7 ms·

I think it's a fairly safe bet that they did, and I'll explain why I believe this. 1. The NSA has access to more info on both good crypto and broken crypto 2.

by rnovak 11y ago

I think it's a fairly safe bet that they did, and I'll explain why I believe this. 1. The NSA has access to more info on both good crypto and broken crypto 2. Hacking Team's software & infrastructure were clearly vulnerable, otherwise they wouldn't have been hacked 3. Leaked docs show that NSA hacks everyone they possibly can, to get as much information as they possibly can. It's really not a big leap to assume that NSA infiltrated Hacking Team's infrastructure, if anything I would think it's harder to believe they wouldn't have. So if some Joe Schmoe broke into Hacking Team's system, I think it's pretty reasonable to assume that NSA did as well But just so I can understand what you're saying, why do you think it's a big assumption? Edit: Formating.

codezero 11y ago
Thanks for this, I agree it makes sense that they would have, I was just a bit disappointed that Bruce didn't enumerate any of this in his post. In fairness, all of this stuff is probably "duh" to him, and his normal audience, but it's not so obvious to everyone. Here's another thought: what if the NSA hacked Hacking Team, and they were also the ones to release all the data publicly. Re: #3 – do you have any links to that info? (I'm not challenging you to prove what you said, I'm just curious, if you don't have anything readily available, I'll Google search like a good Internet commenter :))
- rnovak 11y ago
  I think it would be hard to go through everything, but off the top of my head: https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH0127/fe6ee959.dir/doc.pdf https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/... Quote: For the past decade, NSA has lead an aggressive, multi-pronged effort to break widely used Internet encryption technologies Their Motto: "We penetrate targets' defences."
  - codezero 11y ago
    Thanks a bunch.
  - PhantomGremlin 11y ago
    "We penetrate targets' defences." That would more likely be a GCHQ or MI5 or MI6 motto than an NSA motto. A quick bit of Googling finds that the "PTD" in the slides refers to GCHQ's Penetration Targeting Defences unit. So it's their motto. Which explains the spelling.
- rudolf0 11y ago
  It is a bit odd that Schneier was stating it as an obvious fact despite no evidence. Of course, the NSA had and has great incentive to compromise them, as well as the ability to do so, but it's still an empty claim (even if it's probably a true one).
  - rnovak 11y ago
    Keep in mind also that I think he has access to more documents than we have. He made this statement a while back[1]: I am reviewing some of the documents Snowden has provided to the Guardian. Because of the delicate nature of this, I cannot comment on what I have seen. [1]http://www.technologyreview.com/news/519336/bruce-schneier-nsa-spying-is-making-us-less-safe/ http://www.technologyreview.com/news/519336/bruce-schneier-n...
- tptacek 11y ago
  For whatever it's worth: I do not believe --- and this is an opinion I think is shared by lots of people in my field --- that Scheier has any special insight into the software and network exploitation capabilities of NSA. Schneier is a writer first, then a policy guy next, then an academic/standards-group cryptographer. Information security is a huge field with lots of subfields, and nobody specializes in all of them. My take on this post on his blog is that it's probably a stretch for him to be analyzing the Hacking Team story in any depth.
  - nitrogen 11y ago
    Didn't Schneier have access to the Snowden docs, though?
tomphoolery 11y ago
It's an assumption to me, simply because there were no facts or evidence presented. This is purely speculation based on what Bruce thinks the NSA might have done. I wouldn't be surprised if it turns out the NSA had breached them prior to this, though.
tptacek 11y ago
For probably more than 95% of the Fortune 500, vulnerability intelligence that is years out of date is more than sufficient to own up those firms' entire enterprise networks. The half-life of most software vulnerabilities is long. Simple IT problems like inventory remain unsolved in the real world. So the same logic suggests that NSA has owned up every company of any real size in the world. Could NSA do that? Absolutely yes. Did they? I doubt it. I do not see how NSA secures a single extra headcount by illicitly hacking every US and/or European company, and securing additional headcount is literally the core mission of NSA.
- rnovak 11y ago
  I think this discussion could get convoluted really quickly, because I bet 100% of the companies in the Fortune 500 have a different definition of what their "enterprise" network consists of, and how it's organized. I can say that I used to work for one, and our departments' network was literally air gapped (not joking). Internal systems could not reach out, and no one could reach in. It was impossible for us to work remotely, because even a VPN wasn't set up. There was no physical connectivity. But there's a difference between Hacking Team and every company on the Fortune 500: Hacking Team was in the Exploit business, they literally made money selling weaponized exploits to US enemies, and possibly allies. If anything, I think that's literally the NSA's directive in collecting foreign intelligence. Meaning, I believe if there was one foreign business that the NSA would spy on (and lets face it, I don't know that many), I think Hacking Team would absolutely be at the top of their list, purely for logical reasons. But.....I also completely admit that my statement was an assumption, a "bet". I'm not guaranteeing anything, and I really don't care. I'm just over here, arm-chair quarterbacking this shit, haha.
  - tptacek 11y ago
    I've done in the life immediately previous to my current one a fair bit of enterprise netpen work, and I have never seen a large enterprise network that had anything effectively airgapped. Getting onto a single desktop, in my experience, is virtually a gameover guarantee for any reasonable definition of "gameover".
NullCharacter 11y ago
> But just so I can understand what you're saying, why do you think it's a big assumption? Are you serious? Because there's no proof or mention of it anywhere. You're making an assumption based on literally nothing more than "well obviously, based on what I've read on the Internet, they could have done it so they must have". You're bending facts to fit a worldview, something I'm sure you yourself detest elsewhere in life. This is like Russell's Teapot but for the NSA. You're shifting the burden of proof to someone who now has to prove a negative.
- a3n 11y ago
  There's no proof or mention that they didn't. There never will be, ever. Yet we have to make decisions, even in the absence of evidence pro or con. Given that they don't disclose "wittingly" what they do, given their mission, and given what appears to be their interpretation of their mission as revealed by Snowden and others, we have to assume the "worst" within the realm of possibility. They did it, until they show me otherwise.
  - codezero 11y ago
    This is another point: the NSA really wants everyone to think they can, and have penetrated everything. It bolsters their image if people make these assumptions. This is one of the reasons I try not to assume the worst, especially when that's what they want you to do :)
  - deelowe 11y ago
    Let's remove the hyperbole and call a spade a spade. So, you want them to prove a negative? Just trying to be clear.
    - rnovak 11y ago
      They haven't even denied breaking into the HT Network. Should they be accused, would they? I bet a dime-to-a-dollar that should they be accused, they'd release a non-statement to the press: "We cannot comment on...."

