Yeah blame it on hotel internet, not their shitty communication service that's not encrypted.
this post was submitted on 08 Mar 2024
300 points (97.2% liked)
Europe
8484 readers
2 users here now
News/Interesting Stories/Beautiful Pictures from Europe πͺπΊ
(Current banner: Thunder mountain, Germany, π©πͺ ) Feel free to post submissions for banner pictures
Rules
(This list is obviously incomplete, but it will get expanded when necessary)
- Be nice to each other (e.g. No direct insults against each other);
- No racism, antisemitism, dehumanisation of minorities or glorification of National Socialism allowed;
- No posts linking to mis-information funded by foreign states or billionaires.
Also check out !yurop@lemm.ee
founded 2 years ago
MODERATORS
It probably is, but they didnβt disable the feature that allows you to dial in on a phone line for audio. Thatβs my guess.
"I think that's a good lesson for everybody: never use hotel internet if you want to do a secure call," Germany's ambassador to the UK, Miguel Berger, told the BBC this week.
β¦
The exact mode of dial-in is "still being clarified", Germany has said.
OK, well the exact mode kinda fucking matters before you just scapegoat a hotel.
This smells like a coverup.
Oh no. They're not referring to a specific hotel. Seriously never use hotel Internet on a sensitive device or for sensitive business. You will regret it.
In a world where I can deploy end to end encrypted comms servers to an old computer in my house, the fucking military of any country should, at a minimum, require encryption to join meetings where military strategy is being discussed.
Yes
load more comments
(1 replies)
End to end encryption
USE IT
They can discuss missile targets but they don't know how to set a secure comm channel, it makes me wonder... how old were they? why don't they give a device with pre-installed VPN (incl. Killswitch) to all certain-rank officials and get done with this?...
They do. Its much more than a built in vpn, they also have specialized, hardened versions of communications apps on them. The weakest link in cybersecurity is usually the end user.
I think one issue is for high officials that outrank everyone, they can get away with getting an insecure device because they prefer an iPhone over the custom hardened phone on Android 10 locked down for secure reasons.
Not sure what their age has to do with it
an especially secure, certified version
Bwahahahahahhahahahhahahhaa
This happened because of an unintended backdoor into an end to end encrypted conversation.
The British Government are actively trying to get back doors put into end to end encryption by law.
They are doing this so they can spy on their own citizens to ostensibly make Britain safer.
But as you can see, it actually would make it less safe.
This is what happens without E2EE.
This doesnt add up... If the software was properly encrypted they shouldn't have been able to carry out a man in the middle attack right?
Maybe he dialed in by telephone? It would be a complete boomer move, but Iβve seen people do it.
A researcher in cryptography in Berlin, Henning Seidler, believes the most likely theory is that the officer dialled in via his mobile phone and the call was picked up by spies' antenna who can also "forward" the traffic onto the main, official antenna.
Seems like the more likely theory
That is an expensive way to lose your job!
"Intelligence" services cost taxpayers billions a year, so the billion dollar question is why is it possible to dial in to "official" military communications over insecure channels at all?
Why doesn't the government run their own signal or matrix infra? Why are they paying Cisco, and introducing the numerous attack vectors of a proprietary optionally-encrypted service?
The threat of surveillance capitalism isn't just in the dragnet surveillance of the population. It's in the profiteering of "partnerships" between private and public β the drive of corrupt and incompetent political and military leadership to direct funds to sub-optimal proprietary services and protocols, instead of leveraging public funding to contribute to open-source and make hardened systems ubiquitous.
The funny thing is, that the Bundeswehr actually has a communications platform based on Matrix: bwMessenger goes live for Bundeswehr, element.io
Why they're not using it? Who knows...
That's what I'm getting at. This ultimately isn't the fault of some technobozo who dialled in from hotel wifi. If the system were fit for purpose, technobozo could dial in over any network.
