Slashdot Mirror


Australian Spy Agency Seeks Permission To Hack Third-Party Computers

New submitter LordLucless writes "ASIO, Australia's spy agency, is pushing for the ability to lawfully hijack peoples' computers — even if they are not under suspicion of any crime. They seek the ability to gain access to a third party's computer in order to facilitate gaining access to the real target — essentially using any person's personal computer as a proxy for their hacking attempts. The current legislation prohibits any action by ASIO that, among other things, interferes with a person's legitimate use of their computer. Conceivably, over-turning this restriction would give ASIO the ability to build their own bot-net of compromised machines. Perhaps inevitably, they say these changes are required to help them catch terrorists."

43 of 210 comments (clear)

  1. How do we stop them? by Anonymous Coward · · Score: 5, Interesting

    I am an Australian. Assume this passes. How can I harden my computer against being used as a node in an ASIO botnet?

    The only thing I can think of at the moment is to use Linux and make sure I've closed all uncessary ports...?

    What else? I am not a security buff. Encryption doesn't seem particularly useful, since the problem here isn't that ASIO is accessing our files (although they would probably definitely be doing that too), but that they're using our bandwidth and processing resources.

    1. Re:How do we stop them? by Scarletdown · · Score: 2

      Hopefully, someone with some significant power there in the Australian government cordially invites them to piss off.

      --
      This space unintentionally left blank.
    2. Re:How do we stop them? by sabri · · Score: 4, Funny

      I am an Australian.

      Find the nearest Equadorian embassy and request political asylum :-)

      --
      I'm not a complete idiot... Some parts are missing.
    3. Re:How do we stop them? by jamesh · · Score: 4, Interesting

      I am an Australian. Assume this passes. How can I harden my computer against being used as a node in an ASIO botnet?

      Over here! We have a troublemaker!

      Seriously though, I wouldn't worry too much. All the hardening you already do to you computer to keep the existing viruses out will be just fine. The only possible problem will be that the antivirus vendors may be persuaded to ignore government sanctioned malware, but such a thing will be self correcting when the malware authors figure out how to mimic government malware.

    4. Re:How do we stop them? by spazdor · · Score: 4, Interesting

      Or, if the ASIO really needs the resources it says it needs, let them go to the Australian people with their hat in their hands and ask for volunteers to run an Aussie-Government 'network agent' on their Internet-connected PCs to help them catch child molesters and plane-bombers for the good of the homeland, and if appeals to patriotism don't do the trick, let them offer money, and we'll find out how much a person's Internet privacy sells for on the open market.

      --
      DRM: Terminator crops for your mind!
    5. Re:How do we stop them? by bakuun · · Score: 4, Informative

      How can I harden my computer against being used as a node in an ASIO botnet?

      ASIO would come in the same way that normal cybercriminals would, so it's a matter of standard common-sense security precautions.

      If you're using Windows, keep it up-to-date and use a decent antivirus program - Microsoft's security essentials works fine. Don't click links in emails from strange people. Don't open email attachments from strange people. In terms of software, a good rule, originally by Brian Krebs I believe, is not to install software if you didn't search for that software in the first place (with other words, don't install if it comes to you by email, or if it pops up when you're browsing around generally, etc etc).

      In addition to the operating system, a few other pieces of software are fairly important to keep up-to-date: Your internet browser. Adobe flash and reader, if you use those. Java (or better yet, disable Java in the browser completely).

    6. Re:How do we stop them? by Scarletdown · · Score: 2

      I did actually have a look at the article, and saw that it was Australia's AG that is proposing this. Surely there are more people higher up the government food chain than the AG?

