Slashdot Mirror
Police Decrypt 258,000 Messages After Breaking Pricey IronChat Crypto App (arstechnica.com)
An anonymous reader quotes a report from Ars Technica: Police in the Netherlands said they decrypted more than 258,000 messages sent using IronChat, an app billed as providing end-to-end encryption that was endorsed by National Security Agency leaker Edward Snowden. In a statement published Tuesday, Dutch police said officers achieved a "breakthrough in the interception and decryption of encrypted communication" in an investigation into money laundering. The encrypted messages, according to the statement, were sent by IronChat, an app that runs on a device that cost thousands of dollars and could send only text messages.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
"Criminals thought they could safely communicate with so-called crypto phones which used the application IronChat," Tuesday's statement said. "Police experts in the east of the Netherlands have succeeded in gaining access to this communication. As a result, the police have been able to watch live the communication between criminals for some time." Blackbox-security.com, the site selling IronChat and IronPhone, quoted Snowden as saying: "I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation," according to Web archives. Whether the endorsement was authentic or not wasn't immediately known. The site has been seized by Dutch police.
"I use PGP to say hi and hello, i use IronChat (OTR) to have a serious conversation,"
Sure sounds like a paid product endorsement....
This is likely just a fairly amateurish security protocol implementation sold at inflated prices to people flush with cash.
Its really not all that hard to do secure communications... if actual criminals used something called "ironchat" they deserve what they got.
And siezed the keys, then used those keys to unlock the locks. Or the messages are logged unencrypted on the siezed site.
I promise you the dutch police have no ability to "hack" anything.
And IronHorse or whatever has never been secure.
If there was any chance of listening to future conversations between parties using Iron Chat, this announcement just blew that right out of the water.
The folks who wish to talk via encrypted channels will now simply change their method of communication.
It could be another commercial app, a homebrew one or just go all old school and do things the way it was done before the era of smartphones.
It could also be complete bullshit on the part of the Police in an attempt to get folks to quit using it :D
Pretty sure that quote is only half true. Snowden has mentioned OTR in the past. I doubt he specified IronChat.
Joseph Elwell.
They just fetched keys from the central service provider, and given that this crappy app never implemented actual end-to-end encryption, that was enough to decrypt the messages.
Seriously, criminals stupid enough to rely on proprietary, centralized messenger services deserve to get jailed for that alone.
They siezed the site
And siezed the keys, then used those keys to unlock the locks.
Then its not really end-to-end encryption as claimed. Its just another service encrypting its traffic so middlemen, other than itself and its masters, can't read it. In true end-to-end the service provider can't read the content even if they want to.
So only the Android users were hit and not the iOS users of the app?
We should not be using PKI that depends on a trusted source.
People have their own private keys. But then how to know that you are using the right one? The SSH problem.
So use SRP instead. Secure Remote Password. The communication only works if both people use the same password. And no way to brute force the password back. Simple, and intrinsically secure.
Sadly, most of them do. Everyone else gets theirs taken away involuntarily. We all clap when we hear that the government nabbed one of those evil money launderers.
Money laundering is an almost sure-fire conviction as it is impossible to disprove, and that is exactly what a defendant had to do. Thatâ(TM)s why roadside piracy, I mean, civil forfeiture is so lucrative.
Underpay your taxes by $170? Boom, every dollar in your position is now laundered money, proceeds of your tax evasion. Take out $5,000 of your own money from the bank one day, $6,000 of your own money the next? Bam, youâ(TM)re a money launderer, your funds were obtained via structuring.
The link between every dollar and theoretical malfeasance is not hard to make, so itâ(TM)s the perfect crime to charge someone with when they havenâ(TM)t committed a crime you can prove they committed.
In fact, the only guaranteed non-laundered money, is money you give to the government. No matter where you got it from, or how you acquired it, if you give it to the government, itâ(TM)s righteous.
I hear the decryption tool was written in Rust.
I've never heard of Ironchat but from the sounds of it, it was cryptographic snakeoil. If cops / intelligence services were listening in realtime that would suggest that it wasn't securing messages from man in the middle / spoof attacks or the manner that keys were exchanged was insecure.