[liberationtech] Recommended Software for Encrypted Blackberry Voice Calls

[Jim Youll]

On Jan 25, 2011, at 10:18 AM, Chris Palmer wrote:

> My point in this email is not to nay-say, but to caution. It's important for everyone to understand just how hard these problems are. If they were easy, they would have been solved more cheaply; Blackberry (and, hopefully someday, Three Laws of Mobility) is expensive for a reason.


To that point, I'm cross-posting a comment that just moved on the Cryptography mailing lists, because it frames more of that technological subtlety that is often missed when hopeful people try to subvert "policy," unaware that the machines with which they would do so are themselves pre-subverted by manufacturers and governments.

To wit (and writing in a hurry, so I may have made an error): 
The government of Tunisia has a root, code-signing certificate, silently installed by Microsoft and not always visible in Windows, that would allow it to make an https certificate for any end entity, as well as push executable code to any machine and run it.

Keep this and other examples (those already seen, those you will see in the coming year, and those you can imagine) in mind when designing or deploying anything that's "apparently secure" at the application layer.


> Date: Wed, 26 Jan 2011 09:42:44 -0600
> From: Marsh Ray <marsh at extendedsubset.com>
> To: Crypto discussion list <cryptography at randombit.net>
> Subject: Re: [cryptography] A REALLY BIG MITM
> Message-ID: <4D4040F4.8090706 at extendedsubset.com>
> 
> On 01/25/2011 09:50 PM, Peter Gutmann wrote:
>> This isn't one of those namby-pamby one-site phishing MITMs, this is a MITM of
>> an entire country:
>> 
>> http://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/
>> 
>> For those who don't want to read the whole thing, the solution was "duuhh, we
>> turned on thuh SSL" - they were using plain HTTP for logon.  Sigh.
> 
> Of course, Microsoft helpfully provides the government of Tunisia with a 
> trusted root CA in their products. If you have access to a Windows box, 
> visit https://www.certification.tn/ . Then look for "Agence Nationale de 
> Certification Electronique" in your personal trusted root store.
> 
> For some reason, MS Windows doesn't list everyone it trusts until they 
> actually need trusting. Then root certs get installed on the fly.
> 
> Oh and it's a code signing cert. This is used for things like running 
> ActiveX controls without prompting. I.e., arbitrary code execution.
> 
> - Marsh