The is the fault of German politicians, military, and "intelligence". This type of compromise should not exist as a matter of circumstance. It should only be possible when an end users device is directly compromised.
We are talking about the person/department that has ensured that they run an especially secure, certified, version of webex losing their job right?
As much as I'd like to think that senior military people have some basic awareness about security, this is really a tool that was considered secure by the organisation. Sounds like a big gaping whole letting dialin enabled for anyone to use.
Not even. A Pringles can and some wire.
Yes, it is a boomer move. But don't let Cisco off the hook. What kind of specially certified security feature is that, if it can be turned off so easily by accident.
He most likely did, at least from what I can deduce from the published recording.
Sounds like the encryption is automatically turned off if someone calls in via phone. So technically e2e encryption is supported, but it's a shit design just waiting for someone to accidentally misuse it.
It sounds like this especially secure, certified, version of webex should probably not allow dial in via phone should it?
It they used the client, yes. But in you dial in via sip, that opens up so many ways to screw up. Old software, open wifi, legacy hardware, you name it.
Yes, itβs not the 90s anymore. The network is hostile. If itβs not, nice but youβd be a fool to trust even your own. Encryption all the way!
What an amazing feat of incompetence! Theyβd be better off just using Signalβ¦
Theyβd be quantum proof as well π https://signal.org/blog/pqxdh/
They even have their own Matrix Messenger they could have used...
Yeah def this is what they shouldβve been using.
I love Signal but military should use their own messenging service (and they do).
load more comments
(1 replies)
I don't see how it matters if you use hotel WiFi or mobile if the mobile mast you connect to is controlled by a hostile government.
What matters is what you were sending wasn't secured at source.
Although Wikipedia tells you the range and I'm pretty sure even Russia have access to maps and a compass.
It is fine if you use unprotected wifi and then connect to a VPN.
You don't even need a VPN if the software uses proper TLS encryption or equivalent
These VPN ad campaigns are incredibly detrimental to people's understanding of security mechanisms in the internet.
How would this not have helped out in this case? I imagine the Bundeswehr must have an organization-wide VPN which would render any MITM in a local Wifi network impossible, barring user error.
load more comments
(1 replies)
EvE Online should be mandatory training for anyone with a security clearance. Minimum of six months in Goonswarm, Pandemic Horde, Fraternity, or The Initiative.
https://cad-comic.com/comic/one-of-us/
That's only a slight exaggeration. I had a "chat" with one of our intel officers at one point due to a IRL purchase of PLEX.
Edit: maybe just Goonswarm. They do the intelligence and spy stuff the best.
Isn't like very basic security advice to not use random connections for sensitive information? But than again it's Germany, pretty sure he has his password written down on a sticky note.
This is the best summary I could come up with:
He sounds relaxed on the line as he chats with two colleagues about the "mega" view from his room, and how he's just come back from a drink at a nearby hotel where there's an incredible swimming pool.
Over the next 40 minutes, the group appear to touch upon highly sensitive military issues, including the ongoing debate over whether Germany should send Taurus cruise missiles to Ukraine.
The four participants discussed what targets German-made Taurus missiles could potentially hit if Chancellor Olaf Scholz ever allowed them to be sent to Kyiv - a contentious issue in Germany.
"You have to choose a certain kind of disguise for this disaster," says Mr Kiesewetter, who's also worked at the Nato military alliance and is a member of Germany's opposition conservative CDU party.
But German government figures find suggestions that they are somehow soft on Russia increasingly irritating, particularly because Berlin has donated more weapons aid to Ukraine than any other nation in Europe.
It's further exposed domestic divisions about whether to send Taurus missiles to Ukraine and prompted a wider discussion about the country's perceived defence and security weaknesses.
The original article contains 1,075 words, the summary contains 187 words. Saved 83%. I'm a bot and I'm open source!
Bad article
Should have used jitsi... It's free too!
view more: next βΊ