Cyber Spying Is Out, Cyber Lying Is In | Hacker News Reader

Cyber Spying Is Out, Cyber Lying Is In

foreignpolicy.com

50 pointsr72116 comments

I've found that in the same way a boyfriend or girlfriend who is overly jealous or constantly fears that their partner is cheating is likely to be the one who actually gets caught cheating, a government which starts to publicly fear a certain type of cyber attack has done it to someone else and are now worried about it coming home to roost.

It is mentioned in the article that GCHQ has a tool for changing the results of online polls.

aka "elections"…

"You know, comrades," says Stalin, "that I think in regard to this: I consider it completely unimportant who in the party will vote, or how; but what is extraordinarily important is this — who will count the votes, and how."

This is the way I look things also.

An anime series called "Ghost in The Shell: Stand Alone Complex" had something very similar back in 2004 or so. Batou: "I'm sorry but i had to hack your eyes pal.

41-second scene: https://www.youtube.com/watch?v=rAELp7OjvEg

Oceania was at war with Eurasia; therefore Oceania had always been at war with Eurasia.

Huh, if only there were some way to digitally sign and secure communications, perhaps some sort of... Encryption scheme could be used to ensure accuracy of information...

How do digital signatures solve the problem? The manipulator of the data just re-signs the new manipulated data. If you're suggesting that equipment (smartphones, DV cameras) sign their outputs, you still can't trust the signature-- How do you force the original signature to remain attached? How do you prevent anyone from faking some other device key and producing a new signature? This is effectively a problem related to the DRM realm, and DRM has failed to thwart pirates.

Leaps in logic to DRM and piracy aside, if you trust that you have the correct public key for a source, someone else's signature is not going to match the original key.

It's not much of a leap; both depend on trusting potentially attacker-controlled devices. If my sensor drone signs reports it sends back a remotely exploited drone could send back validly signed tampered data.

Exactly.

It's not a sheep vs. goats problem, where you just have to ID those bad machines and block them.

It's a defector problem. Any 'legitimate' machine can join a botnet at any moment, along with all the permissions and trust you vested it with back when you approved of whatever it was doing.

There was this interesting book by Mark Russinovich called Trojan Horse that dealt with the exact scenario. There was malware that got around the digital signature by altering the file in memory before signing and uploading to the email client.

I've gotten the impression that the NSA has their thump on the standard web of trust surrounding certificates.

Now if we combined IP addresses and public keys so they were one and the same we might be onto something.

That's essentially how Tor Hidden Services work. The private key is used to generate the public key (and the hash of that key). The hash is the onion address used to access the hidden service. Quite a clever combination.

Tor Hidden Services, I2P eepsites, CJDNS addresses, etc...

Reply on news.ycombinator.com