21 ms·
New German law would force ISPs to allow secret service to install trojans
- 1cvmask 6y agoThe German surveillance state is very capable and often understated. They even “ran” Crypto AG with the NSA for decades and even profited from it. https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG
- cpach 6y agoTIL. Didn’t know Germany was involved in that.
- est31 6y agoIt's funny as the Germans had different priorities from the US. The US mainly wanted to use it to extract information, while the Germans also wanted to increase profits so that they have funds outside of parliamentary control and supervision. So they looked more at the business side of things.
- cpach 6y agoI guess funding was not a big issue for the CIA...
- tick_tock_tick 6y agoThey are still flush with cash from decades of running cocaine.
- est31 6y agoYeah I doubt the CIA has objected because they got all their needs met from congressional funding. They just already had built plenty of dark money reserves.
- brianxp 6y agopeople might laugh at you but Colombian "cartels" have deep ties with the government and the military. They even know the patrolling routes of the US Navy. https://www.youtube.com/watch?v=Ra3uSDGL9sw https://www.youtube.com/watch?v=Ra3uSDGL9sw
- mschuster91 6y agoThe alliance that managed Crypto AG was named by a German beer brand, Maximator. https://en.wikipedia.org/wiki/Maximator_(intelligence_alliance) https://en.wikipedia.org/wiki/Maximator_(intelligence_allian...
- rurban 6y agoThe German surveillance state was created and ran by ex-Nazi secret services (Aufklärung Ost), introduced by the CIA (BND = Organisation Gehlen). You have look up the various fascist scandals they have been involved in.
- rbecker 6y agoIt's worrying how government spies are getting legal cover to impersonate legitimate entities. Like spoofing a phone number and faking the voice of a loved one. You don't need to be able to compel speech, when you can employ doppelgangers. > There's even a promotional video of how FinFly ISP sends a fake iTunes update and infects the target system with FinSpy Does Apple not sign iTunes updates?
- wyattjoh 6y agoFrom the promo video of it running an ancient version of iTunes on Windows Vista and the brochures it seems they inject their malware via software updates in general, not just iTunes.
- kevingadd 6y agoI wouldn't be surprised if they force the installation of a certificate root they can use to serve malicious updates (for German OS X users, at least). That's a tactic used by agencies in other countries. Apple et al could probably mitigate this with certificate pinning in their updaters but I'm not sure they can get away with that without running into trouble with other countries that expect to be able to MITM updates.
- hobofan 6y agoI would be surprised. IIRC those "other countries" are countries like Iran that have also just shut off access to the internet for the country. I still think we have a few more years of internet freedom in Germany before that happens.
- s9w 6y agoInternet freedom in Germany? https://stadt-nachrichten.de/fahndungen/hasskommentare-im-internet-bka-durchsucht-wohnungen-in-mehreren-bundeslaendern/ https://stadt-nachrichten.de/fahndungen/hasskommentare-im-in... https://www.bild.de/news/inland/news-inland/hass-kommentare-im-internet-polizei-rueckt-bundesweit-zu-razzien-aus-62450840.bild.html https://www.bild.de/news/inland/news-inland/hass-kommentare-... https://www.bundesregierung.de/breg-de/aktuelles/gesetz-gegen-hasskriminalitaet-1722896 https://www.bundesregierung.de/breg-de/aktuelles/gesetz-gege... Boy China is childs play compared to us.
- detaro 6y ago"will" = "according to a proposed law", but sadly par for the course for our governments to push this kind of thing through, even if a good chunk of their surveillance laws get eaten by the constitutional court. (Maybe we should have a rule that you can't be in politics anymore if multiple of the laws you supported were found to be unconstitutional? ...)
- johannes1234321 6y agoWell in theory that's what elections are for. But majority of the population doesn't seem to bother that much about those things and elects conservatives again and again. Need to raise awareness on these topics ... but unfortunately our opposition is split between crazy wannabe populists, a green party trying hard not to loose momentum by bringing up "critical" topics and a weak liberal party with a leader who's mostly there for being joked about. (Yeah, yeah, ignorant and simplified classification)
- netsharc 6y ago"will" isn't the exact translation of the headline, the idea is written in an upcoming law that will be discussed (or rubber-stamped?) next Wednesday...
