Slashdot Mirror
Is the DEA Lying About iMessage Security?
First time accepted submitter snobody writes "Recently, an article was posted on Slashdot about the claim that law enforcement made about being frustrated by their inability to decrypt messages using Apple's iMessage. However, this article on Techdirt suggests that the DEA may be spewing out disinformation. As the Techdirt article says, if you switch to a new iDevice, you still are able to access your old iMessages, suggesting that Apple has the key somewhere in the cloud. Thus, if law enforcement goes directly to Apple, they should be able to get the key."
The mere fact that you even have to ASK such a question means the answer is "Yes."
[End Of Line]
There were reports for a while of "wiped" devices bugging out and remembering to receive former owner's messages after being turned in to Apple Stores for replacement.
While I won't make the argument that free software is always more secure it's at least verifiable.
If you're using software created in the US by a commercial company you can bet the government has access to it. Who would believe any different?
I think one of the main problems law enforcement has with iMessages is that it is ridiculously easy to get a pen register from a telco for a phone number. This is a list of the calls made to/from that number and a list of SMS/MMS to/from that number. iMessage bypasses SMS/MMS if both the origin and destination device are iMessage capable, so those interactions do not show in a pen register. The same could be said for many other text/chat services, but iMessage is the default texting client for a large number of people and does not require the user to do anything special to message others without the telco knowing, unlike many other services.
iMessage isn't that special, the memo could just as easily been talking about FaceBook messages, which also won't appear in a pen register.
Don't be ridiculous. You are only a guest in Apple's garden.
Just because your messages are accessible on a new device, it does not necessarily mean that your messages are readable or key is accessible by Apple. For instance, if the decryption key for iMessage were encrypted with your Apple ID password, then your key could be transferred around between devices, but Apple or the DEA would still have to brute-force/social engineer/whatever to get your password and decrypt the key. Whether or not it's actually set up that way...
Political dissidents, whistle blowers... and FREEDOM LOVERS.
Unless the DEA is actively 'leaking' in order to attempt to move people into a vulnerable channel with a false sense of security(not impossible; but I'm inclined to suspect that the higher level drug runners take their paranoia seriously, or they wouldn't have lasted long enough to level up, and the lower level ones are probably more often foiled by the fact that they need to solicit customers, any one of which could be a plant), I'd be inclined to a more prosaic explanation.
With SMS, architectural security during transmission is somewhere between pitiful and nonexistent and the entity that handles the messages during their voyage is the phone company, which has substantial legal incentives to, and a long history of, supine cooperation with the authorities.
With iMessage, it looks pretty much like SMS on the handset; but it's all just data to the telco, and Apple presumably included some SSL/TLS or similar implementation that isn't totally broken, meaning that going through the telco is totally useless(this would also be why the leaked memo specifically mentioned that iMessages sent to non-Apple devices, which would be crunched into SMS at some stage, were still often recoverable).
The fact that Apple can, apparently, retrieve your iMessage history for you suggests that, indeed, a subpoena of Apple would leave you in the open; but I imagine that the DEA is much more familiar with, and pleased by, the 'service-oriented' attitudes of the phone companies, who are extremely forthcoming with customer information, with very low bars to clear, and minimal pesky judicial process.
Certainly not a good idea to trust anything that the service operator can 'recover' or 'restore' for you to be secure(since it can't possibly be); but the DEA jackboots probably do encounter significantly greater hassle with a message that is never available to the notoriously friendly telcos. You are still up shit creek if they are building a case against you specifically(or if Apple caves and starts providing bulk access at some future time); but casual fishing is likely to be more difficult.
TinFoilHat: They brought Steve into the fold a long time ago, gave him top secret clearance and then asked him to make device no one could do without, that they could use to track and listen to people.
This just in: Toil Foil Hoodies selling like hotcakes.
http://kottke.org/13/04/the-anti-drone-hoodie
"If any question why we died, Tell them because our fathers lied."
