I am under surveillance by Canadian agents, my computer has been backdoored

http://log.nadim.cc/?p=110

by joshfraser • 13 years ago

701 337 13 years ago

log.nadim.cc

0x0• 13 years ago

Would be interesting to hear more details about which software he's using (OS, "Secure File Transfer desktop client", firewall).

Also, it would be interesting to see what one could find on a raw disk image clone (hidden files? rootkits?).

magikarp12• 13 years ago

Hello, I'm the person who wrote the blog post.

I am using Transmit for Mac OS X, by Panic Software, version 4.2.

benmmurphy• 13 years ago

transmit can be scripted so it could be anything running on the machine that is backdoored.

i assume they had connection for sending commands that was separate because the sftp sounds like it was blocked but the uploading stopped apparently in response to external stimuli. seems kind of lame to have some kind of connection sending commands and then using transmit to upload files.

pudquick2• 13 years ago

Unless you had logs in Transmit indicating it was used, I would recommend not saying they used Transmit to do it - considering OS X has a builtin command-line sftp client:

http://developer.apple.com/library/mac/documentation/Darwin/...

If you're still concerned your machine is affected, I'd recommend getting Little Snitch - which automatically blocks connections (both in-bound and out-bound) that are not pre-approved. In addition, when it auto-blocks it records the application that was making the connection attempt in the auto-block rule.

(Well, actually I'd suggest you dd a backup of the drive to analyze - then wipe and start anew.)

If they hired anyone of any worth, the person installed a timed launchd (or cron) controlled script to run rarely and at odd hours to upload content from your machine to those remote locations. This kind of setup a.) would use a command-line tool for the upload and b.) unless they knew you had Transmit it would be designed around executables already included in OS X or that they installed.

Unfortunately, if it has stopped, they've probably deleted the scripts and cleaned up the evidence. If you've got Time Machine running, however, you may have backed up some of their handiwork.

weslly2• 13 years ago

Which firewall are you using? The one builtin on OSX?

w-ll• 13 years ago

How did they get access to your hardware? No disk encryption?

Might be crazy, but when I travel I setup a webcam in my office to upload to a vps and then ustream 24/7. Highest quality (don't care about bw since nobodies home.)

epoxyhockey• 13 years ago

The post does say Ever since my return from NYC as when the activity has been encountered. Since I'm guessing that he didn't have his external firewall with him on travel, the access could have taken place in an airport or anytime in the US.

It would be interesting to hear if/when he didn't have direct control of his laptop while on travel.

KMag• 13 years ago

I doubt he brought his desktop with him to NYC. It's the desktop that's acting suspiciously.

magikarp12• 13 years ago

Hello, I left for NYC for five days. Since I develop sensitive cryptography software, I do not store anything sensitive on my desktop, only on my laptop, which is kept with me at all times (even when going on dates and such.) It was my desktop that exhibited this behaviour after my 5 day trip to NYC. Stupidly, I left it on the whole time. I do use full disk encryption.

HardCode• 13 years ago

Do you backup the information stored on the laptop? Are you worried about being "mugged"?

danso• 13 years ago

This is an interesting mindset...I'm inclined to do the inverse, because of how easy it is for someone to steal a laptop.

While yes, a desktop can be breached (as it apparently was in this case), there's more surveillance options you have with which to secure its surroundings. And agents would have to get a warrant anyway.

If you're worried about the prospect of them warantlessly breaking in...I guess that the more likely danger is that if they are willing to resort to that, they are also willing to stage a robbery in which someone punches you in the face and makes off with the laptop. Or hire someone to spike your drink during a date.

tedunangst3• 13 years ago

What's the desktop's uptime?

bconway• 13 years ago

You're paranoid, man. Take a deep breath. See a doctor if you can.

toyg• 13 years ago

HN is a public forum. You really shouldn't post this sort of info here (unless you're trying to actively mislead whoever is targeting you).

As somebody else said: take a deep breath, take over 9000 backups, and start reducing your attack surface without falling to complete paranoia.

kawsper• 13 years ago

You could use something like Motion ( http://www.lavrsen.dk/foswiki/bin/view/Motion/WebHome ) it only records when there is activity.

bahman20002• 13 years ago

I'm pretty sure that no legitimate covert service operative would identify themselves as such, nor would they brag about going to conferences.

cperciva2• 13 years ago

Working for CSIS doesn't mean that you're a covert operative. I know plenty of present and past employees of CSIS, CSEC, CIA, NSA, GCHQ, etc -- my understanding is that the general rule is "don't call attention to your affiliation, but it's ok to say if evading questions would draw even more attention to you".

conformal7• 13 years ago

this whole account sounds patently ridiculous considering the nature of cryptocat.

i would like to think that "CSIS" had better things to do.

dylangs10304• 13 years ago

I'd like to know more information.

As it's written this seems to be a very confused article to me. What exactly is the author's point in writing this? And what is his next step moving forward?

What operating system does he use, what software under that operating system (specifically the FTP client), does he have a secure firewall, etc. etc.

magikarp12• 13 years ago

Mac OS X, Transmit by Panic Software (v. 4.2) — I blogged this in order to protect myself.

dylangs10304• 13 years ago

Wow, thanks for the fast reply!

