8 ms·

The Crime Messenger

99 points by SirLJ 2y ago

kubb 2y ago
Feels like criminals will eventually get encrypted communication right and there won’t be anything left for police to do.
- gambiting 2y ago
  Vast majority of criminals are actually stupid though. For every criminal using quantum guaranteed encryption there will be 10 just doing normal unencrypted calls over regular GSM - you use the same tactics against criminals that have been used forever, before IMs were even invented - you infiltrate these groups, arrest lower members, get them to incriminate the people higher up until you dismantle the entire structure. Yeah I know it sounds simple and in reality there are million other steps to do this - but it has been done in the past and is still being done now. That's what the police will do. They caught criminals before they could read their messages, they will catch them again when they can't read their messages.
- deleted 2y ago
  [deleted]
- Cthulhu_ 2y ago
  What makes you believe they don't / didn't already? That's the thing, if it's done right you'll never know until it's found out and decrypted like what is in this article.
- ActionHank 2y ago
  If the marketing is to be believed we are months away from having AI assist someone with no dev, technology, devops background just asking for an app like this.
  - kubb 2y ago
    I mean, nobody really believes that, this is just what you have to say if you have a stake in an AI company. Or you don’t know what you’re talking about.
  - AnimalMuppet 2y ago
    I'm not holding my breath for AI enabling someone with no tech background to get encryption right.
- paxys 2y ago
  Encrypted communication is already a solved problem. The people being caught are the ones who don't have the technical skills to use them correctly.
- dist-epoch 2y ago
  When you have tens of thousands of criminals using a single app, the reward of cracking that in some way is gigantic, and these apps are created by a team of a few people which can't cover every angle like Apple can.
- ruthmarx 2y ago
  Then they'll refine stenography and it will be citizens who suffer increasingly more.
jmdsh 2y ago
[flagged]
Zak 2y ago
> The Serbian criminals shared photos of their victims on Sky without realizing police had installed a probe on the Sky ECC servers in France, which allowed authorities to intercept and read every user’s messages. I'm surprised criminals keep picking these niche messaging services, which keep turning out not to use proper end to end encryption, rather than Signal.
- dghlsakjg 2y ago
  Presumably you don’t hear about the ones that use signal for a reason…
  - notachatbot123 2y ago
    That's what a Fed would say to discourage Signal use.
    - derefr 2y ago
      That’s the opposite of what the GP poster meant to imply. They meant that you don’t hear about the ones that use Signal because they don’t get caught.
      - notachatbot123 2y ago
        Haha it can be read both ways. I read "they don't publish anything about intel gathered in Signal to keep people trusting it".
    - krisoft 2y ago
      > That's what a Fed would say to discourage Signal use. What? No. That is exactly what a Fed (or anyone else) would say to encourage Signal use. "Presumably you don’t hear about the ones that use signal for a reason…" The reason being that they don't get caught so you don't hear about them.
    - RUnconcerned 2y ago
      feds literally fund signal https://www.mintpressnews.com/the-open-technology-fund-makes-privacy-apps-staffed-spies/279147/ https://www.mintpressnews.com/the-open-technology-fund-makes...
dghlsakjg 2y ago
> “Privacy is really, really important and we all have the right to our privacy,” said Catherine De Bolle, executive director of Europol, the law enforcement agency of the European Union. “But when we see now that encrypted communication is really an enabler for crime, then we have to do something.” Can she hear herself when she talks? Apparently we don’t have a right to our privacy. Interpol intercepting every message going across a server just because some of the messages might be criminal is explicitly acting in a way that does not imply any right to privacy.
- deleted 2y ago
  [deleted]
- hbn 2y ago
  As soon as someone follows "we all have the right to privacy" with "but", a springboard should pop up from under their feet and launch them into space. Unsurprising the first time I see a CBC article at the top of HN, it's a puff piece about how taking people's privacy is supposedly good for us. Real glad I paid for this article, but it's not like I'm not constantly paying for these clowns to produce slop that I find appalling. They recently spent $2 million to create a bunch of liberal propaganda podcasts that got a few hundred views per episode. I hate this country.
  - ipython 2y ago
    When the entire point of the enterprise (sky in this case) is to enable criminals, wouldn’t the enterprise itself be part of the criminal conspiracy? I am all for privacy, but I’m also for rule of law. If I could start an encrypted messaging company that marketed exclusively to criminals, then wouldn’t I expect to be charged as abetting the crimes committed as a result of facilitating that communication? It’s a question of intent. Law isn’t black and white- and law recognizes that tools can be dual use. It’s not perfect but nothing is.