We should just give everyone google glass with a direct feed to all the government agencies. Who would care except drug dealers and terrorists anyway.
I'd like to think that law enforcement is above attempting such tricks, but unfortunately that might just be naive these days.
Might be?? I would say extremely so.. An indication the writer has no knowledge of history... Or maybe just something he has to say to avoid legal issues, or worse..
“He’s not deformed, he’s just drunk!”
I've been wondering the same thing about older news stories, on how the FBI was unable to crack PGP encryption. That too might be disinformacija.
Knowledge is power; knowledge shared is power lost.
But they've never lied about the effects of drug usage, right?
Right?
Um, right?
Do you have ESP?
Every government statistic or statement on the drug war is not to be believed. There might be some truth in some of it, but after 80+ years of lies, it's not the way to bet.
They're quite knowledgeable about DRUG TRAFFICKING. Expertise in other areas relevant to law enforcement should not be assumed. Apple either has a copy of your key or can crack their own encryption when they need to. The NSA could probably crack it too, but why would the DEA go to the NSA and why should the NSA concern itself with helping the DEA crack cases? That's not their job.
Political dissidents, whistle blowers... and FREEDOM LOVERS.
Like Martin Luther King was watched and harassed by the police and the FBI.
And now we have a national holiday honoring him. If I were President, I make every goddam FBI employee work 18 hour days on that weekend - scrubbing the bathrooms with toothbrushes from their anus.
John Lennon - yes, the dead Beetle - was watched by the FBI for - God forbid! - preaching peace!
We are a God fearing Christian Nation! We can't have those wackoes preaching Peace!
The issue is not that the DEA cannot lawfully acquire the messages... It's that THEY HAVE TO ASK , EVERY TIME.
Most taps are just "wide open" until the warrant expires and the telco turns the tap off... There is very little oversight. Many online services give law enforcement more of an "open ticket" to keep coming back for email or Facebook as often as they need. While the line isn't "tapped" LEOs can refresh every twenty minutes if they want.
They are attepting to bully Apple into allowing a MITM or wide open ticket to people's accounts. The first post on this very carefully NEGLECTED to mention that Apple COMPLIES with lawful requests. Which they most certainly would. The issue is that Apple won't open a giant backdoors and look the other way while LEOs look up their ex-girlfriends, or people with fancy cars to pick on. Apple is probably making them request transcripts with dates and times... And then APPLE SENDS it to them.
Everyone should. Not because they're breaking a law, but because laws are changing. And rapidly so. What is very legal today may be illegal tomorrow. And then try to prove that you stopped the behaviour just because it became illegal. What is that you say? They have to prove that you still did it after it became illegal? You think you'd be the first to be in jail because there is "strong evidence" (read: someone hinted at it) that you did again what you did before?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because who could have possibly seen THAT coming. Seriously, this is my shocked face.
Freedom lovers who really love it will fight for it.
And one countries freedom fighter is another countries terrorist.
Don't fight for your country, if your country does not fight for you.
Freedom lovers who really love it will fight for it.
And one countries freedom fighter is another countries terrorist.
The transcripts of your SMS and emails indicate you don't really
believe this.
'looking like a "Lawnmower for Sale" but with message
encrypted into tel.# & eMail address
Better, encrypted into photos for an apartment / house
ad (on a free-ad web site)
Dump your eDevice(s)
QED
It may not be the most elegant solution, but hosting your own Mumble server works pretty well for secure private IM and voice chat. There's a really slick Android client called Plumble, and I believe iOS has a basic one as well. The built-in authentication and encryption is sufficient, and the newer builds support the OPUS codec.
The fact that old iMessages transfer to new iDevices is not proof of external keys. The method for secure transmission may decrypt on receipt. If so, then already received messages would be transferable. New messages would use the new key combination.
And, if Apple takes this route, they have no keys and no unencryptd data to give to anyone. Simplifies the issue for them quite nicely.
Just as encryption for email like PGP, it is then in your hands. If they can't get your device, then intercepted messages are useless.
