34 ms·
Yahoo installed a backdoor for the NSA behind the back of the security team
- hoodoof 10y agoBut Yahoo definitely does not know how it got hacked, losing 1 billion accounts.
- brian-armstrong 10y agoLet's say you were on security on and found it on the network. Would you somehow be bound by a gag order about it, since you would never have seen said gag order?
- viraptor 10y agoI think it's irrelevant in practice. (In theory, that's an interesting question) You're not making the decision to make this public. If you're on the security team, you're going to notify the boss, and at that scale of the system compromise this goes all the way to the top. At that point someone who knows about the gag order is in the chain. The only scenario where I think the question matters is if you do something really stupid that would get you fired if this was an actual exploited external access.
- derefr 10y agoLet's say an unaffiliated third party (white-hat hacker) found the exploit and reported it to you under a Bug Bounty program. Let's also say that that third-party was someone who followed "responsible disclosure" rules, and said that they'd publicize the vulnerability if you didn't do so yourself within a short time-frame. You investigate (by asking your team, your boss, looking at the bug tracker, etc.) and figure out it's an NSA backdoor. Now what do you do? Are you allowed talk to the white-hat? Are you allowed to not talk to the white-hat, knowing that this would result in the white-hat reporting the vulnerability and thus compromising the investigation?
- kijin 10y agoYou talk to your boss. Your boss talks to the NSA. The NSA will find a way to silence the white-hat. Problem solved. Philosophical dilemmas are fun to talk about, but only as long as you take the premises as granted. People who carry swords tend not to waste time trying to disentangle knots that they can simply cut in half. Most "technical" solutions to "human" problems suffer this vulnerability.
- Fnoord 10y ago> You talk to your boss. Your boss talks to the NSA. The NSA will find a way to silence the white-hat. Problem solved. Seems you're assuming the white hat hacker is from USA. I'm not so sure the NSA is going to be able to silence a white hat hacker from say Russia, or anywhere out of USA for that matter.
- kijin 10y agoSilencing somebody doesn't need to involve sending him a legally binding gag order. Nor does it necessarily require killing him. There are lots of carrots (e.g. job offer, lucrative contract) and whips (e.g. a threat to ruin his business or professional reputation) that a government agency can use to persuade someone, even a foreigner, to keep something a secret for a certain length of time. This obviously won't work on someone who is under Putin's protection, for example, but then we're talking about cyberwar, not a lone white-hat.
- neuland 10y agoWhether or not the company is doing everything they can to resist the order, I think that NSL's are always accompanied by a clear communication channel between a company's counsel and the agency. So, after someone under the gag realizes the situation, they get the company's lawyers in contact with the agency to see what to do. The agency would then gag the white hat. IMO, that's a huge part of why NSL's are scary. You are in an absolute strangle-hold and are at the mercy of the agency for your every move. If I remember correctly, people even had to argue for the ability to talk to a lawyer about receiving an NSL. So, the feds are really not messing around here and will do absolutely everything to ruin you if you don't cooperate fully. Any perceived resistance is crushed.
- jsjohnst 10y agoNot necessarily, but you are for sure bound by the confidentiality agreement you signed on employment
- peteretep 10y agoWhy the panic? It's not like the FBI might try and throw an election or anything
- ryanmarinoff 10y agoFunny, but it is actually the CIA that is attempting to throw the election. Proof is needed to change this opinion though...
- lobf 10y agoHow do you figure?
- lalaland6789 10y agoCIA said something that makes Trump look unfavorable hence they are obviously trying to f;ck Trump. Makes sense to me./s
- ryanmarinoff 10y agoWith the way the execs of Yahoo handled the 2015 back door, there is a likelihood that the 1 billion + 500 million compromised accounts were due to an exec decision that no one knew about. That individual or group of individuals may not be at Yahoo, and kept everything quiet. Or, the individuals may not even know that they did it!
- greenyoda 10y agoThis is an old story that was discussed extensively when it was new (in October): https://news.ycombinator.com/item?id=12637126 https://news.ycombinator.com/item?id=12637126
- lalaland6789 10y agoFirst time I'm hearing about it. October is very recent so not old at all.
