9 ms·
Inside the Operating System Edward Snowden Used to Evade the NSA
- cloudwalking 13y agoTails (The Amnesic Incognito Live System) http://en.wikipedia.org/wiki/The_Amnesic_Incognito_Live_System http://en.wikipedia.org/wiki/The_Amnesic_Incognito_Live_Syst..., a Debian fork which forces Tor for all outgoing and incoming connections. Designed to be run from read-only media.
- reedalex01 13y agoMore info on their relationship with Debian: https://tails.boum.org/contribute/relationship_with_upstream https://tails.boum.org/contribute/relationship_with_upstream "For various reasons Tails tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian" "We try to push our changes upstream when we need to modify software we ship. This often requires us to write code in a generic way, rather than implementing ad-hoc hacks to fit our specific needs: e.g. we often need to make the stuff we need opt-in and add configuration options." The official term for this is "Debian derivative" rather than "fork."
- drzaiusapelord 13y agoSo, is this proof that tor is not completely subverted by the NSA? Recent articles here claim that the NSA has been deploying numerous nodes and can analyze traffic from multiple nodes to compromise the user. Or is this proof of tor being better than nothing?
- toyg 13y agoThe latter. The NSA didn't have to analyze anything: Snowden was not a known target, and he revealed himself before any real manhunt or mass-analysis had started.
- xsace 13y agoWell it's not like Snowden managed to remain anonymous forever
- steve19 13y agoYou mean when he did a video interview? He managed to do what he did and leave the country without being caught. I call that mission accomplished.
- jonemo 13y agoAnother Debian based boot-from-CD OS that used to be quite popular is Knoppix [1]. I remember that was a big thing in the times of Win98 viruses when people used it for system recovery. In Germany they distributed it as add-on to computer magazines. [1] https://en.wikipedia.org/wiki/Knoppix https://en.wikipedia.org/wiki/Knoppix
- k-mcgrady 13y agoKnoppix was my first introduction to Linux. The boot-from-CD aspect amazed me. At first the only thing I used it for was recovering data from a screwed up Windows install but eventually I got more into it and started installing other distress (starting with Ubuntu I think).
- AJ007 13y agoFor some perspective, this was back in the days where it was actually quite a bit of work to get get linux configured and running correctly on your at home desktop. Knoppix was quite a miracle.
- dfc 13y agoKnoppix came out in 2000, a lot of time had passed since it was "actually quite a bit of work to get get linux configured and running correctly on your at home desktop." If you were mot using a thinkpad or ibook a laptop could still cause some trouble.
- k-mcgrady 13y agoI started using linux around 2004 and it still required quite a lot of technical knowledge to get working. Drivers were a big issue around sound, graphics, and network.
- girvo 13y agoKnoppix and Slax were my first foray into Linux as a teenager. The latter also introduced me to the terminal, in my quest force it to boot from a HDD... Many a partition died that week.
- SixSigma 13y agoEven wired don't know what an OS is. Or rather the definition of OS has changed. A strange time when your industry jargon enters the popular lexicon but always slightly twisted. You can't even call yourself a Troll in the UK now without people thinking you go on Facebook and mock the dead to their nearest and dearest.
- timthorn 13y agoYes, the BBC News at Ten told us that "the website Mumsnet has warned its 1.5 million users that their data may have been hacked as a result of the Heartbleed computer bug. It's the first time the virus has been found on a British website"
- SixSigma 13y agoI have found the BBC's Technology reporting particularly irksome. Their website is filled with re-hashed press releases. I even re-wrote an article concerning turning urea into electricty for them to show what it could have been like if they had put half an hour's effort into it, naturally I didn't even get a response.
- timthorn 13y agoOf course not. They thought that you were taking the piss in a shocking way. I did once mail a correction to a story about a new EU regulation which had been a high profile item across BBC News. It was quite a fundamental thing, and I got a short mail from a senior editor, thanking me and angrily lamenting that it wasn't a difficult thing for his reporter to check, state of journalists these days, etc etc. The story was changed. --edit: make a bad pun worse.
- bashinator 13y agoWhat is Tails, if not an operating system?
- SixSigma 13y ago
- Gregorein 13y agois website under ddos?
- gulbrandr 13y agoHN-DDOS, probably.
