Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the Operating System Edward Snowden Used to Evade the NSA

wired.com

Post reply on HN
Print view View original

61–70 of 83 posts

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#61

Post by dfc »

AJ007 wrote: post #50
k-mcgrady wrote: post #6

Earlier quoted context omitted.

Knoppix was my first introduction to Linux. The boot-from-CD aspect amazed me. At first the only thing I used it for was recovering data from a screwed up Windows install but eventually I got more into it and started installing other distress (starting with Ubuntu I think).

For some perspective, this was back in the days where it was actually quite a bit of work to get get linux configured and running correctly on your at home desktop. Knoppix was quite a miracle.

Knoppix came out in 2000, a lot of time had passed since it was "actually quite a bit of work to get get linux configured and running correctly on your at home desktop." If you were mot using a thinkpad or ibook a laptop could still cause some trouble.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#62

Post by dmix »

acqq wrote: post #53
dmix wrote: post #43

One important and often overlooked feature of Tails is when you shut it down it wipes your system memory/RAM using sdmem. Your encrypted data and sensitive files are often accessible via memory forensics even if you shut your computer down. Including the websites you visited. Your encryption keys can be in your computers memory for weeks and is easily accessible via a memory dump. This is why people say that with phy…

Data can be retrieved from DRAM not after weeks (your claim is "even if you shut your computer down (...) Your encryption keys can be in your computers memory for weeks") but only http://en.wikipedia.org/wiki/Cold_boot_attack "in the seconds to minutes after power has been removed." The reason is explained here: http://en.wikipedia.org/wiki/Memory_refresh And even the electrons from SRAM, which doesn't need refreshes…

Thanks, this is true. Encryption keys can exist in memory for up to a week [edit: or longer] in live memory with power on. This is well after they've been used on the machine, or say after you close your Truecrypt volumes. The vast majority of people rarely shutdown their laptops for extended periods of time and often just suspend to disk, instead of a full power-off.

This is why it's good to power down or sdmem when you're finished working with sensitive data.

On a full shutdown persistence is not as big of a risk, as the other commenter pointed out, cold boots are mitigated by DDR3 similar to how modern SSDs with TRIM make deleted data-recovery nearly impossible (such as Swap data which may also contain encryption keys).

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#63

Post by acqq »

dmix wrote: post #62
acqq wrote: post #53

Earlier quoted context omitted.

Data can be retrieved from DRAM not after weeks (your claim is "even if you shut your computer down (...) Your encryption keys can be in your computers memory for weeks") but only http://en.wikipedia.org/wiki/Cold_boot_attack "in the seconds to minutes after power has been removed." The reason is explained here: http://en.wikipedia.org/wiki/Memory_refresh And even the electrons from SRAM, which doesn't need refreshes…

Thanks, this is true. Encryption keys can exist in memory for up to a week [edit: or longer] in live memory with power on. This is well after they've been used on the machine, or say after you close your Truecrypt volumes. The vast majority of people rarely shutdown their laptops for extended periods of time and often just suspend to disk, instead of a full power-off. This is why it's good to power down or sdmem when…

> Encryption keys can exist in memory for up to a week in live memory with power on.

No. After some high-enough RAM area contained the keys and you keep it powered and your OS uses much less physical RAM than physically available there's no hard limit. Just forget the "week."

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#64

Post by dmix »

acqq wrote: post #63
dmix wrote: post #62

Earlier quoted context omitted.

Thanks, this is true. Encryption keys can exist in memory for up to a week [edit: or longer] in live memory with power on. This is well after they've been used on the machine, or say after you close your Truecrypt volumes. The vast majority of people rarely shutdown their laptops for extended periods of time and often just suspend to disk, instead of a full power-off. This is why it's good to power down or sdmem when…

> Encryption keys can exist in memory for up to a week in live memory with power on. No. After some high-enough RAM area contained the keys and you keep it powered and your OS uses much less physical RAM than physically available there's no hard limit. Just forget the "week."

