Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

bleepingcomputer.com

Post reply on HN
Print view View original

101–110 of 284 posts

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#101

Post by dopamean »

stinkytaco wrote: post #77
cabaalis wrote: post #46

Earlier quoted context omitted.

So much for that whole constitution thing anyway.. They can just create some "act" that overrides it! And nobody will complain because the person affected is the bad guy, until they come for them.

But they are not asking him to testify, admit guilt, or anything like that. They aren't even asking him to tell them the password, just to enter the password to decrypt. This is more like expecting access to your house when a search warrant is provided. EDIT: To be clear, it's not that I feel he should necessarily be compelled, but rather that a fifth amendment defense is weak in this case, since it's not a testimony…

This may be a dumb question but I want to make sure I'm getting everything here... they have a warrant to search the hard drive?

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#102

Post by wyager »

weinzierl wrote: post #48
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

> If the disk is encrypted how can they match file hashes? This is an attack, which contemporary block based FDE doesn't really protect you well from. Bitlocker, FileFault, TrueCrypt, VeraCrypt basically operate on one disk block at at time and this means they cannot hide data patterns well. Or as Thomas Ptacek put it in his article "You Don't Want XTS" [1] >It’s ECB-like. It can’t do a perfect job of providing priva…

This is 100% wrong. XTS-mode AES absolutely protects you from known-plaintext attacks like the investigators apparently claim to have pulled off. I suspect we don't have the full description.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#104

Post by kakarot »

shpx wrote: post #83
kakarot wrote: post #57

Earlier quoted context omitted.

I wonder if the same kind of error-tolerant fingerprinting used in technology like Shazam (recognizing songs from ambient recordings) could be generalized to combat such a doping program. You might have to do more than change a few pixels here and a unicode character or meta tag there. I even suspect things like color grading and, say, something like batching multiple images or text files together into one file, coul…

https://en.wikipedia.org/wiki/PhotoDNA They usually aren't using SHA (maybe they are in this specific case).

Oh cool, I'd heard of PhotoDNA but I didn't know the details behind it. Thanks!

"It works by converting the image to black and white, re-sizing it, breaking it into a grid, and looking at intensity gradients or edges."

Pretty cool piece of technology. Seems like it covers the obvious bases. I imagine it also ignores meta tags as part of the hashing process, and operates directly on the pixel information.

Perhaps one way to circumvent detection without making perceptual modifications (which would have to be somewhat significant to thwart the above method) could be a program that losslessly converts all of your images' pixel data to a generated file type only understandable by a program with a specific key in memory, which either directly displays the image or creates temporary files that could be used by a regular image viewer? The files could possibly be signed by more than one party for extra protection. I know it sounds just like encryption but I'm thinking of something a little different. Sort of a singular encrypted file that can be securely transferred to any file system.

Sounds like a fun and challenging project but I'd hate for it to be so successful that it leads to child pornographers getting off the hook.

"In December 2016, Facebook, Twitter, Google and Microsoft announced plans to use PhotoDNA to tackle extremist content such as terrorist recruitment videos or violent terrorist imagery."

Dear lord, that is a stupendously slippery slope.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#105

Post by keehun »

campuscodi wrote: post #97
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Article was updated with the following link to sustain the source of the information: https://arstechnica.com/wp-content/uploads/2017/03/rawlsopin...

Great source. Here's the relevant bits:

