Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Every message was copied to the police’

theguardian.com

Post reply on HN
Print view View original

91–100 of 193 posts

Re: ‘Every message was copied to the police’

#91

Post by kube-system »

dredmorbius wrote: post #79
kube-system wrote: post #73

Earlier quoted context omitted.

I've never heard of a business being scammed by a vendor through ransomware. When businesses choose vendors, they do it with legal contracts enforceable in their jurisdictions.

Vendor-based scams are not the entirety of the threat model.

Vendor-based scams are what this thread and this article is about. The root quoted that An0m was a 'trick' that couldn't be repeated again. My point is that legitimate businesses would have never had to worry about such tricks, being scammed by a vendor like this is a problem unique to illegal businesses.

Re: ‘Every message was copied to the police’

#92

Post by vkou »

VLM wrote: post #45
GuB-42 wrote: post #39

Earlier quoted context omitted.

One time pads are really inconvenient and hard to get right. That's why they are almost never used in practice, despite being theoretically perfect. First, you need to generate large amounts of unbiased, true random data. If it is not true randomness, you have a stream cypher, and if you "rolled your own", probably not a good one. They you have to store the one-time pad. It is usually too big to memorize. You have to…

IF you want to send arbitrary data. Usually people don't need that. For something like coke smuggling you just need to know its on the way, get ready. So the OTP could be something as lame as "if you get a phone call from some rando who says 'Taste the Feeling'" then the next boat is full of coke, or if not, then the next boat is not full of coke". Actually terrible idea as taste the feeling was a coke company slogan…

Most criminal activity involves communicating arbitrary data. Communicating that a drug boat is coming across a border is a tiny fraction of the communication in a criminal organization. In the scenario you described, planning out the communication protocol itself is an example of communicating arbitrary data... That needs to happen, at every physical hand-off point.

Re: ‘Every message was copied to the police’

#93

Post by dredmorbius »

monocasa wrote: post #57
VLM wrote: post #50

Earlier quoted context omitted.

People are too free with their phones. Just walk into a bar and say you're too drunk to drive and could the bartender call my wife to pick me up? Not knowing its actually picking up $60M worth of coke instead of picking up me. Or pull off to the side of the road, walk in well dressed, wave a dead iphone in front of them, ask the receptionist "hey my car broke down and my battery is dead, could you call this number an…

That's a function of there not being penalties. You'd see that change if the laws changed.

Penalties for what exactly, here?

Good Samaritanism?

Re: ‘Every message was copied to the police’

#94

Post by clipradiowallet »

unnouinceput wrote: post #54
Y_Y wrote: post #38

Earlier quoted context omitted.

I think that this isn't strictly true. If you naïvely apply bad encryption before good you may weaken the entire system. For a silly example, imagine your "homegrown" crypto adds a publicly known plaintext to the start of the cyphertext. I think this is discussed in Schneier's textbook.

So? https it adds a publicly known header at beginning of any connection anyway and I don't see public key encryption being cracked anyway. Or blockchains do that too, are wallets being emptied by the ones that don't have the private key? And since you mentioned Schneier textbook, he also said that a good safe is the one that you give to your adversaries with the blue print of how it's made and still is uncracked, no…

> PGP is still uncracked, if I'd become a criminal then public PGP with at least 8k bits key would be my choice.

It's not PGP that is uncracked, PGP is a set of tools built on top of RSA. RSA is still secure (other than brute force factoring) with appropriately sized keys.

The biggest problem with PGP isn't PGP itself, it's your opsec approach to everything else. Example... after decrypting a PGP payload - did you save it to disk unencrypted? Did the recipients to your messages save it unencrypted? Are any machines infected with keyloggers? PGP is a great tool, but still requires good opsec overall.

Re: ‘Every message was copied to the police’

#95

Post by vkou »

VLM wrote: post #50
monocasa wrote: post #40

Earlier quoted context omitted.

The easier way to attack this is by instituting a know your customer law for phone systems including prepaid SIMs, combined with accomplice charges for anyone who's SIM is used in connection with criminal acts.

People are too free with their phones. Just walk into a bar and say you're too drunk to drive and could the bartender call my wife to pick me up? Not knowing its actually picking up $60M worth of coke instead of picking up me. Or pull off to the side of the road, walk in well dressed, wave a dead iphone in front of them, ask the receptionist "hey my car broke down and my battery is dead, could you call this number an…

This is all well and good for communicating a single, pre-planned operation, but you're going to need to communicate a lot more in order to actually do all that pre-planning for it.

Re: ‘Every message was copied to the police’

#96

Post by tessierashpool »

icu wrote: post #16

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to mind. It's probably the case that more technically adept criminals will roll their own tech and out manoeuvre rival criminals and law enforcement. Considering the sums of money discussed in the article it's not inconceivable for criminal organisations to start c…

one fun factoid in favor of your argument is that Latin American drug cartels have been known to build their own submarines for drug smuggling.

however, most known criminal dev teams are hacker groups in Russia who either operate as part of official espionage activities, or are allowed to operate as long as their victims aren't Russian.

all that being said, though, this "criminal software" idea probably isn't as true as you think. criminal enterprises are inherently risky, and there's so much money to be made in software that anybody good enough to do well in a criminal enterprise could do well normally.

(unless we count normal companies which get away with breaking the law in the course of normal business as criminal organizations — e.g., Amazon and Tesla for union-busting — in which case, there are probably a lot of people reading this who technically belong to criminal organizations, although some percentage of them would intend otherwise.)

Re: ‘Every message was copied to the police’

#97

Post by ljm »

neither_color wrote: post #83
RcouF1uZ4gsC wrote: post #15

> Every single message sent on the app since its launch in 2018 – 19.37m of them – had been collected, and many of them read by the Australian federal police (AFP) who, together with the FBI, had conceived, built, marketed and sold the devices. I wonder how many crypto currency tumblers are actually run by law enforcement?

That and VPN services. Cheap and easy to deploy and run, are mostly marketed towards people who want to hide their online activity. Not saying all VPN providers are like this or that there aren't legitimate reasons to use them, just saying that they'd make a good honeypot.

And Tor exit nodes.

Re: ‘Every message was copied to the police’

#98

Post by joshmarlow »

giantg2 wrote: post #88
icu wrote: post #16

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to mind. It's probably the case that more technically adept criminals will roll their own tech and out manoeuvre rival criminals and law enforcement. Considering the sums of money discussed in the article it's not inconceivable for criminal organisations to start c…

The best solutions are to go low tech. Enforcement models and staffing is reliant on electronic technology. Many enforcement organizations are poorly equipted to handle well implemented physical systems.

I wonder how useful The Solitare Encryption Algorithm would be here - https://www.schneier.com/academic/solitaire/

Re: ‘Every message was copied to the police’

#99

Post by ChuckMcM »

rkk3 wrote: post #67

> the FBI, had conceived, built, marketed and sold the devices. > $1,700 for the handset, with a $1,250 annual subscription > Almost 10,000 users around the world had agreed to pay So the FBI built a 8 figure ARR hardware business...

Funny but that is exactly where my brain went too, it was like "Wow, that is some serious market validation."

Re: ‘Every message was copied to the police’

#100

Post by newsclues »

chongli wrote: post #42
tokai wrote: post #34

Earlier quoted context omitted.

You would think that, but the whole an0m thing showed that it wasn't really the case.

That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols? [1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...

In the 90s Colombian cartels were using mainframes.
Post reply on HN