    - dghlsakjg 2y ago
      No one is arguing that the company shouldn’t face consequences, people are arguing that their customers who aren’t part of some criminal enterprise shouldn’t have all of their messages intercepted, decrypted and put in a database.
darknavi 2y ago
A good defcon talk that referenced Sky but focused on another platform called Anon: https://youtu.be/uFyk5UOyNqI?si=i-GtpeCR1QEj69cz https://youtu.be/uFyk5UOyNqI?si=i-GtpeCR1QEj69cz
auscad 2y ago
What makes this different from a typical attack on encryption is that this company (probably) knowingly distributed to and worked with criminal enterprises. But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.
- Cthulhu_ 2y ago
  > (probably) knowingly That's doing a lot of heavy lifting. I'm sure they knew, personally, but since everything is encrypted, even for themselves, they have plausible deniability. If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking. And even then, criminals can talk using e.g. commercially available phones and mobile networks; are those networks / manufacturers / anyone but the criminal responsible for what is talked about? Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication. It doesn't make them guilty themselves.
  - gambiting 2y ago
    >>If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking. If you look at the article it has examples found of the company employees explicitly saying they are meeting with criminals so to play it safe. It doesn't get any more "solid proof" than that. >>are those networks / manufacturers / anyone but the criminal responsible for what is talked about? No, but again - read the article. There are examples of their employees saying that a client of theirs was arrested so they proactively wiped their phone - that could be interpreted as knowingly destroying evidence. They did end up changing this policy to not wipe phones of people who have been arrested, precisely because of this concern. >>Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication The difference is most likely in how it's advertised and sold. Whatsapp is a free app that anyone can use, Facebook can reasonably claim that they don't advertise to criminals or encourage illegal use because the app is free to anyone. The owners of this app made it paid and they actively pursued clients they knew were members of criminal rings. Whether that passes the threshold for holding the company liable - that's for courts to decide. But that's generally where I think the line is. Anyone can make and sell a knife, but start selling knives(knowingly) to gang members and you're going to be in trouble even though selling a knife isn't illegal in itself.
BadHumans 2y ago
[flagged]
- deleted 2y ago
  [deleted]
reverendsteveii 2y ago
[flagged]
- deleted 2y ago
  [deleted]
paxys 2y ago
Pretty ironic that they got caught after going out of their way to buy secure phones and use secure messaging services when an off-the-shelf iPhone and Whatsapp/Signal/Telegram would have made them 100% untraceable.
- mhitza 2y ago
  Probably Signal would have been a safe bet. Telegram doesn't do encryption by default (on group messages? Been a year or two since I've used it). And Facebook complies with law enforcement agencies, and I don't think it's unreasonable for them to have a feature flags to selectively and transparently disable encryption for some participants if need be.
  - joering2 2y ago
    Facebook certainly likes to at least have sense to know what you are conversating about. Sometime in 2016 we and my buddy abroad got our accounts frozen "due to security reasons" at exact same time; what we were doing is having fun with FB Messenger and sending each other PGP-encrypted messages. This least about 2 months and my buddy is Egyptian, so I am pretty sure at some point FB said "we don't know what they chat about and enough is enough". I got my account recovered after multiple layers of verification including video-call to hold up my ID done by third-party ... my friend never gotten his reinstated.
    - int_19h 2y ago
      Facebook definitely has some kind of chat monitoring and real-time censorship in place. For example, I once couldn't send a message in private chat if it included a link to one of the online weed stores. Remove the link, and it goes through just fine. Put the link there, and the thing just hangs and errors out with no coherent explanation.
  - Zak 2y ago
    Telegram doesn't do encryption on group messages at all, nor does it do encryption by default on any messages. End to end encryption is available for one-to-one conversations, but must be turned on manually.
ipython 2y ago
If you enjoy this story, read the book Dark Wire which focuses on the FBI’s infiltration of Anom, another encrypted message service. It also covers sky briefly. Fascinating story https://www.hachettebookgroup.com/titles/joseph-cox/dark-wire/9781541702691/?lens=publicaffairs https://www.hachettebookgroup.com/titles/joseph-cox/dark-wir...
- morbicer 2y ago
