Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

motherboard.vice.com

Post reply on HN
Print view View original

51–60 of 81 posts

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#51

Post by ikeboy »

geofft wrote: post #46
ikeboy wrote: post #26

Earlier quoted context omitted.

But the version signed could check the id of the phone and shut down if not a hard coded id. Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.

You're right, that's a good point.

Also, Apple does have the ability to prevent signed updates from being installed on phones they don't want it to be. Every update must be signed by Apple specifically to the phone that's being updated, and this includes a nonce to prevent replay attacks. (I forgot about this in my reply above).

See https://en.wikipedia.org/wiki/SHSH_blob, https://www.theiphonewiki.com/wiki/SHSH, http://www.saurik.com/id/12

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#52

Post by waterhouse »

chatmasta wrote: post #31
singletonaccnt wrote: post #3

So the headline uses the word "pedophiles", but in the article the word is nowhere to be found. Maybe that's because this sting isn't necessarily about pedophiles, but about people watching and trading child pornography. Using "pedophiles" only serves to reinforce the stigma of a already heavily stigmatized minority. The word "pedophile" should be defined as someone with a sexual attraction towards children. It doesn…

If nobody visited the hidden service, the operator would have no reason to keep it running. Watching child porn fuels its demand, and therefore encourages its distribution.

Are the viewers paying the operator? If not, I'm not sure you can really argue they're legally responsible for "encouraging" the operator. The operator could say, "I'm going to make another child abuse video for every million people that vote for Hillary Clinton", and no one would blame voters for "encouraging" him. Even if the operator has ads on the site, I don't think it's reasonable to call the viewers culpable--their financial contribution is unintentional, miniscule, and possibly negative if they used an ad-blocker.

For all we know, the "operator" was just showing a dump of things he found on an abandoned site five years ago, and was not involved at all in the production, and had no intention to be. Or perhaps he applied the principles of the MPAA and pirated for free as much material as he could, and put it on his website for free so as to try to get viewers to stop paying the producers and supporting their crimes.

(Which, by the way, is a strategy I would recommend law-enforcement pursue if they take their own arguments seriously. Spend federal money on servers hosting free, searchable torrents and direct downloads of CP; perhaps restrict it to material produced at least 20 years ago, and strip out or change any identifying metadata, so as to avoid any semblance of supporting or encouraging the producers of the materials.)

If you want to make the case that the viewers are liable for supporting the production of child abuse materials, that's a specific claim that you would have to prove in any individual case. By no means is it to be assumed.

What you mentioned was "encouraging its distribution", not "its production". Still, I can't imagine why the former would be rationally considered criminal except insofar as it contributes to the latter (notwithstanding rhetoric about "re-victimizing our children every time it is passed from one person to another"--which is completely absurd unless the viewers encounter the victims in real life and mistreat them in a way they wouldn't have if they didn't see the video, which seems outlandish--I doubt if it's even possible to track down the real-life identities of the victims most of the time).

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#53

Post by ericcumbee »

geofft wrote: post #24
ikeboy wrote: post #10

Earlier quoted context omitted.

The code being released wouldn't matter, because it can't be installed anywhere without Apple signing it. Presumably the keys wouldn't need to be released in any such order.

The code is only useful on the specific iPhone in question if it is in fact signed, and Apple does not have the technical capability to sign an update for a specific phone but not others; they all trust the same keys. And Apple would deliver it to the FBI with a signature, so there's a high risk that the signature wouldn't be redacted before being available to the public.

Are you sure that is the case? Or is that the Case for Iphone 5C and earlier? I remember listening to the Security now episode where they discuss the IOS Security model and it worked something like. 1)Apple Sends A notification that an update is available. 2) the Phone sends a request with certain identifiers for the update. 3) Witchcraft happens 4) Apple sends a update signed specifically for that device and it will work on no other device.

Like I said that might be for 5c and older or I might have completely invented that.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#54

Post by ikeboy »

ericcumbee wrote: post #53
geofft wrote: post #24

Earlier quoted context omitted.

The code is only useful on the specific iPhone in question if it is in fact signed, and Apple does not have the technical capability to sign an update for a specific phone but not others; they all trust the same keys. And Apple would deliver it to the FBI with a signature, so there's a high risk that the signature wouldn't be redacted before being available to the public.

