9 ms·
Inside Job: How a Hacker Helped Cocaine Traffickers Infiltrate Europe's Ports
- pixxel 3y agoInteresting piece. I’m left more interested in this: > breaking into the encrypted chat platform SkyECC Psychical access to a device or something more technical…
- kotaKat 3y agoSkyECC was blown wide open by LE. https://en.wikipedia.org/wiki/Shutdown_of_Sky_Global https://en.wikipedia.org/wiki/Shutdown_of_Sky_Global
- taosx 3y agoHow did they manage to decrypt the messages, I thought it's very expensive to decrypt a correctly encrypted piece of data? "About a billion messages were intercepted, about half of which had been decrypted by April 2021—further avenues of inquiry were expected to open as decryption progressed"
- kotaKat 3y agoIn some of the raids they got their hands on SkyECC infrastructure, IIRC. SkyECC claimed "no, that's a fake version of our app" yet they seemingly did have some service disruptions at the same time. They also suddenly claim all the users that got intercepted were using "elaborate fake" SkyECC apps and services, yet oddly those same "fake" apps could talk with actual SkyECC users, so, y'know. Grains of salt.
- dotnet00 3y agoI'd say most things are more technical than access to a device through psychic means ;)
- TheLoafOfBread 3y agoPsykers are natural evolution of hackers.
- pixxel 3y agolol! I’m leaving it unedited.
- ta988 3y agohttps://journals.sagepub.com/doi/10.1177/20322844231212661 https://journals.sagepub.com/doi/10.1177/20322844231212661 It is unclear how the decryption was made, but it talks about how the servers were tapped into including RAM access!
- pixxel 3y ago> Dutch technicians then developed a technique to copy the random access memory (RAM) of one of the Sky ECC servers without causing them to offline Teasing! I wonder how. Thanks for sharing.
- fullspectrumdev 3y agoThere’s a number of ways to take a physical memory dump from a server without taking it offline. On Linux, there’s for example Lime if you have root. On windows there’s various other tools, some commercial, some open source. All require admin privs. If you have access to the hypervisor it’s even easier - just direct the hypervisor to dump the VM’s RAM to a file. Most hypervisor tools have a utility for this. If you have only physical access it’s a bit trickier, but if there’s an available PCIe slot and you are very careful it’s possible to dump RAM that way on a live system :)
- TacticalCoder 3y agoTFA talks a lot about corruption and it's way worse than people think. Not that long in Belgium, in the port of Antwerp ("Anvers" in french), non-corrupt employees found a container with cocaine. Before the authorities came to seize the shipment, corrupt cops tried to bribe the port custom employees to gain temporary access to the container (basically to steal part of the shipment before it'd be officially weighted). I pity these people: when shipment go undetected, it's their fault. Then criminals try to bribe them. Then corrupt cops try to bribe them. It's a sad state of affair. Whether cocaine should be legal or not is another topic but it's not legal and there are killings related to cocaine traffic in Europe: consumers of cocaine have their share of responsibility too.
- dylan604 3y ago>consumers of cocaine have their share of responsibility too. consumers of any product. consumers of chocolate are responsible for... consumers of electronics are responsible for... consumers of cotton are responsible for... there's only so many options consumers really have. there are somethings you cannot vote with your wallet. blaming addicts teeters precariously towards victim blaming.
- 11235813213455 3y agototally right, consuming is polluting, which is a big responsibility nowadays for the environment So the best is to minimize consumption, and obviously things like drugs, travel, and many things are not essential products
- para_parolu 3y agoAnd having children
- JumpinJack_Cash 3y ago"You'll own nothing and you'll be happy eating bugs"
- deleted 3y ago[deleted]
- gumballindie 3y agoThey dont need to hack their way in. A good bribe in a dutch or belgian official pocket is all it takes.
- InCityDreams 3y agoNationality irrelevant. Any human can be bribed.
- s5300 3y ago[dead]
- konschubert 3y agoIt matters which nations have a culture of corruption
- erie 3y agoThat is meaningless, the culture of corruption' in US congress does not extend to everyone in the US.
