9 ms·

Some advice for the accused; not that I condone your actions(based on the article, you seem guilty) but if you get the devices back you should probably assumed

by smtddr 12y ago

Some advice for the accused; not that I condone your actions(based on the article, you seem guilty) but if you get the devices back you should probably assumed they've been compromised. You should just destroy them complelety. Or maybe investigate and document any tampering. But please don't login to any sensitive accounts on them. Don't decrypt the files on those devices either. Mount the filesystems and copy the files to a known trustworthy device.

pavel_lishin 12y ago
> Mount the filesystems and copy the files to a known trustworthy device. At this point, can we even be certain that that's safe? If the hard drives themselves have been compromised, what's to prevent them from copying out arbitrary data?
- c22 12y ago
  Perhaps nothing, but at that point you'll be able to tell if the data is arbitrary by attempting to decrypt it without having to entrust your keys to a potentially compromised device.
- bigiain 12y ago
  I guess it depends on value (to him) of retrieving the data and the sophistication of your adversary (and if his reported/alleged boasting on irc is to be believed, and collusion/cooperation between the UK's NCA and the US, you'd need to assume the most sophisticated of adversaries is a distinct possibility). It's too late to keep encrypted copies of the data out of his adversary's hands - they'll have imaged everything as their first step - so presumably he's either doing this because there's data there he wants, or he's just being a pain in the ass over a few hundred bucks (or pounds) worth of hardware (and more power to him if that's what's really gong on!). If _I_ needed data off those drives, I'd get a "burner" computer that's not connected to the internet or any sort of local network, plug the drives into that and decrypt them, then get those files off the machine in the least technical way possible - transcribe them by hand, take photos of the screen, print to a usb connected (burner) printer, if the data is too big for those sort of options (or binary blobs) I'd use a serial port connection to a second trusted machine. Then I'd melt down the drives and the burner machine. But mostly, I'd avoid becoming a target of the NSA's attention in the first place - if I were him I'd be suspicious of any hardware known or suspected by the NSA to be used by him ever. I'd assume supply chain exploitation of any new hardware with deeply embedded firmware/hardware layer exploits. I'd only ever use (for "private" purposes) 2nd hand hardware bought for cash from strangers... If you can get "targeted" for surveillance and exploitation just for occasionally using PGP and working at the wrong company (like the Gemalto guy from Thailand), how much scrutiny would you have to expect to live under if the US military thought you'd rooted their internal networks? Glad I'm not him...
  - bigiain 12y ago
    And, in a late update: http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/ I don't know if he's considered worth this much to "the authorities", but how'd you like _that_ done to your disks? (If I'm reading that right, by non network connected burner machine would _probably_ be safe against that, but it's clearly half decade old NSA tech. Assuming their capability hasn't improve beyond that is ... foolish...)
shit_parade 12y ago
>(based on the article, you seem guilty) what utter nonsense, is being charged with a crime the same as guilt now? The article makes a point of repeatedly using the word alleged and citing that all the claims are from the prosecutor. It is extremely pernicious of you to use such language.
- tedunangst 12y ago
  What utter nonsense. Is seeming guilty the same as guilt now? The comment makes a point of using the word seem and citing that all interpretation is based on the article.

by smtddr 12y ago

pavel_lishin 12y ago

> Mount the filesystems and copy the files to a known trustworthy device. At this point, can we even be certain that that's safe? If the hard drives themselves have been compromised, what's to prevent them from copying out arbitrary data?

c22 12y ago
Perhaps nothing, but at that point you'll be able to tell if the data is arbitrary by attempting to decrypt it without having to entrust your keys to a potentially compromised device.
bigiain 12y ago
I guess it depends on value (to him) of retrieving the data and the sophistication of your adversary (and if his reported/alleged boasting on irc is to be believed, and collusion/cooperation between the UK's NCA and the US, you'd need to assume the most sophisticated of adversaries is a distinct possibility). It's too late to keep encrypted copies of the data out of his adversary's hands - they'll have imaged everything as their first step - so presumably he's either doing this because there's data there he wants, or he's just being a pain in the ass over a few hundred bucks (or pounds) worth of hardware (and more power to him if that's what's really gong on!). If _I_ needed data off those drives, I'd get a "burner" computer that's not connected to the internet or any sort of local network, plug the drives into that and decrypt them, then get those files off the machine in the least technical way possible - transcribe them by hand, take photos of the screen, print to a usb connected (burner) printer, if the data is too big for those sort of options (or binary blobs) I'd use a serial port connection to a second trusted machine. Then I'd melt down the drives and the burner machine. But mostly, I'd avoid becoming a target of the NSA's attention in the first place - if I were him I'd be suspicious of any hardware known or suspected by the NSA to be used by him ever. I'd assume supply chain exploitation of any new hardware with deeply embedded firmware/hardware layer exploits. I'd only ever use (for "private" purposes) 2nd hand hardware bought for cash from strangers... If you can get "targeted" for surveillance and exploitation just for occasionally using PGP and working at the wrong company (like the Gemalto guy from Thailand), how much scrutiny would you have to expect to live under if the US military thought you'd rooted their internal networks? Glad I'm not him...
- bigiain 12y ago
  And, in a late update: http://www.wired.com/2015/02/nsa-firmware-hacking/ http://www.wired.com/2015/02/nsa-firmware-hacking/ I don't know if he's considered worth this much to "the authorities", but how'd you like _that_ done to your disks? (If I'm reading that right, by non network connected burner machine would _probably_ be safe against that, but it's clearly half decade old NSA tech. Assuming their capability hasn't improve beyond that is ... foolish...)

shit_parade 12y ago

>(based on the article, you seem guilty) what utter nonsense, is being charged with a crime the same as guilt now? The article makes a point of repeatedly using the word alleged and citing that all the claims are from the prosecutor. It is extremely pernicious of you to use such language.

tedunangst 12y ago
What utter nonsense. Is seeming guilty the same as guilt now? The comment makes a point of using the word seem and citing that all interpretation is based on the article.