7 ms·

This may be a dumb question, but is there any reason why these crime groups don't just use Signal? I understand a phone number is required upon registration but

This may be a dumb question, but is there any reason why these crime groups don't just use Signal? I understand a phone number is required upon registration but a burner sim could be used and discarded for that purpose.

collaborative 6y ago
It's not a dumb question at all. I bet you that 99% of criminals already use Signal. These ones were dumb enough not to use it and got caught If you want a Signal-like app that doesn't need a phone number you can use www.groupsapp.online
- years3500 6y ago
  You should have disclosed that groupsapp is your app. How's it better than signal in terms of security other than not requiring phone number? How is the E2EE implemented? Is it open source?
  - collaborative 6y ago
    Indeed, I disclose here that I am the developer. It's not better or worse, it's different. You can see a list of features in the link, that should be better than me writing them here (main security pluses are: doesn't read from phone book, email can be masked, sent messages can be deleted even after having been read, and there is a self-destruct mechanism) E2EE is implemented with RSA+AES. iOS uses keychain and CommonCrypto. Android uses a modified BouncyCastles. I'll probably open source the code once I've figured out the licensing details
    - years3500 6y ago
      Thank you.
      - collaborative 6y ago
        Welcome :)
- deleted 6y ago
  [deleted]
- INTPenis 6y ago
  Or even better, why don't they have their own synapse network with proper PKI and key rotation? Because anyone who can do that wouldn't waste their lives workin for criminals when they can make safe money legally.
  - a2tech 6y ago
    Thats exactly what the Mexican cartels had until the guy that ran it flipped on them. They even had their own cell towers in remote areas of Mexico.
  - Nextgrid 6y ago
    > anyone who can do that wouldn't waste their lives workin for criminals when they can make safe money legally The skills required to set up a secure communications network aren't that valued (as in it won't make you a millionaire) in the legal world, and even less so in Europe where IT salaries are absolutely terrible.
    - INTPenis 6y ago
      It will allow you to live comfortably at least. Look I know because I've been between those two worlds. When I was around criminals I had the option of working for them for money and would probably make more than I do today because it would be tax free. But it wouldn't be millions because I'd be in the background helping out with IT infra and policy. So if you're smart you take less money to be left as far outside as possible. The problem is that it's not possible to be outside of that world. You will be taken advantage of. You will be a golden goose that everyone wants a part of just because you can manage their IT securely. So I was smart and got a safe IT job where I make enough to live very comfortably, work where I want, practically when I want and with people who are not openly sociopaths.
      - Nextgrid 6y ago
        What I meant is that if someone doesn't have a moral problem with breaking the law, US tech wages are more likely to sway them towards the right path (just because of the risk aversity) than EU wages where IT isn't well-compensated. I know as well because when starting my career I had to make a choice - if it wasn't for a stroke of luck I may have had to pick the wrong path out of desperation (whether I would've made it anywhere is another question - sounds like you looked into it farther than I did). Thankfully everything worked out and I haven't needed to be on the wrong side of the law, but this was down to luck - you can very well have the skills that would pay well in the criminal world while being stuck in a situation where you can't get much out of those skills in the legal world, so I disagree with the idea that having those skills automatically gives you the option to make a good living legally.
teekert 6y ago
I have the same "dumb" question every time I read this type of news.
tinus_hn 6y ago
You only hear about dumb crooks because those are the ones that get caught.
danielheath 6y ago
Signal keeps chat history on the device, meaning all the incriminating evidence (of yourself and others) is on your person when you get arrested. Sky ECC wipes messages after 30 seconds, meaning a seized phone is of limited value to investigators.
- Ploskin 6y ago
  Is this still the case even if you set it messages to self-delete after a set period?
- sva_ 6y ago
  Signal has a function to delete messages after a set interval (after having read it.) I don't know about Sky ECC, but Signal requires a Phone # to register, as far as I remember. It's increasingly hard to get anonymous Phone # in the EU. That might be an argument against using it.
  - jfhrnrkfkf 6y ago
    Open the Desktop Signal app, connect it to your phone, and watch it download all the supposedly "expired" messages. They will not always be shown, but they are downloaded.
auganov 6y ago