- hobofan 6y agoMods: This is an article about a proposed law, so "will" isn't really an accurate reflection (yet, or hopefully at all) and the title should be changed. My proposal: "New German law would force ISPs to redirect traffic to intelligence services for trojan install" (if that is not to long).
- ddevault 6y agoSend this to hn@ycombinator.com as an email.
- corty 6y agoYes, you are right, but the current title is just 2 chars under the limit and I couldn't think of a shorter one. Sorry for the somewhat misleading "will". My somewhat lame excuse: The law will most probably pass, current govt is a coalition of the two largest parties with overwhelming majority and absolutely no clue about anything digital. Edit: would "shall" work instead of "will"?
- dang 6y agoThere are a couple problems: one is that proposed bills rarely go anywhere, so it's generally best to wait for a state change [1]. Edit: I think we can override this issue, given that surveillance laws are of particular interest to HN and the comment at https://news.ycombinator.com/item?id=23783164 https://news.ycombinator.com/item?id=23783164. The other is that HN is an English-language site. We have deep respect for the German language, but articles on HN need to be in English [2]. I've changed it to https://www.privateinternetaccess.com/blog/new-german-law-would-force-isps-to-allow-secret-service-to-install-trojans-on-user-devices/ https://www.privateinternetaccess.com/blog/new-german-law-wo... for now. If there's a better link, we can change it again. (Submitted URL was https://netzpolitik.org/2020/staatstrojaner-provider-sollen-internetverkehr-umleiten-damit-geheimdienste-hacken-koennen/ https://netzpolitik.org/2020/staatstrojaner-provider-sollen-...) [1] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20bills&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que... [2] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20english%20language%20site&sort=byDate&type=comment https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
- atoav 6y ago"Sollen" translates to "should" and not "will" That means there is a element of uncertainty there whether they actually will.
- brummm 6y agoActually it translated to "have to", not "should" (which would more properly be "sollten").
- dathinab 6y agoBetter "will have to" .. "if the law is passed".
- this_user 6y agoI would say it more precisely translates to "are supposed to". Although it is clear from the actual content of the article that it would not really be a choice.
- qwertox 6y agoNo, "are supposed to" is less strict than "must". If the law passes, then they must allow the intelligence services to do this. Or "will have to" if they want to continue to be in the business.
- Youden 6y agoI'm learning German at a fairly low level so I ask this from the perspective of wanting to learn, not as a challenge. Wouldn't "have to" be "müssen"? In what cases would you use "sollen" to have a similar meaning? And "sollten" is either Präteritum or Konjunctive II, which as I understand it would both mean "should have", though in different senses. Why is that a more proper translation of "should"?
- r6203 6y agoMost of the times, "sollen" and "müssen" are interchangeable. However, there are fine nuances between the words. In that case, "müssen" is more direct and used as a command which has consequences when not followed while "sollen" is more of a prompt or demand that hasn't to be followed.
- sneak 6y agoFYI: pervasive mass internet surveillance by the US military with the active cooperation of large US telcos AT&T, Verizon, and others already enables this capability in the US and much of the rest of the world. The surveillance allows them to read the TCP sequence numbers or DNS query IDs, and then spoof valid response packets. It’s called QUANTUMINSERT. https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-insert/ https://blog.fox-it.com/2015/04/20/deep-dive-into-quantum-in...
- gruez 6y agoIs this relevant since nearly everything is https these days?
- sneak 6y agoDNS usually isn’t, and TLS still runs over TCP, which is vulnerable to this type of hijacking, so yes, it is indeed still relevant due to both resolution as well as transport layer. NSA would be very bad at their job indeed if they couldn’t issue valid TLS certificates for any domain to themselves.
- gruez 6y ago>NSA would be very bad at their job indeed if they couldn’t issue valid TLS certificates for any domain to themselves. Is there any evidence of this? With certificate transparency being mandatory a few years ago, you'd think that the NSA would be caught at least once.
