Follow Slashdot blog updates by subscribing to our blog RSS feed

 



Forgot your password?
typodupeerror
×
Encryption Privacy Operating Systems Linux

Snowden Used the Linux Distro Designed For Internet Anonymity 171

Hugh Pickens DOT Com writes: "When Edward Snowden first emailed Glenn Greenwald, he insisted on using email encryption software called PGP for all communications. Now Klint Finley reports that Snowden also used The Amnesic Incognito Live System (Tails) to keep his communications out of the NSA's prying eyes. Tails is a kind of computer-in-a-box using a version of the Linux operating system optimized for anonymity that you install on a DVD or USB drive, boot your computer from and you're pretty close to anonymous on the internet. 'Snowden, Greenwald and their collaborator, documentary film maker Laura Poitras, used it because, by design, Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'

The developers of Tails are, appropriately, anonymous. They're protecting their identities, in part, to help protect the code from government interference. 'The NSA has been pressuring free software projects and developers in various ways,' the group says. But since we don't know who wrote Tails, how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it's bad for the NSA, it's safe to say it's good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play. 'With Tails,' say the distro developers, 'we provide a tongue and a pen protected by state-of-the-art cryptography to guarantee basic human rights and allow journalists worldwide to work and communicate freely and without fear of reprisal.'"
This discussion has been archived. No new comments can be posted.

Snowden Used the Linux Distro Designed For Internet Anonymity

Comments Filter:
  • by mythosaz ( 572040 ) on Tuesday April 15, 2014 @02:47PM (#46760275)

    What's that? Have any unknown in your life? Just insert the NSA?

    Don't have the source code? The NSA must be behind it.
    Don't know who spread a worm? Must be the NSA.
    Don't know who authored BitCoin? NSA.
    Don't know who packaged up TAILS? NSA.

    The NSA sent his heavenly son to die for our sins.

    • Re: (Score:2, Insightful)

      by Russ1642 ( 1087959 )

      Well for a start we know that the NSA exists. I can go on but what I've just said pretty much destroys the analogy.

    • by theskipper ( 461997 ) on Tuesday April 15, 2014 @03:18PM (#46760567)

      Well, personally my first thought after reading the summary was "but how do you trust the BIOS?" A few years ago I'd have immediately said that's conspiracy theory and dismissed it (along with the other items you listed). But after a year of exposure to the Snowden and RSA revelations and everything else, it pains me to say these NSA questions aren't so far fetched any more.

      Sure they may not be probable but they could be possible. No matter how rational you think you are, it really messes with one's mind. Subtle paranoia, if you will.

      • TAILS sounds like a honeypot to me. What's wrong with just booting off a KNOPPIX CD-ROM or an Ubuntu CD-ROM? I expect some stuff might get written to a tmp directory somewhere but you could always shred any files there before rebooting the machine.
        • Just physically unplug the hard drive before booting off a live CD? I have to admit, though, that my first reaction was also "Anonymously produced live CD promises to protect your secrets? Sounds legit."
      • Well, personally my first thought after reading the summary was "but how do you trust the BIOS?" A few years ago I'd have immediately said that's conspiracy theory and dismissed it (along with the other items you listed). But after a year of exposure to the Snowden and RSA revelations and everything else, it pains me to say these NSA questions aren't so far fetched any more.

        We need a Harry Tuttle to show up at night in our apts to offer us an alternative BIOS chip.

    • by MrNickname ( 1918152 ) on Tuesday April 15, 2014 @03:19PM (#46760583)
      That sounds like something the NSA would post.
    • Turn on your Heartbleed,
      Let it shine, wherever you go
      Let it make a happy glow
      For the NSA to see...

      • Sort of my first thought... he used this secure software to thwart the NSA, while the NSA supposedly 'owned' OpenSSL that the software likely used. Kind of ironic.
    • by nobuddy ( 952985 )

      How much do they pay you for these NSA flagellation? I'd like a second income, and it appears you don't have to put any effort into it at all.

    • Don't know who did 9-11? No carrier

  • Well, at least it will slow down the other Adam Henrey's with their personal, "needs." Where can I download a copy, today's a good day to start again.
  • by NotDrWho ( 3543773 ) on Tuesday April 15, 2014 @02:51PM (#46760307)

    May want to keep an eye out in the development community of the OS for a sudden influx of programmers "just wanting to help out." Or existing members suddenly driving new sports cars and acting strange.

