4 ms·

The story misses the actually interesting part: how did they establish contact and initiate the call in the first place? It’s not like you or I can simply call

by oefrha 6y ago

The story misses the actually interesting part: how did they establish contact and initiate the call in the first place? It’s not like you or I can simply call up <country>’s parliament on Zoom. There’s gotta be some channel of authentication other than “dude in video call looks like some politician” (or some politician’s staff of whom they can find some photos on Google Images), too.

FatalLogic 6y ago
It's likely to be a kind of privilege escalation and trust transfer. They first fool a chain of trusted outside sources and lower-level staff to raise their trust level to be accepted by the target.
jonplackett 6y ago
That, plus I’d like to know what they discussed!
slim 6y ago
It’s not like you or I can simply call up <country>’s parliament on Zoom. Actually yes, mostly. You just need to contact one of the sympathetic MPs, on social networks for example, and he will set it up for you. They're not more security conscious than the general population.
aasasd 6y ago
For some context, the ‘Anti-Corruption Foundation’ of Navalny and Volkov was giving talks for European and US state/human-rights organizations for years. It's actually a bit weird if MPs didn't get Volkov's phone number and other contact info from colleages of other countries. But then, phone numbers can be spoofed, and if these incidents are done by the state—the FSS follows ACF for a long time now, they probably know quite well who Volkov speaks to.
jeroenhd 6y ago
Getting into contact with the Dutch parliament is actually quite easy, if you have a story interesting enough, you can probably get them to read your email and forward the Zoom link. A simple phishing attack should be more than enough to confuse these people. They're almost all exclusively schooled in social sciences, business, history, that kind of thing. Incredibly few of them have any sort of technical background. There are plenty of agencies working their hardest to keep the political leaders safe, but they can't fix the people themselves. A Dutch journalist managed to get into a "secret" Zoom call with the European ministers of defence after a Dutch politician posted a picture of her screen... with the invite link and most of the password visible. I'm sure they're intelligent people, but when it comes to computers, their young children/grandchildren are probably more capable of securing themselves online than they can. Also keep in mind that there's an aura of secrecy surrounding Navalny's chief of staff even before the Russian government tried to kill Navalny. Things like routing traffic through TOR and the use of privacy-enhancing technologies like Fastmail can be well explained in an environment where the government actively wants to kill any competition to the current leadership. In truth, I think these people have fallen for a well-put-together spear phishing attack that worked well because of their lack of digital skills. I strongly doubt that the leaders of other countries will do much better; politicians and tech rarely mix well. I find it much more troubling that the Dutch government is using Zoom, a product with a terrible history in security problems from a company based in the country that notoriously spied on politicians of even just allied countries. Using American software for government videoconferencing (especially about Russian politics) is a terrible risk.
- toyg 6y ago
  It just baffles me how late governments seem to be at establishing secure videoconf applications for their middle-management (which is effectively what MPs are). I would assume most of NATO has better tools for military applications- what is stopping them from repurposing some of these tools for more “everyday” situations?
  - ForHackernews 6y ago
    MPs are not "middle managers". In many countries [0] Parliament is sovereign: Collectively, MPs are the highest authority in the land. Theoretically, if they chose to do so, they could dissolve the judiciary, have anyone they didn't like executed, and declare war on their neighbours. [0] https://en.wikipedia.org/wiki/Parliamentary_sovereignty https://en.wikipedia.org/wiki/Parliamentary_sovereignty
    - toyg 6y ago
      Well, in most countries the sovereign is actually the people, and Parliaments act as intermediary interpreters of the popular will. Hence, middle-management.
      - ForHackernews 6y ago
        No, that that's not true. In countries with a history of royalty the monarch is sovereign but in modern times that power is vested in Parliament. The notion of popular sovereignty is largely a recent new-world fancy.
        toyg 6y ago
        I don’t know what your beef is, but what you say it’s not true for France, Germany, Italy, and likely tons more. All these constitutions state explicitly that sovereignty belongs to the people. Even in UK, where Parliament is now sovereign by way of forcing its primacy over the Crown, there are plenty of arguments about this (as recently rehashed), and the question is technically not settled.
lostlogin 6y ago
> It’s not like you or I can simply call up <country>’s parliament on Zoom. If the target is the UK, you can wait until BJ posts the meeting ID and MP usernames on Twitter. Somewhat surprisingly, there was a meeting password in that incident. https://www.bbc.com/news/technology-52126534 https://www.bbc.com/news/technology-52126534
Blikkentrekker 6y ago
One of the benefits of a fairly small country is that politicians are quite approachable. Amateur YouTube channels frequently walk up to Dutch politicians to ask them a few quæstions without men in black denying them access. It benefits journalism, of course, as the politicians feel compelled to provide some answer as a refusal to answer a tough quæstion will be construed against them. In larger countries, security has given politicians the perfect excuse to control who can, and cannot ask them quæstions, by only inviting the journalists favorable to them on their press conferences, and decide who can ask. Journalists being able to approach politicians directly is quite beneficial to democracy.

