Hacker News Reader

Comment by mithrilskeleton | Hacker News Reader

why would anyone use this over something like signal?

The devices do more than signal since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription

Most of these hacks are the equivalent of hacking signal and backdooring the software

This shit is hard especially when LE is determined, but criminal syndicates aren’t dumb and hire a lot of smart people

> since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription

That is, do a bunch of crap that will immediately make you stand out to any modern (by which I mean, total) surveillance agency. The syndicates' problem isn't stupidity but immodesty – typical of organized crime. They thought they were, not smart, but the smartest, and that made it easy for other criminals to sell them garbage security products.

From a network perspective it’s indistinguishable from a 4G hotspot

The devices are also heavily rotated, they can also have IMEI numbers updated

To date with all of the public breach details it’s always been humint that lead to the networks being taken down

> From a network perspective it’s indistinguishable from a 4G hotspot

Not exactly, because that would depend on how competent the network is. For a "dumb" network yes, they won't know whether it's a 4g hotspot or not, but it's conceivable that an all-knowing adversary (eg. NSA) can infer the make/model of the phone based on fingerprinting or even the IMEI.

Except the NSA is not interested particularly in criminals. Their job is national security, not law enforcement.

Kinda true. If they are talking the truth, they said they could see the phones turning on around the harbor of Antwerp, Rotterdam and in Colombia. The 3 key points for probably 50% of europe's coke. How that they can see them being turned on might be something to do with your comment.

Why would you work at a criminal syndicate where you could just work in big tech with these levels of skill? These syndicates would have to pay $1 million /yr minimum to justify the risk.

Depends on the cirumstances. For example, if you have a criminal record, some of big tech is quite a bit less interested in talking to you. Criminal syndicates, obviously, don't consider a criminal record a deal-breaker.

good point

also you might have family and community ties to some of these people. They might groom you since you are an early teen.

When I was 13 for sure being the hacker in a crime organization would have sounded somewhat appealing.

I imagine they have way better office parties.

A requirement to be involved in narcotics distribution is inability to think things through very carefully.

Or a lack of other viable options. I would agree with your comment on the whole though. Typically doesn't end well.

So this puts an absolutely huge amount of trust in one place (the Sky ECC) company. A single point of failure that can control and have access to everything if it goes rogue. Surely just having some internally maintained ROMs with Signal/Telegram/Riot/OTR and your own process for procuring and cycling burners would be better if you have the money and resources?

How do they hire talents? You can make lot of money legally if you’re a smart person in tech, I guess they have to offer either ridiculously high salaries, or something else?

Convenience. Why bother with stuff like, say, validating your Signal "safety numbers" to ensure that you are actually talking to your contact and not the police? Instead, just farm out all the boring detail to someone else and buy a "secure" phone for $1-$2k. Unfortunately, at that point you are no longer effectively end to end.

There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers.

To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed.

[1] https://securityaffairs.co/wordpress/57036/cyber-crime/black...

At a guess - flashier marketing sold to consumers who don't know better.

Another likely scenario, people who do "underground" things prefer using not so popular tools to evade authorities but that may prove to have the opposite effect if they're not built robustly.

Reply on news.ycombinator.com