4 ms·

> I would imagine any serious criminal org will have their own messaging infra by now. I'm guessing they do not -- that would be inconvenient, expensive, unrel

> I would imagine any serious criminal org will have their own messaging infra by now. I'm guessing they do not -- that would be inconvenient, expensive, unreliable, insecure, and/or conspicuous. [Edit: "serious" criminal orgs run, e.g., custom-built submarines, so private comms infrastructure is clearly within their technical abilities. But having all org members communicating to a private centralized mothership seems risky from a surveillance perspective]

LinuxBender 2y ago
I'm guessing they do not -- that would be inconvenient, expensive, unreliable, insecure, and/or conspicuous. Some do run their own platforms or share a self hosted platform set up by people in a non cooperating country. Sometimes the platform admins find out they were being MitM by mistake tech or law enforcement make. [1] Or not using the MitM detection Jabber is capable of. Jabber scales to millions of users per cluster, big enough for probably most criminal organizations. I doubt the cluster in question was specifically meant for criminals, but the smart criminals will find solutions best suited for their needs. In this case I think they chose poorly given VM's can be live migrated and snapshot including memory contents without interrupting the platform or raising suspicion. In my humble opinion the big shared corporate platforms will attract the ultra-lazy arrogant and cavalier criminals and I'm sure law enforcement are fine with it. Easy busts still look good to justify big budgets. There are probably people that say they don't know anyone that's been busted on those platforms but they are probably not moving enough volume of illicit goods to warrant immediate attention. That information would be quite useful for getting a warrant however if the target was suspected of something else or if they were an influencer thinking or saying the wrong thing in public. [Edit] Updated link to the snapshot describing potential mitigations including SCRAM PLUS which was not configured in this incident. [1] - https://archive.ph/4wi5t https://archive.ph/4wi5t
pier25 2y ago
More insecure than an app that keeps track of everything in a database you cannot control and can be accessed by the authorities? Even when deleting messages how can you trust these are actually being hard deleted? I would imagine the inconvenience and cost are worth it but what do I know... I'm not a criminal :P

LinuxBender 2y ago

I'm guessing they do not -- that would be inconvenient, expensive, unreliable, insecure, and/or conspicuous. Some do run their own platforms or share a self hosted platform set up by people in a non cooperating country. Sometimes the platform admins find out they were being MitM by mistake tech or law enforcement make. [1] Or not using the MitM detection Jabber is capable of. Jabber scales to millions of users per cluster, big enough for probably most criminal organizations. I doubt the cluster in question was specifically meant for criminals, but the smart criminals will find solutions best suited for their needs. In this case I think they chose poorly given VM's can be live migrated and snapshot including memory contents without interrupting the platform or raising suspicion. In my humble opinion the big shared corporate platforms will attract the ultra-lazy arrogant and cavalier criminals and I'm sure law enforcement are fine with it. Easy busts still look good to justify big budgets. There are probably people that say they don't know anyone that's been busted on those platforms but they are probably not moving enough volume of illicit goods to warrant immediate attention. That information would be quite useful for getting a warrant however if the target was suspected of something else or if they were an influencer thinking or saying the wrong thing in public. [Edit] Updated link to the snapshot describing potential mitigations including SCRAM PLUS which was not configured in this incident. [1] - https://archive.ph/4wi5t https://archive.ph/4wi5t

pier25 2y ago

More insecure than an app that keeps track of everything in a database you cannot control and can be accessed by the authorities? Even when deleting messages how can you trust these are actually being hard deleted? I would imagine the inconvenience and cost are worth it but what do I know... I'm not a criminal :P