Hacker News Reader

Comment by magikarp | Hacker News Reader

Mac OS X, Transmit by Panic Software (v. 4.2) — I blogged this in order to protect myself.

Why do you use Transmit? Panic's software is known (amongst people who do reverse engineering) for having many holes.

If you're doing really security sensitive work don't run questionable software which you don't have the source code for.

As someone who uses Transmit... what would you recommend instead? Command-line sftp?

Very curious to look at your logs. Pastebin?

Wow, thanks for the fast reply!

Can you tell me what your next steps in proceeding are, or would this violate the protection you're attempting to set up?

I am currently in a state of shock and rage. I am contacting helpful friends, documenting every shred of detail for my own protection, and mirroring evidence to multiple servers in order to prevent it from being erased.

Helpful advice is more than welcome.

If you feel like having a mirror in an EU country let me know, email in profile.

Nice try, CSIS. (Just kidding.)

The same, in Paraguay :-) Poor bandwidth but enough storage. Just let me know if I can be of any help to you.

You'll be OK :-) Keep calm and carry on. That's all the advice I have.

If you have not shut down the machine, I would do a memory acquisition (http://code.google.com/p/lime-forensics/, can be analyzed with Volatility) and a raw disk acquisition (you can use dd) and get to someone for forensic investigation to look for rootkits and other evidence of tampering.

I'm sure you know very well how to record and preserve data, so I won't advise you on that note.

But you should try to script something quickly which will automate these actions for you. And you should also try to make a bot to investigate the "backdoor" more.

Aside from your evidence, is there anything that has happened in the past that would lead you to being a target for the NCIS?

He is of Lebanese ancestry and studied in Lebanon for 2 years thus he likely speaks Arabic and has Arabic speaking friends. This alone could be enough if someone among his acquaintances has terrorist links. In addition he was one of the first to speak out about Bradley Manning's arrest, in his support, which raises the possibility that he has connections with WikiLeaks, lulzsec, etc. That is enough for CSIS to investigate him. He also has traveled to the USA which is where the FBI gets involved and, of course, anything regarding terrorist connections or lulzsec brings in the CIA. Quite frankly he is not a clean person and should not be developing software like this. If you were a business executive with shady dealings, would you want to use software from this guy? Would you trust him not to install a backdoor? And would you take the risk of travelling across an international border with a copy of this software knowing that 3-letter agencies associate it with terrorism?

Nice try CIA

What "shady dealings" is he accused of apart from being Lebanese and expressing an opinion on Bradley Manning?

So since he's Arab and involved in activism we shouldn't use his software, interesting. Even more interesting is you seem to be getting upvotes. Congrats, ass.

He is a person. He is being attacked because he has a conscience, actually likes to protect the freedom 3 letter agencies are out to destroy while claiming the opposite, and pays more than lip service to it. Thanks for the bootlicking demonstration.

I don't feel as though you know enough about the man or his situation to make these judgements.

Two bits of advice for what to do after backing up evidence:

1. If you suspect the machine was tampered with, do not use it again. There are a lot of places a backdoor could be hiding, even after you reinstall the OS.

2. If you do not do so already, use smartcards for crypto. Don't store keys on your machine. It is easier to carry a card around than a computer, and smartcards are harder to brute force.

Can you recommend a smartcard?

The easiest one to buy in small quantities is probably the GPG smartcard, although I have not had much luck with it in the low-end reader that my laptop has (YMMV but the same folks that sell GPG smartcards also sell card readers that should work). Otherwise, I am only aware of cards that are only sold in bulk i.e. for corporate and government use.

Yubikey is an option.

Reply on news.ycombinator.com