Governmental Hacking

GNUtoo · Veteran Joined: 05 May 2005 Posts: 1919

a second channel could be tor+privoxy:
having tor is like beeing elsewhere...
with a web page where you can know your ip and a geolocalisation service(there is one that is free) or with the dns name of the ip(.de for instance) you could know where is the exit node...
and because the tcp traffic that goes trough tor is encrypted from your computer to the exit node...your isp couldn't change the data there is inside...
but the exit node(that is in another courntry) can...but they wouldn't make the same changes as your isp...
so let's compare the isp and the exit node to tell if they modify the files...
mabe someone should do a little program to digest all theses files and compare both digest:
->rsync without portage but with the normal rsync command...both with and without tor
->merge all digest together
->diff the 2 digests

speeddemon · Apprentice Joined: 27 Sep 2003 Posts: 162

Genone · Posted: Wed Dec 12, 2007 12:41 am Post subject:

Just to provide some background to people not familiar with the current discussion in Germany:
The issue is that the BKA (think German FBI) and possibly other law enforcement agencies want to secretly install spyware (known as "Bundestrojaner" in the media, officially it's currently called "Remote Forensic Software") on the computer of a given suspect (with the usual "we need this against terrorists" explanation) to examine both existing data and current activities and communication. Main argument is that they want to bypass encryption that way by getting the information before it's encrypted. As they haven't provided many details regarding the technical implementation of this people have tried to come up with possible scenarios how they could install such a tool reliably. And AFAIK there are only three generally viable scenarios:
- physical access
- using unknown software exploits/backdoors
- seizing control over the ISP connection to poison downloads (which is what this thread is about)
And to add some numbers about scope, the director of the BKA said that "there maybe would be a dozen such incidents per year", but that number is generally questioned.

PS: I've just posted this so the motivation of the OP and the scope of this issue becomes a bit clearer, please lets not start a discussion about the (non)sense of the spyware idea itself in this thread

GNUtoo · Veteran Joined: 05 May 2005 Posts: 1919

ahurst · Posted: Fri Dec 14, 2007 12:03 pm Post subject:

I think ...
The only truly reliable end-to-end channel is a quantum encrypted one: i.e. one that changes state by being read.
http://en.wikipedia.org/wiki/Quantum_cryptography

Otherwise, exchanging a public key in person by writing it in pencil on an envelope, in a randomly chosen location, so that no-one else can possibly read it with e.g. high power optics (i.e. in a covered, randomly selected location) will only keep you secure, over an insecure channel, for as long as it takes to break the key by brute force. Remember there are some awfully big and hugely parallel transistor and FPGA based computers out there designed to do precisely that, let alone future deivces.
( interesting read )

Anything else really can be defeated by a man-in-the-middle attack, by interception at the key sharing stage (in either direction).
... but I might be wrong.

depontius · Advocate Joined: 05 May 2004 Posts: 3509

asterisc · n00b Joined: 13 Nov 2007 Posts: 13 Location: Cluj

ahurst · Posted: Fri Dec 14, 2007 3:02 pm Post subject:

asterisc:
Oh dear!
And I dare say a service provider offering a quantum encrypted data link would be just as susceptible to being leant on for access, as would any ISP.

Any miscreant worth his/her salt should be clever enough to realise secure communication over the Internet relies on taking some very careful precautions.
Presumably then, as a proportion of crooks out there, the law enforcers will be dredging out the more stupid ones rather then creaming off the clever ones with this policy.
In some ways I'm glad that Darwinian evolution still applies to some areas of society, but on the other hand, I'd rather the criminal underworld weren't one of the few sectors of humanity benefitting from it. The long term effect is: more clever criminals!

steveL · Posted: Sat Dec 15, 2007 7:24 am Post subject:

fahad_se · Posted: Tue Dec 18, 2007 1:53 pm Post subject: what if we say?

what if we say?
we can never be called bug free
_________________
genius born once in a century

steveL · Posted: Tue Dec 18, 2007 4:15 pm Post subject:

http://blog.freenode.net/?p=62 is the link for that recent IRC controversy.

crackytron · n00b Joined: 16 Nov 2007 Posts: 24

Can you not proxy sync through a SSH tunnel to somewhere less insane? I haven't tried it but I'd be surprised if it was not possible.
_________________
welp