    • by RGRistroph ( 86936 ) <rgristroph@gmail.com> on Tuesday April 15, 2014 @03:19PM (#46760587) Homepage

      We, the open source and freedom-loving community, may need an organized task force to keep track of these programmers, track their incomes, and store their communications -- just for future reference in case something comes up and a mole is suspected, not an actual search as the Constitution defines it, of course. Similar to the Apache Foundation and other Foundations for Open Source causes, but tasked with keeping our communications secure, and breaking the other side's communications where feasiable. We'll have to keep the existence of the Association secret as much as possible of course, and thus also hide it's budget in small items spread accross the other Foundations. They'll archive all the repos and mailing lists and IRC channels and any other communication medium, but advances in technology make the storage on that scale cheaper. We might have to rent a large building out somewhere that has cheap land and few pesky curious tresspassers, Utah or something. We'll just refer to it as No Such Association for now. A small and expedient measure given the threats of our times.

    • by rcamans ( 252182 )

      Isn't the phrase "programmers acting strange" redundant?

  • 'The NSA has been pressuring free software projects and developers in various ways,' the group says.

    Did they provide evidence for this claim?

    • Re:NSA boogeyman (Score:5, Informative)

      by Midnight_Falcon ( 2432802 ) on Tuesday April 15, 2014 @03:02PM (#46760417)
      Go on YouTube and listen Jacob Appelbaum's (a Tor developer) videos. Something about NSA agents peering into his girlfriend's window at night and various other intimidation tactics..and that's just him..
      • A Tor developer? Being paranoid? Shocking!

        No, I'm sorry, when I say "evidence" what I mean is, and try to follow along here, "evidence". Not anecdotes. Not scary bumping noises in the night. Evidence.

        • Re:NSA boogeyman (Score:4, Insightful)

          by Midnight_Falcon ( 2432802 ) on Tuesday April 15, 2014 @03:57PM (#46760905)
          Considering the fact that the NSA is super-secretive and the ongoing joke is it's an acronym for "No Such Organization," short of another Edward Snowden I don't think you can be given the kind of evidence you want. Remember, before Snowden those "paranoid" people like Tor Developers were relegated by folks like you into the land of nutjobs, conspiracy theorists and tinfoil-hat haberdashers. Now look..
        • Re: (Score:3, Interesting)

          by Anonymous Coward

          Really? There haven't been enough scandals yet?

          - pressure to backdoor linux - http://www.itworld.com/open-source/383628/linus-father-confirms-nsa-attempt-backdoor-linux
          - NSA/GCHQ have power points about trying to attack TOR exit nodes including with DOS attacks
          - they hack sys admins
          - they are suspected of introducing bugs into code bases (anonymous commit to the linux kernel which had a = instead of == allowing remote code exploit)
          - they are known to have inserted hardware backdoors into US chips - most pr

        • A Tor developer? Being paranoid? Shocking!

          No, I'm sorry, when I say "evidence" what I mean is, and try to follow along here, "evidence". Not anecdotes. Not scary bumping noises in the night. Evidence.

          Okay [www.dw.de], "When I flew away for an appointment, I installed four alarm systems in my apartment," Appelbaum told the paper after discussing other situations which he said made him feel uneasy. "When I returned, three of them had been turned off. The fourth, however, had registered that somebody was in my flat - although I'm the only one with a key. And some of my effects, whose positions I carefully note, were indeed askew. My computers had been turned on and off."

          Who breaks into an apartment, turns off alarms,

        • by minus9 ( 106327 )
          Just because your paranoid it doesn't mean they're not out to get you.
  • by Midnight_Falcon ( 2432802 ) on Tuesday April 15, 2014 @02:56PM (#46760361)
    And the anonymous authors of the package deserve a medal.

    The CIA etc notes that its employees 'serve in silence,' surely this team has advanced the cause of freedom and liberty more than them, in silence.

    • ... surely this team has advanced the cause of freedom and liberty more than them, in silence.

      I'm pretty sure that the answer to that is no. "Tails" isn't more than a few years old. The CIA was fighting communist dictatorships for decades, and before that its predecessor the OSS fought the Nazis.

