Inside the Operating System Edward Snowden Used to Evade the NSA

http://www.wired.com/2014/04/tails

by Osiris • 12 years ago

303 81 12 years ago

Tails (The Amnesic Incognito Live System) http://en.wikipedia.org/wiki/The_Amnesic_Incognito_Live_Syst..., a Debian fork which forces Tor for all outgoing and incoming connections. Designed to be run from read-only media.

reedalex012• 12 years ago

More info on their relationship with Debian: https://tails.boum.org/contribute/relationship_with_upstream

"For various reasons Tails tries to diverge by the smallest possible amount from its upstream projects, and especially from Debian"

"We try to push our changes upstream when we need to modify software we ship. This often requires us to write code in a generic way, rather than implementing ad-hoc hacks to fit our specific needs: e.g. we often need to make the stuff we need opt-in and add configuration options."

The official term for this is "Debian derivative" rather than "fork."

drzaiusapelord2• 12 years ago

So, is this proof that tor is not completely subverted by the NSA? Recent articles here claim that the NSA has been deploying numerous nodes and can analyze traffic from multiple nodes to compromise the user.

Or is this proof of tor being better than nothing?

toyg• 12 years ago

The latter. The NSA didn't have to analyze anything: Snowden was not a known target, and he revealed himself before any real manhunt or mass-analysis had started.

xsace• 12 years ago

Well it's not like Snowden managed to remain anonymous forever

steve19• 12 years ago

You mean when he did a video interview? He managed to do what he did and leave the country without being caught. I call that mission accomplished.

jonemo• 12 years ago

Another Debian based boot-from-CD OS that used to be quite popular is Knoppix [1]. I remember that was a big thing in the times of Win98 viruses when people used it for system recovery. In Germany they distributed it as add-on to computer magazines.

[1] https://en.wikipedia.org/wiki/Knoppix

k-mcgrady2• 12 years ago

Knoppix was my first introduction to Linux. The boot-from-CD aspect amazed me. At first the only thing I used it for was recovering data from a screwed up Windows install but eventually I got more into it and started installing other distress (starting with Ubuntu I think).

AJ007• 12 years ago

For some perspective, this was back in the days where it was actually quite a bit of work to get get linux configured and running correctly on your at home desktop. Knoppix was quite a miracle.

girvo• 12 years ago

Knoppix and Slax were my first foray into Linux as a teenager. The latter also introduced me to the terminal, in my quest force it to boot from a HDD... Many a partition died that week.

sixothree• 12 years ago

What I found most delightful about knoppix was that with zero configuration on the first boot every single one of my hardware devices was recognized correctly.

JeremyMorgan• 12 years ago

Knoppix was really innovative for it's time, the first live CD OS that I know of, it was great for accessing drives that were toasted or even mounting other linux volumes. All the stuff we do with USBs now, but back in the early 2000s it wasn't an easy thing for them to accomplish.

SixSigma3• 12 years ago

Even wired don't know what an OS is. Or rather the definition of OS has changed. A strange time when your industry jargon enters the popular lexicon but always slightly twisted.

You can't even call yourself a Troll in the UK now without people thinking you go on Facebook and mock the dead to their nearest and dearest.

timthorn2• 12 years ago

Yes, the BBC News at Ten told us that "the website Mumsnet has warned its 1.5 million users that their data may have been hacked as a result of the Heartbleed computer bug. It's the first time the virus has been found on a British website"

SixSigma3• 12 years ago

I have found the BBC's Technology reporting particularly irksome. Their website is filled with re-hashed press releases. I even re-wrote an article concerning turning urea into electricty for them to show what it could have been like if they had put half an hour's effort into it, naturally I didn't even get a response.

bashinator2• 12 years ago

What is Tails, if not an operating system?

SixSigma3• 12 years ago

A distribution of the Linux operating system. It's a Debian distribution with some userspace tools bundled.

Gregorein• 12 years ago

is website under ddos?

gulbrandr• 12 years ago

HN-DDOS, probably.

devconsole• 12 years ago

It's worth noting that Tails doesn't make you impervious. Tails uses Tor, and Tor is vulnerable to NSA and GCHQ attacks. Specifically, they have the capability of deanonymizing individual targets. I hypothesize that this capability works by monitoring Tor traffic worldwide, then performing a timing correlation between an origin and an endpoint.

Here's an example: Let's say (for the sake of example please) that the NSA can passively monitor Google searches in realtime. Let's say you search for a phrase that sets off their monitor: something like "a Tor user has Googled for Snowden." They'd like to know who you are. How would they do that?

One way is to record the fact that from your home computer originated some Tor traffic at almost the same time the Google search took place.

It's unclear exactly how they deanonymize Tor users, but one piece of info that may corroborate my hypothesis is that in a Snowden screenshot, you can see the NSA has a tab called "Tor Events" in one of their tools.

