Slashdot Mirror
The Feds Cracked El Chapo's Encrypted Comms Network By Flipping His System Admin (gizmodo.com)
With signs that the New York trial of notorious Mexican drug lord and alleged mass murderer Joaquin "El Chapo" Guzman is entering its end phase, prosecutors on Tuesday played copies of what they said were audio recordings of Guzman the FBI obtained "after they infiltrated his encrypted messaging system" with the help of Colombian and former cartel systems engineer Cristian Rodriguez, Reuters reported. Gizmodo reports: As has been previously reported by Vice, Colombian drug lord Jorge Cifuentes testified that Rodriguez had forgot to renew a license key critical to the communications network of Guzman's Sinaloa Cartel in September 2010, forcing cartel leaders to temporarily rely on conventional cell phones. Cifuentes told the court he considered Rodriguez "an irresponsible person" who had compromised their security, with a terse phone call played by prosecutors showing Cifuentes warned the subordinate he was in "charge of the system always working."
But on Tuesday it was revealed that the FBI had lured Rodriguez into a meeting with an agent posing as a potential customer much earlier, in February 2010, according to a report in the New York Times. Later, they flipped Rodriguez, having him transfer servers from Canada to the Netherlands in a move masked as an upgrade. During that process, Rodriguez slipped investigators the network's encryption keys. The communications system ran over Voice over Internet Protocol (VoIP), with only cartel members able to access it. Getting through its encryption gave authorities access to roughly 1,500 of Guzman's and other cartel members' calls from April 2011 to January 2012, the Times wrote, with FBI agents able to identify ones placed by the drug lord by "comparing the high-pitched, nasal voice on the calls with other recordings of the kingpin, including a video interview he gave to Rolling Stone in October 2015."
But on Tuesday it was revealed that the FBI had lured Rodriguez into a meeting with an agent posing as a potential customer much earlier, in February 2010, according to a report in the New York Times. Later, they flipped Rodriguez, having him transfer servers from Canada to the Netherlands in a move masked as an upgrade. During that process, Rodriguez slipped investigators the network's encryption keys. The communications system ran over Voice over Internet Protocol (VoIP), with only cartel members able to access it. Getting through its encryption gave authorities access to roughly 1,500 of Guzman's and other cartel members' calls from April 2011 to January 2012, the Times wrote, with FBI agents able to identify ones placed by the drug lord by "comparing the high-pitched, nasal voice on the calls with other recordings of the kingpin, including a video interview he gave to Rolling Stone in October 2015."
In every organization, there's always someone who has too much access. And there's not really a good way to avoid it.
"First they came for the slanderers and i said nothing."
This shows that the FBI doesn't need to force key escrow or any other form of weakened encryption on the public.
If they really want the crypto keys, they can get them.
...they never learn!
Colombian drug lord Jorge Cifuentes testified that Rodriguez had forgot to renew a license key critical to the communications network of Guzman's Sinaloa Cartel in September 2010
I mean, Jesus H. Christo - it is goddamned *tough* to find competent IT support. If they can't do it with automatic weapons and methamphetamine torture parties, what hope do the rest of us have?
Why would the announce that?
Obligatory xkcd
Now that everyone knows sysadmin Cristian Rodriguez betrayed drug cartel, I wonder what is the plan to keep him alive.
Fascinating that this kind of organization trusts proprietary software. Too easy to sneak in back doors.
But I guess if this shop were well run the headlines wouldn't be what they are.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Nothing beats thermorectal cryptanalysis.
Not just "someone", but the sysadmin. The guy who actually enters the commands to give the boss access to stuff can use the same commands to give himself access. Don't hire shady people for those roles, and don't shortchange them on pay so they need a few bucks from someone else.
Drug lords are rich. The rich have civil rights.
A long time ago I worked as a security sysadmin for a well known Wall Street company. As part of my work I was given access to the master passwords for ALL the financial systems.
At the same time, they paid me so little (by Manhattan standards) that I had to live with two roommates. So obviously I was living far below a comfortable middle class lifestyle. While holding the master keys to a system that processed billions of dollars a day...
As it happens, I was young, and I'm an honest man from a good family. So I did nothing dishonorable. But WHAT THE FUCK WERE THEY THINKING?
Just goes to show that most rich folks are inbred half-wits who would be flipping burgers at McDonald's if they'd been born commoners like the rest of us.
Your biggest security problem is always the human factor.
This is why you keep the wife and kids of your sysadmin in a safe place.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
They didn't crack anything at all, but rather got someone to hand over the private keys.
That's not cracking. Just sayin'
It's because the War on Drugs is simply a facade to justify all the spending. Lots of Americans are getting extremely wealthy off of the WoD, and as with all big government programs, their goal is to self perpetuate, not solve whatever problem was used to sell it to the public.
If they actually did what they were supposed to do and just iced all the drug kingpins and dealers, they'd win the WoD and there wouldn't be a need for any more billions of dollars funneled into all of their family businesses.
Because most of them actually believe in following the law, and the rest don't really want to go to jail. All it would take would be for one of these assassins to be prosecuted successfully enough to give up his superiors, and suddenly the whole system comes tumbling down.
The cryptography rarely is the weak link in the security chain. The Snowden papers revealed that the NSA carries out its chores most by social engineering and eavesdropping, not by scientifically breaking cryptosystems, and I think it is a safe bet that the same is true in the FBI.
So the system was so secure that it did not use public-key encryption between clients and had no provisions for perfect forward secrecy?