9 ms·

Uncovering the CIA's Crypto AG operation

195 points by zengid 7y ago

refurb 7y ago
How come I've never heard of this??? It also makes sense why the US is banning Huawei equipment. If the US can do it, why can't the Chinese?
- wahern 7y ago
  One answer is that you don't need to manufacture custom equipment with escrowed keys to infiltrate communication systems any longer. The Israeli's were using stingrays in Washington, DC just last year to spy on officials. You could probably build a stingray using open source software and a software-defined radio USB stick. You can't trust the network. Rather than trying to avoid Huawei, energy should be spent engineering things so Huawei equipment doesn't need to be trusted. Until then, China and everybody will continue to be able to snoop, regardless of who built the network components.
  - 8note 7y ago
    this is also why the us wants to avoid Huawei. letting Huawei in and doing that engineering makes the American spies' job harder than keeping the ruse going
    - dirtyid 7y ago
      Australian PM basically confirmed this conspiracy theory recently, the main risk AU intelligence identified in Huawei hardware wasn't interception of intelligence by China* rather denial of access to networks with Huawei hardware which compromises intelligence sharing, i.e. it makes it harder for FVEY agencies to spy on each other's citizens. Also puts in perspective William Barrs' recent comment on buying controlling share in Ericsson or Nokia. There's also the drama last year where US claimed Huawei technicians was helping Uganda and Zambia spy on political opponents. Political opponents being Washington friendly anti-establishment candidates, and helping being acceding to request for lawful interception duties as vendor. To be fair the technicians also helped used Israeli spyware to extract Whatsapp data. The TL;DR of the entire debacle being Chinese hardware actively undermines US foreign influence operations abroad. *I surmise the reason US is having so much trouble producing convincing evidence of Huawei malfeasance is that China actually haven't exploited Huawei hardware because they don't want to risk damaging the brand's reputation. That's not to say China doesn't spy, of course they do. They just have the capability to do so without going through Huawei.
      - lern_too_spel 7y ago
        Huawei has a reputation going back almost two decades. https://aragonresearch.com/cyber-war-flashback-remembering-the-huawei-hack-of-cisco-and-nortel/ https://aragonresearch.com/cyber-war-flashback-remembering-t...
        dirtyid 7y ago
        Huawei hacking to steal IP =/= Chinese government exploiting Huawei infrastructure to hack other nation states. The latter allegation has no credible public evidence.
        redis_mlc 7y ago
        > The latter allegation has no credible public evidence. I wish this "useful idiot" chatter would stop. Their founder is former Chinese army. There is a Defcon talk on how bad their security is on medium-sized devices. With that as a starting point, why would you ever trust Huawei?
        dirtyid 7y ago
        Lots of US companies founded and operated by former military. Ren was a technical researcher for that didn't hold military rank. He wasn't even eligible for CPC membership due to parental ties to KMT. Also lots of devices with bad security and spaghetti code. Huawei is probably the most scrutinized vendor in the last decade, national and private investigators from a host of countries found nothing to suggest links to Chinese espionage. Hundreds of mobile operators with years of experience found nothing. NSA with access to Huawei internal networks found nothing. GCHQ with Huawei code to audit found nothing. The only people who claim to have evidence but steadfastly refuse to release any until recently is current US administration with Mike Pompeo leading the charge. Which turned out to be non specific claims about legally mandated lawful interception function, aka Vodaphone SSH tier of vapidness. Unsurprisingly, this has convinced no new countries, and the countries have firm banned Huawei all have exeptional dependence on US security and intelligence sharing. With all that as the starting point, why would you ever trust allegations? Even straight from this article: >So one other - there was another Swiss company at the time - Gretag is what it was called - that was trying to become a rival to Crypto. And the CIA and U.S. intelligence helped to sort of orchestrate smear campaigns around the world to spread disinformation that Gretag's devices couldn't be trusted; there were vulnerabilities in them. The playbook hasn't changed. Neither have the interests. There's nothing wrong with US intelligence pursing self interest based purely on the fact that Chinese are security competitors despite complete lack of evidence. But the only useful idiots are people who believe the US smear campaign around Huawei blindly.
  - mistermann 7y ago
    > The Israeli's were using stingrays in Washington, DC just last year to spy on officials. Did this make the news? I've never heard of it.
