Crooks’ mistaken bet on encrypted phones | Hacker News Reader

Crooks’ mistaken bet on encrypted phones

newyorker.com

159 pointsjbegley187 comments

"Crooks' mistaken bet on false marketing claiming end-to-end encryption and offshore hosting by 2 different European communication networks that ended up shutting down due to police raids in 2020-2021" is a better title (or I guess just summary at that point).

This is a dumb slightly unrelated question by me. Say I was a "crook"/bad guy. Why doesn't "well done" AES/RSA/ECC encryption stop law enforcement from being able to "snoop" on what one crook says to another crook?

It does.

The standard playbook for rolling up criminal conspiracies is to arrest a low level member, offer him a reduced sentence in return for testimony, arrest the next guy higher up based on that testimony, etc. (The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.)

You will notice none of this requires communications intercepts. This is because the feds are simply lying when they say encryption prevents law enforcement operations.

> The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.

When properly done, such organization is almost impossible to find. I'd not be too sure about them not existing. The idea is well known, so someone must have tried it at least.

How would they recruit?

PGP recruitment drives

Refer a friend -> referral goes up the chain and back down to a different group?

Ah the infamous crossover: Cartel x MLM.

Now the friend knows two groups.

Only leaf groups, with very tenuous connections.

There was a Chinese drug lord operating out of Canada who did successfully pull off the cell structure. Amazon of Drugs or something.

Somehow they managed perfect forward secrecy.

For a while.

Here he is.

https://torontolife.com/city/this-man-is-the-jeff-bezos-of-t...

Not sure about never been done in real life - some of the Provos and Unionists in Northern Ireland pivoted their cell structures from terrorism to profitable crime when peace broke out.

Peace broke out?

It's a reasonable common idiom with tongue firmly planted in cheek.

(Btw, you've been shadowbanned a while ago. I'm only mentioning this, because your recent comments seem sane as far as I can tell.)

TIL.

I've only ever heard it on an episode of Monty Python. Wonder if it's just a UK thing.

I've heard it in other context, but those people might have picked it up (indirectly) from Monty Python.

Thank you. I know my comments are usually short, but I like to ask questions to learn new things. Appreciate you letting me know. I guess I need to try a new account.

You should email dang. I didn't bother to review your comment history, but if your new comments are avoiding whatever got you shadow banned, he'll probably give you another chance. Skipping that step, there's a very good chance your new account would get auto-shadowbanned as well.

Thank you again. I will give that a try!

It has never been discovered to exist. If it’s actually good it’ll defeat attempts to uncover it. An even better cell structure would be one where the cells don’t even know that other cells exist.

> An even better cell structure would be one where the cells don’t even know that other cells exist.

You can’t have a network with more than one cell where no one outside of the cell knows that it exists, and without those people using a communication method to people in the cell that at least one person in the cell knows exists. And when you minimize down to the minimum contact, the network is very much non-resilient: its hard to discover and roll-up, but (especially if the cells are doing high-risk functions, which is probably why you want to do it) its also easy to disintegrate accidentally, even without being discovered and rolled-up.

I think you -could- generate a network of cells where cells are independent and the communicator doesn't know the cells - broadcast your radicalisation on radio and let the cells organise themselves. At least one cell member knows about the communication method but since it's broadcast, I think that's safe (in this context.)

But practically there's a whole bunch of problems as you say - you've no idea how many - if any - cells exist, they can't coordinate on which one picks up a particular target, the communicator is obviously at risk from being tracked down, how do you tell people where the radio broadcast is, authorities can obviously listen in once they've found the broadcast, etc.

> "and the communicator doesn't know the cells - broadcast your radicalisation on radio and let the cells organise themselves. At least one cell member knows about the communication method"

Couldn't be done by sending messages encrypted with private key and the cells decode it with public key?

Then the problem is: How to trust public keys to have been provided by the "right" correspondent, and not someone from another gang or law enforcement?

Not trying to start an argument because I think your statements are mostly correct. I do think you can have autonomous actors inside of cell systems that can compose an entire cell. Especially at the lowest levels.

Cell systems have order, but only where the most risk is imposed. Lesser risk, less order. Infact, too much order imposes far more risk.

Well it's never been done in real life that we're aware of. Mostly because if it has been done, they almost certainly were not caught by traditional policing techniques.

Why would you even want to be in a conspiracy if you don't know anyone? You couldn't trust that it would work or you wouldn't be manipulated.

The Crips and the Bloods are kind of like that cell structure, but cells have internal beef all the time. If you had different cells have no communication, that would happen way more as they try to expand

That's not how cells work though. Cells don't know people in other cells. Well maybe one or two people do. Sure an internal beef can happen but the people in the cell are mostly still responsible for themselves not the others in the cell.

Think of a cell like a class in programming. If a class has a bug you can fix the bug, or make a new class with the same ins and outs. Never have to restructure the entire code base. Properly made classes don't leak to other ones. Worst case internal beefs take down prod for a bit but they don't take down the entire program

> Why would you even want to be in a conspiracy if you don't know anyone?

Perhaps you are in it for the ideology? Or perhaps they pay you?

> none of conspirators know each other,

"Why am I Mr. Pink?"

https://www.imdb.com/title/tt0105236/characters/nm0000114

Apple does this kind of secrecy well.

