site Search:


 
   
story category
DEA Angry Because They Can't Snoop On iMessages
Thwarted By Apple Service's Encryption
by Karl Bode Thursday 04-Apr-2013 tags: legal · business · wireless · telco · security · privacy · content · networking · mail · wireless · cellular · cloud · AT&T
Tipped by guear See Profile
According to documents obtained by CNET, the DEA is upset because the encryption used by Apple's iMessage foils their ability to snoop on those communications. Even with a warrant (increasingly seen as optional these days by law enforcement and intelligence agencies) and the fact that carriers let the NSA snoop on everything in real time, "it is impossible to intercept iMessages between two Apple devices."

Well not entirely impossible; the memo notes that sometimes interception is possible, but it would require the government to conduct man in the middle attacks using spoofed cell towers, something the feds just got busted for using for years without properly informing Judges.

Encryption isn't particularly hard, but as an ACLU analyst in the CNET piece points out, most companies and providers don't put any effort into it:

Christopher Soghoian, a senior policy analyst at the American Civil Liberties Union, said yesterday that "Apple's service is not designed to be government-proof." "It's much much more difficult to intercept than a telephone call or a text message" that federal agents are used to, Soghoian says. "The government would need to perform an active man-in-the-middle attack... The real issue is why the phone companies in 2013 are still delivering an unencrypted audio and text service to users. It's disgraceful."

The government has been pushing for years to have wiretap and privacy laws like CALEA changed to provide them with easier access to encrypted services like Gmail.

view: topics flat text 
Post a:
coma9

join:2013-02-05
Lehi, UT

Encryption on Android

Does anyone know of a good app to use for SMS on Android that would provide Encryption? I'm sure the receiving party would have to have the same app installed, but that would be no problem.

atuarre
Here come the drums
Premium
join:2004-02-14
College Station, TX

Re: Encryption on Android

Why would you need encrypted SMS? Unlesss your pushing drugs, or selling them, or talking to little boys or girls, like some of the red people like to say, if you are doing nothing wrong, then you should not need encryption.

hitachi369
Embrace Your Rights
Premium
join:2001-10-03
Grand Rapids, MI
kudos:4

Re: Encryption on Android

LOL, the if you are doing nothing wrong you have nothing to hide approach...

atuarre
Here come the drums
Premium
join:2004-02-14
College Station, TX

Re: Encryption on Android

said by hitachi369:

LOL, the if you are doing nothing wrong you have nothing to hide approach...

I don't agree with it but every time you try to beat the drum of privacy that's the first thing I'm used to hearing!
SunnyD

join:2009-03-20
Madison, AL

Re: Encryption on Android

Maybe because it's been proven time and again that private information sent in the clear is constantly being dragnetted by various parties for various reasons, whether they have any interest in YOUR information or not, without you consent or even your knowledge?

And I'm not solely talking about either of government, law enforcement, business, private or illicit entities at any given moment.
CXM_Splicer
a more sensible view
Premium
join:2011-08-11
NYC
kudos:1
I always argue that if you aren't pushing drugs, or selling them, or talking to little boys or girls then the government shouldn't be monitoring you in the first place

FifthE1ement
Tech Nut

join:2005-03-16
Fort Lauderdale, FL
I don't want the government finding out about my Harry Potter collection!

The why do you need it if you're not doing anything wrong argument is BS. Why do I need a Smith & Wesson if I'm not doing anything wrong, perhaps to blow away someone who wants to do something wrong to me.

And if it becomes as easy as they want it to be the system wil be abused by those who would never even think it was wrong. What if an ex works for law enforcement and has access to the text message database and just wants to spy on you, etc. I can give a million examples but they all pretty much end up the same, I don't want someone looking over my shoulder.

5th
--
"The relationship between what we see and what we know is never settled..."

PapaMidnight

join:2009-01-13
Baltimore, MD
said by hitachi369:

LOL, the if you are doing nothing wrong you have nothing to hide approach...

Never fails to be the first counter-argument to be any privacy push.

Corehhi

join:2002-01-28
Bluffton, SC
Reviews:
·Hargray Cable
said by hitachi369:

LOL, the if you are doing nothing wrong you have nothing to hide approach...

Then why fight the "cold war" which I think someone said was about freedom or something like that??? I think one thing they keep pointing out was government surveillance of phone calls??? It's just the US has better tech then they did back then.

The US taxes everything in sight to make things equal??? Isn't that communism???

Still can figure out why the cold war was fought???

For those of you to young to know about all this cold war stuff the US is acting very much like the commies of back then....»en.wikipedia.org/wiki/The_Commun···anifesto

A little reading to get you going.
coma9

join:2013-02-05
Lehi, UT
Because me telling my wife about what I'm going to do to her tonight, and the amount of lube we're going to need to pick up on the way home, is none of the NSAs business. Or do you think it is?

