4 ms·

Well you could check the SSH server fingerprint that it matches what the SSH client sees. In principle if the SSH connection is MitM'd, they could change the ou

by _flux 3y ago

Well you could check the SSH server fingerprint that it matches what the SSH client sees. In principle if the SSH connection is MitM'd, they could change the output from the shell so that it would look like it wouldn't be changed. But ultimately they created the keys to begin with, so they can just keep another copy for the purpose of MitM. I doubt they do this nowadays, but they _could_. edit: I actually thought this story was about virtual machines, but I noticed it was about physical hosts, so those have a bit more hope; but ultimately you're still trusting devices that are not physically under your control, so they cannot be trusted. But let's say that in the case of virtual hosts: basically there is no way to ensure you have non-wiretapped connection to a virtual computer provided by hosting service. They don't even need to MitM it, they can just look at the memory of the virtual machine. The only attempt at trying to do that properly has been AMD's "Secure Encrypted Virtualization" https://www.amd.com/en/developer/sev.html https://www.amd.com/en/developer/sev.html, but I think it was broken by some researchers and I don't know if it could currently provide some means to do this safely. I suspect even in that case it might be challenging to install the initial operating systems so that it won't contain the MitM functionality in itself. And even then you would be trusting AMD's implementation of the security layer. Frankly that the wiretap was discovered this time is just a learning experience for the provider to do better next time. I doubt there are good reasons why it should be possible to detect it, if implemented competently.

riku_iki 3y ago
> Basically there is no way to ensure you have non-wiretapped connection to a virtual computer provided by hosting service. so, I relied on market forces here, I hoped that major provider would protect their brand and do not do or allow to do such things, but looks like it is not the case for hetzner and linode.
- bananapub 3y ago
  what are you talking about? the suggestion in these posts is that the German cops made them do it, which is exactly what happens to every provider in every country - they get a subpoena, they may fight it, if they lose they do whatever it is. every hosting (and transit and peering, I assume) provider in every country has an elaborate "lawful intercept" system already set up for secretly copying traffic to the feds / cops / intelligence services. a hijacking of said LI system is what caused a huge scandal / deaths in greece ~twenty years ago: https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004–05 https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004–05
  - riku_iki 3y ago
    > which is exactly what happens to every provider in every country - they get a subpoena do we know cases of silent wiretapping in Google, MS, Amazon clouds?
    - _flux 3y ago
      Absence of proof isn't proof of absence. Do we know cases of Google/MS/Amazon fighting a targeted wiretapping subpoena and winning it? Do you think they would not have been served one?
      - riku_iki 3y ago
        > Absence of proof isn't proof of absence. absence of proof is a proof that your statement about "any company in any country" is just speculation without much ground. > Do we know cases of Google/MS/Amazon fighting a targeted wiretapping subpoena and winning it? we know somehow similar case for Apple: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
        _flux 3y ago
        Is it not a fair assumption that companies would try to follow local laws, though? It seems rather perilous for businesses to do otherwise. It looks like in these cases either the FBI dropped the case or the request was found to be unlawful in the first place. Arguably Apple indeed was following the law even when opposing it within the framework of the law, but what the FBI asks them to do is not the law. We might be looking at a different story had the case fallen to the side of the government—or perhaps no story at all had that requests also contained a gag-order, which I understand is quite common in these cases and could be the key reason why people hardly ever hear of these cases. I also wouldn't say the case of basically cracking customer device the same as providing wiretapping of a service a company provides similar at all—and even in this case it looks like the FBI would have been given access to the iCloud storage, but the problem was that the latest data was not backed up there, it needed to be retrieved directly from the device. There were 42 digital wiretaps (not including combinations) in the year 2023 in US according to https://www.uscourts.gov/statistics-reports/wiretap-report-2022 https://www.uscourts.gov/statistics-reports/wiretap-report-2... "Types of Surveillance Used, Arrests, and Convictions for Intercepts Installed". I wasn't able to find how many of them were in datacenters from that data, though..

by _flux 3y ago

riku_iki 3y ago

> Basically there is no way to ensure you have non-wiretapped connection to a virtual computer provided by hosting service. so, I relied on market forces here, I hoped that major provider would protect their brand and do not do or allow to do such things, but looks like it is not the case for hetzner and linode.

bananapub 3y ago
what are you talking about? the suggestion in these posts is that the German cops made them do it, which is exactly what happens to every provider in every country - they get a subpoena, they may fight it, if they lose they do whatever it is. every hosting (and transit and peering, I assume) provider in every country has an elaborate "lawful intercept" system already set up for secretly copying traffic to the feds / cops / intelligence services. a hijacking of said LI system is what caused a huge scandal / deaths in greece ~twenty years ago: https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004–05 https://en.wikipedia.org/wiki/Greek_wiretapping_case_2004–05
- riku_iki 3y ago
  > which is exactly what happens to every provider in every country - they get a subpoena do we know cases of silent wiretapping in Google, MS, Amazon clouds?
  - _flux 3y ago
    Absence of proof isn't proof of absence. Do we know cases of Google/MS/Amazon fighting a targeted wiretapping subpoena and winning it? Do you think they would not have been served one?
    - riku_iki 3y ago
      > Absence of proof isn't proof of absence. absence of proof is a proof that your statement about "any company in any country" is just speculation without much ground. > Do we know cases of Google/MS/Amazon fighting a targeted wiretapping subpoena and winning it? we know somehow similar case for Apple: https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple%E2%80%93FBI_encryption_d...
      - _flux 3y ago
        Is it not a fair assumption that companies would try to follow local laws, though? It seems rather perilous for businesses to do otherwise. It looks like in these cases either the FBI dropped the case or the request was found to be unlawful in the first place. Arguably Apple indeed was following the law even when opposing it within the framework of the law, but what the FBI asks them to do is not the law. We might be looking at a different story had the case fallen to the side of the government—or perhaps no story at all had that requests also contained a gag-order, which I understand is quite common in these cases and could be the key reason why people hardly ever hear of these cases. I also wouldn't say the case of basically cracking customer device the same as providing wiretapping of a service a company provides similar at all—and even in this case it looks like the FBI would have been given access to the iCloud storage, but the problem was that the latest data was not backed up there, it needed to be retrieved directly from the device. There were 42 digital wiretaps (not including combinations) in the year 2023 in US according to https://www.uscourts.gov/statistics-reports/wiretap-report-2022 https://www.uscourts.gov/statistics-reports/wiretap-report-2... "Types of Surveillance Used, Arrests, and Convictions for Intercepts Installed". I wasn't able to find how many of them were in datacenters from that data, though..