- dotnet00 3y agoBut no one feels the need to get defensive about nationality if "just bribe some American congressmen" is stated instead of "Dutch or Belgian official".
- gruez 3y agoCan you clarify what exactly is meant by "the culture of corruption' in US congress"? I assume you're talking about campaign contributions and the associated quasi-quid pro quo dealings, but most Americans don't receive campaign contributions nor do they meet up with lobbyists, so there's very little opportunity for them to commit such acts of corruption.
- gumballindie 3y agoThe dutch think it’s embedded within one’s race - in europe they even make studies showing the inferiority of east europeans. Even covid was somehow “proven” by dutch universities to affect east europeans differently. Truly a one of a kind nation the netherlands. Yet dutch ports are main drug weapon and people smuggling ports.
- rambambram 3y agoIt's common practice of journalists in The Netherlands to not publish family names of suspects in the media. There are exceptions for 'famous' criminals. So it was striking for me to read full names in the article. If you're into 'real crime' and all this cocaine smuggling and all the accompanying banditry is of interest to you, I can recommend some channels on Youtube. Just search for 'Holland Crime Boulevard' or 'mocro mafia', etc. There has been an ongoing feud since 2012 over a missing shipment of 200kg cocaine with a lot of murders. Even murders of the family of a crown witness, lawyer and a famous crime journalist. Pretty recently there was a discovery of underground containers setup to torture people. Ridouan Taghi and his organisation worked together with Italian and Irish mobsters. Well, I wasn't there, but that's what the media portrays. Also, this is probably not one group, but there were all kinds of groups working together once in a while.
- comprev 3y agoGroups working together is fairly common. The importers handle logistics into the country. Another group handles distribution within a country. Others may handle distribution within towns/cities. They all have a mutual benefit of clear division of responsibilities in the journey - and thus will reduce the inter-group feuds from trying to branch out. The underground market can be incredibly efficient.
- wslh 3y agoDrug traffickers and/or mafias have more cybersecurity tools that most states.
- lnsru 3y agoThere were some job ads from german state company on who’s hiring thread another day. And what can I say… the salaries there are bad joke. One must love the country very much to join such place. I guess, mafia will not save on salaries here.
- wslh 3y agoYes, also in cybersecurity you can earn a lot of money discovering vulnerabilities in popular apps and devices no matter who is on the other side: a state or a criminal entity.
- Nextgrid 3y ago> One must love the country very much to join such place Or be too bad to get any other job. This in turn breeds a terrible environment of mediocrity which immediately extinguishes any promising talent that may (accidentally) join.
- Woshiwuja 3y agoNot in Italy at least. They just have control over big areas, so they dont need it
- hn_throwaway_99 3y agoThe section on PIN code fraud really highlights the need to move away from code/password matching to cryptographic verification: > The large number of port and transport personnel who are able to view these reference numbers — in some cases up to 10,000 people in a single shipping company — provides traffickers with many targets. This is equivalent to storing passwords in plaintext. A code that is needed to actually access the goods (i.e. used as a password) should be stored as a cryptographic hash or signature, and then only the right parties can verify that signature, with middle men having no access to it. No, it won't solve all forms of corruption, but it will take thousands of people out of the "bribable" (or worse, "intimidatable", as the article explains) category.
- tleilaxu 3y agoI suspect the existing implementation and it’s downsides are a feature not a bug.
- Nextgrid 3y agoThe aforementioned example shows nefarious exploitation of the vulnerability, but the same vulnerability is likely also "exploited" day to day by authorized users as a shortcut or workaround against system failures, missing features or bad user experience. For example, in a perfectly-secure system, how hard would it be to delegate access to someone (we assume the reason for delegation is legitimate)? If it's harder than writing down the access code and/or texting them then it's a downgrade. Is there a contingency process to keep working if your (obviously outsourced) SSO provider is down, or your machine is applying updates, or your browser is pestering you to leave feedback and trying to convince you to switch to their search engine before it'll let you access the system's access control page? Etc.
- Woshiwuja 3y agoIn Italy the mafia built the port, so we dont have this problem