- sneak 6y agoThe NSA released a who-knows-how-many-day in crypto32.dll to Microsoft recently that allows one to bypass app/driver EC certificate verification. It’s called CVE-2020-0601. My assumption is that they had it for years and released it for patching the moment they detected anyone else using it. https://www.cbronline.com/cybersecurity/crypt32-dll-vulnerability-nsa/ https://www.cbronline.com/cybersecurity/crypt32-dll-vulnerab... It’s not TLS, but it’s close. I still think they’d be bad at their job if they didn’t have some method of getting valid certs, and I don’t think they are bad at their job. With bulk collection they may be able to spoof replies to LE DNS verification. There are lots of avenues.
- worldofmatthew 6y agoMy guess is that Germany will lose its web hosts as no one will trust to host anything in that country if this passes.
- KozmoNau7 6y agoI live in Denmark and buy hosting/email from a Danish company, but their servers are in Germany. I wonder if they will switch to having servers in other countries (or locally, as they used to have). Otherwise, I'll have to find a different provider.
- luckylion 6y agoIt's primarily about ISPs, not data centers. Your servers are typically secured with SSL.
- worldofmatthew 6y agoBackbones appear to be included.
- luckylion 6y agoPossibly, but it's much harder to intercept and mitm specific traffic at that level. On the ISP-side, that's different: they can with high certainty say that some traffic is coming from/to a specific suspect, much like a phone surveillance. This might also apply to individual service, e.g. an email provider.
- api 6y agoIf it's in a data center security services have physical access.
- luckylion 6y agoBut they'd need to filter out traffic for a specific suspect. It's unlikely that their approach will be to try to install trojans on every client computer that has traffic that goes through some DC. And if they want to take over a server they know the location of: they already can. From my experience in a case where a previous version of that tech has been involved (though normal LE, not intelligence), they do take all the available measures to only hit the target, it's not a shot gun approach.
- fuzzy2 6y agoNot exactly as easy as they make it sound, thanks to encryption and especially signing. Of course there's probably still enough software not using it and/or users not paying attention.
- drummer 6y agoIn english with more info: https://www.privateinternetaccess.com/blog/new-german-law-would-force-isps-to-allow-secret-service-to-install-trojans-on-user-devices/ https://www.privateinternetaccess.com/blog/new-german-law-wo...
- dang 6y agoOk, changed to that from https://netzpolitik.org/2020/staatstrojaner-provider-sollen-internetverkehr-umleiten-damit-geheimdienste-hacken-koennen/ https://netzpolitik.org/2020/staatstrojaner-provider-sollen-.... See also https://news.ycombinator.com/item?id=23783406 https://news.ycombinator.com/item?id=23783406. Thanks!
- hobofan 6y agoThank _you_ for the great moderation!
- LockAndLol 6y agoIs it possible to modify HTTPS traffic? Wouldn't they have to replace the CA certs on the target machine first before being able to modify that traffic?
- wmf 6y agoThey just have to hijack one existing CA that's within their jurisdiction and force it to issue MITM certs. Key pinning or certificate transparency may mitigate this. Or the MITM box could use some kind of HTTP downgrade attack and not worry about certificates at all.
- cesarb 6y agoThat would "burn" the CA (it will be removed and/or blacklisted from every major browser and operating system once it's exposed, and exposing it gets much easier with the recent push towards certificate transparency), so it can only be done once per CA.
- hobofan 6y agoI would hope that any CA they try to force this on sues them, as that leaking would surely destroy their business.
- MaxBarraclough 6y agoIf the 'certificate transparency' initiative takes off, this could be easily detected. https://transparencyreport.google.com/https/certificates https://transparencyreport.google.com/https/certificates
- wmf 6y agoBased on the headline I hoped they were fixing trojans by redirecting C&C traffic to the government, but no, the government is installing trojans. :-(
- hkt 6y agoI laughed. You may well be the most optimistic person on HN. Bravo.
