Federal agents seek to loosen rules on hacking computers during investigations
1–10 of 53 posts
Re: Federal agents seek to loosen rules on hacking computers during investigations
#2Wow, well I just had a moment of self-reflection on what a Pollyanna I am...my first thought at reading the headline was, "Oh good, now people like Aaron Swartz can't be threatened with 15 year prison sentences, or (in other cases) become felons for violating certain interpretations of Terms of Service". And of course, it is not that.
Re: Federal agents seek to loosen rules on hacking computers during investigations
#3Wow, well I just had a moment of self-reflection on what a Pollyanna I am...my first thought at reading the headline was, "Oh good, now people like Aaron Swartz can't be threatened with 15 year prison sentences, or (in other cases) become felons for violating certain interpretations of Terms of Service". And of course, it is not that.
You are not alone, that's exactly what I thought from reading the title.
Re: Federal agents seek to loosen rules on hacking computers during investigations
#4“The proposed amendment would enable investigators to conduct a search and seize electronically stored information by remotely installing software on a large number of affected victim computers pursuant to one warrant issued by a single judge”
I wonder if we'll start to see researchers/people come across more of things like this in the wild? Which makes me wonder if federal agents are going to be enlarging the attack surface against their own systems?
Re: Federal agents seek to loosen rules on hacking computers during investigations
#5“The proposed amendment would enable investigators to conduct a search and seize electronically stored information by remotely installing software on a large number of affected victim computers pursuant to one warrant issued by a single judge” I wonder if we'll start to see researchers/people come across more of things like this in the wild? Which makes me wonder if federal agents are going to be enlarging the attack…
If your quote means that one warrant can force a victim of hacking to install FBI spyware on their systems, this is very troubling, and seems like it would dissuade many organizations from reporting a hack at all, because the cure will be worse than the disease
Re: Federal agents seek to loosen rules on hacking computers during investigations
#6A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780
In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amount of open software running on your phone can stop. And as laptops become more and more mobile, it's going to seem strange that we've spent so long trying to tether our mobile phones to our laptops. Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee. Consumers would probably love it, because it's very enticing: you get internet access in most of the world without having to find a public hotspot or tether your phone. No more dealing with hotel wifi; no more dealing with logging in to someone else's.
The takeaway is that your children may grow up in a world where it's impossible to guarantee the government can't get into your computer if it really wanted to. Desktop computers aren't ever going to go away, but hardware design seems to be trending towards having built-in theft prevention. One feature of theft prevention is having the ability to locate the computer, or send it remote kill signals. If trends like that do catch on with consumers, it's "gg no re," because once our hardware is compromised to the point of third parties being able to remotely access it on demand, we've all lost something precious, and there won't be any opportunity to fix it. The more I think about it, the more it seems like it's just a matter of time until this happens, precisely because once it's here, it's never going away.
More and more network adapters seem to have DMA access to your computer. It would be interesting if the protections afforded by open source software were defeated at the hardware level without most people noticing. There doesn't seem to be any way to defend against it, because open source hardware simply can't survive: no money is necessary to develop open source software, whereas large investment would be necessary for development of open source hardware down to the chip level.
Re: Federal agents seek to loosen rules on hacking computers during investigations
#7Didn't these folks take an oath to defend the US constitution? This pretty clearly violates 4th Amendment protections against unreasonable search and seizure.
Yes, I'm not a lawyer, so I don't know what "doctrine", "touchstone" or "Three Pronged Test" makes the clearly unconstitutional into something lawfully constitutional, but that's a lawyer problem.
Beyond practical considerations, like this makes the FBI into an ethically dubious organization, doesn't doing this kind of thing grate on lawyers and officers who take very solemn oaths against doing bad things? Clearly, this will have undesired side effects, and make the police into something even less trustworthy than they already are.
Re: Federal agents seek to loosen rules on hacking computers during investigations
#8A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780 In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amoun…
> Perhaps future laptops are going to have 3G access embedded right into them which consumers can subscribe to for some low monthly fee.
The future is now.
http://www.dell.com/learn/us/en/19/campaigns/4g-3g-mobile-br... http://www.amazon.com/Samsung-XE303C12-H01US-Chromebook-3G-1... http://www.bestbuy.com/site/mobile-phones/mobile-broadband-c...
Re: Federal agents seek to loosen rules on hacking computers during investigations
#9A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780 In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amoun…
> The takeaway is that your children may grow up in a world where it's impossible to guarantee the government can't get into your computer if it really wanted to.
This is impossible to guarantee today. Certainly if you run the zero-day magnets known as browsers, and even if not, there is always some possibility of physical intrusion.
> More and more network adapters seem to have DMA access to your computer.
With an IOMMU (VT-d or equivalent on other platforms), it should be possible to protect against malicious DMA from any source.
Also, not all phones have basebands with DMA access to main memory. I think iPhones do not, though I am not sure, and some older iPhones have been attacked by turning on "auto answer", demonstrating direct access to the microphone.
Re: Federal agents seek to loosen rules on hacking computers during investigations
#10A couple weeks ago, when I asked someone how to verify on demand that a BIOS isn't compromised, someone else quipped "Could be the processors too, better forge those by hand." https://news.ycombinator.com/item?id=7609780 In fact, it turns out the future is probably headed in that direction. All mobile phones are already compromised; every phone has a proprietary baseband chip with full remote DMA access that no amoun…
> The takeaway is that your children may grow up in a world where it's impossible to guarantee the government can't get into your computer if it really wanted to.
If your adversary is a well funded government you need to have:
Secure software
Secure firmware
Secure hardware
Secure staff who follow procedure
Secure location
Armed guards
Etc
Most people can not do all of this and this have been vulnerable to governments for a long time.
Suggesting that your mobile communications data was ever secure when it was available to your telecoms provider seems odd to me.