Judge Rules FBI Must Reveal Malware It Used to Hack Over 1,000 Computers
motherboard.vice.com
motherboard.vice.com
A few years ago we had a shitsplosion involving the BATF running illegal guns in order to "catch criminals", with the result that few if any criminals were caught and Mexican drug lords found themselves in possession of nifty new guns. AFAIR none of the major decision makers lost their jobs, let alone were prosecuted.
I wonder how much actual law enforcement purpose is behind these ops and how much of it is just a game of "let's see what we can get away with".
Philosophical purity is very appealing, but ultimately the justifications we use for why the law is the way it is only have to stand up long enough to convince most interested parties that we're doing the right thing.
When the law is influenced by societal consensus the legal system becomes a farce.
"the Constitution, or any text, should be interpreted [n]either strictly [n]or sloppily; it should be interpreted reasonably"
To criminalize it in all of its forms, is the same thing as criminalizing any sexuality. Perhaps one day we'll create an algorithm that can generate these images without anyone being involved -- does that sound distasteful as well.
At this point even artful depictions of a sexual nature are illegal, criminal offense.
That includes everyone. Women with the most neotenous traits are considered the most attractive in every human society.
I mean the deviant element of this is that it's all so taboo, I mean after all "think of the children" (tm). We should treat it as any other crime and try to do harm reduction.
The law is not a programming language.
We are supposed to be judged by people of our approximate age, origin, location, background, etc, to allow for a greater understanding of context.
Random jury selection is an abomination.
An artist accused of selling fake fraudulent paintings should be judged by a jury of artists, since these would best understand the techniques used to make paintings and could interpret the evidence to determine whether it was fraud.
Toyota cheating their emissions should only be judged by a jury made up of members of large car dealerships, mechanics, car repair services, etc. These would be best equipped to understand what exactly was done where in the pipeline, and interpret the evidence for or against them.
When a Goldman Sachs executive is accused of fraud, only other Wall Street investment bankers should be on the jury as these are his peers and the only ones who understand the complex financial instruments being used.
Beautiful comment.
I think that, while people do care for the victims, their main driving force behind their interactions is hatred of the entire group (both those who commit crimes and those who don't). Hatred they justify by the damage some do, but hatred that does not originate there. It is almost like there is some need to have a group painted as evil beyond any consideration, some group you can openly hate regardless of anything else which fuels it. This is one reason why I think support for treatment of non-offenders is so lacking (other than 'lock them up and throw away the key') and why people tolerate the police engaging in abuse of the very same kind to catch them.
And then, the small piece of my mind which loves a good conspiracy begins to wonder if this wasn't engineered as an constant backdoor into digital rights/freedoms. One only needs to look at laws greater than 60 to 100 years ago to see how vastly different society reacted (often there wasn't much care even when a victim was being directly victimized, especially if they weren't the child of someone white and well off).
The same way downloading pirated material creates a market for it, even if you download it for free and the providers don't get money from it (but are rewarded with scene creds)
- Vlad Tsyrklevich: http://tsyrklevich.net/tbb_payload.txt
- Gareth Owenson: http://owenson.me/fbi-tor-malware-analysis/
- My own analysis based on running it in PANDA: https://www.reddit.com/r/ReverseEngineering/comments/1jpln2/... (you can also get the recording of the shellcode executing and step through it here: http://www.rrshare.org/detail/26/ )
It's not big, and we have a pretty good idea what every piece of it does.
Of course, I suppose we don't know that the malware it used in this case is the same as the one in the Freedom Hosting case, so I guess it would be nice to compare and contrast them.
Like I said that might be for 5c and older or I might have completely invented that.
Every update is signed specifically to the device being updated.
Yes, it could be installed on any phone, but it would be useless on any other phone. And in order to modify it to work on other phones (even with source code) you'd need Apple's keys.
Once the backdoor/exploit is created and released, there's no securing it to where it will only be used on a single phone.
To put it another way – if it were in fact easy to patch memory at runtime, there would be no need for the jailbreak community to spend huge amounts of time and effort every new OS release.
See https://en.wikipedia.org/wiki/SHSH_blob, https://www.theiphonewiki.com/wiki/SHSH, http://www.saurik.com/id/12
Regardless, I think someone with expertise should be allowed to review any code developed by the government in such operations only to ensure it does not somehow violate the rights of innocents
It's really not that much of an issue. It makes things more fun.
I am curious about whether they developed the malware in-house or if they hired a contractor. Is there any information out there on this? I wouldn't be surprised if they cut out parts, which may hint at a particular contractor having developed the malware.
Also, I still do not understand why TOR Browser Bundle allows scripts by default.
The best diet is the one you can actually stick to. The best birth control is the one comfortable enough to use. The best anonymity software must be usable enough for Joe Average.
If the situation is high-stakes, TBB comes with NoScript installed. And you should probably get a burner laptop, do all your web browsing off TAILS, and randomly change your physical location.
You are absolutely correct about practicing good opsec, however I have to challenge the usability argument. TOR is already less usable due to many sites blacklisting TOR exits nodes and latency (although connecting to a hidden service is a better idea, and avoids the blacklisting issue. And yet hidden services tend to avoid the JS requirement as well). If Joe Average is willing to put up with that in order to stay anonymous, I'm sure Joe would be willing to disable scripts.
On the other hand, if Joe doesn't understand why having scripts enabled is a security risk, then this might be a better reason to have scripts off by default, anyway.
If he's up against the government, he's going down.
And the FUD about there the government being so competent that it's impossible to hide from them has to stop. It's just so entirely useless and devoid of reality. If you were going down, for example Snowden would be an unknown name to us.
