Hacker News Reader

Comment by bitwize | Hacker News Reader

> Now that the workings have been revealed, An0m is a trick that could surely never be repeated in the world of organised crime. The revelations will push criminals away from technology, even if it makes their work more laborious and slow-moving.

I can imagine future organized crime information flows more closely resembling what was depicted in John Wick: a lot of secretaries and file clerks pushing paper around, using old mechanical adding machines and typewriters; if they do touch a computer, it's a VIC-20 or similarly ancient, internet-incapable device.

View on HN

That sounds like it would be a big win for law enforcement. If you can force your opponent to avoid some modern ways to communicate, you can put a big dent in their efficiency.

It's possible that paranoia might lead to criminals avoiding even technology that they could be using safely, further slowing them down.

An old fashioned system also seems like it would require more people, opening up more opportunities for human intelligence operations targeting the network.

Or they could learn to use Signal.

Properly installed (F-Droid) on off-the-shelf phones with fresh prepaid sims and OS updates disabled, it can be considered secure software against all but the most sophisticated adversaries.

Then, simply verify the handshake key for your contacts, and you can be sure there is no man in the middle attack. Rotate phone+sim every 2 months, while keeping the same "outside" number, say, a landline you control.

There are attacks against this too, but they are very noisy (modify all Signal binaries delivered to a certain area) or typically exceed the technical capabilities of run-of-the-mill agencies (exploit an OS zero day).

The easier way to attack this is by instituting a know your customer law for phone systems including prepaid SIMs, combined with accomplice charges for anyone who's SIM is used in connection with criminal acts.

People are too free with their phones. Just walk into a bar and say you're too drunk to drive and could the bartender call my wife to pick me up? Not knowing its actually picking up $60M worth of coke instead of picking up me.

Or pull off to the side of the road, walk in well dressed, wave a dead iphone in front of them, ask the receptionist "hey my car broke down and my battery is dead, could you call this number and tell them my car broke down?" Or bonus points if the cops arrive because you're blocking traffic, ask the cop to call on their phone.

(edited I got the best idea that most anyone would fall for: Slip a kid $20 to ask an adult to call his mommie because he got lost...)

That's a function of there not being penalties. You'd see that change if the laws changed.

Penalties for what exactly, here?

Good Samaritanism?

The whole thread here is about penalties for assisting criminal enterprises with a SIM tied to your identity.

And if I place a call for someone on good-faith belief that they need assistance?

I don't get where your point is leading or coming from.

Let's back up a bit here.

What specifically in this comment would you penalise?

https://news.ycombinator.com/item?id=28620403

And how would you address the issue of people being good sams --- making calls on behalf of someone else when they ask, in good faith.

See for example RMS:

When I need to call someone, I ask someone nearby to let me make a call. If I use someone else's cell phone, that doesn't give Big Brother any information about me.

https://stallman.org/rms-lifestyle.html

> What specifically in this comment would you penalise?

One comment up from that I said:

