51 ms·

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption client

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption clients. In addition, popular apps, especially in the US, can always be commandeered by 3-letter agencies. You're only anonymous as long as you're not actively targetted, despite using "secure" apps and stuff like Tor, which media makes it seem are unbreakable.

cylde_frog 5y ago
Not quite. They were using an app developed by the police as a honeypot. Someone else had even discovered this and blogged about it[0]. If they had used email and PGP they likely wouldn't have been caught in this way. 3-letter agencies are not going to use their trump card of backdoored OS or hardware to catch drug runners. [0]https://webcache.googleusercontent.com/search?q=cache:PwQXt6Sn_YwJ:https://anomexposed.wordpress.com/+&cd=7&hl=en&ct=clnk&gl=au https://webcache.googleusercontent.com/search?q=cache:PwQXt6...
- CTDOCodebases 5y ago
  True.. however the three letter agencies are going to pass along any relevant information that they stumble across while filtering for money laundering in relation to terrorism. [0] https://en.wikipedia.org/wiki/Parallel_construction?wprov=sfti1 https://en.wikipedia.org/wiki/Parallel_construction?wprov=sf...
- vkou 5y ago
  If they used email and PGP, they wouldn't have been caught this way... That is because the usability of PGP is so bad, they wouldn't have any time to actually operate their criminal enterprise. Also - email, PGP or not, leaks metadata, and the police will happily end your whole criminal career based on metadata.
nexuist 5y ago
> Your hardware has backdoors, so does your OS, and encryption clients None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot. > popular apps This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users. > especially in the US The app was deployed in Australia. > can always be commandeered Why distribute a random app when they could have gotten the criminals to use Signal or Telegram and bust them there? > as long as you're not actively targeted How long did it take to find Bin Laden? > despite using "secure" apps This was not a secure app and any audit would have revealed this (audits such as the ones that Signal and friends have undergone). > and stuff like Tor, Tor was not involved. > media makes it seem are unbreakable. None of the apps hyped as "unbreakable" were broken here, so...point still stands, I guess? Honestly, if anything, the recommended approach from this incident would be to use the walled garden - an FBI-backed honeypot would have a lot harder time getting from the App/Play Store onto a user's phone if it was obviously a scam to collect user conversations, asked for a bunch of permissions, had no reviews, and no apparent update history. Who would download some random chat app that nobody uses?
- lmm 5y ago
  Agree with most of what you said but: > > especially in the US > The app was deployed in Australia. Australia has an even worse equivalent of US National Security Letters, allowing individual workers to be compelled to plant backdoors etc..
  - ungamedplayer 5y ago
    Not without notice of the company, and not for wide spreaed distribution, ie targeted enforcement.
    - lmm 5y ago
      > Not without notice of the company Oh? The reports I read were that they could compel an individual to do something and not tell their employer.
      - ajdlinux 5y ago
        The reports you read were likely based on commentary from techies who have no understanding about law, plus a handful of lawyers involved with digital rights organisations that have an incentive to play up the significance of the legislation a bit / talk about worst-case scenarios, worst possible interpretations of a dangerous law and the broadest possible interpretation of who constitutes a "designated communications provider". The government has stated that's not how they interpret the legislation, as the service provider will be the employer not the employee, and I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something. I'm as suspicious about the Assistance and Access Bill as anyone, but the "telling an employee to implement a backdoor without telling their employer" is really a red herring and I don't know why the Australian tech community was so keen to go along with that.
        the-dude 5y ago
        Why would such a law target an employee, when as you claim, it targets the employer indirectly too? Why not leave it at the employer? Just because won't cut it.
Zenst 5y ago
>The lesson here is complete trust in modern computing platforms is misplaced and impossible For me the lesson here is the same old lesson - Your security is only as good as the humans that interact with it.

cylde_frog 5y ago

Not quite. They were using an app developed by the police as a honeypot. Someone else had even discovered this and blogged about it[0]. If they had used email and PGP they likely wouldn't have been caught in this way. 3-letter agencies are not going to use their trump card of backdoored OS or hardware to catch drug runners. [0]https://webcache.googleusercontent.com/search?q=cache:PwQXt6Sn_YwJ:https://anomexposed.wordpress.com/+&cd=7&hl=en&ct=clnk&gl=au https://webcache.googleusercontent.com/search?q=cache:PwQXt6...

CTDOCodebases 5y ago
True.. however the three letter agencies are going to pass along any relevant information that they stumble across while filtering for money laundering in relation to terrorism. [0] https://en.wikipedia.org/wiki/Parallel_construction?wprov=sfti1 https://en.wikipedia.org/wiki/Parallel_construction?wprov=sf...
vkou 5y ago
If they used email and PGP, they wouldn't have been caught this way... That is because the usability of PGP is so bad, they wouldn't have any time to actually operate their criminal enterprise. Also - email, PGP or not, leaks metadata, and the police will happily end your whole criminal career based on metadata.

nexuist 5y ago

> Your hardware has backdoors, so does your OS, and encryption clients None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot. > popular apps This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users. > especially in the US The app was deployed in Australia. > can always be commandeered Why distribute a random app when they could have gotten the criminals to use Signal or Telegram and bust them there? > as long as you're not actively targeted How long did it take to find Bin Laden? > despite using "secure" apps This was not a secure app and any audit would have revealed this (audits such as the ones that Signal and friends have undergone). > and stuff like Tor, Tor was not involved. > media makes it seem are unbreakable. None of the apps hyped as "unbreakable" were broken here, so...point still stands, I guess? Honestly, if anything, the recommended approach from this incident would be to use the walled garden - an FBI-backed honeypot would have a lot harder time getting from the App/Play Store onto a user's phone if it was obviously a scam to collect user conversations, asked for a bunch of permissions, had no reviews, and no apparent update history. Who would download some random chat app that nobody uses?

lmm 5y ago
Agree with most of what you said but: > > especially in the US > The app was deployed in Australia. Australia has an even worse equivalent of US National Security Letters, allowing individual workers to be compelled to plant backdoors etc..
- ungamedplayer 5y ago
  Not without notice of the company, and not for wide spreaed distribution, ie targeted enforcement.
  - lmm 5y ago
    > Not without notice of the company Oh? The reports I read were that they could compel an individual to do something and not tell their employer.
    - ajdlinux 5y ago
      The reports you read were likely based on commentary from techies who have no understanding about law, plus a handful of lawyers involved with digital rights organisations that have an incentive to play up the significance of the legislation a bit / talk about worst-case scenarios, worst possible interpretations of a dangerous law and the broadest possible interpretation of who constitutes a "designated communications provider". The government has stated that's not how they interpret the legislation, as the service provider will be the employer not the employee, and I don't think government lawyers are in the habit of arguing that the government _doesn't_ have power to do something. I'm as suspicious about the Assistance and Access Bill as anyone, but the "telling an employee to implement a backdoor without telling their employer" is really a red herring and I don't know why the Australian tech community was so keen to go along with that.
      - the-dude 5y ago
        Why would such a law target an employee, when as you claim, it targets the employer indirectly too? Why not leave it at the employer? Just because won't cut it.

Zenst 5y ago

>The lesson here is complete trust in modern computing platforms is misplaced and impossible For me the lesson here is the same old lesson - Your security is only as good as the humans that interact with it.