The need for websites to load quickly is Tor's Achilles heel, because it enables timing correlation. The fact that few people use Tor exacerbates the problem.

nounaut• 12 years ago

I think you mean to say that users of Tor are potentially vulnerable to NSA and GCHQ attacks. Specifically, they lack the capability to deanonymize individual targets upon request and according to the slides leaked by Snowden they are only able to deanonymize a very small fraction of the traffic and usually have to rely on attacking surrounding software, such as the Firefox browser bundled with Tor.

http://www.theguardian.com/world/2013/oct/04/nsa-gchq-attack...

jgalt212• 12 years ago

Has anyone looked into thwarting timing attacks by using Selenium to run web tasks at random times?

mike-cardwell• 12 years ago

https://tails.boum.org/doc/about/warning/index.en.html#index...

"Tor doesn't protect you from a global adversary

A global passive adversary would be a person or an entity able to monitor at the same time the traffic between all the computers in a network. By studying, for example, the timing and volume patterns of the different communications across the network, it would be statistically possible to identify Tor circuits and thus matching Tor users and destination servers.

It is part of Tor's initial trade-off not to address such a threat in order to create a low-latency communication service usable for web browsing, Internet chat or SSH connections.

For more expert information see Tor Project: The Second-Generation Onion Router, part 3. Design goals and assumptions. [https://svn.torproject.org/svn/projects/design-paper/tor-des...

pavanky2• 12 years ago

One way is to record the fact that from your home computer originated some Tor traffic at almost the same time the Google search took place.

This either implies someone already suspects you and are monitoring you or that you are the only person searching on Google using Tor at that particular moment. I find the latter hard to believe. Even if it is true, it can be mitigated by more people using tor at the same time.

unhammer2• 12 years ago

You might want to run a non-exit node at your home. That way you have a lot of Tor traffic all the time, and the one time you really do need anonymity, it doesn't show up as anything unusual.

dobbsbob2• 12 years ago

Google searching no, but an IRC room or being logged into something would be good for metadata. Especially a forum or chat room where you reveal timezone or other geolocation info. "It's snowing here"

Would not take long to grep ISP logs and find the known Tor bridges, Obfsproxy bridges, relays and who might have used them.

If you tunneled Tor traffic through a VPN exiting Russia then your local ISP has no Tor timing metadata to give, unless you're Snowden and your adversary is global. Running an internal relay would help obfuscate your own traffic too if you can connect to it on a local network it would be a lot harder to prove you logged into IRC channel #blowuptheembassy on the Al Qaeda IRC freenode server.

hackuser• 12 years ago

Tails doesn't make you impervious

For all X, X does not make you impervious. All it can do is increase the cost to an attacker.

diziet• 12 years ago

Some alternatives: Whonix: (vm isolated or hardware device isolated, tor) https://www.whonix.org/ and Qubes OS: (sandboxing different processes, needs torVM to do tor things) http://qubes-os.org/trac

A nice comparison: https://www.whonix.org/wiki/Comparison_with_Others

higherpurpose• 12 years ago

This table is also interesting:

https://www.whonix.org/wiki/Comparison_with_Others#Attacks

perlpimp• 12 years ago

You can hack SD cards actually unlike the article states, Bunny's blog post and presentation at Chaos Computer Congress mentions of this possibility. SD cards have microcontrollers and with enough resources their guess flash media can be subverted. Diversity of these controllers and variety of "proprietary" standards the way these flash controllers work however can be the entropy that makes SD controller hacking very unlikely - but you never know.

http://www.bunniestudios.com/blog/?p=3554

my 2c

agumonkey• 12 years ago

also, in your hdd controller(s) http://spritesmods.com/?art=hddhack.

same stuff, too many cpu everywhere, making protocols meaningless.

dmix4• 12 years ago

And Macbooks can be hacked through the battery https://news.ycombinator.com/item?id=2796264

bluenose69• 12 years ago

The article suggests security because "all of the Tails code is open source, so it can be inspected by anyone worried about foul play."

Yeah, that worked out well for openssl.

aw3c2• 12 years ago

Yes it did. The heartbleed bug was found during an audit of the open source of openssl.

epo• 12 years ago

The audit occurred because testing revealed the presence of a problem. Shutting the stable door after the horse has bolted is no vindication of open source.

UweSchmidt2• 12 years ago

Found late, and found in a an error-prone environment. This weakens the oft-implied "proof by open-sourceness", and has brought up some criticism on how open source projects are ran and incentivized.

Doesn't mean "Open Source sux", just some nuanced criticism, ok?

solarc• 12 years ago

Now try to do that trick on proprietary software.

jebus989• 12 years ago

Impressive how much thought and work has gone into Tails development, e.g. it has a surprisingly-convincing XP skin that hides the fact you're even using Linux to the casual observer. Kudos to the devs.

danford2• 12 years ago

It's called GNOME 2 and it feels exactly like you're using Linux, which is a great feeling. Kudos to the devs.

