agencies to wiggle their way into a compromise of the system - including the fact that glenn may send his old buddy frank in to collect his phone, so better give either one of them one of the tainted ones. I misread the original proposal a bit and had assumed it'd be a mail-in-service, but with even determination the three-letter folks could probably leave spiked devices in the stores glenn would be likely to walk into. This is more reasonable but I still have reservations.
- pytyper2 8y ago
  These would be business expenses and would hopefully be reimbursed. You didn't interpret the suggestion in a very charitable way.
rosser 8y ago
A smartphone is already the wrong tool if you're in that job. The baseband is a de facto rootkit.
- tptacek 8y ago
  No, it's not. This is a myth that refuses to die, and like the "one big thing" everyone seems to "know" about mobile security.
  - rosser 8y ago
    You obviously know vastly more about security than I do, but I don't understand how a black box with DMA doesn't implicitly compromise the rest of the device, for people whose threat models might include state-level actors — and particularly their shadier bits. EDIT: Is it just a matter of there being easier/cheaper vectors? Also, phrasing.
    - kasey_junk 8y ago
      https://www.synopsys.com/dw/dwtb.php?a=hsic_usb2_device https://www.synopsys.com/dw/dwtb.php?a=hsic_usb2_device Most modern smartphones use usb for baseband comms. I’m no expert but I don’t think the DMA thing hasn’t been true widely for a very long time.
      - rosser 8y ago
        I'm finding product briefs for 4G and 5G basebands listing host DMA capabilities, so it's still enough of a thing to keep vendors offering it.
        tptacek 8y ago
        You should use, exclusively, modern iPhones or, if you have an expert to help set it up, a flagship Google Android phone. I'm sure there are lots of off-brand Android phones that have basebands with full DMA access and no meaningful IOMMU configuration.
gpm 8y ago
If it was me I would just assume that my phone was compromised, that the mobile network is compromised, and that any wifi network I'm on is compromised. Cheap semi-disposable laptop + trustworthy encryption (edit: Probably with OpenBSD as the OS) is the best you can do, and if I don't have encryption I trust for the task at hand a wired network. It's unfortunate that wireless networks apparently uniformly have terrible encryption and poor security. There is no fundamental reason this needs to be the case.
- tptacek 8y ago
  Giving a journalist an OpenBSD laptop to replace their modern iPhone (or, I suppose, carefully-configured expert-vetted flagship Google Android phone) would be a really good way to get them owned up. For most users, laptops are much less secure than iOS devices. Most of the security engineering in OpenBSD protects users from other users, which is not a security barrier that matters to 90% of endpoint users. Most of the security engineering a modern smartphone protects a single user's applications from each other, which very much does matter.
dontbenebby 8y ago
IIRC most of these exploits require either physical access, or clicking a link in an email or text. I'm not sure anyone will burn a no interaction zero day on a human rights journalist. I suspect that kind of thing is hoarded by the big boys for when life and limb are on the line.
- gpm 8y ago
  True, but if you're a journalist I can't imagine how you avoid clicking on links sent to you reliably. And if something 'important' comes your way you might just elevate yourself to the "big boy" level of exploits.
- tptacek 8y ago
  A "click a link in an email" exploit is probably not too expensive to burn on a journalist, and "click this link in this email" is absolutely one of the top 3 attack vectors for ordinary users.
  - Macross8299 8y ago
    A a security-conscious journalist paranoid enough to use burner phones hardly qualifies as an "ordinary user", even if they aren't traditionally technical.
    - tptacek 8y ago
      Lots of people do all sorts of theatrical security things without having any real savvy for the real threats they face.
      - dontbenebby 8y ago
        >Lots of people do all sorts of theatrical security things without having any real savvy for the real threats they face. For example, switching to a dumbphone makes them likely to be more insecure, since they usually operate on 2 or 3g and offer zero encryption.