Updated comment for HN pedanticism.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#65

Post by saym »

Karunamon wrote: post #48
drzaiusapelord wrote: post #46

Earlier quoted context omitted.

Except now seeing an XP desktop in a corporate environment will raise eyebrows as its officially dead. No Win7 skin?

A more cynical person would say you've not worked in many corporate environments ;)

Good thing there are no cynics here. ;) x2

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#66

Post by SixSigma »

bashinator wrote: post #59
SixSigma wrote: post #7

Even wired don't know what an OS is. Or rather the definition of OS has changed. A strange time when your industry jargon enters the popular lexicon but always slightly twisted. You can't even call yourself a Troll in the UK now without people thinking you go on Facebook and mock the dead to their nearest and dearest.

What is Tails, if not an operating system?

A distribution of the Linux operating system. It's a Debian distribution with some userspace tools bundled.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#67

Post by infinity0 »

sp332 wrote: post #41
infinity0 wrote: post #25

Earlier quoted context omitted.

How would you have found the bug without it being open source? You think companies pay for these open public audits on proprietary software ?

The vulnerability was first found by a fuzzer, which would have worked equally well on closed-source software. And I believe the fuzz tester (part of Codenomicon's "Defensics") is also closed-source.

You misunderstand - how would the public have found out about the results of that audit? There is no incentive to release this information for a closed product; very much the opposite.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#68

Post by dobbsbob »

dmix wrote: post #43

One important and often overlooked feature of Tails is when you shut it down it wipes your system memory/RAM using sdmem. Your encrypted data and sensitive files are often accessible via memory forensics even if you shut your computer down. Including the websites you visited. Your encryption keys can be in your computers memory for weeks and is easily accessible via a memory dump. This is why people say that with phy…

They use memtest=n kernel parameter now instead of sdmem https://tails.boum.org/blueprint/more_efficient_memory_wipe/...

I don't really trust their tests, but DDR3 memory kind of makes this attack useless. The $FEDAGENCY also plans arrests so you're cuffed with everything turned on and no way to push buttons or yank out cables like Ross Ulbricht or Max Vision

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#69

Post by JeremyMorgan »

jonemo wrote: post #4

Another Debian based boot-from-CD OS that used to be quite popular is Knoppix [1]. I remember that was a big thing in the times of Win98 viruses when people used it for system recovery. In Germany they distributed it as add-on to computer magazines. [1] https://en.wikipedia.org/wiki/Knoppix

Knoppix was really innovative for it's time, the first live CD OS that I know of, it was great for accessing drives that were toasted or even mounting other linux volumes. All the stuff we do with USBs now, but back in the early 2000s it wasn't an easy thing for them to accomplish.

Re: Inside the Operating System Edward Snowden Used to Evade the NSA

#70

Post by dobbsbob »

pavanky wrote: post #33
devconsole wrote: post #12

It's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint. Here's an example: Let's say (for the sake of example please) that the NS…

> One way is to record the fact that from your home computer originated some Tor traffic at almost the same time the Google search took place. This either implies someone already suspects you and are monitoring you or that you are the only person searching on Google using Tor at that particular moment. I find the latter hard to believe. Even if it is true, it can be mitigated by more people using tor at the same time…

Google searching no, but an IRC room or being logged into something would be good for metadata. Especially a forum or chat room where you reveal timezone or other geolocation info. "It's snowing here"

Would not take long to grep ISP logs and find the known Tor bridges, Obfsproxy bridges, relays and who might have used them.

If you tunneled Tor traffic through a VPN exiting Russia then your local ISP has no Tor timing metadata to give, unless you're Snowden and your adversary is global. Running an internal relay would help obfuscate your own traffic too if you can connect to it on a local network it would be a lot harder to prove you logged into IRC channel #blowuptheembassy on the Al Qaeda IRC freenode server.

Post reply on HN