18 ms·

I am under surveillance by Canadian agents, my computer has been backdoored

701 points by joshfraser 14y ago

SammyGuergachi 14y ago
Just looked at the update. "we have migrated Cryptocat's network into new servers inside a Swedish nuclear bunker" Holy Crap!
- charlieok 14y ago
  Also love the photo of said bunker. https://blog.crypto.cat/wp-content/uploads/2013/02/Port_sn_05.jpg https://blog.crypto.cat/wp-content/uploads/2013/02/Port_sn_0...
  - mappu 14y ago
    Upon visiting that blog.crypto.cat URL, Chrome tells me "Incorrect certificate for host / Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery." The main crypto.cat page loads fine over HTTPS (certificate has sha1 thumbprint ‎d1aa1c1037202e359f224e407d7f84a0e8a94dd7 which i see is advertised on the erroring blog.crypto.cat page). Why has the certificate changed? Why did the CA signing the SSL certificate change? Is there any forwarding message signed by the original certificate?
    - magikarp 14y ago
      It's a bug in the Chrome 25 Beta. Will be fixed on stable release.
- randomchars 14y ago
  en.wikipedia.com/wiki/Pionen
deleted 14y ago
[deleted]
0x0 14y ago
Would be interesting to hear more details about which software he's using (OS, "Secure File Transfer desktop client", firewall). Also, it would be interesting to see what one could find on a raw disk image clone (hidden files? rootkits?).
- magikarp 14y ago
  Hello, I'm the person who wrote the blog post. I am using Transmit for Mac OS X, by Panic Software, version 4.2.
  - benmmurphy 14y ago
    transmit can be scripted so it could be anything running on the machine that is backdoored. i assume they had connection for sending commands that was separate because the sftp sounds like it was blocked but the uploading stopped apparently in response to external stimuli. seems kind of lame to have some kind of connection sending commands and then using transmit to upload files.
  - pudquick 14y ago
    Unless you had logs in Transmit indicating it was used, I would recommend not saying they used Transmit to do it - considering OS X has a builtin command-line sftp client: http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sftp.1.html http://developer.apple.com/library/mac/documentation/Darwin/... If you're still concerned your machine is affected, I'd recommend getting Little Snitch - which automatically blocks connections (both in-bound and out-bound) that are not pre-approved. In addition, when it auto-blocks it records the application that was making the connection attempt in the auto-block rule. (Well, actually I'd suggest you dd a backup of the drive to analyze - then wipe and start anew.) If they hired anyone of any worth, the person installed a timed launchd (or cron) controlled script to run rarely and at odd hours to upload content from your machine to those remote locations. This kind of setup a.) would use a command-line tool for the upload and b.) unless they knew you had Transmit it would be designed around executables already included in OS X or that they installed. Unfortunately, if it has stopped, they've probably deleted the scripts and cleaned up the evidence. If you've got Time Machine running, however, you may have backed up some of their handiwork.
w-ll 14y ago
How did they get access to your hardware? No disk encryption? Might be crazy, but when I travel I setup a webcam in my office to upload to a vps and then ustream 24/7. Highest quality (don't care about bw since nobodies home.)
- epoxyhockey 14y ago
  The post does say Ever since my return from NYC as when the activity has been encountered. Since I'm guessing that he didn't have his external firewall with him on travel, the access could have taken place in an airport or anytime in the US. It would be interesting to hear if/when he didn't have direct control of his laptop while on travel.
  - KMag 14y ago
    I doubt he brought his desktop with him to NYC. It's the desktop that's acting suspiciously.
    - gknoy 14y ago
      True, but if his laptop has been compromised while he was traveling, that could have been used to get access to the home system.
- magikarp 14y ago
  Hello, I left for NYC for five days. Since I develop sensitive cryptography software, I do not store anything sensitive on my desktop, only on my laptop, which is kept with me at all times (even when going on dates and such.) It was my desktop that exhibited this behaviour after my 5 day trip to NYC. Stupidly, I left it on the whole time. I do use full disk encryption.
  - danso 14y ago
    This is an interesting mindset...I'm inclined to do the inverse, because of how easy it is for someone to steal a laptop. While yes, a desktop can be breached (as it apparently was in this case), there's more surveillance options you have with which to secure its surroundings. And agents would have to get a warrant anyway. If you're worried about the prospect of them warantlessly breaking in...I guess that the more likely danger is that if they are willing to resort to that, they are also willing to stage a robbery in which someone punches you in the face and makes off with the laptop. Or hire someone to spike your drink during a date.
deleted 14y ago
[deleted]
bahman2000 14y ago
I'm pretty sure that no legitimate covert service operative would identify themselves as such, nor would they brag about going to conferences.
- cperciva 14y ago
  Working for CSIS doesn't mean that you're a covert operative. I know plenty of present and past employees of CSIS, CSEC, CIA, NSA, GCHQ, etc -- my understanding is that the general rule is "don't call attention to your affiliation, but it's ok to say if evading questions would draw even more attention to you".
  - conformal 14y ago
    this whole account sounds patently ridiculous considering the nature of cryptocat. i would like to think that "CSIS" had better things to do.
    - mcantelon 14y ago
      Spying on and harassing activists has, for a long time, been a big part of what CSIS does. I personally know tech activists that have been spied on and harassed. The RCMP is also known for this. Mainstream new story from a couple weeks ago in which activist orgs complained of CSIS harassment: http://www.ctvnews.ca/activists-warn-against-csis-intimidation-tactics-1.760797 http://www.ctvnews.ca/activists-warn-against-csis-intimidati...
      - corresation 14y ago
        Spying on and harassing activists has, for a long time, been a big part of what CSIS does. Give me a break. Canada has a very open door immigration policy. Unfortunately that open door draws in people who actually don't like what Canada is about (which makes it weird that they would come here) and who conspire against, effectively, Canadian society. I welcome that law enforcement cares about this and does normal investigations. Further from a corporate perspective it is well known that China, in particular, is going absolutely rampant with corporate espionage in the West. This is a major concern. Or just call it some sort of "anti-activism" creed.
dylangs1030 14y ago
I'd like to know more information. As it's written this seems to be a very confused article to me. What exactly is the author's point in writing this? And what is his next step moving forward? What operating system does he use, what software under that operating system (specifically the FTP client), does he have a secure firewall, etc. etc.
- magikarp 14y ago
  Mac OS X, Transmit by Panic Software (v. 4.2) — I blogged this in order to protect myself.
  - dylangs1030 14y ago
    Wow, thanks for the fast reply! Can you tell me what your next steps in proceeding are, or would this violate the protection you're attempting to set up?
    - magikarp 14y ago
      I am currently in a state of shock and rage. I am contacting helpful friends, documenting every shred of detail for my own protection, and mirroring evidence to multiple servers in order to prevent it from being erased. Helpful advice is more than welcome.
      - jacquesm 14y ago
        If you feel like having a mirror in an EU country let me know, email in profile.
        magikarp 14y ago
        Nice try, CSIS. (Just kidding.)
        dschulz 14y ago
samwillis 14y ago
And now his server is down?
- thejosh 14y ago
  Nothing to do with traffic, must be the agents trying to silence the truth.
  - johnpowell 14y ago
    Or that it is Wordpress.
    - Samuel_Michon 14y ago
      "Never attribute to malice that which can be adequately explained by Wordpress"
  - samwillis 14y ago
    Definitely isn't anything to do with the thousands of geeks who like conspiracy theories pounding his server on a Saturday evening?!...
  - eksith 14y ago
    No, this seems like overload. To be fair, HN isn't exactly gentle on WordPress sites to begin with, especially if they're not aggressively being cached.
- xorpsxmm0 14y ago
  https://gist.github.com/anonymous/918900079de99e4e5c1f https://gist.github.com/anonymous/918900079de99e4e5c1f
  - magikarp 14y ago
    Thank you, I'm using this to restore my server.
jacquesm 14y ago
http://en.wikipedia.org/wiki/Nadim_Kobeissi http://en.wikipedia.org/wiki/Nadim_Kobeissi
- charlieok 14y ago
  Curious how he knew Sabu in the first place
  - drucken 14y ago
    They are both high profile (for activists/hackers). Public twitter accounts, etc.
  - praptak 14y ago
    Wiki: "In 2012, the FBI attempted to entrap Kobeissi using Sabu" http://log.nadim.cc/?p=65 http://log.nadim.cc/?p=65 http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and-disappoints/ http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and... Fuckers. (sorry, I couldn't resist)
- frendiversity 14y ago
  What a wonderful creature that young man is. Eyes of the hero.
SODaniel 14y ago
"Whats that abeut? Are they not your friends buddy?"
Geekette 14y ago
Is the OP sure those were CSIS peeps? Just wondering based on how they bumbled through their attempts at making contact. Thought intelligence agents would be slicker than that.
- fnordfnordfnord 14y ago
  Maybe this is the new guy, and it's his first assignment. Maybe it's not CSIS, but some other interested party. Seriously though, they're gov't employees, the hiring process does not guarantee the highest quality in every case.
- alan_cx 14y ago
  Fair point, until the bit where his PC is trying to send information to the CSIS.
- randomchars 14y ago
  Actually they're not agents, but officers. IIRC the agents are the informants who are not working for the agency.
gnu8 14y ago
This guy should widely distribute the SFTP creds being used by the backdoor agent on his computer. Then we could all be helpful by uploading useful data to the Canadian government's spy server.
- polymatter 14y ago
  While an amusing suggestion, I sincerely hope everyone realises that such a move would be ... incompatible with a long and healthy lifestyle. Both for Nadim and anyone foolish enough to do so.
  - gnu8 14y ago
    On the other hand, anyone who has reason to believe there might be information critical to their investigation embedded in the full version of Two Girls One Cup, it is their civic duty to submit that video to the authorities.
    - polymatter 14y ago
      But sneaking it in through a backdoor and smearing it on their server is probably not going to be well received. (any unintentional puns are entirely unintentional).
  - jacquesm 14y ago