      • Do you really believe that load? The CIA was formed to be an instrument of executive power with minimal accountability, and is one of many intelligence organizations in the United States. While it was fighting communist dictatorships it was also trying to steal the presidential election on behald of Nixon (Watergate), and potentially facilitating the sales of drugs in the USA to finance Iran-Contra. Their SAD divison helped illegally expand the Vietnam War into Cambodia, and use chemical weapons whose
        • How many of the present CIA had anything to do with Vietnam? Iran Contra? See, I can play that game too.

          Watergate was Nixon's own men, not the CIA.

          Were the North Vietnamese in Cambodia and using it to attack South Vietnam? Yes. Are you claiming that Cambodia was outside its rights to ask for assistance against the North Vietnamese occupation of its territory?

          Now maybe you can tell me, how much did the Tails project help dissidents against the Communist governments of Poland, USSR, Hungary, Czechoslovaki

          • Actually, many present CIA employees were around for Vietnam and Iran-Contra..notably, a recent director, Porter Goss -- who was a career CIA employee. Those who were low-level agents at the agency are now in higher positions, and they were around for that time -- albeit it is unkown whether they were involved with those operations. You didn't fact check your statement at all before making it. The reason my statement is true is because of time disparity -- 70 years since the Nazis fell means that any C
            • Former CIA agents are not current CIA agents.

              As the Cambodian situation became worse, the Cambodian government sought military assistance from the United States and South Vietnam.

              -- Across the Border: Sanctuaries in Cambodia and Laos [army.mil]

              The US was out of South Vietnam in 1975. That is nearly 40 years ago. I doubt there are many CIA agents that were working in Vietnam still working at the CIA. Iran Contra is also well into the past. And once again, a former Director of CIA is not a current Director or employee.

              The internet certainly did exist in the 1980s. But you basically concede my point then. Tails had nothing to do with the actual

              • Former CIA agents are not current CIA agents.

                As the Cambodian situation became worse, the Cambodian government sought military assistance from the United States and South Vietnam.

                -- Across the Border: Sanctuaries in Cambodia and Laos [army.mil]

                This is an official military source that misses the point that the "government" of Cambodia was not de facto sovereign at the time, nor legal..the request came from Lon Nol, a pro-US general who was just installed in a coup d'etat.

                The US was out of South Vietnam in 1975. That is nearly 40 years ago. I doubt there are many CIA agents that were working in Vietnam still working at the CIA.

                They'd be 60-70 years old but it's still quite possible. The CIA doesn't really publish lists of employees so this can be checked.

                Iran Contra is also well into the past. And once again, a former Director of CIA is not a current Director or employee.

                The internet certainly did exist in the 1980s.

                Yes, but mostly as U.S-only network, it would be more accurate to say the "Internet did not exist in the way we know it today". CERN and Europe didn't largely uplink into the TCP/IP-based internet until 1989..post-Berlin Wall.

                The real contributor to freedom was the CIA, not the small Tails project only a few years old.

                If you think that the CIA contributed to "freedom" then you speak propaganda only. The CIA contributed to realpolitik, and only came to create "freedom" in places that mattered to the U.S.'s strategic interests. In the same way the KGB helped enforce a "prison of states" around Eastern Europe, the CIA helped foster a similar situation in South America. See Guatemalan Coup [wikipedia.org]. Let's not forget also about Chile and Grenada. Also, the CIA helped stifle dissent in America and reduce American political freedoms during thist ime. Reference: Operation CHAOS [wikipedia.org]

      • by anagama ( 611277 )

        Today, Cold Fjord and the NSA _are_ the Nazis.

  • Almost (Score:5, Interesting)

    by s.petry ( 762400 ) on Tuesday April 15, 2014 @03:02PM (#46760419)

    Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'

    Traffic sniffing does not require files on the target and this is the biggest source of data for agencies like the NSA. It may protect you from key loggers being installed (unless they were inserted ahead of time).

    I'm pretty sure that part of Snowden's leaked information showed that exploits are occurring at the hardware level as well as software. Entry points like LOM modules were explicitly called out in the leaked presentations.

    I'd agree that forensics becomes extremely difficult, if not impossible (memory analysis can still occur). I don't agree that the systems are immune to malicious software at least in a general sense. Immunity would require a lot of control for the hardware running the OS, and monitoring to make sure things have not been tampered with. Relying on a repository build of an OS imaged is still a target for potential a MITM attack feeding a user a kitted image.

