7 ms·

why would anyone use this over something like signal?

by doublextremevil 6y ago

er4hn 6y ago
At a guess - flashier marketing sold to consumers who don't know better.
- vecinu 6y ago
  Another likely scenario, people who do "underground" things prefer using not so popular tools to evade authorities but that may prove to have the opposite effect if they're not built robustly.
wp381640 6y ago
The devices do more than signal since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription Most of these hacks are the equivalent of hacking signal and backdooring the software This shit is hard especially when LE is determined, but criminal syndicates aren’t dumb and hire a lot of smart people
- topynate 6y ago
  > since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription That is, do a bunch of crap that will immediately make you stand out to any modern (by which I mean, total) surveillance agency. The syndicates' problem isn't stupidity but immodesty – typical of organized crime. They thought they were, not smart, but the smartest, and that made it easy for other criminals to sell them garbage security products.
  - wp381640 6y ago
    From a network perspective it’s indistinguishable from a 4G hotspot The devices are also heavily rotated, they can also have IMEI numbers updated To date with all of the public breach details it’s always been humint that lead to the networks being taken down
    - gruez 6y ago
      > From a network perspective it’s indistinguishable from a 4G hotspot Not exactly, because that would depend on how competent the network is. For a "dumb" network yes, they won't know whether it's a 4g hotspot or not, but it's conceivable that an all-knowing adversary (eg. NSA) can infer the make/model of the phone based on fingerprinting or even the IMEI.
      - rswail 6y ago
        Except the NSA is not interested particularly in criminals. Their job is national security, not law enforcement.
  - ParanoidShroom 6y ago
    Kinda true. If they are talking the truth, they said they could see the phones turning on around the harbor of Antwerp, Rotterdam and in Colombia. The 3 key points for probably 50% of europe's coke. How that they can see them being turned on might be something to do with your comment.
- novok 6y ago
  Why would you work at a criminal syndicate where you could just work in big tech with these levels of skill? These syndicates would have to pay $1 million /yr minimum to justify the risk.
  - shadowgovt 6y ago
    Depends on the cirumstances. For example, if you have a criminal record, some of big tech is quite a bit less interested in talking to you. Criminal syndicates, obviously, don't consider a criminal record a deal-breaker.
    - novok 6y ago
      good point
    - jdmoreira 6y ago
      also you might have family and community ties to some of these people. They might groom you since you are an early teen. When I was 13 for sure being the hacker in a crime organization would have sounded somewhat appealing.
  - antihero 6y ago
    I imagine they have way better office parties.
  - AJ007 6y ago
    A requirement to be involved in narcotics distribution is inability to think things through very carefully.
    - boringg 6y ago
      Or a lack of other viable options. I would agree with your comment on the whole though. Typically doesn't end well.
- antihero 6y ago
  So this puts an absolutely huge amount of trust in one place (the Sky ECC) company. A single point of failure that can control and have access to everything if it goes rogue. Surely just having some internally maintained ROMs with Signal/Telegram/Riot/OTR and your own process for procuring and cycling burners would be better if you have the money and resources?
- dgellow 6y ago
  How do they hire talents? You can make lot of money legally if you’re a smart person in tech, I guess they have to offer either ridiculously high salaries, or something else?
upofadown 6y ago
Convenience. Why bother with stuff like, say, validating your Signal "safety numbers" to ensure that you are actually talking to your contact and not the police? Instead, just farm out all the boring detail to someone else and buy a "secure" phone for $1-$2k. Unfortunately, at that point you are no longer effectively end to end. There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers. To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed. [1] https://securityaffairs.co/wordpress/57036/cyber-crime/blackberry-pgp-messages.html https://securityaffairs.co/wordpress/57036/cyber-crime/black...

why would anyone use this over something like signal?

er4hn 6y ago

At a guess - flashier marketing sold to consumers who don't know better.

