Why do criminals use their own encrypted messaging platforms, instead of using any of the recommended apps?
Why do criminals use their own encrypted messaging platforms, instead of using any of the recommended apps?
Black glove holding phone
Does that mean that other apps like signal for example have back doors?
Do criminals have a knowledge of exploits in the recommended messaging apps?
You're missing the #1 reason organized criminals prefer their own service. To have trusted staff who control everything â the servers, code development & deployment â whom can't be ordered by a court to shut off access to individuals at any time, or provide metadata, eavesdrop, etc.
The weakest link with legal services like Signal is that they can be compelled by law enforcement, the judicial system, and government... That's an enormous risk for any organized crime operation. Even a minimal amount of metadata collection can do a lot of damage, especially if it's analyzed over months/years, and especially when performed by an advanced persistent threat actor like a nation state.
I disagree, stupid self developed systems leak so much more, I think the number 1 reason is, surprise surprise, stupid people.
Also plenty of criminals and organized crime also use standard tools like telegram (which is way worse then signal)
I think you're both right. I think the non-stupid people with successful self-developed systems simply aren't talked about, because they don't get caught, because they're not stupid.
It probably depends on the level of the criminals and organized crime groups. I saw this Youtube video a couple weeks ago that talks about the history of how organized crime groups were using encrypted communication https://www.youtube.com/watch?v=gigIOc_0PKo (And how they were honey-potted by the FBI to use an FBI-hosted service, lol)
Organized crime groups that make 100s of millions should be capable enough to hire skilled developers and sysops to host self-managed services. At some point if they make enough money, investing in self-managed communication becomes preferable over using telegram or signal.
That's a very simplistic way of arguing or thinking about the issue. You are in fact not surrounded by idiots. Not everybody has expertise in your field (or the field you believe to be an expert in), so to you, it might seem obvious, but them, it's not.
Ridiculing others for "omg that was so obvious" is a failure on your part to see the obvious: they have other shit going on. I'd like to see you become a successful drug lord, escape capture for decades, and be an expert in computing at the same time. It wouldn't surprise me if you'd utterly fail at the drug lord part and make basic mistakes that a drug lord would call you an idiot for.
Theoretically signal only has your phone number and time of sign up which means theoretically it shouldn't matter if the legal system asks them for information.
... theoretically. In practice if the NSA used a secret court order that banned them from talking about it and made them update the app to reveal plaintext for one particular person, I don't see how they could get out of that (other than by breaking the law and risking jail).
I think the chances of that are very small though.
The average criminal is no dumber or smarter than the average non-criminal. As such theyâre every bit as subject to marketing ploys and mis/disinformation. so if their criminal buddies are using BaddieApp Pro, they probably will too. Or if they hear that Bill Gates is using the Signal app for mind control, thereâs a good chance theyâll believe it.
I've definitely also thought about, if our government gets taken over by fascists, how do you organize a rebellion?
And yeah, Signal definitely has some weird fucking shit going on. As far as I'm aware, they don't allow you to use their centralized servers, if you don't use their provided build of the app. They don't seem to have a mechanism to enforce that, so you could still use a self-compiled build, but if all your friends are on a compromised client, you can't talk to anyone anyways.
Well, and then there's also the great stupidity that Signal requires a phone number. In my country, you can't sign up to a mobile phone plan without revealing your full identity. If the fascist government realizes that I'm part of the rebellion, they can make my phone number disappear in unfortunate circumstances.
So, yeah, I'd at least want to self-host the communication platform. I'd probably use an existing open-source solution, but would try to audit at least part of it...
Just use a XMPP client, instead of signal
And talk with the dozens of people on it.
I think that simply knowing about PGP and using it with traditional platforms will go a long way. If you add some steganography to the mix, it can go a long way.
Lets put it this way: There are criminals that use whatsup, twitter, and the like for communication. They don't really last for some reason. Then there are those who use a special, commercial system. They might fail if they fall for traps like EncroChat (or however that was spelled). Then there are those who try to set up their own system, but lack the capabilities and talent for that. And last but not least are those groups you have not heard from in the news. They do have proper infosec.
I've heard of criminals using MMORPG DM's to communicate back in the day, not sure what happened to those guys.
Another way to stay under the radar. IIRC there was a case where information was passed on an image board by means of using random-looking filenames that actually encoded messages.
No, but by making their own they can ensure there isn't one. Or something like that.
All they really need is a program that turns cleartext into ciphertext and back, an open communication channel to transmit ciphertext, a secure way to exchange keys, and good operational security. There are plenty of cybersecurity experts with good skills and flexible morals, except NK and Russia probably pay better than the local meth lord.
Your average criminal is not making their own and have to trust some third party regardless. Law enforcement agencies have been known to have wide spread honey pot secure messaging apps before.
Yes. Most are likely still on provenly compromised platforms like whatsapp or telegram.
Because they're not stupid and understand that government agencies could have a finger in the pie for any publicly available software in some way/shape/form? Paranoia keeps them in business longer.