10 ms·

First takeaway from here [1] and the other docs: 1 - don't allow physical access to your machine. If you are worried about nation state actors, consider filli

by x0x0 12y ago

First takeaway from here [1] and the other docs: 1 - don't allow physical access to your machine. If you are worried about nation state actors, consider filling firewire and usb slots with super glue. 2 - don't use skype [1] https://netzpolitik.org/wp-upload/FinSpyPC.4.51.ReleaseNotes.pdf https://netzpolitik.org/wp-upload/FinSpyPC.4.51.ReleaseNotes...

wlesieutre 12y ago
Or if you do use Skype, use the Metro version, which finfisher allegedly can't eavesdrop on. Original source was on Dropbox and is overloaded, but here's a link on Slashdot: http://beta.slashdot.org/story/205507 http://beta.slashdot.org/story/205507
- wslh 12y ago
  They didn't do their homework in this case. Companies like Ranorex (and also my company) accesses Windows Metro controls. For the first step, you can read "Injecting a DLL in a Modern UI Metro Application" [1] [1] http://blog.nektra.com/main/2013/02/25/injecting-a-dll-in-modernui-metro-app-win8/ http://blog.nektra.com/main/2013/02/25/injecting-a-dll-in-mo...
- sbierwagen 12y ago
  Or if you do use Skype, use the Metro version, which finfisher allegedly can't eavesdrop on. What? Bullshit. Why would Microsoft remove the law enforcement backdoors in the Metro version?
  - wlesieutre 12y ago
    I haven't seen any indication that FinFisher is using deliberate backdoors from MS; from the article it sounds like it's just installing your typical spyware via exploits in things like PDF and XLS files. But as wslh points out, the assertion that metro's sandbox makes things more secure isn't accurate. I can't get to the dropbox page either, so I'm not sure whether it's saying "FinFisher isn't able to eavesdrop on metro for technical reasons" or "FinFisher can't eavesdrop on metro because they haven't implemented that yet." Either way, isn't this a separate issue from any surveillance access Microsoft is providing? One is local spyware grabbing your communications on your computer, and the other Microsoft grabbing the data as it goes through the Skype servers. I know Microsoft has that capability for text chats [1], and I assume it's the same deal for audio streams. Making the Skype client less vulnerable is no more closing law enforcement access than if Apple they fixed a vulnerability in Mail.app while continuing to hand out your iCloud emails to law enforcement agencies. [1] http://arstechnica.com/security/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/ http://arstechnica.com/security/2013/05/think-your-skype-mes...
    - sbierwagen 12y ago
      Which is mostly the point, I guess. If the feds want to listen in on your calls they have several options: 1.) Use a 0day exploit in Skype client software. 2.) Use the LE backdoors on the local machine. 3.) Install a rooted version of Skype using some other Windows 0day or LE backdoor. 4.) Just record any sound the microphone hears. 5.) Capture traffic as it travels across the backbone. 6.) Capture traffic as it travels through Microsoft's central servers. 7.) Capture traffic at the other end if the callee is using an old version of Skype. Saying "the feds can't spy on you if you use Metro Skype" is in one narrow sense true, and in a wider sense outrageously, mendaciously false. If they can't do #1, they'll do #2-7.
      - wlesieutre 12y ago
        The noise I've heard about FinFisher has been less about its use in Western countries, and more about Gamma selling it to oppressive regimes that use it against protestors. If your goal is to keep your calls away from Egypt's State Security Investigations Service, by all means use metro Skype. If you're trying to hide from a country with law enforcement access to Skype's backend, then don't. But I don't see what the latter has to do with FinFisher. As far as recording things from the mic outside of Skype, if FinFisher does that you're probably toast regardless. I haven't dug into the technical details, but I've seen it mentioned that it can deliver arbitrary payloads. Someone who reads through the doc dump will hopefully be able to confirm what exactly they've been doing with it.
        x0x0 12y ago
