How Various Law Enforcement Agencies Could Hack Your Computer Via YouTube Videos
from the it's-all-fun-and-games-until-someone-rickrolls dept
When we recently wrote about Google starting to make use of SSL for search rankings, one of our commenters noted that not every site really "needs" HTTPS. While I used to agree, I've been increasingly leaning in the other direction, and I may have been pushed over the edge entirely by a new research report from the Citizen Lab by Morgan Marquis-Boire (perhaps better known as Morgan Mayhem), entitled Schrodinger’s Cat Video and the Death of Clear-Text. He's also written about it at the Intercept (where he now works), explaining how watching a cat video on YouTube could get you hacked (though not any more).The key point was this: companies producing so-called "lawful intercept" technology, that was generally (but not always) sold to governments and law enforcement agencies had created hacking tools that took advantage of non-SSL'd sites to use a basic man-in-the-middle attack to hack into targeted computers.
I'd bet pretty good money that both of these companies also target some popular ad networks. For reasons that are still beyond me, many large ad networks still refuse to support SSL -- which is also why so few media sites support SSL. In order to do so, you have to drop most ad networks. Between ad networks and popular media targets, it's likely that there are plenty of opportunities for network injection going on.Companies such as Hacking Team and FinFisher sell devices called “network injection appliances.” These are racks of physical machines deployed inside internet service providers around the world, which allow for the simple exploitation of targets. In order to do this, they inject malicious content into people’s everyday internet browsing traffic. One way that Hacking Team accomplishes this is by taking advantage of unencrypted YouTube video streams to compromise users. The Hacking Team device targets a user, waits for that user to watch a YouTube clip like the one above, and intercepts that traffic and replaces it with malicious code that gives the operator total control over the target’s computer without his or her knowledge. The machine also exploits Microsoft’s login.live.com web site in the same manner.
Fortunately for their users, both Google and Microsoft were responsive when alerted that commercial tools were being used to exploit their services, and have taken steps to close the vulnerability by encrypting all targeted traffic. There are, however, many other vectors for companies like Hacking Team and FinFisher to exploit.
Provided that the attacker can persuade a sufficiently large carrier to install a network injection apparatus, they can be reasonably certain of the success of any attack. While an attacker would still need an exploit to escape from the context of the target’s browser, one of the browser plugins (such as flash, java, quicktime, etc.) or similar is likely to provide a low cost avenue for this. This type of capability obviates the need for spear-phishing or more clumsy attacks provided the target is in the attacker’s domain of influence.The key point made by the new report is not about the ideas behind network injection. That's been well-known for a while, and the NSA's and GCHQ's "Quantum Insert" packet injection system has been talked about recently. The main revelation here is that there are commercial vendors selling this technology to all sorts of law enforcement folks, meaning that it's probably widely used with little oversight or transparency. And that should be a pretty big concern:
This type of approach also allows for the ‘tasking’ of a specific target. Rather than performing a manual operation, a target can be entered into the system which will wait for them to browse to an appropriate website and then perform the required injection of malicious code into their traffic stream. As such, this could be described as ‘hacking on easy mode’.
These so-called “lawful intercept” products sold by Hacking Team and FinFisher can be purchased for as little as $1 million (or less) by law enforcement and governments around the world. They have been used against political targets including Bahrain Watch, citizen journalists Mamfakinch in Morocco, human rights activist Ahmed Mansoor in the UAE, and ESAT, a U.S.-based news service focusing on Ethiopia. Both Hacking Team and FinFisher claim that they only sell to governments, but recently leaked documents appear to show that FinFisher has sold to at least one private security company.With all the attention on NSA/GCHQ surveillance, it's good that people are recognizing just how powerful some of these tools are. But we ought to be quite concerned about how ordinary law enforcement around the globe is making use of these tools as well, often with much less oversight and even less accountability.
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: encryption, https, law enforcement, legal intercept, network injection, packet injection, quantum insert, ssl
Companies: finfisher, hacking team
Reader Comments
Subscribe: RSS
View by: Time | Thread
[ link to this | view in chronology ]
Re:
you have to block ALL of the ad networks
they only have to make one that you don't recognize
make a rule for the browser that says that only Same Domain content is allowed, and you will still only block a portion since some sites will proxy the ad networks.
[ link to this | view in chronology ]
Re: Re:
By having static data on separate domains, session information is not passed to those web servers, making it cheaper to host.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re: Re: Re:
[ link to this | view in chronology ]
Re: Re: Re: Re:
[ link to this | view in chronology ]
Re:
To go full ssl, you have to tell ad networks that don't support to it to to hell and that costs the site money. TechDirt list ad revenue to go ssl and many sites cannot or will not do the same.
[ link to this | view in chronology ]
Provided that the attacker can persuade a sufficiently large carrier to install a network injection apparatus
How do you even begin that conversation? 'Hello, I'm from a group that sells hacking tools to various agencies around the world, and I'm here today to talk to you about perhaps adding some hardware to your systems that will allow easy access to the computers or electronics of people using your services.