  Agents  from  the  Department  of  Homeland  Security then  applied
  for  a  federal  search  warrant  to  examine  the seized  devices.
  Doe  voluntarily  provided  the  password  for the Apple iPhone 5S,
  but refused to provide the passwords  to  decrypt  the  Apple  Mac  Pro
  computer  or  the external  hard  drives.  Despite  Doe’s  refusal,
  forensic  analysts  discovered  the password to decrypt the Mac Pro
  Computer, but could not decrypt the external hard drives.
  Forensic examination of the
  Mac  Pro  revealed  an  image  of  a  pubescent  girl  in  a  sexually
  provocative  position  and  logs  showing  that  the  Mac  Pro  had
  been   used   to   visit   sites   with   titles   common   in   child
  exploitation, such as "toddler_cp," "lolicam," "tor-childporn," and  “pthc.”
  The  Forensic  examination  also disclosed that Doe had downloaded thousands
  of files known by  their  “hash” values  to  be  child  pornography.
  The  files, however,  were  not  on  the  Mac  Pro,  but  instead  had  been
  stored  on  the  encrypted  external  hard  drives. Accordingly,
  the files themselves could not be accessed.
So it looks like they got the hashes from logs/forensic evidence collected from an decrypted Mac Pro.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#106

Post by wyager »

geofft wrote: post #26
xtanx wrote: post #11

"Investigators said content stored on the encrypted hard drive matched file hashes for known child pornography content." If the disk is encrypted how can they match file hashes? Do they encrypt known CP files with the FileVault key and then compare? If so, isn't that enough to convict him?

Some Googling finds http://caselaw.findlaw.com/us-3rd-circuit/1853477.html , which says there's both an internal hard disk and an external hard disk, and the external one is the one at issue: > The Forensic examination also disclosed that Doe had downloaded thousands of files known by their “hash” values to be child pornography.[3] The files, however, were not on the Mac Pro, but instead had been stored on the encryp…

Ding ding ding. This is the answer. I know OS X also stores hashes of at least some downloads for the purpose of checking certificates on downloaded apps and disk images.

This is clearly enough evidence to convict the guy, so I imagine they're holding him for some political reason (like generating jurisprudence for violating the 5th amendment in the future).

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#107

Post by LanceH »

jo909 wrote: post #62
geofft wrote: post #40

Earlier quoted context omitted.

> "The fact remains that the government has not brought charges," Donoghue said in a telephone interview. "Our client has now been in custody for almost 18 months based on his assertion of his Fifth Amendment right against compelled self-incrimination." To be clear (and I am pretty sure the public defender knows this, but is just phrasing it like this for public perception), the prosecution's position is that the Fif…

My analogy would be that 1. There is an unbreakable safe 2. The judge believes he has the key to the unbreakable safe 3. They know there is evidence inside the safe 4. They ask him to unlock the safe 5. He refuses to do so, so they try to force him by jailing him They do not ask him to testify about the safes contents or even to hand over the key, just to "insert and turn the key". And their argument is that he can n…

>> 3. They know there is evidence inside the safe

"know" implies a fact. The determination of fact is up to the jury.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#108

Post by Xorlev »

wyager wrote: post #99
Neverbolt wrote: post #32

Earlier quoted context omitted.

There are several misconceptions in this comment, first and foremost that SHA is encryption, which it is not. It is a hashing algorithm, not unlike MD5, though "stronger". Secondly, when you have two files that are exactly the same and encrypt both with the same key, method and parameters then both will have the same hash. ( Though I could imagine Apple doing stuff with padding, and other parameters to make this not…

All modern encryption schemes inject randomness into the encryption process (via an initialization vector) so no, there is no way to check if two encrypted files are the same file. The investigators' claim doesn't make sense.

This. The padding changes as well. You have to work hard to produce the same ciphertext from a given plaintext.

The claim is bogus.

Re: Man Who Refused to Decrypt Hard Drives Still in Prison After Two Years

#109

Post by threatofrain »

jancsika wrote: post #29

There's a better article in Ars: https://arstechnica.com/tech-policy/2017/03/man-jailed-indef... From that article: > The court also noted that the authorities "found [on the Mac Book Pro] one image depicting a pubescent girl in a sexually suggestive position and logs that suggested the user had visited groups with titles common in child exploitation." They also said the man's sister had "reported" that her brother s…

If there is such overwhelming evidence that it's a foregone conclusion, then I wonder why they haven't charged and convicted the man already. Why do they need any cooperation at all?
Post reply on HN