    - wahern 7y ago
      https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house...
    - shauhdej 7y ago
      At a glance I see a few articles, it looks like the topic came up in 2018 and 2019, potentially in different but related circumstances. One of those stories is from the Associated Press but the article I skimmed from them didn't make the Israel assertion and was more general. If I had to guess, the topic didn't gain much reaction because the most 'in-depth' articles are from infotainment rags like Gizmodo, Common Dreams, and Politico. Politico seem to have been there ones to break the 2019 story but I'm still reading so can't confirm that.
      - mistermann 7y ago
        It's kind of interesting the lack of interest the media has in such a story. Would be interesting if there was a way to somehow float the same story except with a different country (say, Russia) alleged to have been behind the placement of the device.
        wahern 7y ago
        Media attention was similarly short-lived regarding the closing of the Russian consulate in San Francisco and the Russian compound in Maryland. Yes, Israel usually gets a pass on espionage, and Russian election interference is a years-long story. But in any particular incident it's hard to tell whether the public is disinterested in the incident or disinterested in the adversary. Plus, to be fair, reports of actual Russian incidents are fairly common. I mean, they've literally built a niche industry for social media hacking. Reporting on it is easy; you don't need to wait for intelligence leaks. And they publicly gloat about their strategy and tactics. By contrast, Israel is usually far more discrete[1] and publicly identified incidents are few and far between. [1] Operationally and politically. They certainly don't gloat. They stick to a very strict recitation: "Israel does not spy against the United States."
  - akiselev 7y ago
    You absolutely could build a stingray with an SDR with OpenBTS, although I'm not sure how you'd get it to emulate 4G. As far as I know, OpenBTS only supports 3G. For the lazy, a 3G tower dev kit from Range Networks is $8,000 [1]. [1] https://rangenetworks.com/get-started https://rangenetworks.com/get-started
    - bjornsing 7y ago
      AFAIK stingrays typically use 2G, since 3G and upwards have strong mutual authentication (i.e. the network authenticates the phone but the phone also authenticates the network). They just jam the 3/4G signal to make the target phone fall back to 2G.
      - Fnoord 7y ago
        Agreed. I've never done it, but I suppose you could use 2 SDRs. One for setting up OpenBTS, one for jamming 4G/LTE.
    - deleted 7y ago
      [deleted]
    - lima 7y ago
      There's NextEPC: https://github.com/nextepc/nextepc https://github.com/nextepc/nextepc Fake base station attacks do not work with 4G/5G, but a downgrade attack to 2G might still be possible.
  - pyuser583 7y ago
    So just to be clear, we should not trust Chinese designed processors, and other “smart” equipment?
- xorcist 7y ago
  > If the US can do it, why can't the Chinese? This might well be a plausible reason why this old story resurfaced recently.
- anticodon 7y ago
  In case of Huawei is not about spying - its about money. Building 5G networks will require installing lots of equipment on every building in every country. This will allow to make astronomical amount of money. US doesn't want all those money to go to Huawei - hence the witch hunt.
- dade_ 7y ago
  Ban Huawei because the it doesn't have back doors for the right government.
notlukesky 7y ago
This is a real old story. Was fleshed out in German and Swiss media in 1994: https://en.m.wikipedia.org/wiki/Crypto_AG https://en.m.wikipedia.org/wiki/Crypto_AG And there were many suspicions going even back to a “tell all” by Ronald Reagan
- schoen 7y ago
  I thought so too, at first, but the new information is not just that some Crypto AG products were somehow compromised for some customers (widely reported since the 1990s), but that the company was literally owned by the BND and CIA. Not in a metaphorical sense of owned.
  - jojo2000 7y ago
    Well, at least now we know it's widespread [0]. [0] https://en.wikipedia.org/wiki/In-Q-Tel https://en.wikipedia.org/wiki/In-Q-Tel
    - jonathanstrange 7y ago
      This is also well known for several decades. I'd be more interested in hearing from a whistleblower whether someone runs the shell company behind VeraCrypt. DGSE?
      - secfirstmd 7y ago
        Have we found out anything more about the people behind it recently? It's been a question I've been pondering for awhile. I know this was mentioned in a previous thread: https://news.ycombinator.com/item?id=18693073 https://news.ycombinator.com/item?id=18693073 I've often thought an interesting place for an intelligence agency to place or recruit a source would be in a code review organisation. There are a couple of high profile ones that do a lot of work on open source projects. Let's be honest, very few people have the time, energy and skills to review a project independently of this. Of course there comes a point where too much tinfoil makes the hat fall off.
