The outlet describes all the ways in which accounts and phones can be hacked and offers tips on how to protect yourself.
A major scandal broke out recently over statements by Artem Sytnyk, director of the National Anti-Corruption Bureau of Ukraine, about the possibility of intercepting the popular messaging apps WhatsApp and Viber. Sytnyk said this was well within the capabilities of the security services. WhatsApp founder Jan Koum responded immediately, categorically denying that unauthorized access to the messenger was possible. Strana decided to find out who can eavesdrop on messaging apps and how.
Accounts don't burn
The first rule that any user of a public internet service should remember is that neither correspondence nor accounts are ever deleted. Data centers keep backups anyway, made in case of failure. The cost of storing data today is so low that for corporations like Google it costs next to nothing. So it is better not to write anything unnecessary online at all if you are of even the slightest interest to the security services or hackers. After all, even if no one had access to the data today, it may "surface" years later. The same applies to information about a user's movements (it is recorded both by service providers such as Google and by mobile operators) — it is stored forever.
Altogether, there are two most common methods of interception.
Method 1. Hacking
Anything can be intercepted (hacked). The only questions are how difficult access is, how much it costs and how much time it takes. An important note. Most public internet services use so-called classical encryption algorithms (RSA and Diffie-Hellman), which are no longer reliable now that powerful servers have become available to hackers. For security services equipped with the right hardware, hacking an account is even easier, especially if the service provider helps.
"Algorithms such as RSA are becoming less suitable for encryption. The point is that modern computing power is sufficient to carry out a brute-force attack," says Dmytro Dniprovsky, an expert at the Intecracy Group consortium. "Since RSA relies on the difficulty of factoring large numbers, as soon as that difficulty disappears, the algorithm ceases to be reliable for serious use. So to protect truly important data from attackers who have such computing power, you need either to use other algorithms or to increase the key length."
If the SBU (or another security service) cannot manage on its own, it brings in specialists from private companies. For example, it took them only three days to hack the "invulnerable" registers of the Ministry of Justice in 2013. Another matter is that considerable financial and intellectual resources were spent on it.
The current capabilities of the security services do not allow for total control — collecting data is easy, but they have not yet really learned how to process it. That is why in many countries the law obliges IT companies to give the security services access to customer data on specific request. In Russia, for example, to make the task easier, all companies were also required to move their servers to Russian territory, and providers to grant unimpeded access whenever the security services take an interest. In the US, the FBI gains access through the courts. There are known cases in which access was obtained to Skype's code and to Facebook Messenger. Sometimes this leads to conflicts, such as the recent legal battle between Apple and the FBI. On February 16, a court ordered Apple to give the authorities access to information on the iPhone 5c of one of the San Bernardino (California) shooters. The company was required to create special software that would bypass the passcode without losing the data stored on the smartphone. Apple challenged the order in court. The arrest of Facebook vice president Diego Dzodan also caused a great stir after the company failed to comply with a repeated court order to provide access to WhatsApp messages.
How it works in Ukraine
Ukraine's Criminal Procedure Code (Chapter 21) allows up to a dozen different covert investigative (search) actions. The main ones are establishing the location of a radio-electronic device (put simply, where a mobile phone, laptop or tablet is), visual surveillance of a person or an object, audio and video monitoring of a person, retrieving information from telecommunication systems (email, social media accounts, messages on a phone), covert entry into a home, and so on.
However, the Code is written in such a way that an investigator cannot legally carry out any of these covert actions without the prosecutor's approval and a court's permission. The only covert action that can be carried out with the prosecutor's permission alone is control over the commission of a crime. No court ruling is required in that case. Moreover, the Interior Ministry cannot conduct, say, audio monitoring — that is, wiretapping — on its own, since back in 2005 Minister Lutsenko transferred all the technical equipment for this type of covert action to the SBU. So the SBU hands the police recordings of conversations that have already been transcribed. As a result, several agencies are often involved in covert investigative actions, and the risk of information leaks is high.