    Why? Are you suggesting the CSIS kill people? Who are going to be missed because they have said they are under surveilance? Or even abroad?
    - polymatter 14y ago
      I am suggesting pissing off CSIS, or any law enforcement body, is not a good idea. I doubt you will be outright killed on purpose, but arrested, detained and interrogated is a reasonable risk. Worst (reasonable) case is being jailed for "interfering in an investigation" or "unauthorised access to computers" or such like. Magikarp is doing everything right so far. He doesn't need to cross a line by exposing CSIS servers to attack. And nobody else needs to play with CSIS servers either. Protest and demonstration is one thing, but playing with law enforcement servers is like throwing bottles at police cars for the lulz and is just asking for the book to be thrown back at you.
adamnemecek 14y ago
I'm somewhat surprised that the cryptocat project has been ruffling so many feathers (assuming that the story is in fact what it appears to be).
- conformal 14y ago
  i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication. using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.
  - JshWright 14y ago
    I think a statement like that needs a little more in the way of support. Cryptocat has been fairly well reviewed by a number of fairly smart people. While flaws have certainly been found, they've mostly been addressed, AFAIK. "Snake oil" has been a popular term to throw around ever since the original PGP user's guide, but simply labeling something "snake oil" without any actual proof is a dangerous thing to do (especially when it's an open source product, and you should be able to point to any defects specifically). Edit: I realize the term 'snake oil' predates PGP, I was referring to the crypto community's penchant for it.
  - frendiversity 14y ago
    The fact that he's young, brilliant, and identifies as a hacktivist make it more feasible. He's a future threat.
    - teeja 14y ago
      That's how the US has treated its hackers since ... the beginning. And that's why the Chinese are almost certainly eating our crypto-lunch. You'd almost think the authorities are compelled to help CN.
  - magikarp 14y ago
    It would be nice if you could meet me for coffee and say this to my face, friend. I am trying to protect myself and my open source project, which, by the way, has been audited countless times and has progressed greatly towards security. If you have a problem with me, then call me up and discuss it instead of stressing me out even more when I just discovered that the government is building a case against me. If you don't like my work, file a bug report. Check out our documentation. Review our OTR implementation. Submit a pull request. Hack some code. Just don't say hurtful and untrue things like that in public. You can do better.
jhprks 14y ago
Well probably because you did something wrong. Turn yourself in and reflect on your wrongdoings. Put yourself together and stop causing harm to the society.
- deleted 14y ago
  [deleted]
- frendiversity 14y ago
  This is a good joke.
  - mrbarrett84 14y ago
    What does that even mean?
- InclinedPlane 14y ago
  Haha, it's his fault for living in Canada! Canada sucks, move to Japan!
  - frendiversity 14y ago
    This is also a good joke.
gamblor956 14y ago
In other news, Canada's internal security agency is using "PG" to entrap people...(read the article for context) I guess they read HN too.
- clicks 14y ago
  This PG approached him with a "business opportunity" -- so the Canadian security folk probably did mean to confuse him into thinking that this PG is our HN pg.
  - JshWright 14y ago
    s/Canadian security folk/unknown party/
  - redthrowaway 14y ago
    They really should have tried harder. For some reason, I really can't picture pg in a black suit.
stbullard 14y ago
Google cache: http://webcache.googleusercontent.com/search?q=cache:http://log.nadim.cc/%3Fp=110 http://webcache.googleusercontent.com/search?q=cache:http://...
friendly_chap 14y ago
If this is true - we live in a scary world. If not, the guy has talent in marketing.
- randomchars 14y ago
  We live in a scary world either way.
  - friendly_chap 14y ago
    Haha! You are so right (unfortunately).
kjackson2012 14y ago
It seems ridiculous that an "intelligence" organization would upload files to a server that identified themselves so blatantly like that. Could it be that it is some ruse of some sort? I don't doubt that someone broke in, but would it really be CSIS?
- mcantelon 14y ago
  CSIS aren't the most competent intelligence organization in the world.
  - corresation 14y ago
    For the limited scope of the work that they do (which is essentially limited to what the NSA does in the US. They don't really do what the CIA does), and with a relatively small $600 million dollar public budget, they're known to be quite competent. This story sounds...weird. I doubt it is quite as he suspects it is.
    - mcantelon 14y ago
      >which is essentially limited to what the NSA does in the US. The NSA doesn't do field intelligence work, AFAIK, unlike CSIS. >This story sounds...weird. I doubt it is quite as he suspects it is. It's weird, but I'm not sure who else other than CSIS would have the motivation to hack an activists computer so it sends data to CSIS-affiliated servers.
      - corresation 14y ago
        The author said "Hostnames that appear to belong to CSIS.". Reverse DNS should not be trusted. Saying that a hostname "appears to belong" to someone is a naive statement.
        strlen 14y ago
        Indeed, spoofing reverse DNS is not hard -- and spoofing reverse DNS to appear like an intelligence agency is straight out of every 1990s IRC script kiddie's cookbook.
unclefucker 14y ago
Hackernews captivated by a schizophenic...
- frendiversity 14y ago
  Correction: Lightly schizoid/paranoid may suspect hidden cameras in implausible situations. Schizophrenic screams at cars. In this case, it's plausible enough suspicion, let's give him the benefit of the doubt, eh?
  - kdazzle 14y ago
    There are a few types of schizophrenia - paranoid schizophrenia being one of them.
spiritplumber 14y ago
That'd have been an awesome trolling opportunity.
brownbat 14y ago
Contact a lawyer immediately. There are many actions you could take to mess with the investigation that might seem like fair game, but you should discuss each one with an attorney so you don't provide some arcane justification for them to arrest you (by hacking back, or even maybe "interfering with an investigation"). Once you get past that stage, the attorney can help you petition to stop the behavior or demand more information about it. Legal advice is what you need now, not tech advice. (Because the server is crushed, I'm only getting the basic gist - forgive me if you've already done this.)
- magikarp 14y ago
  If anyone knows a good lawyer in Montreal, please let me know! nadim@nadim.cc
  - dfc 14y ago
    Get in touch with the EFF: https://www.eff.org/pages/legal-assistance https://www.eff.org/pages/legal-assistance
    - ComputerGuru 14y ago
      Don't. They take forever as they have only so few lawyers and they're all backlogged for months. They're also not equipped for this kind of thing. Their lawyers focus more on civil suits, not criminal..
      - pringles 14y ago
        > EFF maintains a list of attorneys, called the Cooperating Attorneys list, who have told us that they are passionate about the same things we're passionate about, and who have indicated that they have some of the same areas of expertise. If we can't help you, but feel that your case is something our cooperating attorneys may be able to assist with, we'll offer to refer you to one of them.
        14y ago
unimpressive 14y ago
I have to wonder what you'd see If you used style as ID. Styles change from time to time But style stays from line to line. Names can change and faces too But writing tells you who is who.[0] Many say they are a crowd But fewer do once lost their shroud. Traps and snares one will find Many more if kept their wits about their mind Still plenty that you see Hide their face behind IP. Just a thought. [0]: http://33bits.org/2012/02/20/is-writing-style-sufficient-to-deanonymize-material-posted-online/ http://33bits.org/2012/02/20/is-writing-style-sufficient-to-... [1]: EDIT: It seems to me that it is very possible that not all accounts here, though not necessarily in this thread, correspond to a single individual.
- mintplant 14y ago
  Could you... elaborate more on this, perhaps?
  - unimpressive 14y ago
    Sure. While I don't want to start a witch hunt, I often wonder while reading discussions who it is behind the handle. To the point where I can't help but think that a little careful observation might uncover an army of sockpuppets. With the help of the HN api, you could probably fingerprint a lot of users.
fareesh 14y ago
I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary :)
- JesseObrien 14y ago
  Absolutely. Do a little more than surface level digging and this guy is really just a child playing with toys and announcing it loudly to the world.
  - unreal37 14y ago
    Smart teenage coder turned activist... Reminds me of Aaron Swartz, surprised no one mentioned his name yet...
    - JesseObrien 14y ago
      Sorry but respectively, no. I can't allow you to trash Aaron's name like that. Aaron was actually a child prodigy and a borderline genius who had done more than this at 14 years old. This kid plays with JavaScript and wrote a chrome extension that adheres to the XMPP spec. They're not in the same league.
      - thirsteh 14y ago
        It's ironic that you keep calling him "kid", yet he's obviously accomplished more than you. Is this veiled jealousy, or what? In any case: Please take the time to actually understand the difference between XMPP and OTR. You have repeatedly and very confidently shown a fundamental misunderstanding of their function and implementation in this thread.
      - unreal37 14y ago
        I was not trashing Aaron, and sorry if it came off sounding that way. I was just trying to draw a parallel between two teenage hackers who became activists, and raised the ire of the government.
dmix 14y ago
If you need donations for any legal pursuits, set up a page accepting bitcoins or similar. I'd totally support this. Illegally monitoring a citizen has to about as bad as it gets in my books. Especially someone who has never done anything illegal and only received attention by building tools to help free speech/privacy.
- glamrock 14y ago
  Illegally monitoring anyone, citizen or not, is excessive and supremely uncool.
  - memracom 14y ago
    Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. I was interviewed by CSIS because I did some technical work on a server for a foreign-born Canadian who was suspected of being involved in white-power/neo-nazi orgs. The goal of CSIS was to find out if a certain prominent foreign white-power speaker might sneak into Canada. There was a well-known leaky spot in the US border not far from the town where this guy lived. This Nadim fellow is a suspicious guy doing suspicious things who travels to terrorist hot-spots and to the USA, which is also suspicious. And I bet that CSIS is reading every word on HN right now. After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? Same goes for CIA, NSA, FBI, DHS.
    - n3rdy 14y ago
      > Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. Just because something is legal doesn't mean its not excessive. Just because the government does something, doesn't make it right.
    - vidarh 14y ago
      > After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? From the description of what happened I'd guess probably at the local high school, by asking if anyone likes Bond movies.
Wintamute 14y ago
I don't know you and I don't know the world you live in, but just from your worried tone, and the rate at which you're responding to comments in this thread, I just want to say: take a breath. Engaging in a wild HN thread, full of well meaning but varied techy suggestions/speculation might not be the best approach right now. Have some friends sift through it for good information and disengage. Seek legal advice, and take it slow.
- magikarp 14y ago
  Sorry. I am very stressed and am knocked into full self-defense/damage control mode. Not sure I am in a state to meet people IRL at the moment.
  - jacquesm 14y ago
    I think that you actually should meet someone IRL, have them stay over with you or stay over with them.
    - PavlovsCat 14y ago
      Yes.. and in the meantime, I suggest all of us watch this 29c3 talk by Jacob Applebaum, "Not My Department" ( http://www.youtube.com/watch?v=7mnuofn_DXw http://www.youtube.com/watch?v=7mnuofn_DXw ), and think about all our roles in all this. It's not going to stop unless we make it.
      - dmix 14y ago
        There seems to be a new pattern where anyone involved in promoting free speech and privacy through encryption gets harassed by the state, regardless if they actually did anything illegal. http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_and_detainment http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_a... It really shows how those in power are scared of the liberating powers of technology.
        14y ago
testhis 14y ago
I think you're a little fucked man
csisagent 14y ago
We are watching. Everything.
- conformal 14y ago
  lol. you must have seen me at the border, eh? ;)
- gaius 14y ago
  I'm just surprised you guys even exist - I thought "Canadian Agents" were something they'd just made up for Quantum of Solace.
fareesh 14y ago
I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary
jscheel 14y ago
Honestly, I wasn't reading this very closely and started to wonder what in the world pg had to do with Canadian government agents.
- HNC 14y ago
  Exactly the same. I had to re-read it and then I got that "PG" wasn't PG (Paul).
herge 14y ago
Man, who could imagine such skullduggery in such a boring place as Conscordia's Reggies. Secret agents and illegal break ins oh my! Although, I did have a palestinian friend swear that the Tim Horton's on Guy was a hotbead for the Jordanian security service.
p3d4nt 14y ago
Maybe Wolf 'has learned how to hack'...LOL!
mikebrock 14y ago
You should attempt to contact the Canadian Civil Liberties Association as soon as possible and protect the evidence on your laptop with your life.
triplesec 14y ago
Canada has secret agents?
- krapp 14y ago
  Of course they do, why wouldn't they?
- lutusp 14y ago
  > Canada has secret agents? The fact that you don't know about them means ... the plan is working.
- RockyMcNuts 14y ago
  they're the politest. excepting missions involving ice hockey, which bring forth a lust which can only be quenched by blood.
- MacsHeadroom 14y ago
  What country doesn't?
glamrock 14y ago
What, no "C.I.Eh" comments yet? I'm... a little disappointed to be honest.
- bdg 14y ago
  This isn't reddit.
  - cieh 14y ago
    good thing, too
p3d4nt 14y ago
The cat crept in the crypt crapped and crept out.
mrb 14y ago
Magikarp, out of curiosity, why do you think the CSIS want to spy on you? 1) Because you are an anti-surveillance activist. 2) Because they want to eventually backdoor Crytocat in order to spy on the users. 3) Because the FBI asked CSIS to spy on you, and the FBI has their own motives.
- oxide 14y ago
  all 3?
drucken 14y ago
For a hacker site, why are so few people interested in seeing his logs? I hope Nadim does a full write-up, including these, soon. In the meantime, all the best and keep your (thankfully already) level head.
- JesseObrien 14y ago
  They're caught up in the moment, I'm guessing. My first reaction was "where are the logs? show me some kind of actual proof". Otherwise this is just some kid who's paranoid and has a rootkit on his machine or something.
st3fan 14y ago
Since you have already published so much of this story. How about full disclosure and post the actual hostnames, firewall entries and that email you received?
govcrypto 14y ago
yet another cry for attention from this talented but misguided young man. First it was TSA and Homeland, now the Canadian CSIS -please! You yell and scream about silent circle, about Skype -you demean and disrespect other noted cryptographers when they get press....I work for the govt -your little Hello-Kitty plug in is akin to sugar koolaid. There are many senior experienced folks here that would make great mentors. Get a good mentor -but please stop with the high-school drama. its not reality. I am too old to placate this and someone needs to bring this young man under his wing. He has a future if he stops pining for attention.
- bobzibub 14y ago
  ?The last thing society needs it his talent being co-opted. His software is a clever little tool and helps to strike a balance between overarching security organizations and the citizens they're supposed to protect. Sure it is not enterprise class but good enough is pretty damn good. I think you while he could learn from you tecnically, you could learn a lot from him as a citizen.
  - oijaf888 14y ago
    Good enough isn't good in crypto when people are trusting it for secure communications. Also why what's the difference (functionally) between cryptocat and pidgin/adium with OTR turned on? In the latter case I believe you can even use gtalk securely.
cieh 14y ago
have they done things like use your accounts to make posts in your name? they do that to poeple.
asdlkfjgh 14y ago
Disconnect computer from network. Try to dump RAM image. Image the drive, sign and optionally encrypt the contents, preferably file-by-file checksum and copy to multiple secure locations. Copy of checksums in additional secure location. Get out of your house with your computer as soon as possible (as soon as you upload one or two images). Do not leave the computer, they will try to destroy or confiscate the evidence. Plan to store computer in secure location, preferably with 24/7 video monitoring and a heavy duty safe. Preserving the evidence is probably that important. Try to be in the company of someone you trust so they can act as a witness and can protect you from physical intimidation or attack. Assume phones are compromised including GPS on your mobile phone. Assume you are under physical surveillance. Assume your car is compromised. Relatives and close friends will be known to operatives. May be a good idea to spend 1-2 nights in a motel with a friend without anyone's cell phone paying cash until you secure copies of your data and get advice on what to do next.
borplk 14y ago
whatever you do make sure to document every single little detail, take photos, videos, audio recording, keep the emails, etc...
false_name 14y ago
I find the idea that Nadim is under surveillance to not be unrealistic. I don't believe he would be under surveillance for his programming. Whether for his associates is another thing. I don't believe the people he alleges he spoke with are intelligence operatives. Whoever they are, they were almost surely messing with him (but could still be conventional employees of an intelligence agency.) Whether or not they're for real doesn't change my first paragraph though. I'm not able to give any advice except this: As long as you're on this road, there is no one you can fully trust. No one at all. You haven't fully internalized this yet.
- deleted 14y ago
  [deleted]
pg 14y ago
"I’ll be wearing a black suit." That should have been enough to make anyone suspicious.
- west1737 14y ago
  And the name PG... very sketchy
- charlieok 14y ago
  I did wonder if this bit... “On January 31st, 2013, a person identifying as PG sent me an email saying that he would wish to meet to discuss a business opportunity with me.” ...was intended to refer to you, or if the initials PG are just a coincidence. You are in the “initials club” after all (rms, jwz, esr, djb) and have even shortened the usual three letters to two.
  - pg 14y ago
    Yeah, actually I think he probably meant "PG" and not PG. But by the time I realized that, someone had replied to me, and I don't like to delete comments with replies.
- skrebbel 14y ago
  Why? My friend PG (Pieter Geelen) wears a black suit all the time.
  - RivieraKid 14y ago
    Does he work at CSIS by any chance?
- lostlogin 14y ago
  Did he learn his trade from movies or so something? What if there are 2 people in black suits? Oh, covered, he will be the one with the shaken martini.
- deleted 14y ago
  [deleted]
evolve2k 14y ago
What's the story with everyone calling each other 'friend' in this post? Is this some crypto community thing I'm not aware of or just coincidence?
- jamiek88 14y ago
  Canadians.
  - teeja 14y ago
    A cryo- community then.
wildmXranat 14y ago
I may or may not have any comments about your situation. Nevertheless, anyone responding to these comments needs to know that there is no guarantee that magikarp is actually Nadim himself, whether the account is compromised and so on. Catch 22 is in full mode in this thread and I would hope that this is not simply paranoia kicking in. Hypothetically, what is the benefit of airing out of all this information ?
- JesseObrien 14y ago
  Hypothetically, what is the benefit of airing out of all this information ? Media attention. That seems to be all this kid has done is wave things at the media that the media themselves don't understand. Cryptocat is a javascript implementation of XMPP with OTR enabled. Snore... Hop on Google chat and click "Off the record" and you've done the same thing cryptocat does. Unlike google chat you have to load up yet another Chrome browser extension that will no doubt eat more memory. The "anapnea" thing he was involved in looks like a joke as well. "Encrypted tunneling network"? You mean a VPS you give people SSH access to? Mind blowing. Nothing to see here folks. Move along.
  - kam 14y ago
    Google's "off the record" has nothing to do with the OTR protocol. It only instructs the server to stop archiving the conversation, and does not involve end-to-end crypto. Google still has access to the cleartext as it passes through their servers.
    - JesseObrien 14y ago
      Google still has access to the cleartext as it passes through their servers. Right, and cryptocat doesn't, 'cuz they said so on their website!
      - thirsteh 14y ago
        The first implementation of Cryptocat was bad in this regard, but the new version uses OTR. OTR virtually guarantees that a middle man can't interpret your communications by performing public key authentication and key negotiation--similar to SSL with mutual authentication using a shared secret (see http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html, particularly the section on the Socialist Millionaires' Protocol.) You don't have to trust anyone to transport your data without snooping. Not only that, Cryptocat's new implementation is open source: https://github.com/cryptocat/cryptocat https://github.com/cryptocat/cryptocat. Inform yourself, ignoramus.