They're selling a device too, it's not just an app. If you're a high level criminal it's not irrational to worry about zero days getting used on you. The attack surface isn't limited to any one app [0]. I can see how this may be compelling, if done right it makes a lot of sense. Yes, a tiny no-name company is pretty likely to totally mess up. But the "error" in thinking here is being bad with probabilities rather than strictly not understanding something technical. I'd also wonder if there's an element of buying access. If all the top people in some criminal industry use it, it may be a way to signal membership. [0] not that there haven't been numerous whatsapp zerodays and expecting the Signal honeymoon to last makes about as much sense as "there's no Linux/Mac malware"
- noir_lord 6y ago
  If you where a really high level criminal you wouldn't use a phone at all, you'd pass all your instructions in person to lieutenants who'd pass them on down the chain. This was largely how the Mob operated for decades and why RICO was created. Communications security against national state level organisations in the current environment is a no-win situation for the defending side, you can make their life more difficult but for you to go truly dark means using nothing that shuffles electrons around.
  - auganov 6y ago
    I feel like you may have a different definition of who a high level criminal is. I would consider anybody who derives significant revenue (say above $1M) from a criminal activity to count. I'd also question how many highly hierarchical criminal organizations exist today and how many have in the recent past. Media and governments love to overemphasize the organized element for simplicity. Likewise many "terrorist organizations" aren't organized either. In practice you mostly see very lose networks that operate a lot like the rest of the economy. There may be some emergent structure but it's usually not deliberate. > If you where a really high level criminal you wouldn't use a phone at all, you'd pass all your instructions in person to lieutenants who'd pass them on down the chain. > This was largely how the Mob operated for decades and why RICO was created. That would be a legal strategy not a communications security one. It may have been more feasible to proxy away legal responsibility before RICO and such.
upofadown 6y ago
Convenience. Why bother with stuff like, say, validating your Signal "safety numbers" to ensure that you are actually talking to your contact and not the police? Why bother with insuring you are quickly deleting your old messages? Why bother with finding a burner SIM? Instead, just farm out all the boring detail to someone else and buy a "secure" phone for $1-$2k. Unfortunately, at that point you are trusting a third party which becomes a single point of failure. There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers. To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed. Note that Signal on a smart phone is not anywhere near the most secure way to communicate over the internet. Smart phones themselves are not particularly secure and are vulnerable any time they are unlocked. Instant messaging is inherently insecure because it is always on and thus makes it impossible to keep the secret key information locked up securely when the user is not in a safe environment. [1] https://securityaffairs.co/wordpress/57036/cyber-crime/black https://securityaffairs.co/wordpress/57036/cyber-crime/black...
smoe 6y ago
I think in large parts of Europe you need to identify/register when buying a sim. No idea how hard it is to get one without. Also I was just wondering, albeit maybe ridiculous, if criminals have the same issues with messenger apps as the rest of us, in so far that you are kinda forced to use whichever app is the most popular. I reckon there is not much criming to be done, if everyone in your gangster-circle is using a different app. I don't think criminals lower down the hierarchies have or have access to much security knowledge, so they might just pick the currently most popular or use multiple apps depending who they talk to.
- tim333 6y ago
  You can buy them on UK Ebay with no ID and they can work throughout the EU.
kenmacd 6y ago
Ignoring the rest of the stack for a minute, any crime group should be hesitant to us software connected to the US. National security letters are still very much a thing there. Signal has fought at least one and won (https://signal.org/bigbrother/ https://signal.org/bigbrother/) we can only know about ones they've won against. Plus say you use Signal, how are you connecting? If that's through an app store then your binary has been replaced. A similar thing happened with Hushmail and their 'client side pgp' jar file: https://archive.is/IRYoh https://archive.is/IRYoh. Then you have to consider the sealed-sender stuff, and other metadata. If your crime group isn't specializing in tech crime in general then outsourcing to a third-party (that could use the Signal code internally) probably makes more sense then trying to figure this stuff out yourself.
mattr47 6y ago
With the option of using a burner sim, I thought about the fact that at least in the US, most places you would buy a prepaid sim will also have you on video surveillance when you purchase it. Maybe I've been watching too much TV, but would it be better to pay some random person to go into a store and buy my sim/chromebook/phone in cash and then bring it to me at a location I know does not have video surveillance?