No, a freedom lover wouldn't be using an Apple product in the first place.
If they go to Apple _WITH_ a warrant, Apple can surely provide them with the information (well, I'd be shocked if they couldn't comply with a warrant).
That's not what the DEA wants, however - they want to be able to read the messages _WITHOUT_ a warrant. I imagine that is where they are having difficulties intercepting and reading iMessages.
John Lennon - yes, the dead Beetle - was watched by the FBI for - God forbid! - preaching peace!
We are a God fearing Christian Nation! We can't have those wackoes preaching Peace!
Preaching peace in time of war is clear and present danger to the government's recruitment efforts. It is LITERALLY like shouting fire in a crowded theatre.
This is why it is important to defend the free speech right to shout fire in a crowded theatre. Worst that could happen is everyone walking out calmly and in order. Just because someone think there is a fire doesn't give him the right to push, stomp or strike anyone that stand in his way. If peoples act like ass-holes during emergencies then this is what need to be addressed. Restricting a fundamental freedom in way that will, and was, abused by the state is not a solution.
Apple claims to use "a minimum" of 128-bit AES to encrypt your backups, which includes every iMessage you've ever sent/received (unless you delete them of course).
They claim to never provide the encryption keys to third parties. That sounds pretty clear to me, they won't give it to law enforcement. I am not a lawyer, but my understand is if it's encrypted then there are restrictions in place for how law enforcement can access it. A court order would probably be needed at the very least.
They don't go into much detail about how the AES key is generated. Presumably either your iCloud login password (or forgot password questions) or your phone's PIN code will be used.
Remember the fuss just a year ago when India and other gov'ts complained about Blackberry? How is this different?
-- "At Microsoft, quality is job 1.1" -- PC Magazine, Nov. 1994
It is of course quite possible as some people mentioned that it is harder, but not impossible, for the police to get access to iMessage messages than they like, and they interpret this as "we can't read iMessage" (whenever we like). It is also quite possible that they are just lying and want all the drug dealers to use iMessage because they have complete access.
It is also possible that Apple has absolutely no way to read your iMessages. I would think that making iMessage safe against hacker attacks would be harder if there is already a way to access iMessage that is open only to Apple, and I can't see how buying able to read iMessages would be in Apple's interest.
What better proof do you need that your nation fears God, than FBI surveillance of people who preach peace.
When our name is on the back of your car, we're behind you all the way!
That unpossible!
Note: Chrome thinks that unpossible is actually a word?
Troll is not a replacement for I disagree.
We are a God fearing Christian Nation
I thought church and state were separate?
And getting a pen register dataset can mean enough linkages can be shown to a "known drug dealer" or a "known felon" that they will then have probable cause to get a warrant, even if the number of linkages is so high that you're not the "friend of a drug dealer" or even the "friend of a friend of a drug dealer" but even "(friend of a)^5 of a drug dealer".
.
When you get links that are that long, you can ensnare everyone in the world, whether or not they are truly guilty of anything, just from guilt by association. See the comment about 6-degrees-of-Kevin-Bacon or the one about Bacon numbers and Erd''os Numbers.
They can probably not decrypt iMessage traffic without some other information or hooks; but they almost certainly have that.
I was with you until you said this:
Worst that could happen is everyone walking out calmly and in order.
That is far from the worst that can happen. That is in fact the best case scenario outside of no one believing them and there truly not being a fire. Provoking people into violent acts of desperation by instilling the immediate fear of death into them, such that their rationality is severely compromised is outright negligent. This is why we have things like temporary insanity and heat of passion defenses.
I feel that you should be perfectly free to shout "Fire!" in a theater. However I also feel that if you end up causing a situation where someone is injured, you should be held liable for your negligent actions. Freedom of speech should not mean freedom from responsibility of that speech.
What if you told a blind person that the light at an intersection was green and there was no traffic, causing them to walk into the street and get run over? Would you push the free speech argument? You didn't kill him; the guy behind the wheel of the car did. That doesn't mean you weren't immensely negligent as a result of what you said.