kefs 14y ago
In case you're curious about who exactly we're talking about.. check out this CSIS Recruiting Video, complete with ominous, heart-thumping, background music. https://www.youtube.com/watch?v=dszXCHbvJYY https://www.youtube.com/watch?v=dszXCHbvJYY more: https://www.youtube.com/user/csisscrs/videos?view=0 https://www.youtube.com/user/csisscrs/videos?view=0
orangethirty 14y ago
Slow down a bit there. Whatever is happening, you need to slow down. Don't make any quick decisions. I know you may feel under a lot of pressure. Best way is to talk to someone you know and trust. A family member or a very old friend. These people love you and want the best for you. Contact them, and explain what is happening. Then with their company, analyze the situation. I want you to do this. Your current position may make it not so simple. But you must slow down and regain your composure. Such situations are better dealt with people who love you. Postpone any harsh decision until you have met with a loved one and have explained the items. Remember that there is always a way to work things out. Dont lose hope. I want you to remember that things get better. They improve. You just need to slow down and reason a bit. I'm not doubting your points. But I want you to go to a safe place where you can get some rest. Tomorrow you may be able to think about this with a better understanding. You are a smart person. You always figure out hard problems. You need to rest a bit before you can tackle it. Go and stay with a loved one. They will welcome you and listen to the items you are talking about. I am orangethirty. Have been programming for a long time. I live in the Caribbean, and you can read more about me on my github (github.com/orangethirty). I'm only interested in your well being. We all want for you to regain your inner peace. If you need anything, then let me know by posting here. If you feel comfortable emailing me, then do so.I am not pressuring you to do so. Do it if you feel like it. I want you to remember that tomorrow is another day. Things improve. There is a way to solve every problem. - orangethirty
mylittlepony 14y ago
> "These connections were all detected and prevented by my external firewall system" What software can I use for that in Linux? Did he mean a hardware firewall?
downandout 14y ago
The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Presumably he isn't clicking on spear-phishing emails and the like. If they physically accessed the machine, e.g. they sent Jason Bourne in to bug his machine, he's probably headed for some trouble at some point. In general that kind of thing isn't done just for the purposes of poking around.
- martinced 14y ago
  I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here. Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal. Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! But it still begs the question as to how his computer got owned in the first place.
  - coldtea 14y ago
    >Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! Is it mediocrity, or is it intended in order to send a message? "We are on to you", etc?
    - sanswork 14y ago
      I'd say imaginary myself. I'm curious what the systems were that were obviously csis systems. He failed to include any logs or information beyond his claims.
      - coldtea 14y ago
        Failed implies he tried. He didn't try. He just told the story. People seem to know the guy. I'm not sure this is "imaginary" at all.
kdazzle 14y ago
Assange? McAfee? Is that you?
amasad 14y ago
This is the most trouble a browser plugin could ever cause anyone, and if all this is true then the Canadian government, the FBI and whomever else are after this kid are being very silly. That being said I can't help but think the author likes the media attention, and why wouldn't he, it must be bringing more exposure to his work.
- heyitsrama 14y ago
  I think it's more of the sense of the passion that he puts into his work, you should read the weblog.
guelo 14y ago
Straight into the Supreme Court? That is way better oversight over executive branch spying than in the US!
n3rdy 14y ago
Is it possible that they may have used a type of hardware backdoor? Something that would be connected to the router, or back of the computer using the lan or usb port? None of that would show up in any logs or files, and it would get around any password protection and encryption on the actual computer, the only evidence would be from monitoring router traffic. A usb bug would be something that would transmit via wifi, but it would need to be connected directly to your computer to work. Also check inside the computer for anything unusual.
shocks 14y ago
Umm, backup and format you computer?
Sicp 14y ago
publicity stunt is public.
X4 14y ago
It is possible that someone is playing a bad prank on Nadim, or that Nadim made the story up to gain attention. Please read on. If this is real, then I'm sorry and recommend you to consider all suggestions before deciding illogical. DON'T COMMIT SUICIDE! If you watched the movie "Enemy of the State", I'd become paranoid, but not afraid. Stay calm and act logical. I've looked at cryptocat two days ago, what's special about it? I don't see any reason for the Government to observe you, except that you would be a good fit into their Cyberwar Team. And that you have the wrong connections in the internet. I mean your friends are all hackers. It makes you appear dangerous too. Anyway, the government observes everyone, but with different priority and detail. I think only you might know why they observe you. No need to share the info. Just as in the Movie: I'd replace all clothes, shoes and hardware with new ones and move to a different place. Acquire encryption software from a trusted source or compile it myself on a newly obtained Netbook and encrypt the hardrive+swap with a password and keyfile. Hide the keyfile. Put your hardware and new phone into a cool faradaybag.com. Stay in public, but personally invincible. Leak everything that isn't harmful for you using delayed transmissions with ifttt.com. Always have multiple copies of important documents, just for the case it's necessary. Oh and I'd get a weapon and buy a bulletproof jacket (not vest). Avoid any contact to officials should be priority. Use Tor and VPNs like spotflux, hide.io, ovpn.to etc. and inform close friends to guard you. +Trust no one.
- parasight 14y ago
  I don't think that buying a weapon and a bulletproof jacket is logical in his situation. Seems quite counterproductive to me when dealing with officials.
  - X4 14y ago
    I think a bulletproof jacket is logical if his life is in danger. Yes, I agree on the weapon, every signal that can pull the trigger of an official's gun should be avoided. But I think not having a weapon maybe careless too, only he knows what's right in his situation. A stupid move when confronted with officials could cause him more harm than wearing a gun.
deleted 14y ago
[deleted]
matdrewin 14y ago
Just curious how you are so certain that the servers were CSIS servers? Pretty sure you would never be able to trace back a CSIS or CSE ip.
trevelyan 14y ago
Go talk to your MP as well.
HNC 14y ago
I suggest you contact the CSIS and ask them directly why they've backdoored your computer.
sanko 14y ago
you should revise your TCP connections if you want know if it's a joke or not
wyck 14y ago
This sounds a bit like your friends are playing a prank on you, or CSIS is smart enough to make it look like that is the case. The key here is your desktop and how did they access it.
codejammer 14y ago
magikarp, could you please do a writeup on how did you notice the surveilance? Any extra info except i found a backdoor and noticed funny traffic would be more than useful to know.
cpressey 14y ago
I'm extremely confused by one detail. I'd like to know, what would be the point of describing oneself as a "Juror" or "former Juror"? Is there a particular court case involved with this story that I've missed a reference to? Is it some kind of slang in intelligence circles?
Raz0rblade 14y ago
try a different computer for example android / linux or something exotic much harder to backdoor compared to windows
davebuster 14y ago
IP logs or STFU
X4 14y ago
ANY UPDATES?
- vy8vWJlco 14y ago
  https://twitter.com/kaepora/statuses/300992047345704960 https://twitter.com/kaepora/statuses/300992047345704960
wbhart 14y ago
The Wikipedia article notes that the press attention garnered by Nadim after his prior tussles increased the popularity of Cyptocat. Now imagine an intelligence agency wanting people to make greater use of a system they have back-doored or which is vulnerable to attack by them. Perhaps they couldn't resist the urge to make Cryptocat more popular! (Disclaimer: I have no knowledge of Cryptocat or CSIS, and my comment is hypothetical speculation. Alternative hypotheses are that they are invading Nadim's computer to try to find a way to break Cryptocat or to spook its developer, or because they have Nadim under some sort of surveillance, for who knows what reason.) I do have a question about the story though. Why would an intelligence agency want to "acquire" Cryptocat? What would that mean anyway? Purchasing it for internal use is surely not necessary. They can just use it or any one of a number of in-house products they surely already have access to. Purchasing it to take it out of circulation is a possibility. But is this actually feasible? It's Open Source. Purchasing it to stop the developer working on it is a possibility. But wouldn't others step up? Buying a controlling stake in it is a possibility. But I don't see why an intelligence agency would make an offer of cash to someone not known to be susceptible to that kind of manipulation. I actually just don't see them doing this full stop. They surely know Nadim is motivated by idealism, not cash. So I can't think of a reason to "acquire" Cryptocat that actually stacks up. To work out what is going on here, you have to put yourself into the mindset of the individuals and organisations involved. And that is not easy if you simply have their media persona to go by. Like the rest of the population, these organisations tend to be filled with people of many different persuasions, from geeks and activists and hackers through ultra-authoritarians and rogue elements. It's impossible to know which group is responsible for this, or what their motivations might be. It might have even been an unauthorised operation! And it may just as easily have been someone spoofing CSIS, e.g. some hacker group angry at CSIS for some past grievance. If so, I bet it is baking CSIS's noodle just as much as Nadim's! At any rate, one should never infer a conspiracy where simple administrative or bureaucratic incompetence is a perfectly valid explanation.
vy8vWJlco 14y ago
Update found via Nadim Kobeissi's Twitter feed on Feb 11 @ 7:37 AM: "Alleged CSIS Liaison Officer met me for coffee yesterday. Told me that Cryptocat is national security threat to Canada. That is all." https://twitter.com/kaepora/statuses/300992047345704960 https://twitter.com/kaepora/statuses/300992047345704960

