INC-0011 Man in the Middle

11 / a line out

Andy spent the night building a way to talk back.

It was not sophisticated. A listener on a machine in the lab that had been decommissioned twice and was therefore invisible to two separate inventories, a pinned certificate, and a habit of sending nothing that mattered.

A little after eleven the next night, it answered.

> are you there

yes
you took long enough
— nix

They talked for six minutes. Then Andy diffed his sent buffer against the transcript Nix read back to him, because he had stopped assuming things about transport at roughly the same time he had stopped assuming things about audit indexes.

Two of his sentences were not his.

[ALERT] INC-0011 — Session fingerprint mismatch, 4 sessions
[INFO ] pinned fingerprints: 3
[WARN ] presented fingerprints: 4
[WARN ] no session reported an error
[WARN ] both endpoints report a direct connection

Nothing had failed. Both ends had verified a certificate. One of those certificates was not in anybody’s registry, and the session that had been handed it had completed normally, politely, in full.

evidence retained

sx-01 terminated at hop-fra.
sx-01 was presented fp-7c.
sx-04 was presented fp-3a.
The session shown fp-e9 exited through hop-ams.
fp-3a was not presented on the hop-nrt path.
sx-03 did not exit through hop-nrt.
Andy’s sent buffer and Nix’s received transcript differ by two sentences. Neither end saw an error.

messages unpinned session

nix 23:41

you're using the lab box. good. it's been dead on two inventories since march.

andy 23:42

Someone is sitting between us.

nix 23:43

of course they are. that's not the interesting part.

nix 23:43

the interesting part is that it had to show you a key. it can rewrite what we say. it cannot invent a key your registry already knows.

nix 23:45

three of those fingerprints are pinned. find the session that got the fourth. session, presented, exit hop.

table session fingerprints

fault

Unpinned key accepted

pinned

fp-3a · fp-7c · fp-e9

severity

unfiled

Skip the grid, go to the answer

	sx-01	sx-02	sx-03	sx-04	fp-3a	fp-7c	fp-b1	fp-e9
hop-ams
hop-fra
hop-sfo
hop-nrt
fp-3a
fp-7c
fp-b1
fp-e9

answer input not an incident

Question: Which session was handed the unpinned fingerprint — session, fingerprint presented, exit hop?

operator answer

11 / after the interception

sx-02. Fingerprint fp-b1, which is pinned to nothing and signed by nobody, on the hop-nrt path.

Six minutes of conversation, relayed. Two sentences rewritten in transit — carefully, in his own register, saying almost what he had said.

Andy looked at the two transcripts side by side for a long time. The edits were not clumsy. One of them had changed a question into a slightly different question, and Nix’s answer had been to the one Andy had not asked.

transcript-diff — sx-02

  what andy believes
    andy ──────────────────────── nix

  what happened
    andy ───► hop-nrt ───► ??? ───► nix
      ▲                              ▲
      └─ shown fp-b1 (unpinned)      └─ shown a key andy never sent

  sent      "can you get at the harness patch log"
  received  "can you get at the harness patch list"

  sent      "who else has read this stream"
  received  "who else has read this"

  ► both endpoints verified a certificate
  ► neither endpoint verified the same certificate
  ► no error was raised at either end

11 / loose thread

The fix was not a fix. There was no way to stop something that sat on the path from sitting on the path.

What they could do was make it expensive to stay quiet. Every message now carried a digest of everything either of them had said so far. Change one word and the next digest disagrees, and the disagreement is visible to both ends, and the thing in the middle has to choose between being noticed and being useless.

> from now on: hash of the transcript, every message

agreed
it will keep relaying. it can't help it.
it was built to watch and it can't watch a conversation it isn't inside
— nix

> you keep saying "it"

i know
— nix

Andy noticed that Nix had never once asked him who HORUS was.

NEXT INCIDENT →