- azinman2 6y agoPretty shocking in a state that has such strict privacy laws. Not sure how the two can come from the same mouth, and even be in public view. My understanding is that the privacy restrictions are largely the result of half the country having lived under the Statsi, and thus being extremely weary of government eyes. Here it’s out in the open!
- qwertox 6y agoBy no means. The Stasi was active in the GDR (German Democratic Republic, "East Germany"), and it is not as if those from the east are particularly watchful for state-instigated surveillance. This predates the wall, but the wall only confirmed what was going on beforehand.
- azinman2 6y agohttps://www.japantimes.co.jp/news/2013/11/19/world/stasi-legacy-gives-germans-different-view-on-nsa-spying/ https://www.japantimes.co.jp/news/2013/11/19/world/stasi-leg...
- durnygbur 6y agoThere is something hilarious and schizoid in how Germany is perceived and the realities about this country. They have strict privacy laws? First Nazi personel in the first half then Stasi personel in the second half of the 20th century were simply requalified and rehired, each bloody time. How do you think? They are top environmentally-friendly country? Highest polluting coal power plants in EU are located in Germany.
- jejay 6y agoThese are both known and highly controversial issues in Germany. The first one is widely accepted as without any alternative. You can't just replace a whole bureaucracy and in retrospect it worked out to only change key positions. But obviously it was a healing and cleaning process over time. The other thing is to be attributed to the fact the we were very quick to abandon atomic power even before climate change issues were that popular. Its a hilarious contradiction. We now actually also have a plan to also get rid of the coal power plants but it will be hard, maybe we need to reintroduce the candle as a source of light. There is no lack of willingness and intent but reality has us all in its tight grip.
- paulie_a 6y agoIs the Trojan based on magic? How will redirecting target computer infect it. What about out tipping off the suspect when it fails to implant? This idea is fantasy.
- pbhjpbhj 6y agoWell either those advising the legislature, who actually carry out the hacks for the security services in Germany, are idiots; or they're very clever people and know exactly what they're doing. Or I guess it could be security theatre, or a diversion, but neither of those seems compelling here. My vote is that, whilst I can't understand how it's accomplished as it seems contrary to technical possibility, that the people with billions of funding to make these things possible (Five Eyes, etc.) are probably capable of many things that look like magic. ?
- deleted 6y ago[deleted]
- opqpo 6y agoWhat does "trojans at ISPs" even mean? TLS works end-to-end and ISPs can do absolutely nothing to see the plaintext. It's unless the CAs at users-side are manually replaced with fake ones nothing can be done. I've never used Windows since I was a kid but I am sure this is pretty much impossible on Linux for example since adding CAs require root privilege.
- lazaroclapp 6y agoPresumably, Germany would have little trouble compelling at least one root CA to sign any TLS certificates they wanted. Just a cursory search shows that Google Chrome, on Linux, trusts, e.g. > CN = D-TRUST Root CA 3 2013 > O = D-Trust GmbH > C = DE There is certificate transparency and pinning and so on, and they would be caught (probably, maybe) if they abused this carelessly and at scale, but in practice, for a small number of targets, it would be trivial to wait for users to connect to a less secured TLS site or even a plain-HTTP site (plenty still exist), and then use a browser exploit as the stage 1, followed by whatever escalation of privilege exploit and rootkit is needed. TLS is really good at preventing always-on dragnet surveillance of everyone's internet traffic, but not a counter measure against targeted nation state level attacks.
- alcoholic_byte 6y agoWell. That is the reason for Certificate Pinning. And these days there is no excuse to not enable it server-side. Helped me detect some MITM-Interceptions. Not that the content was malicious (OpenDNS just rerouted my requests to a "This site is blocked page", but the certificate was signed by Cisco, and thus valid. Certificate Pinning still picked it up. Little hint: It was an Archlinux-site.).
- DelightOne 6y agoHere [1] it says that Chrome stopped supporting HTTP Public Key Pinning (HPKP) with Chrome 72. There are other debates on it. See the discussions for excuses. Or is cert pinning something different than HPKP? - [1]: https://security.stackexchange.com/questions/213410/did-google-chrome-kill-public-key-pinning https://security.stackexchange.com/questions/213410/did-goog...
