9 ms·

Interesting story, but wouldn’t be surprised if the real play here was to get his source code so they could get some bad guys to use a modified version that the

Interesting story, but wouldn’t be surprised if the real play here was to get his source code so they could get some bad guys to use a modified version that the NSA could crack. Put a back door in and then intercept traffic trying to download the encryption app to download the back-doored version. The fact that the NSA has to call him in the middle of the night to learn that the free version didn’t use strong encryption (a fact that seems to have been a selling point for the non-free version) just sounds a bit dubious, but that’s just my sense. Nice mug regardless.

kapitalx 6y ago
From the story, I didn't get the sense that Dave didn't know that the shareware version used 40-bit encryption. But that it was a revelation for the author. Sounded like Dave didn't give up any information, other than the relevant version.
- thisisnico 6y ago
  I see so many tactics of an expert negotiator here. Being incredibly nice and respectful. They were able to get what they wanted. They were able to convince you of an issue, with urgency, without any evidence of the use of your code other than the words of the officer. The story could have absolutely been fabricated to obtain access to the source code per an initiative to have access to cryptographic software, or it could have been true.
  - vl 6y ago
    Being NSA they could have easily have gotten source code in the covert way - one of the employees had copy at home, they emailed it around! But for encryption software there is no value in source code in the first place - algorithms are standard, and software can be disassembled anyway. All access to the source code does is allows them to save time on disassembly. Author knew all this and this is why he gave them source code in the first place. Basically fabricating this story and risking exposure just wasn’t necessary.
    - unsignedchar 6y ago
      Having the source code probably just saves time on the analysis of vulnerabilities and triggering timed glitches.
meowface 6y ago
I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers. The fact that they asked for an existing algorithm backdoor, among other things, makes me think they really were trying to crack at least one thing encrypted with it. As for whether it was to deal with a time-critical situation or whether that was just a confidence trick to make him more likely to give up the code, who knows.
- dx034 6y ago
  That happened in 2000, I doubt the page was served via https. MITM shouldn't be too hard then.
- bhelkey 6y ago
  > how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? Man in the Middle attacks work even if one goes to the official site. It could have looked something like this. 1) User attempts to go to the official site https://.. https://... 2) NSA intercepts the message, downgrades to http and sends back a dummy site with the malicious binary [1]. 3) The user doesn't notice the change and uses the malicious binary. Today, a series of steps have been taken to make such an attack more difficult. Now browsers tend to try to warn the user and sites can take advantage of HSTS preload lists[2]. However, this article was written about an event in early 2000 when many of these safeguards didn't exist. [1] https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack [2] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
  - meowface 6y ago
    Right. They could possibly do this and have done it before. But they wouldn't need to request the source code from the author in order to do it - they could patch the binary. Also, it's a pretty involved thing to do and not that easy to pull off in a situation like this. For example, presumably all of the targets already have the software installed, and they may have no reason to visit the official site again; especially if updates are very infrequent. Finally, it wouldn't do them any good for trying to crack things that are already encrypted with it, which from the conversation does seem like was at least one of their goals. (Could be deception, but that's the most likely reading, to me.) I'm just saying that that doesn't seem to be a likely reason for requesting the source code. The reason is likely what they said it was: they want to look at the source code to see if there's some way to crack the encryption faster than they otherwise could - for example, some bug causing key generation to be somewhat predictable.
deleted 6y ago
[deleted]
vl 6y ago
Whatever they used source code for, it just a shortcut - they could do the same thing by just disassembling and binary patching (like all hackers and agencies do all the time). Basically they would never do it and risk exposure if they didn’t want to get result extremely fast.
- dx034 6y ago
  Maybe they had the opportunity to get someone to use their patched software but only had a day or so to create a fake copy. In that case the source could would be very valuable.
- deleted 6y ago
  [deleted]
LatteLazy 6y ago
Or some good guys to use that version...

kapitalx 6y ago

From the story, I didn't get the sense that Dave didn't know that the shareware version used 40-bit encryption. But that it was a revelation for the author. Sounded like Dave didn't give up any information, other than the relevant version.

thisisnico 6y ago
I see so many tactics of an expert negotiator here. Being incredibly nice and respectful. They were able to get what they wanted. They were able to convince you of an issue, with urgency, without any evidence of the use of your code other than the words of the officer. The story could have absolutely been fabricated to obtain access to the source code per an initiative to have access to cryptographic software, or it could have been true.
- vl 6y ago
  Being NSA they could have easily have gotten source code in the covert way - one of the employees had copy at home, they emailed it around! But for encryption software there is no value in source code in the first place - algorithms are standard, and software can be disassembled anyway. All access to the source code does is allows them to save time on disassembly. Author knew all this and this is why he gave them source code in the first place. Basically fabricating this story and risking exposure just wasn’t necessary.
  - unsignedchar 6y ago
    Having the source code probably just saves time on the analysis of vulnerabilities and triggering timed glitches.

meowface 6y ago

I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers. The fact that they asked for an existing algorithm backdoor, among other things, makes me think they really were trying to crack at least one thing encrypted with it. As for whether it was to deal with a time-critical situation or whether that was just a confidence trick to make him more likely to give up the code, who knows.

dx034 6y ago
That happened in 2000, I doubt the page was served via https. MITM shouldn't be too hard then.
bhelkey 6y ago
> how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site? Man in the Middle attacks work even if one goes to the official site. It could have looked something like this. 1) User attempts to go to the official site https://.. https://... 2) NSA intercepts the message, downgrades to http and sends back a dummy site with the malicious binary [1]. 3) The user doesn't notice the change and uses the malicious binary. Today, a series of steps have been taken to make such an attack more difficult. Now browsers tend to try to warn the user and sites can take advantage of HSTS preload lists[2]. However, this article was written about an event in early 2000 when many of these safeguards didn't exist. [1] https://en.wikipedia.org/wiki/Downgrade_attack https://en.wikipedia.org/wiki/Downgrade_attack [2] https://blog.mozilla.org/security/2012/11/01/preloading-hsts/ https://blog.mozilla.org/security/2012/11/01/preloading-hsts...
- meowface 6y ago
  Right. They could possibly do this and have done it before. But they wouldn't need to request the source code from the author in order to do it - they could patch the binary. Also, it's a pretty involved thing to do and not that easy to pull off in a situation like this. For example, presumably all of the targets already have the software installed, and they may have no reason to visit the official site again; especially if updates are very infrequent. Finally, it wouldn't do them any good for trying to crack things that are already encrypted with it, which from the conversation does seem like was at least one of their goals. (Could be deception, but that's the most likely reading, to me.) I'm just saying that that doesn't seem to be a likely reason for requesting the source code. The reason is likely what they said it was: they want to look at the source code to see if there's some way to crack the encryption faster than they otherwise could - for example, some bug causing key generation to be somewhat predictable.

deleted 6y ago

[deleted]

vl 6y ago

Whatever they used source code for, it just a shortcut - they could do the same thing by just disassembling and binary patching (like all hackers and agencies do all the time). Basically they would never do it and risk exposure if they didn’t want to get result extremely fast.

dx034 6y ago
Maybe they had the opportunity to get someone to use their patched software but only had a day or so to create a fake copy. In that case the source could would be very valuable.
deleted 6y ago
[deleted]

LatteLazy 6y ago

Or some good guys to use that version...