  Or if you prefer podcast, listen to this episode of Darknet Diaries https://darknetdiaries.com/transcript/146/ https://darknetdiaries.com/transcript/146/ Truly fascinating story
  - zuhsetaqi 2y ago
    Or if you prefer video, watch this DEF CON 32 presentation https://www.youtube.com/watch?v=uFyk5UOyNqI https://www.youtube.com/watch?v=uFyk5UOyNqI
lyu07282 2y ago
> In 2011, Eap started developing an encrypted messaging system with the help of his father, who holds a master’s degree in computer science from Simon Fraser University in Burnaby, B.C. The app was initially designed for BlackBerry phones and later made available for iPhones. > His father designed the data encryption algorithm. > “My dad's a genius,” said Eap. “It had the highest level of encryption available.” It's hard to imagine that this level of ignorance wasn't intentional from the beginning.
- AnimalMuppet 2y ago
  Sounds more like weapons-grade arrogance on the part of the dad, and the kid believed it.
- dist-epoch 2y ago
  Except these kinds of secure apps are never broken by attacking the encryption, but by just infiltrating/seizing the servers.
  - loup-vaillant 2y ago
    For this one however this seems to be the case? The wording of the article isn't crystal clear, but it looks like the cops took control of the servers, and decrypted messages from there. So either the messages weren't truly end-to-end encrypted, or the encryption truly was broken.
- loup-vaillant 2y ago
  This quote sure was a huge red flag to me. "My dad's a genius" because you're not supposed to rely on genius to make a good crypto system, and also because it makes Eap sounds like he has absolutely zero knowledge on the subject. "highest level of encryption available" because there's a fairly low floor above which it's all uncrackable anyway (ChaCha20 + BLAKE2B authenticated encryption, and Curve448 + post quantum winners for the public stuff, should go beyond total overkill). I don't believe it was intentional though. I'm just out of a quick job implementing SSCPv2 (encryption over RS485 to secure communication between card readers and central computer, typically used to secure buildings). Good specs, fairly good separation between cryptography and business logic, and as far as I could tell the crypto isn't broken… but it is quite old school: AES CBC + HMAC SHA256, using MAC then encrypt. https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html https://moxie.org/2011/12/13/the-cryptographic-doom-principl... And while I think my implementation is okay, I did have to pay special attention to specific traps raising from this design, and to be honest wouldn't bet my life on having ironed out all possible timing attacks. SSCPv2 was almost certainly designed after 2020, but it took books from 2005. Good books for their time, but a bit dated unfortunately. I'm pretty sure no actual cryptographer was involved. If there were, they would almost certainly have used standard authenticated encryption scheme like AES CGM, or ChaPoly (RFC 8439), they would have authenticated the unencrypted header, and provided an even better separation between crypto and business logic.
avodonosov 2y ago
> Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network. So how the messages were intercepted if e2e encryption is used?
- dist-epoch 2y ago
  Backdoor the app itself and add an extra key?
  - avodonosov 2y ago
    That's one of possibilities. But what actually happened in this case?
    - avodonosov 2y ago
      A friend told me that: The exact approach used to break the encryption of Sky ECC phones is not fully detailed in the sources I found. However, there are some insights into the methods used: 1. One source mentions that law enforcement agencies used cloned devices running a fake phishing application designed to impersonate the Sky ECC app https://www.bleepingcomputer.com/news/security/europol-unlocks-encrypted-sky-ecc-chat-service-to-make-arrests/ https://www.bleepingcomputer.com/news/security/europol-unloc.... This allowed them to intercept messages as they were being sent and received. 2. Another report indicates that unauthorized devices with modified security features were sold through unauthorized channels, which likely played a role in the interception https://www.vice.com/en/article/sky-ecc-decrypted-hacked-police-say-billion-messages/ https://www.vice.com/en/article/sky-ecc-decrypted-hacked-pol.... These methods suggest that the encryption itself wasn't directly broken, but rather the security of the devices and the integrity of the app were compromised.
- garrettjoecox 2y ago
  I’ve seen it before—a SaaS claiming to offer end-to-end encryption simply because it uses HTTPS/SSL for communication between the client and server. It’s laughable, but the lack of clear regulations or standards defining E2E encryption lets them get away with treating the client and server as the “ends.” Not sure if that’s what happened here but it wouldn’t surprise me.
jpalawaga 2y ago
I have thoughts and feelings about a lot of this, but the part that stands out to me is LE folks intentionally working with agents out of their jurisdiction to circumvent the laws in their own jurisdiction. You want to talk about unethical behaviour? That sounds borderline like a poison tree to me.