> The easier way to attack this is by instituting a know your customer law for phone systems including prepaid SIMs, combined with accomplice charges for anyone who's SIM is used in connection with criminal acts.

~~~~~~~~~~~~~~~~

> And how would you address the issue of people being good sams --- making calls on behalf of someone else when they ask, in good faith.

Prosecutorial discretion.

And to be clear I'm not pushing for these laws; I think they're awful. I just see it as a clear direction that .gov is going to go if they feel the need to that's easier than maintaining zero days for general law enforcement. The ability to actually tie phones to personal identity in a way good enough for a court room.

Penalisation under a "KYC" law would have to be extreme.

And I suspect there'd be all kinds of challenges to such a requirement.

Again, the Good Sam loophole is huge.

> Penalisation under a "KYC" law would have to be extreme.

Yep. It would have to be enacted in the kind of furvor like existed around 9/11. But, the PATRIOT act had been floating around DC for years before 9/11 too.

> And I suspect there'd be all kinds of challenges to such a requirement.

> Again, the Good Sam loophole is huge.

In the US, it really isn't. It's a patchwork of state and local laws that could absolutely be invalidated by the feds in the case of a global communications medium like the phone network, since that implies interstate commerce.

By "huge" I mean that the plausible set of circumstances in which someone loaned out a phone for a call is large.

It's one thing to put leverage on the already marginal. Another to haul upstanding citizens off for offering a stranger a phone call. Resistance would be huge. No matter how weak any perceived legal shield would be.

This is all well and good for communicating a single, pre-planned operation, but you're going to need to communicate a lot more in order to actually do all that pre-planning for it.

That doesn't really work in practice. All it does is raise the price of black market sims by a fixed, low dollar amount, that is irrelevant for criminal operations willing to spend thousands of dollars for secure coms.

Think about it: unless you distribute SIMs at the local police station, your last mile enforcement officer is just some guy in a kiosk making minimal wage. Assuming he is motivated by law to do his job right, and photocopy IDs etc., he's still untrained to spot fake ones, unwilling to make a ruckus if the customer face does not really match the ID etc.

All it takes is one rogue distributor or some homeless guy, and you will have thousands of SIMS that can't be traced. Then you have anonymous roaming sims for people willing to pay the data roaming fees.

It's a friction, not a silver bullet.

> Properly installed (F-Droid) on off-the-shelf phones with fresh prepaid sims and OS updates disabled, it can be considered secure software against all but the most sophisticated adversaries.

IMEI will identify the phone.

Signal does not work well without GCM.

You can easily identify the phone of the target by physical surveillance coupled with Stingray type of cell traps. No need to bother with IMEI, plain cell number which you will then intercept with operator support.

So you will prove the target uses a phone, and that phone connects to Signal servers or some offshore VPN. That's not very useful.

The quest is to access communication contents, or map out a criminal network that can then then lead to identifying other physical locations of terminals and unknown members of the ring.

Its harder to erase paper trails, so I think the future of crime is using open source or in-house comms tools.

Fire, judiciously applied, can erase paper trails rather efficiently.

And evidence of burning possibly indicting evidence is all the more indicting.

This is what document-retention-and-disposal policies are for.

In major business districts throughout the Western world, document disposal companies will drive their collection truck to a given business address and shred the collected paper right there in the street as it's loaded into the truck.

You can see them everywhere.

You can hear them long before you see them.

Not unlike the FSB: https://www.rt.com/news/typewriters-russia-order-surveillanc...

Curiously, a similar organisation would bug same.

https://web.archive.org/web/20210730214414/https://spectrum....

https://archive.is/T16Fj

(GDPR-noncompliant cookie policy at origin.)

Besides criminals, even legitimate businesses might start to prefer offline methods. With the decline of privacy comes corporate espionage and that's no good for business.

Legitimate businesses can much more easily avoid being scammed by vendors because their legitimate businesses are protected by the legal system. They also can openly discuss their experiences with vendors, because they're not hiding from anyone.

How's that working out for victims of ransomware attacks or nation-state corporate espionage?

I've never heard of a business being scammed by a vendor through ransomware. When businesses choose vendors, they do it with legal contracts enforceable in their jurisdictions.

Vendor-based scams are not the entirety of the threat model.

Vendor-based scams are what this thread and this article is about. The root quoted that An0m was a 'trick' that couldn't be repeated again. My point is that legitimate businesses would have never had to worry about such tricks, being scammed by a vendor like this is a problem unique to illegal businesses.

OK, I see what you're saying.

Though I think there are actually at least two discussions being had here, apparently talking past one another:

One, that a vendor which promises some service but fails to deliver on it, as An0m did here, would be subject to civil claims for fraud or false representation. This seems to be your general argument.

Another is that any given business has concerns over surveillance and privac breaches, whether from law enforcement or other entities, and that any use of digial communictations and data systems exposes them to this risk. Paper-based systems have, of course, far lower capabiliies to data processing, but also to data exfiltration*.

Both are risks.

You're focused on one. Others take a broader view, myself included.

That's fair. But I still don't think the situation translates; businesses have significantly more options for mitigation and less downside risk. They're likely not going to prison if they have a data leak, and they have access to good information and the world's most reputable vendors for solutions to those problems.

Outside of exceptionally high risk (or exceptionally low revenue) businesses , I don't think many are going to choose to go back to paper. Although, we may see more systems being air-gapped, virtualized, or using other forms of isolation. The types of enterprises that could afford the labor cost of using paper can also afford the price tag on digital solutions that do a good job of mitigating those risks. Most breaches, ransomware attacks, etc are things that could have been prevented. Rarely do incident response crews say "this company couldn't have done anything to prevent this"

Additionally, legitimate businesses have customers that will demand that they use digital solutions. Criminals dealing with other criminals might be willing to use paper to mitigate risks. Customers of established B2B or B2C companies will not.

Reply on news.ycombinator.com