      --
      This space unintentionally left blank.
    7. Re:How do we stop them? by crutchy · · Score: 3, Informative

      install linux (i prefer debian stable, but that's just me)

      closed all uncessary ports

      that's usually a function of your router, but linux can also be used for routing functions using an iptables script... here's an example that you can execute from /etc/rc.local (on a debian machine anyway):

      #!/bin/bash
      echo -n "Loading iptables firewall..."
      iptables -F
      iptables -P OUTPUT ACCEPT
      iptables -P FORWARD DROP
      iptables -P INPUT DROP
      iptables -A INPUT -i lo -j ACCEPT
      iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
      iptables -A INPUT -j DROP
      echo "done."
      exit 0

      not the most locked down firewall that you can make with iptables, but its probably a similar configuration to what you would find in most off-the-shelf routers by default. you only need to add more exceptions if you run servers of sorts (ports 80 and 443 for httpd, 25 and 110 for mail, 53 for dns, etc). you can also nat between networks with iptables.

      edit /etc/hosts.deny and make the only non-commented line ALL:ALL, and make sure there is nothing (except comments) in /etc/hosts.allow

      also be sure to configure all users except human users and root so that shell is /bin/false in /etc/passwd and /etc/passwd-

      also, don't install any programs from sources other than official repositories (except for things like flash from adobe website) and don't install garbage apps and avoid torrrent clients which are a breeding ground for malware for all operating systems. i tend to favor stable repositories (with auto security repos update), with many vulnerabilities being due to inadequately tested updates. despite the hype, the testing aspects of both waterfall and extreme programming methodologies are rarely followed in open source projects, with the most common being the "code and test" or (derogative) "cowboy coding" methodology.

      use shields up @ https://www.grc.com/x/ne.dll?bh0bkyd2 to verify if you have any exposed ports

      also, to protect your wifi network(s), only use wpa2 (don't use wep) and set up an access list so that only registered mac addresses will be able to connect

      always use https for online banking and make sure the top and 2nd level domains are what you expect (most modern browsers highlight them)

      some of this stuff is less to do with asio and more to do with security in general. no doubt other /. users will chime in if i've said something wrong or if i've missed something obvious. there's also other security things like wheel group, and there are hardening tutorials for most major distros out there. debian has a good one here: http://www.debian.org/doc/manuals/securing-debian-howto/ but for controlling remote access, the best way is to harden your browser settings (uninstall/disable any unneccesary plugins, disable java, etc), tighten up your wifi security and make sure no router ports are open

      the internet is a scary place, but most viruses and malware is unintentionally installed by users from a web browser or email client (in windows). hacking is a problem, but its only serious if you're hosting. look up how a router works and that may help cool some of your fears. grc has a good info page here: http://www.grc.com/nat/nat.htm
      summary: think of a nat router as sort of being like a one-way valve, so you can make requests out but only responses to your requests can come back in (ininvited requests are dropped)
      if your computer is part of a botnet, there's a good chance that you unintentionally installed software from your web browser or email (or junkware/shareware) that caused it. malware rarely if ever gets onto your pc on its own, and also having malware or virus infected files on your machine is ok as long as they aren't op

    8. Re: How do we stop them? by Anonymous Coward · · Score: 2, Interesting

      Not really the AG is pretty high up. She is a totalitarian bitch though, along with Conroy they plan to make Australia worse than China. I am honestly considering moving countries because both major parties are evil.
      I really hope the Green party have something to say about this, they seem to be the only voice of reason in regards to anything in relation to privacy and government powers.
      Time for a massive change in politics in Australia.

    9. Re:How do we stop them? by TheGratefulNet · · Score: 2

      antivirus will NEVER catch government approved bugs!

      if you think about it, you'll understand.

      and you won't ever trust antivirus apps again. they only block the things 'theyre allowed to'.

      and yes, I'm serious. this has been covered several times before.

      --

      --
      "It is now safe to switch off your computer."
    10. Re:How do we stop them? by davester666 · · Score: 5, Insightful

      You can use this argument to do anything

      -open and read every piece of mail
      -listen to every phone call
      -attach gps monitors to every vehicle
      -install and record video cameras everywhere
      -require every computing device to have a backdoor so the gov't can search through it unhindered
      -stop and search everyone in a given area

      The gov't would potentially 'catch a terrorist' with any of these things. Obviously, they must be implemented immediately.

      --
      Sleep your way to a whiter smile...date a dentist!
    11. Re:How do we stop them? by The1stImmortal · · Score: 2

      He's a Victorian Senator (and is in the half of the Senate that got elected 2010 and won't be up again next election). I didn't vote for him (NSW here) - in fact I doubt many people at all actually voted for him (below the line on the ballot paper). Thanks to the way the senate gets elected combined with the inertia of the two major parties (the coalition might as well be one party these days), it'd actually be rather hard to vote him out - He's second on the ticket, so as long as Victorian Labor manages to get two seats worth in the 2016/2017 elections (not too hard) he's back in.