- morkalork 2y ago
  Isn't that like half the raison d'être for the five eyes?
- potato3732842 2y ago
  Follow the incentives. The only practical check acting against the whims of these agencies is that if they do things that are too horrible the resulting public perception will be bad for the career advancement prospects of the top ranks who want to move into politics where optics matters.
worldvoyageur 2y ago
"His father designed the data encryption algorithm. “My dad's a genius,” said Eap. “It had the highest level of encryption available.” Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network. " This was the basis for users to think the system was secure? Seriously!?! I'm reminded of the saying 'don't roll your own crypto'. Obviously the authorities were able to crack the crypto, probably at multiple points.
- loup-vaillant 2y ago
  > This was the basis for users to think the system was secure? Seriously!?! Charisma and similar flavours of "trust me bro" works more than reasonable people would anticipate. See every pseudo science and conspiracy theory ever. Cryptography is no exception.
Hizonner 2y ago
> They communicated with each other on highly secure phones You keep using that word...
janmo 2y ago
The key aspect here is that both Sky ECC and Encrochat got F. over by the modern day equivalent of Crypto AG which is the french hosting provider OVH. While intelligence agencies were pumping in real-time all the data from Encrochat's and Sky ECC;s dedicated OVH servers, the OVH co-founder Octave Klaba and their ex-CEO Michel Paulin were selling the company with statements like: - We don't dig in our customer's data unlike the the "others". - US secret services have no access to our data. However there are many interesting anecdotes: 1) For many years OVH was hiding a "maintenance" backdoor in "/etc/ssh/authorized_keys2", authorized_keys2 was used for ssh protocol 2 which was depreciated in 2001 yet OVH was using it to store a maintenance key until around 2018. This was very poorly documented and a user warned of the backdoor on HN back in 2012. https://news.ycombinator.com/item?id=4839414 https://news.ycombinator.com/item?id=4839414 2) In 2013 the TOR hidden service hosting provider "Freedom hosting" was taken down, "they" had rented 400 servers at OVH and in June 2013 "they" let all but one expire, likely moving to another provider, this is when through an unknown way the FBI obtained the IP address of the only remaining server at OVH. The server was imaged but it contained an encrypted "container". The FBI claims that they were able to break the encryption within a week using "cryptanalysis" and to recover the "root" password used to encrypt these "containers". This is total BS, they must just have used the ssh maintenance key or added "something" to the server when they did the imaging. Source criminal complaint Eric Eoin Marques: https://www.justice.gov/d9/press-releases/attachments/2019/03/25/marques_amended_criminal_complaint_-_redacted_0.pdf https://www.justice.gov/d9/press-releases/attachments/2019/0... 3) Later that same year Silk Road was taken down. It is undisputed that law enforcement lied about key parts in their investigation. According to law enforcement Ross Ulbricht was ssh'ing into the Silk Road server using a "VPN server". When they got to the "VPN server" it had been wiped out BUT, the hosting provider had kept "VPN" "logs"??? which led them to the IP address of a cafe where Ross Ulbricht had been. Ross Ulbricht kept a list with all the servers he was and had been operating. There is no mention of a VPN server, however in the "retired" server section there is a "VNC Desktop" server with the note "SR related". This appears to be a server running a virtual desktop that Ross Ulbricht was using to connect to the Silk Road. It was a VPS hosted at ... OVH and rented through an intermediary called momentovps. But it gets even worse, just bellow he listed another VPS at OVH and it has the remark "Will / personal backup / deadman switch"... Source: Silk Road Exhibit GX-264 4) The creation story is quite strange. OVH was offering very low prices while not having any funding. The secret was that for years Xavier Niel who is one of Octave Klaba's competitors and has been outed as being a former agent for the french government was hosting the OVH servers in his datacenter for FREE. Obviously if you do not pay for the electricity, internet and rent life is easy. The question is what did Xavier Niel get in return? According to him (Interview on BFMTV) he did it out of generosity. Of course... Now we pretty much know that Pavel Durov founder of Telegram got his french passport because he agreed to work with the french intelligence agencies but failed to deliver. Guess who was the first person he called when he got arrested, and then the person he met once he was released? Xavier Niel!
barbazoo 2y ago
Reminds me of a recent episode of "Search Engine" about the "AN0M" phone: https://www.searchengine.show/listen/search-engine-1/what-s-the-best-phone-to-do-crimes-on https://www.searchengine.show/listen/search-engine-1/what-s-...

