16 ms·

Security Breach and Spilled Secrets Have Shaken the N.S.A.

311 points by sgustard 9y ago

dmitrygr 9y ago
Good. Working as intended. They could use some slowing and shaking. > calling into question [..] its very value to national security Its what now?
- jhiska 9y ago
  When Americans rejoice that their own institutions are failing... it speaks to how they view their own government as an enemy. What are elections for in a representative democracy if the people elected don't represent the majority?
  - marssaxman 9y ago
    America would like to become a representative democracy when it grows up, but it has a long way to go yet.
sebcat 9y ago
> The agency regarded as the world’s leader in breaking into adversaries’ computer networks failed to protect its own. Those are two very different things. Focusing on one of them doesn't automatically benefit your efforts on the other.
- noobermin 9y ago
  The hope is that one's level of expertise in those areas are correlated.
- magicalist 9y ago
  > Focusing on one of them doesn't automatically benefit your efforts on the other. Uh, yeah. It isn't saying, "why did defense fail to automatically follow from offense?" It's literally just saying they failed to protect their own network, whether technically or organizationally.
- chiefalchemist 9y ago
  I don't think I see it that way. If you have the best then you should test your systems against being exploited by the best. And then harden from there. If you have the knowledge - knowing you're a prome target- why not double its value? As it is, their approach strikes me as one of arrogance, or (ironically) lack of intelligence about foreign threats, or worse...both. Both is not what we're paying them for.
- kevin_thibedeau 9y ago
  NSA is also responsible for establishing computer security practices for the rest of the government to follow. That they don't eat their own dogfood is damning.
  - meowface 9y ago
    They do typically eat their own dogfood when it comes to the security practices they propose. Dual_EC_DRBG is the big exception, but it's generally considered that most of the rest of their cryptographic standards are secure and suitable for public and government use. There are likely many conflicting departments and teams within NSA. Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.
    - retailbuyout 9y ago
      > Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk. Directly at odds. I don’t believe you should encourage anyone to trust known espionage. If it’s good advice, someone else will say it too you can trust independently.
  - fujiters 9y ago
    We should also keep in mind that finding an exploit or two is much easier than making sure that nothing on your network can be exploited. I wouldn't expect even the best in the world to be able to thwart all attacks.
larkeith 9y ago
Cause for celebration for all who support privacy and security.
- mirimir 9y ago
  I get the sentiment. But now the tools are available to more criminals. And that's hardly good, is it?
  - CyberSpyz 9y ago
    Security by obscurity? No it doesn't work. Good to know our systems aren't private.
  - JumpCrisscross 9y ago
    The bugs were always there.
  - FooHentai 9y ago
    Yes, it's great. Public availability of these tools means the exploits they leverage will be swiftly mitigated. They will be of no use to criminals, outside of the narrow window between disclosure and mitigation. Had the NSA acted with integrity and disclosed these vulnerabilities rather than hoarding them, that window would be even smaller.
totalZero 9y ago
Does this seem like sensationalist junk journalism to anyone else? We already know the NYT has an axe to grind regarding this administration, and they take some jabs here too. Even if you hate Trump, you should have the clarity to see that this article feeds into the Russia investigation by hyping up the harms of Russian meddling to stir up anti-Trump fervor over collusion, even though the events took place before he became President.
- empath75 9y ago
  When you say this administration, do you mean Putin or trump?
  - Fjolsvith 9y ago
    Probably Trump. However, many of the issues the NSA faces occurred before Trump's administration.
    - chiefalchemist 9y ago
      That's true. The concern should be Trump's sense of priorities. He's so easily distracted. He's seemingly more focused on Twitter than the NSA. He, similar to Obama, is the wrong "leader" at the wrong time. We're off course and getting more and more so with each day.
      - totalZero 9y ago
        I'm just saying the NYT has clearly demonstrated that it has taken sides as a publication, and this bias doesn't make for good journalism, whether you agree with the bias or not.
      - 0xbear 9y ago
        I think it’s everybody else that’s “easily distracted”. He uses his Twitter as a laser pointer with a cat, and he has been doing so for years. You don’t win an election against the Clinton political dynasty if you’re “easily distracted”.
none_to_remain 9y ago
"Rendition Infosec" - give me a break, you were a peeping tom secret policeman, not a kidnapping secret policeman.
- Wonnk13 9y ago
  I love how he refers to himself as an "operator" - like he's going downrange with SEALs or some shit.
