Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code from the FBI’s Anom encrypted messaging app

vice.com

Post reply on HN
Print view View original

51–60 of 107 posts

Re: Code from the FBI’s Anom encrypted messaging app

#51

Post by SheinhardtWigCo »

drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

All E2EE does is keep the general herd of users safe from malicious insiders and script kiddies. It's valuable but doesn't make these apps worthy of the catch-all "secure" descriptor.

For anyone worth targeting, there are so many options available to actors with moderate resources. They will pwn your OS with an RCE exploit; or interfere the next time you update that "E2EE" app via Google or Apple's servers; or your laptop will take a few seconds longer to reappear at airport security; etc.

Marketing messengers as "secure" because they use some derivative of the Double Ratchet is like your bank saying your funds are secure because their website uses TLS.

Re: Code from the FBI’s Anom encrypted messaging app

#52

Post by armchairhacker »

jliptzin wrote: post #15

So what's the strategy moving forward? The operation clearly hasn't permanently solved crime, the next generation of organized crime bosses won't trust any apps to handle their secrets, so I guess their communication just moves offline again? Or maybe each develops their own methods in house that they know they can trust (such as shooting holes in a wall on call of duty)?

> the next generation of organized crime bosses won't trust any apps to handle their secrets, so I guess their communication just moves offline again? Or maybe each develops their own methods in house that they know they can trust (such as shooting holes in a wall on call of duty)?

Organized crime is smart but even smart people can be dumb. They were dumb for trusting a random app and not using in-house or at least looking at the source code in the first place.

And as someone else noted, if they just decide to go completely online that’s going to be much harder

Re: Code from the FBI’s Anom encrypted messaging app

#53

Post by oceanplexian »

drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

You also have to keep in mind that spreading FUD about secure messaging apps can be a type of manipulation, in some cases planted by the FBI.

If you don't have confidence in say, iMessage, which is pretty secure, you might instead go for a "secure" messaging app that's actually a plant (Like Anom).

Re: Code from the FBI’s Anom encrypted messaging app

#54

Post by kube-system »

jliptzin wrote: post #15

So what's the strategy moving forward? The operation clearly hasn't permanently solved crime, the next generation of organized crime bosses won't trust any apps to handle their secrets, so I guess their communication just moves offline again? Or maybe each develops their own methods in house that they know they can trust (such as shooting holes in a wall on call of duty)?

Making crime more difficult to get away with is a deterrent to participating in crome.

Re: Code from the FBI’s Anom encrypted messaging app

#55

Post by kube-system »

jeffbee wrote: post #10
sneak wrote: post #3

> Last year, the FBI and its international partners announced Operation Trojan Shield, in which the FBI secretly ran an encrypted phone company called Anom for years and used it to hoover up tens of millions of messages from Anom users. What other services might be run, controlled, or surveilled by the US investigative authorities? What other services might have operators that can be extorted or blackmailed by those…

> What other services might be run, controlled, or surveilled by the US investigative authorities? Any service that is marketed to you as privacy- or security-as-a-service, or software sold as privacy- or security-enhancing, is virtually guaranteed to be secretly working against the interests of its users. You can't buy security or privacy in the form of software or services, because privacy and security are a set of…

If you buy your privacy services for $9.99/month from a sponsored ad in a YouTube video, then yeah.

If you are willing to spend 6+ digits, there are absolutely good solid privacy products/services you can get. These folks aren't catering to individuals or street criminals, though.

Re: Code from the FBI’s Anom encrypted messaging app

#56

Post by jeffbee »

kube-system wrote: post #55
jeffbee wrote: post #10

Earlier quoted context omitted.

> What other services might be run, controlled, or surveilled by the US investigative authorities? Any service that is marketed to you as privacy- or security-as-a-service, or software sold as privacy- or security-enhancing, is virtually guaranteed to be secretly working against the interests of its users. You can't buy security or privacy in the form of software or services, because privacy and security are a set of…

If you buy your privacy services for $9.99/month from a sponsored ad in a YouTube video, then yeah. If you are willing to spend 6+ digits, there are absolutely good solid privacy products/services you can get. These folks aren't catering to individuals or street criminals, though.

