11 ms·
GCHQ Used Fake LinkedIn Pages to Target Engineers (2013)
- jstanley 13y agoBut LinkedIn uses SSL. There's no mention of how GCHQ got around this. Does anyone know? EDIT: Because the ability to MITM SSL sessions is a lot more scary to me than the willingness to MITM non-SSL sessions.
- dangrossman 13y agoLinkedIn does not require (or automatically redirect to) SSL. If you're not logged in, the homepage is served over https:// https://. If you are logged in, typing linkedin.com brings you to your news feed, no redirect to https:// https://. If you aren't logged in, then enter your username and password, you're redirected from the https:// https:// site to the http:// http:// one.
- anaphor 13y agoI strongly suggest using httpseverywhere for this reason. Although for some reason linkedin.com is listed as "buggy" by default :/ so enabling it might break some stuff.
- metachris 13y agoWell since the GCHQ is part of the government, and the government has a root cert in the browsers, they can basically create all the SSL certificates they want. Governments can MITM without any problems.
- __alexs 13y agoI don't believe the UK gov have a TLS CA in any standard browser deployments do they? I'm not even sure we have a CA HQd here for them to compel into giving them certs for mitm?
- arethuza 13y agoOut of curiosity I had a quick scan through the "Trusted Root Certification Authorities" on this Windows 7 box and it's quite a surprising list - I have no idea who a lot of these organizations are... Also, one thing I'm pretty confident about, is that if GCHQ is behind any of these certs they wouldn't go labeling it as "UK Government - GCHQ". So presumably I'm just trusting Microsoft that when these certs get pushed out as part of Windows they are who they say they are...
- Maxious 13y agoCA's can issue or lose intermediate certificates that they shouldn't. These have been detected at least 3 times when these technically valid but never before seen certificate chains are used for google.com/yahoo.com/microsoft.com etc. http://googleonlinesecurity.blogspot.com.au/2013/01/enhancing-digital-certificate-security.html http://googleonlinesecurity.blogspot.com.au/2013/01/enhancin... https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion https://blog.torproject.org/blog/detecting-certificate-autho... http://www.chromium.org/Home/chromium-security/root-ca-policy http://www.chromium.org/Home/chromium-security/root-ca-polic...
- willvarfar 13y agohttp://www.mozilla.org/en-US/about/governance/policies/security-group/certs/included/ http://www.mozilla.org/en-US/about/governance/policies/secur... lists those that firefox currently trusts. How many of them are not amenable to some government somewhere? 0. And how many would GCHQ have to compromise to get deniable MITM? 1.
- kluce1984 13y agoHTTPS stripping attacks http://www.thoughtcrime.org/software/sslstrip/ http://www.thoughtcrime.org/software/sslstrip/ or Valid SSL certificate and MiTM attack https://www.eff.org/deeplinks/2011/04/unqualified-names-ssl-observatory https://www.eff.org/deeplinks/2011/04/unqualified-names-ssl-... https://en.wikipedia.org/wiki/QUANTUM#QUANTUM_attacks https://en.wikipedia.org/wiki/QUANTUM#QUANTUM_attacks https://en.wikipedia.org/wiki/Comodo_Group#Comodo_Internet_Security https://en.wikipedia.org/wiki/Comodo_Group#Comodo_Internet_S... or Plant your malware directly into the Linked servers https://en.wikipedia.org/wiki/Muscular_%28surveillance_program%29 https://en.wikipedia.org/wiki/Muscular_%28surveillance_progr...
- Tobu 13y agoLinkedIn doesn't use HSTS and can be sslstrip-ed. Even then, it's not like GCHQ would have qualms at using a spoofed cert (cert pinning could prevent this but isn't widely deployed), the express purpose of spooks is to use illegal methods.
- digitalengineer 13y ago>Then they determined which of the potential targets used LinkedIn or Slashdot.org, a popular news website in the IT community. So is HN. And it's ancient. Any ideas of possible vectors to attack HN-loving engineers?
- SideburnsOfDoom 13y agoMITM on a connection to hackernews probably doesn't differ in any significant detail from MITM to facebook, linkedin, slashdot, etc.
- SideburnsOfDoom 13y agoUpdate, this sibling post claims that HN is at least a well-configured website; and so MITM attacks will be on the upper end of the normal difficulty range: https://news.ycombinator.com/item?id=7421558 https://news.ycombinator.com/item?id=7421558
- jakub_g 13y agoHN has been, for a couple months already, HTTPS-only, and it uses HSTS and disallows framing in the response headers, so that's pretty good. It wouldn't hurt though (probably) to get added to the HSTS preload lists of Chrome [1] and Firefox [2]. [1] https://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json https://src.chromium.org/viewvc/chrome/trunk/src/net/http/tr... [2] https://github.com/mozilla/gecko-dev/blob/master/security/manager/boot/src/nsSTSPreloadList.inc https://github.com/mozilla/gecko-dev/blob/master/security/ma... Trusting the SSL certs is another thing though.
- shubb 13y agoWell, you could post a linkbait article that pulled in some javascript with an exploit in it. Everything here is public except the IP addresses behind the usernames.
- pbhjpbhj 13y agoI think he meant for hiding malware on the rendered pages a HN user sees - doxing most people here would probably not be so hard (especially for GCHQ).
- digitalengineer 13y agoSo you have targets (basically employees of said company) browsing popular sites and becoming infected. You can't deny access to all popular sites. Would it be possible to build a 'scraper' that copies content and places it on your local network for your employees? Perhaps also allowing comments to be placed back on your behalf? You'd give the employees access to things they want to read, but stop attacks correct?
