Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

nytimes.com

Post reply on HN
Print view View original

221–230 of 250 posts

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#221

Post by dogma1138 »

lvh wrote: post #148
sqeaky wrote: post #106

Earlier quoted context omitted.

Most users cannot tell the difference between between the Phone, OS, App and the signal (Let alone an app named Signal). Likely the journalists work with tech savvy to make sure their understood this and it was hard for them to make sense of gigabytes of technical jargon and noise. Arguing this point at all is silly when many people, even many IT professionals don't know and don't care about the difference between by…

That hardly matters if people's response is to use other, less secure things, as was the case with the Guardian and Whatsapp.

People who care sufficiently about the security of their crypto don't use NYT or the guardian as an information source to base their opsec decisions on.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#222

Post by blfr »

deathhand wrote: post #126
tptacek wrote: post #13

Earlier quoted context omitted.

Running misinformation is part of Wikileaks' job. It's not the NYT's job.

Could you explain more about "misinformation is part of wikileaks' job"

And that it's not NYT's job while we're at it.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#223

Post by libertymcateer »

nikcub wrote: post #219
libertymcateer wrote: post #207

Earlier quoted context omitted.

I'm also interested to know. Believe it or not, I would love to get Nik as a consultant. I fear my 'hubris' (I won't deny it, this idea is extraordinarily ambitious and I have to be arrogant to even conceive of it) will have pissed him off irrevocably. That aside, I don't really follow his point on the login PW. I understand 8 char alphanum pw is pretty low entropy... but that isn't used for encryption. And the login…

It isn't the login password but the message password - although using sha256 for a login password isn't great either if you're doing aes(plaintext, sha2(password)) = cyphertext given cyphertext I can get to plaintext with sha2(8-char dictionary) well designed systems will generate a truly random key there, exchanged using public-key. if you're going to use a password, you need a key-derivation algorithm this is all b…

> this is all bunk tho since the big vulnerability here is that you're delivering the encryption routines via javascript in a global browser space

So what about mailvelope?

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#224

Post by vetinari »

libertymcateer wrote: post #82
md_ wrote: post #38

Earlier quoted context omitted.

> Given Google's stance of not encrypting local storage in any way that I am aware of, this is fundamentally unsurprising. I have long been saying that Android is insecure and that storing passwords in Chrome is dangerous. ChromeOS and Android both implement FDE. There are some legitimate criticisms of (especially) the latter, voiced by e.g. Matthew Green, but you're just speaking nonsense here. There's very little v…

I am not talking about ChromeOS - I am talking about the Chrome browser. Localstorage, last I checked, which was recently, is plaintext. > ChromeOS and Android both implement FDE Which is irrelevant if the runtime is compromised, which appears to be the case.

And it does not matter - it is in Chrome's homedir, no other app can access it. Wrt. physical store, it is on FDE anyway.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#225

Post by crowbahr »

md_ wrote: post #158
crowbahr wrote: post #133

Earlier quoted context omitted.

While you are correct about the enforcement applying to Google Apps the Google Play Services has all possible permissions. I don't know if they could do something with the kernel from that alone though. Personally I trust Android as much as I'd trust iOS... Which is to say I expect the government can get at either with physical access but only at the highest levels of government (CIA/NSA/FBI).

True. But Play Services is effectively a part of the OS (from Google's perspective). As you say, in both cases (iOS and Play Services) it's a commercial closed-source bundle. shrug I don't personally spend time worrying about that, given that Google and Apple's code is probably better reviewed than some random open source app, but some people like to nerd out about such things. As you say, the FBI was eventually able…

Totally agree with you. I like my Nexus 5x a lot. I figure that usually it's the highest levels of government who are actually willing to pay a sum like that though. I doubt the local PD is willing to dedicate 1mil to cracking a phone if you get arrested for possession of a controlled substance or something.

And it's kinda an unspoken goal of mine to, ya know, not end up on a CIA watch list. Now I know some of the concern goes around controlling so the Government doesn't get out of control but I think that we would expect a government's worth of resources able to do something as trivial as cracking a commercial phone.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#226

Post by sqeaky »

lvh wrote: post #209
sqeaky wrote: post #199

Earlier quoted context omitted.