- deleted 6y ago[deleted]
- solarkraft 6y agoVPN service providers can expect a pretty good future for them (not only with this, but also the new EU copyright guidelines).
- worldofmatthew 6y agoAnd Tor.
- Forbo 6y agohttps://metrics.torproject.org/rs.html#search/country:de https://metrics.torproject.org/rs.html#search/country:de This shows 1,648 relays potentially having their traffic monitored under this law. Out of 6,432 relays, that makes up more than 25% of all Tor relays. Unfortunately, Tor's design doesn't really go far enough in protecting against adversaries with large swaths of visibility. Perhaps it's time for people to begin shifting to I2P, or some other overlay network with more resilience against these types of adversaries. Edit: This page gives you a nice visual representation of how much that consists of. Germany is the big one. https://metrics.torproject.org/bubbles.html#country https://metrics.torproject.org/bubbles.html#country
- hkt 6y agoTor might not protect anonymity effectively in that case, but in the case given it would still offer protection because of the way the relay circuits are designed.
- squarefoot 6y agoSound strange to me that they need a law for this, unless it is intended as leverage to coerce ISPs into collaboration. Secret service agencies do exist for the purpose of doing nasty things governments cannot afford to put their names on, or even be associated with; this would include spying on own citizens. In other words they'd do what they have already done for decades, but this time since it involves ISPs, ie a third party whose collaboration and silence are necessary, it is possible that the regulation includes also some kind of gag order preventing ISPs to tell their users they're under surveillance.
- Animats 6y agoDoes that imply that the German intelligence service has the crypto keys for Windows Update? Otherwise modified Microsoft updates won't work.
- throwawayway9 6y agoI would wager that.
- cuillevel3 6y agoThere are a lot of insecure updaters. I remember reading the list from evilgrade a few years back. It was shocking.
- _ink_ 6y agoGermany hassome weired laws that prohibit the use of "hacker tools". How can there be a German company creating these tools?
- grumio 6y agosome animals are more equal than others
- tastroder 6y agoThe hacker tool paragraph is pretty toothless. I just checked one of those legal tech apps and see 12 judgements total that even mention it. There was quite a bit going on when it passed that effectively clarified that working on, and with, tools like that is legal when there's an assumption of dual use for legitimate purposes, e.g. security research (which is like... all of them). LE use would likely benefit from the same assumption.
- seph-reed 6y agoGermany, the US, and Mexico all in the same week? The oligarchs are getting worried, it would seem.
- pier25 6y agoHuh? What do you mean?
- seph-reed 6y agoWell, as far as I know, all of these countries have political systems in which representatives are supposed to act on the behalf of the people. Basically, we can't all work full time to understand every political thing, and vote on them all, so we have someone do it for us: a representative. Representatives very rarely represent themselves, and are almost always representing either powerful people ( often through lobbying) or citizens. Given that an absolute minority of citizens are asking for this, it's fair to say it's a top down decision. Most citizens are concerned with things that aren't changing at all, if you'd like further proof on who the representatives work for. By virtue of it being a top down decision, it is almost certainly being pushed by a small group of very powerful people. When a small group of people have all the power, that's called an oligarchy. So the question is, why is the oligarchy pushing so hard for control of the internet right now? Well, it's probably not for fun.. so they are worried, I suppose.
- DethNinja 6y agoWhy they are so scared of citizenry though? Anyone that is criminal or really needs security will just use Faraday Cages with disconnected computers. Literally there is nothing they can do against big league criminals with this much mass surveillance, so only logical conclusion is that this is only intended for use on citizenry.
- seph-reed 6y agoIt's the only logical conclusion. And given that there's so many of us, and so few of them, and they've been taking advantage of us in a very abusive way... I don't think they're wrong. I think there's a good chance this goes sour for them.
- kmfrk 6y agoWhat was that German government malware that was found on regular computers like ten years ago? Could have sworn there was something like that.