If covert investigative actions are carried out without the sanction of a prosecutor and a court, that is a crime committed in office. This happened several years ago, when Serhiy Kivalov's number was inserted into a wiretap request concerning a different crime. The police major who pulled it off received a suspended sentence from a court in Odesa. If the procedure is not followed, it is easy to end up facing criminal charges, or the information obtained by the security services will not be accepted as admissible evidence in court. There is a Constitutional Court ruling on Major Melnychenko's tapes: the high court held that wiretapping without a court's sanction is inadmissible evidence.
Method 2. Access to the device
Most often, law enforcement officers have no time for brute-force hacking (searching for vulnerabilities, gaining access through the provider, and so on). So, to read messages in messaging apps, they exploit the carelessness of the users themselves and gain access to the device.
First, you need to understand that no messenger whose client can be installed on two, three or more devices is safe in terms of confidentiality. Messages can always be read through a second copy of the account.
For example, a simple way to access information in Viber is to install it on a laptop and, to authorize it, borrow the user's smartphone for 20–30 seconds (receive the SMS and enter the code on the laptop). An even more common method is to strike a deal with an employee of the mobile operator (or trick them by saying it is your SIM card and naming the numbers it most often calls) or to issue a duplicate SIM card using the special equipment that the security services have.
There are several ways (without a hacker's help) to access Skype as well. It usually starts automatically when you log in to Windows on a computer and when a smartphone boots up (so access to one of the devices is enough). Skype accounts are often linked to social networks (it is enough to get the social network password, and the browser stores it). Plus, most people's passwords are simple, and girls often like to write them down on a piece of paper and keep it in a desk drawer (so as not to forget). Very often, the password reminder function is used to gain access to someone else's account — the security word is either the mother's maiden name, the make of the first car or the dog's name. In other words, it is information that is not hard to obtain.
Second, specially written programs are used to access other people's data. An attacker or a security service officer simply needs to infect the user's device. Usually the user is sent a file with a virus by email (or via Viber, Skype or Facebook Messenger), disguised as a photo, a video or an update to a favorite game.
Third, it is almost impossible to protect yourself if a hacker or security service officer is working with one of the user's colleagues or family members — that is, with a person who has direct access to the device (and can install the virus on it themselves) and also has the information needed for the hack (smartphone model, number, full name and additional details, such as which messaging apps are installed). Software written for a specific smartphone model will pass an antivirus check.
Fourth, a popular hacking method is infecting a device via a public Wi-Fi network, especially if the user, prompted by the program (to get free internet access), enters personal data or logs in to social networks.
What Jan Koum meant
On Twitter, the founder of WhatsApp hinted to NABU director Sytnyk that the service uses E2EE cryptographic key technology. The idea is that correspondence is controlled directly by the users, and messages cannot be decrypted either by those intercepting them or even by the servers transmitting the data. That is, a message is encrypted locally on the sender's device and can be decrypted only on the recipient's device.
The ideology is absolutely right. The only problem is that the encryption algorithm itself is rather simple — the encryption key used by the WhatsApp app for Android is an MD5 hash of the phone's IMEI number in reverse order. In addition, on iOS devices (iPad/iPhone), WhatsApp creates its encryption key simply by duplicating the MAC address of the Wi-Fi interface and generating an MD5 hash from it. So a hacker can obtain the data needed for a hack as soon as the smartphone owner decides to use a public Wi-Fi network.
How to protect yourself: 5 key tips
- Do not use free public Wi-Fi. Turn this function off (as well as GPS) when you do not need it — for example, when you have left the office.
- Passwords should be complex and different for every account, so that an attacker who learns one password cannot gain access to everything.
- The password recovery function should be set up so that an attacker cannot guess the answer to the security question.
- All devices (computer, phone, tablet, smart TV) should have antivirus software installed. Preferably a paid one.
- Of all the popular messaging apps, the only secure ones are Telegram, and only in secret chat mode, and iMessage. This is according to a study by the Electronic Frontier Foundation. Several other programs (ChatSecure, Cryptocat, etc.) are also among the leaders, but since few people know about them, you will most likely have no one to "communicate securely" with.
Source: Strana.ua