Can you tell me what your next steps in proceeding are, or would this violate the protection you're attempting to set up?

bahman20002• 13 years ago

Very curious to look at your logs. Pastebin?

kybernetyk• 13 years ago

Why do you use Transmit? Panic's software is known (amongst people who do reverse engineering) for having many holes.

If you're doing really security sensitive work don't run questionable software which you don't have the source code for.

samwillis2• 13 years ago

And now his server is down?

thejosh• 13 years ago

Nothing to do with traffic, must be the agents trying to silence the truth.

johnpowell• 13 years ago

Or that it is Wordpress.

samwillis2• 13 years ago

Definitely isn't anything to do with the thousands of geeks who like conspiracy theories pounding his server on a Saturday evening?!...

eksith• 13 years ago

No, this seems like overload. To be fair, HN isn't exactly gentle on WordPress sites to begin with, especially if they're not aggressively being cached.

xorpsxmm0• 13 years ago

https://gist.github.com/anonymous/918900079de99e4e5c1f

magikarp12• 13 years ago

Thank you, I'm using this to restore my server.

jacquesm4• 13 years ago

http://en.wikipedia.org/wiki/Nadim_Kobeissi

charlieok3• 13 years ago

Curious how he knew Sabu in the first place

drucken3• 13 years ago

They are both high profile (for activists/hackers). Public twitter accounts, etc.

praptak• 13 years ago

Wiki: "In 2012, the FBI attempted to entrap Kobeissi using Sabu"

http://log.nadim.cc/?p=65

http://bits.blogs.nytimes.com/2012/03/12/a-hacker-charms-and...

Fuckers. (sorry, I couldn't resist)

frendiversity8• 13 years ago

What a wonderful creature that young man is. Eyes of the hero.

SODaniel• 13 years ago

"Whats that abeut? Are they not your friends buddy?"

Geekette• 13 years ago

Is the OP sure those were CSIS peeps? Just wondering based on how they bumbled through their attempts at making contact. Thought intelligence agents would be slicker than that.

fnordfnordfnord2• 13 years ago

Maybe this is the new guy, and it's his first assignment. Maybe it's not CSIS, but some other interested party. Seriously though, they're gov't employees, the hiring process does not guarantee the highest quality in every case.

alan_cx2• 13 years ago

Fair point, until the bit where his PC is trying to send information to the CSIS.

randomchars6• 13 years ago

Actually they're not agents, but officers. IIRC the agents are the informants who are not working for the agency.

gnu82• 13 years ago

This guy should widely distribute the SFTP creds being used by the backdoor agent on his computer. Then we could all be helpful by uploading useful data to the Canadian government's spy server.

polymatter5• 13 years ago

While an amusing suggestion, I sincerely hope everyone realises that such a move would be ... incompatible with a long and healthy lifestyle. Both for Nadim and anyone foolish enough to do so.

gnu82• 13 years ago

On the other hand, anyone who has reason to believe there might be information critical to their investigation embedded in the full version of Two Girls One Cup, it is their civic duty to submit that video to the authorities.

jacquesm4• 13 years ago

Why?

Are you suggesting the CSIS kill people? Who are going to be missed because they have said they are under surveilance? Or even abroad?

burke• 13 years ago

CSIS is not nearly as eager to unjustly violate personal freedoms out of spite as its American counterparts seem to be.

tluyben2• 13 years ago

I have asked before, but why would you want to live in countries where this train of thought is a possible reality? Although chances are not great 'it will happen to you', anything over 0% is far too great for my taste.

dfc3• 13 years ago

If he was backdoored by a 3/4-letter and he is not skilled[1] in malware analysis how likey do you think it is that he will recover the credentials? Do you think it is as easy as:

  $ ls -l ~/.ssh
  total 80
  -rw-------+   1 nadim  staff   737 Aug 22 01:39 authorized_keys
  -rw-------+   1 nadim  staff    35 Jan  5 21:32 config 
  -rw-------+   1 nadim  staff  3243 Aug 18 10:57 id_rsa
  -rw-------+   1 nadim  staff   735 Aug 18 10:57 id_rsa.pub
  -rw-------+   1 nadim  staff  3326 Feb  2 21:41 id_rsa_CSIS
  -rw-------+   1 nadim  staff   749 Feb  2 21:41 id_rsa_CSIS.pub
  -rw-------+   1 nadim  staff  3198 Feb  2 21:46 known_hosts

[1] I have no reason to think he does or does not posses this skill. I only mention it in the negative because it was not in his wikipedia bio.

adamnemecek2• 13 years ago

I'm somewhat surprised that the cryptocat project has been ruffling so many feathers (assuming that the story is in fact what it appears to be).

conformal7• 13 years ago

i know the author (nadim) is in here and this is all a bit fantastic. cryptocat is one of many crypto snake-oil products that i would never consider using for any kind of secure communication.

using defective crypto products is much riskier than not using any crypto at all and exercising caution. cryptocat has always seemed a poorly disguised honeypot to me.

JshWright2• 13 years ago

I think a statement like that needs a little more in the way of support.

Cryptocat has been fairly well reviewed by a number of fairly smart people. While flaws have certainly been found, they've mostly been addressed, AFAIK.

"Snake oil" has been a popular term to throw around ever since the original PGP user's guide, but simply labeling something "snake oil" without any actual proof is a dangerous thing to do (especially when it's an open source product, and you should be able to point to any defects specifically).

