Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the CIA used Crypto AG encryption devices to spy on countries for decades

washingtonpost.com

Post reply on HN
Print view View original

151–160 of 353 posts

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#151

Post by criddell »

ceejayoz wrote: post #104
criddell wrote: post #37

Earlier quoted context omitted.

It doesn't make sense for two reasons to me. For one, the government can't compel you to do work. That's slavery. Also, it's open source software. TrueCrypt going down didn't change the security landscape at all.

> For one, the government can't compel you to do work. That's slavery. Slavery's perfectly legal. The 13th Amendment: "Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted , shall exist within the United States, or any place subject to their jurisdiction." https://en.wikipedia.org/wiki/Penal_labor_in_the_United_Stat...

Are you suggesting the TrueCrypt authors had been duly convicted of a crime?

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#152

Post by einpoklum »

tptacek wrote: post #134
nyolfen wrote: post #123

Earlier quoted context omitted.

snowden explicitly said pgp was safe

How on Earth would he know? He's not a cryptographer. Much of what we've learned from the Snowden disclosures has been through experts granted access to the SCIF that houses the documents he exfiltrated. He didn't carefully review those documents before collecting them. I think it's really difficult to come to any kind of firm conclusion about what NSA can and can't break, even with a background in the material. I te…

> How on Earth would he know?

I'm sure he said "to my knowledge" or something to that effect. That is, at least for at least relatively far into the circles of confidence, people did not know about encryption being broken algorithmicly or PGP broken in practice.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#153

Post by [deleted] »

paganel wrote: post #111
jhart99 wrote: post #100

Earlier quoted context omitted.

I always assumed that this is exactly what happened to Skype and Whatsapp.

I’m in the exact same boat as you. I’m on mobile and lazy to post links, but Whatsapp’s acquisition was carried through a boutique investment bank which had former CIA director George Tenet on its board of directors. Anyway, I found a quick link about the bank [1], it’s called Allen & Co. And also let’s not forget that the precursor of Google Maps was funded with CIA venture capital money. I’m stil curious why and ho…

[deleted]

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#155

Post by hadcomplained »

brightball wrote: post #114
NamTaf wrote: post #2

Reading between the lines on this, it's plainly apparent why there's been repeated attacks on encrpytion by the US government. From this, through RSA's Dual_EC_DRBG, to the present day, it's obvious that the US highly values rigging the deck to aid their decryption, and that the current democratisation of encrpytion protocols is a threat to them. I mean, you only need to read their repeated admissions that without MI…

That thought is one reason why I've always questioned this advice: "Don't roll your own encryption." I've always understood the arguments for it but that the advice is so widespread seemed a little counter intuitive. It always seemed, to me at least, that having millions of encryption algorithms out there would be inherently more secure than a lot of people standardized on one because the risk to any one would be so…

I agree with the sentiment. The common argument against rolling out your own encryption just baffles me. Because there are plenty of ways to roll out your own encryption safely and in such a way that drastically eliminates the possibility of getting broken. Following is just a few ideas easily implemented even by a mediocre engineer.

For the easiest, you can just apply multiple encryption algorithms in succession (of course with different keys). Although the algorithm of AES is considered safe, it can be broken through a side-channel such as a backdoor, which secretly stores keys used somewhere. But if you apply another algorithm after AES, be it ChaCha20 or Blowfish, it can only gets reinforced.

Another trivial way to safely roll out your own encryption is to increase the number of rounds in ciphers that are considered safe. The increased number of rounds only strengthen the algorithm. And it's just changing a few magic numbers in the source code - you can get extra security for little expense of time.

Both methods provide esay-to-implement ways to safely 'invent' a new encryption algorithm without a proper knowledge of cryptography. If people start doing any of the above regularly, it would be a headache for those enjoying to exploit vulnerabilities in common crypto implementations.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#156

Post by hjkgfdfgh »

tptacek wrote: post #150
hjkgfdfgh wrote: post #146

Earlier quoted context omitted.

That may be true of Apple, and is true of the PinePhone and Librem, but for the majority of Android devices, that's blatantly false. On Qualcomm chipsets in particular heavily utilize shared memory for baseband to application processor communication.

"The majority of Android devices" is a very wide net to cast.

Qualcomm alone covers 40%, and they're arguably the most likely to correctly implement their MMU (nevermind they've seen quite a few vulnerabilities in their MMU implementations over the years..)

Meditek uses a similar architecture, and I sure as hell don't trust their MMU.

Outside of Apple, Librem and Pine are just about the only way you're getting a USB attached baseband.

edit - Here's a Mediatek Baseband->AP PoC even: https://comsecuris.com/blog/posts/path_of_least_resistance/

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#157

Post by Mirioron »

bosswipe wrote: post #147
ninly wrote: post #128

Earlier quoted context omitted.

The "don't roll your own" argument isn't against having lots of encryption algorithms, though. It's because it's nearly impossible for a nonspecialist to implement tools that other specialists can't fairly easily recognize as broken and exploit (whether cryptologically broken or due to side-channel exploits).

> other specialists can't fairly easily recognize as broken and exploit Is there any supporting evidence for this claim? If I took an AES library and changed the order of some inner loop wouldn't it require extensive statistical analysis to notice the difference? Which means instead of throwing a bunch of compute at decrypting me, along with the masses 10 years from now, you would need to get a specialist to specific…

I've wondered this as well. Are there tools that will automatically run through all kinds of existing cryptographic algorithms to figure out which ones you're dealing with? Because it sounds to me like throwing enough layers of shoddy algorithms would obfuscate things enough that somebody would actually have to look at it and try to explicitly figure out a way to bypass what you're doing.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#158

Post by einpoklum »

noelsusman wrote: post #95
apexalpha wrote: post #8

What a treat to read a well written piece based on decent research. It's a long read but well worth your time. Kudo's to the journalists who helped uncover it. And the 'coup of the century' is far from clickbait, it's definitionally warranted for what the CIA and BND did here. It's a little ironic as well, especially since the US is so keen on blocking Huawei over espionage concerns.

There's nothing ironic, weird, or surprising about the US wanting to stop other countries from doing to them what they do to other countries. It's hypocritical in some sense, mostly because the US tries to project itself as the good guys, but it's just basic international relations. That's how every country has always operated and will always operate.

The US mostly tries to project itself as "the good guys" to its own inhabitants, and secondly to the local and international media. But in most of the world you are often faced with the business end of a US-operated or US-financed weapon.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#159

Post by einpoklum »

bobosha wrote: post #11

Related question: do modern diplomats/negotiators automatically assume their comms are compromised? Are their "secure" lines ever truly secure? Surely they know the NSA/CIA would be listening.

Somewhat surprisingly, it seems they don't. Just look at the diplomatic cables Wikileaks obtained. I mean, ok, they were leaked and not decrypted, but people were assuming that texts which can be accessed by tens of thousands of people would not leak.

Re: How the CIA used Crypto AG encryption devices to spy on countries for decades

#160

Post by beerandt »

apexalpha wrote: post #8

What a treat to read a well written piece based on decent research. It's a long read but well worth your time. Kudo's to the journalists who helped uncover it. And the 'coup of the century' is far from clickbait, it's definitionally warranted for what the CIA and BND did here. It's a little ironic as well, especially since the US is so keen on blocking Huawei over espionage concerns.

>based on decent research

The story was handed to him by the Agency, or agents of. The only "research" seems to be calling the names in the story for fact checking, and wapo couldn't even determine if some of them were alive or dead.

This story is dangerously close to being nothing but a CIA press release.

Post reply on HN