I don't see how this goes from one to the other. It seems that just about every Android and iOS device can be part of an "easy dragnet" without any app installed. If the wikileaks article is correct about the CIA having kept multiple 0-day exploits hidden for each OS, then breaking anything even remotely is a work ticket and not a research project for them. The fine distinction of one app being singled out sucks, but…

You made a specific claim: no app, easy dragnet, work ticket level, because tons of hidden 0days. I'm taking it as read that a publicly patched one doesn't count. Is there evidence for that claim in the actual documents? Pending that, here is evidence of a counter claim. I'd repeat what tptacek said, but he's whittled it down better than I could: https://news.ycombinator.com/item?id=13811541 To cite Tony Arcieri, the…

I haven't gone through all the documents but the summary does say verbatim:

> dozens of "zero day" weaponized exploits against a wide range of U.S. and European company products, include Apple's iPhone, Google's Android and Microsoft's Windows

The only presumption on my part is that they are remotely exploitable, which is practically a requirement for mobile device exploits to be useful because physical access is hard to obtain. I do plan on going further through these, they look fun.

Of course encrypted communication is better for the user than unencrypted, but this is not the place for that, which is why I ignored it. This was supposed to be a discussion about massive government overreach, not petty squabbles between apps. With unfettered access to these phones there are all manner of hypothetical attacks that could go after any of these app providers and not just snoop on the communications of the users. With root access to a large number of phones and little oversight their capacity for harm is frightening, this seems more worthy of discussion.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#227

Post by libertymcateer »

bitmapbrother wrote: post #216
libertymcateer wrote: post #180

Earlier quoted context omitted.

These ones? https://www.washingtonpost.com/world/national-security/wikil...

Why not point to the actual ancient exploits from circa 2011-2013 for Android versions below 5 and Chrome versions below 40? https://wikileaks.org/ciav7p1/cms/page_11629096.html

Thanks for the link. So then is the assertion that the relevant hacks are all for older versions of Android? How does that comport with the current batch of hacks?

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#228

Post by libertymcateer »

md_ wrote: post #192
libertymcateer wrote: post #175

Earlier quoted context omitted.

For serious, thank you for taking the time to engage. I do take this seriously.

Yep. Same. And I would probably have posted a longer and less confrontational explanation of why you're (mostly) wrong if I weren't tired after a long day of work. ;) The whole "why not encrypt local resources" thing is an odd red herring that a lot of (even fairly experienced) people trip over. There was a massive public furor over Chrome's chrome://settings/passwords (i.e. lack of a master password) design choice a…

This argument is almost exactly what I was on about. I'd love to see some summary of it and why they came down where they did.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#229

Post by libertymcateer »

libertymcateer wrote: post #223
nikcub wrote: post #219

Earlier quoted context omitted.

It isn't the login password but the message password - although using sha256 for a login password isn't great either if you're doing aes(plaintext, sha2(password)) = cyphertext given cyphertext I can get to plaintext with sha2(8-char dictionary) well designed systems will generate a truly random key there, exchanged using public-key. if you're going to use a password, you need a key-derivation algorithm this is all b…

> this is all bunk tho since the big vulnerability here is that you're delivering the encryption routines via javascript in a global browser space So what about mailvelope?

Nm, I understand your point, and yes, no contest. The extension is being broken up and will communicate with the environment on the tab with sent messages, rather than just injecting the whole content script. I hear your point loud and clear.

Re: WikiLeaks Releases Trove of Alleged C.I.A. Hacking Documents

#230

Post by lvh »

sqeaky wrote: post #226
lvh wrote: post #209

Earlier quoted context omitted.

You made a specific claim: no app, easy dragnet, work ticket level, because tons of hidden 0days. I'm taking it as read that a publicly patched one doesn't count. Is there evidence for that claim in the actual documents? Pending that, here is evidence of a counter claim. I'd repeat what tptacek said, but he's whittled it down better than I could: https://news.ycombinator.com/item?id=13811541 To cite Tony Arcieri, the…

I haven't gone through all the documents but the summary does say verbatim: > dozens of "zero day" weaponized exploits against a wide range of U.S. and European company products, include Apple's iPhone, Google's Android and Microsoft's Windows The only presumption on my part is that they are remotely exploitable, which is practically a requirement for mobile device exploits to be useful because physical access is har…

The documents do not mention encrypted communications; that same summary editorialized them in.
Post reply on HN