Duramax08
Win8 sucks
Premium
join:2008-08-03
San Antonio, TX
Reviews:
·Millenicom
·Cricket Broadband

Re: Encryption on Android


humanfilth

join:2013-02-14

2 edits

Re: Encryption on Android

RE: Think of the children!
Fun fact: The people who think of the children that much, usually get busted for pervy things. Or abuse their kids or were abused by their parents/relations.

The biggest 'scared of homosexuals' people in congress/senate will eventually get busted for being homosexual. Michelle Bachmann did cure her husband of being gay for the time being. Marcus Bachmann runs a 'gay to straight' conversion company. Nasty Nasty man he is.

There was an unconstitutional Bill up in Canada that the title was "protecting children from internet stuff". Except it had nothing about children in it and it was all about creating a massive data-base of everyones internet communications.
An Canadian article recently also had a Judges decision that the police need a wiretapping warrant above a regular warrant to download peoples IM history and other digital communications stuff.

Meanwhile Internet companies in America keep rerouting their customers communications into that massive government data center for profit(called the George Bush Jr memorial library?) .
Corporations are 100% corrupt and enjoying breaking constitutional law without any penalty.
Network Guy
Premium
join:2000-08-25
New York
Reviews:
·Optimum Online
said by coma9:

Because me telling my wife about what I'm going to do to her tonight, and the amount of lube we're going to need to pick up on the way home, is none of the NSAs business. Or do you think it is?

:D

PapaMidnight

join:2009-01-13
Baltimore, MD
said by coma9:

Because me telling my wife about what I'm going to do to her tonight, and the amount of lube we're going to need to pick up on the way home, is none of the NSAs business. Or do you think it is?

Some of those acts may be illegal in certain states.

/facepalm.
coma9

join:2013-02-05
Lehi, UT

Re: Encryption on Android

Utah's good. The wife and I can do what ever we want

jap
Premium
join:2003-08-10
038xx

Re: Encryption on Android

said by coma9:

Utah's good. The wives and I can do what ever we want.

Fixed it for you.

KrK
Heavy Artillery For The Little Guy
Premium
join:2000-01-17
Tulsa, OK
It is or how else will they be able to get the cameras in place in time to watch???!??!?


RRedline
Rated R
Premium
join:2002-05-15
Williamsport, PA
said by coma9:

Because me telling my wife about what I'm going to do to her tonight, and the amount of lube we're going to need to pick up on the way home, is none of the NSAs business. Or do you think it is?

The suspense is killing me. I want to know what you are going to do to your wife tonight!
--
One nation, under Zod!
Wilsdom

join:2009-08-06
Upload your SMS history and give us a link

hyphenated

@mycingular.net

Re: Encryption on Android

There probably already is a link, if you can find it. Wait... did I break TOS?

hyphenated

@mycingular.net
Encryption isn't just for people "doing wrong"

Probitas

@teksavvy.com

Re: Encryption on Android

This is all too true. Some people require encryption due to the job they have, and these are all legal and require to be safe, cell phone, landline, and the internet (VPN for one thing), so secret information is not transmitted in the clear.

Is the government in the business of attempting to spy on legitimate businesses in an attempt to create emminent domain issues and steal ideas and products for government use without actually PAYING for it? (one wingnut theory)

This type of behavior is right out of the iron curtain. It is far to open to abuse as current behavior indicates, and should be halted immediately. The only good being served by this is government attempting to avoid being prosecuted for rights violations.

Gozo

join:2012-07-25
said by atuarre:

if you are doing nothing wrong, then you should not need encryption.

I can't wait to deport unamerican "good 'ol boy" traitor trash like you to more hospitable countries like China or North Korea where you have no right to privacy, personal rights or property rights.

I'm sure you'll fit right in bowing to daddy mao and the dear leader.

In the meanwhile i'll stay right here and enjoy my freedoms and use the legal system to fight anyone who dares threaten those freedoms.

OSUGoose

join:2007-12-27
Columbus, OH

Re: Encryption on Android

Annnnnnd that didn't take long...

C'mon back into the bunker grandpa, and put your tin foil hat back on. Big Bad Red aint gonna get you way down here.
clone

join:2000-12-11
Portage, IN

Re: Encryption on Android

Just because it's currently so trendy to mock people with privacy concerns, doesn't make their concerns any less legitimate. Making fun of people doesn't solve anything.

OSUGoose

join:2007-12-27
Columbus, OH

Re: Encryption on Android

I wasn't making fun per se, however do you immedely think anything anyone thinks of is true, and not nutty.
clone

join:2000-12-11
Portage, IN

Re: Encryption on Android

Of course not. But I don't immediately dismiss everything as nutty, just because someone feels strongly about it.