  - walshemj 9y ago
    A quick google finds its a compromise worthy of the laundry file "We settled on the name ‘operator’ to designate an operational member of the unit (as opposed to a member of the support staff) due to some legal and political situations. We couldn’t use ‘operative’ because that name had certain espionage connotations from the CIA. The term ‘agent’ had some legal issues. An agent carries a legal commission to perform certain duties and a governmental authority empowered by a state or federal constitution issues that commission. In our case, we would perform our duties under the authority of the federal government as administered by the Department of Defense and the Department of the Army. But in the military, only officers carry legal commissions from the President and are confirmed by Congress. Sergeants, who are noncommissioned officers, are authorized to perform their duties by virtue of appointment by the Secretary of the Army. Sergeants therefore cannot be agents of the government. And since almost every operational member of Delta Force is a sergeant, we needed to choose a different name for ourselves. Hence, operator. If that sounds sort of convoluted, it’s because it is. But if you work for any governmental entity, it will make perfect sense to you."
    - nyolfen 9y ago
      this sounds more like a joke about government bureaucracy than anything. it seems much more likely that it's simply derived from 'special operations'.
      - walshemj 9y ago
leeoniya 9y ago
> "The fundamental purpose of intelligence is to be able to effectively penetrate our adversaries in order to gather vital intelligence. By its very nature, that only works if secrecy is maintained and our codes are protected." lol "codes"
- 4gotpassthrow 9y ago
  I think they're referring to cryptographic codes which makes it sound less awkward. https://en.wikipedia.org/wiki/Code_(cryptography) https://en.wikipedia.org/wiki/Code_(cryptography)
- burke 9y ago
  I’m not even peripherally involved in the IC but I think this is being used to refer to e.g. cryptographic protocols, rather than source code.
- spaceseaman 9y ago
  Pretty common to use that terminology in the sciences and government work for small "kernels" of code that does one thing really well. EX: Water simulation codes, cryptographic codes, FEM codes, etc.
- saltcured 9y ago
  When I was roaming the halls of UC Berkeley 25 years ago, the use of countable "codes" was idiomatic in the numerical computing sphere at the intersection of computer science, mathematics, and parallel computing. A code was more or less a program or application. A frequently linked idiom was "kernel" to refer to the inner-loop of a particular numerical simulation, generalizing a "filter kernel" (matrix of coefficients) in signal processing/convolution. I have heard similar usage from academics working in various US national labs, so it was not confined to a single coffee klatch. Some of the professors and postdocs using it back then are probably lab directors and program managers by now. I can easily imagine that this usage would be widespread among academic and federal lab computing environments. Like many kinds of jargon, it is both more precise in its meaning when used properly, but also what you might consider a "dog whistle" used for virtue signaling.
- 9y ago
dasil003 9y ago
I don't think it's exactly right to say they should have focused on defense. The first mistake was focusing on installing a surveillance apparatus and using fear mongering to sell it politically while giving short thrift to the actual principles justifying the decision. In doing so they lost the moral high ground and opened the door for Snowdens and worse. I'm not saying the NSA has ever been a paragon of ethics, but you've got to have some standards or no amount of vetting is going to be sufficient to suppress everyone's conscience.
- chickenbane 9y ago
  I disagree; it's a focus of their existence that appears to be abandoned by the NSA - and that's dearly needed right now. From the front page of nsa.gov: "Defending our Nation. Securing the Future." The second point from their What we do page - "Defends vital networks". In the opening paragraph of Wikipedia: "The NSA is also tasked with the protection of U.S. communications networks and information systems". Etc. For all the prestige of the TAO, who claims that the US networks are secure and well defended? I read the news and see the nation's voting, power, media, and other critical infrastructure are all being hacked. Notably Equifax, a steward of all Americans most valuable information, was compromised in trivial fashion. Our peers working at Google, Facebook, Twitter, etc are being attacked nonstop by foreign actors and they are rightfully being held to account by congress. But in my opinion the social networks are secondary compared to the primary infrastructure that honestly does not have access to the best talent should be aided by NSA.
  - someguydave 9y ago
    Yeah but think about it - imagine government employees shift their entire focus onto "securing US networks". What would they do, exactly? Build their own open-source chip designs from scratch? Because that's pretty much step one.
    - chickenbane 9y ago
      We are very far from trusted hardware. It's very easy to imagine what they would do - step one is helping American networks use the best practices - use open-source software, keep dependencies up-to-date, have bug bounties to find vulnerabilities in popular frameworks, etc. Step two would be to consider some shared infrastructure, probably subcontracting with a cloud provider (AWS/Azure/GCP), hopefully multiple. Once we get to that step, then you can start considering things like Google's Titan (https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-...). But there's a lot of low hanging fruit before we get there.
saas_co_de 9y ago
This is something I have been wondering about: how did both the CIA and NSA have their toolkits leaked within months of each other? Either one of these agencies suffering such a major security breach would be extraordinary but both at the same time is unprecedented.