Bhilai 8y ago

It's probably a lot more lucrative to work on such projects than may be working for the NSA while doing the exactly same things but aren't there laws that prevent ex-spies and hackers to work for foreign governments ?

rcMgD2BwE72F 8y ago
If governments / law makers cared, they would react. I remember when the French government learnt that all the top officials of the country where tapped by the NSA, including the President (https://fr.wikipedia.org/wiki/Espionnage_de_l%27%C3%89lys%C3%A9e_par_la_NSA https://fr.wikipedia.org/wiki/Espionnage_de_l%27%C3%89lys%C3...). France did absolutely nothing.
- bilbo0s 8y ago
  >France did absolutely nothing... ...that we know about.
  - soraminazuki 8y ago
    Sure, but doing nothing publicly does mean a lot.
- 0xADEADBEE 8y ago
  I mean you say nothing, but they did start building their own secure chat app [0] with a view to making it mandatory for all government officials. [0] - https://www.businessinsider.com/france-building-encrypted-messaging-app-2018-4/?r=AU&IR=T https://www.businessinsider.com/france-building-encrypted-me...
souprock 8y ago
These people started off working for an American company with a contract in UAE. Once they were there, UAE replaced that company with a local one. You could say that they should have seen that coming. They are well aware that they now can't return to previous employers. They have little chance of getting their security clearances restored.

NeoBasilisk 8y ago

I wonder how many of these hackers "just liked to solve interesting problems" for work.

tptacek 8y ago
Too many. Your comment probably sounds like snark to a lot of people but touches on a very real problem.
ganoushoreilly 8y ago
For a lot of them they do like the challenge, it's what drives many agency analysts/operators, but for many it was the lure of money. Packages up to half a million depending on your former position/credentials, free housing and more were throw about like candy. Some of those leaving the agencies were former military or newly hired GS9's. You can see how the monetary lure would pull you out. A bigger problem that has persisted is why are they leaving the domestic agencies? What needs to change for retention there?

munk-a 8y ago

Hey America, do you think you might find a bit of time to persecute these Americans that are being such obviously terrible actors? Sure, the crime wasn't on US soil and so-and-so but... I feel like in the modern world it'd really help America's cred to actually try and take action against these terrible actors. The fact that these folks were former three-letter probably means there's some contract somewhere out there where they signed away all their rights forever. (Also, I get that America is probably fine with this sort of hacking, given that it targeted "the evil" but why not just prosecute these folks for the image of it)

gpm 8y ago
I don't like the way this is written. The US is a country of laws. They should only prosecute people for breaking the law. Part of breaking a law is being subject to its jurisdiction. If you want someone to be charged who you don't think should be able to advocate for changing the law to catch future transgressions, not prosecuting them anyways. Alternatively advocate for supporting foreign law enforcement agencies who do have jurisdiction (it seems to me the British should have a good claim here). But it turns out that this is probably illegal under current US law, which specifies a jurisdiction not limited to US soil. A protected computer under the CFAA is defined to include the following (18 U.S.C. § 1030(e)(2)) > a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; Recall that US journalists were targeted. I strongly suspect that qualifies as "foreign communication of the United States".
boomboomsubban 8y ago
If you read their earlier investigation, the employees aren't any more terrible than the average NSA rep, and the firm is mostly careful about making an Emarati operative actually perform the attacks on people from the US making prosecution difficult. The FBI was investigating as of January at least.
- Gibbon1 8y ago
  I would think running your own foreign espionage operation as an American citizen would get you 25 to life. Or should.

craftyguy 8y ago

Can we not turn HN into /r/politics? Or, if we are, be very up-front about HN supporting political 'news' and gossip?

pvg 8y ago
This report is not scare-quoted news or gossip.
sonnyblarney 8y ago
It's news (not 'news' or 'gossip') about hackers on 'hacker news'.

Simple_Guy 8y ago

When I was a kid I did dream of being a cyber-mercenary. Given that the US recognise cyberspace as being a battlespace, would being a hacker for another country count as being a mercenary. Would that make you a combatant?

tibbydudeza 8y ago

And they are bleating about China and Huawei.

Latteland 8y ago

Why isn't it illegal for Americans to hack into phones in other countries?