collaborative 6y ago

It's not a dumb question at all. I bet you that 99% of criminals already use Signal. These ones were dumb enough not to use it and got caught If you want a Signal-like app that doesn't need a phone number you can use www.groupsapp.online

years3500 6y ago
You should have disclosed that groupsapp is your app. How's it better than signal in terms of security other than not requiring phone number? How is the E2EE implemented? Is it open source?
- collaborative 6y ago
  Indeed, I disclose here that I am the developer. It's not better or worse, it's different. You can see a list of features in the link, that should be better than me writing them here (main security pluses are: doesn't read from phone book, email can be masked, sent messages can be deleted even after having been read, and there is a self-destruct mechanism) E2EE is implemented with RSA+AES. iOS uses keychain and CommonCrypto. Android uses a modified BouncyCastles. I'll probably open source the code once I've figured out the licensing details
  - years3500 6y ago
    Thank you.
    - collaborative 6y ago
      Welcome :)
deleted 6y ago
[deleted]
INTPenis 6y ago
Or even better, why don't they have their own synapse network with proper PKI and key rotation? Because anyone who can do that wouldn't waste their lives workin for criminals when they can make safe money legally.
- a2tech 6y ago
  Thats exactly what the Mexican cartels had until the guy that ran it flipped on them. They even had their own cell towers in remote areas of Mexico.
- Nextgrid 6y ago
  > anyone who can do that wouldn't waste their lives workin for criminals when they can make safe money legally The skills required to set up a secure communications network aren't that valued (as in it won't make you a millionaire) in the legal world, and even less so in Europe where IT salaries are absolutely terrible.
  - INTPenis 6y ago
    It will allow you to live comfortably at least. Look I know because I've been between those two worlds. When I was around criminals I had the option of working for them for money and would probably make more than I do today because it would be tax free. But it wouldn't be millions because I'd be in the background helping out with IT infra and policy. So if you're smart you take less money to be left as far outside as possible. The problem is that it's not possible to be outside of that world. You will be taken advantage of. You will be a golden goose that everyone wants a part of just because you can manage their IT securely. So I was smart and got a safe IT job where I make enough to live very comfortably, work where I want, practically when I want and with people who are not openly sociopaths.
    - Nextgrid 6y ago
      What I meant is that if someone doesn't have a moral problem with breaking the law, US tech wages are more likely to sway them towards the right path (just because of the risk aversity) than EU wages where IT isn't well-compensated. I know as well because when starting my career I had to make a choice - if it wasn't for a stroke of luck I may have had to pick the wrong path out of desperation (whether I would've made it anywhere is another question - sounds like you looked into it farther than I did). Thankfully everything worked out and I haven't needed to be on the wrong side of the law, but this was down to luck - you can very well have the skills that would pay well in the criminal world while being stuck in a situation where you can't get much out of those skills in the legal world, so I disagree with the idea that having those skills automatically gives you the option to make a good living legally.

teekert 6y ago

I have the same "dumb" question every time I read this type of news.

tinus_hn 6y ago

You only hear about dumb crooks because those are the ones that get caught.

danielheath 6y ago

Signal keeps chat history on the device, meaning all the incriminating evidence (of yourself and others) is on your person when you get arrested. Sky ECC wipes messages after 30 seconds, meaning a seized phone is of limited value to investigators.

Ploskin 6y ago
Is this still the case even if you set it messages to self-delete after a set period?
sva_ 6y ago
Signal has a function to delete messages after a set interval (after having read it.) I don't know about Sky ECC, but Signal requires a Phone # to register, as far as I remember. It's increasingly hard to get anonymous Phone # in the EU. That might be an argument against using it.
- jfhrnrkfkf 6y ago
  Open the Desktop Signal app, connect it to your phone, and watch it download all the supposedly "expired" messages. They will not always be shown, but they are downloaded.