As a closer example to the theater, what if in that same situation you screamed in front of a blind man "Everyone get out of the way! A car is heading straight for us!" causing him to jump out of the way and into actual traffic? Would you still feel like you were completely free of the burden of responsibility?
For the love of rms, people, the original article was about the DEA lamenting that their illegal unwarranted dragnet efforts via communication service providers couldn't intercept the messages because of the way CALEA was written. If they want the contents of your iMessages, they merely have to subpoena Apple for your devices' master keys and they can connect to it as long as it's on a network someplace (see: Find My Phone, Notifications) and read the #%^*#%^*#%^* iMessages.
Stop amplifying noise and amplify signal instead.
Provoking people into violent acts of desperation by instilling the immediate fear of death into them, such that their rationality is severely compromised is outright negligent.
Shouting fire should not provoke anyone to be violent. In my experience, when there is a fire alarm, peoples look around wondering if it real then move out in order. On the other hand, seeing fire running up the wall and ceiling could cause panic. But this thread is about shouting fire in a theatre, not setting fire to the theatre.
I feel that you should be perfectly free to shout "Fire!" in a theater. However I also feel that if you end up causing a situation where someone is injured, you should be held liable for your negligent actions.
I feel that you are perfectly free to advocate peace in time of war. However I also feel that if you end up danger the government's recruitment efforts you should be held liable for your act of sedition.
How about all the assault on brown peoples flowing the WTC attack? Are the perpetrators responsible for their action, or the media held liable for causing muslim-scare panic? (After you answer don't forget to check what judges decided in the real world)
Shouting fire when there is no fire is being an asshole. But freedom is freedom to be an asshole, and if you don't defend assholes your turn will come eventually. eg: When you advocate peace in war time.
Nope, God still gives us our rulers through divine right. Voting is simply a test of faith.
No.
captcha: corrects
What if you told a blind person that the light at an intersection was green and there was no traffic, causing them to walk into the street and get run over? Would you push the free speech argument?
Yes. A blind person is not helpless. If he is outside, by himself, then he is fully responsible for his action. He does not depend on strangers telling them what colour is the light. Stating otherwise is insulting to the blind and otherwise handicapped in general.
The DEA lies about everything else. Why would this be any different? The very fact that the DEA exists is an affront to personal liberty; We have decades of detailed records of them spreading falsehoods, destroying families, in general doing far more harm than drugs ever did or ever could.
DEA Informers: They lie about who they are, what they do, what their intent is -- and just about anything else they're asked. This is who they are. Liars. But that's not all they are. They're also as dangerous as any government agent you can imagine, wholly without concern for anyone but themselves.
DEA agents: They lie about where the danger comes from; they lie about toxicity; they lie about addictiveness. They lie about consequences (they ARE the primary consequences), and they have been known to attempt to trade your personal honor for your freedom if you fall into their hands. They created the violence underlying the black market drug trade; they created the black market itself. They're not shy of interfering with other sovereign countries, nor of playing fast and loose with our own "justice" system.
So when a DEA "anything" tells you something, you're best off assuming they're lying. It's what they do. Aside from destroying families, that is. If they're not lying, they're likely trying to hurt you some other way. Get away and stay away. Nothing truly good can ever come of contact with people so bereft of personal honor -- or so outright stupid -- that they would work for the DEA.
To heck with them. And the laws they rode in on. And those who made the laws. And those in the general population who thought, and perhaps still think, agencies like the DEA were ever a good idea.
The drug war: It's a war on you and your family and your friends.
I've fallen off your lawn, and I can't get up.
I'm pretty sure they're doing their best to figure out what Jesus would do and then do the opposite...
Back to SMS with Android huh?
I run: Windows, OS X, Linux, FreeBSD. Just because you have a hammer, doesn't mean everything is a nail.
> Is the DEA Lying About iMessage Security?
