Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Possible Governmental Backdoor Found ("case R2D2")

f-secure.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Possible Governmental Backdoor Found ("case R2D2")

#21

Post by palish »

joe_the_user wrote: post #15
spullara wrote: post #12

I'd be more worried if this was a backdoor in a popular program or operating system that was specified by the government and implemented by the original software author rather than more typical malware/trojan more akin to a wiretap. The former would be widespread and affect millions of users, while this appears to be a tool for use by law enforcement to carry out legitimate surveilance in criminal investigations. Pre…

I would challenge the concept of the government carrying out "legitimate surveilance" through this dubious means. The person surveiled has not been has not convicted of a crime yet the state has taken onto itself to install software that would leave the person open to further hacking by random individuals. This is akin to the police not simply breaking into the house of a man they suspected of a crime but also them l…

It's a little naive to believe governments don't do this kind of thing (software surveillance), don't you think? Even if they "shouldn't".

Re: Possible Governmental Backdoor Found ("case R2D2")

#22

Post by timrod »

lachenmayer wrote: post #14
spullara wrote: post #12

I'd be more worried if this was a backdoor in a popular program or operating system that was specified by the government and implemented by the original software author rather than more typical malware/trojan more akin to a wiretap. The former would be widespread and affect millions of users, while this appears to be a tool for use by law enforcement to carry out legitimate surveilance in criminal investigations. Pre…

The main gripe the authors of the paper have is not that this trojan exists - there are indeed German laws that allow for such a trojan - but that it has been so insecurely implemented, and also collects information that cannot be identified as "communication" (which is a requirement for this German law). Any data received from the command and control server is sent unencrypted and unchecked. Additionally, the trojan…

another gripe was the fact that the "backdoor within a backdoor" functionality (which AFAIK was ruled unlawful by German courts) is the only part of the trojan that tries to hide what it does.

Re: Possible Governmental Backdoor Found ("case R2D2")

#24

Post by ars »

joe_the_user wrote: post #15
spullara wrote: post #12

I'd be more worried if this was a backdoor in a popular program or operating system that was specified by the government and implemented by the original software author rather than more typical malware/trojan more akin to a wiretap. The former would be widespread and affect millions of users, while this appears to be a tool for use by law enforcement to carry out legitimate surveilance in criminal investigations. Pre…

I would challenge the concept of the government carrying out "legitimate surveilance" through this dubious means. The person surveiled has not been has not convicted of a crime yet the state has taken onto itself to install software that would leave the person open to further hacking by random individuals. This is akin to the police not simply breaking into the house of a man they suspected of a crime but also them l…

If they got a warrant first I'd be OK with it - as long as they were competent of course and didn't leave the person vulnerable.

It's no different from getting a warrant for a phone tap, or a copy or your US mail.

(Incidentally they don't need a warrant for a copy of the address on the front, called http://en.wikipedia.org/wiki/Mail_cover - so presumably they don't need a warrant to ask your ISP for a list of IP address, but I'd want a court to confirm that first.)

Re: Possible Governmental Backdoor Found ("case R2D2")

#25

Post by wnight »

tptacek wrote: post #10
buster wrote: post #8

Earlier quoted context omitted.

With an open government they wouldn't be able to do this in the dark. Also, they don't need to admit it, it's not like nobody knows that this software exists.

Why doesn't it simply stand to reason that software like this exists? Phone taps are far more sinister than trojans.

How so? The phone is largely someone else's device and as such not as trusted as your own PC.

Also, phone taps record what you say in one particular case versus PC trojans which could record everything you do or say near the computer, and everything you do on it. Trojans also put your whole computer under the attackers control and makes can make it appear, forensically, that you were doing things. If they download porn, it appears that you downloaded porn. If they send spam, it appears that you sent spam...

If sinister means dangerous, then I think trojans win hands down.

Re: Possible Governmental Backdoor Found ("case R2D2")

#26

Post by specialist »

WalterGR wrote: post #5
specialist wrote: post #2

Digging down to the source material, the Strong Towns group does address Government Transfer Payments, explaining that all suburbs are subsidized. But they avoid offending anyone by pointing out that the suburbs were financed by the urban areas. In my experience, suburban dwellers don't like learning that they're parasites.

You're looking for the "A Complete Guide To The Ponzi Scheme That Is Suburban America" submission. http://news.ycombinator.com/item?id=3090385

Haha. Oops! How'd that happen...?

Re: Possible Governmental Backdoor Found ("case R2D2")

#27

Post by buster »

canistr wrote: post #20
buster wrote: post #8

Earlier quoted context omitted.

With an open government they wouldn't be able to do this in the dark. Also, they don't need to admit it, it's not like nobody knows that this software exists.

>With an open government they wouldn't be able to do this in the dark. Please don't tell me you actually believe this.

In an ideal world it would be like that, this doesn't mean i can't hope to get as near as possible to "ideal". Let's say it like that: open government is better then the partially closed down shit we have now, ok?

Re: Possible Governmental Backdoor Found ("case R2D2")

#28

Post by joe_the_user »

palish wrote: post #21
joe_the_user wrote: post #15

Earlier quoted context omitted.

I would challenge the concept of the government carrying out "legitimate surveilance" through this dubious means. The person surveiled has not been has not convicted of a crime yet the state has taken onto itself to install software that would leave the person open to further hacking by random individuals. This is akin to the police not simply breaking into the house of a man they suspected of a crime but also them l…

It's a little naive to believe governments don't do this kind of thing (software surveillance), don't you think? Even if they "shouldn't".

What in my post lead you to believe I thought that governments don't engage in a variety of dubious surveillance (including surveillance which leaves open back doors to the victims machine)? They certainly do.

The thing is that exposing these acts and fighting all efforts to make such acts legal is still important for limiting how much the state can do.

Re: Possible Governmental Backdoor Found ("case R2D2")

#29

Post by palish »

joe_the_user wrote: post #28
palish wrote: post #21

Earlier quoted context omitted.

It's a little naive to believe governments don't do this kind of thing (software surveillance), don't you think? Even if they "shouldn't".

What in my post lead you to believe I thought that governments don't engage in a variety of dubious surveillance (including surveillance which leaves open back doors to the victims machine)? They certainly do. The thing is that exposing these acts and fighting all efforts to make such acts legal is still important for limiting how much the state can do.

Nothing, sorry.

My point was, there's nothing to be done about it. They're going to do it, just as sure as gravity.

Post reply on HN