701 points by joshfraser 14y ago

Just looked at the update. "we have migrated Cryptocat's network into new servers inside a Swedish nuclear bunker" Holy Crap!

charlieok 14y ago
Also love the photo of said bunker. https://blog.crypto.cat/wp-content/uploads/2013/02/Port_sn_05.jpg https://blog.crypto.cat/wp-content/uploads/2013/02/Port_sn_0...
- mappu 14y ago
  Upon visiting that blog.crypto.cat URL, Chrome tells me "Incorrect certificate for host / Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery." The main crypto.cat page loads fine over HTTPS (certificate has sha1 thumbprint ‎d1aa1c1037202e359f224e407d7f84a0e8a94dd7 which i see is advertised on the erroring blog.crypto.cat page). Why has the certificate changed? Why did the CA signing the SSL certificate change? Is there any forwarding message signed by the original certificate?
  - magikarp 14y ago
    It's a bug in the Chrome 25 Beta. Will be fixed on stable release.
randomchars 14y ago
en.wikipedia.com/wiki/Pionen

deleted 14y ago

[deleted]

0x0 14y ago

Would be interesting to hear more details about which software he's using (OS, "Secure File Transfer desktop client", firewall). Also, it would be interesting to see what one could find on a raw disk image clone (hidden files? rootkits?).

magikarp 14y ago
Hello, I'm the person who wrote the blog post. I am using Transmit for Mac OS X, by Panic Software, version 4.2.
- benmmurphy 14y ago
  transmit can be scripted so it could be anything running on the machine that is backdoored. i assume they had connection for sending commands that was separate because the sftp sounds like it was blocked but the uploading stopped apparently in response to external stimuli. seems kind of lame to have some kind of connection sending commands and then using transmit to upload files.
- pudquick 14y ago
  Unless you had logs in Transmit indicating it was used, I would recommend not saying they used Transmit to do it - considering OS X has a builtin command-line sftp client: http://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man1/sftp.1.html http://developer.apple.com/library/mac/documentation/Darwin/... If you're still concerned your machine is affected, I'd recommend getting Little Snitch - which automatically blocks connections (both in-bound and out-bound) that are not pre-approved. In addition, when it auto-blocks it records the application that was making the connection attempt in the auto-block rule. (Well, actually I'd suggest you dd a backup of the drive to analyze - then wipe and start anew.) If they hired anyone of any worth, the person installed a timed launchd (or cron) controlled script to run rarely and at odd hours to upload content from your machine to those remote locations. This kind of setup a.) would use a command-line tool for the upload and b.) unless they knew you had Transmit it would be designed around executables already included in OS X or that they installed. Unfortunately, if it has stopped, they've probably deleted the scripts and cleaned up the evidence. If you've got Time Machine running, however, you may have backed up some of their handiwork.

w-ll 14y ago

How did they get access to your hardware? No disk encryption? Might be crazy, but when I travel I setup a webcam in my office to upload to a vps and then ustream 24/7. Highest quality (don't care about bw since nobodies home.)

epoxyhockey 14y ago
The post does say Ever since my return from NYC as when the activity has been encountered. Since I'm guessing that he didn't have his external firewall with him on travel, the access could have taken place in an airport or anytime in the US. It would be interesting to hear if/when he didn't have direct control of his laptop while on travel.
- KMag 14y ago
  I doubt he brought his desktop with him to NYC. It's the desktop that's acting suspiciously.
  - gknoy 14y ago
    True, but if his laptop has been compromised while he was traveling, that could have been used to get access to the home system.
magikarp 14y ago
Hello, I left for NYC for five days. Since I develop sensitive cryptography software, I do not store anything sensitive on my desktop, only on my laptop, which is kept with me at all times (even when going on dates and such.) It was my desktop that exhibited this behaviour after my 5 day trip to NYC. Stupidly, I left it on the whole time. I do use full disk encryption.
- danso 14y ago
  This is an interesting mindset...I'm inclined to do the inverse, because of how easy it is for someone to steal a laptop. While yes, a desktop can be breached (as it apparently was in this case), there's more surveillance options you have with which to secure its surroundings. And agents would have to get a warrant anyway. If you're worried about the prospect of them warantlessly breaking in...I guess that the more likely danger is that if they are willing to resort to that, they are also willing to stage a robbery in which someone punches you in the face and makes off with the laptop. Or hire someone to spike your drink during a date.

deleted 14y ago

[deleted]

bahman2000 14y ago

I'm pretty sure that no legitimate covert service operative would identify themselves as such, nor would they brag about going to conferences.

cperciva 14y ago
Working for CSIS doesn't mean that you're a covert operative. I know plenty of present and past employees of CSIS, CSEC, CIA, NSA, GCHQ, etc -- my understanding is that the general rule is "don't call attention to your affiliation, but it's ok to say if evading questions would draw even more attention to you".
- conformal 14y ago
  this whole account sounds patently ridiculous considering the nature of cryptocat. i would like to think that "CSIS" had better things to do.
  - mcantelon 14y ago
    Spying on and harassing activists has, for a long time, been a big part of what CSIS does. I personally know tech activists that have been spied on and harassed. The RCMP is also known for this. Mainstream new story from a couple weeks ago in which activist orgs complained of CSIS harassment: http://www.ctvnews.ca/activists-warn-against-csis-intimidation-tactics-1.760797 http://www.ctvnews.ca/activists-warn-against-csis-intimidati...
    - corresation 14y ago
      Spying on and harassing activists has, for a long time, been a big part of what CSIS does. Give me a break. Canada has a very open door immigration policy. Unfortunately that open door draws in people who actually don't like what Canada is about (which makes it weird that they would come here) and who conspire against, effectively, Canadian society. I welcome that law enforcement cares about this and does normal investigations. Further from a corporate perspective it is well known that China, in particular, is going absolutely rampant with corporate espionage in the West. This is a major concern. Or just call it some sort of "anti-activism" creed.

dylangs1030 14y ago

I'd like to know more information. As it's written this seems to be a very confused article to me. What exactly is the author's point in writing this? And what is his next step moving forward? What operating system does he use, what software under that operating system (specifically the FTP client), does he have a secure firewall, etc. etc.

magikarp 14y ago
Mac OS X, Transmit by Panic Software (v. 4.2) — I blogged this in order to protect myself.
- dylangs1030 14y ago
  Wow, thanks for the fast reply! Can you tell me what your next steps in proceeding are, or would this violate the protection you're attempting to set up?
  - magikarp 14y ago
    I am currently in a state of shock and rage. I am contacting helpful friends, documenting every shred of detail for my own protection, and mirroring evidence to multiple servers in order to prevent it from being erased. Helpful advice is more than welcome.
    - jacquesm 14y ago
      If you feel like having a mirror in an EU country let me know, email in profile.
      - magikarp 14y ago
        Nice try, CSIS. (Just kidding.)
        dschulz 14y ago

samwillis 14y ago

And now his server is down?

thejosh 14y ago
Nothing to do with traffic, must be the agents trying to silence the truth.
- johnpowell 14y ago
  Or that it is Wordpress.
  - Samuel_Michon 14y ago
    "Never attribute to malice that which can be adequately explained by Wordpress"
- samwillis 14y ago
  Definitely isn't anything to do with the thousands of geeks who like conspiracy theories pounding his server on a Saturday evening?!...
- eksith 14y ago
  No, this seems like overload. To be fair, HN isn't exactly gentle on WordPress sites to begin with, especially if they're not aggressively being cached.
xorpsxmm0 14y ago
https://gist.github.com/anonymous/918900079de99e4e5c1f https://gist.github.com/anonymous/918900079de99e4e5c1f
- magikarp 14y ago
  Thank you, I'm using this to restore my server.

jacquesm 14y ago

http://en.wikipedia.org/wiki/Nadim_Kobeissi http://en.wikipedia.org/wiki/Nadim_Kobeissi

charlieok 14y ago
Curious how he knew Sabu in the first place
- drucken 14y ago
  They are both high profile (for activists/hackers). Public twitter accounts, etc.
- praptak 14y ago
  Wiki: "In 2012, the FBI attempted to entrap Kobeissi using Sabu" http://log.nadim.cc/?p=65 http://log.nadim.cc/?p=65 http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and-disappoints/ http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and... Fuckers. (sorry, I couldn't resist)
frendiversity 14y ago
What a wonderful creature that young man is. Eyes of the hero.

SODaniel 14y ago

"Whats that abeut? Are they not your friends buddy?"