The government made a similar statement about TOR last year, and I wondered the same thing, that maybe it was disinformation.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
[quote]That is in fact the best case scenario outside of no one believing them and there truly not being a fire.[/quote]
Unless that desensitizes them, so that the next time there really is a fire, nobody believes it until it is too late. This is where your argument gets difficult. What if, in every movie I go to, I shout "fire" half way through. Because of this, people know not to react when people shout fire, because it's just a prank. The next time there is a fire, people don't believe it until it's too late. How do you prove my liability there? At the time of the fire, I was laying in my bed sipping mimosas and twirling my mustache laughing evilly.
You can think that all you like, but the reality is that Americans have an immensely negative view of atheists. Here, observe that Americans consider atheists more objectionable than blacks, women, Catholics, Hispanics, Jews, Mormons, gays, or Muslims for political office. And that study does not discriminate about which political party you're discussing!
And that is why, as a European, I dont intend to ever set foot again in the USA. Only if I have to. Amerika is becoming the Iran of the West.
Agree 100%. We should just exterminate all the idiots whose brains are too dysfunctional to think before acting. What kind of mindless cow tramples someone just because they hear a word...
Dear Anonymous Troll. It's not about being blind or handicapped. It's about trust. We are indeed responsible for our actions - and that includes the act of speech.
Und if you are schmart, you schut kip thinking zat.
"You must try to forget all you have learned. You must begin to dream." -- Sherwood Anderson
I think you don't understand what "literally" means. Your post gets sillier from there.
At first your list sounds horrifying. On closer examination, over 90% of Americans said they wouldn't have a problem voting for a black, female, catholic, hispanic or jewish candidate. The others ranked... lower. It's still pretty bad, but not quite as horrifying as at first glance.
Read the link and think again why it is written ALL UPPER-CASE.
It's easy to copy-past Internet meme like "I think you don't understand what \"literally\" means." before think about what was really said.
Your messages would be just as easily for them to read once they know how you embedded them. Encrypt them with a decent algorithm implemented properly. Then use a channel that they might not discover, at least for a while. Don't use the same channel too long and use encrypted messages to inform the recipient of a change in channel. Use PKI, so you don't have to change keys when someone can no longer be trusted. Use PKI, so others can't pretend to be your without stealing your private key. Using steganography the way you describe it is for religious fanatics and boy scouts. Trojans that lack the resources and the channel to do proper encryption may use steganography to remain undetected for people that only casually inspect their proxy/firewall but that's about the only serious modern application I've seen so far. Anyone under surveillance that will only use steganography to hide their data, will be caught.
I was promised a flying car. Where is my flying car?
I didn't see anyone mentioning it, but your iMessage data is not stored in the cloud, it is all stored locally. if you switch devices, you have to restore from a full backup of all the data, which can be stored in the cloud if your using that iCloud feature... but it's not stored/archived in the same sense that your email is. you can't just plug in your Apple ID and have the iMessages pulled down like you can when you add a GMail account to your phone.
The DEA had no idea how to access iMessages but now Techdirt just told them how to do it. Your iMessages are no longer safe...
I keep hitting the "off the record" option on Google Talk chats. However, I log in from e.g. an Android device and voila - the chat is back there with the chat log.
So much about off the record.
These companies lie to us.
Time for a conspiracy theory. Nothing to see here, move right along...
and that is the real problem. I think a better broader question to be asking is should a "free and democratic society with government by the people and for the people" have agencies spreading disinformation to the people?
I ask this because there is already large portion of the population that has a very cynical mistrustful view of government (myself included). When officials are known to provide inaccurate information to the public it harms societies ability to trust any other information from government. Most of us are taught honesty is a virtue; when we see government being purposely dishonest it degrades our respect for its institutions.
