Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Code from the FBI’s Anom encrypted messaging app

vice.com

Post reply on HN
Print view View original

61–70 of 107 posts

Re: Code from the FBI’s Anom encrypted messaging app

#61

Post by londons_explore »

drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

How could it be done better?

I imagine for example, the protocol could be opensource and documented, and then the app-maker could be a different company than the server-owner.

The server-owner need not be trustworthy as long as the protocol is sufficiently reviewed.

The app-maker still needs to be trusted, but you can at least constrain the app to only communicating with the one allowed server and having no other network access.

Perhaps the server owner could also make a webpage showing all the people you have communicated with... That way a malicious client couldn't send your data astray.

Re: Code from the FBI’s Anom encrypted messaging app

#62

Post by Terry_Roll »

mike00632 wrote: post #45
richbell wrote: post #44

Earlier quoted context omitted.

Unfortunately Google is failing me right now. There was a case within the last few years where someone was convicted because their VPN provider was sharing raw traffic (not logs) with the government. If anyone knows what I'm referring to, please chime in. But given the existence of Room 641A[0], and other extra-judicial mass surveillance, I am confident in my assertion. Moreover, the explosion of VPN companies with l…

You're probably thinking of the big story from January of this year: https://www.pcmag.com/news/nordvpn-actually-we-do-comply-wit... NordVPN says they don't collect logs, but then it came out that they send information to law enforcement. So the big question is what information is being sent to law enforcement. Despite what NordVPN maintains, it seems like they do keep incriminating data about their users.

Maybe the vast majority of big companies listed on stock markets work for the govt, and the price of a CEO or board member keeping quiet is the income and wealth gained from these stock market listed entities?

Re: Code from the FBI’s Anom encrypted messaging app

#63

Post by londons_explore »

gabagool wrote: post #50
criddell wrote: post #28

Earlier quoted context omitted.

I wonder if Messages will be available at all in lockdown mode? If Apple can be compelled to build in surveillance (and it's not clear to me that they can be), then it really should be.

In a word, yes. > Messages: Most message attachment types other than images are blocked. Some features, like link previews, are disabled. https://www.apple.com/newsroom/2022/07/apple-expands-commitm...

Lockdown mode protects against bad snoopers, not good snoopers...

Re: Code from the FBI’s Anom encrypted messaging app

#64

Post by asdff »

drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

I don't know why radicals can't go back to physical written works and spoken word. No surveillance from someone sitting in a cubical 1000 miles a way at least. Suddenly the agency needs to spend a lot more money and effort to physically infiltrate your group and intercept written communication. It's worked for thousands of years, and the internet has not made it obsolete contrary to popular belief.

Re: Code from the FBI’s Anom encrypted messaging app

#65

Post by londons_explore »

concinds wrote: post #37
xoa wrote: post #7

Earlier quoted context omitted.

> We already know Apple has preserved a backdoor in the end-to-end cryptography of iMessage at the FBI's behest, as reported by Reuters. WhatsApp has always had the same backdoor (unencrypted backups to cloud services). The largest services are all unsafe for privacy. I don't agree with your characterization of that as a "backdoor" and I think that dilutes the term dangerously. There is no need to use Apple's backup…

I consider iCloud backups being enabled by default to be a backdoor to E2E encryption; however there's a "more real" backdoor in iMessage, which is that Apple can undetectably add new devices (i.e. an FBI iPhone) to conversations so that all forward secrecy is broken. This has not been fixed. https://www.wired.com/2015/09/apple-fighting-privacy-imessag...

Remember that the FBI really doesn't want to get caught nor does Apple.

So if you make a software package that monitors for "FBI iPhones" being added to your account, and make that available on github for other people to use, and have it send results back to a big web dashboard, then both the FBI and Apple would have to immediately stop for fear of being caught.

Such a package could be on Mac, where you have easy root access, because the e2e keys of chats has to be visible to all clients, not just iPhones.

Remember you only have to find one convincing case of Apple/FBI adding a phone to a users account without consent, and Apples privacy conscious reputation is ruined.