Edit: I realize the term 'snake oil' predates PGP, I was referring to the crypto community's penchant for it.

frendiversity8• 13 years ago

The fact that he's young, brilliant, and identifies as a hacktivist make it more feasible. He's a future threat.

magikarp12• 13 years ago

It would be nice if you could meet me for coffee and say this to my face, friend.

I am trying to protect myself and my open source project, which, by the way, has been audited countless times and has progressed greatly towards security. If you have a problem with me, then call me up and discuss it instead of stressing me out even more when I just discovered that the government is building a case against me.

If you don't like my work, file a bug report. Check out our documentation. Review our OTR implementation. Submit a pull request. Hack some code. Just don't say hurtful and untrue things like that in public. You can do better.

mcantelon9• 13 years ago

>i know the author (nadim) is in here and this is all a bit fantastic.

What aspect seems "fantastic" to you? Have you yourself been involved in activism?

betterunix3• 13 years ago

Snake-oil? I am not sure I would go that far. I am somewhat concerned about crypto that runs in-browser after the Hushmail debacle, but the term "snake-oil" is usually reserved for cryptosystems that follow proprietary designs or "roll your own crypto," and cryptocat does not seem to fall into either category.

marshray• 13 years ago

I have spent a fair bit of time discussing Cryptocat with Nadim in person. He is sincere in his development goals for Cryptocat and does not intend for it to be a honeypot.

drawkbox• 13 years ago

Phil Zimmerman (PGP) knows a thing or two about what happens when you make cryptography/encryption that is not easily known/keyed/trapdoored for national security agencies.

http://en.wikipedia.org/wiki/Phil_Zimmermann

jhprks• 13 years ago

Well probably because you did something wrong. Turn yourself in and reflect on your wrongdoings. Put yourself together and stop causing harm to the society.

frendiversity8• 13 years ago

This is a good joke.

mrbarrett84• 13 years ago

What does that even mean?

InclinedPlane• 13 years ago

Haha, it's his fault for living in Canada! Canada sucks, move to Japan!

frendiversity8• 13 years ago

This is also a good joke.

gamblor956• 13 years ago

In other news, Canada's internal security agency is using "PG" to entrap people...(read the article for context)

I guess they read HN too.

clicks• 13 years ago

This PG approached him with a "business opportunity" -- so the Canadian security folk probably did mean to confuse him into thinking that this PG is our HN pg.

JshWright2• 13 years ago

s/Canadian security folk/unknown party/

redthrowaway5• 13 years ago

They really should have tried harder. For some reason, I really can't picture pg in a black suit.

stbullard• 13 years ago

Google cache: http://webcache.googleusercontent.com/search?q=cache:http://...

friendly_chap2• 13 years ago

If this is true - we live in a scary world. If not, the guy has talent in marketing.

randomchars6• 13 years ago

We live in a scary world either way.

friendly_chap2• 13 years ago

Haha! You are so right (unfortunately).

kjackson2012• 13 years ago

It seems ridiculous that an "intelligence" organization would upload files to a server that identified themselves so blatantly like that. Could it be that it is some ruse of some sort? I don't doubt that someone broke in, but would it really be CSIS?

mcantelon9• 13 years ago

CSIS aren't the most competent intelligence organization in the world.

corresation4• 13 years ago

For the limited scope of the work that they do (which is essentially limited to what the NSA does in the US. They don't really do what the CIA does), and with a relatively small $600 million dollar public budget, they're known to be quite competent.

This story sounds...weird. I doubt it is quite as he suspects it is.

lostlogin3• 13 years ago

Which one is? I put the Mosad up there, but most are summed up by the statement: Reward for failure. Screw up, get given a bigger budget so it doesn't happen again.

phnk• 13 years ago

Even high-profile organizations have a spectrum of competence within their offices.

kfury• 13 years ago

An actual exploit like this designed to monitor the hacked computer would likely either talk to a small range of IPs in the infiltrating organization, or a widely scattered botnet.

Trying to contact a small variety of servers of various disparate government agencies seems more like an attempt to generate false evidence that the victim is actually a dangerous hacker.

Or at least that's what Stephenson, Doctorow, and Gibson have trained me to think.

chiph• 13 years ago

I was thinking it was a false-flag scenario as well. Other than the network identifiers, there's nothing to say it was the Canadians behind it.

perlgeek• 13 years ago

Don't assume they act intelligently, just because they have "intelligence" in the name. Many people who make the decisions aren't IT experts at all.

unclefucker• 13 years ago

Hackernews captivated by a schizophenic...

frendiversity8• 13 years ago

Correction: Lightly schizoid/paranoid may suspect hidden cameras in implausible situations. Schizophrenic screams at cars.

In this case, it's plausible enough suspicion, let's give him the benefit of the doubt, eh?

kdazzle2• 13 years ago

There are a few types of schizophrenia - paranoid schizophrenia being one of them.

spiritplumber• 13 years ago

That'd have been an awesome trolling opportunity.

brownbat• 13 years ago

Contact a lawyer immediately.

There are many actions you could take to mess with the investigation that might seem like fair game, but you should discuss each one with an attorney so you don't provide some arcane justification for them to arrest you (by hacking back, or even maybe "interfering with an investigation").