        Yeah, most of this finfisher stuff appears to be for surveillance states (plus assholes like nsa), not real law enforcement. Real cops / fbi can get a warrant and go straight to microsoft who appears to have very good skype capture ability. Why would you screw around with all this nonsense when all it takes is a couple hours of a DAs time to draft a warrant, a trip to see a judge (assuming you have a reasonable cause), then a fax to microsoft? Unless of course the reasonable cause thing is tripping you up... ps -- that's not to say our governments aren't well aware of what FinFisher is doing. I bet the fastest way to seriously piss nsa/various pigs off is to sell an exploit before sharing it with the US/5 eyes. I mean, they don't "know know", but they know, the same way we know damn well what goes on in extraordinary rendition, though we all run around pretending to be shocked, shocked! that there's torture in egyptian prisons...
- higherpurpose 12y ago
  Or just don't use Skype. You have more to fear about Skype than just FinFisher hacking you.
jason_slack 12y ago
What? Did you really say fill your firwire and usb ports with super glue?
- fabulist 12y ago
  https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack Edited to add; This is heresay, but my friend just told me that this is the first thing techs do when they set up a computer at Los Alamos National Lab. (He knows some people who were contractors there.)
  - josu 12y ago
    How do you plug in the mouse and keyboard?
    - fabulist 12y ago
      The idea is hardening; disallow anything extraneous to your purpose which may negatively impact your security. So, get a computer with built-in peripherals (a laptop), or only leave the ports unglued which you intend to use. An old-fashioned keyboard and mouse port serves only one function; connecting a keyboard or a mouse. A USB port is general purpose. Since the latter is much more complex, we can expect its drivers to contain lot more vulnerabilities. If you expose your keyboard and mouse ports, and your USB ports, you're vulnerable to all of the flaws in both. If you only expose your keyboard and mouse, you're better off. Its worth noting that none of this matters if you don't use full-disk encryption. They can mount your hard drive and add a user with root privileges to /etc/shadow and /etc/passwd in a matter of minutes if your drives are stored in clear text.
      - josu 12y ago
        I see. Thanks.
      - e12e 12y ago
        > Its worth noting that none of this matters if you don't use full-disk encryption. And just to be clear, one of the fun things with firewire exploits, is that it easily defeats fde -- it allows an attacker to dump the ram, and extract the encryption keys from ram (as the keys need to be in ram for the os to access the disks...). So you could perhaps mirror the drives at night, when no-one is around, and dump the keys you need to use that dump during lunch break, when the machine is on, but unattended... You might argue that they could just blow some co2 on your ram sticks, and dump the keys from there (if they could already access your hds...) -- and you'd be right -- but firewire is a lot less intrusive...
fabulist 12y ago
3 - Don't use Windows. Remember this gem? https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Filling ports with glue is a pretty good idea. Clipping the leads might be necessary though; I'm not sure how well the glue will stick to metal. Edit; I'm told that the government uses hot glue. Another good suggestion that was in the news recently is to use nail polish to make your laptop tamper-evident. http://www.wired.com/2013/12/better-data-security-nail-polish/ http://www.wired.com/2013/12/better-data-security-nail-polis...
- allegory 12y ago
  They do indeed use hot glue and bolt the computers into cages. Then they buy monitors with built in USB hubs for keyboard and mouse and plug them in. To circumvent, remove mouse inert USB stick. No kidding. This was a tier 1 defense company and I was DV cleared.
  - fabulist 12y ago
    Ouch. I was thinking, "What if you unplugged the monitor cable...?" but thats even worse. Still, when I was going to go on a tour of LANL (I decided it wasn't worth divulging my SSN, in case it was misplaced), they made it very clear that cell phones, USBs, etc. were not allowed; I'm not sure if I would have actually been searched, however. (Not that I was remotely tempted to push it.) That was a long time ago. Today you can get such tiny devices that theres no way they could find them. Perhaps you could modify the firmware on something like this, and swallow it; http://laughingsquid.com/wp-content/uploads/269902-sandisk-cruzer-fit.jpg http://laughingsquid.com/wp-content/uploads/269902-sandisk-c...
    - allegory 12y ago
      Definitely. I use one of those USB sticks in my car radio so it doesn't stick out. It is tiny. I was searched going in and out but you could easily stick one up your bum like a drug mule!
- wmt 12y ago
  So what OS should you use? I imagine Linux and OSX are also out of the question as they are also supported by the FinFisher.

