Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

LulzSec indictment published

scribd.com

Post reply on HN
Print view View original

51–60 of 70 posts

Re: LulzSec indictment published

#51

Post by chernevik »

fl3tch wrote: post #43
DevX101 wrote: post #9

They didn't get him via TOR. If you start reading on page 26, it states that Jeremy hammond revealed personal info to the confidential witness (CW-1). It was this personal info he shared that was used to identify Hammond as the suspect.

It's interesting because the FBI was in a perfect position to perform the most well-known attack on Tor: a correlation / timing attack. "If your adversary can watch both ends of the connection, you lose." They could watch his end and probably knew where the chat server was located. If it was located in the US, it would have been pretty straightforward to send an agent / install a device at the data center and watch t…

There's the surveillance you do to find someone, and there's the surveillance you do to build an admissible case comprehensible to a jury.

Also, the surveillance you disclose in explanation of finding him, and the surveillance you do for the sake of having some surveillance to disclose.

Re: LulzSec indictment published

#52

Post by chernevik »

tptacek wrote: post #24
lazyBilly wrote: post #5

I think this is actually a pretty strong endorsement of TOR, just based on what I briefly read here. They had a wiretap running, and all they got out of it was "he's definitely using TOR." That's pretty awesome, if you ask me.

The bug that breaks Tor for a hostile government is not going to be disclosed in an indictment or in unsealed court proceedings.

But whatever they used to find him may be discoverable. Even if they had such tech, they might still have foregone it here to keep it out of discovery.

They might have other teams using it for intelligence rather than case-building. If they sequestered those from the teams building evidence that usage might not be discoverable.

Re: LulzSec indictment published

#53

Post by jrockway »

fpp wrote: post #30
wmf wrote: post #17

Earlier quoted context omitted.

Yeah, we know about CALEA and ECHELON, but there's no evidence that they were used in this case so I don't know why you're bringing it up. It sounds like conspiracy-mongering.

Hold your horses - you're trying to kill the messenger! This is what the congressional hearings with AT&T reg. Bush Mark 2 interceptions were all about - now its all legal so no press on that anymore. And I guess you know that what can be done will be done. No conspiracy, standard practice - 15 years ago everybody involved into such practices would have been called a terrorist, enemy no 1 to our democratic systems no…

Nobody is shooting the messenger. You're saying "oh noes, the government is evil! look!" where in this case, there is no evidence of that. Without inspecting every packet on the Internet, they still got this guy with something equivalent to a regular wiretap.

Re: LulzSec indictment published

#54

Post by smsm42 »

sliverstorm wrote: post #49
smsm42 wrote: post #47

Earlier quoted context omitted.

What's so surprising in that? FBI can probably hire an expert in any existing technology. I'm sure they have very smart people working for them, and if they need they can always use outside consultants. I'd be pretty surprised and disappointed if they didn't have some experts with knowledge in everything that pertains to internet security, cracking, etc. There's a whole industry about that, for years now, so why not?

I guess what I'm saying is, it makes it sound like they have a guy on staff (not contracted) whose whole job is to be the TOR expert. I just wasn't expecting TOR would be that important.

It doesn't say his whole job is to be TOR expert. He could have knowledge in TOR - one doesn't have to be exceptionally knowledgeable to be considered "expert" in legalese, regular working knowledge of the matter allowing him to make informed conclusions like "this set of packets is a TOR traffic going to this IP" should be enough - and other matters too.

Re: LulzSec indictment published

#55

Post by aortega »

eli wrote: post #39
aortega wrote: post #19

Earlier quoted context omitted.

Did you read the indictment? They got it specifically by matching TOR traffic to his online-activity patterns. Obviously they matched perfectly. IMHO this was a weak proof, but still is totally unacceptable for a secure network not to hide traffic patterns.

Once the FBI has a surveillance van parked outside your house, I think you already lost. I don't think there's much you can realistically do.

Yes you can, if you know math. Plus, with math knowledge often comes the wisdom to not commit crimes.

Re: LulzSec indictment published

#57

Post by darksaga »

clintecker wrote: post #12

This was all detailed by Ars Technica a couple of days ago: http://arstechnica.com/tech-policy/news/2012/03/stakeout-how...

