6 ms·
Belgian professor in cryptography hacked
- sentenza 13y agoA near-perfect copy of Slashdot was supposedly served to infect "targets" with malware. Since Slashdot isn't the center of the IT world any more, the logical conclusion must be this: Who of us (reading this) is currently being served his HN by GCHQ? We're here at the heart of what should (and does) bug many IT people over here in Europe: If you work in IT for a company that does something of interest to GCHQ and the NSA, then you and your access credentials are one of those 'targets' they keep speaking about.
- vezzy-fnord 13y agoHN isn't the center of the IT world, either.
- niels_olson 13y agoWell, maybe not, but USG does keep on eye on the goings on here. E.g. http://web.nvd.nist.gov/view/vuln/detail?vulnId http://web.nvd.nist.gov/view/vuln/detail?vulnId
- dave809 13y agoYour link is broken
- darsham 13y agoYour link is indeed broken but some google fu led me to find these entries proving your point : http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0175 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-017... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-2094 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-209... http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-4929 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-492... They cite HN among a plethora of other references, though.
- varjag 13y agoYes but this is NIST (formerly ANSI), and these are essentially credits. Heck even I am in credits at NIST somewhere, it's quite a leap from being mentioned to being tracked by government.
- slurry 13y agoI just assume the intelligence community has penetration into YC at an organizational level anyway. (Not to single out YC, just any firm in that class).
- w1ntermute 13y agoWhat would be the point of penetrating YC? There isn't much useful intelligence to gain from a startup accelerator. Things might change now that there are a lot of foreigners in the program, but even then, it's a relatively small group of people. As much as people on this site like to think they're important, I highly doubt that anyone here (with the exception of the infrastructure/security people) matters enough to the intelligence community for anything more than your run-of-the-mill passive wiretapping/eavesdropping that all Americans are being subjected to.
- DanBC 13y agoBritish secret service police wanted an informer on every street and certainly tried to send infiltrators to every minority political meeting they could.
- mikevm 13y agoI guess if you think that you're a potential target, you should be doing your computing like rms: http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html
- sentenza 13y agoAnybody who works in infrastructure for a big European ISP is a target. That's a lot of people who are currently living relatively normal lives.
- intslack 13y agoHere's a much better english summary: http://www.standaard.be/cnt/dmf20140201_011 http://www.standaard.be/cnt/dmf20140201_011
- kremlin 13y agothanks. First sentence of second paragraph had my mind in shambles trying to parse it. "There isn't a card with an electronic chip available, or it has some sort of security technology that UCL professor Jean-Jacques Quisquater (67) was involved in developing." I haven't a clue what that means. [edit] wait, your link just ends up at the same article for me.
- jessaustin 13y agoThat sentence is not perfectly idiomatic, but it seems to assert that Prof. Quisquater was involved in developing security tech for all chip-equipped cards that are currently available.
- intslack 13y agoA mod changed the link, earlier it was just a several sentence gigaom "article" linking to a Google translation of http://www.standaard.be/cnt/dmf20140131_049 http://www.standaard.be/cnt/dmf20140131_049.
- 1337biz 13y agoThanks to the mod for the link change. Only found the standaard translation and thought the gigaom was at least some form of a summary and better than a google translated document.
- createmyaccount 13y agoThat sentence is a literal translation from Dutch. Basically saying that the professor has been involved in the development of basically any card with an electronic chip available.
- things 13y ago
- eliteraspberrie 13y agoHis computer was infected after clicking a (bogus) LinkedIn invitation of a non-existent employee of the European patent office. Just goes to show how effective phishing attacks are. If a professor of cryptography does not check SSL certificates, far less people do so than we think.
- zokier 13y agoSocial engineering has very little to do with cryptography; being expert on one does not give effective protection against the other (or vice versa).
- jessaustin 13y agoISTM that a strict adherence to Kerckhoffs's principle on the part of the professor and his colleagues would reduce the value of this hack to run-of-the-mill NSA/GCHQ creepiness. That is, they're not going to learn any secret keys to CA roots by reading his email. Since they're creepy evil bastards, however, there doesn't have to be a point to it.
- setori88 13y agoQuisquater was involved in the development AES. Are the NSA trying to find ways to crack it?
- chbrown 13y agoBesides the GCHQ aspect, doesn't seem terribly different from other less catchy news stories: "Immunologist gets the flu", "Physical therapist fractures shin", etc.
- effdee 13y agoYou make it sound like it happened by chance. However, it's more like "Special Forces kill top terrorist in Absurdistan" (as in, went an extra mile, tailored operation, high-value target). edit: speling
- kevin_bauer 13y agoThat example just shows, how easy it is to be scamed. No matter how smart and how much of an expert you are, you still may be vulnerable from an totally unsuspected angle. Don't ridicule someone who "deserved" it because of his "stupidity" or "naivety", because you may be the next laughing-stock.