Slashdot Mirror
Police Decrypt 258,000 Messages After Breaking Pricey IronChat Crypto App (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: Police in the Netherlands said they decrypted more than 258,000 messages sent using IronChat, an app billed as providing end-to-end encryption that was endorsed by National Security Agency leaker Edward Snowden. In a statement published Tuesday, Dutch police said officers achieved a "breakthrough in the interception and decryption of encrypted communication" in an investigation into money laundering. The encrypted messages, according to the statement, were sent by IronChat, an app that runs on a device that cost thousands of dollars and could send only text messages.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
"I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation,"
Sure sounds like a paid product endorsement....
Pinky in corner of mouth, Thousands of dollars!
This is likely just a fairly amateurish security protocol implementation sold at inflated prices to people flush with cash.
Its really not all that hard to do secure communications... if actual criminals used something called "ironchat" they deserve what they got.
And siezed the keys, then used those keys to unlock the locks. Or the messages are logged unencrypted on the siezed site.
I promise you the dutch police have no ability to "hack" anything.
And IronHorse or whatever has never been secure.
Looks like they won't be using IronChat any more.
If there was any chance of listening to future conversations between parties using Iron Chat, this announcement just blew that right out of the water.
The folks who wish to talk via encrypted channels will now simply change their method of communication.
It could be another commercial app, a homebrew one or just go all old school and do things the way it was done before the era of smartphones.
It could also be complete bullshit on the part of the Police in an attempt to get folks to quit using it :D
Title need changed to: Police in the Netherlands are idiots for telling people they can decrypt ironchat. OR change to Police in the Netherlands recommend you find another chat tool, Ironchat isnt good enough
No source? Then why did anyone trust it? Because it was expensive? Because there was a business backing it? You fools.
If somebody else has your private keys, they aren't secure.
Pretty sure that quote is only half true. Snowden has mentioned OTR in the past. I doubt he specified IronChat.
Joseph Elwell.
They just fetched keys from the central service provider, and given that this crappy app never implemented actual end-to-end encryption, that was enough to decrypt the messages.
Seriously, criminals stupid enough to rely on proprietary, centralized messenger services deserve to get jailed for that alone.
They siezed the site
And siezed the keys, then used those keys to unlock the locks.
Then its not really end-to-end encryption as claimed. Its just another service encrypting its traffic so middlemen, other than itself and its masters, can't read it. In true end-to-end the service provider can't read the content even if they want to.
So only the Android users were hit and not the iOS users of the app?
Seems like the damage could have been limited if perfect forward secrecy was used
We should not be using PKI that depends on a trusted source.
People have their own private keys. But then how to know that you are using the right one? The SSH problem.
So use SRP instead. Secure Remote Password. The communication only works if both people use the same password. And no way to brute force the password back. Simple, and intrinsically secure.
And made some criticisms approved by his Russian landlords, so some "independent" agency makes a by-the-way announcement that they have broken encryption on a tool. Now Snowden has to worry about what might be in some of his captured conversations, and if it could be a cold winter...
Sadly, most of them do. Everyone else gets theirs taken away involuntarily. We all clap when we hear that the government nabbed one of those evil money launderers.
Money laundering is an almost sure-fire conviction as it is impossible to disprove, and that is exactly what a defendant had to do. Thatâ(TM)s why roadside piracy, I mean, civil forfeiture is so lucrative.
Underpay your taxes by $170? Boom, every dollar in your position is now laundered money, proceeds of your tax evasion. Take out $5,000 of your own money from the bank one day, $6,000 of your own money the next? Bam, youâ(TM)re a money launderer, your funds were obtained via structuring.
The link between every dollar and theoretical malfeasance is not hard to make, so itâ(TM)s the perfect crime to charge someone with when they havenâ(TM)t committed a crime you can prove they committed.
In fact, the only guaranteed non-laundered money, is money you give to the government. No matter where you got it from, or how you acquired it, if you give it to the government, itâ(TM)s righteous.
I don't get why anyone would use IronChat. Or any OTR solution, given that it's pointless, due to the metatdata not being encrypted.
Just use Signal, like everyone, and be done with it.
And if your life depends on it, and you have the option, you use one-time pads from a good source of randomness somewhere in your process, period. Because it vastly simplifies the amount of things that could go wrong, while itself (but not the code around it, of course) being uncrackable.
You are correct. I remember him mentioning OTR. But with the caveat, that it only protects what has being said, and the implementation must be good too. It does NOT protect the metadata. Like who you are, who you talked to, and when. As in: What criminals actually care about.
I hear the decryption tool was written in Rust.
I've never heard of Ironchat but from the sounds of it, it was cryptographic snakeoil. If cops / intelligence services were listening in realtime that would suggest that it wasn't securing messages from man in the middle / spoof attacks or the manner that keys were exchanged was insecure.