99 points by SirLJ 2y ago

kubb 2y ago

Feels like criminals will eventually get encrypted communication right and there won’t be anything left for police to do.

gambiting 2y ago
Vast majority of criminals are actually stupid though. For every criminal using quantum guaranteed encryption there will be 10 just doing normal unencrypted calls over regular GSM - you use the same tactics against criminals that have been used forever, before IMs were even invented - you infiltrate these groups, arrest lower members, get them to incriminate the people higher up until you dismantle the entire structure. Yeah I know it sounds simple and in reality there are million other steps to do this - but it has been done in the past and is still being done now. That's what the police will do. They caught criminals before they could read their messages, they will catch them again when they can't read their messages.
deleted 2y ago
[deleted]
Cthulhu_ 2y ago
What makes you believe they don't / didn't already? That's the thing, if it's done right you'll never know until it's found out and decrypted like what is in this article.
ActionHank 2y ago
If the marketing is to be believed we are months away from having AI assist someone with no dev, technology, devops background just asking for an app like this.
- kubb 2y ago
  I mean, nobody really believes that, this is just what you have to say if you have a stake in an AI company. Or you don’t know what you’re talking about.
- AnimalMuppet 2y ago
  I'm not holding my breath for AI enabling someone with no tech background to get encryption right.
paxys 2y ago
Encrypted communication is already a solved problem. The people being caught are the ones who don't have the technical skills to use them correctly.
dist-epoch 2y ago
When you have tens of thousands of criminals using a single app, the reward of cracking that in some way is gigantic, and these apps are created by a team of a few people which can't cover every angle like Apple can.
ruthmarx 2y ago
Then they'll refine stenography and it will be citizens who suffer increasingly more.

jmdsh 2y ago

[flagged]

Zak 2y ago

> The Serbian criminals shared photos of their victims on Sky without realizing police had installed a probe on the Sky ECC servers in France, which allowed authorities to intercept and read every user’s messages. I'm surprised criminals keep picking these niche messaging services, which keep turning out not to use proper end to end encryption, rather than Signal.

dghlsakjg 2y ago
Presumably you don’t hear about the ones that use signal for a reason…
- notachatbot123 2y ago
  That's what a Fed would say to discourage Signal use.
  - derefr 2y ago
    That’s the opposite of what the GP poster meant to imply. They meant that you don’t hear about the ones that use Signal because they don’t get caught.
    - notachatbot123 2y ago
      Haha it can be read both ways. I read "they don't publish anything about intel gathered in Signal to keep people trusting it".
  - krisoft 2y ago
    > That's what a Fed would say to discourage Signal use. What? No. That is exactly what a Fed (or anyone else) would say to encourage Signal use. "Presumably you don’t hear about the ones that use signal for a reason…" The reason being that they don't get caught so you don't hear about them.
  - RUnconcerned 2y ago
    feds literally fund signal https://www.mintpressnews.com/the-open-technology-fund-makes-privacy-apps-staffed-spies/279147/ https://www.mintpressnews.com/the-open-technology-fund-makes...

dghlsakjg 2y ago

> “Privacy is really, really important and we all have the right to our privacy,” said Catherine De Bolle, executive director of Europol, the law enforcement agency of the European Union. “But when we see now that encrypted communication is really an enabler for crime, then we have to do something.” Can she hear herself when she talks? Apparently we don’t have a right to our privacy. Interpol intercepting every message going across a server just because some of the messages might be criminal is explicitly acting in a way that does not imply any right to privacy.

deleted 2y ago
[deleted]
hbn 2y ago
As soon as someone follows "we all have the right to privacy" with "but", a springboard should pop up from under their feet and launch them into space. Unsurprising the first time I see a CBC article at the top of HN, it's a puff piece about how taking people's privacy is supposedly good for us. Real glad I paid for this article, but it's not like I'm not constantly paying for these clowns to produce slop that I find appalling. They recently spent $2 million to create a bunch of liberal propaganda podcasts that got a few hundred views per episode. I hate this country.
- ipython 2y ago
  When the entire point of the enterprise (sky in this case) is to enable criminals, wouldn’t the enterprise itself be part of the criminal conspiracy? I am all for privacy, but I’m also for rule of law. If I could start an encrypted messaging company that marketed exclusively to criminals, then wouldn’t I expect to be charged as abetting the crimes committed as a result of facilitating that communication? It’s a question of intent. Law isn’t black and white- and law recognizes that tools can be dual use. It’s not perfect but nothing is.
  - dghlsakjg 2y ago
    No one is arguing that the company shouldn’t face consequences, people are arguing that their customers who aren’t part of some criminal enterprise shouldn’t have all of their messages intercepted, decrypted and put in a database.

darknavi 2y ago

A good defcon talk that referenced Sky but focused on another platform called Anon: https://youtu.be/uFyk5UOyNqI?si=i-GtpeCR1QEj69cz https://youtu.be/uFyk5UOyNqI?si=i-GtpeCR1QEj69cz

auscad 2y ago

What makes this different from a typical attack on encryption is that this company (probably) knowingly distributed to and worked with criminal enterprises. But this article is written in a way that suggests that encryption is dangerous - an angle that the CBC has taken before - which makes sense considering that it is a government-owned news outlet in a Five Eyes member state.

