5 ms·

Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.

by ljf 3y ago

bombcar 3y ago
It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.
- cirosantilli 3y ago
  I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
  - bombcar 3y ago
    I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).
    - 082349872349872 3y ago
      Steganography-wise, timestamps of HN comments aren't part of the UI, but are delivered in the HTML: <span class="age" title="2023-06-11T12:31:28"> <a href="item?id=36280770">22 minutes ago</a> so —in principle— the minutes field could be used to provide a very low bandwidth covert channel on top of innocuous commentary. Wouldn't it be pretty difficult to pick up even an outbound one-if-by-land two-if-by-sea style communication from the general noise floor?
- _kbh_ 3y ago
  > Things like TOR can help, but that can be difficult to completely hide, and so on. I think stuff like TOR are actively harmful to a site like the CIA is trying to run. Accessing TOR would make you light up like a Christmas tree, it's a much harder problem to solve without TOR (as the CIA tried). > It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. Randomising the structure and sanitising the element names (not having password in them) would probably go a long way. It seems like it wasn't designed with a large amount of OPSEC in mind to be honest.
  - bombcar 3y ago
    Which is why there are (some) attempts to disguise Tor traffic, but at some point the bits have to escape and that can be monitored. I wonder what the "bandwidth breakdown" of various traffic types is, and which ones average Tor usage would be comparable to. Could you encapsulate a Tor session in a Youtube video (with cooperation from Google)? Or would that be noticeable because Youtube is 99/1 and Tor is 80/20?
  - wongarsu 3y ago
    Just run a Tor advocacy program in the area to increase the local userbase. But I tend to agree, for single agent TOR is probably a bad tradeoff, I suspect the intended use case of TOR is likely more about larger groups like opposition movements or rebel groups
- mrandish 3y ago
  > It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virtually no one visited the fake sites (and they re-used unique components). Since the NSA and their "Five Eyes" partners tap into the global internet at so many points for "full take" feeds, it seems like it should be possible to devise a passive approach that monitors seemingly normal interactions with legit high-traffic sites. Just combining commercial browser fingerprinting and broad geolocation with certain patterns of behavior, like visiting a few particular sites in sequence, should be enough to identify the asset trying to make contact. Then the asset's subsequent connection to a different unrelated (and equally legit) site could be taken over by a MITM-style interception. I'm assuming here the NSA can gain sufficient certificate access for some major sites either surreptitiously or by gaining certain corporate employee's cooperation. Once the NSA has stepped into the online transaction with the legit site, it serves up slightly modified pass-through data from the real site to the asset. While more work to set up, it seems something along those lines would be virtually impossible to detect via bulk monitoring, especially if, at the end of each communication session, the asset is given a different ID behavior sequence to use for the next contact. Thus, there's no repeating behavior pattern statistically different enough to stand out.

Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.

by ljf 3y ago

Amazing article and well worth a read to discover how these sites would have worked in practice. It deserves a submission of its own.

bombcar 3y ago

It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. If both sides are educated and trained, you can do things like hiding messages in quasi-randomly selected posts on Hacker News; but that quickly breaks down if one side doesn't have the skillset needed to hide their actions that way. Things like TOR can help, but that can be difficult to completely hide, and so on.

cirosantilli 3y ago
I think it is pretty safe to assume that essentially all opponents are capable. In particular, intelligence is one of the first things dictatorships will invest in, partly to spy on their own people, which the leaders fear above all else. The ideal communication mechanism is one that blends in with a huge number of other "legitimate" users. E.g. for Tor, it only works if many people are also using Tor for other non-spy things. I wonder why not just email.
- bombcar 3y ago
  I'm honestly a bit surprised that they haven't really been pushing "using Tor for piracy" to create additional cover traffic. Email has many problems but may be better than most, but you need to use something like gmail which everyone is using, and even that may be noticeable. Once they suspect you, you're pretty much done for unless you find out that you're on the list and you stop communicating outbound. It's much harder to track one-way broadcast communications (many still think that there are/were communications to spies hidden in BBC shortwave broadcasts, and numbers stations are still a thing).
  - 082349872349872 3y ago
    Steganography-wise, timestamps of HN comments aren't part of the UI, but are delivered in the HTML: <span class="age" title="2023-06-11T12:31:28"> <a href="item?id=36280770">22 minutes ago</a> so —in principle— the minutes field could be used to provide a very low bandwidth covert channel on top of innocuous commentary. Wouldn't it be pretty difficult to pick up even an outbound one-if-by-land two-if-by-sea style communication from the general noise floor?
_kbh_ 3y ago
> Things like TOR can help, but that can be difficult to completely hide, and so on. I think stuff like TOR are actively harmful to a site like the CIA is trying to run. Accessing TOR would make you light up like a Christmas tree, it's a much harder problem to solve without TOR (as the CIA tried). > It's interesting to consider "how would you build it better" - especially when you realize that half of the equation is trained, educated, and safely in America, the other half is potentially anyone in the world anywhere. Randomising the structure and sanitising the element names (not having password in them) would probably go a long way. It seems like it wasn't designed with a large amount of OPSEC in mind to be honest.
- bombcar 3y ago
  Which is why there are (some) attempts to disguise Tor traffic, but at some point the bits have to escape and that can be monitored. I wonder what the "bandwidth breakdown" of various traffic types is, and which ones average Tor usage would be comparable to. Could you encapsulate a Tor session in a Youtube video (with cooperation from Google)? Or would that be noticeable because Youtube is 99/1 and Tor is 80/20?
- wongarsu 3y ago
  Just run a Tor advocacy program in the area to increase the local userbase. But I tend to agree, for single agent TOR is probably a bad tradeoff, I suspect the intended use case of TOR is likely more about larger groups like opposition movements or rebel groups
mrandish 3y ago
> It's interesting to consider "how would you build it better" Creating these one-off websites was easy but also pretty easy to track once detected, since virtually no one visited the fake sites (and they re-used unique components). Since the NSA and their "Five Eyes" partners tap into the global internet at so many points for "full take" feeds, it seems like it should be possible to devise a passive approach that monitors seemingly normal interactions with legit high-traffic sites. Just combining commercial browser fingerprinting and broad geolocation with certain patterns of behavior, like visiting a few particular sites in sequence, should be enough to identify the asset trying to make contact. Then the asset's subsequent connection to a different unrelated (and equally legit) site could be taken over by a MITM-style interception. I'm assuming here the NSA can gain sufficient certificate access for some major sites either surreptitiously or by gaining certain corporate employee's cooperation. Once the NSA has stepped into the online transaction with the legit site, it serves up slightly modified pass-through data from the real site to the asset. While more work to set up, it seems something along those lines would be virtually impossible to detect via bulk monitoring, especially if, at the end of each communication session, the asset is given a different ID behavior sequence to use for the next contact. Thus, there's no repeating behavior pattern statistically different enough to stand out.