Hacker News Reader

Comment by boosting7669 | Hacker News Reader

And yet a jury convicted him. This kind of thing is far beyond the comprehension of the common juror. Knowing what I know about computer security and how EASY it is to plant digital evidence without leaving a trace, even from thousands of miles away, I'd have to see video evidence of the defendant downloading the material as it happens before rendering such a verdict, especially if it's going to mean decades in prison.

View on HN

"Knowing what I know about computer security and how EASY it is to plant digital evidence without leaving a trace."

This right here is the conversation which needs to happen around this particular topic. In the security community the topic of forensic discovery of child porn tends to get a hand-wave because child porn. It's there so someone must be guilty. The fact is, it is trivial to plant such evidence on anyone's computer and honestly, if a computer is connected to the Internet, define ownership. Is your computer connected to the Internet? Then it's not your computer. Ever used public WiFi? It's absolutely trivial for someone to inject image requests which never get rendered, but which remain in the cache. This can be done en-mass without anyone ever noticing until someone's computer gets searched.

Based on digital evidence alone no one should ever be arrested, let alone convicted on these charges, but the fact is, to catch someone who is guilty is very difficult. Difficult to the degree that it should require video and/or photographic evidence of the perp at the computer looking at the images. Therefore it seems law enforcement and the justice system has decided that the easy way out is to just go with what's on the hard-drive. If a few innocent people get caught, no big deal, it's for the greater good.

This is utterly terrifying. What are some common steps to prevent this kind of "invisible" injection of images. If you're on private WiFi are you good to go? Any common tips to stay secure?

You can tell your browser to not download images: https://support.mozilla.org/en-US/questions/981640

This would disable all images, but that's what you want, because you can never tell if a site you're going to has been compromised and what content they're going to serve up until you've already downloaded it.

This doesn't completely solve the problem though, you'd also need to make sure you don't have Flash or Java, and disable SVG and CSS now that I think about it... plus an encoded text of an illegal image is still probably illegal, even if it's text-encoded, so, uhh... I don't know, it depends how paranoid you want to be.

If someone wanted to force you to have illegal data on your machine, there's almost certainly a way to make it happen if you're connected to the internet in any way. Hell, even gmail shows embedded images by default... and even if you didn't open the email containing the illegal content, you still have it in your inbox, so there's that...

This advice tends to be akin to the advise to disable JavaScript. Basically at this point why are you even on the Internet? Also, as you mentioned Flash, Java, and especially SVG. The only real mitigation here is full drive encryption with a long passphrase which you'll never give up. Of course in the eyes of the courts and public that's a serious double-edged sword because you are assumed guilty at that point.

This is a good argument for Full disk encryption with a vpn and dns leak protection. You're right about people using encryption too. They have a whole playbook dedicated to targeting encryption(physical access is page one).

Don't use insecure WiFi networks, or if you do, use a VPN. That prevents you from getting these images injected by people sitting near you on the same network.

And don't visit web sites controlled by people who would do this, or linking to ad networks controlled by people who would do this. That's a little more out of your hands...

One, I don't know anyone who doesn't use non-secure WiFi networks & even if they don't, they typically still do without knowing, ergo., the 'attwifi' situation. Two, I've reviewed a number of VPN solutions over the years and they are far from perfect. Amongst some of my more notable findings:

1) Banner / update text delivered via HTTP to the client in a fully renderable state within the VPN client. Yeah, that was a fairly common issue many years ago and could be used to hijack the application UX to ask the user for things like their password.

2) Split tunneling. Some VPN providers will send HTTP traffic through the VPN while sending HTTPS traffic out the hostile leg of the VPN. This is cool and all until you use an application which doesn't properly validate the server public and then boom, a bad guy can get in the middle. Over the last half decade I've reported said flaw (failure to properly validate the server public) to over three dozen financial institutions, a couple anti-virus companies, and a major automotive manufacturer. It's real, it happens. Not to mention the Superfish and related situations.

Three, femtocells. Even if a bad actor can't get to someone's mobile computer (phone) via WiFi, they sure can by forcing it to negotiate a vulnerable cellular protocol and simply inject from there.

Can you elaborate on the femtocell vector and mitigation strategies?

Here's a good intro:

https://webcache.googleusercontent.com/search?q=cache:7r-Vd2...

Mitigation? Effectively none for end-users. You can always monitor your connection and if you go down to 2G, run. But no one does that. You can also test each and every app on your phone to ensure:

a) It's using HTTPS for every request / response which is rendered in the app & b) It's validating the server public. This one's easier said than done and well beyond the capabilities of most pen-testers. They might think they have it covered but rarely test for all man in the middle conditions.

I've not looked at it in detail, but someone I know tried out Network Signal Info on Android claiming it could help detect a femtocell attack:

https://play.google.com/store/apps/details?id=de.android.tel...

However, they didn't really know what the app was telling them and kept accusing me of running a femtocell so I wasn't impressed. As far as I'm concerned it's an interesting app to use in attempting to get a confession out of someone you are pretty sure is running a femtocell but likely if that person is running a femtocell they wouldn't "fall for it."