Once you get past that stage, the attorney can help you petition to stop the behavior or demand more information about it.

Legal advice is what you need now, not tech advice.

(Because the server is crushed, I'm only getting the basic gist - forgive me if you've already done this.)

magikarp12• 13 years ago

If anyone knows a good lawyer in Montreal, please let me know!

nadim@nadim.cc

dfc3• 13 years ago

Get in touch with the EFF:

https://www.eff.org/pages/legal-assistance

dmix3• 13 years ago

I would also contact someone familiar with forensic analysis of malware, so you have lots of data about the monitoring that was conducted.

xutopia• 13 years ago

I'm not a lawyer nor do I know any who can deal with this kind of thing. However I do know that in Canada CSIS will not spy on citizens unless they have a warrant for it. So getting a lawyer is a great idea at this point. If the government is spying on you they have reasons to believe you are tied to someone who might pull you indadvertedly into something illegal.

strlen3• 13 years ago

The only relevant piece of advice here. This is, after all, Canada: if it is indeed CSIS who setup backdoor the OP's computer, there is a paper trail. Lawyers know how to obtain this paper trail. I don't know Canadian law, but the worst I could possibly think of in any of US/UK/AU jurisdiction is that the paper trail says "confidential, pending investigation".

I should add that while the malware in question may indeed talking to CSIS servers, this could be the case the CSIS servers themselves are hacked -- more likely by an automated worm in service of spammers (and honestly this is what the 'PG' person sounds like to me -- a scammer/spammer) than any scary entity.

Regardless, this is a legal, not technical matter at this point. Get recommendations for a lawyer in your area (you could also try contacting the university staff for this -- they may well be required to help you find an attorney), talk to them. Avoid posting anything else to a public forum.

schappim• 13 years ago

Re: "Hacking Back"

I heard that Canadian sysops are the ones that apologise when you hack them. ;-)

zaidmo• 13 years ago

How about he contact CSIS directly, and clarify...?

muoncf• 13 years ago

"Hello, I'm sure this is all a big misunderstanding, but did you happen to root my computer?"

Not trying to be sarcastic, but I'm really curious what such an email could possibly achieve. If they tell you they haven't done anything, they're either lying or not - you wouldn't know. And really, what are the chances they would tell you that they have rooted your PC if they had?

unimpressive2• 13 years ago

  I have to wonder what you'd see
  If you used style as ID.

  Styles change from time to time
  But style stays from line to line.

  Names can change and faces too
  But writing tells you who is who.[0]

  Many say they are a crowd
  But fewer do once lost their shroud.

  Traps and snares one will find
  Many more if kept their wits about their mind

  Still plenty that you see
  Hide their face behind IP.

Just a thought.

[0] http://33bits.org/2012/02/20/is-writing-style-sufficient-to-...

[1]: EDIT: It seems to me that it is very possible that not all accounts here, though not necessarily in this thread, correspond to a single individual.

mintplant• 13 years ago

Could you... elaborate more on this, perhaps?

unimpressive2• 13 years ago

Sure. While I don't want to start a witch hunt, I often wonder while reading discussions who it is behind the handle. To the point where I can't help but think that a little careful observation might uncover an army of sockpuppets.

With the help of the HN api, you could probably fingerprint a lot of users.

dmix3• 13 years ago

If you need donations for any legal pursuits, set up a page accepting bitcoins or similar.

I'd totally support this.

Illegally monitoring a citizen has to about as bad as it gets in my books. Especially someone who has never done anything illegal and only received attention by building tools to help free speech/privacy.

glamrock3• 13 years ago

Illegally monitoring anyone, citizen or not, is excessive and supremely uncool.

memracom3• 13 years ago

Actually it is not excessive. It is legal for CSIS to monitor non-citizens and it is even legal for them to investigate citizens if they may be assisting foreigners that Canada disapproves of. I was interviewed by CSIS because I did some technical work on a server for a foreign-born Canadian who was suspected of being involved in white-power/neo-nazi orgs. The goal of CSIS was to find out if a certain prominent foreign white-power speaker might sneak into Canada. There was a well-known leaky spot in the US border not far from the town where this guy lived.

This Nadim fellow is a suspicious guy doing suspicious things who travels to terrorist hot-spots and to the USA, which is also suspicious. And I bet that CSIS is reading every word on HN right now. After all, where do you think that CSIS finds the hackers to set up the kind of hacks that Nadim has described? Same goes for CIA, NSA, FBI, DHS.

sanswork3• 13 years ago

I would wait for some proof before throwing this kid money.

Wintamute• 13 years ago

I don't know you and I don't know the world you live in, but just from your worried tone, and the rate at which you're responding to comments in this thread, I just want to say: take a breath. Engaging in a wild HN thread, full of well meaning but varied techy suggestions/speculation might not be the best approach right now. Have some friends sift through it for good information and disengage. Seek legal advice, and take it slow.

magikarp12• 13 years ago

Sorry. I am very stressed and am knocked into full self-defense/damage control mode. Not sure I am in a state to meet people IRL at the moment.

jacquesm4• 13 years ago

I think that you actually should meet someone IRL, have them stay over with you or stay over with them.

anigbrowl• 13 years ago

I strongly suggest you take a week off - don't expend valuable energyon trying to control the things that are stressing you. Check in and say hi to friends on Twitter (or suchlike) by all means, so that nobody has to worry about you, but don't put pressure on yourself to get to the bottom of this or resolve it within a certain timeframe. You haven't done anything wrong that I can see so there's no particular reason you should knock yourself out trying to untangle the situation.

