Youth Jailed For Not Handing Over Encryption Password

[okiwan]

Only an idiot (read: someone who has no idea what they're doing) would buy that, or anything like it. ANY linux live CD + a usb HDD and you just dd yourself an img.

an idiot if your some average joe off the street yes. but if your working for a company you make them buy all the nice equipment so every thing looks professional. rather then a shopping bag with a external hard drive an a linux live cd thrown over your back.

thats like saying only an idiot would buy a $200 kitchen knife set when you could get one from the dollar store that will still cut your food.

say you have two computer forensics experts. they have exactly the same skills. one guy has all his gear looking like he got it from best buy. the other guys gear looks like hes some CSI swat team mission impossible james bond agent. which one will get more respect? id go with the CSI swat team mission impossible james bond agent.

so perhaps only an idiot would go in with a linux live CD + a usb HDD. what you think company expenses are for?

[GeekGoneCrazy]

Very true which is why i use encryption. Well there are two things really:

1) If they were being nice and I had no implication in the crime whatso ever OR I was the only one that could help them track down a criminal i would supply the password (and change it after)

2)If i could possibly be implicated as an "accomplice" or such I would use it as leverage for immunity and then hand it over to the police :P

I use 50+ char ASCII password on my FDE :) AES-256 bit in XTS mode lets see them get that :) Not to mention backups are encrypted on a file by file biases and then sealed in a AES-TWOFish-serpent encrypted partition on my 1 TB external HDD with another 50+ char ASCII password + 4 key files and has a hidden volume as well! Kiss my ass Law enforcement!

Paranoid much? That's a lot of encryption. Encrypt your traffic too?

What if the guy doesn't have kiddie porn. Could be he doesn't want to share his files. I can think of plenty of stuff besides porn that encrypting would be good for.

I say keep a remote backup of this. Put it on a china server or something. Cops come knocking just throw it in the microwave and nuke it. lol Well actually... how advanced are basic law enforcement agencies? Just delete the file. Sure the data is still there... but its still encrypted.

Encrypted file? What file? I don't remember having an encrypted file.

Get released, recover it. Just hope they don't zero out the unused space while they examine it :P

Edited October 8, 2010 by GeekGoneCrazy

[SomeoneE1se]

an idiot if your some average joe off the street yes. but if your working for a company you make them buy all the nice equipment so every thing looks professional. rather then a shopping bag with a external hard drive an a linux live cd thrown over your back.

thats like saying only an idiot would buy a $200 kitchen knife set when you could get one from the dollar store that will still cut your food.

say you have two computer forensics experts. they have exactly the same skills. one guy has all his gear looking like he got it from best buy. the other guys gear looks like hes some CSI swat team mission impossible james bond agent. which one will get more respect? id go with the CSI swat team mission impossible james bond agent.

so perhaps only an idiot would go in with a linux live CD + a usb HDD. what you think company expenses are for?

you're analogy is flawed, a 200 dollar knife is (read: should be) better then a dollar store kniof.

but there's nothing in that kit that would do that job better then dd would, unless we also need to consider how cool you look while making an img of a hard drive. In that case go to you local hardware store buy a bunch of random cables and metal tubeing, throw it all into a pelican case, put some danger underground hacker stickers on the case and strut in looking like this http://ia.media-imdb.com/images/M/MV5BMTg5...X485_SY327_.jpg

because the kid in the basement will always be better then the guy who learned his shit from school.

[okiwan]

because the kid in the basement will always be better then the guy who learned his shit from school.

only people who dont go to school say that.

unless we also need to consider how cool you look while making an img of a hard drive.

in the real world image is every thing. (no pun intended)

people judge you by what they see first. its sad but its true. when you wanna leave the basement you will realize that.

Edited October 8, 2010 by okiwan

[SomeoneE1se]

only people who dont go to school say that.

in the real world image is every thing. (no pun intended)

people judge you by what they see first. its sad but its true. when you wanna leave the basement you will realize that.

