4 ms·

This article was hard to follow, if you want to see what the actual website looked like, and how the informant would communicate back to the CIA, scroll about h

by nailer 3y ago

This article was hard to follow, if you want to see what the actual website looked like, and how the informant would communicate back to the CIA, scroll about halfway down this Reuters article: https://www.reuters.com/investigates/special-report/usa-spies-iran/ https://www.reuters.com/investigates/special-report/usa-spie...

ljf 3y ago
Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.
- bombcar 3y ago
  It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.
  - cirosantilli 3y ago
    I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
    - bombcar 3y ago
      I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).
      - 082349872349872 3y ago
        Steganography-wise, timestamps of HN comments aren't part of the UI, but are delivered in the HTML: <span class="age" title="2023-06-11T12:31:28"> <a href="item?id=36280770">22 minutes ago</a> so —in principle— the minutes field could be used to provide a very low bandwidth covert channel on top of innocuous commentary. Wouldn't it be pretty difficult to pick up even an outbound one-if-by-land two-if-by-sea style communication from the general noise floor?
  - _kbh_ 3y ago
    > Things like TOR can help, but that can be difficult to completely hide, and so on. I think stuff like TOR are actively harmful to a site like the CIA is trying to run. Accessing TOR would make you light up like a Christmas tree, it's a much harder problem to solve without TOR (as the CIA tried). > It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. Randomising the structure and sanitising the element names (not having password in them) would probably go a long way. It seems like it wasn't designed with a large amount of OPSEC in mind to be honest.
    - bombcar 3y ago
      Which is why there are (some) attempts to disguise Tor traffic, but at some point the bits have to escape and that can be monitored. I wonder what the "bandwidth breakdown" of various traffic types is, and which ones average Tor usage would be comparable to. Could you encapsulate a Tor session in a Youtube video (with cooperation from Google)? Or would that be noticeable because Youtube is 99/1 and Tor is 80/20?
    - wongarsu 3y ago
      Just run a Tor advocacy program in the area to increase the local userbase. But I tend to agree, for single agent TOR is probably a bad tradeoff, I suspect the intended use case of TOR is likely more about larger groups like opposition movements or rebel groups
  - mrandish 3y ago
    > It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virtually no one visited the fake sites (and they re-used unique components). Since the NSA and their "Five Eyes" partners tap into the global internet at so many points for "full take" feeds, it seems like it should be possible to devise a passive approach that monitors seemingly normal interactions with legit high-traffic sites. Just combining commercial browser fingerprinting and broad geolocation with certain patterns of behavior, like visiting a few particular sites in sequence, should be enough to identify the asset trying to make contact. Then the asset's subsequent connection to a different unrelated (and equally legit) site could be taken over by a MITM-style interception. I'm assuming here the NSA can gain sufficient certificate access for some major sites either surreptitiously or by gaining certain corporate employee's cooperation. Once the NSA has stepped into the online transaction with the legit site, it serves up slightly modified pass-through data from the real site to the asset. While more work to set up, it seems something along those lines would be virtually impossible to detect via bulk monitoring, especially if, at the end of each communication session, the asset is given a different ID behavior sequence to use for the next contact. Thus, there's no repeating behavior pattern statistically different enough to stand out.
cirosantilli 3y ago
Sure, the point of my article is to build upon the Reuters article to provide some concrete domains/archives links, add new sites to the existing Reuters list, and explain the technical details used to obtain them. With a bit of reverse engineering, I'm sure we'd be able to get a mockup of the JavaScript ones running however: https://cirosantilli.com/cia-2010-covert-communication-websites#javascript-reverse-engineering https://cirosantilli.com/cia-2010-covert-communication-websi... But in the end, it's just going to be some kind of "click something, a box opens, you type, it encrypts and sends a POST request.". The main interest of reverse engineering to me would be to possibly find some searchable fingerprint that we could use to find more of the websites.
- jaclaz 3y ago
  Side question (irrelevant, just as curiosity), why did you write it in third person? I see that later on you switch to "we". JFYI, there are a couple typos I could spot, "pubic" and "lits".
  - cirosantilli 3y ago
    Hi, third person: https://cirosantilli.com/why-ciro-santilli-refers-to-himself-in-the-third-person https://cirosantilli.com/why-ciro-santilli-refers-to-himself... We includes me, and if at some point others might contribute. So when it's not something I did specifically, I tend to we. Typos: fixed now and some others, thanks. Feel free to send any others. "Pubic" one was epic. Vim sometimes forgets to turn on spellcheck.
    - jaclaz 3y ago
      Yep, the "pubic" one is a classic.