I suppose you're talking about development teams that have no knowledge about what other development teams are working on.

My sense is that it has become a bit more lax since Apple has grown and, well, let's face it, Steve is no longer with the company.

>The only way to prevent that would be a fully trustless "cell" structure where none of conspirators know each other, which has never been done in real life.

Or you just have your buddies enact violence on the friends/relatives of anyone caught squealing.

It does. The problem is that crooks aren't generally trustworthy, and selling you out is leverage they're very willing to use should the cops ever catch them. The same applies to every part of the illicit communications network you rely on - if any part of the trusted chain breaks down in a way that enables the cops to subvert your encryption you're screwed, right down to installing an OS update on your device.

Good opsec is exceptionally hard. If you aren't building it from scratch it probably isn't secure. And even if you are, if you're a big enough target for nation states to be looking you're still going to have a hard time.

> If you aren't building it from scratch it probably isn't secure.

And if you are building it from scratch, it is definitely not secure.

It's essentially a larger scale, legal version of https://xkcd.com/538/

None of these busts involved breaking encryption. They all involved trusting a third party which later became known to be untrustworthy.

Also when they arrested people the phones were often unlocked (I watched a documentary and saw the police capture phones and state they were unlocked)

Also they didn’t use disappearing messages or delete them so the full history was available without breaking any encryption

Sounds like they catched a bunch of n00bs to me.

That's what a n00b would think!

If crooks were proficient at using FOSS to write their own encryption apps that obey best practices... working as an SWE would probably pay better and have less downsides.

But that doesn't stop them from hiring a bunch of capable software engineers from e.g. the Western Balkans to build stuff for them for crazy money (6 figures EUR is crazy money for the Western Balkans). Like the guy who created a phone network for the Colombian cartels in the 1990s.

Same guy snitched 'em once caught by the FBI tho

They'd need to kill those SWE to be -safe- after

PS: I wouldn't take a job that can get me killed, there's a reason I like working with computers

Movie stereotyping whole region as aside, 6 figures EUR is not crazy money for western Balkans.

6 figures EUR is bordering on crazy money for Eastern Balkans, which are in the EU, let alone Western Balkans.

For reference, in Bosnia and Herzegovina, the median salary for a software engineer is 3650 BAM (1867 EUR at today's rate), per month, making a yearly 43800 BAM / 22404 EUR, and that's gross, before taxes and stuff. 6 figures EUR, even assuming low 6 figures like 300k, is the equivalent of more than 13 yearly salaries, and is of course untaxed, so even more with that. One can comfortably retire with 300k EUR in Bosnia.

Crimie movies make us think criminals are bright subversives, when the vast majority of them are dumb thugs.

There are much more lucrative paths for intelligent psychopaths in the professional world.

At its simplest - they attack the middleman. Most crooks aren't tech nerds, they're not a lot smarter with technical devices than your average user.

So all the cops need to do is go after the central server and then quietly hijack it. After that the choices are pretty much endless. If they used non-standard encryption, ggez, they're probably not smarter than the police. If they did, chances are that the server has an OTA mechanism to update the message application on the phone, so just push out a malicious update that quietly just resends every message to a police controlled server and uploads all messages still stored on the device. Less useful (not as much access to historical messages) but still very useful for tracking criminal activity if you run the tracking net for long enough.

I would disagree with your assumption on their intelligence wrt knowledge of the tech. No matter how poor your technical education is, you are likely to learn details about the thing that is central to the secrecy of your organization if you have any sense of self-preservation.

It does. But how do you prove you have a "well done" cryptosystem?

Very few "crypto" exploits are ever the issue. It's almost always easier to break some other part of the system than the crypto.

To be honest, if someone were trying to sell me a cryptosystem for a criminal enterprise and I were in the market for one, I'd happily start tracing everybody in that company as they are almost certainly part of the Feds.

If you are the target of a nation state actor, you're pretty much fucked. Once a nation decides to put down that much resource to get you, you're getting gotten.

Crypto is only valuable in the sense of "I don't have to outrun the hungry tiger. I just have to outrun you so the tiger stops chasing me to eat." If you, specifically, are a target, crypto won't help you much.

Sounds to me like the best criminals become nations.

Yup, Russia, China, North Korea, all authoritarian states

Winners write the history books.

Real winners write the law books.

Whether that's European colonial settlers, or William of Normandy.

(Not known as "William the Negotiator", or "William the all-around nice guy").

Descendants of the local warlords he installed still own huge (well, by British standards, the entire country isn't much bigger than New York State) tracts of land, a thousand years later.

Are you trying to somehow claim that the well-established fact that the Russian govt is indistinguishable from the Russian Mob, or that North Korea is not counterfeiting currency, running drugs, and hacking networks for currency, all indistinguishable from a criminal gang, and definitely not the purview of legitimate governments?

In linguistics they say that the difference between a dialect and a language is that a language is a dialect with an army.

https://en.wikipedia.org/wiki/A_language_is_a_dialect_with_a...

Encryption only works if the endpoints are secure. Zero day one of them and you have all the access you need without cracking anything.

The biggest endpoint vulnerabilities are human in nature.

The real problem is that most people cannot tell whether they're buying proper encryption or snake oil.

Exactly this. If your core competence is crime and not cryptography, what have you got other than reputation to base your decision on? Just like all of us in whatever sphere we're in.