I don't deny the short term usefulness it might provide certain law enforcement efforts. I would further suggest there is some line to be drawn between broadly announcing disinformation like "we can't intercept/read iMessages" in hopes of drawing in stupid criminals, and providing disinformation in a very targeted way to someone who is already a suspect. Directly E-mailing a recipe for explosives made form easily obtained materials, that dose not really work to a bomb plot suspect for example.
I also understand we need military secrets and disinformation about our capabilities there in makes some sense as well provided the real target of that disinformation is foreign threats.
Repeal the 17th Amendment TODAY! Also Please Read http://www.gnu.org/philosophy/right-to-read.html
Am I the only one who realizes the truth? Apple made the whole thing up to sell more iPhones.
Seriously? This is how you attempt to determine the underlying cryptography, by making ill informed guesses based on the functionality? Moronic.
Let me explain to you how this works. When you attempt to send an iMessage to someone, your phone looks up their public keys for their devices. Then, it encrypts the message to them. When you get a new phone, it generates a new key, and registers it with its phone number.
This kind of like a pgp key server with automatic lookup.
The DEA thought you would think this is a lie before they even released the news!
suggesting that Apple has the key somewhere in the cloud
interesting....see -> http://yro.slashdot.org/story/12/11/02/1737219/us-government-you-dont-own-your-cloud-data-so-we-can-access-it-at-any-time
i'll let you all piece the rest of it together from here
If the encryption key is derived from the users' password, and it's hashed differently than whatever algorithm Apple uses for login (one example might be PBKDF2 for encryption and crypt() for login) - it's very easy to store encrypted "blobs" of data that can only be accessed by the user (with their password). I believe this is how Blackberry operates - their servers store encrypted data, but BB is never in possession of the key.
That said, if you read the DEA's memo more carefully, all it pretty much says if you think about it is "herp derp we can't sniff SSL. Call the waaaaaahmbulance!".
The memo is talking about their intercept systems that are installed at the service provider level (cellular provider or landline ISP). These systems can't intercept SSL traffic.
retrorocket.o not found, launch anyway?
FTA "An internal Drug Enforcement Administration document seen by CNET discusses a February 2013 criminal investigation and warns that because of the use of encryption, "it is impossible to intercept iMessages between two Apple devices" even with a court order approved by a federal judge. ...the key word is INTERCEPT.
I'm not a security or network expert, but isn't "intercept" different than "decrypt messages stored on a server"?
couldn't it be difficult to intercept (whereas reading messages stored somewhere is trivial - with a warrant)
i can send an imessage using the phone number or one (or more) email addresses. w/o knowing how imessage actually works, it looks like phone to Apple to phone - presumably, only Apple knows the relationship between email addresses and phone number so that traffic is sent on the internet (not a cell network) - don't forget, imessage works on non-cellular devices. how does LE track a message end to end with Apple in the middle?.. remember, the keyword is INTERCEPT which implies realtime, so intercepting a message may not be impossible, but impractical - certainly not as easy as SMS. in theory, I could have an imessage conversation and never use the same email address twice - which means cloning an iphone isn't a solution either.
Who would believe any different?
If the source is open, it's actually possible to check if the data safety is sane.
Exemple: Mozilla's Sync.
It *does* store web passwords on the server.
Data sent and received from the server is always encrypted. (the server never has access to the clear text, only to the encrypted form)
Without the password that the user keeps for him/herself, all the rest is useless.
Three-letter agencies could subpoena all that they want, there simply isn't a technical way to extract the data. All that they can get is only a bunch of random-looking encrypted data, which is useless without the password stored into the user's head (or a nearby post-it... saddly, no matter how much advance an encryption scheme is, there are always users who will screw up badly).
Counter example: Skype
Skype's license clearly state that they will collaborate with local authority as required by local law.
It's closed source, so you can't actually check, but given the license, you can safely bet that there is very likely a backdoor somewhere inside to comply with the various wire-tapping law.
(very probably in the form of a way for law-enforcement forces to obtain the encryption key, so it's possible to later decrypt any intercepted network traffic).
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
no no, your comms are secure pay no attention to the crypto geek behind the curtain