7 ms·
"Crooks' mistaken bet on false marketing claiming end-to-end encryption and offshore hosting by 2 different European communication networks that ended up shutti
by the_jeremy 4y ago
"Crooks' mistaken bet on false marketing claiming end-to-end encryption and offshore hosting by 2 different European communication networks that ended up shutting down due to police raids in 2020-2021" is a better title (or I guess just summary at that point).
- MuffinFlavored 4y agoThis is a dumb slightly unrelated question by me. Say I was a "crook"/bad guy. Why doesn't "well done" AES/RSA/ECC encryption stop law enforcement from being able to "snoop" on what one crook says to another crook?
- upofadown 4y agoNone of these busts involved breaking encryption. They all involved trusting a third party which later became known to be untrustworthy.
- ed_elliott_asc 4y agoAlso when they arrested people the phones were often unlocked (I watched a documentary and saw the police capture phones and state they were unlocked) Also they didn’t use disappearing messages or delete them so the full history was available without breaking any encryption
- bboygravity 4y agoSounds like they catched a bunch of n00bs to me.
- coldtea 4y agoThat's what a n00b would think!
- dist-epoch 4y agoThat's an almost impossible task. The Pegasus malware for example was able to infect and spy any phone.
- deleted 4y ago[deleted]
- e12e 4y agoThe missing part is often the "well done" part. Other than that - traditional bugs/listening devices, malware (recording the sound before encryption/after decryption)? Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".
- forgotmypw17 4y agoI think the main reason is that LE basically has root on the entire stack up to the encryption.
- deleted 4y ago[deleted]
- onion2k 4y agoIt does. The problem is that crooks aren't generally trustworthy, and selling you out is leverage they're very willing to use should the cops ever catch them. The same applies to every part of the illicit communications network you rely on - if any part of the trusted chain breaks down in a way that enables the cops to subvert your encryption you're screwed, right down to installing an OS update on your device. Good opsec is exceptionally hard. If you aren't building it from scratch it probably isn't secure. And even if you are, if you're a big enough target for nation states to be looking you're still going to have a hard time.
- vkou 4y ago> If you aren't building it from scratch it probably isn't secure. And if you are building it from scratch, it is definitely not secure.
- FormerBandmate 4y agoIt's essentially a larger scale, legal version of https://xkcd.com/538/ https://xkcd.com/538/
- er4hn 4y agoIf crooks were proficient at using FOSS to write their own encryption apps that obey best practices... working as an SWE would probably pay better and have less downsides.
- asdfman123 4y agoCrimie movies make us think criminals are bright subversives, when the vast majority of them are dumb thugs. There are much more lucrative paths for intelligent psychopaths in the professional world.
- sofixa 4y agoBut that doesn't stop them from hiring a bunch of capable software engineers from e.g. the Western Balkans to build stuff for them for crazy money (6 figures EUR is crazy money for the Western Balkans). Like the guy who created a phone network for the Colombian cartels in the 1990s.
- fiksie 4y agoMovie stereotyping whole region as aside, 6 figures EUR is not crazy money for western Balkans.
- sofixa 4y ago6 figures EUR is bordering on crazy money for Eastern Balkans, which are in the EU, let alone Western Balkans. For reference, in Bosnia and Herzegovina, the median salary for a software engineer is 3650 BAM (1867 EUR at today's rate), per month, making a yearly 43800 BAM / 22404 EUR, and that's gross, before taxes and stuff. 6 figures EUR, even assuming low 6 figures like 300k, is the equivalent of more than 13 yearly salaries, and is of course untaxed, so even more with that. One can comfortably retire with 300k EUR in Bosnia.
- tough 4y agoSame guy snitched 'em once caught by the FBI tho They'd need to kill those SWE to be -safe- after PS: I wouldn't take a job that can get me killed, there's a reason I like working with computers
- sbierwagen 4y agoIt does. The standard playbook for rolling up criminal conspiracies is to arrest a low level member, offer him a reduced sentence in return for testimony, arrest the next guy higher up based on that testimony, etc. (The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.) You will notice none of this requires communications intercepts. This is because the feds are simply lying when they say encryption prevents law enforcement operations.
- jstarfish 4y agoThere was a Chinese drug lord operating out of Canada who did successfully pull off the cell structure. Amazon of Drugs or something. Somehow they managed perfect forward secrecy. For a while.
- spitfire 4y agoHere he is. https://torontolife.com/city/this-man-is-the-jeff-bezos-of-the-international-drug-trade/ https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...