Cthulhu_ 2y ago
> (probably) knowingly That's doing a lot of heavy lifting. I'm sure they knew, personally, but since everything is encrypted, even for themselves, they have plausible deniability. If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking. And even then, criminals can talk using e.g. commercially available phones and mobile networks; are those networks / manufacturers / anyone but the criminal responsible for what is talked about? Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication. It doesn't make them guilty themselves.
- gambiting 2y ago
  >>If there is no solid proof of e.g. the company selling to someone they knew is a criminal, there's nothing to be done, legally speaking. If you look at the article it has examples found of the company employees explicitly saying they are meeting with criminals so to play it safe. It doesn't get any more "solid proof" than that. >>are those networks / manufacturers / anyone but the criminal responsible for what is talked about? No, but again - read the article. There are examples of their employees saying that a client of theirs was arrested so they proactively wiped their phone - that could be interpreted as knowingly destroying evidence. They did end up changing this policy to not wipe phones of people who have been arrested, precisely because of this concern. >>Yes the seller could reasonably assume their stuff was used by criminals, but so can Signal, Whatsapp, Messenger, anyone offering (encrypted) communication The difference is most likely in how it's advertised and sold. Whatsapp is a free app that anyone can use, Facebook can reasonably claim that they don't advertise to criminals or encourage illegal use because the app is free to anyone. The owners of this app made it paid and they actively pursued clients they knew were members of criminal rings. Whether that passes the threshold for holding the company liable - that's for courts to decide. But that's generally where I think the line is. Anyone can make and sell a knife, but start selling knives(knowingly) to gang members and you're going to be in trouble even though selling a knife isn't illegal in itself.

BadHumans 2y ago

[flagged]

deleted 2y ago
[deleted]

reverendsteveii 2y ago

[flagged]

deleted 2y ago
[deleted]

paxys 2y ago

Pretty ironic that they got caught after going out of their way to buy secure phones and use secure messaging services when an off-the-shelf iPhone and Whatsapp/Signal/Telegram would have made them 100% untraceable.

mhitza 2y ago
Probably Signal would have been a safe bet. Telegram doesn't do encryption by default (on group messages? Been a year or two since I've used it). And Facebook complies with law enforcement agencies, and I don't think it's unreasonable for them to have a feature flags to selectively and transparently disable encryption for some participants if need be.
- joering2 2y ago
  Facebook certainly likes to at least have sense to know what you are conversating about. Sometime in 2016 we and my buddy abroad got our accounts frozen "due to security reasons" at exact same time; what we were doing is having fun with FB Messenger and sending each other PGP-encrypted messages. This least about 2 months and my buddy is Egyptian, so I am pretty sure at some point FB said "we don't know what they chat about and enough is enough". I got my account recovered after multiple layers of verification including video-call to hold up my ID done by third-party ... my friend never gotten his reinstated.
  - int_19h 2y ago
    Facebook definitely has some kind of chat monitoring and real-time censorship in place. For example, I once couldn't send a message in private chat if it included a link to one of the online weed stores. Remove the link, and it goes through just fine. Put the link there, and the thing just hangs and errors out with no coherent explanation.
- Zak 2y ago
  Telegram doesn't do encryption on group messages at all, nor does it do encryption by default on any messages. End to end encryption is available for one-to-one conversations, but must be turned on manually.

ipython 2y ago

If you enjoy this story, read the book Dark Wire which focuses on the FBI’s infiltration of Anom, another encrypted message service. It also covers sky briefly. Fascinating story https://www.hachettebookgroup.com/titles/joseph-cox/dark-wire/9781541702691/?lens=publicaffairs https://www.hachettebookgroup.com/titles/joseph-cox/dark-wir...

morbicer 2y ago
Or if you prefer podcast, listen to this episode of Darknet Diaries https://darknetdiaries.com/transcript/146/ https://darknetdiaries.com/transcript/146/ Truly fascinating story
- zuhsetaqi 2y ago
  Or if you prefer video, watch this DEF CON 32 presentation https://www.youtube.com/watch?v=uFyk5UOyNqI https://www.youtube.com/watch?v=uFyk5UOyNqI

lyu07282 2y ago

> In 2011, Eap started developing an encrypted messaging system with the help of his father, who holds a master’s degree in computer science from Simon Fraser University in Burnaby, B.C. The app was initially designed for BlackBerry phones and later made available for iPhones. > His father designed the data encryption algorithm. > “My dad's a genius,” said Eap. “It had the highest level of encryption available.” It's hard to imagine that this level of ignorance wasn't intentional from the beginning.

