this post was submitted on 08 Mar 2024
333 points (97.4% liked)

Europe

8324 readers
1 users here now

News/Interesting Stories/Beautiful Pictures from Europe 🇪🇺

(Current banner: Thunder mountain, Germany, 🇩🇪 ) Feel free to post submissions for banner pictures

Rules

(This list is obviously incomplete, but it will get expanded when necessary)

  1. Be nice to each other (e.g. No direct insults against each other);
  2. No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
  3. No posts linking to mis-information funded by foreign states or billionaires.

Also check out [email protected]

founded 1 year ago
MODERATORS
 

Four German military officials discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv, and the call had been intercepted by Russian intelligence.

According to German authorities, the "data leak" was down to just one participant dialling in on an insecure line, either via his mobile or the hotel wi-fi.

The exact mode of dial-in is "still being clarified", Germany has said.

"I think that's a good lesson for everybody: never use hotel internet if you want to do a secure call," Germany's ambassador to the UK, Miguel Berger, told the BBC this week. Some may feel the advice came a little too late.

Eyebrows were raised when it emerged the call happened on the widely-used WebEx platform - but Berlin has insisted the officials used an especially secure, certified version.

Professor Alan Woodward from the Surrey Centre for Cyber Security says that WebEx does provide end-to-end encryption "if you use the app itself".

But using a landline or open hotel wi-fi could mean security was no longer guaranteed - and Russian spies, it's now supposed, were ready to pounce.

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 138 points 8 months ago* (last edited 8 months ago) (5 children)

This doesnt add up... If the software was properly encrypted they shouldn't have been able to carry out a man in the middle attack right?

[–] [email protected] 87 points 8 months ago (3 children)

Maybe he dialed in by telephone? It would be a complete boomer move, but I’ve seen people do it.

[–] [email protected] 85 points 8 months ago (1 children)

A researcher in cryptography in Berlin, Henning Seidler, believes the most likely theory is that the officer dialled in via his mobile phone and the call was picked up by spies' antenna who can also "forward" the traffic onto the main, official antenna.

Seems like the more likely theory

[–] [email protected] 10 points 8 months ago* (last edited 8 months ago) (3 children)

That is an expensive way to lose your job!

[–] [email protected] 41 points 8 months ago (1 children)

"Intelligence" services cost taxpayers billions a year, so the billion dollar question is why is it possible to dial in to "official" military communications over insecure channels at all?

Why doesn't the government run their own signal or matrix infra? Why are they paying Cisco, and introducing the numerous attack vectors of a proprietary optionally-encrypted service?

The threat of surveillance capitalism isn't just in the dragnet surveillance of the population. It's in the profiteering of "partnerships" between private and public — the drive of corrupt and incompetent political and military leadership to direct funds to sub-optimal proprietary services and protocols, instead of leveraging public funding to contribute to open-source and make hardened systems ubiquitous.

[–] [email protected] 25 points 8 months ago (2 children)

The funny thing is, that the Bundeswehr actually has a communications platform based on Matrix: bwMessenger goes live for Bundeswehr, element.io

Why they're not using it? Who knows...

[–] [email protected] 9 points 8 months ago

That's what I'm getting at. This ultimately isn't the fault of some technobozo who dialled in from hotel wifi. If the system were fit for purpose, technobozo could dial in over any network.

The is the fault of German politicians, military, and "intelligence". This type of compromise should not exist as a matter of circumstance. It should only be possible when an end users device is directly compromised.

[–] [email protected] 2 points 8 months ago

Probably the client runs poorly on the cutting edge Nokia 3310s those generals use

[–] [email protected] 2 points 8 months ago (1 children)

We are talking about the person/department that has ensured that they run an especially secure, certified, version of webex losing their job right?

As much as I'd like to think that senior military people have some basic awareness about security, this is really a tool that was considered secure by the organisation. Sounds like a big gaping whole letting dialin enabled for anyone to use.

[–] [email protected] 2 points 8 months ago

Not even. A Pringles can and some wire.

[–] [email protected] 13 points 8 months ago

Yes, it is a boomer move. But don't let Cisco off the hook. What kind of specially certified security feature is that, if it can be turned off so easily by accident.

[–] [email protected] 2 points 8 months ago

He most likely did, at least from what I can deduce from the published recording.

[–] [email protected] 38 points 8 months ago* (last edited 8 months ago) (1 children)

Sounds like the encryption is automatically turned off if someone calls in via phone. So technically e2e encryption is supported, but it's a shit design just waiting for someone to accidentally misuse it.

[–] [email protected] 3 points 8 months ago* (last edited 8 months ago)

It sounds like this especially secure, certified, version of webex should probably not allow dial in via phone should it?

[–] [email protected] 10 points 8 months ago

It they used the client, yes. But in you dial in via sip, that opens up so many ways to screw up. Old software, open wifi, legacy hardware, you name it.

[–] lurch 8 points 8 months ago (2 children)

yes, one side has to automatically or manually accept a fake certificate/key to MITM end to end encryption. you know, like when your browser says "certificate error" and you click on advanced->accept anyway or something like that. if the software always accepts or he manually accepted one, the MITM guy can substitute his own encryption key/cert and decrypt and re-encrypt on the fly.

[–] [email protected] 11 points 8 months ago* (last edited 8 months ago) (1 children)

If you're looking at who is allowed to issue trusted root certificates in common browsers and operating systems, nobody needs to accept nothing to have every possible man in the middle from every major country's intelligence services already in there.

[–] [email protected] 5 points 8 months ago (1 children)

But that also depends on the issuer that WebEx used. If this really was a MITM without someone fucking up and bypassing a warning, whoever the root CA is issuing for WebEx can no longer be trusted.

More likely they dialed in via mobile rather than use “Computer Audio” and that is easily defeated using a Stingray-type device.

[–] [email protected] 3 points 8 months ago (1 children)

Yes, in that case, it most likely was using an insecure channel to directly dial into the conference. Still, the entire certificate infrastructure is mere security theater, unless you're actually going through the trouble of checking every individual certificate yourself.

[–] [email protected] 3 points 8 months ago (1 children)

That’s the open secret of the Web, all security on it is just fake. The list of root certificates is way too long to provide any security.

[–] brbposting 1 points 8 months ago (2 children)

Think it’s likely to impact people with regular threat models?

Any obvious solutions?

[–] [email protected] 2 points 8 months ago

Public WiFi is the main problem, anybody connected to the same WiFi could potentially intercept all of your Web traffic. You could use a VPN to avoid that one.

[–] [email protected] 2 points 8 months ago

Certificate transparency, pinning, etc

[–] [email protected] 10 points 8 months ago (2 children)

It's always one of two possibilities: shit software or idiot users

[–] [email protected] 9 points 8 months ago* (last edited 8 months ago)

In this case shit software. For a secure conference software there should be no possibility for the user to accept invalid certificates.

The developer always has to plan with what we call a DAU in germany (Dümmster anzunehmender User = dumbest user possible), and even that user should have no possibility to accidentally share a secure conference. So as a developer I would: Lock the user to certificates and encryption keys I deem secure and hook into the low level OS functions to grab the screen and disable them to prevent accidental sharing via software like Anydesk and the like which the user forgot to close. This would even interrupt the functions of a simple trojan on the PC.

Of course a dedicated attacker with physical or admin access to the device could always break these. But then you have another big security breach.

[–] [email protected] 7 points 8 months ago
[–] [email protected] 5 points 8 months ago

Yes, it’s not the 90s anymore. The network is hostile. If it’s not, nice but you’d be a fool to trust even your own. Encryption all the way!