5 ms·

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to m

by icu 5y ago

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to mind. It's probably the case that more technically adept criminals will roll their own tech and out manoeuvre rival criminals and law enforcement. Considering the sums of money discussed in the article it's not inconceivable for criminal organisations to start creating their own dev teams.

tokai 5y ago
You would think that, but the whole an0m thing showed that it wasn't really the case.
- chongli 5y ago
  That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols? [1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-cartels-private-phone-networks https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...
  - earnesti 5y ago
    Also, there are lot of open source software in the space - no need to develop your own, just scan the code for backdoors.
    - deleted 5y ago
      [deleted]
  - newsclues 5y ago
    In the 90s Colombian cartels were using mainframes.
  - walrus01 5y ago
    that's not a cellphone network that's a VHF/UHF radio repeater network. basically same idea as ham radio hilltop repeater stuff in the US, but built for private purposes, and using COTS radios capable of basic encryption.
    - chongli 5y ago
      From the article: Soldiers seized 167 antennas, more than 150 repeaters and thousands of cellphones and radios that operated on the system. It sounds like it had both radio and cell bands if phones were able to use it.
      - CompuHacker 5y ago
        There exist very fancy radios that look somewhat like GSM-alike cell phones, if I'm not mistaken.
        walrus01 5y ago
        there are also cheap vhf/uhf handheld radios from china which integrate a basic 2G GSM radio, SIM card slot, and can talk to common euro/asian 3GPP radio bands.
- icu 5y ago
  I mean wouldn't it be logical for the criminals to adapt? It's now public that: a) Crypto is secure, b) Infiltration is difficult, and c) You can't trust hardware and software vendors. From what I can tell the criminals need international communications to facilitate their operations. Ergo, my earlier speculation that the technologically savvy ones will adapt and develop their own proprietary software. Maybe the juice isn't worth the squeeze for criminals to learn software development, but I worry about criminals who do learn.
giantg2 5y ago
The best solutions are to go low tech. Enforcement models and staffing is reliant on electronic technology. Many enforcement organizations are poorly equipted to handle well implemented physical systems.
- joshmarlow 5y ago
  I wonder how useful The Solitare Encryption Algorithm would be here - https://www.schneier.com/academic/solitaire/ https://www.schneier.com/academic/solitaire/
  - indigo945 5y ago
    Solitaire is very broken as an encryption scheme. You should not use it for communication that requires more than LARP security. If you need to encrypt a message manually, LC4 is a better algorithm, but still not acceptable for real world use. The good old one time pad may be most effective.
    - ixwt 5y ago
      I don't remember reading it was broken per say, just that there are some issues, and weak keys. The only work I know of analyzing Solitare is [0]. And they propose some fixes to make it more resilient. OTP is by far the easiest and most reliable pencil and paper crypto algorithm though. [0]: https://arxiv.org/abs/1909.06300 https://arxiv.org/abs/1909.06300
tessierashpool 5y ago
one fun factoid in favor of your argument is that Latin American drug cartels have been known to build their own submarines for drug smuggling. however, most known criminal dev teams are hacker groups in Russia who either operate as part of official espionage activities, or are allowed to operate as long as their victims aren't Russian. all that being said, though, this "criminal software" idea probably isn't as true as you think. criminal enterprises are inherently risky, and there's so much money to be made in software that anybody good enough to do well in a criminal enterprise could do well normally. (unless we count normal companies which get away with breaking the law in the course of normal business as criminal organizations — e.g., Amazon and Tesla for union-busting — in which case, there are probably a lot of people reading this who technically belong to criminal organizations, although some percentage of them would intend otherwise.)
- mistrial9 5y ago
  > most known criminal dev teams are hacker groups in Russia citation, please!

by icu 5y ago

tokai 5y ago

You would think that, but the whole an0m thing showed that it wasn't really the case.

chongli 5y ago
That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols? [1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-cartels-private-phone-networks https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...
- earnesti 5y ago
  Also, there are lot of open source software in the space - no need to develop your own, just scan the code for backdoors.
  - deleted 5y ago
    [deleted]
- newsclues 5y ago
  In the 90s Colombian cartels were using mainframes.
- walrus01 5y ago
  that's not a cellphone network that's a VHF/UHF radio repeater network. basically same idea as ham radio hilltop repeater stuff in the US, but built for private purposes, and using COTS radios capable of basic encryption.
  - chongli 5y ago
    From the article: Soldiers seized 167 antennas, more than 150 repeaters and thousands of cellphones and radios that operated on the system. It sounds like it had both radio and cell bands if phones were able to use it.
    - CompuHacker 5y ago
      There exist very fancy radios that look somewhat like GSM-alike cell phones, if I'm not mistaken.
      - walrus01 5y ago
        there are also cheap vhf/uhf handheld radios from china which integrate a basic 2G GSM radio, SIM card slot, and can talk to common euro/asian 3GPP radio bands.
icu 5y ago
I mean wouldn't it be logical for the criminals to adapt? It's now public that: a) Crypto is secure, b) Infiltration is difficult, and c) You can't trust hardware and software vendors. From what I can tell the criminals need international communications to facilitate their operations. Ergo, my earlier speculation that the technologically savvy ones will adapt and develop their own proprietary software. Maybe the juice isn't worth the squeeze for criminals to learn software development, but I worry about criminals who do learn.

giantg2 5y ago

The best solutions are to go low tech. Enforcement models and staffing is reliant on electronic technology. Many enforcement organizations are poorly equipted to handle well implemented physical systems.

joshmarlow 5y ago
I wonder how useful The Solitare Encryption Algorithm would be here - https://www.schneier.com/academic/solitaire/ https://www.schneier.com/academic/solitaire/
- indigo945 5y ago
  Solitaire is very broken as an encryption scheme. You should not use it for communication that requires more than LARP security. If you need to encrypt a message manually, LC4 is a better algorithm, but still not acceptable for real world use. The good old one time pad may be most effective.
  - ixwt 5y ago
    I don't remember reading it was broken per say, just that there are some issues, and weak keys. The only work I know of analyzing Solitare is [0]. And they propose some fixes to make it more resilient. OTP is by far the easiest and most reliable pencil and paper crypto algorithm though. [0]: https://arxiv.org/abs/1909.06300 https://arxiv.org/abs/1909.06300

tessierashpool 5y ago

one fun factoid in favor of your argument is that Latin American drug cartels have been known to build their own submarines for drug smuggling. however, most known criminal dev teams are hacker groups in Russia who either operate as part of official espionage activities, or are allowed to operate as long as their victims aren't Russian. all that being said, though, this "criminal software" idea probably isn't as true as you think. criminal enterprises are inherently risky, and there's so much money to be made in software that anybody good enough to do well in a criminal enterprise could do well normally. (unless we count normal companies which get away with breaking the law in the course of normal business as criminal organizations — e.g., Amazon and Tesla for union-busting — in which case, there are probably a lot of people reading this who technically belong to criminal organizations, although some percentage of them would intend otherwise.)

mistrial9 5y ago
> most known criminal dev teams are hacker groups in Russia citation, please!