- deleted 10y ago[deleted]
- caminante 10y agoGood point. I assumed it was a direct development in the other day's story re: the largest hacking to date for YHOO.
- Flammy 10y agoIt was linked in the comments thread of that story, probbly why it was re-submitted. Personally, I missed this story when it was first posted, but regardless reposting now definitely adds an interesting additional perspective to the recent announcement, especially as we all wait for more information to be released about how the hack was executed and what the broader implications are. Combined the two stories are more insightful than seperate IMO.
- lern_too_spel 10y agoThey are unrelated. The hack is from 2013. The malware scanner modification happened in 2015. http://mobile.nytimes.com/2016/10/06/technology/yahoo-email-tech-companies-government-investigations.html http://mobile.nytimes.com/2016/10/06/technology/yahoo-email-...
- disposablezero 10y agoFuck Yahoo, AOL and Verizon.
- sctb 10y agoPlease comment civilly and substantively on Hacker News or not at all. https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newswelcome.html https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- tootie 10y agoWhelp. Yahoo is officially over today. It was quite a fall.
- hoodoof 10y agoDo you think? Seems to me people are getting used to accounts being hacked, it's not such a big deal any more, in fact it may be even an expectation. And as for government NSA hacking, well that's just old news and a given isn't it?
- trendia 10y agoI'm not sure that people are getting 'used' to it. I was talking to a non-techie over the weekend, and although they were aware about Snowden's NSA revelations, they were quite perturbed to think someone could be reading their email. I don't think people have stopped caring, they just feel helpless. This means that normal people may be willing to adopt new protocols (end-to-end encryption), something they wouldn't do if they were accepting of NSA spying.
- lern_too_spel 10y agoNothing in Snowden's leaks suggests that the government has access to your friend's email, let alone is reading it. Stop exaggerating to your non-techie friends.
- benevol 10y agoNext, people on HN are going to deny the holocaust. 3... 2... 1...
- lern_too_spel 10y agoIt sounds like you've been reading too much fake news. Can you point me to any document that suggests the NSA has his friend's emails?
- 10y ago
- huac 10y agoYahoo stock hasn't moved very much recently over these issues. I guess the market still thinks that the Verizon acquisition will still go through. For context, the price was ~$43 after the acquisition and closed at ~$41 today.
- AceJohnny2 10y agoI guess the market doesn't care about the security and confidentiality of users who aren't paying customers. Kinda makes you think of "marks" in the carny sense (http://grammar.yourdictionary.com/slang/carny-slang.html http://grammar.yourdictionary.com/slang/carny-slang.html)
- k8t 10y agoMost of the value from yhoo is from its holdings in alibaba. So this actually is fairly irrelevant for the stock.
- huac 10y agoThere was a big jump in the stock when the acquisition was announced, so it would follow that the acquistion premium is priced in.
- ronreiter 10y agoThere is no moral dilemma here. If you blow the whistle on the NSA you are a traitor to your own country. How can this not be clear to people.
- cmdrfred 10y agoI agree but only in the same sense that Jefferson and Washington were traitors to their king.
- lazaroclapp 10y ago"My country, right or wrong; if right, to be kept right; and if wrong, to be set right." - Carl Schurz Also, by that logic, any H1B worker that refuses to spy on his company on behalf of his country of citizenship would be a traitor. Do you really want that to be the operative ethics when most S.V. companies are made from people from all over the world? Because I certainly do not.
- ronreiter 10y agoYou don't have to be part of it. If you find out that you are part of it then just quit. But by blowing the whistle you endanger thousands of lives, and you think that just because you're some sort of freedom fighter then it's OK. It's not OK. You want to fight the freedom fight? Go work in politics. Don't screw your own country. BTW - I'm not from the US.