AnimalMuppet 2y ago
Sounds more like weapons-grade arrogance on the part of the dad, and the kid believed it.
dist-epoch 2y ago
Except these kinds of secure apps are never broken by attacking the encryption, but by just infiltrating/seizing the servers.
- loup-vaillant 2y ago
  For this one however this seems to be the case? The wording of the article isn't crystal clear, but it looks like the cops took control of the servers, and decrypted messages from there. So either the messages weren't truly end-to-end encrypted, or the encryption truly was broken.
loup-vaillant 2y ago
This quote sure was a huge red flag to me. "My dad's a genius" because you're not supposed to rely on genius to make a good crypto system, and also because it makes Eap sounds like he has absolutely zero knowledge on the subject. "highest level of encryption available" because there's a fairly low floor above which it's all uncrackable anyway (ChaCha20 + BLAKE2B authenticated encryption, and Curve448 + post quantum winners for the public stuff, should go beyond total overkill). I don't believe it was intentional though. I'm just out of a quick job implementing SSCPv2 (encryption over RS485 to secure communication between card readers and central computer, typically used to secure buildings). Good specs, fairly good separation between cryptography and business logic, and as far as I could tell the crypto isn't broken… but it is quite old school: AES CBC + HMAC SHA256, using MAC then encrypt. https://moxie.org/2011/12/13/the-cryptographic-doom-principle.html https://moxie.org/2011/12/13/the-cryptographic-doom-principl... And while I think my implementation is okay, I did have to pay special attention to specific traps raising from this design, and to be honest wouldn't bet my life on having ironed out all possible timing attacks. SSCPv2 was almost certainly designed after 2020, but it took books from 2005. Good books for their time, but a bit dated unfortunately. I'm pretty sure no actual cryptographer was involved. If there were, they would almost certainly have used standard authenticated encryption scheme like AES CGM, or ChaPoly (RFC 8439), they would have authenticated the unencrypted header, and provided an even better separation between crypto and business logic.

avodonosov 2y ago

> Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network. So how the messages were intercepted if e2e encryption is used?

dist-epoch 2y ago
Backdoor the app itself and add an extra key?
- avodonosov 2y ago
  That's one of possibilities. But what actually happened in this case?
  - avodonosov 2y ago
    A friend told me that: The exact approach used to break the encryption of Sky ECC phones is not fully detailed in the sources I found. However, there are some insights into the methods used: 1. One source mentions that law enforcement agencies used cloned devices running a fake phishing application designed to impersonate the Sky ECC app https://www.bleepingcomputer.com/news/security/europol-unlocks-encrypted-sky-ecc-chat-service-to-make-arrests/ https://www.bleepingcomputer.com/news/security/europol-unloc.... This allowed them to intercept messages as they were being sent and received. 2. Another report indicates that unauthorized devices with modified security features were sold through unauthorized channels, which likely played a role in the interception https://www.vice.com/en/article/sky-ecc-decrypted-hacked-police-say-billion-messages/ https://www.vice.com/en/article/sky-ecc-decrypted-hacked-pol.... These methods suggest that the encryption itself wasn't directly broken, but rather the security of the devices and the integrity of the app were compromised.
garrettjoecox 2y ago
I’ve seen it before—a SaaS claiming to offer end-to-end encryption simply because it uses HTTPS/SSL for communication between the client and server. It’s laughable, but the lack of clear regulations or standards defining E2E encryption lets them get away with treating the client and server as the “ends.” Not sure if that’s what happened here but it wouldn’t surprise me.

jpalawaga 2y ago

I have thoughts and feelings about a lot of this, but the part that stands out to me is LE folks intentionally working with agents out of their jurisdiction to circumvent the laws in their own jurisdiction. You want to talk about unethical behaviour? That sounds borderline like a poison tree to me.

