Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

wired.com

Post reply on HN
Print view View original

251–260 of 280 posts

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#251

Post by nwh »

nitrogen wrote: post #193
darkarmani wrote: post #160

Earlier quoted context omitted.

SD cards have a physical switch you can flip for read-only.

The SD card switch is actually read by an external physical sensor (a tiny button like the write-protect buttons inside of ancient 3.5" floppy drives), at least on most SD cards. I had an SD card whose switch wasn't quite thick enough to trigger the writability sensor of an SD card reader, so I had to wrap it in tape.

In a completely unrelated area, you just saved me a pile of effort and time with that tape trick. Kudos.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#252

Post by brown9-2 »

mithras wrote: post #165
wslh wrote: post #157

Earlier quoted context omitted.

I am using 8192 bits, just in case ;-) also applying one time pads when I can.

How do you get the one time pad to the recipient?

I really hope no one is using just one OTP.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#253

Post by anaphor »

nitrogen wrote: post #195
Amadou wrote: post #118

Earlier quoted context omitted.

If you can come up with a backdoor that requires the non-obvious interaction of multiple parts of the kernel (or parts of the kernel and certain user-space actions) then it would be reasonable to break up the necessary changes and slip each one in as a part of a larger demonstrable improvement to each specific subsystem. For example (completely hypothetical), you could create a race condition in the kernel's page all…

That reminds me of a story I read about how the satellite companies foiled carders by slowly building up a new decryption system out of apparent garbage released across a long string of updates. I don't dare to search for it though, so I don't have a link.

Thanks for mentioning that, I had a feeling of deja vu that I couldn't figure out. It was an awesome hack anyway.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#254

Post by eru »

jacquesm wrote: post #219
signed0 wrote: post #218

Earlier quoted context omitted.

Which banks actually do this? I've never encountered one.

Both my banks do (European banks, specifically Rabo and ABN/AMRO). These are still not immune to phishing attacks but it's a lot better than TAN codes or some other 'dumb' authentication scheme. Typically these systems work in conjunction with pin-and-chip card, a small piece of hardware that generates the codes and a challenge / response system built into the website you use for the authorization. Separate challenge…

What's wrong with TANs?

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#255

Post by mmavnn »

001sky wrote: post #143
a3n wrote: post #137

Earlier quoted context omitted.

You could be right. Or it could be the exact opposite. Or something else. It doesn't matter. Fundamentally we do it to ourselves, because we're herd/pack/social animals. We shun anyone too different from the tribe, it's in our DNA. Because of that, we are highly evolved to fit in. Yeah, we're self aware and all that, we have choices, but what we generally choose to do is identify with some group and hate opposing gro…

In England and Wales, truancy is a criminal offence for parents.[6] Since 1998, a police officer of or above the rank of superintendent may direct that for a specified time in a specified area a police officer may remove a child believed to be absent from a school without authority to that school or to another designated place....

It's not that widely known, but you can remove your child from state education as a parent and teach them yourself. You just have to tell the local authority you're doing so in writing.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#256

Post by greenyoda »

richardwhiuk wrote: post #239
greenyoda wrote: post #174

Earlier quoted context omitted.

For a wiretap, they'd definitely need a warrant. And I think there was a recent court decision that says that police need a warrant to put a GPS tracker on someone's car. What they did here was to install malware on thousands of machines, without any probable cause to believe that any specific machine owner was involved with child porn. If I understand the law correctly, they would need to obtain a specific warrant f…

That's a pretty poor analogy. A better one would be 'Would a judge give a warrant to allow the FBI to place a GPS tracker automatically on everyone who visited a store that was known to sell child porn?' The answer to that might be yes.

I think my analogy is more accurate. There were many independently owned web sites (stores) hosted at Freedom Hosting (neighborhood), and not all of them carried child porn. You could visit one of the legal sites without even knowing that there was child porn being hosted by Freedom Hosting (or even knowing where the site was being hosted).