This pretty much sums it up from the article:

"While sup_g may indeed have been a "credible threat," he was in the end no match for the overwhelming federal resources of the FBI agents hunting him down. Over the last month, federal agents staked out his home in Chicago constantly, dug up old police surveillance records, tapped his Intern'et connection, used directional wireless finders to locate and identify his wireless router, and relied on Sabu back in his New York City apartment to let them know when sup_g went on or offline."

This is the one thing hackers will never get. You get the FBI on you and guess what? You're one person. They can assign hundreds of people to the case, bring down a wealth of resources to get you, and they go 24/7 until they build an airtight case on you. Not much you can do at that point but play their game.

Re: LulzSec indictment published

#58

Post by idm »

I'm now wondering about the whole wifi router/MAC address connection (see p. 30). Initially, they claim they intercepted "public signals," and that from this information they were able to determine the MAC addresses connecting to the router. That's all well and good as long as you're running an open access point, but using WPA (for example) would prevent this.

Are we supposed to assume this guy wasn't encrypting his wifi? I'll grant that it's possible, but it strikes me as unlikely given his activities.

Alternatively, if the wifi router were encrypted, are they suggesting that it is "public" because it's wireless, penetrates walls, and can be "seen" from outside?

In order to inspect MAC addresses, the WPA encryption would need to be cracked using that SSID pre-computed attack. However, executing such an attack certainly couldn't be considered the collection of public information.

Re: LulzSec indictment published

#59

Post by inchcombec »

idm wrote: post #58

I'm now wondering about the whole wifi router/MAC address connection (see p. 30). Initially, they claim they intercepted "public signals," and that from this information they were able to determine the MAC addresses connecting to the router. That's all well and good as long as you're running an open access point, but using WPA (for example) would prevent this. Are we supposed to assume this guy wasn't encrypting his…

Every TCP/IP packet has a MAC address for the sending device and the next receiving device. I say sending device, rather than just sender, as the MAC address may not be the original sender's MAC address. Every time a packet is received by a device in the chain where it is going the old MAC addresses are stripped from the packet. The device that just received it becomes the sending MAC and the device that is the next hop in the chain to where it is going becomes the destination MAC. The MAC addresses have to change at each hop for them to forward them to the next device along the chain to destination.

Theoretically, you could encrypt a MAC address, but all it would mean is that your packet would go nowhere as your own computer wouldn't even know where to send it. Even when using WEP/WPA/WPA2 the MAC addresses between the devices must be clear text. There is simply no way around that. It does mean that the idea that they just intercepted public signals is entirely accurate if all they did was determine MAC addresses as they are transmitted in the clear with no active attack needed. Heck, every time I open my wifi manager I see the MAC addresses for all neighbours within 500m.

My big question is why is someone's MAC important? I can't see it being a very useful piece of evidence. It isn't end-to-end like IP addresses so I can't see anyway it could be used to track him down. His own ISP probably doesn't even know it since they'll just see the MAC address of the modem he connects through. They are also notoriously easy to change at a seconds notice.

Re: LulzSec indictment published

#60

Post by inchcombec »

runn1ng wrote: post #36
aortega wrote: post #19

Earlier quoted context omitted.

Did you read the indictment? They got it specifically by matching TOR traffic to his online-activity patterns. Obviously they matched perfectly. IMHO this was a weak proof, but still is totally unacceptable for a secure network not to hide traffic patterns.

To cite the first Tor research paper: https://svn.torproject.org/svn/projects/design-paper/tor-des... Not secure against end-to-end attacks: Tor does not claim to completely solve end-to-end timing or intersection attacks. Some approaches, such as having users run their own onion routers, may help; see Section 9 for more discussion. They are repeating it several times in their documentation, too. It's not really a bu…

The only way to really counter such an attack would be to have a constant stream of traffic going 24/7 that is set at such a level that your normal usage never exceeds it. Then, when you send a real message, the computer throttles back on the garbage communication and injects your real traffic into the stream. The amount of traffic thus remains constant and it would be difficult to do any type of frequency analysis on the traffic.

However, depending on how high the garbage stream must be set to ensure that there is never a spike of real communications higher than that, it could easily be too costly for most people.

Post reply on HN