3 ms·

What doesn't make sense about the staging server idea, which seems to mean a command and control server, is why there would be a bunch of different tools for un

by guelo 10y ago

What doesn't make sense about the staging server idea, which seems to mean a command and control server, is why there would be a bunch of different tools for unrelated exploits on the same server.

EvanAnderson 10y ago
I don't think an operator just dumping a large cache of tools and leaving it behind is far-fetched. People are lazy and make mistakes.
rdtsc 10y ago
Because it is easy to automate?
etjossem 10y ago
Snowden himself talks about this. His comments should be required reading for anyone in this thread: https://twitter.com/Snowden/status/765514347196084224 https://twitter.com/Snowden/status/765514347196084224
- guelo 10y ago
  People get lazy and upload a bunch of highly prized top secret "keys to the kingdom" at once. Seems like the opposite of "Tailored Access".
  - etjossem 10y ago
    Conjecture: this is done via automated scripts that check for vulnerabilities and then execute the appropriate exploits on them, a la Metasploit. It's a comprehensive binary (or a few of them) that is supposed to be deleted when the work is done. :P
  - tptacek 10y ago
    What do you think "tailored access" is? Look at some of the better known former NSA hacking-division people in industry: they were all at NSA in their early 20s. Then look at the unbelievably shoddy quality of these tools. Are you arguing also that they might themselves not be part of NSA's repertoire? Because I could make the same "opposite of tailored" argument about the tools themselves.
    - guelo 10y ago
      I meant tailored access literally. I assume that the name "Tailored Access" comes from the idea that access is tailored, i.e. custom fit for the specific task at hand.
      - tptacek 10y ago
        It is, in the sense that it's not indiscriminately owning up every vulnerable host on the Internet the way a botnet operator would.
tptacek 10y ago
A staging server isn't a C&C server. Anyone who's ever broken into sites as a teenager or done pentesting for their career understands the concept: it's a shell on a server unrelated to you or your business, which you can log into from anywhere, and on which all your tools are built. You typically don't run your exploits from your own machine, both because you don't want a single network hop between you and your target, and because your tools may be inconvenient to run on your own machine.

by guelo 10y ago

What doesn't make sense about the staging server idea, which seems to mean a command and control server, is why there would be a bunch of different tools for unrelated exploits on the same server.

EvanAnderson 10y ago

I don't think an operator just dumping a large cache of tools and leaving it behind is far-fetched. People are lazy and make mistakes.

rdtsc 10y ago

Because it is easy to automate?

etjossem 10y ago

Snowden himself talks about this. His comments should be required reading for anyone in this thread: https://twitter.com/Snowden/status/765514347196084224 https://twitter.com/Snowden/status/765514347196084224

guelo 10y ago
People get lazy and upload a bunch of highly prized top secret "keys to the kingdom" at once. Seems like the opposite of "Tailored Access".
- etjossem 10y ago
  Conjecture: this is done via automated scripts that check for vulnerabilities and then execute the appropriate exploits on them, a la Metasploit. It's a comprehensive binary (or a few of them) that is supposed to be deleted when the work is done. :P
- tptacek 10y ago
  What do you think "tailored access" is? Look at some of the better known former NSA hacking-division people in industry: they were all at NSA in their early 20s. Then look at the unbelievably shoddy quality of these tools. Are you arguing also that they might themselves not be part of NSA's repertoire? Because I could make the same "opposite of tailored" argument about the tools themselves.
  - guelo 10y ago
    I meant tailored access literally. I assume that the name "Tailored Access" comes from the idea that access is tailored, i.e. custom fit for the specific task at hand.
    - tptacek 10y ago
      It is, in the sense that it's not indiscriminately owning up every vulnerable host on the Internet the way a botnet operator would.

tptacek 10y ago

A staging server isn't a C&C server. Anyone who's ever broken into sites as a teenager or done pentesting for their career understands the concept: it's a shell on a server unrelated to you or your business, which you can log into from anywhere, and on which all your tools are built. You typically don't run your exploits from your own machine, both because you don't want a single network hop between you and your target, and because your tools may be inconvenient to run on your own machine.