You know the saying don't roll your own crypto, well that is because almost everyone does it wrong. AES/RSA/ECC can't protect you from using it incorrectly.

You can have perfect crypto on your devices, and great operations, and your messages can still be intercepted several ways. The feds are almost never in a rush. If they want you, they'll get you. If they want you enough, they'll sit in a coffee shop they know you frequent with a high zoom camera ready to read your encrypted texts from across the room. Or they'll bug your car and listen in to your properly encrypted phone calls. Or they'll intercept a package and add some spy gear. They won't do this to bust some street level meth dealer. But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.

> But, if you're suspected of something like posting state secrets in a Minecraft server? You betcha. They'll follow you everywhere.

Or they just call up discord and ask for the name and billing address on the account.

Presumably a criminal mastermind would know to fake that

Seeing as anybody who takes a credit card on the internet has to do some fraud prevention, that's pretty likely to be very difficult. Hell, depending on how paranoid things have been set up, even having uBlock can prevent you from using a credit card somewhere!

The missing part is often the "well done" part. Other than that - traditional bugs/listening devices, malware (recording the sound before encryption/after decryption)?

Then there's traffic analysis (a talk to b, b kill c, b talk to a). See also: "well done".

That's an almost impossible task.

The Pegasus malware for example was able to infect and spy any phone.

The article addresses this: it’s because it’s almost never well done.

They claim it’s super secure, and then apparently implement whatever with no oversight.

The reality is that when you start to endanger society the State comes after you. See Escobar and Noriega.

The companies offering encrypted phones were infiltrated. Servers hacked. Employees intimidated with prosecution. Bank accounts seized.

I think the main reason is that LE basically has root on the entire stack up to the encryption.

The NSA quantum computers.

A reality inspired title doesn't scratch the confirmation bias itch quite the way that a title closer to the "criminals dumb" end of the spectrum does though.

One warrant let the Gendarmerie copy all data on EncroChat phones indefinitely, and seemingly let them then use that data for any number of charges. That is kind of messed up. Burying it in "but we have to stop the drugs" doesn't change anything.

General warrants are supposed to be illegal under US law but it doesn't stop law enforcement from trying. https://www.eff.org/files/filenode/att/generalwarrantsmemo.p... Most of the cases discussed in this article are outside the US so I don't know if similar precedents exist.

Warrants deployed in the US today are nothing like the general warrant, which was issued to constables as carte blanche to harass random targets at will.

Nobody cares about the fucking drugs. It becomes a problem when you have daylight assassinations on journalists in busy shopping streets.

I think "this service advertised itself as for use for crime, so we can gather all of it's clients data" is a reasonable scope for a warrant.

This shouldn't work on AT&T (though room 641[1] showed that it does), but I'm less concerned about grabbing the mob's customer list wholesale than the grocers.

[1] https://en.m.wikipedia.org/wiki/Room_641A

What are you complaining about? Are you implying that there should have been additional warrants required? Because the article doesn't say there weren't. All it says is,

> Gendarmerie executed a warrant to secretly copy EncroChat’s servers

Yes, there was initially one warrant. But there could have been many others. And even if there weren't, why is that a bad thing? What is your actual complaint?

That the message contents of every user of a service were indiscriminately read without doing any investigation to see which were criminals first? Imagine if the FBI just seized the Yahoo! mail database and started reading messages because some of the users were criminals.

The FBI did do this with safety deposit boxes. And a judge ruled they did nothing wrong! https://www.latimes.com/california/story/2022-09-30/judge-ba...

I think that's being appealed and in that case all the IJ was asking for was for people who had their stuff seized to have their names removed from some government database. Basically anyone who asked for their money ended up getting it back.

> It went on to return everything in about 180 of those boxes after failing to produce evidence to support the allegations, court documents show. Those box holders retrieved more than $27 million. Attorneys for other customers say they recovered close to $25 million more through private negotiations with the U.S. attorney’s office.

https://www.latimes.com/california/story/2022-09-23/fbi-beve...

That's $52 million and that's just from the attorneys they talked to - I think another LA Times article mentioned that around 5% of boxholders didn't even claim anything. They seized a few million from Poliak the owner but they had him talking about being a professional criminal for hours and hours. Still messed up but maybe if another judge sees it goes another way.

The problem being discussed is not so much the government stealing people's money, it is the government searching your property without any semblance of a warrant or any shred of evidence that could be used to obtain a warrant.

Per this ruling, if the FBI obtained a warrant to confiscate Google's servers using proof that Google is engaging in criminal behavior, they could then claim to start an inventory of every Gmail account in order to give people back access to their accounts. If they do so, they would then be perfectly justified in starting investigations into each and every Gmail user for anything they find in their emails, without any warrant whatsoever, because their inventory of the emails and pictures was not solely motivated by fishing for evidence.

Similarly, they could seize a post office and do the same with un-opened mail, per the same logic.

These cryptomessenger-take downs happened in Europe and most EU jurisdictions work very differently from the US as far as admissibility and searches go. In fact in several of them (France, UK and Netherlands iirc) you even have to decrypt your own devices to provide evidence against yourself if there is a reasonable suspicion that evidence exists.

