Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code from the FBI’s Anom encrypted messaging app

vice.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: Code from the FBI’s Anom encrypted messaging app

#91

Post by Arathorn »

mavhc wrote: post #6
drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

Matrix treats all chats as chatrooms, even 2 people chats. This is promoted as a simplification, but maybe it's a security problem. If a protocol only allows 2 people to chat, harder to exfiltrate the messages

As the sibling implies: it doesn’t matter if the conversation is limited to 2 users - it’d just shift the attack adding a ghost device to one of those users, which is equivalent (and arguably more subtle) than adding a 3rd user to the conversation.

Re: Code from the FBI’s Anom encrypted messaging app

#92

Post by dmix »

nojito wrote: post #90
dmix wrote: post #89

Earlier quoted context omitted.

I was talking about using a 3rd party key and copying during transit, not explicitly adding an additional contact to the message and sending it using standard channels. There has been papers in the past based off of Apple's own documentation that showed it was possible. But based on some googling Apple hasn't provided this capability, at least to the FBI (they claimed it would require modifying the iMessage key serve…

Again..this isn't possible because we would have seen its use already and why the FBI uses the iCloud backup strategy for investigations.

> we would have seen its use already and why the FBI uses the iCloud backup strategy for investigations.

That's what I just said, it still doesn't mean the feds would be dumb enough to make visible changes the destination contacts

Re: Code from the FBI’s Anom encrypted messaging app

#93

Post by nr2x »

natch wrote: post #39
nr2x wrote: post #11

Earlier quoted context omitted.

As long as iCloud backup is a) on by default, and b) isn’t clearly marked as being readable to Apple, it is a back door in practice, especially since the FBI is the reason that they did this. Let’s not even talk about Chinese users, as apparently Apple bending over to store all their data in CCP data centers doesn’t count.

Agree and it's not just Chinese users. Just talking about that one country (there are others, let's set that aside) it's Chinese users, and anyone who happens to be in China, and it would seem to be also anyone who, knowingly or unknowingly, anywhere around the world… in the US, the UK, the EU, etc… anywhere, has so much as a one-time interaction with such a user. I feel like that paragraph would lose most people bec…

Interesting point! The thing with Apple that annoys me is they believe their own marketing, but if you say "Privacy is a Human Right" and deny it to Chinese citizens, you either don't consider Chinese people human, or you are full of shit. Honestly, not sure where Apple stands given their labor practices in China, the people who assemble the widgets certainly haven't been treated like human beings.

Re: Code from the FBI’s Anom encrypted messaging app

#94

Post by calvinmorrison »

sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

> What other services might be run, controlled, or surveilled by the US investigative authorities?

More boringly, and more simply, they hire people who work at Apple, Google, and so forth to exfiltrate data, create constant new bugs that will at some point be called a 0 day, and it goes on and on.

Re: Code from the FBI’s Anom encrypted messaging app

#95

Post by mjreacher »

danso wrote: post #87
mjreacher wrote: post #73

Earlier quoted context omitted.

I'm not sure if this is 100% serious but if it is, how could the FBI having a backdoor into every messaging app fit in with the relative ineffectiveness of the FBI?[0] If they truly did have the ability to spy on any messaging app without issue then you would expect them to have far more success than they actually do. For comparison, a quick Google search says China has a 99.9% conviction rate. Remember security and…

This is kind of a nitpick, but U.S. prosecutors also boast 99+% conviction rates. Note that conviction rate is not necessarily indicative of a systems effectiveness (or lack of fairness). Prosecutors only pursue charges in very few cases, and very few of those cases go to trial https://www.pewresearch.org/fact-tank/2019/06/11/only-2-of-f...

The first link I mentioned says in 2017 the conviction rate of crimes referred to the Justice Dept. by the FBI was 47%. Of course I am guessing the differences here are definitional, regardless the stat was just used as a broad proxy for how successful the FBI is in getting people they think are criminals convicted.

Re: Code from the FBI’s Anom encrypted messaging app

#96

Post by dicknuckle »

_jal wrote: post #83
mandelbrotwurst wrote: post #68

Earlier quoted context omitted.

What does raw traffic that is not in the form of logs look like? Maybe you mean that they are streaming logs in real-time rather than sending log files in batches periodically? You don't mean sharing raw traffic as in forwarding actual requests, I wouldn't think?

> You don't mean sharing raw traffic as in forwarding actual requests, I wouldn't think? The usual method is either to use a splitter or switch configuration to mirror traffic to another interface, attached to a machine running packet capture/analysis tools.

Unencrypted obviously.

Re: Code from the FBI’s Anom encrypted messaging app

#97

Post by sergers »

l33t2328 wrote: post #38
richbell wrote: post #25

Earlier quoted context omitted.

> Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Lots of VPNs, too! "We don't keep any logs! We just pipe a direct feed to the government so they can keep logs!"

Do you have any examples?

PureVPN’s ‘non-existent’ logs given to authorities, to arrest alleged stalker

https://thenextweb.com/news/purevpns-non-existent-logs-used-...

These guys just actually logged certain data when they said they didnt

Re: Code from the FBI’s Anom encrypted messaging app

#98

Post by stereoradonc »

xoa wrote: post #7
sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

> We already know Apple has preserved a backdoor in the end-to-end cryptography of iMessage at the FBI's behest, as reported by Reuters. WhatsApp has always had the same backdoor (unencrypted backups to cloud services). The largest services are all unsafe for privacy. I don't agree with your characterization of that as a "backdoor" and I think that dilutes the term dangerously. There is no need to use Apple's backup…

Why use Apple in the first place? Problem solved.

Re: Code from the FBI’s Anom encrypted messaging app

#100

Post by blepyzdiec »

spongechameleon wrote: post #24
xt00 wrote: post #21

I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own server, where that server runs a VM that you configure and setup on your own PC locally then upload to AWS or something and has some facility to constantly report to you the hash of the memory and disk contents, along with some contract from AWS that states that…

I think something like Ricochet (if it were still actively maintained) could be a good solution. https://github.com/ricochet-im/ricochet Every user is their own Tor onion service, so you get E2E encryption and no centralized servers. The whole thing hinges on the security of Tor itself which is probably a safe enough bet.

Briar https://briarproject.org/ is similar, plus, AFAIK, it's using E2E on top of Tor service. However, looking at massively caught Tor services, I believe, to keep it truly secure, you have to rotate your service address, aka reinstall the app, losing all your history of communication.
Post reply on HN