- devconsole 13y agoIt's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint. Here's an example: Let's say (for the sake of example please) that the NSA can passively monitor Google searches in realtime. Let's say you search for a phrase that sets off their monitor: something like "a Tor user has Googled for Snowden." They'd like to know who you are. How would they do that? One way is to record the fact that from your home computer originated some Tor traffic at almost the same time the Google search took place. It's unclear exactly how they deanonymize Tor users, but one piece of info that may corroborate my hypothesis is that in a Snowden screenshot, you can see the NSA has a tab called "Tor Events" in one of their tools. The need for websites to load quickly is Tor's Achilles heel, because it enables timing correlation. The fact that few people use Tor exacerbates the problem.
- nounaut 13y agoI think you mean to say that users of Tor are potentially vulnerable to NSA and GCHQ attacks. Specifically, they lack the capability to deanonymize individual targets upon request and according to the slides leaked by Snowden they are only able to deanonymize a very small fraction of the traffic and usually have to rely on attacking surrounding software, such as the Firefox browser bundled with Tor. http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack-tor-network-encryption http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack...
- jgalt212 13y agoHas anyone looked into thwarting timing attacks by using Selenium to run web tasks at random times?
- mike-cardwell 13y agohttps://tails.boum.org/doc/about/warning/index.en.html#index7h1 https://tails.boum.org/doc/about/warning/index.en.html#index... "Tor doesn't protect you from a global adversary A global passive adversary would be a person or an entity able to monitor at the same time the traffic between all the computers in a network. By studying, for example, the timing and volume patterns of the different communications across the network, it would be statistically possible to identify Tor circuits and thus matching Tor users and destination servers. It is part of Tor's initial trade-off not to address such a threat in order to create a low-latency communication service usable for web browsing, Internet chat or SSH connections. For more expert information see Tor Project: The Second-Generation Onion Router, part 3. Design goals and assumptions. [https://svn.torproject.org/svn/projects/design-paper/tor-design.pdf]" https://svn.torproject.org/svn/projects/design-paper/tor-des...
- diziet 13y agoSome alternatives: Whonix: (vm isolated or hardware device isolated, tor) https://www.whonix.org/ https://www.whonix.org/ and Qubes OS: (sandboxing different processes, needs torVM to do tor things) http://qubes-os.org/trac http://qubes-os.org/trac A nice comparison: https://www.whonix.org/wiki/Comparison_with_Others https://www.whonix.org/wiki/Comparison_with_Others
- higherpurpose 13y agoThis table is also interesting: https://www.whonix.org/wiki/Comparison_with_Others#Attacks https://www.whonix.org/wiki/Comparison_with_Others#Attacks
- perlpimp 13y agoYou can hack SD cards actually unlike the article states, Bunny's blog post and presentation at Chaos Computer Congress mentions of this possibility. SD cards have microcontrollers and with enough resources their guess flash media can be subverted. Diversity of these controllers and variety of "proprietary" standards the way these flash controllers work however can be the entropy that makes SD controller hacking very unlikely - but you never know. http://www.bunniestudios.com/blog/?p=3554 http://www.bunniestudios.com/blog/?p=3554 my 2c
- agumonkey 13y agoalso, in your hdd controller(s) http://spritesmods.com/?art=hddhack http://spritesmods.com/?art=hddhack. same stuff, too many cpu everywhere, making protocols meaningless.
- dmix 13y agoAnd Macbooks can be hacked through the battery https://news.ycombinator.com/item?id=2796264 https://news.ycombinator.com/item?id=2796264
- bluenose69 13y agoThe article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play." Yeah, that worked out well for openssl.
- aw3c2 13y agoYes it did. The heartbleed bug was found during an audit of the open source of openssl.
- epo 13y agoThe audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.
- infinity0 13y agoHow would you have found the bug without it being open source? You think companies pay for these open public audits on proprietary software?
- sp332 13y agoThe vulnerability was first found by a fuzzer, which would have worked equally well on closed-source software. And I believe the fuzz tester (part of Codenomicon's "Defensics") is also closed-source.
- infinity0 13y agoYou misunderstand - how would the public have found out about the results of that audit? There is no incentive to release this information for a closed product; very much the opposite.
- 0xdeadbeefbabe 13y agoThis point is important. Testing came first and then auditing. In other words, black box testing and then white box testing. Why pretend you are better off just because you have millions of lines of inscrutable source?
- jebus989 13y agoImpressive how much thought and work has gone into Tails development, e.g. it has a surprisingly-convincing XP skin that hides the fact you're even using Linux to the casual observer. Kudos to the devs.