Actually there was a case some time ago very similar to your post office example: Someone was stealing letters/packages in a post sorting center near the Dutch-german border. Supervisors found a stash of partially opened/damaged/illegibly addressed letters and the suspected thief. Hand everything over to the police. Police opens all letters and reads them ostensibly to determine whether things are missing and where the letter is supposed to be delivered. One letter is from some german dude to some dutch dude asking for cannabis seeds. Oops. A few busted down doors later german dude is convicted, appeals on the grounds that it was obviously illegal for the police to just read his letter for no reason. Appeal denied - sure it was illegal for the police to do that, but he didn't get convicted based on the letter, but based on his plantation that was found during a raid.

So, as a general rule, it usually doesn't matter how or why police knew about something, if they have solid, physical evidence at the end of the day, it will not be thrown out just because some constitutional rights were ignored along the way.

So they can basically use the result of an illegal search to justify it? That seems so wrong to me. Makes you wonder why they even require warrants at that point.

Post office would be a much harder legal sell given it's a federal entity with plenty of precedence against that.

Wasn't it established that the whole sales spiel was geared towards criminals? If Yahoo mail was largely aimed at criminals I wouldn't have a huge problem with police having a look. Actual Yahoo has mostly ordinary people so I'm not ok with that, but this thing seems to be specifically for crime, no?

>Another network, EncroChat, boasted that its devices offered “worry free communications” and “the electronic equivalent of a regular conversation between two people in an empty room.”

Is that "geared towards criminals?" I can see how you'd say yes, but there are plenty of other people who would be interested in such a thing. It's also very similar to the sales pitch of any encryption protocol.

Yeah but that doesn't say where the product is marketed. The copy can be the same, context matters a lot.

> "The network, owned by a Dutchman named Danny Manupassa, had made a spectacular bungle: it had stored the private keys for the system on the same server as the network’s messages. Analysts in the Netherlands obtained the private keys and then used them to decrypt Ennetcom texts."

Not your keys not your comms. But even then then, apply defense in depth.

> "Sky’s messages ran on a different system than EncroChat’s, and it was more difficult to infect the network with bulk malware. Instead, someone with knowledge of the investigation told me, analysts seem to have launched a “protocol attack” that deceived handsets into revealing their private keys."

If anyone is interested. There's a pretty good Darknet Diaries episode that covers some of this and other cases: https://darknetdiaries.com/transcript/105/

Nice! I just love this podcast so much. I think I discovered it from an older Hacker News thread a year ago or so.

Might be worth adding some indicator that this is a podcast and not a video series

Isn't the guy speaking part of the hacker quality radio crue?

> He told me that, although there were measures a government could take to combat organized crime—better scanners, more customs officers, improved collaboration between national police forces—the flow of drugs would stop only if there was a change in attitude among Europeans. “Drugs are being normalized in our society,” he said. “Users need to look themselves in the mirror. They are putting our security in danger. I hope they are wise enough to understand that, without demand, there is no supply.”

Just how long will it take politicians to finally recognize that prohibition is the problem? It didn't work for alcohol in the US (and created Al Capone in the process), it didn't work for cannabis, it didn't work for sex work, it didn't work for porn, it didn't work for any other kind of drug. All it ever created was senseless suffering on all levels, from governments whose budgets were and are drained by the cost of prosecuting all the drug crime, over the users who literally die like flies from contaminated products or accidental overdoses, to society which can't rely on not being shot in a drive-by gang fight or walking home without stepping over feces and heroin needles.

The only place where prohibition somehow works halfway is CSAM and pedophilia, but only because everyone but the pedos hates the pedos and agrees it's inacceptable - and even there, with this worldwide unity, there's still more than enough pedos that corrupt local officials in poor countries where pedos from all over the world exploit the utter poverty that leads people to send their children into human trafficking.

> I hope they are wise enough to understand that, without demand, there is no supply

I hope the executives of our society stops one day for “hoping” the wall will move while keeping on bouncing on it.

As peer commenter said, prohibition never really worked to combat crimes outside in real world. What does work is legalization of production and sells. Not as giving up but as controlling the market. Would you try meth of it where legal ? Probably not and neither does your folks.

On the cultural and health side we have the clear exemple of tobacco marketing legislations that have a strong effect on consommation. How will be one (non Islamic) country if it stop advertising alcool ? While it’s mitigated with internet ads, my bet is less alcool will be consumed > better health. And on the working side, c’mon we surely can find or create jobs for our wine-yard workers that will be helpful for our society as a whole.

> Would you try meth of it where legal?

Given that a lot of ADHD medications are methamphetamine based... yes.

Mmmh not convinced, around me people take those drugs because their therapist advise them to do so. They don’t buy stuff at the drugstore because it’s legal, neither does the therapist prescribe you a pill “because it’s legal !”

A ton of people I know self-medicate their ADHD symptoms with all kinds of drugs (mostly pot and alcohol, but some also regular prescription pills), simply because access to therapists is far from being a given, much less getting access to a therapist specializing in adult ADHD/autism.

Thanks, your reply is informative. I’m probably biased by my living bubble and reading “access to therapist is far from given” helps to keep in mind to not generalize my context.

It does work. Check Lee Kuan Yee and Singapore. but it needs to be strong willed not weak.

And yet, even Singapore is not drug free. They have black markets as well, it's just stupidly expensive due to the risk involved for the mules.