Watch some movies, catch your regular classes (or skip a couple if you can), read that fat sci-fi novel - fill in the blank. FI anyone you don't know calls you on the phone just tell them you're not interested, goodbye, and take a rest from the internet. After a week, chat to a lawyer and work on the fact that someone is harrassing you - might be an intelligence service, might be criminals, but make it your lawyer's problem. The best thing for you right now is to recharge your batteries and that putting some distance between yourself and the source of your stress. The best way to deal with your computer being hacked is to leave it switched off; not least because your lawyer might advise handing it over to a forensic analyst for an audit.

But primarily, take it easy and be good to yourself. Nothing obliges you to wear yourself out responding to the behavior of others if it is making you stressed or unhappy.

coldtea5• 13 years ago

Isn't that what got Sandra Bullock's character in "The Net"?

Speak to a lawyer and/or some journalists.

csisagent• 13 years ago

We are watching. Everything.

conformal7• 13 years ago

lol. you must have seen me at the border, eh? ;)

gaius• 13 years ago

I'm just surprised you guys even exist - I thought "Canadian Agents" were something they'd just made up for Quantum of Solace.

herge• 13 years ago

Man, who could imagine such skullduggery in such a boring place as Conscordia's Reggies. Secret agents and illegal break ins oh my!

Although, I did have a palestinian friend swear that the Tim Horton's on Guy was a hotbead for the Jordanian security service.

mikebrock• 13 years ago

You should attempt to contact the Canadian Civil Liberties Association as soon as possible and protect the evidence on your laptop with your life.

triplesec• 13 years ago

Canada has secret agents?

krapp• 13 years ago

Of course they do, why wouldn't they?

lutusp• 13 years ago

> Canada has secret agents?

The fact that you don't know about them means ... the plan is working.

RockyMcNuts• 13 years ago

they're the politest.

excepting missions involving ice hockey, which bring forth a lust which can only be quenched by blood.

MacsHeadroom• 13 years ago

What country doesn't?

glamrock3• 13 years ago

What, no "C.I.Eh" comments yet? I'm... a little disappointed to be honest.

bdg2• 13 years ago

This isn't reddit.

mrb• 13 years ago

Magikarp, out of curiosity, why do you think the CSIS want to spy on you?

1) Because you are an anti-surveillance activist.

2) Because they want to eventually backdoor Crytocat in order to spy on the users.

3) Because the FBI asked CSIS to spy on you, and the FBI has their own motives.

oxide2• 13 years ago

all 3?

drucken3• 13 years ago

For a hacker site, why are so few people interested in seeing his logs?

I hope Nadim does a full write-up, including these, soon.

In the meantime, all the best and keep your (thankfully already) level head.

JesseObrien8• 13 years ago

They're caught up in the moment, I'm guessing. My first reaction was "where are the logs? show me some kind of actual proof". Otherwise this is just some kid who's paranoid and has a rootkit on his machine or something.

st3fan• 13 years ago

Since you have already published so much of this story. How about full disclosure and post the actual hostnames, firewall entries and that email you received?

govcrypto• 13 years ago

yet another cry for attention from this talented but misguided young man. First it was TSA and Homeland, now the Canadian CSIS -please! You yell and scream about silent circle, about Skype -you demean and disrespect other noted cryptographers when they get press....I work for the govt -your little Hello-Kitty plug in is akin to sugar koolaid. There are many senior experienced folks here that would make great mentors. Get a good mentor -but please stop with the high-school drama. its not reality. I am too old to placate this and someone needs to bring this young man under his wing. He has a future if he stops pining for attention.

bobzibub• 13 years ago

?The last thing society needs it his talent being co-opted. His software is a clever little tool and helps to strike a balance between overarching security organizations and the citizens they're supposed to protect. Sure it is not enterprise class but good enough is pretty damn good. I think you while he could learn from you tecnically, you could learn a lot from him as a citizen.

oijaf888• 13 years ago

Good enough isn't good in crypto when people are trusting it for secure communications. Also why what's the difference (functionally) between cryptocat and pidgin/adium with OTR turned on? In the latter case I believe you can even use gtalk securely.

asdlkfjgh• 13 years ago

Disconnect computer from network.

Try to dump RAM image.

Image the drive, sign and optionally encrypt the contents, preferably file-by-file checksum and copy to multiple secure locations. Copy of checksums in additional secure location.

Get out of your house with your computer as soon as possible (as soon as you upload one or two images). Do not leave the computer, they will try to destroy or confiscate the evidence. Plan to store computer in secure location, preferably with 24/7 video monitoring and a heavy duty safe. Preserving the evidence is probably that important.

Try to be in the company of someone you trust so they can act as a witness and can protect you from physical intimidation or attack.

Assume phones are compromised including GPS on your mobile phone. Assume you are under physical surveillance. Assume your car is compromised.

