Hacker News Reader

Comment by lol768 | Hacker News Reader

I don't quite understand how this worked and the article is thin on details - was there not E2E encryption between the participants?

> Our servers are node based and located all over the world; all input and output are true end-to-end encrypted. The Servers only initiate the tunnel.

Their own statement suggests a zero-day?

> Today we had our domains seized illegally by government entities. They repurposed our domain to launch an attack to compromise carbon units.

> With control of our domain they managed to launch a malware campaign against the carbon to weaken its security.

View on HN

Here is a link from another HN post. It explains a little about it from my quick scanning:

https://www.vice.com/en_us/article/3aza95/how-police-took-ov...

> French authorities had penetrated the Encrochat network, leveraged that access to install a technical tool in what appears to be a mass hacking operation, and had been quietly reading the users' communications for months.

Sounds like their servers got popped, probably ones distributing updates, and also sounds like hand rolled crypto from their website although that doesn’t mean much if they can access the devices.

Breaking "hand rolled" crypto is a very hypothetical threat, almost a non-existent threat, as in practice software with centralizedly controlled distribution model has many much much bigger weaknesses that advanced threat actors are going to exploit, like updates. Assuming they even can successfully break such crypto at scale, imagine how much effort would it take just to get to the encrypted bytes given all the VPNs, TOR and overlay networks providing extra layers of encryption and privacy/anonymity hiding who talks to whom by sending packet through other countries.

I guess what people should learn from this is that encryption isn't a protection without solving problems caused by centralization first.

Well, I wouldn't say that's true, hand rolled crypto notoriously is weak when your adversary has cryptographers... like governments.

And this system sounds extremely snake-oily, and likely making typical bad crypto mistakes everywhere.

That's a good summary.

The other article I read about this is that law enforcement compromised the service's servers and pushed an update to the clients, making them send unencrypted messages, which allowed law enforcement to read them as they came through in real time.

Devil's advocate: Is there evidence law enforcement didn't start and run the project from the beginning? If they did, I wouldn't expect them to come out and acknowledge it.

I'm similarly skeptical of popular VPN apps.

Humans are often the weak link here. The most common scenario is that the police had some control over the project due to a compromised person. I'd wager that the police did not start the project, but soon after it was being used for crime, they took over it.

I'm not sure it's possible to me to develop and run something with the assumption that even if I turned police intelligence asset, that the product would be untouched. Open source would help, and some kind of distributed, decentralised thing maybe

I agree. That seems more likely. I doubt we'll be told, but I'd be interested in the specifics. It seems like it might have ethical implications to take over it without the blessing of the owner(s) of the company. After all, I doubt they will be able to get many more customers now that it's widely known that it was compromised by law enforcement. Arguably law enforcement destroyed this company, which the owners might normally not be happy about.

It may be as simple as: the business wasn't making money and the owners wanted out, so law enforcement bought it or paid them off. Then law enforcement isn't really "compromising" the company--they're in control of it (whether the employees know or not). At that point they can have the existing devs modify it however they want, or just hire a few new devs.

Think there may be some legal/ethical issues with law enforcement starting/running a honeypot that is actively being used to plan (and probably carry out) murder, while they just sat back and watched.

Yeah, police are just not that entrepreneurial in enabling crime.

It's like trying to design something to go viral -- harder than it looks. Probably easier just to find informers.

Yeah, any VPN that doesn't mind paying YouTubers to advertise I run far away from.

But in that case why wouldn't the system's owners alert everyone about that fact? It's pretty obvious when your system is sending updates and your domains are getting seized.

According to the Vice article, they did notify users on multiple occasions about the compromise. They even pushed out software updates and worked with a 3rd party SIM provider to try and fix the issue. Apparently, even after they pushed out updates the “hackers” were somehow able to repeatedly regain access.

Do you have a link?

The Dutch news mentions the police managed to snoop on the messages "before they were encrypted", so I assume they managed to hijack the app update process and installed a keylogger or something.

If they had access to the servers then they could have intercepted the key transfer. They would then be able to decrypt any messages sent

If that was the case, it's not really "before they were encrypted" though.

Some government comms such as areas including disaster relief and simple police dispatch are end to end

Thalw problem is the key is transmitted in dtmf or other means in the clear. I am not sure what my local pd uses for encryption but I'm guessing it's outdated.

You can set the tornado sirens off with a small transmitter and recording the very consistent tone pattern of you wanted.

The worrisome thing is that cops use their cellphones instead, which is much more secure but also is used accidentally or purposefully to avoid public records.

Police dispatch might be encrypted but not very well.

https://www.mattblaze.org/blog/p25

It's actually worse than clear text radio in many ways.

All cellphone call meta data and all SMSes are recorded, so while it avoids people listening in scanners and the public record it isn't very confidential. It's police using WhatsApp and Signal that will cause big problems.

Reply on news.ycombinator.com