kissickas 7y ago
Discussion on the Washington Post's great exposé 23 days ago: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963
chriselles 7y ago
This is not the only encryption/communications technology company that has been compromised by national intelligence services. I’m aware of another(potentially) where an employee credibly alleged it. From the perspective of a national intelligence service, it is likely a far better return on investment to proactively catalogue compromised communications at root, rather than intercept and brute force it later.
ColanR 7y ago
This makes me wonder how many presently existing encryption & security projects / organizations are owned or influenced by government agencies.
- augstein 7y ago
  … yes, and how many (open-source) software projects in general.
  - boomboomsubban 7y ago
    Though I know it's not perfect, free software projects at least give you some ability to discover and hinder government interference. I don't know why you seem more interested/worried about them.
    - Ill_ban_myself 7y ago
      Wasn't there a post here about how little review open source software actually gets due to the highly specific knowledge required to identify vulnerabilities? something like: https://www.itworld.com/article/2922074/significant-virtual-machine-vulnerability-has-been-hiding-in-floppy-disk-code-for-11-years.html https://www.itworld.com/article/2922074/significant-virtual-... Seems like creating a foundational open source project and introducing a few key bugs would be the best way to hide in the open.
    - ColanR 7y ago
      Because the open source community is slowly coming to the uncomfortable realization that many eyes != security. Take heartbleed: SSL had a glaring security vulnerability open for years that none of those eyes ever spotted. I've seen questions raised here on HN about Signal and Tor: where they came from, and where their funding comes from. If I had to bet, then I'd bet both of those are modern day Crypto AG variants.
      - Ill_ban_myself 7y ago
        Its one thing to acknowledge that open source software doesn't get the review it needs. Its another thing entirely to suggest that major platforms in use today are sponsored by state actors willing and able to introduce vulnerabilities without proof. Turnkey black box solutions may be reviewed more regularly by a dedicated team but you have to admit that they're subject to flimsy and easy manipulation by state actors and the greed and coruptability of their owners.
BurningFrog 7y ago
Amusing how the CIA is "audacious", while foreign agencies are pure evil.
- steve19 7y ago
  Within the context, this is about the spying and signals intelligence. We don't usually talk about an foreign agency being pure evil when they tap fiber lines, we do when they murder or massacre.
  - thulecitizen 7y ago
    “If only it were all so simple! If only there were evil people somewhere insidiously committing evil deeds, and it were necessary only to separate them from the rest of us and destroy them. But the line dividing good and evil cuts through the heart of every human being. And who is willing to destroy a piece of his own heart?” ― Aleksandr Solzhenitsyn In the digital age, information is everything. And information usually precedes action, so in my eyes your argument is wilfully ignorant to the larger reality of a complex globalized world. I think the US and other Global North countries have a massive shadow: https://www.youtube.com/watch?v=j800SVeiS5I https://www.youtube.com/watch?v=j800SVeiS5I If unfamiliar, this is a guide to Jung's concept of the shadow: https://highexistence.com/carl-jung-shadow-guide-unconscious/ https://highexistence.com/carl-jung-shadow-guide-unconscious...
    - Nasrudith 7y ago
      All of that is mere sophistry to justify their crimes. It is an addictive toxic meme like "neccessity" as it at best escalates from any actual neccessity to excusing mistakes to whatever is convenient to whatever they /think/ will help even if actively detrimental like torturing for information. This sort of delusion has a long history - often found as societies rail against "decadence" when it is really what they consider virtue which will be their inevitable downfall. The secret is that information doesn't matter to the evil fools, it is all a pretext for self justification whether consciously or otherwise. In order for the delusional evil to die and stay dead the secret must be widely exposed.
saagarjha 7y ago
> The Iranian government then arrested Crypto AG's top salesman, Hans Buehler, in March 1992 in Tehran. It accused Buehler of leaking their encryption codes to Western intelligence. Buehler was interrogated for nine months but, being completely unaware of any flaw in the machines, was released in January 1993 after Crypto AG posted bail of $1m to Iran. Soon after Buehler's release Crypto AG dismissed him and sought to recover the $1m bail money from him personally. Sounds like a great employer. Knowingly sells backdoored equipment to foreign governments, allows their employees to be arrested and held for nine months even though they know nothing about it, pays the bail, then immediately fires them and tries to recoup the bail.
