Italian ISP Hides Data Acquisition by Police 23
jaromil writes "It happened recently in Italy: the provider Aruba lied to a customer calling "power loss" a police action to acquire all data contained in the harddisks of the AUT/INV collective,
keeping it secret for a whole year, while more than 30.000 people used its encrypted services for private comunications."
Re:Incredible! (Score:4, Insightful)
The problem is they didn't later inform the other perhaps 29,999 people that they also had their data and privacy compromised.
Not to mention the whole issue of taking their data in the first place
Re:Incredible! (Score:3, Interesting)
Re:Incredible! (Score:4, Interesting)
Actually, Italy has a long history of repressive search and seizure laws that go far beyond what would be considered okay in the US. I am curious to know if they had a warrant for any information that could have been in traffic passing through the server, or it was just some fishing expedition.
Dear Editors: Do your job. (Score:3, Insightful)
Re:Summary is fine (Score:2)
Aruba lied to a customer calling "power loss"
Re:Summary is fine (Score:5, Informative)
It appears the police raid was made and no one bothered to tell the responsible for the servers that an investigation/seizing of data was being made.
Disruption of service occurred, and the phone calls by costumers were answered with technical excuses, instead of telling the truth.
This is what italian webpress says.
Note also that 30000 accounts, personal data, crypto keys, was seized because one single hosted site was under investigation.
Re:Summary is fine (Score:2)
reads, to me, that they had a "power loss" and when people called to complain they were told the "power loss" was really a police action to acquire all data contained in the harddisks of the AUT/INV collective, when in fact it was a "power loss." At least, that's how it reads to me.
Maybe they meant that the citizens have lost all power over the Poli
Re:Summary is fine (Score:1, Funny)
It is not, in fact, a "perfectly well-formed, gramatically correct sentence." There subject/object confusion, a missing comma between "customer" and "calling," and several other miscellaneous mistakes. It could
What can be done to prevent this? (Score:2, Interesting)
Re:What can be done to prevent this? (Score:3, Informative)
If you are trusting some upstream service to do the encryption it sorta defeats the purpose, as this example points out.
Are there US compnies or laws that will make me more secure?
No one can make you secure, except yourself.
Re:What can be done to prevent this? (Score:3)
No, this example points out nothing of the sort. Aruba was purely an ISP hosting a server machine. They shut down the server and stole the SSL keys used for encryption. In no way was Austici relying on them to do anything other than respect the privacy of the box. However, this example does instruct us to not use SSL keys without a passphrase, despite the inconvenience associated with t
Re:What can be done to prevent this? (Score:1)
So it is exactly what I said. People trusting an upstream provider, Autistici, to do the encryption for them, Autistici, in turn, trusted their hosting provider not to tamper with the machine. It backfired, as is to be expected, with that many people having access to the private key.
Re:What can be done to prevent this? (Score:4, Insightful)
The ISP Aruba was much more then an ISP hosting a server machine. Aruba was also providing the physical security of the server. Aruba had physical access to the server, the encryption keys, the encryption software, and the clear text data. Austici had to trust Aruba for the security of the entire system. If Austici wants a secure system they must keep the encryption physically secure. Usually this requires that the servers are in a location that they control and monitor.
Physical security is important (Score:5, Insightful)
Why did they think their system was secure?
This article highlights why physical security is so important. Cryptography is a work around for poor physical security. It is not a replacement. As the server held encryption keys the security of the system was completely dependant on the physical security of that server.
Unfortunately this group hasn't learned their lesson:
We will, as soon as possible, reactivate all the services on a new server, cleaned and sanitized, hosted by a different provider.
This service will still be susceptible to the very same attack.
Re:Physical security is important (Score:1, Insightful)
physical security (Score:3, Insightful)
ISP's answer was absolutely true (Score:5, Funny)
Re:ISP's answer was absolutely true (Score:2)
Query the Oracle, USING proper syntax, and retrieve from it the stored procedure which you must execute in ORDER to ALTER the WINDOW of your mind, and receive the true VIEW. Only the SELECT will learn the correct answer, the rest will be INSERTed headfirst to the DUMP.
Now back up on your two-wheel tape drive, exit the door, turn around,
Genoa G8 (Score:3, Interesting)