Relatives and close friends will be known to operatives. May be a good idea to spend 1-2 nights in a motel with a friend without anyone's cell phone paying cash until you secure copies of your data and get advice on what to do next.

borplk• 13 years ago

whatever you do make sure to document every single little detail, take photos, videos, audio recording, keep the emails, etc...

false_name• 13 years ago

I find the idea that Nadim is under surveillance to not be unrealistic. I don't believe he would be under surveillance for his programming. Whether for his associates is another thing.

I don't believe the people he alleges he spoke with are intelligence operatives. Whoever they are, they were almost surely messing with him (but could still be conventional employees of an intelligence agency.) Whether or not they're for real doesn't change my first paragraph though.

I'm not able to give any advice except this: As long as you're on this road, there is no one you can fully trust. No one at all. You haven't fully internalized this yet.

pg2• 13 years ago

"I’ll be wearing a black suit."

That should have been enough to make anyone suspicious.

west1737• 13 years ago

And the name PG... very sketchy

charlieok3• 13 years ago

I did wonder if this bit...

“On January 31st, 2013, a person identifying as PG sent me an email saying that he would wish to meet to discuss a business opportunity with me.”

...was intended to refer to you, or if the initials PG are just a coincidence.

You are in the “initials club” after all (rms, jwz, esr, djb) and have even shortened the usual three letters to two.

pg2• 13 years ago

Yeah, actually I think he probably meant "PG" and not PG. But by the time I realized that, someone had replied to me, and I don't like to delete comments with replies.

skrebbel• 13 years ago

Why? My friend PG (Pieter Geelen) wears a black suit all the time.

RivieraKid• 13 years ago

Does he work at CSIS by any chance?

lostlogin3• 13 years ago

Did he learn his trade from movies or so something? What if there are 2 people in black suits? Oh, covered, he will be the one with the shaken martini.

mtgx• 13 years ago

You mean just a like a hoodie?

bio4m• 13 years ago

Nothing wrong with black suits, in London theyre very common among business people. Not everyone has the luxury of wearing t-shirts and jeans to the office.

dreamfactory• 13 years ago

Black suits aren't supposed to be worn for business. They are for evening wear. They should only be worn in the day if you are a waiter, doorman, undertaker, American etc.

Mvandenbergh• 13 years ago

Not black though, that's not really done - certainly not in London.

X45• 13 years ago

Maybe the agent didn't have time to change clothes. Or the Agency can't afford colorful clothes :D

evolve2k• 13 years ago

What's the story with everyone calling each other 'friend' in this post? Is this some crypto community thing I'm not aware of or just coincidence?

jamiek88• 13 years ago

Canadians.

teeja2• 13 years ago

A cryo- community then.

wildmXranat• 13 years ago

I may or may not have any comments about your situation. Nevertheless, anyone responding to these comments needs to know that there is no guarantee that magikarp is actually Nadim himself, whether the account is compromised and so on. Catch 22 is in full mode in this thread and I would hope that this is not simply paranoia kicking in.

Hypothetically, what is the benefit of airing out of all this information ?

JesseObrien8• 13 years ago

Hypothetically, what is the benefit of airing out of all this information ?

Media attention. That seems to be all this kid has done is wave things at the media that the media themselves don't understand. Cryptocat is a javascript implementation of XMPP with OTR enabled. Snore... Hop on Google chat and click "Off the record" and you've done the same thing cryptocat does. Unlike google chat you have to load up yet another Chrome browser extension that will no doubt eat more memory.

The "anapnea" thing he was involved in looks like a joke as well. "Encrypted tunneling network"? You mean a VPS you give people SSH access to? Mind blowing.

Nothing to see here folks. Move along.

kam• 13 years ago

Google's "off the record" has nothing to do with the OTR protocol. It only instructs the server to stop archiving the conversation, and does not involve end-to-end crypto. Google still has access to the cleartext as it passes through their servers.

thirsteh6• 13 years ago

You're quite cocky for being so hilariously wrong. "Off the record" in GTalk makes it not log your conversation in your "Chats" folder. It has absolutely nothing to do whatsoever with encryption or deniability.

kefs• 13 years ago

In case you're curious about who exactly we're talking about.. check out this CSIS Recruiting Video, complete with ominous, heart-thumping, background music.

https://www.youtube.com/watch?v=dszXCHbvJYY

more: https://www.youtube.com/user/csisscrs/videos?view=0

orangethirty• 13 years ago

Slow down a bit there. Whatever is happening, you need to slow down. Don't make any quick decisions. I know you may feel under a lot of pressure. Best way is to talk to someone you know and trust. A family member or a very old friend. These people love you and want the best for you. Contact them, and explain what is happening. Then with their company, analyze the situation.

I want you to do this. Your current position may make it not so simple. But you must slow down and regain your composure.

Such situations are better dealt with people who love you.

Postpone any harsh decision until you have met with a loved one and have explained the items.

Remember that there is always a way to work things out. Dont lose hope. I want you to remember that things get better. They improve. You just need to slow down and reason a bit.

I'm not doubting your points. But I want you to go to a safe place where you can get some rest. Tomorrow you may be able to think about this with a better understanding. You are a smart person. You always figure out hard problems. You need to rest a bit before you can tackle it. Go and stay with a loved one. They will welcome you and listen to the items you are talking about.

I am orangethirty. Have been programming for a long time. I live in the Caribbean, and you can read more about me on my github (github.com/orangethirty). I'm only interested in your well being. We all want for you to regain your inner peace.

