Hacker News Reader

Comment by icu | Hacker News Reader

The striking thing is that criminal enterprise relies on software as much as any other legitimate business. The adage "software is eating the world" comes to mind. It's probably the case that more technically adept criminals will roll their own tech and out manoeuvre rival criminals and law enforcement. Considering the sums of money discussed in the article it's not inconceivable for criminal organisations to start creating their own dev teams.

View on HN

one fun factoid in favor of your argument is that Latin American drug cartels have been known to build their own submarines for drug smuggling.

however, most known criminal dev teams are hacker groups in Russia who either operate as part of official espionage activities, or are allowed to operate as long as their victims aren't Russian.

all that being said, though, this "criminal software" idea probably isn't as true as you think. criminal enterprises are inherently risky, and there's so much money to be made in software that anybody good enough to do well in a criminal enterprise could do well normally.

(unless we count normal companies which get away with breaking the law in the course of normal business as criminal organizations — e.g., Amazon and Tesla for union-busting — in which case, there are probably a lot of people reading this who technically belong to criminal organizations, although some percentage of them would intend otherwise.)

> most known criminal dev teams are hacker groups in Russia

citation, please!

The best solutions are to go low tech. Enforcement models and staffing is reliant on electronic technology. Many enforcement organizations are poorly equipted to handle well implemented physical systems.

I wonder how useful The Solitare Encryption Algorithm would be here - https://www.schneier.com/academic/solitaire/

Solitaire is very broken as an encryption scheme. You should not use it for communication that requires more than LARP security. If you need to encrypt a message manually, LC4 is a better algorithm, but still not acceptable for real world use. The good old one time pad may be most effective.

I don't remember reading it was broken per say, just that there are some issues, and weak keys. The only work I know of analyzing Solitare is [0]. And they propose some fixes to make it more resilient. OTP is by far the easiest and most reliable pencil and paper crypto algorithm though.

[0]: https://arxiv.org/abs/1909.06300

You would think that, but the whole an0m thing showed that it wasn't really the case.

That’s one case. It doesn’t apply to all criminal organizations. The cartels in Mexico are sophisticated enough to build their own cell networks [1] to evade wiretapping. Why couldn’t they also recruit engineers to build their own crypto and secure protocols?

[1] https://www.npr.org/2011/12/09/143442365/mexico-busts-drug-c...

Also, there are lot of open source software in the space - no need to develop your own, just scan the code for backdoors.

In the 90s Colombian cartels were using mainframes.

that's not a cellphone network that's a VHF/UHF radio repeater network. basically same idea as ham radio hilltop repeater stuff in the US, but built for private purposes, and using COTS radios capable of basic encryption.

From the article:

Soldiers seized 167 antennas, more than 150 repeaters and thousands of cellphones and radios that operated on the system.

It sounds like it had both radio and cell bands if phones were able to use it.

There exist very fancy radios that look somewhat like GSM-alike cell phones, if I'm not mistaken.

there are also cheap vhf/uhf handheld radios from china which integrate a basic 2G GSM radio, SIM card slot, and can talk to common euro/asian 3GPP radio bands.

I mean wouldn't it be logical for the criminals to adapt? It's now public that:

a) Crypto is secure, b) Infiltration is difficult, and c) You can't trust hardware and software vendors.

From what I can tell the criminals need international communications to facilitate their operations.

Ergo, my earlier speculation that the technologically savvy ones will adapt and develop their own proprietary software.

Maybe the juice isn't worth the squeeze for criminals to learn software development, but I worry about criminals who do learn.

Reply on news.ycombinator.com