I would, however, have to agree that anyone who feels safer when "authorities" can read the personal communications of private citizens at will should at least brush up on their history of the regimes that had/sought that kind of power in the last century or so, and how well it all turned out for the folks in those countries.
etaadmin

join:2002-01-17
Dallas, TX
kudos:1
said by atuarre:

Why would you need encrypted SMS? Unlesss your pushing drugs, or selling them, or talking to little boys or girls, like some of the red people like to say, if you are doing nothing wrong, then you should not need encryption.

I would like to do that to give our government a hard time and make them think I'm doing something bad, and yes I have something to hide I'm guilty of 'thought crimes'
FLATLINE

join:2007-02-27
Buffalo, NY
I'm not doing anything wrong in my house but I still lock the door. Its about protecting whats mine. Including my privacy. It your so eager to let the feds know what your doing then go ahead and provide them anything you want.

Plus there's also fair play involved. I'm not paying taxes in record numbers to have sub par half assed national security. I want them to put the work in and be awesome catching the bad guys the right way.

tc1uscg

join:2005-03-09
Saint Clair Shores, MI
said by atuarre:

Why would you need encrypted SMS? Unlesss your pushing drugs, or selling them, or talking to little boys or girls, like some of the red people like to say, if you are doing nothing wrong, then you should not need encryption.

Just curious, do you have WiFi in your house? Do you run security/Encryption on your router? What about logging into your router. Do you have it password protected?
TBusiness

join:2012-10-26
Toledo, OH
First if you want privacy; you shouldn't use an open source product that is known to have issues with spyware, viruses and other issues. And especially don't trust Google who sells any and everything they can for a buck.
coma9

join:2013-02-05
Lehi, UT

Re: Encryption on Android

So don't have a cell phone? How about I root it, and throw a custom cyanogenmod on it, so it's clean and fast. Then, how about throwing an encrypted SMS app on it, so texts are secure. Problem fixed. If not, name a way to fix the problem of security, and I'd be happy to look into it.
Kearnstd
Elf Wizard
Premium
join:2002-01-22
Mullica Hill, NJ
said by TBusiness:

First if you want privacy; you shouldn't use an open source product that is known to have issues with spyware, viruses and other issues. And especially don't trust Google who sells any and everything they can for a buck.

Apple is just as bad, But their spying is closed source and patented.

But I know the big business is sucking my data like a hoover to make a buck. The government should worry you more, They suck up the data and stash it away. You will never know why they have that data and what it could be used for.

I trust Cuppertino and Mountainview more than I trust the MIBs in the Beltway.(Trust being a subjective term, I trust all of them about as far as I can throw a gold brick on a planet with 2.0g)
--
[65 Arcanist]Filan(High Elf) Zone: Broadband Reports

Kandinsky

@comcast.net
Wow, such a simple question and all this fuss. Did anyone even answer? On Android you can encrypt SMS texts using TextSecure by Whisper Systems. They also make an app for encrypting your voice calls called RedPhone. If you have a rooted phone, Gibberbot gives you OTR chat functionality now with Gmail account support with optional Tor integration at that. MITM attacks cannot intercept the communications for any of these 3 apps.

Personal security should be protected always; as a matter of principal.
buzz_4_20

join:2003-09-20
Presque Isle, ME

Maybe It's not about hiding

Maybe some of us just want private conversations to be private.
coma9

join:2013-02-05
Lehi, UT

Re: Maybe It's not about hiding

Nice username It's okay Buzz, you shouldn't have to hide anything, because they shouldn't be looking through everything.
But let's say this, someone walks in on you in the shower, complete stranger, do you not instantly cover your private parts? They're perfectly normal and human parts, but they're YOUR parts and you don't want others looking at them, amirite?

OSUGoose

join:2007-12-27
Columbus, OH

Re: Maybe It's not about hiding

Depends, is it a cute female?
coma9

join:2013-02-05
Lehi, UT

Re: Maybe It's not about hiding

said by OSUGoose:

Depends, is it a cute female?

No, it's a federal agent. He's tall, brawny, and smiling. But what do you have to hide either way? What does it matter who's looking at your junk? It's not like yours is much different than billions of others, right? Why hide it?

Because it's yours.

OSUGoose

join:2007-12-27
Columbus, OH

Re: Maybe It's not about hiding

You need to call your mfg as your sarcasm detector is not working.

BTW there are hot female federal agents.
coma9

join:2013-02-05
Lehi, UT

Re: Maybe It's not about hiding

Didn't say there wasn't, the one staring at your junk is a man. As described above. Do you cover your parts, or let him take in the view? You have yet to answer the hypothetical question. =]

Probitas

@teksavvy.com

Due process

Those two words alone should put an end to all this crap. Side stepping rights and such should cause null and void on any evidence if gathered improperly. I don't really care about letting a few guilty people go as long as only guilty people end up in court.