auganov 6y ago

They're selling a device too, it's not just an app. If you're a high level criminal it's not irrational to worry about zero days getting used on you. The attack surface isn't limited to any one app [0]. I can see how this may be compelling, if done right it makes a lot of sense. Yes, a tiny no-name company is pretty likely to totally mess up. But the "error" in thinking here is being bad with probabilities rather than strictly not understanding something technical. I'd also wonder if there's an element of buying access. If all the top people in some criminal industry use it, it may be a way to signal membership. [0] not that there haven't been numerous whatsapp zerodays and expecting the Signal honeymoon to last makes about as much sense as "there's no Linux/Mac malware"

noir_lord 6y ago
If you where a really high level criminal you wouldn't use a phone at all, you'd pass all your instructions in person to lieutenants who'd pass them on down the chain. This was largely how the Mob operated for decades and why RICO was created. Communications security against national state level organisations in the current environment is a no-win situation for the defending side, you can make their life more difficult but for you to go truly dark means using nothing that shuffles electrons around.
- auganov 6y ago
  I feel like you may have a different definition of who a high level criminal is. I would consider anybody who derives significant revenue (say above $1M) from a criminal activity to count. I'd also question how many highly hierarchical criminal organizations exist today and how many have in the recent past. Media and governments love to overemphasize the organized element for simplicity. Likewise many "terrorist organizations" aren't organized either. In practice you mostly see very lose networks that operate a lot like the rest of the economy. There may be some emergent structure but it's usually not deliberate. > If you where a really high level criminal you wouldn't use a phone at all, you'd pass all your instructions in person to lieutenants who'd pass them on down the chain. > This was largely how the Mob operated for decades and why RICO was created. That would be a legal strategy not a communications security one. It may have been more feasible to proxy away legal responsibility before RICO and such.

upofadown 6y ago

Convenience. Why bother with stuff like, say, validating your Signal "safety numbers" to ensure that you are actually talking to your contact and not the police? Why bother with insuring you are quickly deleting your old messages? Why bother with finding a burner SIM? Instead, just farm out all the boring detail to someone else and buy a "secure" phone for $1-$2k. Unfortunately, at that point you are trusting a third party which becomes a single point of failure. There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers. To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed. Note that Signal on a smart phone is not anywhere near the most secure way to communicate over the internet. Smart phones themselves are not particularly secure and are vulnerable any time they are unlocked. Instant messaging is inherently insecure because it is always on and thus makes it impossible to keep the secret key information locked up securely when the user is not in a safe environment. [1] https://securityaffairs.co/wordpress/57036/cyber-crime/black https://securityaffairs.co/wordpress/57036/cyber-crime/black...

smoe 6y ago

I think in large parts of Europe you need to identify/register when buying a sim. No idea how hard it is to get one without. Also I was just wondering, albeit maybe ridiculous, if criminals have the same issues with messenger apps as the rest of us, in so far that you are kinda forced to use whichever app is the most popular. I reckon there is not much criming to be done, if everyone in your gangster-circle is using a different app. I don't think criminals lower down the hierarchies have or have access to much security knowledge, so they might just pick the currently most popular or use multiple apps depending who they talk to.

tim333 6y ago
You can buy them on UK Ebay with no ID and they can work throughout the EU.

kenmacd 6y ago

Ignoring the rest of the stack for a minute, any crime group should be hesitant to us software connected to the US. National security letters are still very much a thing there. Signal has fought at least one and won (https://signal.org/bigbrother/ https://signal.org/bigbrother/) we can only know about ones they've won against. Plus say you use Signal, how are you connecting? If that's through an app store then your binary has been replaced. A similar thing happened with Hushmail and their 'client side pgp' jar file: https://archive.is/IRYoh https://archive.is/IRYoh. Then you have to consider the sealed-sender stuff, and other metadata. If your crime group isn't specializing in tech crime in general then outsourcing to a third-party (that could use the Signal code internally) probably makes more sense then trying to figure this stuff out yourself.

mattr47 6y ago

With the option of using a burner sim, I thought about the fact that at least in the US, most places you would buy a prepaid sim will also have you on video surveillance when you purchase it. Maybe I've been watching too much TV, but would it be better to pay some random person to go into a store and buy my sim/chromebook/phone in cash and then bring it to me at a location I know does not have video surveillance?