You're falling for the exact same fallacy as the dipshits in the article fell for. The FBI was selling the ANØM "service" for $4000 per phone per year.

Re: Code from the FBI’s Anom encrypted messaging app

#57

Post by legalcorrection »

drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

>Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats.

That's a broad claim. Do you have specific examples?

Re: Code from the FBI’s Anom encrypted messaging app

#58

Post by kube-system »

jeffbee wrote: post #56
kube-system wrote: post #55

Earlier quoted context omitted.

If you buy your privacy services for $9.99/month from a sponsored ad in a YouTube video, then yeah. If you are willing to spend 6+ digits, there are absolutely good solid privacy products/services you can get. These folks aren't catering to individuals or street criminals, though.

You're falling for the exact same fallacy as the dipshits in the article fell for. The FBI was selling the ANØM "service" for $4000 per phone per year.

That's a couple orders of magnitude below the bar of what I am referring to.

I agree, if you're a person with a serious targeted privacy threat, and you think there's a magic bullet, you're kidding yourself. Any serious data privacy solution is going to involve a ton of associated meatspace solutions beyond buying one SKU and calling it done.

Re: Code from the FBI’s Anom encrypted messaging app

#59

Post by MattJ100 »

danielschonfeld wrote: post #46
xt00 wrote: post #21

I wish somebody would create some scheme to like self host the backend of an app.. like you launch Signal and it has a button to type in the name of your own server, where that server runs a VM that you configure and setup on your own PC locally then upload to AWS or something and has some facility to constantly report to you the hash of the memory and disk contents, along with some contract from AWS that states that…

There’s plenty of that stuff. Jabber and XMPP. And also more up to date is Matrix.org which nobody seems to want to use and I’m not sure why. The problem though is that you’re still trusting the code. Nothing stops self hosted from rotting on you unless you look and read the code yourself.

In case anyone is in doubt after reading your comment, I want to clarify that XMPP is "up to date" and has an active community and ecosystem of software projects, open-source and commercial.

Matrix is similar in many ways, and certainly younger, but also has a vastly different design at the protocol layer. It's more akin to a distributed JSON database/log, while XMPP is more focused on message routing and synchronization. Therefore each has different strengths/weaknesses for different use cases.

Despite these differences, both protocols indeed have IM apps and a whole lot of other software built on top of them.

Re: Code from the FBI’s Anom encrypted messaging app

#60

Post by Terry_Roll »

l33t2328 wrote: post #38
richbell wrote: post #25

Earlier quoted context omitted.

> Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Lots of VPNs, too! "We don't keep any logs! We just pipe a direct feed to the government so they can keep logs!"

Do you have any examples?

So one way you can identify VPN traffic is to slow the vpn connection temporarily between the target and the VPN server, whilst observing the connections coming out of the VPN server, spot the slow connection coming out, you then its possible to identify where the VPN traffic is heading! Its just traffic shaping.

Think of it as just monitoring vehicle movements on a road network which cross borders, you cant see the contents of the vehicle, but you can see where they are heading back and forth multiple times, and thus work out what they are upto, even if the destination is a cloud server!

The article also shows that the network carriers, land line and mobile network carriers many of which are stock market listed dont monitor the networks to protect their users, thus do they fail in their duty of care? I think many victims of crime could have a case, it wouldnt be hard to spot whats going on for them, in much the same way the postal service can tell whats going on when people deliver drugs through the postal system, or supermarket loyalty card schemes can highlight changes in their customers which can indicate health issues. The lawyers and judges probably wouldnt be able to understand it, in much the same way people cant understand quantum physics, so is there a case to bring?

Everyone gives away metadata, if you know what to look for, the crime is the current setup of society benefits a privileged few!

Post reply on HN