by rnovak 11y ago

codezero 11y ago

Thanks for this, I agree it makes sense that they would have, I was just a bit disappointed that Bruce didn't enumerate any of this in his post. In fairness, all of this stuff is probably "duh" to him, and his normal audience, but it's not so obvious to everyone. Here's another thought: what if the NSA hacked Hacking Team, and they were also the ones to release all the data publicly. Re: #3 – do you have any links to that info? (I'm not challenging you to prove what you said, I'm just curious, if you don't have anything readily available, I'll Google search like a good Internet commenter :))

rnovak 11y ago
I think it would be hard to go through everything, but off the top of my head: https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/index/assoc/HASH0127/fe6ee959.dir/doc.pdf https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/... Quote: For the past decade, NSA has lead an aggressive, multi-pronged effort to break widely used Internet encryption technologies Their Motto: "We penetrate targets' defences."
- codezero 11y ago
  Thanks a bunch.
- PhantomGremlin 11y ago
  "We penetrate targets' defences." That would more likely be a GCHQ or MI5 or MI6 motto than an NSA motto. A quick bit of Googling finds that the "PTD" in the slides refers to GCHQ's Penetration Targeting Defences unit. So it's their motto. Which explains the spelling.
rudolf0 11y ago
It is a bit odd that Schneier was stating it as an obvious fact despite no evidence. Of course, the NSA had and has great incentive to compromise them, as well as the ability to do so, but it's still an empty claim (even if it's probably a true one).
- rnovak 11y ago
  Keep in mind also that I think he has access to more documents than we have. He made this statement a while back[1]: I am reviewing some of the documents Snowden has provided to the Guardian. Because of the delicate nature of this, I cannot comment on what I have seen. [1]http://www.technologyreview.com/news/519336/bruce-schneier-nsa-spying-is-making-us-less-safe/ http://www.technologyreview.com/news/519336/bruce-schneier-n...
tptacek 11y ago
For whatever it's worth: I do not believe --- and this is an opinion I think is shared by lots of people in my field --- that Scheier has any special insight into the software and network exploitation capabilities of NSA. Schneier is a writer first, then a policy guy next, then an academic/standards-group cryptographer. Information security is a huge field with lots of subfields, and nobody specializes in all of them. My take on this post on his blog is that it's probably a stretch for him to be analyzing the Hacking Team story in any depth.
- nitrogen 11y ago
  Didn't Schneier have access to the Snowden docs, though?