If you need anything, then let me know by posting here. If you feel comfortable emailing me, then do so.I am not pressuring you to do so. Do it if you feel like it.

I want you to remember that tomorrow is another day. Things improve. There is a way to solve every problem.

- orangethirty

SammyGuergachi• 13 years ago

Just looked at the update. "we have migrated Cryptocat's network into new servers inside a Swedish nuclear bunker" Holy Crap!

charlieok3• 13 years ago

Also love the photo of said bunker.

https://blog.crypto.cat/wp-content/uploads/2013/02/Port_sn_0...

mappu• 13 years ago

Upon visiting that blog.crypto.cat URL, Chrome tells me "Incorrect certificate for host / Error 150 (net::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN): The server's certificate appears to be a forgery."

The main crypto.cat page loads fine over HTTPS (certificate has sha1 thumbprint ‎d1aa1c1037202e359f224e407d7f84a0e8a94dd7 which i see is advertised on the erroring blog.crypto.cat page).

Why has the certificate changed? Why did the CA signing the SSL certificate change? Is there any forwarding message signed by the original certificate?

randomchars6• 13 years ago

en.wikipedia.com/wiki/Pionen

fareesh• 13 years ago

I am inclined to believe this is some sort of publicity stunt. This is based on the same amount of evidence that has been presented to the contrary :)

JesseObrien8• 13 years ago

Absolutely. Do a little more than surface level digging and this guy is really just a child playing with toys and announcing it loudly to the world.

unreal372• 13 years ago

Smart teenage coder turned activist... Reminds me of Aaron Swartz, surprised no one mentioned his name yet...

jscheel• 13 years ago

Honestly, I wasn't reading this very closely and started to wonder what in the world pg had to do with Canadian government agents.

HNC2• 13 years ago

Exactly the same. I had to re-read it and then I got that "PG" wasn't PG (Paul).

downandout• 13 years ago

The interesting part of this to me is that I'm curious how, exactly, a computer owned by an undisputed computer security expert was successfully backdoored. Presumably he isn't clicking on spear-phishing emails and the like. If they physically accessed the machine, e.g. they sent Jason Bourne in to bug his machine, he's probably headed for some trouble at some point. In general that kind of thing isn't done just for the purposes of poking around.

martinced• 13 years ago

I agree: I'd be formatting the machine and putting it on sale or eBay and then I'd buy a new machine. Nothing illegal here.

Now if he's in trouble simply because he works in the security field, this is a bit concerning. The lawyer advice is the sound one: fight legally the system and bring this to court if the attacker did anything illegal.

Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh!

But it still begs the question as to how his computer got owned in the first place.

coldtea5• 13 years ago

>Of course you have to laugh hard at the mediocrity of the second part of the "attack": directly contacting servers which can be reverse-looked up. Doh!

Is it mediocrity, or is it intended in order to send a message?

"We are on to you", etc?

PeterisP2• 13 years ago

Remote-ownage exploits do happen, and there is no reasonable defence against them until they are patched. And given the frequency of exploits being found in common user components such as browsers and content (flash/pdf) plugins, an usual well secured computer still is vulnerable to multiple exploits any day of the week.

Of course, he doesn't seem 'valuable' enough to spend a fresh 0-day on him alone as the government backdoors (Flame and friends) did with multiple 0-days included; but I'd guess that every large gov't has a standard rootkit and knows a few vulnerabilities not yet disclosed/patched - it's really not that hard/expensive to do, you can just spend a million and buy that stuff from private researchers.

kdazzle2• 13 years ago

Assange? McAfee? Is that you?

amasad• 13 years ago

This is the most trouble a browser plugin could ever cause anyone, and if all this is true then the Canadian government, the FBI and whomever else are after this kid are being very silly. That being said I can't help but think the author likes the media attention, and why wouldn't he, it must be bringing more exposure to his work.

heyitsrama• 13 years ago

I think it's more of the sense of the passion that he puts into his work, you should read the weblog.

guelo• 13 years ago

Straight into the Supreme Court? That is way better oversight over executive branch spying than in the US!

n3rdy2• 13 years ago

Is it possible that they may have used a type of hardware backdoor? Something that would be connected to the router, or back of the computer using the lan or usb port?

None of that would show up in any logs or files, and it would get around any password protection and encryption on the actual computer, the only evidence would be from monitoring router traffic. A usb bug would be something that would transmit via wifi, but it would need to be connected directly to your computer to work.

Also check inside the computer for anything unusual.

shocks• 13 years ago

Umm, backup and format you computer?

matdrewin• 13 years ago

Just curious how you are so certain that the servers were CSIS servers?

Pretty sure you would never be able to trace back a CSIS or CSE ip.

trevelyan• 13 years ago

Go talk to your MP as well.

HNC2• 13 years ago

I suggest you contact the CSIS and ask them directly why they've backdoored your computer.

sanko• 13 years ago

you should revise your TCP connections if you want know if it's a joke or not

X45• 13 years ago

It is possible that someone is playing a bad prank on Nadim, or that Nadim made the story up to gain attention.

Please read on. If this is real, then I'm sorry and recommend you to consider all suggestions before deciding illogical.

DON'T COMMIT SUICIDE!