The word "pedophile" should be defined as someone with a sexual attraction towards children. It doesn't describe behavior: people can choose to not act on the attraction, and many, invisible as they are, in fact do not. Also, the people operating and visiting that hidden service could have had other reasons for visiting. They are not necessarily all pedophiles.
Regardless, though, the term "pedophile" by definition is someone who is sexually attracted to children. There is no distinction about whether or not they actually committed a sexual act with a child. A person who commits a sexual act with a child is by definition a pedophile and a rapist, since children cannot legally give sexual consent.
Such as?
The Dutch rapporteur for sexual abuse summarized that it is estimated that about 20% of the people caught for possessing child pornography are actual pedophiles, meaning people with a persistent sexual attraction towards children: http://www.nationaalrapporteur.nl/Images/nationaal-rapporteu...
For all we know, the "operator" was just showing a dump of things he found on an abandoned site five years ago, and was not involved at all in the production, and had no intention to be. Or perhaps he applied the principles of the MPAA and pirated for free as much material as he could, and put it on his website for free so as to try to get viewers to stop paying the producers and supporting their crimes.
(Which, by the way, is a strategy I would recommend law-enforcement pursue if they take their own arguments seriously. Spend federal money on servers hosting free, searchable torrents and direct downloads of CP; perhaps restrict it to material produced at least 20 years ago, and strip out or change any identifying metadata, so as to avoid any semblance of supporting or encouraging the producers of the materials.)
If you want to make the case that the viewers are liable for supporting the production of child abuse materials, that's a specific claim that you would have to prove in any individual case. By no means is it to be assumed.
What you mentioned was "encouraging its distribution", not "its production". Still, I can't imagine why the former would be rationally considered criminal except insofar as it contributes to the latter (notwithstanding rhetoric about "re-victimizing our children every time it is passed from one person to another"--which is completely absurd unless the viewers encounter the victims in real life and mistreat them in a way they wouldn't have if they didn't see the video, which seems outlandish--I doubt if it's even possible to track down the real-life identities of the victims most of the time).
Is someone legally responsible for "liking" a child porn/terror/homeless beating video? Currently you are for the first case, sometime for the second.
Should "liking" or viewing criminal content be a crime? That's a tough question. It certainly encourages the production of such content (for money or karma).
- the website is run by someone unconnected to the original
producer of the videos, who doesn't know the website exists?
- the person hosting the website got the content years in
the past?
- the original producer of the videos is no longer doing such
things, perhaps is dead or has a life sentence in jail?
Also, if we allow motivations like, say, getting high ratings and prominence on a website (and, to be sure, I haven't heard that this website supported user ratings and stuff), how about things like fame and getting your name in the headlines? Even if you're presented in a negative light, I'm sure there's a fair number of criminals who enjoy the thought that many people are disgusted and horrified by them, because it makes them feel powerful to have affected them so. Therefore, should newspapers that publish stories about horrible criminals be considered liable for encouraging criminal behavior?I think anytime that question has come up, the answer has generally been "no". An example comes to mind: whether newspapers should publish the names of kids who have committed suicide, for fear that it would encourage copycat behavior. I think most newspapers do avoid that, but that's as a voluntary policy they adopt, and something that other newspapers would look down on you for if you did it--nothing like criminal liability. Likewise, some have suggested that widely publicizing terrorist attacks is helping the terrorists achieve their goals; but as far as I know, the media continue to publicize it extensively because it attracts a (paying?) audience. Laws criminalizing these things would probably be seen as a violation of the First Amendment.
Why are the media allowed to give criminals and terrorists nationwide infamy and attention, while a pervert is not allowed to give a CP site operator pageviews? I expect someone would argue that the media being allowed to report on everything is important, while anything pedophiles want is not important, even if it may give them a way to get their jollies without going out and doing things to real children. I have a feeling it's more about the political position of journalists vs that of perverts.
I think the arguments in favor of the prohibition of the possession or consumption of child pornography are rationalizations made up after the fact for the laws that already exist; that these arguments tend to fall apart under serious scrutiny, or to, if consistently applied, justify a much more authoritarian society than we have; that people make these arguments to defend their position, which they've chosen because of their emotions about pedophiles, which are generally unreasoned fear or hatred of a greater or lesser degree; that you see such intense hate against pedophiles because they're a convenient, safe target for hate, and some people love to hate, especially if they're contemptible themselves[1];
that this is so unreasoned that both laws and actual prosecution have fallen upon (a) drawn art of non-real minors [the U.S. Supreme Court struck down a law of this sort; other countries like Australia have not] and (b) minors sexting pictures of themselves [so now the laws are harming children, whom the law was allegedly meant to protect]; that people have probably been slower to propose and pass laws that don't charge sexting teenagers with CP because that goes against the unreasoning-hatred flow; and that authoritarians find the irrationally anti-pedophile mob useful for achieving their political ends, be it passing laws requiring ISPs to start filtering their traffic, passing over-broad censorship laws that happen to cover adult pornography or other things they dislike as well, justifying more extensive surveillance, or smearing anyone who opposes the above as being "pro-pedophile".
In short, I have a bad feeling about anyone who advocates measures against anyone who has not been specifically shown to have either abused children or knowingly encouraged anyone else to do it.
[1] Elsewhere in this thread, people have mentioned sex offenders getting beaten and killed in prison, and I googled a bit: http://www.foxnews.com/us/2015/02/16/ap-exclusive-sex-offend...
Because the idiot had chummed up with the gang, the gang was responsible for recovering their "respect" among the prison society by trying to kill the sex offender.
As long as a sex offender was an "independent" (not gang affiliated) and extremely respectful of everyone, most everyone would leave him alone.
Two exceptions to this rule (that I observed): Blacks and Hispanics. Black guys (and therefore gangs) tended to not see a sex charge as that big of a deal. Hispanics stuck together no matter what.
I learned this from a Netflix documentary.