343
This doesnt add up... If the software was properly encrypted they shouldn't have been able to carry out a man in the middle attack right?
Sounds like the encryption is automatically turned off if someone calls in via phone. So technically e2e encryption is supported, but it's a shit design just waiting for someone to accidentally misuse it.
load more comments
(1 replies)
It they used the client, yes. But in you dial in via sip, that opens up so many ways to screw up. Old software, open wifi, legacy hardware, you name it.
yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says "certificate error" and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.
If you're looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country's intelligence services already in there.
But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.
More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.
load more comments
(5 replies)
It's always one of two possibilities: shit software or idiot users
In this case shit software. For a secure conference software there should be no possibility for the user to accept invalid certificates.
The developer always has to plan with what we call a DAU in germany (Dümmster anzunehmender User = dumbest user possible), and even that user should have no possibility to accidentally share a secure conference. So as a developer I would: Lock the user to certificates and encryption keys I deem secure and hook into the low level OS functions to grab the screen and disable them to prevent accidental sharing via software like Anydesk and the like which the user forgot to close. This would even interrupt the functions of a simple trojan on the PC.
Of course a dedicated attacker with physical or admin access to the device could always break these. But then you have another big security breach.
Why not both?
Yes, it’s not the 90s anymore. The network is hostile. If it’s not, nice but you’d be a fool to trust even your own. Encryption all the way!
"I think that's a good lesson for everybody: never use hotel internet if you want to do a secure call," Germany's ambassador to the UK, Miguel Berger, told the BBC this week.
…
The exact mode of dial-in is "still being clarified", Germany has said.
OK, well the exact mode kinda fucking matters before you just scapegoat a hotel.
This smells like a coverup.
load more comments
(1 replies)
End to end encryption
USE IT
In a world where I can deploy end to end encrypted comms servers to an old computer in my house, the fucking military of any country should, at a minimum, require encryption to join meetings where military strategy is being discussed.
load more comments
(2 replies)
They can discuss missile targets but they don't know how to set a secure comm channel, it makes me wonder... how old were they? why don't they give a device with pre-installed VPN (incl. Killswitch) to all certain-rank officials and get done with this?...
They do. Its much more than a built in vpn, they also have specialized, hardened versions of communications apps on them. The weakest link in cybersecurity is usually the end user.
Not sure what their age has to do with it
I think one issue is for high officials that outrank everyone, they can get away with getting an insecure device because they prefer an iPhone over the custom hardened phone on Android 10 locked down for secure reasons.
an especially secure, certified version
Bwahahahahahhahahahhahahhaa
This is what happens without E2EE.
This happened because of an unintended backdoor into an end to end encrypted conversation.
The British Government are actively trying to get back doors put into end to end encryption by law.
They are doing this so they can spy on their own citizens to ostensibly make Britain safer.
But as you can see, it actually would make it less safe.
What an amazing feat of incompetence! They’d be better off just using Signal…
They’d be quantum proof as well 😅 https://signal.org/blog/pqxdh/
load more comments
(2 replies)
How is it possible to accomplish a man in the middle attack on a TLS secure connection ? Hotel wifi or not, unless something major like Singaporean gov interfered with the connection, forced forged certificates into his phone, I don't see how this was put off by compromising the connection .
I bet they are covering for the Fact that one of them has downloaded malware into his device to masturbate to a hot girl living next to him kinda ad. and then malware shared back that data to Russia. or they have a spy among them and Germany isn't ready to admit having its defense forces compromised with Russian assets.
The easiest explanation is the room was bugged and the general stayed there.
Everyone forgets the old school stuff. It doesn't matter how well your connection is encrypted if the GRU has the room next to you.
they were using an insecure method to connect with webex, so something like a dial-in number for using it without a computer i guess. that is probably not encrypted. the meeting could have been a fax anyway
load more comments
(3 replies)
load more comments
(2 replies)
It is fine if you use unprotected wifi and then connect to a VPN.
You don't even need a VPN if the software uses proper TLS encryption or equivalent
TLS downgrade attacks are a thing, and can enable MITM attacks. There are server-side mitigations (such as only allowing TLS 1.2+ which should be the case but often isn't because the server has to support a niche user or application that only supports TLS 1.1), and since you usually don't know which TLS version you are using, for very sensitive connections it should be assumed that TLS is not enough.
Don't even get me started on the non-security of standard mobile/landline calls. They're basically transparent for an attacker with means like Russia's.
Proper E2E encryption and/or a VPN should be mandatory for a call to be considered secure, period.
If WebEx is susceptible to MITM attacks, it shouldn't be used for sensitive calls. It's better to use a VPN, but something like this should not happen at all, even without VPNs.
load more comments
(1 replies)
load more comments
(1 replies)
These VPN ad campaigns are incredibly detrimental to people's understanding of security mechanisms in the internet.
How would this not have helped out in this case? I imagine the Bundeswehr must have an organization-wide VPN which would render any MITM in a local Wifi network impossible, barring user error.
load more comments
(1 replies)
I don't see how it matters if you use hotel WiFi or mobile if the mobile mast you connect to is controlled by a hostile government.
What matters is what you were sending wasn't secured at source.
Although Wikipedia tells you the range and I'm pretty sure even Russia have access to maps and a compass.
Isn't like very basic security advice to not use random connections for sensitive information? But than again it's Germany, pretty sure he has his password written down on a sticky note.
günther2
EvE Online should be mandatory training for anyone with a security clearance. Minimum of six months in Goonswarm, Pandemic Horde, Fraternity, or The Initiative.
https://cad-comic.com/comic/one-of-us/
That's only a slight exaggeration. I had a "chat" with one of our intel officers at one point due to a IRL purchase of PLEX.
Edit: maybe just Goonswarm. They do the intelligence and spy stuff the best.
This is the best summary I could come up with:
He sounds relaxed on the line as he chats with two colleagues about the "mega" view from his room, and how he's just come back from a drink at a nearby hotel where there's an incredible swimming pool.
Over the next 40 minutes, the group appear to touch upon highly sensitive military issues, including the ongoing debate over whether Germany should send Taurus cruise missiles to Ukraine.
The four participants discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv - a contentious issue in Germany.
"You have to choose a certain kind of disguise for this disaster," says Mr Kiesewetter, who's also worked at the Nato military alliance and is a member of Germany's opposition conservative CDU party.
But German government figures find suggestions that they are somehow soft on Russia increasingly irritating, particularly because Berlin has donated more weapons aid to Ukraine than any other nation in Europe.
It's further exposed domestic divisions about whether to send Taurus missiles to Ukraine and prompted a wider discussion about the country's perceived defence and security weaknesses.
The original article contains 1,075 words, the summary contains 187 words. Saved 83%. I'm a bot and I'm open source!
Bad article
view more: next ›
this post was submitted on 08 Mar 2024
343 points (100.0% liked)
Europe
8332 readers
1 users here now
News/Interesting Stories/Beautiful Pictures from Europe 🇪🇺
(Current banner: Thunder mountain, Germany, 🇩🇪 ) Feel free to post submissions for banner pictures
Rules
(This list is obviously incomplete, but it will get expanded when necessary)
- Be nice to each other (e.g. No direct insults against each other);
- No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
- No posts linking to mis-information funded by foreign states or billionaires.
Also check out !yurop@lemm.ee
founded 1 year ago
MODERATORS