benzinschleuder

Amazing. Did they need to jailbreak or physically open the phone to find all this stuff? They talk about reversing binary images and using their "Legilimency" toolkit; I wonder if a vanilla phone was enough to research all this and propagate through Wi-Fi.

Done, thanks!

Is a kill switch purpose to protect against a new infection? It doesn't help decrypting the files i guess? What is it used for?

Thanks!

Seems to work both ways. Receive random file from unknown people or send chosen file to unknown people?

EDIT: was just explained in other comment by meejah, thanks! (https://news.ycombinator.com/item?id=14649727#14650551)

Probably all "slots" would be "occupied" and everybody gets the attacker's sent file, iiuc.

It operates over the Internet instead of Wi-Fi / Bluetooth and it initializes transfers by a code.

Does the session key hash help if the attacker guessed the code correctly?

at the moment its very tailored to macOS and has plenty rough edges because its for personal use. But I'll gladly clean it up a bit and put it on github if enough people are interested and/or i will write-up how its "protocol" works. Just let me know (twitter pm or sth.) who is interested.

EDIT: basically it's one deterministic stream of messages for journaling everything, one recursive stream of folders and linked raw files. deterministic lookup rougly like: HMAC(type|index|revision|replication, key_for_locating) and it iterates through that

EDIT2: and one for parity of meta and raw

Some time ago, I implemented a little tool for myself which backups folders incrementally on usenet (deterministic message-id creation from a secret key, append-only style with metadata, parity, encryption etc. so you only have to remember one unique key to access all of your data, even if new data is added).

It can mount the current state of the usenet backup with FUSE and it's possible to browse through the files and listen to music etc. I understand that it might not be a good idea to store all your data only on usenet, but I thought that was an interesting concept and a fun little project to work on :)

Dunno, tried it on OS X and it's colorful and looks good.

It works in the Terminal, too!

curl http://wttr.in/london

Not sure about being the middleman yet. What if the big Usenet providers decide to delete data or we violate their non-business-usage policies? But on the other hand it's really cheap indeed! We can cancel our Usenet subscription and renew it when the data is needed. So I thought it's maybe better to cut out the middleman by giving the software away.

About the abuse: I imagined that the method could be used like some unlimited-disk-space-providers which had to get rid of that plan because the users used it as advertised.

Of course, apart from that, anyone can write such software. So it's maybe just a matter of time? Though I couldn't find any other solutions besides RAR archives.

The Usenet can be used as a key-value store with handicaps. And stuff can be built on top of that.

Usenet is also usable for backups. Normally you would upload a huge encrypted RAR.

Some time ago i built a tool where you can store files/folders incrementally on Usenet with encryption, parity etc. I put much effort into this. It was possible to restore a directory tree by a unique ID (which you could write on some piece of paper) that securely resolves to a chain which links to meta/raw blocks via Message-IDs and you could mount the whole thing with OSXFuse. The ID was reusable after updates to the tree, so incremental backups worked without a new ID.

I thought this would be a nice alternative use for binaries on Usenet instead of piracy stuff. But I never released it because I think that it would lead to pollution of the Usenet network.

Is anyone interested in this? Or maybe somebody has an idea on how to use this without polluting the network? Would love to hear some thoughts about this!