- Wistar 7y ago
  Good lord.
- gregoryl 7y ago
  Given it was run by the CIA, possibly something more going on behind the scenes there.
  - jacobush 7y ago
    Either way, feels like a bad place to work.
- pjc50 7y ago
  See the Matrix-Churchill fiasco, whereby: - UK government secretly changes its own rules on arms to Iraq - encourages a company to ship such weapons to Iraq - they get caught by UK Customs - this gets all the way to the trial and potential jailing of the directors - UK government (in particular, Kenneth Clarke) directs suppression of vital evidence through "Public Interest Immunity Certificates" - Judge refuses to go along with the coverup and jail innocent people, and the whole thing blows up in the newspapers. https://www.independent.co.uk/news/uk/scott-report-the-essential-guide-1319094.html https://www.independent.co.uk/news/uk/scott-report-the-essen...
  - switch007 7y ago
KCUOJJQJ 7y ago
As a Swiss I would say that you can put Swiss cryptography into the garbage bin, together with US-American cryptography, unless there is quality control. My country needs a food inspector for cryptography. The inspector should talk to employees, check source codes, look at who owns a company etc.
- sschueller 7y ago
  We need open source. Threema is one of those that concerns me. Used by the government but source is closed and distributed via Google Play and Apple App Store.
aschatten 7y ago
On my way home I tuned in on this interview, caught the end of it. Had my dinner and decided to google the story, but before checked Hacker News. And here it is on the from page.
JabavuAdams 7y ago
Why do we trust Tor and Protonmail, again? Ugh.
- ta999999171 7y ago
  Tor is open source/not a vendor. But a good point, for Tor hosts.
- saagarjha 7y ago
  What should we trust?
- xorcist 7y ago
  Tor places limits on how much of the network must be owned by an adversary in order for them to extract useful information from it. They are quite transparent about it.
- Fnoord 7y ago
  Who said we do? That's up to each person to (consder to) construct a threat analysis. Protonmail uses JavaScript, which can theoretically be serving nonsense to a specific client. There's no way you will audit the source every time you use it. I use it, for larping, and because I like the though that there is still some competition in the e-mail landscape. Tor is a completely different league... but I don't consider the actions I (might) perform there to be confidential for the rest of my life, so I act accordingly. YMMV.
- upofadown 7y ago
  We don't. Trust is relative, not absolute.
dang 7y ago
Recent threads on this: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22307500 https://news.ycombinator.com/item?id=22307500 https://news.ycombinator.com/item?id=22309478 https://news.ycombinator.com/item?id=22309478 https://news.ycombinator.com/item?id=22473148 https://news.ycombinator.com/item?id=22473148 Others?
tbyehl 7y ago
Nice to finally have some exploration of how this tied into geopolitics. What I'd still like to see is... how did this influence domestic crypto policy and export controls? It seems entirely too coincidental that right after the cat is fully out of the bag with the Iran thing, the US is suddenly easing export restrictions on crypto, trying to shove Clipper / Key Escrow down our throats, coming for Zimmerman, etc.
thatiscool 7y ago
backdoor of Intel CPUs and chipsets https://arstechnica.com/information-technology/2020/03/5-years-of-intel-cpus-and-chipsets-have-a-concerning-flaw-thats-unfixable/ https://arstechnica.com/information-technology/2020/03/5-yea...
random_savv 7y ago
The Swiss government (specifically the State Secretariat for Economic Affairs) has filed a criminal complaint "against unknown persons" to shine some light on this case: https://www.swissinfo.ch/eng/crypto-leaks_swiss-authorities-file-criminal-complaint-against-encryption-firm/45588760 https://www.swissinfo.ch/eng/crypto-leaks_swiss-authorities-...
jamisteven 7y ago
This is not even half the story, the real story is how many people died via this shady entity: https://gosint.wordpress.com/2020/03/02/crypto-ag-the-missing-piece-of-the-snowden-puzzle/ https://gosint.wordpress.com/2020/03/02/crypto-ag-the-missin...
itsreal 7y ago
Considering the CIA is still running all sorts of programs out of private companies that shouldn't be surprising https://pastebin.com/0ydbVRkP https://pastebin.com/0ydbVRkP
Wistar 7y ago
Last night's Fresh Air interview with WaPo's Greg Miller about the Crypto AG case. 37 minute run time. https://www.npr.org/transcripts/812499752 https://www.npr.org/transcripts/812499752
stebann 7y ago
USA hypocrisy again. Oh! We will ban Huawei while we sing racist slurs in every country around the world!