Now yes, this may or may not open you up to a massive amount of negative PR, or even lawsuits should this ever be discovered, but we assure you, due to the incredibly restrictive NDA we'd like you to sign, all of the blame will be placed solely on your head, as you will be forbidden to even mention our name at any point. So, do we have a deal?'
Or I suppose they could just cut straight to the chase. 'Here's a check for a couple million, here's an NDA that you need to sign to get the check, and you don't need to know why we're paying you so much money, so don't ask, and don't look into it.'
Somehow I imagine it's closer to the second possibility than the first.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
It's not the company that has the conversation. It's the government who bought the technology that shows up at the telco with the equipment in one hand... and a legal order (or guns) in the other...
[ link to this | view in chronology ]
Re: Re:
Why not both? In fact, my patent=pending technology allows us to actually print legal orders on guns and even on bullets! Just think how much more efficient it would be!
[ link to this | view in chronology ]
Re: Re:
Major U.S telcos are such gov't boot-lickers that they don't even need legal orders (or guns). They're eager to help subvert the Constitution any time they can and are then generously rewarded.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
Not even close. These telcos will do anything the government asks, and require nothing more formal than a post-it note. Literally*.
* and I am using that word literally
[ link to this | view in chronology ]
Well, on second thought, guess I'm not really interested in all the mumbo jumbo lip service - how do they rationalize this within commonly accepted ethical standards? Obviously they can not and simply fall back upon the premise that they above the law, because reasons.
[ link to this | view in chronology ]
Re:
Once a device such as this is installed inside the telco to provide this lawful intercept capability, then it will get used. Especially if it's a case where the Government Agency (Police, intelligence, SEC, IRS etc) has direct access to the device rather than having to go through the telco each time it wants to gather data.
[ link to this | view in chronology ]
Re: Re:
The whole anti-russia sentiment coming back is already simmering down, as the, may I say, illegal, sanctions put on it since a couple years are complete nonsense.
[ link to this | view in chronology ]
I would say this is more the point than requiring more sites go SSL.
SSL won't protect anyone from malicious attacks as long as third parties refuse to update their software to prevent the injections in the first place.
I remember the days when browsers prohibited any third party sources from activating.
How far we've come for a little convenience.
Rule of thumb: any time third party sources are used to deliver content, vulnerabilities will always exist, and SSL won't change this.
Most third party sources always start with the user, the second they click the install button.
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Law Enforcement's new motto
Never gonna let you
Gonna track your history
from your Youtube
Never gonna let you cry
Never gonna say goodbye
We've got a flash cookie
via Bluetooth.
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
We want to make it as much trouble to spy as possible. Even if it's still possible, if it's harder to do, then they'll be able to do less of it. And if we can push the issue from a few utterly subservient ISPs to more contentious (and numerous) companies like Google, that's better too.
[ link to this | view in chronology ]
Is there any protection other than using https?
[ link to this | view in chronology ]
Re: Is there any protection other than using https?
Do these have to do with the OS at all?
[ link to this | view in chronology ]
SSL cert problems on TD still exist
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Of course, if such a program were exposed, it would permanently reduce the online security of everyone, since people would avoid getting security updates. But I wouldn't assume they care about that when they've got a computer they want to compromise.
[ link to this | view in chronology ]
Re:
You don't NEED Windows Update if you have a good firewall and good anti-virus software.
[ link to this | view in chronology ]
Re: Re:
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Let apply it the other way around
[ link to this | view in chronology ]
Internet Surfing Security
Must have security related add-on's
(Click tools/Add-ons - on the menu bar of Firefox)
type in the following names on the add-on's page to find:
Noscript,
Better Privacy
Adblock Plus,
or visit:
https://addons.mozilla.org/en-US/firefox/
Learn to use Noscript and keep all scripts disabled except the one's you must enable. Others only temporary enable when one must do so. The rest, never enable them. Practice and soon you will be a noscript pro and it's fast after that.
Just as important as Noscript is:
https://www.eff.org/https-everywhere
And a good VPN service - beware of "honeypots"
----------------------------------------------------
https://torrentfreak.com/which-vpn-pr oviders-really-take-anonymity-seriously-111007/
Much of the advice here is misinformation and very inaccurate/wrong.
Leave Windows Updates ON. Not doing so is seriously stupid. As is the other horrible advice from other replies here. IF your older computer can't handle Win Updates then it's past time to run 32 bit GNU/Linux Mint or Ubuntu, and also with the above Firefox add-on's there as well.
Everything stated here is 100% accurate. But many other replies are absolutely horrible advice.
note: all my links above are https (secure ssl) sites. For your safety.
Don't forget the VPN Service. $30 to $40 per year, for up to 5 PC's.
Beware of others offering horrible advice on the internet. Always verify everything.
[ link to this | view in chronology ]