Police Decrypt 258,000 Messages After Breaking Pricey IronChat Crypto App (arstechnica.com) 122
An anonymous reader quotes a report from Ars Technica: Police in the Netherlands said they decrypted more than 258,000 messages sent using IronChat, an app billed as providing end-to-end encryption that was endorsed by National Security Agency leaker Edward Snowden. In a statement published Tuesday, Dutch police said officers achieved a "breakthrough in the interception and decryption of encrypted communication" in an investigation into money laundering. The encrypted messages, according to the statement, were sent by IronChat, an app that runs on a device that cost thousands of dollars and could send only text messages.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
Paid Product Endorsement? (Score:5, Insightful)
"I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation,"
Sure sounds like a paid product endorsement....
Re: (Score:2)
Re:Paid Product Endorsement? (Score:5, Funny)
"Exactly, who the fuck is quoting me? And why do I look so fucking pale in all the paintings?" - Jesus of Nazareth
Re: Paid Product Endorsement? (Score:5, Insightful)
I think what probably happened is Snowden was talking about the OTR protocol, and not a particular product and the marketurds twisted his words with their ignorant/malicious misquotation.
Re: (Score:2)
I'm pretty sure this quite is fake. I can't find an original source for it, and Snowden's writing style would at capitalize the 'I', if not put quotes around "hi" and "hello".
He has mentioned OTR before, but not in reference to IronChat.
Re: Paid Product Endorsement? (Score:3)
This is a common problem, and can also be accomplished by getting a rogue employee in, getting an backdoor in version control that eventually gets pushed, or stealing developer credentials.
That's why the crypto hardware my company is working on has a four part process. To do an update, we first have to sign the firmware. Next, a third party code audit company has to countersign after auditing any changes and building their own identical build. Next, the customer must use their admin credential and upgra
Re: Paid Product Endorsement? (Score:2)
That is what the self destructing enclosure is for. Light, temperature, tamper sensor.
Extremely thin on useful detail (Score:5, Interesting)
This is likely just a fairly amateurish security protocol implementation sold at inflated prices to people flush with cash.
Its really not all that hard to do secure communications... if actual criminals used something called "ironchat" they deserve what they got.
Re:Extremely thin on useful detail (Score:5, Interesting)
Police informants deep in criminal networks are safe as everyone thinks it was the computers.
Informants that stay in place can then report on the next use of crypto.
Re:Extremely thin on useful detail (Score:5, Informative)
Rather succinctly explained in the release from the Police:
We stopped the operation because we became aware that criminals were starting to suspect each other of leaking information to the police. This was causing safety risks. That’s why now we make clear that it was us acting upon information from the chats.
Re: Extremely thin on useful detail (Score:1)
Sounds like a cover story to protect a high level informant or undercover cop.
Re: Extremely thin on useful detail (Score:4, Insightful)
Just because someone is a crook doesn't mean its ok to step over their dead bodies to stop them.
The information the police were obtaining causes the crims to suspect and then kill / harm each other. The police determined that the risks or death / injury to the people involved in or around the criminal activites exceed the rewards
Re: (Score:2)
Re: (Score:3)
I see it several ways.
1) maybe they can't crack it - so everybody move to another one that they can break. :-)
2) maybe they want to see Who moves - and that is telling
3) I'm surprised they didn't say "gosh we can't break this other Secure Chat App"
Re: (Score:2)
Intercepting an encrypted message and being able to READ said message is 3 different things.
Re: (Score:3)
"used something called "ironchat" they deserve what they got."
Exactly! It would have been much cheaper, and just as secure to use triple ROT13. Cause it's 3x betterer.
Re: (Score:3)
"used something called "ironchat" they deserve what they got."
Exactly! It would have been much cheaper, and just as secure to use triple ROT13. Cause it's 3x betterer.
I prefer the Rotweiller13 encrypted comms: the message is transmitted via a sled pulled by 13 extremely hungry rotweillers.
*Lag is horrible and distance can become a problem.YMMV (literally).
Re: (Score:2)
Had I not commented you would be getting my last point. Good work!
Re: (Score:2)
"used something called "ironchat" they deserve what they got."
Exactly! It would have been much cheaper, and just as secure to use triple ROT13. Cause it's 3x betterer.
I prefer the Rotweiller13 encrypted comms: the message is transmitted via a sled pulled by 13 extremely hungry rotweillers.