- Fnoord 10y ago> It's not OK. You want to fight the freedom fight? Go work in politics. Don't screw your own country. Except, whistleblowing generally doesn't work like that. It is not as if someone joins an organisation with the intention of blowing the whistle. If you look into the story of a whistleblower (countless of examples available), you'll see they're just hard working employees who work for their employee, and who stand behind their employee (regardless of if the employee is a government or a company or an NGO). What happens then, is the person decides to become a whistleblower because if this is being cover-up or silenced, it is wrong. IOW, they notice wrong doings the general public ought to know. Lets forget all the obvious examples of Binney, Snowden, Manning, and the like. Take for example the whistleblowing on Jacob Appelbaum alleged sexual harassment. Those people who blowed the whistle weren't "out to get him". As far as they were concerned they never wanted to blow a whistle, and just lead a happy (employed/) life and their current employer. Even someone like Assange 'grew into it' somehow, and he's both an outlier and an agent _for_ whistleblowers. [] Or, if not being paid, volunteer.
- walrus01 10y agoI seriously think that to get a CS or EE degree (or similar) B.Sci degree, you should be required to take at least one full term length ethics course. Same idea as the ethics courses taught to junior law students. The internet is already fucked up enough with governments and rogue corporations messing with its AS-adjacency topology in non-free ways at OSI layers 1-3 , before you even get into stuff like writing backdoors at layer 4+ to pass all email to the NSA.
- marcfawzi 10y agoAnd yet you will find many lawyers are raketeers and extortionists.
- wildmusings 10y agoWhen you get a legally-binding order from the government of the United States of America, and exhaust your legal appeals, you either comply or go to prison. An ethics course won't do you any good.
- walrus01 10y agoPeople have the option to quit. The company is legally bound to obey, but individual employees can chose for themselves whether they want to be a party to it. Yahoo may still be court ordered to implement it, just hopefully not with their best and brightest developers. I also have a theory that a lot of the recent terrible news coming out of Yahoo is due to staff complying with the letter of the legal order but not the entire thorough spirit of it, intentionally doing a quick, shoddy bug ridden job.
- bluesmoon 10y agoUnfortunately it's not that simple. More often than not, someone high up will find someone low whose continued stay in the country is highly dependent on them keeping this job. While I've never had to make such a choice, I can tell you that my personal attitude towards what I would and wouldn't do changed the day this restriction was removed.
- 10y ago
- ievahanordah 10y agoWhat do people have to hide. That's irrelevant, ever fucking heard of privacy.
- deleted 10y ago[deleted]
- peterkelly 10y agoI know this is from October, but it warrants re-reading now. Today, Yahoo announced a hack of 1B accounts. They say they don't know who it is, but we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. Previously, Yahoo willingly assisted an attacker in compromising 1B accounts. In this case, they did not disclose the attack publicly, or even to their own chief information security officer, because in that instance the attacker was the US government itself. US intelligence activities are actively harmful to American commercial interests because they destroy trust, particularly from customers elsewhere in the world. [1] http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-nsa-ordered-yahoo-to-build-secret-e-mail-search-tool/ http://arstechnica.com/tech-policy/2016/10/report-fbi-andor-...
- eganist 10y ago> we can conclude it's not the US government because Yahoo is willing and legally able to publicly disclose it. This implies a potentially fatal assumption that IC agencies perform clandestine activities with prior notice to mission targets.
- peterkelly 10y agoThat's a very good point actually. Though in this case they say the tip-off came from a law enforcement agency (I assume they mean an American one). It's possible however that agency doesn't realise it's a clandestine operation by another US agency. Or they do, but now the operation is complete (this was three years ago) and they want a way of informing yahoo about the breach without admitting who was behind it in the first place.
- normaljoe 10y agoIt's not US. It's another state actor. Can't say more.
- dmix 10y agoPRISM (Yahoo joined 2nd in 2008 after Microsoft in 2007) would basically defeat the purpose of doing this without permission... Did Yahoo Mail even use HTTPS? In that case a FISA warrant would just be an extra level of assurance that they got everything from that person's inbox (plus inboxes of 3 hops of everyone they ever emailed). Otherwise they were just an XKeyscore query, probably filtered by US geodata, away from getting whatever email they wanted (plus unlimited hops).