It's so dumb - think about the signals you are sending out just by having such a device. Let alone trusting someone else to harden it for you.

Think about Monero - it's a lot more suspicious to be dealing with that than regular bitcoin.

For privacy advocates it's fine, you aren't doing anything wrong by using e2e and monero, any govt looking at you won't be able to get past reasonable suspicion.

But if you're a criminal you're basically glowing in the dark by doing this stuff. Regular phones are also encrypted! Facetime is e2e? What was the point of the "AN0M" phones. What did they give you except a supply chain risk and a 100x SIGINT interest factor than a normal person.

I simultaneously agree with you (tor being another prime example of this -- they may not be able to see which tor sites you're visiting [unless they control the exit node] but they sure as hell can see you're using tor), and also think that at some level, the "what have YOU got to hide?" attitude is purposefully encouraged by the intelligence agencies as a way to slowly erode privacy expectations. "Good people don't need an expectation of privacy" is the start of a really dark path.

People will willfully and joyfully will vote for a would-be dictator, so I don’t privacy is really the main thing that brings us on a really dark path. There are far bigger fish to fry to protecting our basic rights and values.

The balance between privacy and the authority is just that. We outsourced the rule of law to the state in order to have a fair and just society. Ipso facto the government should be fair and just to have the right to invade some amount of privacy in order to keep a society free, fair and just.

That’s why the judicial branch exist: to see if what the government (or anyone) did was playing by the rules.

Which brings us back to politics being a danger to a society if people vote in unjust or unfair people.

I don't think this is what the GP was arguing. They were not discussing whether what the court system did was right and justified, nor whether people who know they have done nothing wrong/illegal should be expected not to use privacy technology.

Instead, they were pointing out that it's hard to imagine why the people who knew they were engaging in criminal activity and were hoping to hide it thought it would be a good idea to have specialized equipment/services rather than blending in the crowd with normal phones and apps.

> Let alone trusting someone else to harden it for you.

At some point you have to trust others in order to take advantage of network effects, and network effects are exactly what these crooks were seeking to manage. The criminals in this case wanted secure, supported hardware in order to conduct operations and logistics across a range of countries.

My point is they left the massive network of regular people using regular encryption and privacy protections for an uncommon and bespoke solution. In doing so they grouped themselves, basically megaphoning to the police that there was a 10,000x higher likelihood that they were involved in criminal activity.

> exactly what these crooks were seeking to manage

Use iMessage and Facetime without iCloud. Like, to be targeted by Pegasus they have to know who you are, and each time you infect a new target, you risk the exploit being discovered and patched.

Just be buying these "hardened" deviced, police identified criminal cells they didn't even know existed.

They pay thousands for a bespoke solution that puts them 3 OPSEC steps backwards.

https://archive.ph/DOA8y

If "crooks" as a category would be so stupid, we wouldn't have crime at all.

While good, this is fishing the ocean with a fishing rod to me. The comfiest, surface-nearest and most trusting fish get arrested, which ironically could well be strengthening the real underground.

The smart crooks use Signal on iOS with backups off. Maybe a VPN for good measure.

I think the real crooks do the old-fashioned stuff. Like, not use a smartphone at all for criminal things. Just use expendable workers over two or three layers of hierarchy :)

Is signal on iOS safer than signal on Android?

Yes, just because iOS itself is harder to hack. For example there are trivial evil maid style attacks against Android: https://www.tiktok.com/@android_infosecurity/video/718590789...

Security 101: Physical compromise is full compromise. If someone with the means has access to your unlocked iPhone, it's game over as quickly as Android. Remember JailbreakMe? That was the NiceGuy™ version of iPhone hacking. Now companies bill governments millions of dollars for iPhone jailbreaks and you can't even sideload apps after.

As time goes on the cost of physical attacks increases. This was more true in the 90s when secure boot and FDE weren’t a thing, sure it’s still possible but it’s much harder now.

Secureboot and FDE will still protect against this. The attack in the linked video just uses a flipper zero to mimic someone holding your phone and disabling protections then installing malware.

Even if the phone was on, unencrypted, and locked it would fail.

Edit: I initially misunderstood where you were coming from. Yes, today things are more secure, but if someone has unfettered physical access to your device they can just as easily install hardware that waits for you to login and then do these things or replace your charger plug (on a mobile device) or use a modified Bluetooth or USB proxy to keylog (on a full device). We're of course getting into high-level corporate attacks at that point if to be unnoticed (i.e. no popups, prompts, unexpected changes), so the average user is much more safe.

Pretty much, iOS jailbreaks were common and free, now they’re worth millions (assuming they can be exploited remotely).

At some point, if you have physical access and the device pin, you should assume it’s game over, but there may also be a point in time where we no longer care about physical security as much, if at all.

No. Actual criminals are going much deeper than that. Custom hardware, custom apps, custom servers. Sometimes it works, sometimes they get this.

Are you speculating or is there precedent for this? I highly doubt even the largest criminal organisations are producing custom hardware or software.

The largest cartels operate their own cell networks and have dedicated proprietary technology and netsec divisions.

El Chapo’s cartel had their proprietary cell network, but the FBI simply grabbed up the cartel’s technology/IT head and threatened him into giving them access.

https://amp.cnn.com/cnn/2019/01/09/americas/el-chapo-it-tech...