From the article:

Freedom Hosting was a provider of turnkey “Tor hidden service” sites — special sites, with addresses ending in .onion, that hide their geographic location behind layers of routing, and can be reached only over the Tor anonymity network. Tor hidden services are used by sites that need to evade surveillance or protect users’ privacy to an extraordinary degree – including human rights groups and journalists. But they also appeal to serious criminal elements, child-pornography traders among them.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#257

Post by SEJeff »

signed0 wrote: post #218
jacquesm wrote: post #206

Earlier quoted context omitted.

And if your bank does not do 2 factor authentication switch to another bank.

Which banks actually do this? I've never encountered one.

My American Express personal savings does. HSBC does and even allows you to enter your 2FA on a JavaScript keyboard (clicky click) if you choose to mitigate the threat of a key logger.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#258

Post by quantumpotato_ »

sillysaurus2 wrote: post #34
jlgreco wrote: post #14

Earlier quoted context omitted.

Meanwhile the way Bruce Schneier is now using GPG is really only one conceptual leap away from full-blown Tinfoil Hat Linux usage: http://en.wikipedia.org/wiki/Tinfoil_Hat_Linux The difference between "tinfoil hatters" and reasonable people like Bruce Schneier now seems to be how concerned they are with their ability to destroy a harddrive, and TEMPEST.

the way Bruce Schneier is now using GPG Which way is that? Also, from your Tinfoil Hat Linux link, this idea is hilariously awesome: Keystroke monitoring — THL has gpggrid, a wrapper for GPG that lets you use a video game style character entry system instead of typing in your passphrase. Keystroke loggers get a set of grid points, not your passphrase. I wonder if it might be possible to implement that idea into other…

Julian Assange worked on projects relating to maze navigation, theorizing that people could memorize the muscle sequences but not be able to tell them under pressure, or fail under pressure.

Randomizing the position of landmarks eg. go to A, B, E, C, F, then showing a map could let the user enter a different sequence of keystrokes to get the same result.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#259

Post by polyfractal »

MichaelGG wrote: post #166
pkinsky wrote: post #138

Earlier quoted context omitted.

The government poisoned alcohol during Prohibition.

They still poison medicines. Hydrocodone, a Schedule II substance, drops to Schedule III when sold with acetaminophen, a substance toxic to the liver.

This is ridiculous. Acetaminophen is Tylenol. Are you seriously trying to make the argument that Tylenol is a poison?

Arsenic is a poison. Lead is a poison. Cyanide is a poison. Tylenol becomes toxic at a certain threshold (like every other substance on the earth for that matter).

Sure, it is toxic to your liver in large doses. That isn't why Tylenol 3 is Schedule II while pure Codeine is Schedule II. The difference is in dosage. Tylenol 3 tends to come in doses of around 5mg Codeine to 300-500mg Tylenol. You get T3 when you have a tooth taken out, or maybe some minor stitches. You are also only given a few pills.

You get pure Codeine when you break a bone or stick a pencil through your eye. Or one of the stronger codeine-derivatives (oxycodeine, etc). These come in larger doses and are more prone to abuse.

Hence Schedule III.

I'm no fan of the DEA or the schedule system...but the "Government" isn't poisoning anyone. That's pure FUBAR and true tin-foil-hattery. Its a classification system for the abuse potential of perfectly legal drugs.

Re: FBI Admits It Controlled Tor Servers Behind Mass Malware Attack

#260

Post by josh2600 »

polyfractal wrote: post #259
MichaelGG wrote: post #166

Earlier quoted context omitted.

They still poison medicines. Hydrocodone, a Schedule II substance, drops to Schedule III when sold with acetaminophen, a substance toxic to the liver.

This is ridiculous. Acetaminophen is Tylenol. Are you seriously trying to make the argument that Tylenol is a poison? Arsenic is a poison. Lead is a poison. Cyanide is a poison. Tylenol becomes toxic at a certain threshold (like every other substance on the earth for that matter). Sure, it is toxic to your liver in large doses. That isn't why Tylenol 3 is Schedule II while pure Codeine is Schedule II. The difference…

http://www.medicinenet.com/tylenol_liver_damage/article.htm#...

Yes, but in rare cases. Acetaminophen is not the easiest thing in the world for your body to deal with. But this is technically correct and in the 99 percent case you're correct so this is kind of belaboring the point.

Nevertheless, I thought it was worth mentioning.

Post reply on HN