Is it's bark worse than it's byte?
Re: (Score:2)
This is likely just a fairly amateurish security protocol implementation sold at inflated prices to people flush with cash.
Its really not all that hard to do secure communications... if actual criminals used something called "ironchat" they deserve what they got.
If secure communications are so easy, why do so many people seem to get it wrong? It only takes one little mistake to compromise secure communications. The mistake may not even be in anything but a library you use or a design flaw in the silicon you run it on. No. Secure communications is very difficult and that is why the NSA spends a lot of time and effort A) Monitoring others communications B) developing and testing secure methods of communication.
Re: (Score:2)
They siezed the site (Score:1)
And siezed the keys, then used those keys to unlock the locks. Or the messages are logged unencrypted on the siezed site.
I promise you the dutch police have no ability to "hack" anything.
And IronHorse or whatever has never been secure.
Re:They siezed the site (Score:5, Interesting)
A trojaned version of the app is also a good possibility. They could have quietly taken control of the site, changed the app to push the keys back to them, etc. Sure that's beyond a typical police department but with any agency help it's totally doable.
You don't have to be incompetent to get a gag order and have your stuff compromised like that.
So only Android not iOS users of the app? (Score:2)
Re: (Score:1)
Re: (Score:2)
Why only Android? You don't think Apple bends of backward to accommodate law enforcement?
Because of the word "trojan" in: "A trojaned version of the app is also a good possibility."
Re: (Score:2)
They were custom phones ('IronPhones'). Stop trying to inject Android/iOS-strife into this.
Re: (Score:2)
Yes The Netherlands has some great IT security people, just think about how they for several watched the webcam in a major Moscow troll factory.
Until Trump blew the whistle...
Re: (Score:2)
That still requires the correspondents to have exchanged the public keys somehow. I bet, the site was signing the users' public keys with their own so that device would trust them. There is no way to do this — enable PGP-communications between strangers — otherwise.
Even if the site didn't act as the "man-in-the-middle" itself — and you may well be right in that they did — by
Re: (Score:2)
Re: (Score:2)
but in order for each client to know to trust that the other isn't a man-in-the-middle attacker, you need some kind of trust authority (usually a central CA). if the keys to that were compromised, then all bets are off - which is what mi was saying above.
Re: (Score:2)
Re: They siezed the site (Score:2)
Yeah. If youâ(TM)re sharing a key then you donâ(TM)t need asymmetric enc at all. You can just share your aes key (or whatever) and be done with it.
Re: (Score:3)
Its not end-to-end if the service provider / middleman is providing or transmitting the keys. The key should be exchanged via an entirely different and unrelated channel of communications
You would be right if the purpose of the app was to provide secure communications. It wasn't. The purpose was to make money from criminals that are willing to pay for an application where they _believe_ they get secure communications.
Re: (Score:2)
The "different and unrelated"... such as?
Re: (Score:2)
The "different and unrelated"... such as?
Well you could go the full Snowden and fly to Hong Kong, meet in a hotel room and get under a blanket with computers that have never been online. Or any myriad of less drastic things that would be an improvement over letting a middleman handle keys for you.
Re: (Score:2)
Such as? Remember, we are talking here about strangers seeking to communicate securely without ever meeting each other in person...
Re: (Score:2)
Such as? Remember, we are talking here about strangers seeking to communicate securely without ever meeting each other in person...
Sigh --- Create a truecrypt/versacrypt volume with a text file with the keys. Email them, put them on a USB stick or SD Card and postal mail them, ... Phone, text, postal mail (not if sending USB stick or SD card via postal), etc the volume passphrase. Use temporary emails, burner phones, etc depending on you level of paranoia, fedex, ups or courier rather than postal mail. As I said there are a host of options beyond the chat service middleman also handling your keys.
Re: (Score:2)
Mail — and all your other means of communications, except those under blanket ones you mentioned — are still subject to interception by government. And, probably, should be.
Though two dedicated people could use some of the means you describe, it can not be done commercially....
Re: (Score:2)
Mail — and all your other means of communications, except those under blanket ones you mentioned — are still subject to interception by government. And, probably, should be.
Though two dedicated people could use some of the means you describe, it can not be done commercially....
Yes, and when the gov't grabs a single site as in this case you lose everything. However if you had used one of the other channels for key distribution you would overwhelmingly likely be just fine. You are comparing apples and oranges, a massive haul of keys and communications at a single point of failure and the targeting of one specific person over many channels of communications. Two very very different things.
