Slashdot Mirror
FBI Compromises Another Remailer
betterunixthanunix writes "Another remailer has been compromised by the FBI, who made a forensic image of the hard disk of a remailer located in Austria. The remailer operator has reissued the remailer keys, but warns that messages previously sent through the remailer could be decrypted. The operator also warns that law enforcement agents had an opportunity to install a back door, and that a complete rebuild of the system will take some time."
Why the fuck are you intruding into and altering foreign systems? That's not your fucking jurisdiction or job!
Leave that shit to the intelligence agencies, if someone must do it.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
Did they manufacture any "evidence" in the process?
Not if they were encrypted to the end recipient's public key. If not, they were plaintext in transit and possibly on the ISP's server.
So, are there any remailers in countries that don't have reciprocal juristictional arrangements with the USA?
I'm going to take this opportunity to post a link to information about remailers, but I think you are an idiot for asking.
http://www.andrebacard.com/remail.html
Don't know something? Look it up. Still don't know? Then ask.
An anonymous remailer is a server that receives messages with embedded instructions on where to send them next, and that forwards them without revealing where they originally came from.
http://en.wikipedia.org/wiki/Anonymous_remailer
Lets break the word down for you:
[re]-[mailer]
I'm sure you can figure it out from there. If you still can't, go here.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
....is that the FBI is a criminal organization.
Anonymous remailers are set up for reason of protection of those with information they want to get out but can as well suffer from a repressive regime, otherwise risking death if not done anonymously. Even universities of law have set such remailer up in respect of the law, ethics and democracy.
Perhaps there is a jail cell next to Bradly available for these. Naw.... not a chance.... somebody is going to die and that will make it ok.
What an upside down world we live in... Ready to flip it right side up?
So, effectively, the FBI has just committed a crime. They have intruded into the server of a foreign company and added a backdoor. I am surprised Austria is not up in complete arms over this. Anonymity in of itself is not a crime so the FBI really behaved egregiously!
include could the FBI briing a rogue remailer online using the image?
why wasnt full disk encryption used in this case to store the private keys?
in my opinion everything from the case fans to the bolts in the mounting rails on this server are now tainted. Sell it on ebay and build a new one.
Good people go to bed earlier.
According to the link discussion, this came about as the result of a Pittsburgh bomb threat, as authorities try to trace the original sender.
Copying a whole hard disk seems a bit much. Especially since it's a foreign country. I guess if it were US, they would sieze the hardware instead. Still, I have to wonder about collateral data that went through that remailer. Say they find something unrelated but illegal. Jurisdiction go out the window here, or is the US really the gonna be world cop for the Internet? Or at least, only when it upsets them.
I hope others here and around are helping do their part, sending meaningless noise messages through the reamailer networks.
I don't expect everyone to know everything about every topic, but I do expect people to make the effort to find out what something is before they put out a request for information.
And no it is not betterunixthanunix's fault that people viewing a news for nerds website can't figure out what a remailer is. A basic grasp of english tells you what a remailer is, and if you do not have a basic grasp of english you should be used to looking up words when viewing an english language website.
Don't know something? Look it up. Still don't know? Then ask.
When I read the summary ("... forensic image of the hard disk"), I pictured an agent standing over a server taking a photo of the HDD (with a Polaroid camera).
Nothing would surprise me after reading this.
No. In the view of every competent Slashdotter out there, anyone who is ignorant enough to post the question here rather than using this handy little tool is an idiot.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Because anonymous remailers are not designed and implemented for the use of Spammers any more than the Internet was. By your logic: Spammers use anonymous remailers so taking them down is good, and Spammers use the Internet, so taking it down is good. See the problem there?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
"I'll be back!"
Life imitates art, because when he came back, he was pwnd by Connor.
Have gnu, will travel.
And nothing of value was lost.
For large sets, this will be our guide even unto death, for the LORD will work for each type of data it is applied to...
If we're going to trust these remailers then we need to do things properly. Key goes into the crypto processor, never comes out. Means someone can't just seize your server and image it then use that image to decrypt all traffic that passed through. If they want to try and get it out, fine but they'll need a guy with an Electron microscope to do so and they'll likely trip the tamper measures and bye bye key. If you're particularly paranoid you can even destroy your copy of the key once you've loaded it, this might mean changing your key if you have to move servers but it means that the service you offer is truly tamper evident. Plus you also have the added bonus that a dedicated hardware security module is usually quicker than your processor at doing encryption/decryption.
Can I send in a FOIA request to get back that important email that I lost last week when my hard drive failed?
While I realize this was not a US server, I am curious. Can the FBI legally install a backdoor into a US server without a warrant to specifically do so? I would assume not. Of course, I guess that wouldn't keep the FBI from illegally installing a backdoor.
For private communication use postal mail.
Encryption keys were lost ...
