Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

motherboard.vice.com

Post reply on HN
Print view View original

41–50 of 81 posts

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#41

Post by daeken »

nacs wrote: post #37
ikeboy wrote: post #26

Earlier quoted context omitted.

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.

It'd be easy for anyone to patch memory at runtime to skip over that `if` check on the phone's ID (or at least easier than hacking the phone without the backdoor code). Once the backdoor/exploit is created and released, there's no securing it to where it will only be used on a single phone.

If you could trivially patch memory at runtime, they wouldn't need this firmware in the first place -- they'd just patch out the lock-on-fail code. If you assume that the chain of trust is compromised such that memory changes can be made, you own the device.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#42

Post by moyix »

nacs wrote: post #37
ikeboy wrote: post #26

Earlier quoted context omitted.

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.

It'd be easy for anyone to patch memory at runtime to skip over that `if` check on the phone's ID (or at least easier than hacking the phone without the backdoor code). Once the backdoor/exploit is created and released, there's no securing it to where it will only be used on a single phone.

Patching memory at runtime on an iPhone is not in any sense "easy". If it were the FBI wouldn't need Apple's help right now at all; they could just NOP out the code that implements the increasing timeout and erase-on-too-many-failures code.

To put it another way – if it were in fact easy to patch memory at runtime, there would be no need for the jailbreak community to spend huge amounts of time and effort every new OS release.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#43

Post by ebf6 »

sirsar wrote: post #38
ebf6 wrote: post #27

Earlier quoted context omitted.

If you analyze malware for a living, then the assembly is the source code. :) It's really not that much of an issue. It makes things more fun. I am curious about whether they developed the malware in-house or if they hired a contractor. Is there any information out there on this? I wouldn't be surprised if they cut out parts, which may hint at a particular contractor having developed the malware. Also, I still do not…

> Also, I still do not understand why TOR Browser Bundle allows scripts by default. The best diet is the one you can actually stick to. The best birth control is the one comfortable enough to use. The best anonymity software must be usable enough for Joe Average. If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and ran…

> If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and randomly change your physical location.

You are absolutely correct about practicing good opsec, however I have to challenge the usability argument. TOR is already less usable due to many sites blacklisting TOR exits nodes and latency (although connecting to a hidden service is a better idea, and avoids the blacklisting issue. And yet hidden services tend to avoid the JS requirement as well). If Joe Average is willing to put up with that in order to stay anonymous, I'm sure Joe would be willing to disable scripts.

On the other hand, if Joe doesn't understand why having scripts enabled is a security risk, then this might be a better reason to have scripts off by default, anyway.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#44

Post by moyix »

Unless this is different from the shellcode they used when taking down Freedom Hosting, I'm not sure what releasing it would do. There are already numerous analyses of the code:

- Vlad Tsyrklevich: http://tsyrklevich.net/tbb_payload.txt

- Gareth Owenson: http://owenson.me/fbi-tor-malware-analysis/

- My own analysis based on running it in PANDA: https://www.reddit.com/r/ReverseEngineering/comments/1jpln2/... (you can also get the recording of the shellcode executing and step through it here: http://www.rrshare.org/detail/26/ )

It's not big, and we have a pretty good idea what every piece of it does.

Of course, I suppose we don't know that the malware it used in this case is the same as the one in the Freedom Hosting case, so I guess it would be nice to compare and contrast them.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#45

Post by Floegipoky »

boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

If you're looking for consistency in the US legal system you're going to be sorely disappointed

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#46

Post by geofft »

ikeboy wrote: post #26
geofft wrote: post #24

Earlier quoted context omitted.

The code is only useful on the specific iPhone in question if it is in fact signed, and Apple does not have the technical capability to sign an update for a specific phone but not others; they all trust the same keys. And Apple would deliver it to the FBI with a signature, so there's a high risk that the signature wouldn't be redacted before being available to the public.

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.

You're right, that's a good point.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#47

Post by Floegipoky »

presidentender wrote: post #28
boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

The dissonance is accepted in this case because of the repulsive nature of the crimes, as determined by our current social consensus. Philosophical purity is very appealing, but ultimately the justifications we use for why the law is the way it is only have to stand up long enough to convince most interested parties that we're doing the right thing.

Stated another way, the law is being ignored because these particular criminal defendants' rights don't matter when they're inconvenient, based on the crime(s) they were accused of.

When the law is influenced by societal consensus the legal system becomes a farce.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#48

Post by inopinatus »

Floegipoky wrote: post #45
boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

If you're looking for consistency in the US legal system you're going to be sorely disappointed

Moreover, if you create a legal system with perfect consistency, you'd going to be astounded by how much injustice it produces.

The law is not a programming language.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#50

Post by bitwize »

boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

It's the FBI -- not just a law enforcement agency but a national security/counter terror agency. For such agencies the Constitution and the laws become vague and flexible. Under color of law, the FBI can essentially do anything they can present a plausible law-enforcement case for.

A few years ago we had a shitsplosion involving the BATF running illegal guns in order to "catch criminals", with the result that few if any criminals were caught and Mexican drug lords found themselves in possession of nifty new guns. AFAIR none of the major decision makers lost their jobs, let alone were prosecuted.

I wonder how much actual law enforcement purpose is behind these ops and how much of it is just a game of "let's see what we can get away with".

Post reply on HN