by x0x0 12y ago

wlesieutre 12y ago

Or if you do use Skype, use the Metro version, which finfisher allegedly can't eavesdrop on. Original source was on Dropbox and is overloaded, but here's a link on Slashdot: http://beta.slashdot.org/story/205507 http://beta.slashdot.org/story/205507

wslh 12y ago
They didn't do their homework in this case. Companies like Ranorex (and also my company) accesses Windows Metro controls. For the first step, you can read "Injecting a DLL in a Modern UI Metro Application" [1] [1] http://blog.nektra.com/main/2013/02/25/injecting-a-dll-in-modernui-metro-app-win8/ http://blog.nektra.com/main/2013/02/25/injecting-a-dll-in-mo...
sbierwagen 12y ago
Or if you do use Skype, use the Metro version, which finfisher allegedly can't eavesdrop on. What? Bullshit. Why would Microsoft remove the law enforcement backdoors in the Metro version?
- wlesieutre 12y ago
  I haven't seen any indication that FinFisher is using deliberate backdoors from MS; from the article it sounds like it's just installing your typical spyware via exploits in things like PDF and XLS files. But as wslh points out, the assertion that metro's sandbox makes things more secure isn't accurate. I can't get to the dropbox page either, so I'm not sure whether it's saying "FinFisher isn't able to eavesdrop on metro for technical reasons" or "FinFisher can't eavesdrop on metro because they haven't implemented that yet." Either way, isn't this a separate issue from any surveillance access Microsoft is providing? One is local spyware grabbing your communications on your computer, and the other Microsoft grabbing the data as it goes through the Skype servers. I know Microsoft has that capability for text chats [1], and I assume it's the same deal for audio streams. Making the Skype client less vulnerable is no more closing law enforcement access than if Apple they fixed a vulnerability in Mail.app while continuing to hand out your iCloud emails to law enforcement agencies. [1] http://arstechnica.com/security/2013/05/think-your-skype-messages-get-end-to-end-encryption-think-again/ http://arstechnica.com/security/2013/05/think-your-skype-mes...
  - sbierwagen 12y ago
    Which is mostly the point, I guess. If the feds want to listen in on your calls they have several options: 1.) Use a 0day exploit in Skype client software. 2.) Use the LE backdoors on the local machine. 3.) Install a rooted version of Skype using some other Windows 0day or LE backdoor. 4.) Just record any sound the microphone hears. 5.) Capture traffic as it travels across the backbone. 6.) Capture traffic as it travels through Microsoft's central servers. 7.) Capture traffic at the other end if the callee is using an old version of Skype. Saying "the feds can't spy on you if you use Metro Skype" is in one narrow sense true, and in a wider sense outrageously, mendaciously false. If they can't do #1, they'll do #2-7.
    - wlesieutre 12y ago
      The noise I've heard about FinFisher has been less about its use in Western countries, and more about Gamma selling it to oppressive regimes that use it against protestors. If your goal is to keep your calls away from Egypt's State Security Investigations Service, by all means use metro Skype. If you're trying to hide from a country with law enforcement access to Skype's backend, then don't. But I don't see what the latter has to do with FinFisher. As far as recording things from the mic outside of Skype, if FinFisher does that you're probably toast regardless. I haven't dug into the technical details, but I've seen it mentioned that it can deliver arbitrary payloads. Someone who reads through the doc dump will hopefully be able to confirm what exactly they've been doing with it.
      - x0x0 12y ago
        Yeah, most of this finfisher stuff appears to be for surveillance states (plus assholes like nsa), not real law enforcement. Real cops / fbi can get a warrant and go straight to microsoft who appears to have very good skype capture ability. Why would you screw around with all this nonsense when all it takes is a couple hours of a DAs time to draft a warrant, a trip to see a judge (assuming you have a reasonable cause), then a fax to microsoft? Unless of course the reasonable cause thing is tripping you up... ps -- that's not to say our governments aren't well aware of what FinFisher is doing. I bet the fastest way to seriously piss nsa/various pigs off is to sell an exploit before sharing it with the US/5 eyes. I mean, they don't "know know", but they know, the same way we know damn well what goes on in extraordinary rendition, though we all run around pretending to be shocked, shocked! that there's torture in egyptian prisons...
higherpurpose 12y ago
Or just don't use Skype. You have more to fear about Skype than just FinFisher hacking you.