195 points by zengid 7y ago

How come I've never heard of this??? It also makes sense why the US is banning Huawei equipment. If the US can do it, why can't the Chinese?

wahern 7y ago
One answer is that you don't need to manufacture custom equipment with escrowed keys to infiltrate communication systems any longer. The Israeli's were using stingrays in Washington, DC just last year to spy on officials. You could probably build a stingray using open source software and a software-defined radio USB stick. You can't trust the network. Rather than trying to avoid Huawei, energy should be spent engineering things so Huawei equipment doesn't need to be trusted. Until then, China and everybody will continue to be able to snoop, regardless of who built the network components.
- 8note 7y ago
  this is also why the us wants to avoid Huawei. letting Huawei in and doing that engineering makes the American spies' job harder than keeping the ruse going
  - dirtyid 7y ago
    Australian PM basically confirmed this conspiracy theory recently, the main risk AU intelligence identified in Huawei hardware wasn't interception of intelligence by China* rather denial of access to networks with Huawei hardware which compromises intelligence sharing, i.e. it makes it harder for FVEY agencies to spy on each other's citizens. Also puts in perspective William Barrs' recent comment on buying controlling share in Ericsson or Nokia. There's also the drama last year where US claimed Huawei technicians was helping Uganda and Zambia spy on political opponents. Political opponents being Washington friendly anti-establishment candidates, and helping being acceding to request for lawful interception duties as vendor. To be fair the technicians also helped used Israeli spyware to extract Whatsapp data. The TL;DR of the entire debacle being Chinese hardware actively undermines US foreign influence operations abroad. *I surmise the reason US is having so much trouble producing convincing evidence of Huawei malfeasance is that China actually haven't exploited Huawei hardware because they don't want to risk damaging the brand's reputation. That's not to say China doesn't spy, of course they do. They just have the capability to do so without going through Huawei.
    - lern_too_spel 7y ago
      Huawei has a reputation going back almost two decades. https://aragonresearch.com/cyber-war-flashback-remembering-the-huawei-hack-of-cisco-and-nortel/ https://aragonresearch.com/cyber-war-flashback-remembering-t...
      - dirtyid 7y ago
        Huawei hacking to steal IP =/= Chinese government exploiting Huawei infrastructure to hack other nation states. The latter allegation has no credible public evidence.
        redis_mlc 7y ago
        > The latter allegation has no credible public evidence. I wish this "useful idiot" chatter would stop. Their founder is former Chinese army. There is a Defcon talk on how bad their security is on medium-sized devices. With that as a starting point, why would you ever trust Huawei?
        dirtyid 7y ago
        Lots of US companies founded and operated by former military. Ren was a technical researcher for that didn't hold military rank. He wasn't even eligible for CPC membership due to parental ties to KMT. Also lots of devices with bad security and spaghetti code. Huawei is probably the most scrutinized vendor in the last decade, national and private investigators from a host of countries found nothing to suggest links to Chinese espionage. Hundreds of mobile operators with years of experience found nothing. NSA with access to Huawei internal networks found nothing. GCHQ with Huawei code to audit found nothing. The only people who claim to have evidence but steadfastly refuse to release any until recently is current US administration with Mike Pompeo leading the charge. Which turned out to be non specific claims about legally mandated lawful interception function, aka Vodaphone SSH tier of vapidness. Unsurprisingly, this has convinced no new countries, and the countries have firm banned Huawei all have exeptional dependence on US security and intelligence sharing. With all that as the starting point, why would you ever trust allegations? Even straight from this article: >So one other - there was another Swiss company at the time - Gretag is what it was called - that was trying to become a rival to Crypto. And the CIA and U.S. intelligence helped to sort of orchestrate smear campaigns around the world to spread disinformation that Gretag's devices couldn't be trusted; there were vulnerabilities in them. The playbook hasn't changed. Neither have the interests. There's nothing wrong with US intelligence pursing self interest based purely on the fact that Chinese are security competitors despite complete lack of evidence. But the only useful idiots are people who believe the US smear campaign around Huawei blindly.
- mistermann 7y ago
  > The Israeli's were using stingrays in Washington, DC just last year to spy on officials. Did this make the news? I've never heard of it.
  - wahern 7y ago
    https://www.politico.com/story/2019/09/12/israel-white-house-spying-devices-1491351 https://www.politico.com/story/2019/09/12/israel-white-house...
  - shauhdej 7y ago
    At a glance I see a few articles, it looks like the topic came up in 2018 and 2019, potentially in different but related circumstances. One of those stories is from the Associated Press but the article I skimmed from them didn't make the Israel assertion and was more general. If I had to guess, the topic didn't gain much reaction because the most 'in-depth' articles are from infotainment rags like Gizmodo, Common Dreams, and Politico. Politico seem to have been there ones to break the 2019 story but I'm still reading so can't confirm that.
    - mistermann 7y ago
      It's kind of interesting the lack of interest the media has in such a story. Would be interesting if there was a way to somehow float the same story except with a different country (say, Russia) alleged to have been behind the placement of the device.
      - wahern 7y ago
        Media attention was similarly short-lived regarding the closing of the Russian consulate in San Francisco and the Russian compound in Maryland. Yes, Israel usually gets a pass on espionage, and Russian election interference is a years-long story. But in any particular incident it's hard to tell whether the public is disinterested in the incident or disinterested in the adversary. Plus, to be fair, reports of actual Russian incidents are fairly common. I mean, they've literally built a niche industry for social media hacking. Reporting on it is easy; you don't need to wait for intelligence leaks. And they publicly gloat about their strategy and tactics. By contrast, Israel is usually far more discrete[1] and publicly identified incidents are few and far between. [1] Operationally and politically. They certainly don't gloat. They stick to a very strict recitation: "Israel does not spy against the United States."
- akiselev 7y ago
  You absolutely could build a stingray with an SDR with OpenBTS, although I'm not sure how you'd get it to emulate 4G. As far as I know, OpenBTS only supports 3G. For the lazy, a 3G tower dev kit from Range Networks is $8,000 [1]. [1] https://rangenetworks.com/get-started https://rangenetworks.com/get-started
  - bjornsing 7y ago
    AFAIK stingrays typically use 2G, since 3G and upwards have strong mutual authentication (i.e. the network authenticates the phone but the phone also authenticates the network). They just jam the 3/4G signal to make the target phone fall back to 2G.
    - Fnoord 7y ago
      Agreed. I've never done it, but I suppose you could use 2 SDRs. One for setting up OpenBTS, one for jamming 4G/LTE.
  - deleted 7y ago
    [deleted]
  - lima 7y ago
    There's NextEPC: https://github.com/nextepc/nextepc https://github.com/nextepc/nextepc Fake base station attacks do not work with 4G/5G, but a downgrade attack to 2G might still be possible.
- pyuser583 7y ago
  So just to be clear, we should not trust Chinese designed processors, and other “smart” equipment?
xorcist 7y ago
> If the US can do it, why can't the Chinese? This might well be a plausible reason why this old story resurfaced recently.
anticodon 7y ago
In case of Huawei is not about spying - its about money. Building 5G networks will require installing lots of equipment on every building in every country. This will allow to make astronomical amount of money. US doesn't want all those money to go to Huawei - hence the witch hunt.
dade_ 7y ago
Ban Huawei because the it doesn't have back doors for the right government.