Good old $5 wrench attack.

>At Europol, Lecouffe has explained that, although he was of course unsurprised to find that criminals used violence, he was shocked at “the level of violence” in Europe.

It isn't like they can settle their differences in drug court. Black markets and the associated attempts to shut them down naturally generate violence. The people involved literally have no other choice.

They have plenty of choices, like not doing crime or participate in black markets, what are you talking about.

I don't think GP was making a bleeding heart argument for the poor drug cartel enforcers, they were simply pointing out that a drug cartel can only use violence to respond to any perceived injustice (or ignore it and eventually dissolve, of course), there are no non-violent means to solve disputea between cartels.

Even that isn't true, there's history of cooperation and sharing markets by delineating borders among criminal groups. But ultimately they simply can do a normal job instead of crime. It's not like they're born and "all I can do is kill because I'm in a cartel", oopsie.

> one of the goals of the sting was to “dismantle the business model” of encrypted phones as a tool of organized crime

Why would law enforcement do that? They are self-made honeypots, evidence-collectors, and tracking devices all rolled into one. And these people can't seem to muster the self-discipline to lay off the sweet stuff.

because some of these networks- not the one you read about in the news, are LE resistant (servers in Panama etc). One or 2 are so tight that we (LE) can see use of the network as a marker of organised crime but not the messages. Reducing trust in such networks is a way of slowing their spread, use, infra and effectiveness. And that has been effective.

These networks are being used for drugs, fraud, sex trafficking. But almost nothing legal. Encrypted hardened phone with specialist app in one pocket, iPhone for facebook/instagram in the other

The primary take away from most of what you see in the news (a failed LE investigation of "encryption" or darkweb almost never makes it to the news) ... opsec is hard.

I still regularly visit an old IRC server, which is largely abandoned except by a few friends, and sometimes I wonder, what if it's the best way to have secure communication in 2023, it's an outdated protocol most people including the police probably forgot even exists, i.e. won't look there at all :) Everyone is mostly paying attention to modern shiny messengers

Apparently you can share Top Secret documents for months on Discord and no one notices....

Which shouldn't be a surprise. If you aren't suspected of doing such things, you are just a number in the void.

Until they single out specific targets, begin monitoring their traffic and notice IRC usage.

Doesn't reflect poorly on the crooks as much as the government.

You have no right to privacy. The government can and will spy on everything you do.

You do have a right to privacy by default, but the government can spy if it has a good enough reason.

If you thought being spied on was bad, wait til you hear what the government does when it thinks you're guilty of a crime.

It seems that "suspecting it might have a good reason later" or "you're using the same service as other people it has a good reason to spy on" are sufficient reasons now.

If the adversary had been another gang of crooks it's still bad security.

anybody that’s tried to do a commodities trade over whatsapp can tell you there are just a lot of dumb crooks out there

but especially in Europe

There are currently hearings being held around the legality of the collection from the AN0M app.

https://www.abc.net.au/news/2023-04-18/accused-criminals-cha...

The criminals were fooled by cons: false confidence and bravado. I know almost nothing about criminal culture (if there is such a thing), but I'm not surprised that people engaged in crime would be accustomed to evaluating others based on those signals.

What is surprising is that such cons - such signalling and trust in it - as spread to legitimate business at the highest levels. It's run SV and much more for awhile now. Really, the criminals made the same mistake that all the celebrated investors did make, and continue to make, with the endless parade of SV fraud.

Really interesting article. I get the impression the Sky ECC bust was bigger than all of the previous ones but maybe that's just cause there was more reporting on it. It's kind of confusing to me why the CEO is wanted in the US because it doesn't seem like there's any evidence he facilitated drug trafficking or at least facilitated it anymore than say Signal does.

The propaganda against encryption is in full swing.

My expectation is that all NSA CNSA[1] encryption standards are backdoored at the implementation level (by the NSA who uses Suite A for its own communication and I suspect military communications outside of that in weapons systems that can fall into enemy hands)

I guess the propaganda is driven by FBI and law enforcement agencies.

1. https://en.wikipedia.org/wiki/Commercial_National_Security_A... 2. https://en.wikipedia.org/wiki/NSA_Suite_A_Cryptography

Can someone explain me why this is downvoted ? In my understanding his proposition about NSA is quite close to a popular one and hn seems to allow discussion of hypothesis - if they are more probable than imaginary ?

Is it the word propaganda that patriots dislike ? Not sure if some soviet connotation is involved in US but for me it’s just a synonym of “public lobbying” of “ideology gov marketing”.

I know those subjects can become polemic and I don’t want to throwing oil on the fire, but an “out of debate” clarification would be nice and helpful.

The worst thing about HN (and it does reflect badly on YC as a whole, at least for me) is how they enable people to act in seemingly passive aggressive ways. Instead of stating disagreements, they downvote, and you'll never know why. Just pure crappy behavior. In this case, someone explained below that they downvoted because they don't agree that the article is propaganda and that it calls for less backdoors or something like that as if everything isn't backdoored already, one way or another.

Then you have stuff like BIP39 protecting people's money (cryptocurrency) that can be cracked for $350/hr on GPU rigs. Someone even wrote a how-to.