Hahaha you're funny. I don't say that because I'm living out of a basement I'm in school right now too.

BUT! Name something you can learn from school that I cant find out on my own. then I'll name 5 things that you can only learn by being plugged into the tech world that I'm not going to learn about in school.

[okiwan]

Hahaha you're funny. I don't say that because I'm living out of a basement I'm in school right now too.

BUT! Name something you can learn from school that I cant find out on my own. then I'll name 5 things that you can only learn by being plugged into the tech world that I'm not going to learn about in school.

no i totally agree you can learn anything on your own that you can learn in school. but degree's and certifications look better when trying to get a job. though you can also get certified with out going to school. but having some one who knows what there talking about teach you is allot faster then learning on your own. a school will tell you what you need to know rather then you searching around looking for the right things. though searching around and doing things the long hard way also gives you the experience factor. its a win/win situation.

but this is off topic. point is image is important in the real world. at least in 90% of the companies out there. if your lucky to work for linux or something then you can roll outta bed an show up at work eating cold pizza from the night before. lol

[SomeoneE1se]

no i totally agree you can learn anything on your own that you can learn in school. but degree's and certifications look better when trying to get a job.

yes they do, but I never said anything about getting a job just about breaking to an encrypted file

though you can also get certified with out going to school. but having some one who knows what there talking about teach you is allot faster then learning on your own.

I disagree but have nothing to cite to prove my point and it's "a lot"

a school will tell you what you need to know rather then you searching around looking for the right things.

again, school will not teach you everything you need to know to do your job correctly (assuming your job is to break into other peoples systems) and if you know how to use google you can find the answer in less time it would take to travel to school

though searching around and doing things the long hard way

not long and hard if you know how to search for it

also gives you the experience factor. its a win/win situation.

what's a win win now?

but this is off topic. point is image is important in the real world.

trying to get a job yes, but that's not what we're talking about just breaking into a system

at least in 90% of the companies out there. if your lucky to work for linux

the linux kernel is hiring SWEET!

or something then you can roll outta bed an show up at work eating cold pizza from the night before. lol

I do that anyway cool pizza is yummy and no one (who matters) cares what I ate for breakfast

yes I'm being trivial and petty, but you're arguing a point that I never stood against.

do you disagree that a live cd with dd would not work as well as that expensive kit?

[okiwan]

but I never said anything about getting a job just about breaking to an encrypted file

school will not teach you everything you need to know to do your job correctly (assuming your job is to break into other peoples systems)

trying to get a job yes, but that's not what we're talking about just breaking into a system

my initial comment was that a forensics team would have something like the equipment i posted a link to. a computer forensics team works for the police. that is a job. that is what were talking about. you seem to be confused.

the linux kernel is hiring SWEET!

dont be ignorant. an for your information redhat is hiring.

do you disagree that a live cd with dd would not work as well as that expensive kit?

of course i dont disagree. but if your part a a computer forensics team working for the police chances are they are going to do things proper and professional. do you think a bomb defusal unit is going to use a arduino controller robot, or some expensive unit?

ya a $30 arduino could control a robot to defuse a bomb, an a live cd can copy a HD. your not understanding the point of professionalism. not to mention the point of have specific tools for a specific job.

you can hammer a nail with a rock but i think paying for a hammer is better.

Edited October 8, 2010 by okiwan

[SomeoneE1se]

my initial comment was that a forensics team would have something like the equipment i posted a link to. a computer forensics team works for the police. that is a job. that is what were talking about. you seem to be confused.

I must be because you already agreed that where you go to school or what tools you're holding doesn't make you better or worse. and I never said anything about a job when YOU replied to ME

dont be ignorant. an for your information redhat is hiring.

ad hominem attacks are not necessary

of course i dont disagree. but if your part a a computer forensics team working for the police chances are they are going to do things proper and professional.

you mean the way some overpriced company says you should do it? that doesn't make it the right way

do you think a bomb defusal unit is going to use a arduino controller robot, or some expensive unit?

what's wrong with a custom built robot?

ya a $30 arduino could control a robot to defuse a bomb, an a live cd can copy a HD. your not understanding the point of professionalism. not to mention the point of have specific tools for a specific job.

you can hammer a nail with a rock but i think paying for a hammer is better.