Geekette 14y ago

Is the OP sure those were CSIS peeps? Just wondering based on how they bumbled through their attempts at making contact. Thought intelligence agents would be slicker than that.

fnordfnordfnord 14y ago
Maybe this is the new guy, and it's his first assignment. Maybe it's not CSIS, but some other interested party. Seriously though, they're gov't employees, the hiring process does not guarantee the highest quality in every case.
alan_cx 14y ago
Fair point, until the bit where his PC is trying to send information to the CSIS.
randomchars 14y ago
Actually they're not agents, but officers. IIRC the agents are the informants who are not working for the agency.

gnu8 14y ago

This guy should widely distribute the SFTP creds being used by the backdoor agent on his computer. Then we could all be helpful by uploading useful data to the Canadian government's spy server.

polymatter 14y ago
While an amusing suggestion, I sincerely hope everyone realises that such a move would be ... incompatible with a long and healthy lifestyle. Both for Nadim and anyone foolish enough to do so.
- gnu8 14y ago
  On the other hand, anyone who has reason to believe there might be information critical to their investigation embedded in the full version of Two Girls One Cup, it is their civic duty to submit that video to the authorities.
  - polymatter 14y ago
    But sneaking it in through a backdoor and smearing it on their server is probably not going to be well received. (any unintentional puns are entirely unintentional).
- jacquesm 14y ago
  Why? Are you suggesting the CSIS kill people? Who are going to be missed because they have said they are under surveilance? Or even abroad?
  - polymatter 14y ago
    I am suggesting pissing off CSIS, or any law enforcement body, is not a good idea. I doubt you will be outright killed on purpose, but arrested, detained and interrogated is a reasonable risk. Worst (reasonable) case is being jailed for "interfering in an investigation" or "unauthorised access to computers" or such like. Magikarp is doing everything right so far. He doesn't need to cross a line by exposing CSIS servers to attack. And nobody else needs to play with CSIS servers either. Protest and demonstration is one thing, but playing with law enforcement servers is like throwing bottles at police cars for the lulz and is just asking for the book to be thrown back at you.

adamnemecek 14y ago

I'm somewhat surprised that the cryptocat project has been ruffling so many feathers (assuming that the story is in fact what it appears to be).

conformal 14y ago
i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication. using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.
- JshWright 14y ago
  I think a statement like that needs a little more in the way of support. Cryptocat has been fairly well reviewed by a number of fairly smart people. While flaws have certainly been found, they've mostly been addressed, AFAIK. "Snake oil" has been a popular term to throw around ever since the original PGP user's guide, but simply labeling something "snake oil" without any actual proof is a dangerous thing to do (especially when it's an open source product, and you should be able to point to any defects specifically). Edit: I realize the term 'snake oil' predates PGP, I was referring to the crypto community's penchant for it.
- frendiversity 14y ago
  The fact that he's young, brilliant, and identifies as a hacktivist make it more feasible. He's a future threat.
  - teeja 14y ago
    That's how the US has treated its hackers since ... the beginning. And that's why the Chinese are almost certainly eating our crypto-lunch. You'd almost think the authorities are compelled to help CN.
- magikarp 14y ago
  It would be nice if you could meet me for coffee and say this to my face, friend. I am trying to protect myself and my open source project, which, by the way, has been audited countless times and has progressed greatly towards security. If you have a problem with me, then call me up and discuss it instead of stressing me out even more when I just discovered that the government is building a case against me. If you don't like my work, file a bug report. Check out our documentation. Review our OTR implementation. Submit a pull request. Hack some code. Just don't say hurtful and untrue things like that in public. You can do better.

jhprks 14y ago

Well probably because you did something wrong. Turn yourself in and reflect on your wrongdoings. Put yourself together and stop causing harm to the society.

deleted 14y ago
[deleted]
frendiversity 14y ago
This is a good joke.
- mrbarrett84 14y ago
  What does that even mean?
InclinedPlane 14y ago
Haha, it's his fault for living in Canada! Canada sucks, move to Japan!
- frendiversity 14y ago
  This is also a good joke.

gamblor956 14y ago

In other news, Canada's internal security agency is using "PG" to entrap people...(read the article for context) I guess they read HN too.

clicks 14y ago
This PG approached him with a "business opportunity" -- so the Canadian security folk probably did mean to confuse him into thinking that this PG is our HN pg.
- JshWright 14y ago
  s/Canadian security folk/unknown party/
- redthrowaway 14y ago
  They really should have tried harder. For some reason, I really can't picture pg in a black suit.

stbullard 14y ago

Google cache: http://webcache.googleusercontent.com/search?q=cache:http://log.nadim.cc/%3Fp=110 http://webcache.googleusercontent.com/search?q=cache:http://...

friendly_chap 14y ago

If this is true - we live in a scary world. If not, the guy has talent in marketing.

randomchars 14y ago
We live in a scary world either way.
- friendly_chap 14y ago
  Haha! You are so right (unfortunately).

kjackson2012 14y ago

It seems ridiculous that an "intelligence" organization would upload files to a server that identified themselves so blatantly like that. Could it be that it is some ruse of some sort? I don't doubt that someone broke in, but would it really be CSIS?

mcantelon 14y ago
CSIS aren't the most competent intelligence organization in the world.
- corresation 14y ago
  For the limited scope of the work that they do (which is essentially limited to what the NSA does in the US. They don't really do what the CIA does), and with a relatively small $600 million dollar public budget, they're known to be quite competent. This story sounds...weird. I doubt it is quite as he suspects it is.
  - mcantelon 14y ago
    >which is essentially limited to what the NSA does in the US. The NSA doesn't do field intelligence work, AFAIK, unlike CSIS. >This story sounds...weird. I doubt it is quite as he suspects it is. It's weird, but I'm not sure who else other than CSIS would have the motivation to hack an activists computer so it sends data to CSIS-affiliated servers.
    - corresation 14y ago
      The author said "Hostnames that appear to belong to CSIS.". Reverse DNS should not be trusted. Saying that a hostname "appears to belong" to someone is a naive statement.
      - strlen 14y ago
        Indeed, spoofing reverse DNS is not hard -- and spoofing reverse DNS to appear like an intelligence agency is straight out of every 1990s IRC script kiddie's cookbook.

unclefucker 14y ago

Hackernews captivated by a schizophenic...

frendiversity 14y ago
Correction: Lightly schizoid/paranoid may suspect hidden cameras in implausible situations. Schizophrenic screams at cars. In this case, it's plausible enough suspicion, let's give him the benefit of the doubt, eh?
- kdazzle 14y ago
  There are a few types of schizophrenia - paranoid schizophrenia being one of them.

spiritplumber 14y ago

That'd have been an awesome trolling opportunity.

brownbat 14y ago

Contact a lawyer immediately. There are many actions you could take to mess with the investigation that might seem like fair game, but you should discuss each one with an attorney so you don't provide some arcane justification for them to arrest you (by hacking back, or even maybe "interfering with an investigation"). Once you get past that stage, the attorney can help you petition to stop the behavior or demand more information about it. Legal advice is what you need now, not tech advice. (Because the server is crushed, I'm only getting the basic gist - forgive me if you've already done this.)

magikarp 14y ago
If anyone knows a good lawyer in Montreal, please let me know! nadim@nadim.cc
- dfc 14y ago
  Get in touch with the EFF: https://www.eff.org/pages/legal-assistance https://www.eff.org/pages/legal-assistance
  - ComputerGuru 14y ago
    Don't. They take forever as they have only so few lawyers and they're all backlogged for months. They're also not equipped for this kind of thing. Their lawyers focus more on civil suits, not criminal..
    - pringles 14y ago
      > EFF maintains a list of attorneys, called the Cooperating Attorneys list, who have told us that they are passionate about the same things we're passionate about, and who have indicated that they have some of the same areas of expertise. If we can't help you, but feel that your case is something our cooperating attorneys may be able to assist with, we'll offer to refer you to one of them.
      - 14y ago

unimpressive 14y ago

I have to wonder what you'd see If you used style as ID. Styles change from time to time But style stays from line to line. Names can change and faces too But writing tells you who is who.[0] Many say they are a crowd But fewer do once lost their shroud. Traps and snares one will find Many more if kept their wits about their mind Still plenty that you see Hide their face behind IP. Just a thought. [0]: http://33bits.org/2012/02/20/is-writing-style-sufficient-to-deanonymize-material-posted-online/ http://33bits.org/2012/02/20/is-writing-style-sufficient-to-... [1]: EDIT: It seems to me that it is very possible that not all accounts here, though not necessarily in this thread, correspond to a single individual.

mintplant 14y ago
Could you... elaborate more on this, perhaps?
- unimpressive 14y ago
  Sure. While I don't want to start a witch hunt, I often wonder while reading discussions who it is behind the handle. To the point where I can't help but think that a little careful observation might uncover an army of sockpuppets. With the help of the HN api, you could probably fingerprint a lot of users.

fareesh 14y ago

I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary :)

JesseObrien 14y ago
Absolutely. Do a little more than surface level digging and this guy is really just a child playing with toys and announcing it loudly to the world.
- unreal37 14y ago
  Smart teenage coder turned activist... Reminds me of Aaron Swartz, surprised no one mentioned his name yet...
  - JesseObrien 14y ago
    Sorry but respectively, no. I can't allow you to trash Aaron's name like that. Aaron was actually a child prodigy and a borderline genius who had done more than this at 14 years old. This kid plays with JavaScript and wrote a chrome extension that adheres to the XMPP spec. They're not in the same league.
    - thirsteh 14y ago
      It's ironic that you keep calling him "kid", yet he's obviously accomplished more than you. Is this veiled jealousy, or what? In any case: Please take the time to actually understand the difference between XMPP and OTR. You have repeatedly and very confidently shown a fundamental misunderstanding of their function and implementation in this thread.
    - unreal37 14y ago
      I was not trashing Aaron, and sorry if it came off sounding that way. I was just trying to draw a parallel between two teenage hackers who became activists, and raised the ire of the government.

dmix 14y ago

If you need donations for any legal pursuits, set up a page accepting bitcoins or similar. I'd totally support this. Illegally monitoring a citizen has to about as bad as it gets in my books. Especially someone who has never done anything illegal and only received attention by building tools to help free speech/privacy.

glamrock 14y ago
Illegally monitoring anyone, citizen or not, is excessive and supremely uncool.
- memracom 14y ago
  Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. I was interviewed by CSIS because I did some technical work on a server for a foreign-born Canadian who was suspected of being involved in white-power/neo-nazi orgs. The goal of CSIS was to find out if a certain prominent foreign white-power speaker might sneak into Canada. There was a well-known leaky spot in the US border not far from the town where this guy lived. This Nadim fellow is a suspicious guy doing suspicious things who travels to terrorist hot-spots and to the USA, which is also suspicious. And I bet that CSIS is reading every word on HN right now. After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? Same goes for CIA, NSA, FBI, DHS.
  - n3rdy 14y ago
    > Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. Just because something is legal doesn't mean its not excessive. Just because the government does something, doesn't make it right.
  - vidarh 14y ago
    > After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? From the description of what happened I'd guess probably at the local high school, by asking if anyone likes Bond movies.