      What I don't understand is how he's survived two prime ministers and countless cabinet shuffles in the exact same post. Normally ministers get rotated around a bit more, especially when they're as troublesome and controversial as Conroy. While I hate the idea of an Abbot-let Coalition government, the thought of another 3 years minimum of Conroy screwing up the IT & communications industries in Australia bothers me deeply.

    12. Re:How do we stop them? by AHuxley · · Score: 2

      Its Australia, so they own you down to the exchange/rim/nbn 'card' with not much trouble and will log your net traffic 24/7.
      CALEA export hardware is wonderful in that way :)
      So expect any desktop consumer OS or hardware to be wide open by default.
      If that fails, expect a sun tanned "tradie" to be at your home while your at work :)
      2 plumbers, one day.
      If your under ASIO watch, its still not so bad.
      If you upset the Australian Secret Intelligence Service, they have a different origin in Australian law.
      Their training, origins and methods are more US centric :)
      The file system is the key, if the Win/Apple/Linux/droid spyware does not work, they have to get to the hardware - keyboard/service layer.

      --
      Domestic spying is now "Benign Information Gathering"
    13. Re:How do we stop them? by rtb61 · · Score: 4, Insightful

      I am an Australian and I find the whole idea of the gutless and cowardly attack appalling. ASIO is proposing to leave some poor innocent nobody holding the bag for when the attack is detected. Some innocent person minding their own business acceding the internet, who suddenly finds the local swat team raiding their home and threatening that family with death. That whole family now finds itself on trial for espionage and treason a death penalty offence in many countries. That trial will be accompanied by torture. At which point will the Australia Government have the courage and stand up and tell the truth to the country so that the innocent family are no longer standing under the threat of execution.

      This all smells of a request by the US government who has all sorts of laws to deny any rights at all to foreigners. Sounds like those people at Pine Gap have been up to some naughty business and are looking to tidy up the legalities of a 'Joint Facility', Australian and US, doing stuff that is legal for the US part of the partnership but illegal for the Australian part of the partnership and as the attack must eventually leave the joint territory and cross Australian land it is subject to Australian law.

      It is well known that the US consider innocent third parties as nothing more than statistics and collateral damage, to be lied about in press releases but the Australian government better think long and hard about likely sending people to their death because those other countries aren't all rank computer security amateurs who wont detect the attack, after all if they were ASIO could attack direct or more accurately stand idly by and ignore the US led and controlled attack.

      You only have to look at the MEGAupload case to see how badly it can go when you trust the US inJustice system.

      --
      Chaos - everything, everywhere, everywhen
    14. Re:How do we stop them? by TheSpoom · · Score: 2

      How can I harden my computer against being used as a node in an ASIO botnet?

      Against a nationstate with effectively unlimited resources where essentially all hacking has been declared legal? Nothing. You're screwed.

      --
      It's better to vote for what you want and not get it than to vote for what you don't want and get it.
      - E. Debs
    15. Re:How do we stop them? by AHuxley · · Score: 2

      Re -install and record video cameras everywhere.
      Line your own home with the better quality gum stick video recorders - add storage, test the battery life for 12h?.

      --
      Domestic spying is now "Benign Information Gathering"
    16. Re:How do we stop them? by jamesh · · Score: 2

      Here, you can use some of my tinfoil now.

      Wait a minute... how do I know you haven't tampered with it?

    17. Re:How do we stop them? by LordLucless · · Score: 3, Insightful

      I don't think this is raw CPU cycles they're looking for here. It's more like: "We're trying to grab information on this guy. We see he visits www.somesite.com.au an awful lot. Let's get access to the computer of somesite's developer, grab his access keys, and modify somesite to deliver our trojan to the target."

      Of course, once you've compromised a computer, are you going to just clean it up and let it go? After all that trouble of getting a warrant? Pfft, no - what if you need it again? You're going to list it as a resource and add it to the pile of private computers your agency owns.

      --
      Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face
    18. Re: How do we stop them? by Antarius · · Score: 2

      Baseball bats? Surely you meant "cricket bats?"