morkalork 2y ago
Isn't that like half the raison d'être for the five eyes?
potato3732842 2y ago
Follow the incentives. The only practical check acting against the whims of these agencies is that if they do things that are too horrible the resulting public perception will be bad for the career advancement prospects of the top ranks who want to move into politics where optics matters.

worldvoyageur 2y ago

"His father designed the data encryption algorithm. “My dad's a genius,” said Eap. “It had the highest level of encryption available.” Not only did Sky ECC provide end-to-end encryption, like Whatsapp or Signal, but unlike those free apps, it also redirected the data on its own secure network. " This was the basis for users to think the system was secure? Seriously!?! I'm reminded of the saying 'don't roll your own crypto'. Obviously the authorities were able to crack the crypto, probably at multiple points.

loup-vaillant 2y ago
> This was the basis for users to think the system was secure? Seriously!?! Charisma and similar flavours of "trust me bro" works more than reasonable people would anticipate. See every pseudo science and conspiracy theory ever. Cryptography is no exception.

Hizonner 2y ago

> They communicated with each other on highly secure phones You keep using that word...

janmo 2y ago

The key aspect here is that both Sky ECC and Encrochat got F. over by the modern day equivalent of Crypto AG which is the french hosting provider OVH. While intelligence agencies were pumping in real-time all the data from Encrochat's and Sky ECC;s dedicated OVH servers, the OVH co-founder Octave Klaba and their ex-CEO Michel Paulin were selling the company with statements like: - We don't dig in our customer's data unlike the the "others". - US secret services have no access to our data. However there are many interesting anecdotes: 1) For many years OVH was hiding a "maintenance" backdoor in "/etc/ssh/authorized_keys2", authorized_keys2 was used for ssh protocol 2 which was depreciated in 2001 yet OVH was using it to store a maintenance key until around 2018. This was very poorly documented and a user warned of the backdoor on HN back in 2012. https://news.ycombinator.com/item?id=4839414 https://news.ycombinator.com/item?id=4839414 2) In 2013 the TOR hidden service hosting provider "Freedom hosting" was taken down, "they" had rented 400 servers at OVH and in June 2013 "they" let all but one expire, likely moving to another provider, this is when through an unknown way the FBI obtained the IP address of the only remaining server at OVH. The server was imaged but it contained an encrypted "container". The FBI claims that they were able to break the encryption within a week using "cryptanalysis" and to recover the "root" password used to encrypt these "containers". This is total BS, they must just have used the ssh maintenance key or added "something" to the server when they did the imaging. Source criminal complaint Eric Eoin Marques: https://www.justice.gov/d9/press-releases/attachments/2019/03/25/marques_amended_criminal_complaint_-_redacted_0.pdf https://www.justice.gov/d9/press-releases/attachments/2019/0... 3) Later that same year Silk Road was taken down. It is undisputed that law enforcement lied about key parts in their investigation. According to law enforcement Ross Ulbricht was ssh'ing into the Silk Road server using a "VPN server". When they got to the "VPN server" it had been wiped out BUT, the hosting provider had kept "VPN" "logs"??? which led them to the IP address of a cafe where Ross Ulbricht had been. Ross Ulbricht kept a list with all the servers he was and had been operating. There is no mention of a VPN server, however in the "retired" server section there is a "VNC Desktop" server with the note "SR related". This appears to be a server running a virtual desktop that Ross Ulbricht was using to connect to the Silk Road. It was a VPS hosted at ... OVH and rented through an intermediary called momentovps. But it gets even worse, just bellow he listed another VPS at OVH and it has the remark "Will / personal backup / deadman switch"... Source: Silk Road Exhibit GX-264 4) The creation story is quite strange. OVH was offering very low prices while not having any funding. The secret was that for years Xavier Niel who is one of Octave Klaba's competitors and has been outed as being a former agent for the french government was hosting the OVH servers in his datacenter for FREE. Obviously if you do not pay for the electricity, internet and rent life is easy. The question is what did Xavier Niel get in return? According to him (Interview on BFMTV) he did it out of generosity. Of course... Now we pretty much know that Pavel Durov founder of Telegram got his french passport because he agreed to work with the french intelligence agencies but failed to deliver. Guess who was the first person he called when he got arrested, and then the person he met once he was released? Xavier Niel!

barbazoo 2y ago

Reminds me of a recent episode of "Search Engine" about the "AN0M" phone: https://www.searchengine.show/listen/search-engine-1/what-s-the-best-phone-to-do-crimes-on https://www.searchengine.show/listen/search-engine-1/what-s-...