And if you are concerned about being targeted over many channels of communications then you
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
And siezed [wikipedia.org] the keys.
Re: (Score:2)
google certificate authority.
Not really end-to-end encryption (Score:2)
They siezed the site
And siezed the keys, then used those keys to unlock the locks.
Then its not really end-to-end encryption as claimed. Its just another service encrypting its traffic so middlemen, other than itself and its masters, can't read it. In true end-to-end the service provider can't read the content even if they want to.
Brilliant (Score:3)
If there was any chance of listening to future conversations between parties using Iron Chat, this announcement just blew that right out of the water.
The folks who wish to talk via encrypted channels will now simply change their method of communication.
It could be another commercial app, a homebrew one or just go all old school and do things the way it was done before the era of smartphones.
It could also be complete bullshit on the part of the Police in an attempt to get folks to quit using it :D
Re:Brilliant (Score:5, Insightful)
They couldn't keep it secret for very long because they would have to present the intercepted messages in court eventually.
It appears that weaknesses in the app are to blame here. It was a poorly designed app, basically snake oil.
Re: (Score:1)
Maybe Iron Chat is working so well, the only way to defeat it is to fake a story that it's been cracked so people switch to something more exploitable.
Re: (Score:2)
Better to tell everyone that it was "computers" and protect other well placed human informants working for the police.
The police can then control the results now rather and unexpected results of finding actual decades of well placed human informants.
Informants who can always find out what the next crypto products is
Re: (Score:3)
It was on the news here: the police announced it at this moment on purpose, because several people getting arrested recently made other criminals suspect someone in their mids was leaking to the police and they were planning violent actions against them.
Re: (Score:3, Interesting)
You apparently don't understand the underworld.. They would have been killed, not beaten up.. I'm no longer a criminal but I still despise rats. If you do a crime and get caught for it shut the fuck up and do your time don't rat someone else out that was smart enough to not get caught because you're a fuck up. The rats deserve to die. I've seen police let violent offenders who have ratted go free and lock up the drug dealer(weed) for years because the violent person turned state.
Re: (Score:1)
It sounds like you actively and strenuously promote conspiracy after the fact, so I guess rehabilitation failed on you.
Re: (Score:3)
You apparently don't understand the underworld
You're right, we don't.
If you do a crime and get caught for it shut the fuck up and do your time don't rat someone else out
In law there is something called the Clean Hands Doctrine that can be fit here. It a nutshell it says that if your hands are dirty, you are not entitled to a fair outcome.
Re: (Score:2)
Back to "You apparently don't understand the underworld" We are talking about the CCOC(since you guys like codes of conduct so much).
Criminals do not follow "laws" That's why they're criminals. Which is also why the people saying "make guns illegal" look like bleeding heart idiots, because they don't even realize that the people committing 99% of gun crimes are already criminals and couldn't give a fuck about a gun law. But from the brief look at your comment history I cant tell if you will be able to under
Re: (Score:2)
No, you weren't just stating facts. You were stating your opinion that "the rats deserve to die".
If you're talking about criminals willing to kill each other, then you should consider that maybe both the rats and the ratted-on deserve to die.
Not to mention the irony of you complaining that " . . . using words to express my thoughts means I'm a criminal because of the words contained in my thought." and also complaining that the rats expressing, in words, what they know
Re: (Score:1)
The moment you become a criminal, you no longer get to play the moral high ground, but you still consider yourself somehow being morally superior to an informant, an individual who actually aids the non-criminal society by putting shitheads like you behind bars?
That is the most retarded thing I have read all week. You decide to shit on the society and break its rules for material gains, but the moment someone shits on you for a material gain (
Re: (Score:2)
In law there is something called the Clean Hands Doctrine that can be fit here. It a nutshell it says that if your hands are dirty, you are not entitled to a fair outcome.
You really don't understand the clean hands doctrine. It has nothing to do with what he's talking about.
Re: (Score:2)
You really don't understand the clean hands doctrine. It has nothing to do with what he's talking about.
The difference is my ability to apply ideas and concepts outside the domain which they were originally applied. It's one of the things that separates us from lower animals.
Re: (Score:2)
You apparently don't understand the underworld
You're right, we don't.