Puteulanus fenestra mortis
In a democracy, just as the government is meant to be accountable to the people, the people are accountable for the government they choose. Democracy doesn't stop at the ballot box. This is something noone seems to get. Why does everyone hate Americans? Because of what their government does. And they keep on putting assholes in charge. Sure, not every American voted the same way, but as a democracy you (theoretically) have the power as a population to stop bad laws from being passed, and to stop bad actions from being taken... In general, people don't. It's called tacit consent. Bitch and whine all you want, and say you voted for the other guy, but you are implicitly condoning the actions of your government until you actively protest against them, either within the law (writing letter to your representatives, legal protests) or outside the law (civil disobedience).
I mean, if the person they're after, used the remailer system as it is supposed to work...it "should" be uncrackable and untraceable.
It will be interesting to see the system go through what I have to guess is the first actual hard core test it has ever gone through.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Send all your data through the US email system then if you have a catastrophic loss you can just use a freedom of information request to get a copy of your data!
Why was this modded flamebait? He was responding to an idiot. It took more effort for the AC to post to Slashdot than it would have taken for him or her to look it up. I can't even say that the AC was too damned lazy to look it up, since it actually required more effort to post to Slashdot and then review responses. Jeng had the decency to provide the AC with the information requested, and also took steps to correct the idiotic behavior.
My own post may disappear because I might mod Jeng's post up as informative.
http://lmgtfy.com/?q=remailer
If remailers are getting taken down because authorities want images of their hard drives, what about just giving that to them? Pre-emptively? The hard drives should have nothing revealing on them, I think. Is that your understanding, too? If so, then remailers could continue to operate despite law enforcement investigation.
The sticking points I see:
My intuition says it may be possible to overcome each of these.
Up to +1 Flamebait
I really should get some sort of achievement for that.
Don't know something? Look it up. Still don't know? Then ask.
Why not try and induce a mass media frenzy that can focus on twhen the FBI has found leaks, and compromised particular networks, specifically the ones that are responsible for the worst spam. Then attach all sorts of fake info about busts, raids, etc...and that they are looking for more of the individuals associated through C&Cs and will use the ip list to track them down.
This would lead to all or any of the people using the C&C to stop right away for fear of getting caught and laying low until it tides over, even though the threat is fake and therefor without costing any money but lying to media a little, you brought down temporarily the amount of spam out there.
Your mood will change when you have a bunch of people with M4s pointed at your head at 4AM local time. I suspect you don't run for the "delete" button.
http://xkcd.com/538/ also XKCD
Right, it looks as a decent process was followed here. FBI found came up with a potential issue, made a request thru the local government and made their case. Their local court ruled on the request and produced a warrant.
They imaged the machines for later infestation by the FBI, instead of asking for confiscation, so while there was a bit of downtime it wasn't a knock out blow.
---- Booth was a patriot ----
Which was why I said destroy your copy of the key once you've loaded it... It's far more likely you'd be compelled by a court order than an M4 anyway. The point being if the only copy of the private key is in the crypto processor then it doesn't matter whether your opponent uses rubber hose cryptography or has a court order, because you don't have a copy of the key to give them and they know that because you've advertised that fact before hand.
From NSA's point of view, right now your gmail account is noise. But everyone's political views change over time as a natural part of the process of growing up. Sometimes things go wrong, and perfectly normal people who hold perfectly normal views turn into monsters. There's a 99.99999% probability that you're not one of them. But for the sake of 3 lousy gigs out of a yottabyte, there's a 100% chance that someone's 3GB of noise will contain signal.
And this is what is wrong with America. People will go to any end to have 100% safety, including sell out their rights and privacy if they think there is an IOTA of a chance it will protect their measly worthless backsides.
I am proud to say I believe in freedom and the beliefs of the founding fathers.I am willing to die for the country in the name of freedom. I don't want to, but I accept that risk as a cost of living in a free society. If that means that there is a small chance that I die because the plane/train/buss I am on destroyed in a terrorist attack, I freely accept that risk. The rest of America needs to wake up and realize that selling privacy and freedom will not buy them any more safety and security.
Data intercept is just plain wrong. Nobody has license to spy on America domestically, there is a reason why warrants are required legally to engage in surveillance.
HA! I just wasted some of your bandwidth with a frivolous sig!
...or, to avoid 'specialist' hardware (and thus bring it into the realm of a $10/month VM), would it be possible for the machine to boot up and wait for a key to be sent to it, which it would store only in RAM?
This idea suggests it might be possible for the FBI to nab a server and actually get nothing at all. If they had some way to breakpoint the system and read the RAM then presumably they'd get everything though (which the crytpo chip wouldn't be vulnerable to).
This method also means it would be possible to setup a cluster of servers in disparate locations, but have them keyed from machines in other locations. If they keys got delivered by email, then it could be considerably difficult to work out where the keys came from, and thus make it hard to 'cut off the head' and destroy the cluster.
Going further, I guess you could set up VPNs between remailers so that machine A receives an email, but actually sends it to machines B and C to have it decrypted. Machine B just sends the message right back, whereas C decrypts it and sends it back. Thus, you wouldn't know which machine had actually done the work, and thus which machine to subpoena. This method is a lot more complicated, and I'm sure needs a lot more thinking about (and would need one hell of an implementation not to have a backdoor in it).
All this said, I have no idea what I'm talking about. For some reason I've always enjoyed the mental challenge of working out how to overcome these sorts of problems though.