Wintamute 14y ago

I don't know you and I don't know the world you live in, but just from your worried tone, and the rate at which you're responding to comments in this thread, I just want to say: take a breath. Engaging in a wild HN thread, full of well meaning but varied techy suggestions/speculation might not be the best approach right now. Have some friends sift through it for good information and disengage. Seek legal advice, and take it slow.

magikarp 14y ago
Sorry. I am very stressed and am knocked into full self-defense/damage control mode. Not sure I am in a state to meet people IRL at the moment.
- jacquesm 14y ago
  I think that you actually should meet someone IRL, have them stay over with you or stay over with them.
  - PavlovsCat 14y ago
    Yes.. and in the meantime, I suggest all of us watch this 29c3 talk by Jacob Applebaum, "Not My Department" ( http://www.youtube.com/watch?v=7mnuofn_DXw http://www.youtube.com/watch?v=7mnuofn_DXw ), and think about all our roles in all this. It's not going to stop unless we make it.
    - dmix 14y ago
      There seems to be a new pattern where anyone involved in promoting free speech and privacy through encryption gets harassed by the state, regardless if they actually did anything illegal. http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_and_detainment http://en.wikipedia.org/wiki/Jacob_Appelbaum#Investigation_a... It really shows how those in power are scared of the liberating powers of technology.
      - 14y ago

testhis 14y ago

I think you're a little fucked man

csisagent 14y ago

We are watching. Everything.

conformal 14y ago
lol. you must have seen me at the border, eh? ;)
gaius 14y ago
I'm just surprised you guys even exist - I thought "Canadian Agents" were something they'd just made up for Quantum of Solace.

fareesh 14y ago

I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary

jscheel 14y ago

Honestly, I wasn't reading this very closely and started to wonder what in the world pg had to do with Canadian government agents.

HNC 14y ago
Exactly the same. I had to re-read it and then I got that "PG" wasn't PG (Paul).

herge 14y ago

Man, who could imagine such skullduggery in such a boring place as Conscordia's Reggies. Secret agents and illegal break ins oh my! Although, I did have a palestinian friend swear that the Tim Horton's on Guy was a hotbead for the Jordanian security service.

p3d4nt 14y ago

Maybe Wolf 'has learned how to hack'...LOL!

mikebrock 14y ago

You should attempt to contact the Canadian Civil Liberties Association as soon as possible and protect the evidence on your laptop with your life.

triplesec 14y ago

Canada has secret agents?

krapp 14y ago
Of course they do, why wouldn't they?
lutusp 14y ago
> Canada has secret agents? The fact that you don't know about them means ... the plan is working.
RockyMcNuts 14y ago
they're the politest. excepting missions involving ice hockey, which bring forth a lust which can only be quenched by blood.
MacsHeadroom 14y ago
What country doesn't?

glamrock 14y ago

What, no "C.I.Eh" comments yet? I'm... a little disappointed to be honest.

bdg 14y ago
This isn't reddit.
- cieh 14y ago
  good thing, too

p3d4nt 14y ago

The cat crept in the crypt crapped and crept out.

mrb 14y ago

Magikarp, out of curiosity, why do you think the CSIS want to spy on you? 1) Because you are an anti-surveillance activist. 2) Because they want to eventually backdoor Crytocat in order to spy on the users. 3) Because the FBI asked CSIS to spy on you, and the FBI has their own motives.

oxide 14y ago
all 3?

drucken 14y ago

For a hacker site, why are so few people interested in seeing his logs? I hope Nadim does a full write-up, including these, soon. In the meantime, all the best and keep your (thankfully already) level head.

JesseObrien 14y ago
They're caught up in the moment, I'm guessing. My first reaction was "where are the logs? show me some kind of actual proof". Otherwise this is just some kid who's paranoid and has a rootkit on his machine or something.

st3fan 14y ago

Since you have already published so much of this story. How about full disclosure and post the actual hostnames, firewall entries and that email you received?

govcrypto 14y ago

yet another cry for attention from this talented but misguided young man. First it was TSA and Homeland, now the Canadian CSIS -please! You yell and scream about silent circle, about Skype -you demean and disrespect other noted cryptographers when they get press....I work for the govt -your little Hello-Kitty plug in is akin to sugar koolaid. There are many senior experienced folks here that would make great mentors. Get a good mentor -but please stop with the high-school drama. its not reality. I am too old to placate this and someone needs to bring this young man under his wing. He has a future if he stops pining for attention.

bobzibub 14y ago
?The last thing society needs it his talent being co-opted. His software is a clever little tool and helps to strike a balance between overarching security organizations and the citizens they're supposed to protect. Sure it is not enterprise class but good enough is pretty damn good. I think you while he could learn from you tecnically, you could learn a lot from him as a citizen.
- oijaf888 14y ago
  Good enough isn't good in crypto when people are trusting it for secure communications. Also why what's the difference (functionally) between cryptocat and pidgin/adium with OTR turned on? In the latter case I believe you can even use gtalk securely.

cieh 14y ago

have they done things like use your accounts to make posts in your name? they do that to poeple.

asdlkfjgh 14y ago

Disconnect computer from network. Try to dump RAM image. Image the drive, sign and optionally encrypt the contents, preferably file-by-file checksum and copy to multiple secure locations. Copy of checksums in additional secure location. Get out of your house with your computer as soon as possible (as soon as you upload one or two images). Do not leave the computer, they will try to destroy or confiscate the evidence. Plan to store computer in secure location, preferably with 24/7 video monitoring and a heavy duty safe. Preserving the evidence is probably that important. Try to be in the company of someone you trust so they can act as a witness and can protect you from physical intimidation or attack. Assume phones are compromised including GPS on your mobile phone. Assume you are under physical surveillance. Assume your car is compromised. Relatives and close friends will be known to operatives. May be a good idea to spend 1-2 nights in a motel with a friend without anyone's cell phone paying cash until you secure copies of your data and get advice on what to do next.

borplk 14y ago

whatever you do make sure to document every single little detail, take photos, videos, audio recording, keep the emails, etc...

false_name 14y ago

I find the idea that Nadim is under surveillance to not be unrealistic. I don't believe he would be under surveillance for his programming. Whether for his associates is another thing. I don't believe the people he alleges he spoke with are intelligence operatives. Whoever they are, they were almost surely messing with him (but could still be conventional employees of an intelligence agency.) Whether or not they're for real doesn't change my first paragraph though. I'm not able to give any advice except this: As long as you're on this road, there is no one you can fully trust. No one at all. You haven't fully internalized this yet.

deleted 14y ago
[deleted]

pg 14y ago

"I’ll be wearing a black suit." That should have been enough to make anyone suspicious.

west1737 14y ago
And the name PG... very sketchy
charlieok 14y ago
I did wonder if this bit... “On January 31st, 2013, a person identifying as PG sent me an email saying that he would wish to meet to discuss a business opportunity with me.” ...was intended to refer to you, or if the initials PG are just a coincidence. You are in the “initials club” after all (rms, jwz, esr, djb) and have even shortened the usual three letters to two.
- pg 14y ago
  Yeah, actually I think he probably meant "PG" and not PG. But by the time I realized that, someone had replied to me, and I don't like to delete comments with replies.
skrebbel 14y ago
Why? My friend PG (Pieter Geelen) wears a black suit all the time.
- RivieraKid 14y ago
  Does he work at CSIS by any chance?
lostlogin 14y ago
Did he learn his trade from movies or so something? What if there are 2 people in black suits? Oh, covered, he will be the one with the shaken martini.
deleted 14y ago
[deleted]

evolve2k 14y ago

What's the story with everyone calling each other 'friend' in this post? Is this some crypto community thing I'm not aware of or just coincidence?

jamiek88 14y ago
Canadians.
- teeja 14y ago
  A cryo- community then.

wildmXranat 14y ago

I may or may not have any comments about your situation. Nevertheless, anyone responding to these comments needs to know that there is no guarantee that magikarp is actually Nadim himself, whether the account is compromised and so on. Catch 22 is in full mode in this thread and I would hope that this is not simply paranoia kicking in. Hypothetically, what is the benefit of airing out of all this information ?