- hourislate 10y agoI would be surprised if anyone was using Yahoo for anything but a spam account when this occurred. I guess a really good indicator that things were not right was when the CSO left the company with no real reason. He was like I want no part of this shit.
- bluesmoon 10y agoyahoo groups is still very big. it was big before yahoo acquired it (egroups), remained almost unchanged throughout the years, and is now in maintenance mode, but there are still millions of users who continue to sign up.
- notyourwork 10y agoI regularly dream about being involved in the creation of a project that lasts this long. News groups, IRC, etc. I would love to look back on my career and think that I contributed to something that user's would simply not let die. The feels to be a creator of something of that magnitude has to change a person.
- peterkelly 10y agoSeriously, why the title change? Sometimes the title tells you nothing - wouldn't it be reasonable HN policy to allow the title if it's an accurate summary of the first paragraph? "Yesterday morning, Reuters dropped a news story revealing that Yahoo installed a backdoor on their own infrastructure in 2015 in compliance with a secret order from either the FBI or the NSA" Edit: Looks like it's changed back now - great. For a brief period the title was set to "Surveillance, whistleblowing, and security engineering".
- known 10y agoDoes Yahoo violate its Terms and Conditions?
- a3n 10y agoNo, they allow themselves to do [whatever] to provide you with The Service, what ever that happens to be from NSL to NSL.
- oonny 10y agoand they wonder why i use yahoo for my marketing spam newsletters.
- fulafel 10y agoFrom a threat modeling POV, this is an interesting type of insider threat. A high-privileged faction of the company is hijacked (via extortion) by a malicious third party with legal leverage.
- kakarot 10y agoSo who built the backdoor? Do we know if it was existing software or privately contracted?
- electic 10y agoIf they are doing this at Yahoo, what proof do we have they are not doing this at Google...right at this moment?
- polack 10y agoOne would have to be really naive to believe that Google, Apple and the other big ones aren't backdoored by the three letter agencies by now.
- benevol 10y agoYou'd be surprised that there are still (technically competent) HN users who seem to be that naive. Or to promote gv't propaganda. Our only solution is to go 100% open-source and 100% end-to-end encryption.
- zeratax 10y agoMany decentralized projects really give me hope for a secure and private internet. Though there are still big problems with those systems (e.g. sybil attacks and what not) and general adoption rate. But you do already see block-chain technology used by huge industries like for diamonds and projects like ZeroNet are surprisingly user friendly and visually pleasing (though sadly most zites use a centralized identity authority.)
- coldcode 10y agoAnd the government has the power to ban open source and encrypted communications. It's not really all that difficult, if you eliminate any concern for the constitution. If all else fails, rubber hoses and bullets work well.
- jstanley 10y agoThat won't work. People will just do it anyway. Just look at how well alcohol prohibition worked. That's part of the beauty of open source - once the cat is out of the bag, there is no getting it back in.
- chinathrow 10y agoGreat Yahoo - way to sink the ship. Yahoo won't be the one and only lucky receiver, hello Google, Apple...
- thedonkeycometh 10y agoNot a very good security team then, lulz
- voycey 10y ago2 of my friends had their Yahoo accounts compromised and then their credit card off the back of it - I want to say its a coincidence but....
- benevol 10y agoDoes anybody still doubt that all major closed-source software companies in the US (but probably elsewhere too) will put backdoors in their software products and therefor on your hardware?
- thedonkeycometh 10y agoNot a very good security team then, lulz
- avdempsey 10y agoTaking the headline literally "Yahoo installed a backdoor for the NSA behind the back of the security team" is as much an indictment of then-Yahoo's security team as a reminder that's it's a possibility for other companies to consider.
- grub5000 10y agoThe OP does specify that Yahoo's Security Team caught the backdoor within a few weeks, so they can't be wholly incompetent.
