3 ms·

> An intelligence agency used FinFly ISP in the main national Internet Service Provider network. It was enough for the system to only know the target’s log-in i

by pwnna 12y ago

> An intelligence agency used FinFly ISP in the main national Internet Service Provider network. It was enough for the system to only know the target’s log-in information into the ISP network to be able to deploy a remote monitoring solution on his computer and monitor him from then onwards. Wow. See https://netzpolitik.org/wp-upload/FF_SolutionBrosch%C3%BCre_RZ_web.pdf https://netzpolitik.org/wp-upload/FF_SolutionBrosch%C3%BCre_... for FinISP.

DINKDINK 12y ago
Does this imply a designed back-door?
- superuser2 12y ago
  From Wikipedia: >FinFisher can be covertly installed on targets' computers by exploiting security lapses in the update procedures of non-suspect software Also, see: http://blogs.wsj.com/digits/2011/11/21/surveillance-company-says-it-sent-fake-itunes-flash-updates-documents-show/ http://blogs.wsj.com/digits/2011/11/21/surveillance-company-... So, apparently, no - just that most targets are running at least one application that downloads updates on an insecure channel. Because general-purpose OSes don't isolate applications from each other like, say, iOS, it would only take one neglected utility performing a software update over plain HTTP to be able to turn MITM into remote code execution with access to your entire computer. If you are an ISP, you can of course commit MITM of HTTP traffic on any of your customers trivially. The WSJ also shows a screenshot of a faked "download the latest version of flash player" screen, presumably on a non-HTTPs site. If your ISP is also a trusted CA (which I believe is not rare) they could also be MITMing HTTPs traffic as well. It would seem that if you and all of the software you run uses HTTPs all the time and if your OS enforces code-signing so that, i.e., only Apple can patch iTunes, you're pretty much immune. A VPN might provide some defense, but the ISP with which your VPN terminates could be ordered to perform/allow the same kind of MITM attack with the same result. Interestingly, this sort of attack featured heavily in the Girl with the Dragon Tattoo series, except that she and her friends (lacking control of ISPs) would actually go to people's houses while they were out and wire MITMing devices into their cable/DSL connections. Having administrator-level access to an ISP would obviate the need for field operations, hence the NSA's infamous "I hunt sysadmins."

by pwnna 12y ago

DINKDINK 12y ago

Does this imply a designed back-door?

superuser2 12y ago
From Wikipedia: >FinFisher can be covertly installed on targets' computers by exploiting security lapses in the update procedures of non-suspect software Also, see: http://blogs.wsj.com/digits/2011/11/21/surveillance-company-says-it-sent-fake-itunes-flash-updates-documents-show/ http://blogs.wsj.com/digits/2011/11/21/surveillance-company-... So, apparently, no - just that most targets are running at least one application that downloads updates on an insecure channel. Because general-purpose OSes don't isolate applications from each other like, say, iOS, it would only take one neglected utility performing a software update over plain HTTP to be able to turn MITM into remote code execution with access to your entire computer. If you are an ISP, you can of course commit MITM of HTTP traffic on any of your customers trivially. The WSJ also shows a screenshot of a faked "download the latest version of flash player" screen, presumably on a non-HTTPs site. If your ISP is also a trusted CA (which I believe is not rare) they could also be MITMing HTTPs traffic as well. It would seem that if you and all of the software you run uses HTTPs all the time and if your OS enforces code-signing so that, i.e., only Apple can patch iTunes, you're pretty much immune. A VPN might provide some defense, but the ISP with which your VPN terminates could be ordered to perform/allow the same kind of MITM attack with the same result. Interestingly, this sort of attack featured heavily in the Girl with the Dragon Tattoo series, except that she and her friends (lacking control of ISPs) would actually go to people's houses while they were out and wire MITMing devices into their cable/DSL connections. Having administrator-level access to an ISP would obviate the need for field operations, hence the NSA's infamous "I hunt sysadmins."