notlukesky 7y ago

This is a real old story. Was fleshed out in German and Swiss media in 1994: https://en.m.wikipedia.org/wiki/Crypto_AG https://en.m.wikipedia.org/wiki/Crypto_AG And there were many suspicions going even back to a “tell all” by Ronald Reagan

schoen 7y ago
I thought so too, at first, but the new information is not just that some Crypto AG products were somehow compromised for some customers (widely reported since the 1990s), but that the company was literally owned by the BND and CIA. Not in a metaphorical sense of owned.
- jojo2000 7y ago
  Well, at least now we know it's widespread [0]. [0] https://en.wikipedia.org/wiki/In-Q-Tel https://en.wikipedia.org/wiki/In-Q-Tel
  - jonathanstrange 7y ago
    This is also well known for several decades. I'd be more interested in hearing from a whistleblower whether someone runs the shell company behind VeraCrypt. DGSE?
    - secfirstmd 7y ago
      Have we found out anything more about the people behind it recently? It's been a question I've been pondering for awhile. I know this was mentioned in a previous thread: https://news.ycombinator.com/item?id=18693073 https://news.ycombinator.com/item?id=18693073 I've often thought an interesting place for an intelligence agency to place or recruit a source would be in a code review organisation. There are a couple of high profile ones that do a lot of work on open source projects. Let's be honest, very few people have the time, energy and skills to review a project independently of this. Of course there comes a point where too much tinfoil makes the hat fall off.

kissickas 7y ago

Discussion on the Washington Post's great exposé 23 days ago: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963

chriselles 7y ago

This is not the only encryption/communications technology company that has been compromised by national intelligence services. I’m aware of another(potentially) where an employee credibly alleged it. From the perspective of a national intelligence service, it is likely a far better return on investment to proactively catalogue compromised communications at root, rather than intercept and brute force it later.