That's something to shoot for.

OSUGoose

join:2007-12-27
Columbus, OH
Reviews:
·Insight Communic..

Re: Due process

How about raising the bar, or hell actually respecting the bar. All too many innocent people go to jail because of Prosecutors scared to do work and upset their cop friends. Why question my good friend Mr Cops facts, he would NEVER lie nor screw up.

Shoot, look at how DA/Prosecutors act even when its PROVEN that the person they convicted was innocent, they STILL will not admit they were wrong.
kevinds

join:2003-05-01
Calgary, AB

Cell phone towers?

Why would a man-in-the-middle attack using cell phone towers work in this case?

Wouldn't the encyption be happening on the device, and sent as encypted data, then only decypted by the receiving Apple device?
--
Yes, I am not employed and looking for IT work. Have passport, will travel.

KrK
Heavy Artillery For The Little Guy
Premium
join:2000-01-17
Tulsa, OK
Reviews:
·AT&T DSL Service

Re: Cell phone towers?

It's to do with the authentication of the devices to each other to send the encryption, my guess. The devices can't decrypt the messages unless they are working off the same key or code.

So they probably authenticate to each other before sending the encrypted data. By placing your equipment in the middle you authenticate to the device and then pass the authentication to the next device. Now you are authenticated as well without either end user knowing it and can read the codes/keys and decrypt traffic at will.
--
"Fascism should more properly be called corporatism because it is the merger of state and corporate power." -- Benito Mussolini
kevinds

join:2003-05-01
Calgary, AB

Re: Cell phone towers?

My thinking was private/public keys - to prevent spying, but the public keys should be shared when added to the other device's contact list, just guessing how the encyption works, I haven't known Apple to share much, so I didn't bother looking at their protocol.

So they probably authenticate to each other before sending the encrypted data. By placing your equipment in the middle you authenticate to the device and then pass the authentication to the next device. Now you are authenticated as well without either end user knowing it and can read the codes/keys and decrypt traffic at will.

-As soon as they stop spying, the two devices can't message each other?
--
Yes, I am not employed and looking for IT work. Have passport, will travel.

RARPSL

join:1999-12-08
Suffern, NY

Re: Cell phone towers?

said by kevinds:

My thinking was private/public keys - to prevent spying, but the public keys should be shared when added to the other device's contact list, just guessing how the encyption works, I haven't known Apple to share much, so I didn't bother looking at their protocol.

So they probably authenticate to each other before sending the encrypted data. By placing your equipment in the middle you authenticate to the device and then pass the authentication to the next device. Now you are authenticated as well without either end user knowing it and can read the codes/keys and decrypt traffic at will.

-As soon as they stop spying, the two devices can't message each other?

There is no need for the two devices to have the same authentication code. All that is required is that cellphone1 be sending to the Man-in-the-Middle (MitM) phony cell tower which has a separate connection to cellphone2. The message goes from cellphone1 to the MitM tower encrypted, gets decrypted and recorded, gets re-encrypted using the credentials agreed upon between MitM and cellphone2 and delivered to cellphone2.

blah_

@orbital.com
Note that this MitM attack wouldn't work generally, (in the way that the government is saying they can), with other secure messaging--- it just happens that the way Apple is implementing it with their imessaging, is vulnerable in the way the feds, (and others here), are describing, to MitM.

There are probably plenty of other apps out there that wouldn't be vulnerable to this MitM, but they aren't as popular as imessaging.
netwerp

join:2010-12-10
Evans, GA

1 edit

Here's why we don't want the government spying on us:

1. We want to safeguard our wooing and mating acts. There has already been a scandal in which employees were found to be peeping.
2. We want our money to be safe. We want our stock marketing transactions to be safe. We want own real property and we want it to be safe.
3. We want our intellectual property to be safe.
4. We want to keep our social and fiduciary identity safe and free from scandal.

Government promotes the image of being very powerful and claims to have absolute authority, implying absolute power, but it does not. The government employs hundreds of thousands of people. Statistically, some are dishonest and others may give in to temptation. We rely on the government to protect us. It cannot. We rely on the government to defend the U.S. Constitution but as we can see, it continually fudges interpretation in the wrong direction.

Consider how long our country has been in existence, the average age of management in government and then read the statement of Pournelle's Iron Law of Bureaucracy. He's on wikipedia or you can read it from his web site:
»www.jerrypournelle.com/ironlaw.html

Sunday, 07-Apr 19:07:27 Terms of Use & Privacy | feedback | contact | Hosting by nac.net - DSL,Hosting & Co-lo
over 13.5 years online © 1999-2013 dslreports.com.