6 ms·

In the physical world we take measures to ensure evidence is not tampered with like tamper “resistant” packaging etc... We don’t have any such measures at all f

In the physical world we take measures to ensure evidence is not tampered with like tamper “resistant” packaging etc... We don’t have any such measures at all for the digital “evidence.” And what exactly is digital evidence and how do we keep and maintain the integrity of it from beginning to end. We have trouble maintaining the security of mission critical systems. How are we gonna ensure there are no rogue elements in this process who conveniently can and will digitally frame us. They already use fake evidence in the physical world by planting stuff on us. Digital planting is so much easier. On a similar note, nation state hackers already have false flag tools in their arsenal, where they “plant” evidence of other nations doing an attack. https://en.wikipedia.org/wiki/Vault_7 https://en.wikipedia.org/wiki/Vault_7

gumby 6y ago
They could be extracting the data once into a Merkel tree and then peruse that. I've got to believe the reason they don't is that various intelligence agencies don't want them to.
- cryptonector 6y ago
  You could reconstruct that any way you want to later.
  - gumby 6y ago
    Yes, you'd need to have separate storage for intermediate product (or at least periodic incremental hashes) to ensure against tampering. The meatspace chain of control rules would likely be adequate (at least to the current state of the legal art) to handle the two, were they stored separately.
    - cryptonector 6y ago
      This would require regulation of these devices, and they would have to have adequate hardware protection of the keys used to secure these Merkle hash trees.
      - gumby 6y ago
        Not really: if you copied them to a pair of USB keys, those could be handled like other physical evidence. The point of the Merkle tree in this case is just to make tampering much more difficult/ easier to suspect; independent entities could hash he result and compare for evidence of tampering. This isn’t a case of absolute perfection, this is bringing things up to the current standard (aka “state of he art”) WRT courts and police procedure. Sure, one could design all sorts of additional mechanisms (error correcting codes in the trees etc) but realistically, it’s tamper detection that matters, and it only needs to be as good as paper, candlesticks, fingerprints (sigh) or whatever else is already customary in the evidence room.
        cryptonector 6y ago
        If you have no cryptographic protection then it's just a matter of writing code to tamper with the thing leaving no evidence of that tampering behind.
sneak 6y ago
> We don’t have any such measures at all for the digital “evidence.” This is false. The chain of custody and integrity of digital evidence is pretty much a solved problem. Digital forensics is a fairly mature field. This is not to say there aren't issues with some of the tools, such as Cellebrite's clown show.
- PartiallyTyped 6y ago
  This clown fiesta on Cellebrite's side is an example of the issues of trusting a compiler that Ken Thompson pointed out all those years ago[1]. Trust and Computers don't go hand in hand [2]. [1] https://softwareengineering.stackexchange.com/questions/194746/what-is-the-ken-thompson-hack https://softwareengineering.stackexchange.com/questions/1947... [2] https://pluralistic.net/2020/12/05/trusting-trust/#thompsons-devil https://pluralistic.net/2020/12/05/trusting-trust/#thompsons...
  - colejohnson66 6y ago
    This actually happened with someone way back when: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
    - px43 6y ago
      Pretty sure we had to do the "trusting trust" patch set as a homework assignment during my CS undergrad. It's not actually super complicated. Backdoor login.c when you see it, and backdoor GCC when you see it. Sounds like someone took code from their homework assignment and added a few fun extra credit features to screw with their psychology professor. I can imagine how it would be pretty confusing to stumble across if you hadn't read the paper though :-)
- ganafagol 6y ago
  Your two paragraphs are contradicting each other. The mere possibility that a "clown show" of that magnitude can exist is evidence for the lack of a solution to the problem of digital forensics.
1vuio0pswjnm7 6y ago
"We don't have any such measures at all for the digital "evidence"." This has not stopped courts from accepting digital evidence and the creation of a "digital forensics" industry. Perhaps the only persons who could successfuly call this into question are the same people, so-called "experts", who are supporting its continued existence.
- indigochill 6y ago
  I'm not sure digital forensics is invalid, but it certainly needs a process of validating that the evidence wasn't tampered with due to the easier nature of tampering. Independent review/auditing is insufficient because it could be fooled by tampering. Independent oversight, though, perhaps could work. Imagine a scenario like FBI Bob and EFF Alice show up to image a suspect's hard drive. Both of them image it, Alice hashes it and throws away the image, Bob keeps the image, then if there's a dispute, Alice is called in and provides her hash and if Bob's image doesn't match it, the tampering alarms go off.
  - Natsu 6y ago
    Usually they use things like write blockers to prevent accidental modification of the data, at least with hard drives.
    - logifail 6y ago
      > they use things like write blockers Q: How could you verify that a write blocker was actually used, and that it functioned as described?
      - PeterisP 6y ago
        Just as with most things for physical evidence, paper trail documenting what was done by whom and when, plus the testimony of these people. Think the equivalence of "how do you verify that the fingerprints shown as exhibit A were actually taken off that gun?" - if it's disputed, the forensics expert testifies what they did and without very specific counterarguments the juries generally trust that it's true.
striking 6y ago
It's worth noting that the link you've posted is mostly about the CIA, and it debunks their use of false flag tools.