ColanR 7y ago

This makes me wonder how many presently existing encryption & security projects / organizations are owned or influenced by government agencies.

augstein 7y ago
… yes, and how many (open-source) software projects in general.
- boomboomsubban 7y ago
  Though I know it's not perfect, free software projects at least give you some ability to discover and hinder government interference. I don't know why you seem more interested/worried about them.
  - Ill_ban_myself 7y ago
    Wasn't there a post here about how little review open source software actually gets due to the highly specific knowledge required to identify vulnerabilities? something like: https://www.itworld.com/article/2922074/significant-virtual-machine-vulnerability-has-been-hiding-in-floppy-disk-code-for-11-years.html https://www.itworld.com/article/2922074/significant-virtual-... Seems like creating a foundational open source project and introducing a few key bugs would be the best way to hide in the open.
  - ColanR 7y ago
    Because the open source community is slowly coming to the uncomfortable realization that many eyes != security. Take heartbleed: SSL had a glaring security vulnerability open for years that none of those eyes ever spotted. I've seen questions raised here on HN about Signal and Tor: where they came from, and where their funding comes from. If I had to bet, then I'd bet both of those are modern day Crypto AG variants.
    - Ill_ban_myself 7y ago
      Its one thing to acknowledge that open source software doesn't get the review it needs. Its another thing entirely to suggest that major platforms in use today are sponsored by state actors willing and able to introduce vulnerabilities without proof. Turnkey black box solutions may be reviewed more regularly by a dedicated team but you have to admit that they're subject to flimsy and easy manipulation by state actors and the greed and coruptability of their owners.

BurningFrog 7y ago

Amusing how the CIA is "audacious", while foreign agencies are pure evil.

steve19 7y ago
Within the context, this is about the spying and signals intelligence. We don't usually talk about an foreign agency being pure evil when they tap fiber lines, we do when they murder or massacre.
- thulecitizen 7y ago
  “If only it were all so simple! If only there were evil people somewhere insidiously committing evil deeds, and it were necessary only to separate them from the rest of us and destroy them. But the line dividing good and evil cuts through the heart of every human being. And who is willing to destroy a piece of his own heart?” ― Aleksandr Solzhenitsyn In the digital age, information is everything. And information usually precedes action, so in my eyes your argument is wilfully ignorant to the larger reality of a complex globalized world. I think the US and other Global North countries have a massive shadow: https://www.youtube.com/watch?v=j800SVeiS5I https://www.youtube.com/watch?v=j800SVeiS5I If unfamiliar, this is a guide to Jung's concept of the shadow: https://highexistence.com/carl-jung-shadow-guide-unconscious/ https://highexistence.com/carl-jung-shadow-guide-unconscious...
  - Nasrudith 7y ago
    All of that is mere sophistry to justify their crimes. It is an addictive toxic meme like "neccessity" as it at best escalates from any actual neccessity to excusing mistakes to whatever is convenient to whatever they /think/ will help even if actively detrimental like torturing for information. This sort of delusion has a long history - often found as societies rail against "decadence" when it is really what they consider virtue which will be their inevitable downfall. The secret is that information doesn't matter to the evil fools, it is all a pretext for self justification whether consciously or otherwise. In order for the delusional evil to die and stay dead the secret must be widely exposed.

saagarjha 7y ago

> The Iranian government then arrested Crypto AG's top salesman, Hans Buehler, in March 1992 in Tehran. It accused Buehler of leaking their encryption codes to Western intelligence. Buehler was interrogated for nine months but, being completely unaware of any flaw in the machines, was released in January 1993 after Crypto AG posted bail of $1m to Iran. Soon after Buehler's release Crypto AG dismissed him and sought to recover the $1m bail money from him personally. Sounds like a great employer. Knowingly sells backdoored equipment to foreign governments, allows their employees to be arrested and held for nine months even though they know nothing about it, pays the bail, then immediately fires them and tries to recoup the bail.