    19. Re:How do we stop them? by dryeo · · Score: 2

      Well as all of your list also works very well for catching dissidents they'll all eventually be implemented. Dissidents are a much bigger threat to the established powers then terrorists.

      --
      https://en.wikipedia.org/wiki/Inverted_totalitarianism
    20. Re:How do we stop them? by crutchy · · Score: 2

      spot the windows fanboi... the proof is in the pudding... the number of linux kernels operating in the world (including beneath android and in embedded systems like set top boxes) far exceeds the number of windows installs, and yet no malware or virus problems, yet windows STILL needs antivirus and even then it gets infected

      windows is only competently set up if it has antivirus... linux doesn't need it

      keep drinking the microsoft kool-aid, moron

    21. Re: How do we stop them? by maxwell+demon · · Score: 2

      The thing is, if you make it too hard for terrorists to use computers/phones etc (ie they are/can be monitored), they simply switch to communicate via hand delivered notes written on paper.

      Then forbid paper as a terrorist's tool.

      --
      The Tao of math: The numbers you can count are not the real numbers.
    22. Re: How do we stop them? by craigminah · · Score: 3, Funny

      If they used cricket bats it could take days to finish the beatdowns...and it would be boring to watch.

    23. Re: How do we stop them? by Antarius · · Score: 2

      Distractions... You obviously weren't watching the cricket then. ;)

  2. Insanity by xtal · · Score: 2

    So what happens when one of these third parties is detained as a spy, if their compromised computer is detected at a border? Depending on where you go, taking a machine with you sounds like it could actually put your life - or at least, your freedom - at risk?

    Have we given up even maintaining the facade of the rule of law now?

    --
    ..don't panic
  3. What happens if you get rid of their backdoor.. by NettiWelho · · Score: 4, Interesting

    You get charged with interfering with law enforcement operation?

  4. Ha by Moe1975 · · Score: 3, Insightful

    I'd like to see them do that to someone's OpenBSD box!

    --
    SARAVA!
  5. Re:Who is terrorizing who? by MichaelSmith · · Score: 2

    Its partly because of our close relationship with the US. We have to keep track of terrorists living in Australia, and possibly migrating here.

  6. What will Woz Do? by Macrat · · Score: 4, Insightful

    Will Woz still want to buy Aussie citizenship if this is allowed?

  7. What happened to the "free" of the "Free World" ? by Taco+Cowboy · · Score: 5, Insightful

    Last time when we talk about Soviet Union and/or China and/or Cuba and/or Iran and/or North Korea or East Germany, or any of those countries we used words like "ROUGE COUNTRIES" to describe them.

    And they deserved it, for those countries never about the human rights of their citizens, and those countries spied on their own citizens.

    Nowadays, countries that are supposed to be "FREE", such as Australia, New Zealand, United Kingdom and United States are becoming more and more like those rogue states.

    What the fuck has happened to the spirit of "FREEDOM" of the free world?

    --
    Muchas Gracias, Señor Edward Snowden !
  8. I'd like to report a terrorist by thegarbz · · Score: 4, Insightful

    Dear ASIO, The only people (and I use that term loosely) currently terrorising Australia are you. Kindly take your hacking desires against lawful citizens and shove them.

  9. Translation by russotto · · Score: 4, Insightful

    Headline: "ASIO is already breaking into third-party computers unlawfully, but is tired of covering it up."

    ''The purpose of this power is to allow ASIO to access the computer of suspected terrorists and other security interests,'' : "The purpose of this power is power".

    ''(It would be used) in extremely limited circumstances and only when explicitly approved by the Attorney-General through a warrant.": "We'll use it whenever and order several redundant sets of rubber stamps for the warrants"

    'The Attorney-General's Department refused to explain yesterday how third-party computers would be used, ''as this may divulge operationally sensitive information and methods used by ASIO in sensitive national security investigations.''' : "We use them for all sorts of things no one in their right mind would approve of"

  10. Re:What happened to the "free" of the "Free World" by Runaway1956 · · Score: 4, Funny

    Pal, Australia. What does the word conjure up? Think. I know you had history classes in school. Australia was a penal colony. Meaning, they were rogues before they ever got to Australia. They are EXPECTED to be rogue! Putting the words "Australia" and "rogue" in the same sentence is redundant and repetitive.