If you watched the movie "Enemy of the State", I'd become paranoid, but not afraid. Stay calm and act logical.

I've looked at cryptocat two days ago, what's special about it? I don't see any reason for the Government to observe you, except that you would be a good fit into their Cyberwar Team. And that you have the wrong connections in the internet. I mean your friends are all hackers. It makes you appear dangerous too. Anyway, the government observes everyone, but with different priority and detail. I think only you might know why they observe you. No need to share the info.

Just as in the Movie: I'd replace all clothes, shoes and hardware with new ones and move to a different place. Acquire encryption software from a trusted source or compile it myself on a newly obtained Netbook and encrypt the hardrive+swap with a password and keyfile. Hide the keyfile. Put your hardware and new phone into a cool faradaybag.com. Stay in public, but personally invincible. Leak everything that isn't harmful for you using delayed transmissions with ifttt.com. Always have multiple copies of important documents, just for the case it's necessary.

Oh and I'd get a weapon and buy a bulletproof jacket (not vest). Avoid any contact to officials should be priority. Use Tor and VPNs like spotflux, hide.io, ovpn.to etc. and inform close friends to guard you.

+Trust no one.

parasight• 13 years ago

I don't think that buying a weapon and a bulletproof jacket is logical in his situation. Seems quite counterproductive to me when dealing with officials.

X45• 13 years ago

I think a bulletproof jacket is logical if his life is in danger.

Yes, I agree on the weapon, every signal that can pull the trigger of an official's gun should be avoided. But I think not having a weapon maybe careless too, only he knows what's right in his situation. A stupid move when confronted with officials could cause him more harm than wearing a gun.

ameen• 13 years ago

I'd assume "Trust no one" would include your very post? Movies are fiction, to base one's reactions & responses on it is silly.

What he needs is legal & political help.

X45• 13 years ago

You're right sir. I think he shouldn't trust anyone, but still consider the suggestions seriously. Legal help is surely his highest priority.

Btw. almost if not all of the fiction described in that movie has become a real threat. Not taking them into consideration is silly.

wyck• 13 years ago

This sounds a bit like your friends are playing a prank on you, or CSIS is smart enough to make it look like that is the case.

The key here is your desktop and how did they access it.

codejammer• 13 years ago

magikarp, could you please do a writeup on how did you notice the surveilance? Any extra info except i found a backdoor and noticed funny traffic would be more than useful to know.

cpressey• 13 years ago

I'm extremely confused by one detail. I'd like to know, what would be the point of describing oneself as a "Juror" or "former Juror"? Is there a particular court case involved with this story that I've missed a reference to? Is it some kind of slang in intelligence circles?

Raz0rblade• 13 years ago

try a different computer for example android / linux or something exotic much harder to backdoor compared to windows

davebuster• 13 years ago

IP logs or STFU

X45• 13 years ago

ANY UPDATES?

vy8vWJlco3• 13 years ago

https://twitter.com/kaepora/statuses/300992047345704960

wbhart• 13 years ago

The Wikipedia article notes that the press attention garnered by Nadim after his prior tussles increased the popularity of Cyptocat. Now imagine an intelligence agency wanting people to make greater use of a system they have back-doored or which is vulnerable to attack by them. Perhaps they couldn't resist the urge to make Cryptocat more popular! (Disclaimer: I have no knowledge of Cryptocat or CSIS, and my comment is hypothetical speculation. Alternative hypotheses are that they are invading Nadim's computer to try to find a way to break Cryptocat or to spook its developer, or because they have Nadim under some sort of surveillance, for who knows what reason.)

I do have a question about the story though. Why would an intelligence agency want to "acquire" Cryptocat? What would that mean anyway? Purchasing it for internal use is surely not necessary. They can just use it or any one of a number of in-house products they surely already have access to. Purchasing it to take it out of circulation is a possibility. But is this actually feasible? It's Open Source. Purchasing it to stop the developer working on it is a possibility. But wouldn't others step up? Buying a controlling stake in it is a possibility. But I don't see why an intelligence agency would make an offer of cash to someone not known to be susceptible to that kind of manipulation. I actually just don't see them doing this full stop. They surely know Nadim is motivated by idealism, not cash. So I can't think of a reason to "acquire" Cryptocat that actually stacks up. To work out what is going on here, you have to put yourself into the mindset of the individuals and organisations involved. And that is not easy if you simply have their media persona to go by.

Like the rest of the population, these organisations tend to be filled with people of many different persuasions, from geeks and activists and hackers through ultra-authoritarians and rogue elements. It's impossible to know which group is responsible for this, or what their motivations might be. It might have even been an unauthorised operation! And it may just as easily have been someone spoofing CSIS, e.g. some hacker group angry at CSIS for some past grievance. If so, I bet it is baking CSIS's noodle just as much as Nadim's!

At any rate, one should never infer a conspiracy where simple administrative or bureaucratic incompetence is a perfectly valid explanation.

vy8vWJlco3• 13 years ago

Update found via Nadim Kobeissi's Twitter feed on Feb 11 @ 7:37 AM:

"Alleged CSIS Liaison Officer met me for coffee yesterday. Told me that Cryptocat is national security threat to Canada. That is all."

https://twitter.com/kaepora/statuses/300992047345704960

I am under surveillance by Canadian agents, my computer has been backdoored

Related Stories