gumby 6y ago

They could be extracting the data once into a Merkel tree and then peruse that. I've got to believe the reason they don't is that various intelligence agencies don't want them to.

cryptonector 6y ago
You could reconstruct that any way you want to later.
- gumby 6y ago
  Yes, you'd need to have separate storage for intermediate product (or at least periodic incremental hashes) to ensure against tampering. The meatspace chain of control rules would likely be adequate (at least to the current state of the legal art) to handle the two, were they stored separately.
  - cryptonector 6y ago
    This would require regulation of these devices, and they would have to have adequate hardware protection of the keys used to secure these Merkle hash trees.
    - gumby 6y ago
      Not really: if you copied them to a pair of USB keys, those could be handled like other physical evidence. The point of the Merkle tree in this case is just to make tampering much more difficult/ easier to suspect; independent entities could hash he result and compare for evidence of tampering. This isn’t a case of absolute perfection, this is bringing things up to the current standard (aka “state of he art”) WRT courts and police procedure. Sure, one could design all sorts of additional mechanisms (error correcting codes in the trees etc) but realistically, it’s tamper detection that matters, and it only needs to be as good as paper, candlesticks, fingerprints (sigh) or whatever else is already customary in the evidence room.
      - cryptonector 6y ago
        If you have no cryptographic protection then it's just a matter of writing code to tamper with the thing leaving no evidence of that tampering behind.

sneak 6y ago

> We don’t have any such measures at all for the digital “evidence.” This is false. The chain of custody and integrity of digital evidence is pretty much a solved problem. Digital forensics is a fairly mature field. This is not to say there aren't issues with some of the tools, such as Cellebrite's clown show.

PartiallyTyped 6y ago
This clown fiesta on Cellebrite's side is an example of the issues of trusting a compiler that Ken Thompson pointed out all those years ago[1]. Trust and Computers don't go hand in hand [2]. [1] https://softwareengineering.stackexchange.com/questions/194746/what-is-the-ken-thompson-hack https://softwareengineering.stackexchange.com/questions/1947... [2] https://pluralistic.net/2020/12/05/trusting-trust/#thompsons-devil https://pluralistic.net/2020/12/05/trusting-trust/#thompsons...
- colejohnson66 6y ago
  This actually happened with someone way back when: https://www.quora.com/What-is-a-coders-worst-nightmare/answer/Mick-Stute https://www.quora.com/What-is-a-coders-worst-nightmare/answe...
  - px43 6y ago
    Pretty sure we had to do the "trusting trust" patch set as a homework assignment during my CS undergrad. It's not actually super complicated. Backdoor login.c when you see it, and backdoor GCC when you see it. Sounds like someone took code from their homework assignment and added a few fun extra credit features to screw with their psychology professor. I can imagine how it would be pretty confusing to stumble across if you hadn't read the paper though :-)
ganafagol 6y ago
Your two paragraphs are contradicting each other. The mere possibility that a "clown show" of that magnitude can exist is evidence for the lack of a solution to the problem of digital forensics.

1vuio0pswjnm7 6y ago

"We don't have any such measures at all for the digital "evidence"." This has not stopped courts from accepting digital evidence and the creation of a "digital forensics" industry. Perhaps the only persons who could successfuly call this into question are the same people, so-called "experts", who are supporting its continued existence.

indigochill 6y ago
I'm not sure digital forensics is invalid, but it certainly needs a process of validating that the evidence wasn't tampered with due to the easier nature of tampering. Independent review/auditing is insufficient because it could be fooled by tampering. Independent oversight, though, perhaps could work. Imagine a scenario like FBI Bob and EFF Alice show up to image a suspect's hard drive. Both of them image it, Alice hashes it and throws away the image, Bob keeps the image, then if there's a dispute, Alice is called in and provides her hash and if Bob's image doesn't match it, the tampering alarms go off.
- Natsu 6y ago
  Usually they use things like write blockers to prevent accidental modification of the data, at least with hard drives.
  - logifail 6y ago
    > they use things like write blockers Q: How could you verify that a write blocker was actually used, and that it functioned as described?
    - PeterisP 6y ago
      Just as with most things for physical evidence, paper trail documenting what was done by whom and when, plus the testimony of these people. Think the equivalence of "how do you verify that the fingerprints shown as exhibit A were actually taken off that gun?" - if it's disputed, the forensics expert testifies what they did and without very specific counterarguments the juries generally trust that it's true.

striking 6y ago

It's worth noting that the link you've posted is mostly about the CIA, and it debunks their use of false flag tools.