I understand that, and I also understand that you think it needs to look good and be approved by someone who has to wear a suit to work, but that's just not true. My suggestion has the benefit of working just as well and being near free. So again I ask why you need to buy the expensive kit? And you can't say because it looks better anymore.

My suggestion is to just make an img of the drive then trick him in to providing the password, you don't need a special device to do that. You only need to be a little smarter then your target. That's the point I wanted to make. And again, I DO NOT care how this police agency decides to run their operations. I'm only trying to provide a suggestion and the way I would do it.

You know you've got it right not when you can no longer add more, but when you can no longer take anything away.

Occam's Razor

[okiwan]

k.

[SomeoneE1se]

k.

can I ask how old are you?

[Infiltrator]

can I ask how old are you?

I would guess he is in his 20's.

[okiwan]

im in my late 20's. how old are you?

[SomeoneE1se]

im in my late 20's. how old are you?

You make a lot of spelling and grammar mistakes for someone who cares about the "right" way to do something in their late 20s

I'm 23

[okiwan]

You make a lot of spelling and grammar mistakes for someone who cares about the "right" way to do something in their late 20s

I'm 23

im just typing online, im not writing an essay. its a bad habit. i normally type as if i was talking. like talkin instead of talking etc.

[MRGRIM]

Couple of points:

At $3000+ I wouldn't buy that kit, maybe if it was $300 I would buy it just for kicks and to look "cool".

Back to the topic: I guess they already know he's downloaded (rather than shared) something he shouldn't have, I mean they don't randomly pick on people? So either his home address, IP or email address is associated with a site or group distributing this stuff or he’s been online and foolish downloaded torrents containing this data.

The hardest part they have is proving it was him and his PC, it’s the common argument that people are putting up at the moment vs. other legal cases and they can only prove that someone on your network downloaded something, they can’t prove who.

[Guest Deleted_Account]

Paranoid much? That's a lot of encryption. Encrypt your traffic too?

haha no its more just because its fun to secure things :) as for traffic my Gmail and Facebook are ALWAYS https even at home because its easier to set the option and leave it that way when i log on in starbucks or school its already secure no need to worry about it :P

[Trip]

why dont we have a distributed password cracking app ?? like the seti screen saver

[SomeoneE1se]

why dont we have a distributed password cracking app ?? like the seti screen saver

there's a few on some of the darknets out there, but who'd run it and how'd you decide who's passwords get cracked?

[Infiltrator]

there's a few on some of the darknets out there, but who'd run it and how'd you decide who's passwords get cracked?

We could design an open source service, especially for cracking passwords.

That could be used by anyone who wishes to recover their password. It doesn't have to be for a particular user or target.

Edited October 9, 2010 by Infiltrator

[SomeoneE1se]

We could design an open source service, especially for cracking passwords.

That could be used by anyone who wishes to recover their password. It doesn't have to be for a particular user or target.

Everybody's favorite words open source (geek for you write the code.)

I'd be happy to help, how do you suggest we prevent abuse, and get the computers to do the actual cracking?

[Guest Deleted_Account]

Actually if you are interested in a Distributed Cracking System of sorts we have been discussing it here http://www.hak5.org/forums/index.php?showt...view=getnewpost and if enough people are willing we should start up a thread in the Hak5 Labs section about it!

[unasoto]

Glad I live in the U.S.A :)

read this

[Infiltrator]

Glad I live in the U.S.A :)

read this

American Laws never cease to amaze me.

Really good stuff, thanks for sharing.

Now I have a compelling reason to encrypt my drive.