Are you sure that is the case? Or is that the Case for Iphone 5C and earlier? I remember listening to the Security now episode where they discuss the IOS Security model and it worked something like. 1)Apple Sends A notification that an update is available. 2) the Phone sends a request with certain identifiers for the update. 3) Witchcraft happens 4) Apple sends a update signed specifically for that device and it will…

3GS and later introduced SHSH blobs. See sources I linked to in https://news.ycombinator.com/item?id=11141965

Every update is signed specifically to the device being updated.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#55

Post by vox_mollis »

inopinatus wrote: post #48
Floegipoky wrote: post #45

Earlier quoted context omitted.

If you're looking for consistency in the US legal system you're going to be sorely disappointed

Moreover, if you create a legal system with perfect consistency, you'd going to be astounded by how much injustice it produces. The law is not a programming language.

One noteworthy bastardization of modern justice is that our right to trial by a jury of our peers has long been infringed.

We are supposed to be judged by people of our approximate age, origin, location, background, etc, to allow for a greater understanding of context.

Random jury selection is an abomination.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#56

Post by shkkmo »

Floegipoky wrote: post #47
presidentender wrote: post #28

Earlier quoted context omitted.

The dissonance is accepted in this case because of the repulsive nature of the crimes, as determined by our current social consensus. Philosophical purity is very appealing, but ultimately the justifications we use for why the law is the way it is only have to stand up long enough to convince most interested parties that we're doing the right thing.

Stated another way, the law is being ignored because these particular criminal defendants' rights don't matter when they're inconvenient, based on the crime(s) they were accused of. When the law is influenced by societal consensus the legal system becomes a farce.

Well, in this example the rights that are being ignored are not those of the defendants, but those of their victims to not be further victimized.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#57

Post by 21 »

boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

Viewing the image also creates a market for it, since you'll get bored of it and will want another one, even if you'll not pay for it.

The same way downloading pirated material creates a market for it, even if you download it for free and the providers don't get money from it (but are rewarded with scene creds)

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#58

Post by mtgx »

boosting6889 wrote: post #19

The Justice Department contends that the act of viewing a child porn image revictimizes the child each time the view occurs and is the basis for arguing that viewing child porn is not a victimless crime. Yet the FBI seized a server and allows such images to be downloaded and viewed thousands of times over a 2 week period. This would be like seizing the operators of an underground rape dungeon where patrons pay to rap…

It's kind of like how the CIA produces, sells, and profits from drugs so it can "catch the really bad guys".

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#59

Post by 21 »

ebf6 wrote: post #43
sirsar wrote: post #38

Earlier quoted context omitted.

> Also, I still do not understand why TOR Browser Bundle allows scripts by default. The best diet is the one you can actually stick to. The best birth control is the one comfortable enough to use. The best anonymity software must be usable enough for Joe Average. If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and ran…

> If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and randomly change your physical location. You are absolutely correct about practicing good opsec, however I have to challenge the usability argument. TOR is already less usable due to many sites blacklisting TOR exits nodes and latency (although connecting to a hidde…

Average Joe probably worries about Average Hacker/Average Stalker

If he's up against the government, he's going down.

Re: Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers

#60

Post by 21 »

waterhouse wrote: post #52
chatmasta wrote: post #31

Earlier quoted context omitted.

If nobody visited the hidden service, the operator would have no reason to keep it running. Watching child porn fuels its demand, and therefore encourages its distribution.

Are the viewers paying the operator? If not, I'm not sure you can really argue they're legally responsible for "encouraging" the operator. The operator could say, "I'm going to make another child abuse video for every million people that vote for Hillary Clinton", and no one would blame voters for "encouraging" him. Even if the operator has ads on the site, I don't think it's reasonable to call the viewers culpable--…

Not everybody is motivated by money. Some people enjoy being rewarded with karma/lulz/creds/likes.

Is someone legally responsible for "liking" a child porn/terror/homeless beating video? Currently you are for the first case, sometime for the second.

Should "liking" or viewing criminal content be a crime? That's a tough question. It certainly encourages the production of such content (for money or karma).

Post reply on HN