Wistar 7y ago
Good lord.
gregoryl 7y ago
Given it was run by the CIA, possibly something more going on behind the scenes there.
- jacobush 7y ago
  Either way, feels like a bad place to work.
pjc50 7y ago
See the Matrix-Churchill fiasco, whereby: - UK government secretly changes its own rules on arms to Iraq - encourages a company to ship such weapons to Iraq - they get caught by UK Customs - this gets all the way to the trial and potential jailing of the directors - UK government (in particular, Kenneth Clarke) directs suppression of vital evidence through "Public Interest Immunity Certificates" - Judge refuses to go along with the coverup and jail innocent people, and the whole thing blows up in the newspapers. https://www.independent.co.uk/news/uk/scott-report-the-essential-guide-1319094.html https://www.independent.co.uk/news/uk/scott-report-the-essen...
- switch007 7y ago

KCUOJJQJ 7y ago

As a Swiss I would say that you can put Swiss cryptography into the garbage bin, together with US-American cryptography, unless there is quality control. My country needs a food inspector for cryptography. The inspector should talk to employees, check source codes, look at who owns a company etc.

sschueller 7y ago
We need open source. Threema is one of those that concerns me. Used by the government but source is closed and distributed via Google Play and Apple App Store.

aschatten 7y ago

On my way home I tuned in on this interview, caught the end of it. Had my dinner and decided to google the story, but before checked Hacker News. And here it is on the from page.

JabavuAdams 7y ago

Why do we trust Tor and Protonmail, again? Ugh.

ta999999171 7y ago
Tor is open source/not a vendor. But a good point, for Tor hosts.
saagarjha 7y ago
What should we trust?
xorcist 7y ago
Tor places limits on how much of the network must be owned by an adversary in order for them to extract useful information from it. They are quite transparent about it.
Fnoord 7y ago
Who said we do? That's up to each person to (consder to) construct a threat analysis. Protonmail uses JavaScript, which can theoretically be serving nonsense to a specific client. There's no way you will audit the source every time you use it. I use it, for larping, and because I like the though that there is still some competition in the e-mail landscape. Tor is a completely different league... but I don't consider the actions I (might) perform there to be confidential for the rest of my life, so I act accordingly. YMMV.
upofadown 7y ago
We don't. Trust is relative, not absolute.

dang 7y ago

Recent threads on this: https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22297963 https://news.ycombinator.com/item?id=22307500 https://news.ycombinator.com/item?id=22307500 https://news.ycombinator.com/item?id=22309478 https://news.ycombinator.com/item?id=22309478 https://news.ycombinator.com/item?id=22473148 https://news.ycombinator.com/item?id=22473148 Others?

tbyehl 7y ago

Nice to finally have some exploration of how this tied into geopolitics. What I'd still like to see is... how did this influence domestic crypto policy and export controls? It seems entirely too coincidental that right after the cat is fully out of the bag with the Iran thing, the US is suddenly easing export restrictions on crypto, trying to shove Clipper / Key Escrow down our throats, coming for Zimmerman, etc.

thatiscool 7y ago

backdoor of Intel CPUs and chipsets https://arstechnica.com/information-technology/2020/03/5-years-of-intel-cpus-and-chipsets-have-a-concerning-flaw-thats-unfixable/ https://arstechnica.com/information-technology/2020/03/5-yea...

random_savv 7y ago

The Swiss government (specifically the State Secretariat for Economic Affairs) has filed a criminal complaint "against unknown persons" to shine some light on this case: https://www.swissinfo.ch/eng/crypto-leaks_swiss-authorities-file-criminal-complaint-against-encryption-firm/45588760 https://www.swissinfo.ch/eng/crypto-leaks_swiss-authorities-...

jamisteven 7y ago

This is not even half the story, the real story is how many people died via this shady entity: https://gosint.wordpress.com/2020/03/02/crypto-ag-the-missing-piece-of-the-snowden-puzzle/ https://gosint.wordpress.com/2020/03/02/crypto-ag-the-missin...

itsreal 7y ago

Considering the CIA is still running all sorts of programs out of private companies that shouldn't be surprising https://pastebin.com/0ydbVRkP https://pastebin.com/0ydbVRkP

Wistar 7y ago

Last night's Fresh Air interview with WaPo's Greg Miller about the Crypto AG case. 37 minute run time. https://www.npr.org/transcripts/812499752 https://www.npr.org/transcripts/812499752

stebann 7y ago

USA hypocrisy again. Oh! We will ban Huawei while we sing racist slurs in every country around the world!