JesseObrien 14y ago
Hypothetically, what is the benefit of airing out of all this information ? Media attention. That seems to be all this kid has done is wave things at the media that the media themselves don't understand. Cryptocat is a javascript implementation of XMPP with OTR enabled. Snore... Hop on Google chat and click "Off the record" and you've done the same thing cryptocat does. Unlike google chat you have to load up yet another Chrome browser extension that will no doubt eat more memory. The "anapnea" thing he was involved in looks like a joke as well. "Encrypted tunneling network"? You mean a VPS you give people SSH access to? Mind blowing. Nothing to see here folks. Move along.
- kam 14y ago
  Google's "off the record" has nothing to do with the OTR protocol. It only instructs the server to stop archiving the conversation, and does not involve end-to-end crypto. Google still has access to the cleartext as it passes through their servers.
  - JesseObrien 14y ago
    Google still has access to the cleartext as it passes through their servers. Right, and cryptocat doesn't, 'cuz they said so on their website!
    - thirsteh 14y ago
      The first implementation of Cryptocat was bad in this regard, but the new version uses OTR. OTR virtually guarantees that a middle man can't interpret your communications by performing public key authentication and key negotiation--similar to SSL with mutual authentication using a shared secret (see http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html http://www.cypherpunks.ca/otr/Protocol-v3-4.0.0.html, particularly the section on the Socialist Millionaires' Protocol.) You don't have to trust anyone to transport your data without snooping. Not only that, Cryptocat's new implementation is open source: https://github.com/cryptocat/cryptocat https://github.com/cryptocat/cryptocat. Inform yourself, ignoramus.

kefs 14y ago

In case you're curious about who exactly we're talking about.. check out this CSIS Recruiting Video, complete with ominous, heart-thumping, background music. https://www.youtube.com/watch?v=dszXCHbvJYY https://www.youtube.com/watch?v=dszXCHbvJYY more: https://www.youtube.com/user/csisscrs/videos?view=0 https://www.youtube.com/user/csisscrs/videos?view=0

orangethirty 14y ago

Slow down a bit there. Whatever is happening, you need to slow down. Don't make any quick decisions. I know you may feel under a lot of pressure. Best way is to talk to someone you know and trust. A family member or a very old friend. These people love you and want the best for you. Contact them, and explain what is happening. Then with their company, analyze the situation. I want you to do this. Your current position may make it not so simple. But you must slow down and regain your composure. Such situations are better dealt with people who love you. Postpone any harsh decision until you have met with a loved one and have explained the items. Remember that there is always a way to work things out. Dont lose hope. I want you to remember that things get better. They improve. You just need to slow down and reason a bit. I'm not doubting your points. But I want you to go to a safe place where you can get some rest. Tomorrow you may be able to think about this with a better understanding. You are a smart person. You always figure out hard problems. You need to rest a bit before you can tackle it. Go and stay with a loved one. They will welcome you and listen to the items you are talking about. I am orangethirty. Have been programming for a long time. I live in the Caribbean, and you can read more about me on my github (github.com/orangethirty). I'm only interested in your well being. We all want for you to regain your inner peace. If you need anything, then let me know by posting here. If you feel comfortable emailing me, then do so.I am not pressuring you to do so. Do it if you feel like it. I want you to remember that tomorrow is another day. Things improve. There is a way to solve every problem. - orangethirty

mylittlepony 14y ago

> "These connections were all detected and prevented by my external firewall system" What software can I use for that in Linux? Did he mean a hardware firewall?

downandout 14y ago

The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Presumably he isn't clicking on spear-phishing emails and the like. If they physically accessed the machine, e.g. they sent Jason Bourne in to bug his machine, he's probably headed for some trouble at some point. In general that kind of thing isn't done just for the purposes of poking around.

martinced 14y ago
I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here. Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal. Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! But it still begs the question as to how his computer got owned in the first place.
- coldtea 14y ago
  >Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh! Is it mediocrity, or is it intended in order to send a message? "We are on to you", etc?
  - sanswork 14y ago
    I'd say imaginary myself. I'm curious what the systems were that were obviously csis systems. He failed to include any logs or information beyond his claims.
    - coldtea 14y ago
      Failed implies he tried. He didn't try. He just told the story. People seem to know the guy. I'm not sure this is "imaginary" at all.

kdazzle 14y ago

Assange? McAfee? Is that you?

amasad 14y ago

This is the most trouble a browser plugin could ever cause anyone, and if all this is true then the Canadian government, the FBI and whomever else are after this kid are being very silly. That being said I can't help but think the author likes the media attention, and why wouldn't he, it must be bringing more exposure to his work.

heyitsrama 14y ago
I think it's more of the sense of the passion that he puts into his work, you should read the weblog.

guelo 14y ago

Straight into the Supreme Court? That is way better oversight over executive branch spying than in the US!

n3rdy 14y ago

Is it possible that they may have used a type of hardware backdoor? Something that would be connected to the router, or back of the computer using the lan or usb port? None of that would show up in any logs or files, and it would get around any password protection and encryption on the actual computer, the only evidence would be from monitoring router traffic. A usb bug would be something that would transmit via wifi, but it would need to be connected directly to your computer to work. Also check inside the computer for anything unusual.

shocks 14y ago

Umm, backup and format you computer?

Sicp 14y ago

publicity stunt is public.

X4 14y ago

It is possible that someone is playing a bad prank on Nadim, or that Nadim made the story up to gain attention. Please read on. If this is real, then I'm sorry and recommend you to consider all suggestions before deciding illogical. DON'T COMMIT SUICIDE! If you watched the movie "Enemy of the State", I'd become paranoid, but not afraid. Stay calm and act logical. I've looked at cryptocat two days ago, what's special about it? I don't see any reason for the Government to observe you, except that you would be a good fit into their Cyberwar Team. And that you have the wrong connections in the internet. I mean your friends are all hackers. It makes you appear dangerous too. Anyway, the government observes everyone, but with different priority and detail. I think only you might know why they observe you. No need to share the info. Just as in the Movie: I'd replace all clothes, shoes and hardware with new ones and move to a different place. Acquire encryption software from a trusted source or compile it myself on a newly obtained Netbook and encrypt the hardrive+swap with a password and keyfile. Hide the keyfile. Put your hardware and new phone into a cool faradaybag.com. Stay in public, but personally invincible. Leak everything that isn't harmful for you using delayed transmissions with ifttt.com. Always have multiple copies of important documents, just for the case it's necessary. Oh and I'd get a weapon and buy a bulletproof jacket (not vest). Avoid any contact to officials should be priority. Use Tor and VPNs like spotflux, hide.io, ovpn.to etc. and inform close friends to guard you. +Trust no one.

parasight 14y ago
I don't think that buying a weapon and a bulletproof jacket is logical in his situation. Seems quite counterproductive to me when dealing with officials.
- X4 14y ago
  I think a bulletproof jacket is logical if his life is in danger. Yes, I agree on the weapon, every signal that can pull the trigger of an official's gun should be avoided. But I think not having a weapon maybe careless too, only he knows what's right in his situation. A stupid move when confronted with officials could cause him more harm than wearing a gun.

deleted 14y ago

[deleted]

matdrewin 14y ago

Just curious how you are so certain that the servers were CSIS servers? Pretty sure you would never be able to trace back a CSIS or CSE ip.

trevelyan 14y ago

Go talk to your MP as well.

HNC 14y ago

I suggest you contact the CSIS and ask them directly why they've backdoored your computer.

sanko 14y ago

you should revise your TCP connections if you want know if it's a joke or not

wyck 14y ago

This sounds a bit like your friends are playing a prank on you, or CSIS is smart enough to make it look like that is the case. The key here is your desktop and how did they access it.

codejammer 14y ago

magikarp, could you please do a writeup on how did you notice the surveilance? Any extra info except i found a backdoor and noticed funny traffic would be more than useful to know.

cpressey 14y ago

I'm extremely confused by one detail. I'd like to know, what would be the point of describing oneself as a "Juror" or "former Juror"? Is there a particular court case involved with this story that I've missed a reference to? Is it some kind of slang in intelligence circles?

Raz0rblade 14y ago

try a different computer for example android / linux or something exotic much harder to backdoor compared to windows

davebuster 14y ago

IP logs or STFU

X4 14y ago

ANY UPDATES?

vy8vWJlco 14y ago
https://twitter.com/kaepora/statuses/300992047345704960 https://twitter.com/kaepora/statuses/300992047345704960

wbhart 14y ago

The Wikipedia article notes that the press attention garnered by Nadim after his prior tussles increased the popularity of Cyptocat. Now imagine an intelligence agency wanting people to make greater use of a system they have back-doored or which is vulnerable to attack by them. Perhaps they couldn't resist the urge to make Cryptocat more popular! (Disclaimer: I have no knowledge of Cryptocat or CSIS, and my comment is hypothetical speculation. Alternative hypotheses are that they are invading Nadim's computer to try to find a way to break Cryptocat or to spook its developer, or because they have Nadim under some sort of surveillance, for who knows what reason.) I do have a question about the story though. Why would an intelligence agency want to "acquire" Cryptocat? What would that mean anyway? Purchasing it for internal use is surely not necessary. They can just use it or any one of a number of in-house products they surely already have access to. Purchasing it to take it out of circulation is a possibility. But is this actually feasible? It's Open Source. Purchasing it to stop the developer working on it is a possibility. But wouldn't others step up? Buying a controlling stake in it is a possibility. But I don't see why an intelligence agency would make an offer of cash to someone not known to be susceptible to that kind of manipulation. I actually just don't see them doing this full stop. They surely know Nadim is motivated by idealism, not cash. So I can't think of a reason to "acquire" Cryptocat that actually stacks up. To work out what is going on here, you have to put yourself into the mindset of the individuals and organisations involved. And that is not easy if you simply have their media persona to go by. Like the rest of the population, these organisations tend to be filled with people of many different persuasions, from geeks and activists and hackers through ultra-authoritarians and rogue elements. It's impossible to know which group is responsible for this, or what their motivations might be. It might have even been an unauthorised operation! And it may just as easily have been someone spoofing CSIS, e.g. some hacker group angry at CSIS for some past grievance. If so, I bet it is baking CSIS's noodle just as much as Nadim's! At any rate, one should never infer a conspiracy where simple administrative or bureaucratic incompetence is a perfectly valid explanation.

vy8vWJlco 14y ago

Update found via Nadim Kobeissi's Twitter feed on Feb 11 @ 7:37 AM: "Alleged CSIS Liaison Officer met me for coffee yesterday. Told me that Cryptocat is national security threat to Canada. That is all." https://twitter.com/kaepora/statuses/300992047345704960 https://twitter.com/kaepora/statuses/300992047345704960