News for hackers. Stuff that matters.
Re:The NSA called me after midnight and requested my source ... by meowface on Tuesday April 21, 2020 @03:50PM (#22938667)
I doubt it. For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site?

But also, if they did want to do that, they could probably backdoor it pretty easily just by patching the binary a bit. Reverse engineering and changing binaries is way easier than cracking encryption, and they probably have some of the world's top reverse engineers.

The fact that they asked for an existing algorithm backdoor, among other things, makes me think they really were trying to crack at least one thing encrypted with it. As for whether it was to deal with a time-critical situation or whether that was just a confidence trick to make him more likely to give up the code, who knows.

Re:The NSA called me after midnight and requested my source ... by bhelkey on Tuesday April 21, 2020 @04:51PM (#22939182)
> how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site?

Man in the Middle attacks work even if one goes to the official site. It could have looked something like this.

1) User attempts to go to the official site https://...

2) NSA intercepts the message, downgrades to http and sends back a dummy site with the malicious binary [1].

3) The user doesn't notice the change and uses the malicious binary.

Today, a series of steps have been taken to make such an attack more difficult. Now browsers tend to try to warn the user and sites can take advantage of HSTS preload lists[2]. However, this article was written about an event in early 2000 when many of these safeguards didn't exist.

[1] https://en.wikipedia.org/wiki/Downgrade_attack

[2] https://blog.mozilla.org/security/2012/11/01/preloading-hsts...

Re:The NSA called me after midnight and requested my source ... by meowface on Tuesday April 21, 2020 @04:53PM (#22939195)
Right. They could possibly do this and have done it before. But they wouldn't need to request the source code from the author in order to do it - they could patch the binary. Also, it's a pretty involved thing to do and not that easy to pull off in a situation like this. For example, presumably all of the targets already have the software installed, and they may have no reason to visit the official site again; especially if updates are very infrequent.

Finally, it wouldn't do them any good for trying to crack things that are already encrypted with it, which from the conversation does seem like was at least one of their goals. (Could be deception, but that's the most likely reading, to me.)

I'm just saying that that doesn't seem to be a likely reason for requesting the source code.

The reason is likely what they said it was: they want to look at the source code to see if there's some way to crack the encryption faster than they otherwise could - for example, some bug causing key generation to be somewhat predictable.

Re:The NSA called me after midnight and requested my source ... by iancarroll on Tuesday April 21, 2020 @07:27PM (#22940397)
Just to be clear, no web browser has ever (AFAIK) allowed a navigation for https:// to downgrade to http://. It's only when the protocol is not explicit (i.e. typing only "domain.com") do problems really arise.
Re:The NSA called me after midnight and requested my source ... by meowface on Tuesday April 21, 2020 @11:17PM (#22941723)
They may have meant finding a link to it elsewhere from a plaintext site, in which case they could sslstrip it. (Before more modern safeguards, at least.)
Re:The NSA called me after midnight and requested my source ... by Libeste on Tuesday April 21, 2020 @06:22PM (#22939969)
>For one, how could they expect to distribute it in a way that a bad guy was more likely to download than by going to the official site?

The original is both pay to own and not available outside of the US. So changing either of those things would work.

Re:The NSA called me after midnight and requested my source ... by meowface on Tuesday April 21, 2020 @11:18PM (#22941732)
I suppose, but the actual process of hosting or sharing it seems a little convoluted. And, again, they could do all this without the source code, if their goal was simply to subtly backdoor it.
Re:The NSA called me after midnight and requested my source ... by ballenf on Wednesday April 22, 2020 @09:11AM (#22945143)
You put the "cracked" version on torrent sites today. Back then there were just as well known distribution sites.

You have to think that intelligence agencies have people inside hacking groups, giving backdoored hacked products a sheen of legitimacy.

Re:The NSA called me after midnight and requested my source ... by dx034 on Friday April 24, 2020 @02:29AM (#22965241)
That happened in 2000, I doubt the page was served via https. MITM shouldn't be too hard then.