If you do a crime and get caught for it shut the fuck up and do your time don't rat someone else out
In law there is something called the Clean Hands Doctrine that can be fit here. It a nutshell it says that if your hands are dirty, you are not entitled to a fair outcome.
So every police department is not entitled to a fair outcome then. Got it! That is why I cheer inside when someone goes on a killing spree of the asses in blue!
Re: (Score:2)
So every police department is not entitled to a fair outcome then.
Police are humans. Punish the bad ones, and get one with your life. The fact that there are bad apples doesn't mean the entire system is crap. There are always bad apples anywhere you go.
That is why I cheer inside when someone goes on a killing spree of the asses in blue!
Got it. You are happy when people are murdered, because some minute percentage of people in the same line work have done bad things. See a therapist friend.
Re: Brilliant (Score:2)
Re: (Score:1)
The rats deserve to die. .
You're dangerously close to being a criminal again, IMHO. Control yourself before it's too late.
Re: (Score:2, Insightful)
No, see these are WORDS. Once again people on slashdot conflate words with violence. My words didn't hurt anybody therefore get the fuck out of here with your noise. I was smart, I did my time and realized being a criminal is fucking stupid and I bust my ass for a living now. on that note.
You're dangerously close to being a fascist, IMHO. Control yourself before it's too late.
FTFY...
Re: (Score:2)
Criminals don't deserve loyalty. Informing the police of a crime is what civilized people do and should do.
Re: (Score:2)
Criminals are not civilized or they wouldn't be criminals. And believe it or not for *most* criminals there is such thing as honor among thieves. The ones that turn state are the ones that couldn't handle THEIR OWN ACTIONS! Nobody forces people to become criminals, that is 100% a choice of the person doing the dirt.
Re: (Score:2)
And believe it or not for *most* criminals there is such thing as honor among thieves.
Actually, there isn't.
A UK police phone line where you can phone in information about crimes anonymously reported that 1/3rd of all calls come from criminals who want to get rid of the competition. And it's common knowledge for everyone in jail that the ones saying "don't rat on anyone" will be the first ones to rat on you.
Re: (Score:2)
Wow, that is almost the complete opposite of the US systems. Here the people snitching do it to get their sentences vastly reduced if not absolved completely.
And it's common knowledge for everyone in jail that the ones saying "don't rat on anyone" will be the first ones to rat on you.
That is common with a lot of things, It is a risk you take if you're a criminal and do work with other criminals. That's why you need to have a good judge of character. But even that is not guaranteed. I found the easiest thing to do is not do crime for a living. Makes life a lot less stressful. Especially when you do the kind of shit that makes you ha
Re: (Score:2)
I really appreciate people that change their bad ways and start to recognise mine and dine, including the right to someone's life.
But by the fact you consider a converted criminal a snitch bring you down to their level.
Re: (Score:2)
A snitch is not a converted criminal. I am a converted criminal. A snitch will snitch on somebody to get a reduced or absolved time for their crime. and go right back to committing crimes as soon as hes out of custody.
Re: (Score:2)
Collateral damage.
Snowden mentioned OTR in the past (Score:3)
Pretty sure that quote is only half true. Snowden has mentioned OTR in the past. I doubt he specified IronChat.
Joseph Elwell.
The police did not break anything (Score:3)
Seriously, criminals stupid enough to rely on proprietary, centralized messenger services deserve to get jailed for that alone.
There should not be any keys to fetch (Score:2)
We should not be using PKI that depends on a trusted source.
People have their own private keys. But then how to know that you are using the right one? The SSH problem.
So use SRP instead. Secure Remote Password. The communication only works if both people use the same password. And no way to brute force the password back. Simple, and intrinsically secure.
There is no such thing as money laundering (Score:2)
Sadly, most of them do. Everyone else gets theirs taken away involuntarily. We all clap when we hear that the government nabbed one of those evil money launderers.
Money laundering is an almost sure-fire conviction as it is impossible to disprove, and that is exac
Re: (Score:2)
You apparently don't understand what money laundering is. In the simplest sense, let's say you're a drug dealer and you have $20,000 in cash. You want to store it in the bank, but when you do that the IRS finds out about it. So you create a sham business and cook the books, making it look as if the money is really proceeds from your business.
We sometimes see things listed for exorbitant prices on Amazon. Probably money laundering. A friend of mine talks about car auctions now, where people will buy car
Decryption tool (Score:2)
Crypto snakeoil (Score:2)