Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Australian Federal Police and FBI nab underworld figures using encrypted app

abc.net.au

Post reply on HN
Print view View original

71–80 of 361 posts

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#71

Post by simondotau »

JumpCrisscross wrote: post #67
michaelmrose wrote: post #9

Does anyone find it funny that each criminal group could have been better off relying on a "kid who knows computers" level of expertise and bog standard devices running open source software which at least wouldn't be trivially systematically turned against them all at once quite so easily.

> anyone find it funny that each criminal group could have been better off relying on a "kid who knows computers" level of expertise and bog standard devices running open source software which at least wouldn't be trivially systematically turned against them all at once quite so easily Tradeoffs. Traditional tradecraft would inhibit such discovery methods. But it's slow and expensive. Your competitors would outmaneuv…

Nothing wrong with inhibiting growth in return for long term stability. Does it matter if your competition is more daring—if they aren't going to last very long? If anything, they might serve as a useful distraction.

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#72

Post by spoonjim »

liquidify wrote: post #40
cdogl wrote: post #32

Earlier quoted context omitted.

I suspect that people don't fall into such neat categories. You could pose a similar question re: lawyers whose bread and butter is protecting and representing people associated with organised crime (the kind of individuals represented by Maury from The Wire or Neil Mink from The Sopranos). Are they lawyers who developed a slippery version of ethics & morality, or people with loose ethical standards who entered law?…

What? Representing criminals is not unethical or 'immoral'. Period. Protecting criminals legally is not unethical unless you are knowingly doing something illegal yourself. I imagine that most layers are just doing their job and getting paid for it. Bringing morality into that equation makes no sense in a legal system that has little to nothing to do with morality.

You don’t get to declare what is unethical by adding the sentence “Period.” after your claim. Ethics is a matter of opinion; I believe that knowingly aiding violent criminals is wrong; if you feel otherwise, that’s just like, your, opinion, man.

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#73

Post by andruby »

killingtime74 wrote: post #46
RachelF wrote: post #37

Earlier quoted context omitted.

Makes you wonder how many commercial VPN services are just FBI honeypots?

Or even foreign state actors

The FBI, from the viewpoint of 95% of the world, is “a foreign state actor”.

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#74

Post by marlor »

cromka wrote: post #59
flashman wrote: post #31

As to how the FBI got access to the messages, Vice says[1] after Vincent Ramos of Phantom Secure was arrested in 2018, a confidential human source offered Anom, which the source was developing, to the FBI (probably in exchange for immunity or a reduced sentence, in my opinion). The source then seeded Anom phones to his existing distributors as a replacement for Phantom Secure phones, and from their they made their wa…

So Vice says that an external source came to offer the app, while the Australian Police "said the plan to use an encrypted app was hatched overseas over a few beers with FBI agents in 2018, before police figured out how to decrypt all messages." I wonder how this all ties together. As someone mentioned here, there surely be some movie about it.

It’s likely the FBI mentioned they had an app they could leverage, Australia noted that there was a gap in the local market after Phantom had been taken down, and the two agencies decided to seed the app into the Australian criminal underworld to see how far it would spread.

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#75

Post by mardifoufs »

girvo wrote: post #49
michaelmrose wrote: post #9

Does anyone find it funny that each criminal group could have been better off relying on a "kid who knows computers" level of expertise and bog standard devices running open source software which at least wouldn't be trivially systematically turned against them all at once quite so easily.

For what it's worth: some do. Signal (and Wickr) are used extensively.

Yep, and for some reason wickr is Imo even more popular than signal in those circles. It's curious since I've basically never heard of wickr here or in any cybersec community & signal seems to be the daily messaging app for tons of people. I guess it's something to do with the phone verification required by Signal... and I'd guess both apps are pretty similar when it comes to security?

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#76

Post by CTDOCodebases »

cylde_frog wrote: post #14
Santosh83 wrote: post #7

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption clients. In addition, popular apps, especially in the US, can always be commandeered by 3-letter agencies. You're only anonymous as long as you're not actively targetted, despite using "secure" apps and stuff like Tor, which media makes it seem are unbreakable.

Not quite. They were using an app developed by the police as a honeypot. Someone else had even discovered this and blogged about it[0]. If they had used email and PGP they likely wouldn't have been caught in this way. 3-letter agencies are not going to use their trump card of backdoored OS or hardware to catch drug runners. [0] https://webcache.googleusercontent.com/search?q=cache:PwQXt6...

True.. however the three letter agencies are going to pass along any relevant information that they stumble across while filtering for money laundering in relation to terrorism.

[0] https://en.wikipedia.org/wiki/Parallel_construction?wprov=sf...

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#77

Post by nucleardog »

nexuist wrote: post #68
iJohnDoe wrote: post #26

Earlier quoted context omitted.

Not funny. Pretty much worse fucking case scenario. Imagine Signal, Telegram, or any other app that touts themselves as a secure app is really just the creation of the FBI, NSA, CIA, and NRO. Remember, yesterday’s conspiracy theory is today’s reality.

If you're not already operating under the assumption that TLAs have full access to your entire online history, there's really no point in trying to start now. Use secure apps like Signal to hide your information from hackers, thieves, and generic script kiddies, not to hide from national security agencies. Especially when said agency can send a van to your house to take all your digital equipment (fully legally if ba…

For a slightly humorous take on this, James Mickens' paper _This World of Ours_[0] is enjoyable:

> In the real world, threat models are much simpler (see Figure 1). Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere.

[0] https://www.usenix.org/system/files/1401_08-12_mickens.pdf

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#78

Post by dalbasal »

olalonde wrote: post #10
ferros wrote: post #3

Looks like the app’s domain was also seized. https://www.anom.io/

Funny how that form is essentially asking users to dox themselves. I wonder how many will take the bait.

"To determine if your account is associated with an ongoing investigation, please enter any device details below:"

Seems like they're flexing.

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#79

Post by lmm »

nexuist wrote: post #64
Santosh83 wrote: post #7

The lesson here is complete trust in modern computing platforms is misplaced and impossible. Your hardware has backdoors, so does your OS, and encryption clients. In addition, popular apps, especially in the US, can always be commandeered by 3-letter agencies. You're only anonymous as long as you're not actively targetted, despite using "secure" apps and stuff like Tor, which media makes it seem are unbreakable.

> Your hardware has backdoors, so does your OS, and encryption clients None of these were exploited to retrieve this data, and the third party app that was installed was not intended to encrypt conversations given that it was a honeypot. > popular apps This was a small app unknown by anyone outside of criminal orgs. It had no "legitimate" non-criminal users. > especially in the US The app was deployed in Australia. >…

Agree with most of what you said but:

> > especially in the US

> The app was deployed in Australia.

Australia has an even worse equivalent of US National Security Letters, allowing individual workers to be compelled to plant backdoors etc..

Re: Australian Federal Police and FBI nab underworld figures using encrypted app

#80

Post by lmm »

marlor wrote: post #13
ferros wrote: post #3

Looks like the app’s domain was also seized. https://www.anom.io/

It’s bizarre, because news reports state that the entire app and monitoring system was created by the FBI and Australian Federal Police. If it’s their system, why would they need to seize its domain?

If they were trying to get criminals to start using it, hosting it on the (seized) website of some reputable criminal organisation might have been helpful?
Post reply on HN