27 ms·
His complete post (just in case) original 4:40 AM - 16 Aug 2016 from @Snowden: The hack of an NSA malware staging server is not unprecedented, but the publicat
by imglorp 10y ago
His complete post (just in case) original 4:40 AM - 16 Aug 2016 from @Snowden:
The hack of an NSA malware staging server is not unprecedented, but the publication of the take is. Here's what you need to know: (1/x)
1) NSA traces and targets malware C2 servers in a practice called Counter Computer Network Exploitation, or CCNE. So do our rivals.
2) NSA is often lurking undetected for years on the C2 and ORBs (proxy hops) of state hackers. This is how we follow their operations.
3) This is how we steal their rivals' hacking tools and reverse-engineer them to create "fingerprints" to help us detect them in the future.
4) Here's where it gets interesting: the NSA is not made of magic. Our rivals do the same thing to us -- and occasionally succeed.
5) Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy.
6) What's new? NSA malware staging servers getting hacked by a rival is not new. A rival publicly demonstrating they have done so is.
7) Why did they do it? No one knows, but I suspect this is more diplomacy than intelligence, related to the escalation around the DNC hack.
8) Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant:
9) This leak is likely a warning that someone can prove US responsibility for any attacks that originated from this malware server.
10) That could have significant foreign policy consequences. Particularly if any of those operations targeted US allies.
11) Particularly if any of those operations targeted elections.
12) Accordingly, this may be an effort to influence the calculus of decision-makers wondering how sharply to respond to the DNC hacks.
13) TL;DR: This leak looks like a somebody sending a message that an escalation in the attribution game could get messy fast.
Bonus: When I came forward, NSA would have migrated offensive operations to new servers as a precaution - it's cheap and easy. So? So...
The undetected hacker squatting on this NSA server lost access in June 2013. Rare public data point on the positive results of the leak.
You're welcome, @NSAGov. Lots of love.
- irishcoffee 10y ago> 5) Knowing this, NSA's hackers (TAO) are told not to leave their hack tools ("binaries") on the server after an op. But people get lazy. I know enough to say that this sentence reveals a lot about what snowden knows, and what he doesn't. Mostly the latter. He doesn't seem to understand the context and meaning of acronyms he uses.
- jmnicolas 10y agoI know enough to say that an anonymous comment on the internet pretending to know about NSA procedures & jargon is not worth much especially when said comment is attacking someone we know for sure had access to the NSA.
- irishcoffee 10y agoAlright bud. I don't have a facebook, twitter, instagram, or any of that other stuff, so I'm not sure how to refute your claim of anonymous. I can say that anonymous hostile replies sure don't do much to further the conversation. What do they say, something about pots and kettles?
- Someone1234 10y agoA year ago you said you don't work for the NSA or DoD but know one person who does: https://news.ycombinator.com/item?id=9297990 https://news.ycombinator.com/item?id=9297990 Are you seriously expecting us to believe that your friend is telling you how the NSA is internally structured and how sensitive foreign operation intelligence programs work? Plus in another comment of yours you claimed to know how General Atomics MQ-1C Gray Eagle worked behind the scenes but when asked to post more info you never did. https://news.ycombinator.com/item?id=10954248 https://news.ycombinator.com/item?id=10954248 So you're seemingly a Linux admin, but know tons about the inner workings of both military contractors, the DoD, and NSA from your single friend? Seems uhh a stretch, let's just say that.
- runjake 10y ago> Plus in another comment of yours you claimed to know how General Atomics MQ-1C Gray Eagle He spelled it "Grey Eagle". It's unlikely one can actually speak "professionally" about a program when they can't spell it correctly. If you're part of the program, you're seeing/typing/writing the name "Gray Eagle" day in/day out.
- 10y ago
- eeeeeeeeeeeee 10y agoThank you for summarizing that. As others have commented, I wish Snowden would simply blog about this sort of thing. Twitter is frustrating to digest for any insightful commentary that is on the longer side.
- imglorp 10y agoYeah I don't understand why people don't just blog and be done with it, without all the formatting gredue. Then, you can just post a link on your twitter and say "hey, see my new blog post".
- Declanomous 10y agoIf HN and Reddit are any indication, if you post a link to a blog post, people will respond without reading it. People don't like switching domains, especially if they are browsing from an app. (Myself included)
- cloverich 10y agoSure but that's not just being lazy, its also a learned habit. There's a great deal of blog posts (like most writing in general) that is 5% information and 95% fluff. Sometimes you want the art, sometimes (esp. the engineering mindset) you just want the information. Skipping to comments frequently yields this, often with bonus comments like "I'm an actual expert and that post is very innaccurate".
- majewsky 10y agoThis. I frequently find myself skimming over HN comments on a submission before reading the article, because it provides a hint at whether reading the submission is actually worth my time.
- josephb 10y agoOr in this case, the HN comments actually provide a more complete article/summary :-)
- pjc50 10y agoSo this seems to be the "Dr Strangelove" scenario playing out, but with (fortunately) exploits rather than nuclear weapons. It sounds like many countries have other significant exploits into other countries, but this isn't "admitted"; it's not an unignorable public fact (+). The Russian destabilisation plan is to get Western countries to see NSA attacks on them and lose trust in the US - plus an attack on the concept of democracy by getting enough people to lose faith in the US election. (+) "unignorable public fact" is a clunky way of expressing it, but I mean something that you can bring up in a news report and politicians discuss what the appropriate reaction is, rather than challenging the fact itself. This is getting increasingly rare.
- balabaster 10y agoIt takes Russia pointing this out to make us lose trust in the U.S.? I think the U.S. has done this all on their own. Snowden was just the latest whistleblower showing the world they can't be trusted. There were others before him, but it got swept under the rug. We all know the U.S. election system is flawed to a point of being broken and thus democracy as we like to believe it's supposed to work doesn't even exist. But everyone just accepts that's the way it is and carries on with life because "at least it's not North Korea." If you hadn't already lost faith in the U.S. election system years ago, then you've got your head in the sand. It might be a hard pill to swallow, but I think if Russia's plan is to make the U.S. wake up and smell the coffee, they're actually doing the U.S. people a huge favour.
- altcognito 10y ago> We all know rolls eyes, adjust your tinfoil hat. Look, even if you believe that dark, unseen forces control the world using the US as a conduit - it would appear that the world has been the better for it. Given a choice of world management between Russian and US in this regard, the choice is pretty straightforward. People who complain about Europe, the US and the general Western alliances management of the world are selling a pretty ugly alternative.
- 794CD01 10y ago
- ffggvv 10y agoLinkable version https://typed.pw/a/1333 https://typed.pw/a/1333
- grandalf 10y agoThere is an interesting story and for some reason HN's top comments have to do with people being annoyed he tweeted rather than blogged. Let's hope some additional voting improves the s/n ratio of this thread, and the useless comments (including this one) disappear.