3 ms·

We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. T

We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this? https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-question-was-the-nsa-hacked.html https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...

bitJericho 10y ago
The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.
deleted 10y ago
[deleted]
cryptarch 10y ago
Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?
- TheSpiceIsLife 10y ago
  I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.
  - sillysaurus3 10y ago
    We probably need the NSA. It's their job to exploit computers the same way it's the job of the military to apply force. It's difficult to say that we can do without the NSA any more than we can do without a military. In that light, the context is to reduce the impact of the NSA's necessary goals. Higher up in the thread, it was claimed that one of the most feared branches of the intelligence arm of the most powerful government in the world was so incompetent that they had no idea who was behind these leaks, and that there was evidence to support this assertion. I have an open mind, so I was hoping to see this evidence.
    - noir_lord 10y ago
      > It's their job to exploit computers the same way it's the job of the military to apply force. That's one half of their job, the other half is to secure government infrastructure from exactly the type of attacks they use on other countries. The problem there is that it sets up an incredible tension since how do you get the message out about a 0-day in windows to protect your 'own' side without your opponents getting the same message. I've thought for years that the NSA doing both jobs is silly since one side will inevitably win that argument (as seems to be the case). It needs to be a separate agency concerned purely with securing government and infrastructure from external threats with a decent firewall between the two sides (and possibly an oversight clearing committee to keep an eye on what both sides are up to). Over here in the UK we have largely the same problem with GCHQ having a dual mandate.
      - JumpCrisscross 10y ago
        > how do you get the message out about a 0-day in windows American companies get disclosures, foreign companies do not.
        hiram112 10y ago
        What's an 'American' company these days? US companies like Oracle, MS, Google, etc. have offices all over the world. They also tend to use various visas to import 10% of their own US based staff (probably a much higher ratio of engineers) from foreign nations. The US has gotten very wealthy from offshoring, foreign talent, and technical exports, but it causes a massive problem when keeping secrets locally.
      - cryptarch 10y ago
        > how do you get the message out about a 0-day in windows Force-push a Windows 10 update? That seems like one of the few legitimate usecases of Win10 being a corporate botnet.
      - tastythrowaway2 10y ago
        I think the obvious answer here is to go full open-source on the infrastructure. if they can afford to pay engineers to craft exploits, the can afford to pay engineers to fix them.
LeeHwang 10y ago
Its impossible now. Wikileaks showed the the cia goes into incredible detail to frame other countries. https://www.wired.com/2017/03/wikileaks-cia-dump-gives-russian-hacking-deniers-perfect-ammo/ https://www.wired.com/2017/03/wikileaks-cia-dump-gives-russi... http://thehackernews.com/2017/03/cia-marble-framework.html http://thehackernews.com/2017/03/cia-marble-framework.html I also bet that other countries do the exact same thing, probably even more likely considering the "marble project" source code is leaked. http://www.dailymail.co.uk/news/article-4427452/CIA-launches-manhunt-Wikileaks-leaker.html http://www.dailymail.co.uk/news/article-4427452/CIA-launches... Also it looks like a hunt for the internal leaker has begun. Whatever the source, We do still have to deal with the content of the leaks. The content is what we need to take a very close look at begin to increase and harden our security. Especially senior developers and software architects.
- ryanlol 10y ago
  >Wikileaks showed the the cia goes into incredible detail to frame other countries. No.
- willstrafach 10y ago
  Wikileaks has not shown this, although it seems to be the narrative which some wanted to push regarding the Marble leak. > We do still have to deal with the content of the leaks. Check out the actual content of the Marble leak. You will find that there is no evidence of your claim. It has been mentioned countless times that the foreign languages seen in the code are gibberish when translated, and are evidently there for testing purposes.
jacquesm 10y ago
Well, that means that if they decided not to leak them they would still be known to others. So that's an excellent argument for disclosing to vendors anything that you do find if you're serious about this whole national security thing. What it shows instead is that the NSA and other agencies could not care less about national security as long as they get to hack interesting targets elsewhere.
thraway2016 10y ago
The article you linked only has a single citation for the Russian attribution, which is a Snowden quote: “circumstantial evidence and conventional wisdom indicates Russian responsibility” Is there any evidence other than Snowden's speculation?

bitJericho 10y ago

The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.

deleted 10y ago

[deleted]

cryptarch 10y ago

Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?