- more_corn 4y agoIt has never been discovered to exist. If it’s actually good it’ll defeat attempts to uncover it. An even better cell structure would be one where the cells don’t even know that other cells exist.
- dragonwriter 4y ago> An even better cell structure would be one where the cells don’t even know that other cells exist. You can’t have a network with more than one cell where no one outside of the cell knows that it exists, and without those people using a communication method to people in the cell that at least one person in the cell knows exists. And when you minimize down to the minimum contact, the network is very much non-resilient: its hard to discover and roll-up, but (especially if the cells are doing high-risk functions, which is probably why you want to do it) its also easy to disintegrate accidentally, even without being discovered and rolled-up.
- wmf 4y agoThe real problem is that most people cannot tell whether they're buying proper encryption or snake oil.
- lordnacho 4y agoExactly this. If your core competence is crime and not cryptography, what have you got other than reputation to base your decision on? Just like all of us in whatever sphere we're in.
- bsder 4y agoIt does. But how do you prove you have a "well done" cryptosystem? Very few "crypto" exploits are ever the issue. It's almost always easier to break some other part of the system than the crypto. To be honest, if someone were trying to sell me a cryptosystem for a criminal enterprise and I were in the market for one, I'd happily start tracing everybody in that company as they are almost certainly part of the Feds. If you are the target of a nation state actor, you're pretty much fucked. Once a nation decides to put down that much resource to get you, you're getting gotten. Crypto is only valuable in the sense of "I don't have to outrun the hungry tiger. I just have to outrun you so the tiger stops chasing me to eat." If you, specifically, are a target, crypto won't help you much.
- newZWhoDis 4y agoSounds to me like the best criminals become nations.
- toss1 4y agoYup, Russia, China, North Korea, all authoritarian states
- Earw0rm 4y agoWinners write the history books. Real winners write the law books. Whether that's European colonial settlers, or William of Normandy. (Not known as "William the Negotiator", or "William the all-around nice guy"). Descendants of the local warlords he installed still own huge (well, by British standards, the entire country isn't much bigger than New York State) tracts of land, a thousand years later.
- toss1 4y agoAre you trying to somehow claim that the well-established fact that the Russian govt is indistinguishable from the Russian Mob, or that North Korea is not counterfeiting currency, running drugs, and hacking networks for currency, all indistinguishable from a criminal gang, and definitely not the purview of legitimate governments?
- bawolff 4y agoYou know the saying don't roll your own crypto, well that is because almost everyone does it wrong. AES/RSA/ECC can't protect you from using it incorrectly.
- blarghyblarg 4y agoYou can have perfect crypto on your devices, and great operations, and your messages can still be intercepted several ways. The feds are almost never in a rush. If they want you, they'll get you. If they want you enough, they'll sit in a coffee shop they know you frequent with a high zoom camera ready to read your encrypted texts from across the room. Or they'll bug your car and listen in to your properly encrypted phone calls. Or they'll intercept a package and add some spy gear. They won't do this to bust some street level meth dealer. But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.
- kube-system 4y ago> But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere. Or they just call up discord and ask for the name and billing address on the account.
- FredPret 4y agoPresumably a criminal mastermind would know to fake that
- mrguyorama 4y agoSeeing as anybody who takes a credit card on the internet has to do some fraud prevention, that's pretty likely to be very difficult. Hell, depending on how paranoid things have been set up, even having uBlock can prevent you from using a credit card somewhere!
- moremetadata 4y ago
- asdfman123 4y agoThe article addresses this: it’s because it’s almost never well done. They claim it’s super secure, and then apparently implement whatever with no oversight.
- kevin_thibedeau 4y agoEncryption only works if the endpoints are secure. Zero day one of them and you have all the access you need without cracking anything.
- kube-system 4y agoThe biggest endpoint vulnerabilities are human in nature.
- Drblessing 4y agoThe NSA quantum computers.
- noirscape 4y agoAt its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user. So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.
- dexterdog 4y agoI would disagree with your assumption on their intelligence wrt knowledge of the tech. No matter how poor your technical education is, you are likely to learn details about the thing that is central to the secrecy of your organization if you have any sense of self-preservation.
- WeylandYutani 4y agoThe reality is that when you start to endanger society the State comes after you. See Escobar and Noriega. The companies offering encrypted phones were infiltrated. Servers hacked. Employees intimidated with prosecution. Bank accounts seized.
- draw_down 4y ago[dead]
- dsfyu404ed 4y agoA reality inspired title doesn't scratch the confirmation bias itch quite the way that a title closer to the "criminals dumb" end of the spectrum does though.