Re: Code from the FBI’s Anom encrypted messaging app

#66

Post by asdff »

oceanplexian wrote: post #53
drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

You also have to keep in mind that spreading FUD about secure messaging apps can be a type of manipulation, in some cases planted by the FBI. If you don't have confidence in say, iMessage, which is pretty secure, you might instead go for a "secure" messaging app that's actually a plant (Like Anom).

I would be bewildered if the FBI doesn't have a back door into every messaging app allowed on american cell phones. That being said there is one chat app that cannot be easily broken by the FBI: Pictochat on the nintendo DS. You would need an FBI agent with a nintendo DS searching for chat rooms in physical proximity to the communicators.

Re: Code from the FBI’s Anom encrypted messaging app

#67

Post by asdff »

jliptzin wrote: post #15

So what's the strategy moving forward? The operation clearly hasn't permanently solved crime, the next generation of organized crime bosses won't trust any apps to handle their secrets, so I guess their communication just moves offline again? Or maybe each develops their own methods in house that they know they can trust (such as shooting holes in a wall on call of duty)?

People who seriously need communications hidden are probably using espionage type tactics already. Put out a benign signal out in the public realm someplace, but your agents have the secret key that turns that seemingly irrelevant signal into an actionable message. Number stations are the famous example (1), but lets think in terms of 2022. Imagine you had an instagram page that posted a certain meme of interest at a particular time as the signal, for instance. Or a seemingly automatic discord bot operation. Or a reddit bot coming in at a certain time to automatically correct a common typo. Anything could be used as a signal. This form of communication imo is impossible to prevent by virtue of that, and people would be wise to use it if they are speaking of things that require such protections.

1. https://en.wikipedia.org/wiki/Numbers_station

Re: Code from the FBI’s Anom encrypted messaging app

#68

Post by mandelbrotwurst »

richbell wrote: post #44
l33t2328 wrote: post #38

Earlier quoted context omitted.

Do you have any examples?

Unfortunately Google is failing me right now. There was a case within the last few years where someone was convicted because their VPN provider was sharing raw traffic (not logs) with the government. If anyone knows what I'm referring to, please chime in. But given the existence of Room 641A[0], and other extra-judicial mass surveillance, I am confident in my assertion. Moreover, the explosion of VPN companies with l…

What does raw traffic that is not in the form of logs look like? Maybe you mean that they are streaming logs in real-time rather than sending log files in batches periodically?

You don't mean sharing raw traffic as in forwarding actual requests, I wouldn't think?

Re: Code from the FBI’s Anom encrypted messaging app

#69

Post by go_elmo »

asdff wrote: post #64
drawkbox wrote: post #2

> The code shows that the messages were secretly duplicated and sent to a “ghost” contact that was hidden from the users’ contact lists. Lots of "secure" messaging apps do this for intel and surveillance and not just the white hats. Other areas that "secure" messaging apps have holes in is the anti-spam/moderation systems that need to view messages and in the clients themselves who have access to the unencrypted cont…

I don't know why radicals can't go back to physical written works and spoken word. No surveillance from someone sitting in a cubical 1000 miles a way at least. Suddenly the agency needs to spend a lot more money and effort to physically infiltrate your group and intercept written communication. It's worked for thousands of years, and the internet has not made it obsolete contrary to popular belief.

Still easier to do it digitally and e.g. physically exchange digital encryption keys?

Re: Code from the FBI’s Anom encrypted messaging app

#70

Post by mintplant »

> The code itself is messy, with large chunks commented out and the app repeatedly logging debug messages to the phone itself.

[…]

> For this new analysis of the code, a source provided a copy of the Anom APK as a standalone file which Motherboard then decompiled.

This doesn't add up. The code snippets they show are decompiled obfuscated Java. But compilation->decompilation wouldn't have preserved comments from the original source code.

Sometimes Java decompilers spit out chunks of code they don't understand as commented-out sections for manual analysis. Maybe Motherboard is misinterpreting this output? And, yeah, decompiled Java is gonna be messy, especially if the compiled code was obfuscated, as looks to be the case here.

Post reply on HN