    It's all good in my opinion, I'm just being picky about the terminology chosen. Immunity implies absolute safety, and very little in the world is absolute.

    • Re:Almost (Score:5, Interesting)

      by lister king of smeg ( 2481612 ) on Tuesday April 15, 2014 @03:39PM (#46760749)

      Tails doesn't store any data locally,' writes Finley. 'This makes it virtually immune to malicious software, and prevents someone from performing effective forensics on the computer after the fact. That protects both the journalists, and often more importantly, their sources.'

      Traffic sniffing does not require files on the target and this is the biggest source of data for agencies like the NSA. It may protect you from key loggers being installed (unless they were inserted ahead of time).

      All traffic sniffing will do is show they are talking to a TOR entree node. Everything is wrapped in multiple layeres of encryption between you and each of the nodes in between. Maybe they could tell from traffic analysis what type of traffic it is based on traffic profiling, streaming your pr0n over to will have a different profile than browseing a webpage wich will in tun be different than ssh, but they still won't know the end point and what the content is.

      I'm pretty sure that part of Snowden's leaked information showed that exploits are occurring at the hardware level as well as software. Entry points like LOM modules were explicitly called out in the leaked presentations.

      Yes but they would have to have had access to your computer to insert the hardware bugs. If you say pick up a cheap laptop at walmart paid for with cash they won't know who has it, and would not have inserted the bugs as they could not have known who would end up wih the computer.

      I'd agree that forensics becomes extremely difficult, if not impossible (memory analysis can still occur).

      if they are doing memory analysis thy have the computer in their posesion already and you probably have a much larger issues to worry over.

      I don't agree that the systems are immune to malicious software at least in a general sense. Immunity would require a lot of control for the hardware running the OS, and monitoring to make sure things have not been tampered with.

      Technically true. However you have to trust something, and as long as there has been know oppertunity to tamper with the computer you can assume your safe for most things.

      Relying on a repository build of an OS imaged is still a target for potential a MITM attack feeding a user a kitted image.

      That is why we have cryptographic signatures on repositories and iso images. If they can break a 4092 bit key in polynomial time we are f***ed anyway

      • by s.petry ( 762400 )

        All traffic sniffing will do is show they are talking to a TOR entree node. Everything is wrapped in multiple layeres of encryption between you and each of the nodes in between. Maybe they could tell from traffic analysis what type of traffic it is based on traffic profiling, streaming your pr0n over to will have a different profile than browseing a webpage wich will in tun be different than ssh, but they still won't know the end point and what the content is.

        Um, no! I am not sure how much you know about network security, but I sniff packets all the time and decrypt traffic. If you have a private key this is simple to do. With a massive computer, I can store conversations and brute force a key lateer. This was made easier by the NSA introducing some weak algorithms into encryption protocols. Even without those weaknesses, it is possible to brute force. We are better today after knowing about introduced weaknesses, but still not immune.

        Yes but they would have to have had access to your computer to insert the hardware bugs. If you say pick up a cheap laptop at walmart paid for with cash they won't know who has it, and would not have inserted the bugs as they could not have known who would end up wih the computer.

        Unfortunately the exp

      • by AmiMoJo ( 196126 ) *

        Tor mitigates traffic analysis attacks by padding data, generating extra random packets, combining packets it is forwarding or splitting them up again etc.

      • All traffic sniffing will do is show they are talking to a TOR entree node. Everything is wrapped in multiple layeres of encryption between you and each of the nodes in between. Maybe they could tell from traffic analysis what type of traffic it is based on traffic profiling, streaming your pr0n over to will have a different profile than browseing a webpage wich will in tun be different than ssh, but they still won't know the end point and what the content is.

        Assuming you can view every page and do what you need to do without ever turning on Javascript. Which is quite the tall order. For example, there is no e-mail service on this planet that allows signup and use without JS turned on for at least one step or payment (this sounds ridiculous, but go and try it. There used to be. They've all been changed or shut down.). And it's been clearly established all it takes is one malicious script to unmask your IP while on tor.

        Yes but they would have to have had access to your computer to insert the hardware bugs. If you say pick up a cheap laptop at walmart paid for with cash they won't know who has it, and would not have inserted the bugs as they could not have known who would end up wih the computer.