Edit: apparently I was mistaken. GNOME 2 is the default desktop, but there is an XP skin. See comments below.

breakall• 12 years ago

GP is referring to XP Camoflauge option in Tails.

http://www.bitblokes.de/wp-content/uploads/2013/02/tails-0-1...

drzaiusapelord2• 12 years ago

Except now seeing an XP desktop in a corporate environment will raise eyebrows as its officially dead.

No Win7 skin?

Karunamon• 12 years ago

A more cynical person would say you've not worked in many corporate environments ;)

blueskin_• 12 years ago

I like the way I had to click the article to see what it was. I was wondering if it'd be Tails or something. Yep.

dmix4• 12 years ago

One important and often overlooked feature of Tails is when you shut it down it wipes your system memory/RAM using sdmem.

Your encrypted data and sensitive files are often accessible via memory forensics even if you shut your computer down. Including the websites you visited. Your encryption keys can be in your computers memory for weeks and is easily accessible via a memory dump.

This is why people say that with physical access your computer can always be owned. Even if it's encrypted. Tails is the only one I know that handles this attack vector by default.

https://tails.boum.org/contribute/design/memory_erasure/

acqq3• 12 years ago

Data can be retrieved from DRAM not after weeks (your claim is "even if you shut your computer down (...) Your encryption keys can be in your computers memory for weeks") but only

http://en.wikipedia.org/wiki/Cold_boot_attack

"in the seconds to minutes after power has been removed."

The reason is explained here:

http://en.wikipedia.org/wiki/Memory_refresh

And even the electrons from SRAM, which doesn't need refreshes and which was for decades not used as "RAM" in the computers will leak away without the power:

http://en.wikipedia.org/wiki/Static_random-access_memory

"SRAM exhibits data remanence but it is still volatile in the conventional sense that data is eventually lost when the memory is not powered."

Of course, if you never power off your computer but just reset it (the power is never cut off) or if you shut it down and immediately power it up the content of the RAM can really survive for much longer.

reedalex012• 12 years ago

The original cold boot paper was released in 2008 and they only demonstrated the attack on DDR2 memory [1]. A paper published in 2013 [2] discussed cold boot on modern hardware.

"This study is based on 5 different computer systems. While we demonstrate that simple warm reset attacks (not cutting power) are effective even against DDR3 systems, we were not able to detect any data remanence for DDR3 after cold boots. Even cooling the RAM chips did not reveal data remanence beyond cold boots. This leads us to the claim that cold boot attacks relying on RAM remanence beyond cold boots are not possible against modern DDR3 RAM chips."

[1] https://www.usenix.org/legacy/event/sec08/tech/full_papers/h...

[2] http://www1.cs.fau.de/filepool/projects/coldboot/fares_coldb... (search for DDR3 to find the relevant sections)

dmix4• 12 years ago

Thanks, this is true. Encryption keys can exist in memory for up to a week [edit: or longer] in live memory with power on. This is well after they've been used on the machine, or say after you close your Truecrypt volumes. The vast majority of people rarely shutdown their laptops for extended periods of time and often just suspend to disk, instead of a full power-off.

This is why it's good to power down or sdmem when you're finished working with sensitive data.

On a full shutdown persistence is not as big of a risk, as the other commenter pointed out, cold boots are mitigated by DDR3 similar to how modern SSDs with TRIM make deleted data-recovery nearly impossible (such as Swap data which may also contain encryption keys).

dobbsbob2• 12 years ago

They use memtest=n kernel parameter now instead of sdmem https://tails.boum.org/blueprint/more_efficient_memory_wipe/...

I don't really trust their tests, but DDR3 memory kind of makes this attack useless. The $FEDAGENCY also plans arrests so you're cuffed with everything turned on and no way to push buttons or yank out cables like Ross Ulbricht or Max Vision

bch• 12 years ago

How do we now it isn’t some government plot designed to snare activists or criminals? A couple of ways, actually. One of the Snowden leaks show the NSA complaining about Tails in a Power Point Slide; if it’s bad for the NSA, it’s safe to say it’s good for privacy. And all of the Tails code is open source, so it can be inspected by anyone worried about foul play.

It does not follow that either, or both, of these points (Open source, an NSA complaint slide) make this "snare proof". I'm not saying that it isn't, but there is no logic in the Wired article's assertions.

slantview2• 12 years ago

Yeah, safe and open source are not necessarily synonymous. (see openssl "heartbleed")

gtirloni• 12 years ago

And naturally, nobody knows exactly who created it.

Shouldn't it be the opposite so we all know who we're relying on? It's the same question I'd throw at Bitcoin.

joezydeco• 12 years ago

I think users would prefer that covert government agencies not know where to find the authors, either to avoid undue influence or surreptitious hacking of their development machines to insert backdoors and other nefarious things.

Plus, as TFA states, the code is all out there in the open and able to be reviewed. Does it matter who wrote it at that point?

trustlook• 12 years ago

That reminds me the movie Captain America 2. Use such a USB based OS, enter an Apple store and find a macbook. Literally an untraceable hacking.

slantview2• 12 years ago

A real inside look at it. /s

Inside the Operating System Edward Snowden Used to Evade the NSA

Related Stories