tomphoolery 11y ago

It's an assumption to me, simply because there were no facts or evidence presented. This is purely speculation based on what Bruce thinks the NSA might have done. I wouldn't be surprised if it turns out the NSA had breached them prior to this, though.

tptacek 11y ago

For probably more than 95% of the Fortune 500, vulnerability intelligence that is years out of date is more than sufficient to own up those firms' entire enterprise networks. The half-life of most software vulnerabilities is long. Simple IT problems like inventory remain unsolved in the real world. So the same logic suggests that NSA has owned up every company of any real size in the world. Could NSA do that? Absolutely yes. Did they? I doubt it. I do not see how NSA secures a single extra headcount by illicitly hacking every US and/or European company, and securing additional headcount is literally the core mission of NSA.

rnovak 11y ago
I think this discussion could get convoluted really quickly, because I bet 100% of the companies in the Fortune 500 have a different definition of what their "enterprise" network consists of, and how it's organized. I can say that I used to work for one, and our departments' network was literally air gapped (not joking). Internal systems could not reach out, and no one could reach in. It was impossible for us to work remotely, because even a VPN wasn't set up. There was no physical connectivity. But there's a difference between Hacking Team and every company on the Fortune 500: Hacking Team was in the Exploit business, they literally made money selling weaponized exploits to US enemies, and possibly allies. If anything, I think that's literally the NSA's directive in collecting foreign intelligence. Meaning, I believe if there was one foreign business that the NSA would spy on (and lets face it, I don't know that many), I think Hacking Team would absolutely be at the top of their list, purely for logical reasons. But.....I also completely admit that my statement was an assumption, a "bet". I'm not guaranteeing anything, and I really don't care. I'm just over here, arm-chair quarterbacking this shit, haha.
- tptacek 11y ago
  I've done in the life immediately previous to my current one a fair bit of enterprise netpen work, and I have never seen a large enterprise network that had anything effectively airgapped. Getting onto a single desktop, in my experience, is virtually a gameover guarantee for any reasonable definition of "gameover".

NullCharacter 11y ago

> But just so I can understand what you're saying, why do you think it's a big assumption? Are you serious? Because there's no proof or mention of it anywhere. You're making an assumption based on literally nothing more than "well obviously, based on what I've read on the Internet, they could have done it so they must have". You're bending facts to fit a worldview, something I'm sure you yourself detest elsewhere in life. This is like Russell's Teapot but for the NSA. You're shifting the burden of proof to someone who now has to prove a negative.

a3n 11y ago
There's no proof or mention that they didn't. There never will be, ever. Yet we have to make decisions, even in the absence of evidence pro or con. Given that they don't disclose "wittingly" what they do, given their mission, and given what appears to be their interpretation of their mission as revealed by Snowden and others, we have to assume the "worst" within the realm of possibility. They did it, until they show me otherwise.
- codezero 11y ago
  This is another point: the NSA really wants everyone to think they can, and have penetrated everything. It bolsters their image if people make these assumptions. This is one of the reasons I try not to assume the worst, especially when that's what they want you to do :)
- deelowe 11y ago
  Let's remove the hyperbole and call a spade a spade. So, you want them to prove a negative? Just trying to be clear.
  - rnovak 11y ago
    They haven't even denied breaking into the HT Network. Should they be accused, would they? I bet a dime-to-a-dollar that should they be accused, they'd release a non-statement to the press: "We cannot comment on...."