There are a lot of insecure updaters. I remember reading the list from evilgrade a few years back. It was shocking.
New German law would force ISPs to allow secret service to install trojans
121–130 of 245 posts
Re: New German law would force ISPs to allow secret service to install trojans
#122What does "trojans at ISPs" even mean? TLS works end-to-end and ISPs can do absolutely nothing to see the plaintext. It's unless the CAs at users-side are manually replaced with fake ones nothing can be done. I've never used Windows since I was a kid but I am sure this is pretty much impossible on Linux for example since adding CAs require root privilege.
That is a good question.
Looking at some of Citizen Lab’s excellent reporting on FinFisher shows that victims were redirected to regular unencrypted http downloads when the malware was installed.
One of the examples given was when a user tried to download Avast antivirus from a well-known software hosting site and the download was done over http.
There are several security sites that have downloadable packet captures of malware infections where you can see in Wireshark that redirects are commonly used.
Re: New German law would force ISPs to allow secret service to install trojans
#123Earlier quoted context omitted.
Well, as far as I know, all of these countries have political systems in which representatives are supposed to act on the behalf of the people. Basically, we can't all work full time to understand every political thing, and vote on them all, so we have someone do it for us: a representative. Representatives very rarely represent themselves, and are almost always representing either powerful people ( often through lob…
Why they are so scared of citizenry though? Anyone that is criminal or really needs security will just use Faraday Cages with disconnected computers. Literally there is nothing they can do against big league criminals with this much mass surveillance, so only logical conclusion is that this is only intended for use on citizenry.
It's the only logical conclusion. And given that there's so many of us, and so few of them, and they've been taking advantage of us in a very abusive way... I don't think they're wrong. I think there's a good chance this goes sour for them.
Re: New German law would force ISPs to allow secret service to install trojans
#124Earlier quoted context omitted.
Is this relevant since nearly everything is https these days?
DNS usually isn’t, and TLS still runs over TCP, which is vulnerable to this type of hijacking, so yes, it is indeed still relevant due to both resolution as well as transport layer. NSA would be very bad at their job indeed if they couldn’t issue valid TLS certificates for any domain to themselves.
>NSA would be very bad at their job indeed if they couldn’t issue valid TLS certificates for any domain to themselves.
Is there any evidence of this? With certificate transparency being mandatory a few years ago, you'd think that the NSA would be caught at least once.
Re: New German law would force ISPs to allow secret service to install trojans
#125Earlier quoted context omitted.
The scary stuff about the current development is, that we get flooded with arguments about hardcore criminals, but if you look at the actual changes to the laws, such restrictions are not made, instead these extreme measures are allowed for petty reasons and some politicians will still keep pushing for even more totalitarianism. These siloviki want mass surveillance comparable to what Chinas Ministry of State Securit…
The surveillance, including the mass surveillance of the communication, existed even in older times. It is, for example, documented that both British and US secret services went through all the telegrams that passed their commercial infrastructure, often based on a simple "gentleman's agreement" with the companies, even in the 19th century, and certainly in the 20th. Other countries were somehow aware of that weaknes…
Back in the age of feudalism the holy roman emperor, who was neither holy, nor roman, nor an emperor, but the head of the House of Habsburg, gave the monopoly of postal services as an hereditary title to the House of Thurn und Taxis who had been building their postal services for two centuries, eliminating their competition in the empire, under the rule that letters are read and checked for conspiracy against the crown. That happened in black rooms, or cabinet noir or Geheime Kanzlei and became common in all of europe. In the 17th century the "Wiener Postloge" for example was well known for their efficiency not only in opening, copying and re-sealing letters by forging wax-seals, but also for their state of the art crypto-analysis.
Re: New German law would force ISPs to allow secret service to install trojans
#126To not even be sure whether a website you visit, or a file you download is actually what its creator says it is, is like picking up an orange but the government secretly replaces it with an apple that contains almost no vitamin C in it at all.
You have the right to seek out and eat an orange for your immune system and survival, and no government should have the right to interfere with that, at any time.
This law is a fundamental attack on basic quality of life and basic human rights for all Germans. Whoever proposed it should be ashamed of themselves. I hope the parliament outright rejects it for what it is.
The very fact it has been proposed is Orwellian and chilling. Internet giants like Google should resist this technology and tell us when a government has just tampered with our web browsing.
Re: New German law would force ISPs to allow secret service to install trojans
#127To not even be sure whether a website you visit, or a file you download is actually what its creator says it is, is like picking up an orange but the government secretly replaces it with an apple that contains almost no vitamin C in it at all. You have the right to seek out and eat an orange for your immune system and survival, and no government should have the right to interfere with that, at any time. This law is a…
Now I want an orange.
Re: New German law would force ISPs to allow secret service to install trojans
#128Pretty shocking in a state that has such strict privacy laws. Not sure how the two can come from the same mouth, and even be in public view. My understanding is that the privacy restrictions are largely the result of half the country having lived under the Statsi, and thus being extremely weary of government eyes. Here it’s out in the open!
There is something hilarious and schizoid in how Germany is perceived and the realities about this country. They have strict privacy laws? First Nazi personel in the first half then Stasi personel in the second half of the 20th century were simply requalified and rehired, each bloody time. How do you think? They are top environmentally-friendly country? Highest polluting coal power plants in EU are located in Germany…
These are both known and highly controversial issues in Germany. The first one is widely accepted as without any alternative. You can't just replace a whole bureaucracy and in retrospect it worked out to only change key positions. But obviously it was a healing and cleaning process over time. The other thing is to be attributed to the fact the we were very quick to abandon atomic power even before climate change issues were that popular. Its a hilarious contradiction. We now actually also have a plan to also get rid of the coal power plants but it will be hard, maybe we need to reintroduce the candle as a source of light. There is no lack of willingness and intent but reality has us all in its tight grip.
Re: New German law would force ISPs to allow secret service to install trojans
#129Earlier quoted context omitted.
The scary stuff about the current development is, that we get flooded with arguments about hardcore criminals, but if you look at the actual changes to the laws, such restrictions are not made, instead these extreme measures are allowed for petty reasons and some politicians will still keep pushing for even more totalitarianism. These siloviki want mass surveillance comparable to what Chinas Ministry of State Securit…
> It does not matter if Germany is not ruled by an autocratic regime at the moment I totally get the appeal of that argument, but it completely breaks down once I ask myself how much that autocratic bogeyman regime, once it got into power, would feel bound by privacy protections put in place by their predecessors.
The question is rather: can they use preestablished structures and machinery or do they need to build it from the ground up. Surveilance also needs work, and its less work if everything is prepared.
Re: New German law would force ISPs to allow secret service to install trojans
#130What does "trojans at ISPs" even mean? TLS works end-to-end and ISPs can do absolutely nothing to see the plaintext. It's unless the CAs at users-side are manually replaced with fake ones nothing can be done. I've never used Windows since I was a kid but I am sure this is pretty much impossible on Linux for example since adding CAs require root privilege.
Well they can still see (to some extent) which websites you visit, and how often. And how much data you upload or download.