jason_slack 12y ago

What? Did you really say fill your firwire and usb ports with super glue?

fabulist 12y ago
https://en.wikipedia.org/wiki/DMA_attack https://en.wikipedia.org/wiki/DMA_attack Edited to add; This is heresay, but my friend just told me that this is the first thing techs do when they set up a computer at Los Alamos National Lab. (He knows some people who were contractors there.)
- josu 12y ago
  How do you plug in the mouse and keyboard?
  - fabulist 12y ago
    The idea is hardening; disallow anything extraneous to your purpose which may negatively impact your security. So, get a computer with built-in peripherals (a laptop), or only leave the ports unglued which you intend to use. An old-fashioned keyboard and mouse port serves only one function; connecting a keyboard or a mouse. A USB port is general purpose. Since the latter is much more complex, we can expect its drivers to contain lot more vulnerabilities. If you expose your keyboard and mouse ports, and your USB ports, you're vulnerable to all of the flaws in both. If you only expose your keyboard and mouse, you're better off. Its worth noting that none of this matters if you don't use full-disk encryption. They can mount your hard drive and add a user with root privileges to /etc/shadow and /etc/passwd in a matter of minutes if your drives are stored in clear text.
    - josu 12y ago
      I see. Thanks.
    - e12e 12y ago
      > Its worth noting that none of this matters if you don't use full-disk encryption. And just to be clear, one of the fun things with firewire exploits, is that it easily defeats fde -- it allows an attacker to dump the ram, and extract the encryption keys from ram (as the keys need to be in ram for the os to access the disks...). So you could perhaps mirror the drives at night, when no-one is around, and dump the keys you need to use that dump during lunch break, when the machine is on, but unattended... You might argue that they could just blow some co2 on your ram sticks, and dump the keys from there (if they could already access your hds...) -- and you'd be right -- but firewire is a lot less intrusive...

fabulist 12y ago

3 - Don't use Windows. Remember this gem? https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY Filling ports with glue is a pretty good idea. Clipping the leads might be necessary though; I'm not sure how well the glue will stick to metal. Edit; I'm told that the government uses hot glue. Another good suggestion that was in the news recently is to use nail polish to make your laptop tamper-evident. http://www.wired.com/2013/12/better-data-security-nail-polish/ http://www.wired.com/2013/12/better-data-security-nail-polis...

allegory 12y ago
They do indeed use hot glue and bolt the computers into cages. Then they buy monitors with built in USB hubs for keyboard and mouse and plug them in. To circumvent, remove mouse inert USB stick. No kidding. This was a tier 1 defense company and I was DV cleared.
- fabulist 12y ago
  Ouch. I was thinking, "What if you unplugged the monitor cable...?" but thats even worse. Still, when I was going to go on a tour of LANL (I decided it wasn't worth divulging my SSN, in case it was misplaced), they made it very clear that cell phones, USBs, etc. were not allowed; I'm not sure if I would have actually been searched, however. (Not that I was remotely tempted to push it.) That was a long time ago. Today you can get such tiny devices that theres no way they could find them. Perhaps you could modify the firmware on something like this, and swallow it; http://laughingsquid.com/wp-content/uploads/269902-sandisk-cruzer-fit.jpg http://laughingsquid.com/wp-content/uploads/269902-sandisk-c...
  - allegory 12y ago
    Definitely. I use one of those USB sticks in my car radio so it doesn't stick out. It is tiny. I was searched going in and out but you could easily stick one up your bum like a drug mule!
wmt 12y ago
So what OS should you use? I imagine Linux and OSX are also out of the question as they are also supported by the FinFisher.