    --
    "Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
  11. Suggestions: by thedarb · · Score: 4, Informative

    * Run a BSD or Linux system. - Secure it. If you don't know how to do this, do your home work.
    * Use a snapshot capable filesystem, and take snapshots (ZFS / BTRFS). - You can use these to identify file that have changed.
    * Use Tripwire or a clone like AIDE. - This is a second level of checking for file changes.
    * Manually audit your system regularly.
    * Use OS repositories from outside Australia.

    And the list would not end there.

    --
    This sig intentionally left blank.
  12. Re:What happened to the "free" of the "Free World" by Yaa+101 · · Score: 2

    It got sold away under your ass...

  13. Re:What happened to the "free" of the "Free World" by CrimsonAvenger · · Score: 2, Informative

    Last time when we talk about Soviet Union and/or China and/or Cuba and/or Iran and/or North Korea or East Germany, or any of those countries we used words like "ROUGE COUNTRIES" to describe them.

    Well, technically, Iran has never been a "rouge nation". On the other hand, that's an apt description for all the communist nations...

    On the other hand, if you really meant "ROGUE nation", then Iran would also fit nicely.

    Why do so many supposedly educated people get "rouge" and "rogue" confused?

    --

    "I do not agree with what you say, but I will defend to the death your right to say it"
  14. Re:What happened to the "free" of the "Free World" by Phrogman · · Score: 2

    The Spirit of Freedom has been bought and sold to the mega-corporations and their client governments. Privacy doesn't need to be dead, but its more advantageous to the business community if it is, therefore things like this proposed legislation to "Combat Terrorism" - i.e. to combat those whom the Media Industry wants to close down and prevent from copying their copyright works.

    --
    "The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
  15. Good news by KeensMustard · · Score: 5, Insightful

    Ever since terrorism became such a huge problem in Australia, ASIO have been unable to catch a single terrorist. So hampered were they by a lack of access to my computer, they have been unable to foil a single, credible terrorist plot. In the last decade or so, an attack by terrorists has been imminent, at any moment, I expect to be attacked by terrorists. The lack of an actual attack, the lack of any suspicion of an actual attack, the lack of any identifiable group with any plausible reason to attack, the lack of any identifiable person associated with any group planning to attack, these are simply indicators of how clever these devious, brown people are. If only someone would use my computer to hack into theirs, then Australians would know the reason for the constant stream of messages telling us to fear.

    1. Re:Good news by Anonymous Coward · · Score: 3, Informative

      Insightful but not actually correct. 3 terrorist plots have been foiled in Australia since 9/11:
      - http://en.wikipedia.org/wiki/2005_Sydney_terrorism_plot
      - http://en.wikipedia.org/wiki/Abdul_Nacer_Benbrika
      - http://en.wikipedia.org/wiki/Holsworthy_Barracks_terror_plot

      ASIO definitely had involvement in the second one, not sure about the others. I'd be more inclined to suggest that actually they are doing their job just fine with the powers they currently have.

  16. Re:What happened to the "free" of the "Free World" by Pf0tzenpfritz · · Score: 3, Funny

    Brian damage, perhaps?

    --
    Oh, the beautiful gloss of greality!
  17. Re:What happened to the "free" of the "Free World" by Archfeld · · Score: 3, Insightful

    No, buying is a bad practice in the corporate world. It has just been co-opted by the DiscoverCard Spirit of Freedom(TM), brought to you in part by McDonald's, and by the generous donation of the Monsanto Corporation. They are "Loving It"

    --
    errr....umm...*whooosh* *whoosh* Is this thing on ?
  18. If you need hack my computer to stop terrorists by kawabago · · Score: 4, Insightful

    I'd rather have terrorists.

  19. Re:What happened to the "free" of the "Free World" by stymy · · Score: 5, Informative

    It sounds like you need to brush up on your own history classes -- unless they were in the US, in which cases they made some important omissions. Such as the fact that England started shipping its inmates to Australia only after the American Revolution made them lose their favorite penal colony. Prior to then, many punishments for criminals consisted of them having to spend several years or their whole lives in the US.