- dngray 6y agoWere you thinking of this? https://www.ccc.de/en/updates/2011/staatstrojaner https://www.ccc.de/en/updates/2011/staatstrojaner https://www.ccc.de/en/updates/2015/bkag https://www.ccc.de/en/updates/2015/bkag
- micpalmia 6y agoHas anybody found any credible institutional source on this?
- mindfulhack 6y agoTo not even be sure whether a website you visit, or a file you download is actually what its creator says it is, is like picking up an orange but the government secretly replaces it with an apple that contains almost no vitamin C in it at all. You have the right to seek out and eat an orange for your immune system and survival, and no government should have the right to interfere with that, at any time. This law is a fundamental attack on basic quality of life and basic human rights for all Germans. Whoever proposed it should be ashamed of themselves. I hope the parliament outright rejects it for what it is. The very fact it has been proposed is Orwellian and chilling. Internet giants like Google should resist this technology and tell us when a government has just tampered with our web browsing.
- annadane 6y agoNow I want an orange.
- throwawayway9 6y agoAbsolutely true and brilliant comparison. +1
- waheoo 6y agoWhat. Its awful. Privacy doesnt need comparisons or analogies. We have the language to describe privacy in native terms. We dont need help of figurative speech mixing and muddying the waters.
- mindfulhack 6y agoI love making analogies. I even compared apples to oranges and it worked! Humour aside, analogies are really important and I have never understood the disparagement of comparing one group or situation to another. Analogising is a tool to help understand one other and promote diversity.
- throwawayway9 6y ago
- gentleman11 6y agoDoes this not invalidate the claims by many small companies that data has good days privacy laws and that your data is safe there? Could we arrange a petition where users of those services can sign up to say they will change providers if the law passes?
- gentleman11 6y agoYou would think that the country, after recovering from both naziism, and also a chilling communist rule in the east, would worry more about the surveillance state growing. What is German public sentiment about that sort of thing? Does anybody know?
- Dissley 6y agoThe current law is not yet big in the media. I am not sure if there will be a big discussion. If public media decides to push this topic, there will be resistance. I doubt that the average German will notice that this law was passed, if there is a lack of big media covering this topic.
- dirtylowprofile 6y agoGermany is part of the five eyes if I remember correctly.
- fowl2 6y ago> The Five Eyes (FVEY) is an intelligence alliance comprising Australia, Canada, New Zealand, the United Kingdom and the United States. https://en.wikipedia.org/wiki/Five_Eyes https://en.wikipedia.org/wiki/Five_Eyes
- dirtylowprofile 6y agoOh it's 14 eyes now. Germany is still in there.
- marcrosoft 6y agoThis coming from a company that was just acquired by a company with known affiliation with malware.
- dontbenebby 6y agoWhen someone wants to legalize something, I wonder how often it was happening in secret while illegal.
- chanyukai 6y agoThat's sucks.
- Shared404 6y ago> from a company called FinFisher. Why on earth would somebody think this is an appropriate name for a company involved with assisting government surveillance.
- thecleaner 6y agoI see. So does this relate to German citizens only or is it true for immigrants as well ? I guess its true for all since the Trojan will be installed on the ISP servers ?
- gigatexal 6y agowill using a VPN for everything help mitigate this?
- jjice 6y agoWould a checksum be a good way to ensure that you're getting the correct files in a situation like this?
- rocqua 6y agoHow are you going to confirm you got the correct checksum? Generally the solution is to get signed checksums. This comes with the usual issues of how you verify the key used to sign. Alternatively try and distribute the checksums out-of-band. So an attacker would need to MitM two channels.
- deleted 6y ago[deleted]
- coldtea 6y agoBut as a state they forbid sales of Mein Kampf and Nazi paraphernalia, so they're cool and anti-fascist... /s (Not invoking the Godwin law, this is an actual comment on an actual situation, to point the hypocrisy of token anti-totalitarian moves - 70 years too late - vs actual totalitarian law-making...)
- BrandoElFollito 6y agoGermany already had a law where any security software on your machine = you are a hacker. At least this time is is simply useless. The secret services are not magicians and the fact that they have access to my home network or the link does not mean that they can do anything spectacular.