- adamnemecek 13y agoThat's kinda now Richard Stallman browses the internet. https://stallman.org/stallman-computing.html https://stallman.org/stallman-computing.html Search for wget.
- e12e 13y agoI'm not sure if truly defeating such attacks is feasible, but if you demand employees use a (ssl terminating) proxy, you can at least monitor and/or log all traffic (not necessarily legal or ok in many jurisdictions) -- and so have a reasonable way to look for malware (possibly only useful after the fact). That is if the routers inside your own network can be trusted. Paranoid turtles, all the way down.
- spindritf 13y agoI don't think the filtering approach is feasible. You need separation. Maybe run separate VMs for casual browsing, work, entertainment, etc? Like Qubes does http://qubes-os.org/trac http://qubes-os.org/trac
- Eye_of_Mordor 13y agoWhat does this have to do with saving us from terrorism?
- bananas 13y agoAbsolutely nothing. It's Totalitarianism, nothing more or less.
- wreegab 13y agoI just can't understand how the people who work in there do not see it.
- bananas 13y agoI worked in the defense industry for a few years (1998-2002). I didn't see it at the time. Everyone works in isolation, no one talks about work and everyone is micromanaged to bits and separately motivated. It's heavily draped in propaganda as well, most of which is horse shit. It's all much like the promoted status of imperialist armies. Obviously september 11th 2001 happened and to see your colleagues actually see that as job security and a way to sell more weapons and celebrate that turned it for me. I started to question the ethics of what I was doing and decided it was best that I left. I bailed one afternoon, gave no notice and spent three months selling Sun kit on ebay before taking a job at a web agency selling whiskey and houses instead. Most people didn't get that "moment" and are still prisoners of the inane propaganda. The same is true of those at GCHQ. My children are doing GCHQ sponsored mathematics work (cryptography challenges) at the age of 10 probably in the vain hope that they will eventually see this as normal and be recruited before they have a chance to question the ethics of it all.
- neuralk 13y ago>My children are doing GCHQ sponsored mathematics work (cryptography challenges) at the age of 10 probably in the vain hope that they will eventually see this as normal and be recruited before they have a chance to question the ethics of it all. What? Care to elaborate? (I'm American if that explains why I have no idea what you are referring to)
- DominikR 13y agoAnd we all know that they are using this data only to fight terrorism. They would never use it to give their own industry insider information. </sarcasm>
- motters 13y agoAs outlined in the NSA recruitment audio, the term "adversary" includes everyone - not just terrorists. There is nobody who is not considered to be an "adversary", so that includes commercial rivals too.
- DominikR 13y agoThere was a time when I used to wonder why sovereign states like Russia or China built their own variant of Facebook and Twitter instead of using the original. I thought that language or cultural barriers prevented those companies from succeeding or that those countries suppressed US companies because they are evil and want to control their population. Today I think I'm more realistic about that. All sides want to control their population (US included), and no one wants foreign countries to access data of their citizens. That's why there's so much redundancy. China would never allow Facebook to succeed in their market and the US wouldn't allow Sina Weibo, Renren or Vkontakte to succeed on their market. The US wouldn't ban those companies outright (like China did), but there would be a media campaign against them and the COMMUNIST THREAT that those companies pose to the minds of our innocent children in the west, which basically would have the same effect.
- dan_bk 13y agoThere is really only 1 solution to this: Put your mobile phone permanently in flight mode and go back to relying on landlines/email. The alternative choice to this is accepting the fact that "GCHQ now wants to turn the mobile web into an all-seeing surveillance machine."
- infinity0 13y agoThis sounds like something a NSA/GCHQ psy-ops division would say. The alternative is most definitely not landlines/email. We can and must demand free verifiably-secure hardware and software, including for our mobile phones. There is ABSOLUTELY NO REASON why the mobile web must be a surveillance machine.
- jjjeffrey 13y ago> "[LinkedIn] does not sanction the creation or use of fake LinkedIn profiles or the exploitation of its platform for the purposes alleged in this report." If I understand things correctly, it's not claimed that GHCQ made fake profiles or exploited their platform. It's possible that whoever made the statement didn't really understand MITM, but this kind of reads like another one of the usual carefully worded non-denials. Full paragraph in the article: When contacted, LinkedIn stated that the company takes the privacy and security of its members "very seriously" and "does not sanction the creation or use of fake LinkedIn profiles or the exploitation of its platform for the purposes alleged in this report." "To be clear," the company continued, "LinkedIn would not authorize such activity for any purpose." The company stated it "was not notified of the alleged activity."
- altero 13y agoWho needs enemies with such friends...
- JabavuAdams 13y agoWith friends like these, who needs enemas?
- glitchdout 13y agoWhy do the NSA and GCHQ want this much access? Everyone's location in real time? This is ludicrous. Terrorists don't use mobile phones anyway. I'm still waiting for the blackmail revelations. Though I doubt NSA & friends would be that stupid to make slides about that little objective.
- AimHere 13y ago>Terrorists don't use mobile phones anyway. There you go! Track all the phone users, and anyone who doesn't have one, and is therefore untracked, is probably a terrorist! Actually that's not far-fetched. I do recall, vaguely, some old indymedia article about a European political activist being arrested, with the fact they left their phone at home before turning up at a meeting being part of the grounds for suspicion. Indymedia stories tend to be rather ephemeral and hard to search so providing actual details is somewhat troublesome...
- dan_bk 13y ago> There you go! Track all the phone users, and anyone who doesn't have one, and is therefore untracked, is probably a terrorist! This is how I would scare people if I were paid by the NSA.
- deleted 13y ago[deleted]
- mikkohypponen 13y agoPlease add [2013] in the title.