Current security makes it harder, but not sufficiently harder, to break into systems. I mean... HN crowd is probably high schoolers and non-tech people just out here to argue.

> Then you have stuff like BIP39 protecting people's money (cryptocurrency) that can be cracked for $350/hr on GPU rigs

This doesn't appear to be true (in the sense that yes it is feasible to crack 4-word BIP pass phrases, but all wallets that I'm aware of use at least 6 words, which is estimated to take 11 years for a hypothetical ASIC cracker)

https://coldbit.com/can-bip-39-passphrase-be-cracked/

Perhaps you are meaning this attack where someone was able to brute-force 4 words from a 12 words phrase. It matches your $350 cost, but of course is dramatically different to "cracking BIP39": https://medium.com/@johncantrell97/how-i-checked-over-1-tril...

2048 words in 6 positions is simply not enough entropy for the NSA's encryption cracking infrastructure. If it is worth it they'll crack it. The NSA does not use a single ASIC cracker.

That's an extremely different proposition. Pretty sure the NSA isn't into stealing bitcoins.

That's 66 bits of entropy. With a quantum computer having 66 logical (error corrected) qubits, the pass phrase can be cracked in under a day.

That's not too far off, maybe a few years before one is commercially available.

It's because it's another conspiracy theory unsupported by evidence.

The encryption algorithms in CNSA are broadly accepted by the security community. Just saying "NSA backdoor" is a cheap shot.

> unsupported by evidence

Depending on what you accept as an evidence, but this theory is surely supported by precedent(s?) [0]

Just saying “another conspiracy theory” is a cheap shot : conspiracy are bad and should be fought. Theories are a useful process to make knowledge advance. Conspiracy theories are often discussed in an awful way on social medias, can’t HN do better than just downvoted them ?

[0] https://www.theguardian.com/books/2014/may/12/glenn-greenwal...

This guy is still around on 4chan:

https://twitter.com/4chan_greentext/status/84511828265908224...

See this is a great example of the problem.

1) Did NSA modify Cisco routers? Yes

2) Did NSA get a backdoor in Dual EC_DRBG? Yes

3) Did NSA get a backdoor in the CNSA algorithms? There is no evidence to suggest they have and plenty the other way.

The original claim was (3) but the "NSA does stuff" thing overrides any attempt at discussion of that specific piece of misinformation.

>It's because it's another conspiracy theory unsupported by evidence.

I'm having a hard time keeping up with it all, it's nuts. But my understanding is that the NSA backdooring protocols is totally supported by evidence? We saw it in the Snowden revelations? RSA being the company nobody will ever trust again?

Is that all wrong somehow?

> backdooring protocols is totally supported by evidence

It's important to be very precise.

I think you might be confusing backdooring specific pieces of software produced by RSA-the-company (specifically things using Dual EC_DRBG) with the RSA algorthim that company is named after, which is included in the CNSA.

Dual EC_DRBG was a bad algorithm which many people had serious doubts about from the start - and indeed it was backdoored by NSA. That is different to the algorithms in CNSA which (as I said earlier) are well regarded by the same security researchers.

There is no evidence (or serious claims) that the RSA-algorithm is backdoored.

get it from the horse's mouth, as they say... instead of baselessly pontificating on HN and not understanding the diff between algorithm and implementation

not the algorithm. the various implementations of it. evidence? ask a friend.

It was an interesting read, moral to me is not to use Cell Phones for anything illegal. If you do not control the keys, you might as well not bother with encryption.

Even if you control the keys, it does not protect you from vulnerabilities somewhere in the stack. Stuff like thumbnail generation provided by the OS has been used by cyber-criminals in the past to compromise phones by sending MMSes or even third-party messenger apps, and I'd take a guess and bet that at least the Five Eyes government agencies all have a sizeable cache of baseband vulnerabilities.

Technology simply has become far too complex to be reasonably secure, even if you have the financial firepower of being Apple, Sony, Microsoft, Nintendo or Amazon.

Agreed.

If it installs updates without requiring you to specify the desired updates explicitly (i.e. by cryptographic hash), it should not be considered "your" device from a security perspective.

This 100%.

> My expectation is that all NSA CNSA[1] encryption standards are backdoored at the implementation level (by the NSA who uses Suite A for its own communication and I suspect military communications outside of that in weapons systems that can fall into enemy hands)

CNSA / NSA Suite B are pretty much entirely public encryption standards that have stood up to public scrutiny for decades at this point.

They are also approved by the USA to encrypt TS SCI information, why would they approve that if they had backdoors?.

Why would they have Suite A then?

> Why would they have Suite A then?

Because Suite A are a set of non public algorithms that are used to encrypt data.

Them being non public makes it harder to workout how to decrypt the data.

They are also likely protected against a number of attacks that aren't public, even if these attacks aren't feasible against current algorithms.

>They are also likely protected against a number of attacks that aren't public

For reference, see DES, where the NSA adjusted the algorithm to protect from a not publicly understood differential cryptanalysis attack. Many people claimed that the adjustment by the NSA was clear backdooring, though we know that was not true.

It was however purposely deficient in the length of its key, allegedly because "it was good enough" and for export reasons, but also because the NSA considered it easy enough to brute force.

"even if these attacks aren't feasible against current algorithms" lol, ok, if you say so....