- danford 13y agoIt's called GNOME 2 and it feels exactly like you're using Linux, which is a great feeling. Kudos to the devs. Edit: apparently I was mistaken. GNOME 2 is the default desktop, but there is an XP skin. See comments below.
- breakall 13y agoGP is referring to XP Camoflauge option in Tails. http://www.bitblokes.de/wp-content/uploads/2013/02/tails-0-17-04-xp-tarnung.jpg http://www.bitblokes.de/wp-content/uploads/2013/02/tails-0-1...
- danford 13y agoOh I see.. I just skimmed the Wikipedia article. That is very interesting. Would come in handy in an environment where your superiors are looking over your shoulder. I guess it can't be that bad of an experience since it's Linux underneath.
- drzaiusapelord 13y agoExcept now seeing an XP desktop in a corporate environment will raise eyebrows as its officially dead. No Win7 skin?
- blueskin_ 13y agoI like the way I had to click the article to see what it was. I was wondering if it'd be Tails or something. Yep.
- dmix 13y agoOne important and often overlooked feature of Tails is when you shut it down it wipes your system memory/RAM using sdmem. Your encrypted data and sensitive files are often accessible via memory forensics even if you shut your computer down. Including the websites you visited. Your encryption keys can be in your computers memory for weeks and is easily accessible via a memory dump. This is why people say that with physical access your computer can always be owned. Even if it's encrypted. Tails is the only one I know that handles this attack vector by default. https://tails.boum.org/contribute/design/memory_erasure/ https://tails.boum.org/contribute/design/memory_erasure/
- acqq 13y agoData can be retrieved from DRAM not after weeks (your claim is "even if you shut your computer down (...) Your encryption keys can be in your computers memory for weeks") but only http://en.wikipedia.org/wiki/Cold_boot_attack http://en.wikipedia.org/wiki/Cold_boot_attack "in the seconds to minutes after power has been removed." The reason is explained here: http://en.wikipedia.org/wiki/Memory_refresh http://en.wikipedia.org/wiki/Memory_refresh And even the electrons from SRAM, which doesn't need refreshes and which was for decades not used as "RAM" in the computers will leak away without the power: http://en.wikipedia.org/wiki/Static_random-access_memory http://en.wikipedia.org/wiki/Static_random-access_memory "SRAM exhibits data remanence but it is still volatile in the conventional sense that data is eventually lost when the memory is not powered." Of course, if you never power off your computer but just reset it (the power is never cut off) or if you shut it down and immediately power it up the content of the RAM can really survive for much longer.
- deleted 13y ago[deleted]
- reedalex01 13y agoThe original cold boot paper was released in 2008 and they only demonstrated the attack on DDR2 memory [1]. A paper published in 2013 [2] discussed cold boot on modern hardware. "This study is based on 5 different computer systems. While we demonstrate that simple warm reset attacks (not cutting power) are effective even against DDR3 systems, we were not able to detect any data remanence for DDR3 after cold boots. Even cooling the RAM chips did not reveal data remanence beyond cold boots. This leads us to the claim that cold boot attacks relying on RAM remanence beyond cold boots are not possible against modern DDR3 RAM chips." [1] https://www.usenix.org/legacy/event/sec08/tech/full_papers/halderman/halderman.pdf https://www.usenix.org/legacy/event/sec08/tech/full_papers/h... [2] http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldboot.pdf http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... (search for DDR3 to find the relevant sections)
- bch 13y ago> How do we now it isn’t some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it’s bad for the NSA, it’s safe to say it’s good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. It does not follow that either, or both, of these points (Open source, an NSA complaint slide) make this "snare proof". I'm not saying that it isn't, but there is no logic in the Wired article's assertions.
- slantview 13y agoYeah, safe and open source are not necessarily synonymous. (see openssl "heartbleed")
- gtirloni 13y agoAnd naturally, nobody knows exactly who created it. Shouldn't it be the opposite so we all know who we're relying on? It's the same question I'd throw at Bitcoin.
- joezydeco 13y agoI think users would prefer that covert government agencies not know where to find the authors, either to avoid undue influence or surreptitious hacking of their development machines to insert backdoors and other nefarious things. Plus, as TFA states, the code is all out there in the open and able to be reviewed. Does it matter who wrote it at that point?
- trustlook 13y agoThat reminds me the movie Captain America 2. Use such a USB based OS, enter an Apple store and find a macbook. Literally an untraceable hacking.
- slantview 13y agoA real inside look at it. /s