        Actually they would have a picture of your f

  • by SuperKendall ( 25149 ) on Tuesday April 15, 2014 @03:18PM (#46760557)

    how do we know it isn't some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide

    And that, ladies and gentleman, is how you play the Really Long Game.

  • And it's Slashdotted.

  • by spasm ( 79260 ) on Tuesday April 15, 2014 @03:26PM (#46760641) Homepage

    NSA 'compaining' about tails? Oh, no, please don't throw me in that briar patch!

    http://americanfolklore.net/fo... [americanfolklore.net]

  • The Amnesic Operating System. Shouldn't it be amnesiac? Or is this another English/American English difference like aluminium?
    • The Amnesic Operating System.

      Shouldn't it be amnesiac?

      Nope - an amnesiac is a noun that refers to a person suffering from amnesia; "amnesic" is an adjective that means "exhibits properties of amnesia," which can apply to more than just the human psyche.

  • by Vinegar Joe ( 998110 ) on Tuesday April 15, 2014 @03:29PM (#46760661)

    Snowden would have had a much harder time had he been using legal Microsoft products.

  • What do you bet that "Tails" used OpenSSL as part of its security?

    • It did, but a version that was NOT vulnerable to heartbleed since tails tracks debian-oldstable. Also, there is no use case for running a web server that people can exploit heartbleed on via tails.
  • Unless you compile from vetted source code on an un-compromised system using an un-compromised compiler, etc., you can't be certain the binary they provide is the same as what compiling the source code would provide.

    • by istartedi ( 132515 ) on Tuesday April 15, 2014 @04:53PM (#46761463) Journal

      I would assemble the system myself from discrete transistors, except that I can't be sure the NSA didn't drug me, drag me off and hypnotize me.

    • by AmiMoJo ( 196126 ) *

      Most of us are gonna have to trust someone at some point. We can't build our own CPUs out of sand, we have to hope that Intel didn't install an NSA sponsored backdoor. Fortunately all the evidence so far suggests that the NSA avoids creating pre-exploited hardware and firmware, instead relying on more subtle techniques like weakening encryption or making use of genuine bugs. Maybe they insert a few bugs too, but again the evidence suggests that using systems like Tails is pretty effective.

      At any rate, it se

  • by Lawrence_Bird ( 67278 ) on Tuesday April 15, 2014 @04:54PM (#46761475) Homepage

    Are you able to verify all of the distribution yourself? Are you able to vet the contributors? Are they able to vet each other? Is Tor really safe?

    It all comes down to a matter of degree but in the end... Trust No One

    • by Nimey ( 114278 )

      In other words, don't use any technology unless you developed it yourself, smelted the raw materials yourself, &c.

      How much do you trust the evidence of your senses?

      • You'll notice that al Qaeda has gone back to using couriers.

        I would say if you use technology which can compromise your location, communications or other private info and you do not want to share that then yes, you are making a mistake to assume safety unless you have personally vetted it. As noted earlier, it comes down to a matter of degree/risk assessment (ignoring that you may be terrible or unqualifed at assessing that) but that there is a non zero probability you have been compromised. And Trust No

  • https://www.whonix.org/ [whonix.org]

    Magnet links:
    magnet:?xt=urn:btih:A031805E690BB0E03114A8FEB52485517218D3CE&dn=Whonix-Gateway-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Gateway-8.1.ova

    magnet:?xt=urn:btih:AB89247534553946C500EDF3A78E9C30F9C956ED&dn=Whonix-Workstation-8.1.ova&tr=http%3a%2f%2fannounce.torrentsmd.com%3a6969%2fannounce&ws=http%3a%2f%2fwebseed.whonix.org%3a8008%2f8.1%2fWhonix-Workstation-8.1.ova

    And here's

    • by Nimey ( 114278 )

      Note that the above Whonices are vulnerable to Heartbleed, so you'll need to do an apt-get update/apt-get dist-upgrade once you've imported the VMs into VirtualBox.

  • "Fire him! He's too clever for us!"

  • How about just sending the stuff by snail mail? I'd bet my cup of coffee that they completely lost the expertise and interest on this form of communication.

  • They will put developers to work on the open source code who will "accidentally" insert bugs that open holes in the security -like the hole that was recently discovered in https. Tails may have been a problem for them in the past, but with the NSA's nearly infinite budget it seems unlikely that Tails would remain a problem for long.

Experiments must be reproducible; they should all fail in the same way.

Working...