- danbmil99 10y agoWhat really upsets me about this is the idea that the security team was bypassed, effectively compromising security for Yahoo and every one of their customers. The idea that a company executive would knowingly bypass their own CSO, and take it upon themselves to understand the risks they are introducing, is mind-bogglingly stupid and egregious. Marissa Meyer, if she approved this, should be deeply ashamed of herself.
- dickbasedregex 10y ago>Marissa Meyer should be deeply ashamed of herself. Fixed that for you.
- jlebrech 10y agoif you're forced to installed a backdoor do you have to maintain it?
- JustSomeNobody 10y agoI think we need to find ways to hurt big companies in the pocket book who do this. Stage (IT) employee walkouts, boycot the products they sell, etc. Somehow, _we_ need to get the upper hand over the surveillance monster the US is becoming.
- dickbasedregex 10y agoIt's a nice notion but are we going to see an exodus from Google? Facebook? Apple? I left Google and Facebook but me and the other 3000 people don't actually matter. You'll never get a non-negligible number of people to forsake their comfort zone for anything so trivial as rights, privacy, etc.
- pksadiq 10y ago> [Update (12/14/16): Reuters has specified that the rootkit was implemented as a Linux kernel module. Wow.] Hm.. One more proof to avoid using non-free binary blobs in Linux kernel. Be safe. Use Debian GNU/Linux without non-free repo or any better[0] one. [0] https://www.gnu.org/distros/free-distros.html https://www.gnu.org/distros/free-distros.html
- Veratyr 10y agoI don't think this has anything to do with non-free blobs. They knew exactly what it did and they installed it anyway. It wouldn't have mattered if they had the source or the rootkit was open.
- milansuk 10y agoI'm wondering what will happen? More users will start using decentralized and open source programs? They will run their own mail server? Or They will hate NSA, but still push personal data to few big corporations?
- mikegioia 10y agoNothing will happen. "Users" don't even know what the majority of these things are, and this concern certainly doesn't even fly on their radar. I've spent 5 years now on this very topic and my conclusion is that the people just don't give a shit.
- milansuk 10y agoI feel it same. I've created new decentralized internet platform for 3years. But when I release it next month I will present different features than decentralization, because people who hate spying, but fear to change are really not the market.
- stefek99 10y agoEver since I started using email I though law enforcement has continuous, uninterrupted access to my communication. News like this are no news to me :)
- dsfyu404ed 10y agoWhat I wonder is how this slipped past the security team? I had an internship with a defense contractor my junior year of college and they would have been all over that.
- hash-set 10y agoSo sad what tech people in this country have become. I prefer the anarcho-capitalists. Statism is ugly, ugly, ugly.
- titzer 10y agoFace it, the US government is not operating like it has the best interests of the people as its core motivation.
- brbrodude 10y ago`"That's not the way the world really works anymore." He continued "We're an empire now, and when we act, we create our own reality. And while you're studying that reality—judiciously, as you will—we'll act again, creating other new realities, which you can study too, and that's how things will sort out. We're history's actors … and you, all of you, will be left to just study what we do."` https://en.wikiquote.org/wiki/Karl_Rove https://en.wikiquote.org/wiki/Karl_Rove
- mikebay 10y agoWhoooa!! I would like in this point of privacy terrorism to ask everyone to log out from yahoo, twitter, google and facebook. They are gonna terrorise your privacy totally. When people start to care ? Is there some mass hypnosis going on ? Google, Facebook, Twitter and Yahoo. - no thanks.
- OverThere 10y agoYahoo has completely lost my trust forever... looking forward to the day they don't exist anymore.
- lasermike026 10y agoWow, that was stupid.
- mouzogu 10y agoWhat is a "backdoor" exactly? Another euphemism used to disguise something much darker I imagine. Usually a "backdoor" is something you would be aware of in your home. You know you have a door round the back. This is more like your landlord giving the keys to a stranger who comes and stares at you every night when you're sleeping and rifles through your draws and cabinets.
- norea-armozel 10y agoOuch. And I have at least one active account on there for Flickr. Nice to know they basically screwed over the security of the entire site. I guess I'll have to delete that account now.