Re: Antivirus software will ignore FBI spyware: solutions
[I sent this a couple of hours ago, hasn't appeared on my feed, lne.com. Apologies if you get it twice.] On Monday, November 26, 2001, at 11:49 AM, Sunder wrote:
Great and wonderful except:
1. If such spyware has already been installed on your system you can't trust your os therefore:
a. It may use your OS to hide the key capture log, so you won't be able to just watch files. Think of a kernel patch that removes all references to a specific file, not just sets it to be hidden.
Yes, but this is probably beyond current and foreseeable attacks. I don't dispute that all sorts of advanced attacks are possible, just that the fixes this guy suggested are "much better than doing nothing." Even _secure_ OSes (KeyCOS, for example) are vulnerable to attacks when physical access is gained...doesn't make it easy, though.
4. If you live in a crowded area, your iPod can be lifted off you in a false mugging, or break in, pick pocketting while you're at a restaurant, movie, etc.
This implies a level of surveillance/commitment beyond what most FBI attacks are at. More importantly, theft of my iPod would then trigger certain actions. Cancelling my existing key and generation of a new one. All of these kinds of "they've got your hardware" attacks are present with nearly all systems. All require more work than the simple insertion of a keystroke logger involves. It's all measures and countermeasures.
10. Ordered any new copies of a bit of software? Maybe they have a deal with FedEx, UPS, the Mailman. Maybe what you're getting is the upgrade and then some. How can you tell that copy of SmallTalk doesn't carry an extra bit of code just for you? How can you tell that the latest patch to MacOS you've just downloaded really came from Apple? Sure DNS said it was from ftp.apple.com but how do you know that the router upstream from your internet provider didn't route your packets via ftp.fbi.gov?
Paranoia can be a dangerous thing. --Tim May "Gun Control: The theory that a woman found dead in an alley, raped and strangled with her panty hose, is somehow morally superior to a woman explaining to police how her attacker got that fatal bullet wound" --Tim May "That government is best which governs not at all." --Henry David Thoreau
On Mon, 26 Nov 2001, Tim May wrote:
On Monday, November 26, 2001, at 11:49 AM, Sunder wrote:
a. It may use your OS to hide the key capture log, so you won't be able to just watch files. Think of a kernel patch that removes all references to a specific file, not just sets it to be hidden.
Yes, but this is probably beyond current and foreseeable attacks. I don't dispute that all sorts of advanced attacks are possible, just that the fixes this guy suggested are "much better than doing nothing."
From what I've read in various articles the terror mongers didn't use the internet for much, just had face to face meetings, etc. So of course the use of spyware bugs and carnivore is simply an opportunistic grab at
Sure, doing something is better than doing nothing, and it all boils down to your threat model, as usual. However, with the heightened 911 crap, it seems these guys will do nearly anything to get the bad guy -- I wouldn't put it past them to beat the shit out some one who just so happens to be of arab descent until they sign a confession. But one has to consider several factors in building a threat model including: Why do I want to encrypt my hard drive? Why do I want to encrypt my emails? How much attention am I attracting by starting to use PGP now versus pre 911? Can I communicate securely by means other than email? Of course the cypherpunk answer is you should always encrypt everything all the time, but if you haven't do so up until this point, is it worth getting probed by the Feds? Maybe it is if they have nothing on you or you expect them to have little reason for fucking with you. If you're of arabian descent, using PGP might just buy you a ticket to one of those fancy new fangled jails where they don't let you have reasonable access to a lawyer, a sweater, or much else among the company of the other 1100 or so suspected terror mongers. On the other hand, if you're a known cypherpunk and have used PGP in the past, this won't attract too much extra attention. power. But so were the Jim Bell and Toto arrests. The question isn't what have you or I or Joe Sixpack to hide as much as what do the Feds think you have to hide, and is it worth it to attract their attention. If you're willing to attract their attention, do you have the technical means to thawart and detect their intrusion, do you have the legal (and by implication money to buy legal) means, etc. The technical stuff is fairly easy if you think it through, but difficult/expensive to implement well. Find all the holes and close them, and should they use black bag ops, set up ways to detect them. The legal means have now changed.
Even _secure_ OSes (KeyCOS, for example) are vulnerable to attacks when physical access is gained...doesn't make it easy, though.
Absolutely. You can close most of the holes. You can make the ones you can't close harder to use by alarming them and watching them alarms closely.
4. If you live in a crowded area, your iPod can be lifted off you in a false mugging, or break in, pick pocketting while you're at a restaurant, movie, etc.
This implies a level of surveillance/commitment beyond what most FBI attacks are at.
Doubtful. They've install key catcher hardware in lots of computers to get spies and mobsters before. The treasury guys installled a gps tracker in Jim Bell's car, etc. All these imply black bag jobs are not beyond them at all.
More importantly, theft of my iPod would then trigger certain actions. Cancelling my existing key and generation of a new one.
Sure, but that would be useless for past communications. If they've copied your emails before, and now have the key, they have what you wrote and what you've read. They don't have future writings, but once they've broken in to your machine, you can assume they own it. Depending on how the bug is installed, simply wiping it might not be enough.
All of these kinds of "they've got your hardware" attacks are present with nearly all systems. All require more work than the simple insertion of a keystroke logger involves. It's all measures and countermeasures.
Yup. Again, back to the threat model. :)
On Monday, November 26, 2001, at 04:37 PM, Tim May wrote:
Paranoia can be a dangerous thing.
So can it's absence. -- "Remember, half-measures can be very effective if all you deal with are half-wits."--Chris Klein
participants (3)
-
Petro -
Sunder -
Tim May