7 ms·

Some at the NSA is having a bad day reading this.

zellyn 10y ago
The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?
- sitkack 10y ago
  Now they are in the SMC and the secure enclave.
  - Aelinsaar 10y ago
    As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?
- Jerry2 10y ago
  >Five years is a pretty good run. For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.
- jandrese 10y ago
  Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work. If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.
  - breadtk 10y ago
    There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/ https://www.wired.com/2015/02/nsa-firmware-hacking/
pjc50 10y ago
Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.
- dragonwriter 10y ago
  There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.
  - mtgx 10y ago
    If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens. One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too. Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year. But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press. The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?
- drzaiusapelord 10y ago
  Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well. If you want regulation, that's Congress and POTUS, not the NSA.
- peterwwillis 10y ago
  You have to research and implement new attacks to design its defense.
jonathankoren 10y ago
Or they're saying, "Oh? That old thing?" We honestly don't know. It might not even be the NSA.

The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?

sitkack 10y ago
Now they are in the SMC and the secure enclave.
- Aelinsaar 10y ago
  As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?
Jerry2 10y ago
>Five years is a pretty good run. For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.
jandrese 10y ago
Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work. If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.
- breadtk 10y ago
  There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/ https://www.wired.com/2015/02/nsa-firmware-hacking/

pjc50 10y ago

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

dragonwriter 10y ago
There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.
- mtgx 10y ago
  If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens. One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too. Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year. But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press. The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?
drzaiusapelord 10y ago
Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well. If you want regulation, that's Congress and POTUS, not the NSA.
peterwwillis 10y ago
You have to research and implement new attacks to design its defense.

jonathankoren 10y ago

Or they're saying, "Oh? That old thing?" We honestly don't know. It might not even be the NSA.