by nailer 3y ago

ljf 3y ago

Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.

bombcar 3y ago
It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.
- cirosantilli 3y ago
  I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
  - bombcar 3y ago
    I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).
    - 082349872349872 3y ago
      Steganography-wise, timestamps of HN comments aren't part of the UI, but are delivered in the HTML: <span class="age" title="2023-06-11T12:31:28"> <a href="item?id=36280770">22 minutes ago</a> so —in principle— the minutes field could be used to provide a very low bandwidth covert channel on top of innocuous commentary. Wouldn't it be pretty difficult to pick up even an outbound one-if-by-land two-if-by-sea style communication from the general noise floor?
- _kbh_ 3y ago
  > Things like TOR can help, but that can be difficult to completely hide, and so on. I think stuff like TOR are actively harmful to a site like the CIA is trying to run. Accessing TOR would make you light up like a Christmas tree, it's a much harder problem to solve without TOR (as the CIA tried). > It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. Randomising the structure and sanitising the element names (not having password in them) would probably go a long way. It seems like it wasn't designed with a large amount of OPSEC in mind to be honest.
  - bombcar 3y ago
    Which is why there are (some) attempts to disguise Tor traffic, but at some point the bits have to escape and that can be monitored. I wonder what the "bandwidth breakdown" of various traffic types is, and which ones average Tor usage would be comparable to. Could you encapsulate a Tor session in a Youtube video (with cooperation from Google)? Or would that be noticeable because Youtube is 99/1 and Tor is 80/20?
  - wongarsu 3y ago
    Just run a Tor advocacy program in the area to increase the local userbase. But I tend to agree, for single agent TOR is probably a bad tradeoff, I suspect the intended use case of TOR is likely more about larger groups like opposition movements or rebel groups
- mrandish 3y ago
  > It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virtually no one visited the fake sites (and they re-used unique components). Since the NSA and their "Five Eyes" partners tap into the global internet at so many points for "full take" feeds, it seems like it should be possible to devise a passive approach that monitors seemingly normal interactions with legit high-traffic sites. Just combining commercial browser fingerprinting and broad geolocation with certain patterns of behavior, like visiting a few particular sites in sequence, should be enough to identify the asset trying to make contact. Then the asset's subsequent connection to a different unrelated (and equally legit) site could be taken over by a MITM-style interception. I'm assuming here the NSA can gain sufficient certificate access for some major sites either surreptitiously or by gaining certain corporate employee's cooperation. Once the NSA has stepped into the online transaction with the legit site, it serves up slightly modified pass-through data from the real site to the asset. While more work to set up, it seems something along those lines would be virtually impossible to detect via bulk monitoring, especially if, at the end of each communication session, the asset is given a different ID behavior sequence to use for the next contact. Thus, there's no repeating behavior pattern statistically different enough to stand out.

cirosantilli 3y ago

Sure, the point of my article is to build upon the Reuters article to provide some concrete domains/archives links, add new sites to the existing Reuters list, and explain the technical details used to obtain them. With a bit of reverse engineering, I'm sure we'd be able to get a mockup of the JavaScript ones running however: https://cirosantilli.com/cia-2010-covert-communication-websites#javascript-reverse-engineering https://cirosantilli.com/cia-2010-covert-communication-websi... But in the end, it's just going to be some kind of "click something, a box opens, you type, it encrypts and sends a POST request.". The main interest of reverse engineering to me would be to possibly find some searchable fingerprint that we could use to find more of the websites.

jaclaz 3y ago
Side question (irrelevant, just as curiosity), why did you write it in third person? I see that later on you switch to "we". JFYI, there are a couple typos I could spot, "pubic" and "lits".
- cirosantilli 3y ago
  Hi, third person: https://cirosantilli.com/why-ciro-santilli-refers-to-himself-in-the-third-person https://cirosantilli.com/why-ciro-santilli-refers-to-himself... We includes me, and if at some point others might contribute. So when it's not something I did specifically, I tend to we. Typos: fixed now and some others, thanks. Feel free to send any others. "Pubic" one was epic. Vim sometimes forgets to turn on spellcheck.
  - jaclaz 3y ago
    Yep, the "pubic" one is a classic.