vecinu 6y ago
Another likely scenario, people who do "underground" things prefer using not so popular tools to evade authorities but that may prove to have the opposite effect if they're not built robustly.

wp381640 6y ago

The devices do more than signal since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription Most of these hacks are the equivalent of hacking signal and backdooring the software This shit is hard especially when LE is determined, but criminal syndicates aren’t dumb and hire a lot of smart people

topynate 6y ago
> since they remove GPS, microphones, have a custom OS and provide anonymous burner SIMs on a subscription That is, do a bunch of crap that will immediately make you stand out to any modern (by which I mean, total) surveillance agency. The syndicates' problem isn't stupidity but immodesty – typical of organized crime. They thought they were, not smart, but the smartest, and that made it easy for other criminals to sell them garbage security products.
- wp381640 6y ago
  From a network perspective it’s indistinguishable from a 4G hotspot The devices are also heavily rotated, they can also have IMEI numbers updated To date with all of the public breach details it’s always been humint that lead to the networks being taken down
  - gruez 6y ago
    > From a network perspective it’s indistinguishable from a 4G hotspot Not exactly, because that would depend on how competent the network is. For a "dumb" network yes, they won't know whether it's a 4g hotspot or not, but it's conceivable that an all-knowing adversary (eg. NSA) can infer the make/model of the phone based on fingerprinting or even the IMEI.
    - rswail 6y ago
      Except the NSA is not interested particularly in criminals. Their job is national security, not law enforcement.
- ParanoidShroom 6y ago
  Kinda true. If they are talking the truth, they said they could see the phones turning on around the harbor of Antwerp, Rotterdam and in Colombia. The 3 key points for probably 50% of europe's coke. How that they can see them being turned on might be something to do with your comment.
novok 6y ago
Why would you work at a criminal syndicate where you could just work in big tech with these levels of skill? These syndicates would have to pay $1 million /yr minimum to justify the risk.
- shadowgovt 6y ago
  Depends on the cirumstances. For example, if you have a criminal record, some of big tech is quite a bit less interested in talking to you. Criminal syndicates, obviously, don't consider a criminal record a deal-breaker.
  - novok 6y ago
    good point
  - jdmoreira 6y ago
    also you might have family and community ties to some of these people. They might groom you since you are an early teen. When I was 13 for sure being the hacker in a crime organization would have sounded somewhat appealing.
- antihero 6y ago
  I imagine they have way better office parties.
- AJ007 6y ago
  A requirement to be involved in narcotics distribution is inability to think things through very carefully.
  - boringg 6y ago
    Or a lack of other viable options. I would agree with your comment on the whole though. Typically doesn't end well.
antihero 6y ago
So this puts an absolutely huge amount of trust in one place (the Sky ECC) company. A single point of failure that can control and have access to everything if it goes rogue. Surely just having some internally maintained ROMs with Signal/Telegram/Riot/OTR and your own process for procuring and cycling burners would be better if you have the money and resources?
dgellow 6y ago
How do they hire talents? You can make lot of money legally if you’re a smart person in tech, I guess they have to offer either ridiculously high salaries, or something else?

upofadown 6y ago

Convenience. Why bother with stuff like, say, validating your Signal "safety numbers" to ensure that you are actually talking to your contact and not the police? Instead, just farm out all the boring detail to someone else and buy a "secure" phone for $1-$2k. Unfortunately, at that point you are no longer effectively end to end. There was a case where a company was selling a "PGP phone" where it turned out that, to save having to bother the customer with key generation on the phone, they were doing it on the servers[1]. So the police grabbed the servers with all the private keys and there were a lot of sad customers. To do end to end encryption in a way that works, there is a minimum level of understanding required. These "secure" phones are really a type of scam that preys on the not sufficiently informed. [1] https://securityaffairs.co/wordpress/57036/cyber-crime/blackberry-pgp-messages.html https://securityaffairs.co/wordpress/57036/cyber-crime/black...