by oefrha 6y ago

FatalLogic 6y ago

It's likely to be a kind of privilege escalation and trust transfer. They first fool a chain of trusted outside sources and lower-level staff to raise their trust level to be accepted by the target.

jonplackett 6y ago

That, plus I’d like to know what they discussed!

slim 6y ago

It’s not like you or I can simply call up <country>’s parliament on Zoom. Actually yes, mostly. You just need to contact one of the sympathetic MPs, on social networks for example, and he will set it up for you. They're not more security conscious than the general population.

aasasd 6y ago

For some context, the ‘Anti-Corruption Foundation’ of Navalny and Volkov was giving talks for European and US state/human-rights organizations for years. It's actually a bit weird if MPs didn't get Volkov's phone number and other contact info from colleages of other countries. But then, phone numbers can be spoofed, and if these incidents are done by the state—the FSS follows ACF for a long time now, they probably know quite well who Volkov speaks to.

jeroenhd 6y ago

Getting into contact with the Dutch parliament is actually quite easy, if you have a story interesting enough, you can probably get them to read your email and forward the Zoom link. A simple phishing attack should be more than enough to confuse these people. They're almost all exclusively schooled in social sciences, business, history, that kind of thing. Incredibly few of them have any sort of technical background. There are plenty of agencies working their hardest to keep the political leaders safe, but they can't fix the people themselves. A Dutch journalist managed to get into a "secret" Zoom call with the European ministers of defence after a Dutch politician posted a picture of her screen... with the invite link and most of the password visible. I'm sure they're intelligent people, but when it comes to computers, their young children/grandchildren are probably more capable of securing themselves online than they can. Also keep in mind that there's an aura of secrecy surrounding Navalny's chief of staff even before the Russian government tried to kill Navalny. Things like routing traffic through TOR and the use of privacy-enhancing technologies like Fastmail can be well explained in an environment where the government actively wants to kill any competition to the current leadership. In truth, I think these people have fallen for a well-put-together spear phishing attack that worked well because of their lack of digital skills. I strongly doubt that the leaders of other countries will do much better; politicians and tech rarely mix well. I find it much more troubling that the Dutch government is using Zoom, a product with a terrible history in security problems from a company based in the country that notoriously spied on politicians of even just allied countries. Using American software for government videoconferencing (especially about Russian politics) is a terrible risk.

toyg 6y ago
It just baffles me how late governments seem to be at establishing secure videoconf applications for their middle-management (which is effectively what MPs are). I would assume most of NATO has better tools for military applications- what is stopping them from repurposing some of these tools for more “everyday” situations?
- ForHackernews 6y ago
  MPs are not "middle managers". In many countries [0] Parliament is sovereign: Collectively, MPs are the highest authority in the land. Theoretically, if they chose to do so, they could dissolve the judiciary, have anyone they didn't like executed, and declare war on their neighbours. [0] https://en.wikipedia.org/wiki/Parliamentary_sovereignty https://en.wikipedia.org/wiki/Parliamentary_sovereignty
  - toyg 6y ago
    Well, in most countries the sovereign is actually the people, and Parliaments act as intermediary interpreters of the popular will. Hence, middle-management.
    - ForHackernews 6y ago
      No, that that's not true. In countries with a history of royalty the monarch is sovereign but in modern times that power is vested in Parliament. The notion of popular sovereignty is largely a recent new-world fancy.
      - toyg 6y ago
        I don’t know what your beef is, but what you say it’s not true for France, Germany, Italy, and likely tons more. All these constitutions state explicitly that sovereignty belongs to the people. Even in UK, where Parliament is now sovereign by way of forcing its primacy over the Crown, there are plenty of arguments about this (as recently rehashed), and the question is technically not settled.

lostlogin 6y ago

> It’s not like you or I can simply call up <country>’s parliament on Zoom. If the target is the UK, you can wait until BJ posts the meeting ID and MP usernames on Twitter. Somewhat surprisingly, there was a meeting password in that incident. https://www.bbc.com/news/technology-52126534 https://www.bbc.com/news/technology-52126534

Blikkentrekker 6y ago

One of the benefits of a fairly small country is that politicians are quite approachable. Amateur YouTube channels frequently walk up to Dutch politicians to ask them a few quæstions without men in black denying them access. It benefits journalism, of course, as the politicians feel compelled to provide some answer as a refusal to answer a tough quæstion will be construed against them. In larger countries, security has given politicians the perfect excuse to control who can, and cannot ask them quæstions, by only inviting the journalists favorable to them on their press conferences, and decide who can ask. Journalists being able to approach politicians directly is quite beneficial to democracy.