TheSpiceIsLife 10y ago
I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.
- sillysaurus3 10y ago
  We probably need the NSA. It's their job to exploit computers the same way it's the job of the military to apply force. It's difficult to say that we can do without the NSA any more than we can do without a military. In that light, the context is to reduce the impact of the NSA's necessary goals. Higher up in the thread, it was claimed that one of the most feared branches of the intelligence arm of the most powerful government in the world was so incompetent that they had no idea who was behind these leaks, and that there was evidence to support this assertion. I have an open mind, so I was hoping to see this evidence.
  - noir_lord 10y ago
    > It's their job to exploit computers the same way it's the job of the military to apply force. That's one half of their job, the other half is to secure government infrastructure from exactly the type of attacks they use on other countries. The problem there is that it sets up an incredible tension since how do you get the message out about a 0-day in windows to protect your 'own' side without your opponents getting the same message. I've thought for years that the NSA doing both jobs is silly since one side will inevitably win that argument (as seems to be the case). It needs to be a separate agency concerned purely with securing government and infrastructure from external threats with a decent firewall between the two sides (and possibly an oversight clearing committee to keep an eye on what both sides are up to). Over here in the UK we have largely the same problem with GCHQ having a dual mandate.
    - JumpCrisscross 10y ago
      > how do you get the message out about a 0-day in windows American companies get disclosures, foreign companies do not.
      - hiram112 10y ago
        What's an 'American' company these days? US companies like Oracle, MS, Google, etc. have offices all over the world. They also tend to use various visas to import 10% of their own US based staff (probably a much higher ratio of engineers) from foreign nations. The US has gotten very wealthy from offshoring, foreign talent, and technical exports, but it causes a massive problem when keeping secrets locally.
    - cryptarch 10y ago
      > how do you get the message out about a 0-day in windows Force-push a Windows 10 update? That seems like one of the few legitimate usecases of Win10 being a corporate botnet.
    - tastythrowaway2 10y ago
      I think the obvious answer here is to go full open-source on the infrastructure. if they can afford to pay engineers to craft exploits, the can afford to pay engineers to fix them.

LeeHwang 10y ago

Its impossible now. Wikileaks showed the the cia goes into incredible detail to frame other countries. https://www.wired.com/2017/03/wikileaks-cia-dump-gives-russian-hacking-deniers-perfect-ammo/ https://www.wired.com/2017/03/wikileaks-cia-dump-gives-russi... http://thehackernews.com/2017/03/cia-marble-framework.html http://thehackernews.com/2017/03/cia-marble-framework.html I also bet that other countries do the exact same thing, probably even more likely considering the "marble project" source code is leaked. http://www.dailymail.co.uk/news/article-4427452/CIA-launches-manhunt-Wikileaks-leaker.html http://www.dailymail.co.uk/news/article-4427452/CIA-launches... Also it looks like a hunt for the internal leaker has begun. Whatever the source, We do still have to deal with the content of the leaks. The content is what we need to take a very close look at begin to increase and harden our security. Especially senior developers and software architects.

ryanlol 10y ago
>Wikileaks showed the the cia goes into incredible detail to frame other countries. No.
willstrafach 10y ago
Wikileaks has not shown this, although it seems to be the narrative which some wanted to push regarding the Marble leak. > We do still have to deal with the content of the leaks. Check out the actual content of the Marble leak. You will find that there is no evidence of your claim. It has been mentioned countless times that the foreign languages seen in the code are gibberish when translated, and are evidently there for testing purposes.

jacquesm 10y ago

Well, that means that if they decided not to leak them they would still be known to others. So that's an excellent argument for disclosing to vendors anything that you do find if you're serious about this whole national security thing. What it shows instead is that the NSA and other agencies could not care less about national security as long as they get to hack interesting targets elsewhere.

thraway2016 10y ago

The article you linked only has a single citation for the Russian attribution, which is a Snowden quote: “circumstantial evidence and conventional wisdom indicates Russian responsibility” Is there any evidence other than Snowden's speculation?