Boot from read only media, or mark your partitions read only. If you boot from CD you can copy-on-read to RAM to keep things snappy. Or PXE booting a Unix / Plan9 workstation.

I set my networks up so that I never rely on a terminal machine for storage. If I lose my laptop all I lose is my laptop.

If I want a file to be stored permanently, I have to action it - Nautilis will mount remote file systems over ssh, I use that feature when creating & editing documents. I don't create them on the laptop.

Other stuff gets mounted/linked in /dev/shm if needed

I can flip ro/rw on partitions for doing updates or anything I really need to write to HD.

I don't do it for privacy reasons, just data loss protection.

How hard would it be to do a demo for jurors in a courtroom? Simple proof-of-concept getting all of them to connect to a "wifi" network which is a tethered device owned by the lawyer, have them navigate to a regular website, and then inject images for the 2nd go-around to introduce reasonable doubt?

Trivial. The way to do this in a courtroom is to demonstrate it to the judge and jury by having a reputable forensics expert certify a computer is free from kitty pictures. Then have the judge connect that computer to a "Free WiFi" network to be used for the demo and have them go anywhere. Just start randomly browsing the Internet. Meanwhile, use an intercepting proxy like The Burp Suite, Fiddler 2, or Charles operating transparently (ergo., port 80 is routed through the proxy) and in every HTTP response replace the close HTML tag with a bunch of 1x1 sized images of kittens playing with yarn or something. After about five minutes of browsing, have the forensics expert look at the computer again and nail the judge for looking at kittens. Using an intercepting proxy which allows scripting, the whole thing could even be done in a way which would very much look like the judge was seeking pictures of kitties playing with yarn, right down to search engine queries. The last time I looked, not a lot of search engines implement cross site request forgery (CSRF) tokens for the entry of simple search terms. It's not like setting up a demo like this is even tough. At most it's a couple hours of work for a basic functional demo.

UPDATE: For anyone claiming the forensics expert would find the tampered markup, the no-store cache directive pretty much takes care of that. For all tampered requests, just set the cache directive in the header to no-store and per the requirements of the RFC, the HTML will not be cached to disk. Also, I've encountered very few forensics experts who understand the web enough to grasp what can and cannot be done via the browser.

If you wanted to do evil, the NSA has already showed the ability to use the "quantum intercept" (return a response before the initial server does).

No need to even have the power of proxy if they are using bare http.

> 1x1 sized images of kittens playing with yarn

Here's a 1x1 image of this you can use. The yarn is actually very small, clear, monofilament fishing line, but I think it's a nice picture:

http://commons.wikimedia.org/wiki/File:Blank.gif

>to catch someone who is guilty is very difficult. Difficult to the degree that it should require video and/or photographic evidence of the perp at the computer looking at the images.

That would be very easy to fake too.

I would argue that it's orders of magnitude more difficult by way of comparison to simply injecting naughty bits into an HTTP response.

In the US, juries are not required to follow the law:

SOURCE: https://en.m.wikipedia.org/wiki/Jury_nullification

RELATED TEXT: "A jury can similarly unjustly and illegally convict a defendant on the ground of disagreement with an existing law, even if no law is broken (although in jurisdictions with double jeopardy rules, a conviction can be overturned on appeal, but an acquittal cannot)."

I don't understand how this is relevant to my comment. Please explain

Your comment appears to me to assume that if a jury knew someone was not guilt by law, that they would vote not guilt. My point is that a jury in the US can intentionally convict someone as guilty that they're aware is "legally" not guilty.

They can also intentionally acquit someone they know is guilty of the law simply because they don't think the law should exist, this is called jury nullification. My point was that the typical jury is just not sophisticated enough to understand how easy it is to plant digital evidence. I doubt they'd convict in a case like this believing the defendant to be innocent.

Attitudes 20 years ago:

"Child porn? Fry him!"

Now:

"Child porn? The government set him up."

Obviously attitudes towards child pornographers hasn't changed, so check out how much the distrust of government has become constant and near absolute.

Thanks, Snowden.

Most people stop listening at "child porn". All the prosecution has to do is say a scary word and it's all over.

Isn't mere possession illegal in the US? If so then the jury returned the correct verdict. If we don't like it then we have to fix the law.

If the evidence was planted, then the jury most certainly did not return the correct verdict.

Legally? I wonder. Morally you're right, but if mere possession is illegal, then I don't see how it being planted matters.

If it were proven that law-enforcement agents did the planting, that would be a different matter. You could also argue about the definition of "possession", maybe... but IANAL.

Of course it matters. Federal law specifies that the CP must be knowingly possessed. If it was planted that requirement cannot be met. https://www.law.cornell.edu/uscode/text/18/2252

The court can't read the mind of the accused. So either there is an implied level of guilt associated with mere possession or it would be impossible to ever get a conviction under that part of the law.

I now agree that the "they planted it" defence would work but in practice that would be impossible to prove, which was probably what happened here.

Reply on news.ycombinator.com