This article isn't spreading any propaganda against encryption. If anything, it makes the case that new backdoors are not needed.

I was curious about the Gates quote, since I had never heard it before.

https://www.washingtonpost.com/archive/opinions/1999/06/28/o...

It didn't seem to have been archived before either:

https://archive.is/2IZPk

Any network of users that is large will leak, whether encrypted or not.

People are social, and when push comes to shove they're more than willing to throw someone else under the bus.

The question is, why hasn't anyone designed a standard cell-like structure for an encrypted communication app? Cell-based structures have been known for a long time.

How do you verify + vouch for a new user in a way that's secure yet anonymous?

How do you handle anonymous + secure + directed communication?

> How do you verify + vouch for a new user in a way that's secure yet anonymous?

> How do you handle anonymous + secure + directed communication?

I believe the answer is PGP key meet-ups.

For a criminal enterprise, FTF authentication is probably fine. You might use PGP keys hidden behind a QR code or something that's user-friendly.

But then you have the other operational issues with the cells, like what do you do when your cell is compromised, or how does a cell reattach to the network if an upper level point-of-contact is compromised.

And there are administrative issues...like a shared calendar. Payroll. Inventory. Logistics alone makes a cell structure difficult, because logistics means coordination among many people.

It would be an interesting project to make for sure.

I think if you make an actual concerted effort behind FTF it'll work fine due to 6* of separation [1] as well as I would assume once you have the FTF setup working you can just piggy-back on existing systems (i.e. the internet).

I assume for a compromise you can just do the same set-up as pre-compromise except at level+1 and level-1 instead of level+1 and level. Figuring out who is compromised is non-trivial but that was the case without a cell structure anyways.

Cell structures should make logistics easier. Thing about MergeSort vs BubbleSort. The amount of comparisons needed by MergeSort is less because of the cell structure. If you're trying to make a master calendar, it's going to be easier to have the cells create their own calendar and then merge them at the cell level and then merge those at the next level and etc until they're all merged than have everybody make their own calendar and talk to everybody else to resolve conflicts.

IIUC, payroll works this way for the federal government. Treasury has a big pile of money it lumps out to various departments which lump it out to divisions which goes out to actual employees.

[1]: https://en.wikipedia.org/wiki/Six_degrees_of_separation

Remember: even if you're on what you believe is a fully encrypted device, don't send a text message with specific details of a crime in it.

How are you supposed to coordinate the cocaine shipment then if you can't send any specific details. That's the whole point of these phones.

Over voice, in person, or without listing incriminating details, presumably. That would be my recommendation. I do know that listing specific details in text messages is how they got caught, however convenient it may have been until that point.

Why don’t criminals just meet in person to swap public keys and use email to mail each other encrypted messages?

Sorry to see people dismissing this idea. It is educational to remind people of best security practice. As for actual criminals.... I would bet some of the most skilled do.... and that's why we never hear of them. As far a socializing the practice, it's like any other skill and practice like learning to sell used cars with high-pressure methods. You just have to know it's possible, then get the word out and train people. Then they'll be able to work together on it.

The convenience and knowledge barriers are too high for most people. It's pretty straightforward for folks with tech subject matter expertise, but for most others, it's just not worth figuring out what they need to know, then getting all of the prerequisite knowledge that lets them learn that, then worrying about screwing it up, or maybe relying on someone else for basic operations, etc.

It's often tough for developers to see this for the same reason it's tough to write documentation-- reasoning about a beginner's perspective is a specific skill that takes study and practice. That's why software companies that need financially stable products hire technical writers and interface designers, and it's a place where FOSS really struggles.

For example, Mastodon's active userbase has dropped 50% since its peak during the beginning of the Musk/Twitter debacle... even for the ones brave enough to plunge in head-first, it was too much technical resistance compared to the more straightforward alternatives that they had already abandoned. I think it was a missed opportunity.

Because that requires technical skills most laypeople don't have.

Because depending on your threat model, meeting in person may be undesirable.

Survivorship Bias. The criminals that are doing this are not getting caught, so you don't hear about it.

They could, but it doesn't stop what happened in this case - the cops infiltrated the organization, so people who had access to unencrypted communications turned them over to the police.

Because no one will ever do that. Even if they risk being arrested

Criminals have gone soft then, and deserve to be arrested!

All the classic mob movies have something about never talk business on the phone, always meeting in person in some dark waterfront or warehouse location. Here, they would only be required to meet in person once! If someone is too lazy even for that, well then, enjoy prison I guess

It depends on which crooks one is talking about, the crooks in government seem to enjoy all kinds of advantages that come from encrypted devices, as wet know, even setting up honey pots.

I always wonder why these guys are using such broken stuff. Surely they can find someone to fire up a private Matrix server for them all to do business on.

There almost certainly are criminals doing this, or better. For instance, Tor and “dark web” stuff are fairly widely used, along with crypto. These things capture the other side of the curve from lex Luthor.

Murder, torture, drug trafficking... but by far the worst is abbreviating Lord of the Rings as Lor rather than LotR !

But then the 'Lor and Order' joke wouldn't have worked.

Tldr?

A bunch of prominent independently produced and maintained 'secure' communications networks marketed to black markets were intercepted by global law enforcement networks, shutdown, and many criminal cases were made off the back of those takedown operations.

Reply on news.ycombinator.com