- Scipio_Afri 9y ago
  I would guess that their cyber offensive operation computers, which if I were to design from a systems level their IT department probably is distinct from other parts of their network, is different than their intelligence gathering and storing methods because sources and methods are the most tightly held secrets of any intelligence agency. Plus you probably don't want your computers that you're using for offensive operations to look any different than a normal computer on the internet.. so my guess is that is that there was an exploit of an offensive computer somehow through that back to a secured network where those tools were developed and deployed... probably through the method of remote command and control. I'm surprised they haven't found the method of infiltration yet. But my guess is they should seriously look into unknown vulnerabilities. But it's also true (if Wikipedia is to believe believed) that agencies work together in joint operations. In that case it would only take one rouge agent to get physical access to leaking materials that would effect both agencies if they were part of the joint operations.
  - retailbuyout 9y ago
    A) this doesn’t require a rogue agent, just an insecure one. B) you just need the same attack to work twice; less extraordinary than an uncorrelated coincidence C) possibly some might have access to both. I think this is unlikely, but again, less unlikely than an uncorrelated coincidence.
- deleted 9y ago
  [deleted]
natch 9y ago
One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving. Maybe my wording is not perfect "they are capable of leaking" well you could argue that NSA didn't leak, it was possibly hacked by an outside actor. I don't think the distinction matters much though in this case. The main point is that they can no longer say "trust us" with a straight face.
- jelly 9y ago
  This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical) [1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... [2] https://news.ycombinator.com/item?id=15663985 https://news.ycombinator.com/item?id=15663985
  - ethbro 9y ago
    It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...
draw_down 9y ago
Sorry but NSA has no one to blame but themselves.
SomeStupidPoint 9y ago
> Some veteran intelligence officials believe a lopsided focus on offensive cyberweapons and hacking tools has, for years, left American cyberdefense dangerously porous. > “We have had a train wreck coming,” said Mike McConnell, the former N.S.A. director and national intelligence director. “We should have ratcheted up the defense parts significantly.” Yes, I think many have said this for years. I'm glad someone high-up went on record. I'm not against what the TAO does, but the NSA (and more broadly, the US government) has massively failed to develop defensive capabilities. I hope the NSA will use this as a moment of introspection, and up their defensive work -- particularly opensource collaborations and research. (The IAD github page[0] is awesome in this regard; as are things like SELinux. On the research side, things like HoTT as a basis for verified software; which has some DoD funding, but would be so much more if NSA researchers collaborated.) I get that attacking things is cool -- but we really need help defending the national infrastructure against constant assault. It's in rough shape. I hope the people at the NSA -- particularly those comissioned -- will reflect on why they're there, and take the stance that the safety of the nation is paramount. Then work towards that, as I know they're more than capable of. [0] https://github.com/iadgov https://github.com/iadgov
badrabbit 9y ago
In any military force,turning your weapon against your own people is worse than being a traitor,running from battle in cowardice or surrendering to the enemy. Their continued attack(yes,using malware and implants against someone is an attack) against their own people is in my opinion completely shameful and unpatriotic. As someone who has no intention of breaking any law or of harming the united states,it is simply not ok for me to have to include my government as part of any threat model or as a potential attacker.
- ethbro 9y ago
  This would be your person opinion, given that the militaries of the US, the UK, China, Russia, Vietnam, Korea, Japan, Mexico, Spain, etc. (probably easier to name those that haven't) have officially performed such actions, with the soldiers in question receiving official honors and rewards?
  - Zelphyr 9y ago
    Just because a lot of countries have done it doesn't make it any less shameful.
    - ethbro 9y ago
      It does mean it's not universally held to be shameful.
      - retailbuyout 9y ago
        Militaries have shame?!?!
      - pm90 9y ago
        I don't think that's the case either. Its more of a "ain't broken so why fixit" problem which hasn't affected people on a personal level just yet, so it isn't regulated as much. Its astonishing to me that in the US it requires a court order to tap someone's phone and yet the NSA collects and analyzes the online data of US citizens...
appleflaxen 9y ago
The biggest indictment of the NSA is the fact that there has been no visible internal dissent after Snowden regarding mass surveillance. Their willingness to overlook the constitution because it's inconvenient is a far bigger problem than leaks, IMO.
- godzillabrennus 9y ago
  I believe this is the underlying cause of their security issues. People involved cannot voice their dissent so they act it out. The NSA and CIA are institutions established to protect a nation that abides by the rule of law. When the rule of law is brushed aside the people who are part of that system rebel.
  - JumpCrisscross 9y ago
    I very frankly believe one of the more patriotic things an American with the ability can do is emulate Snowden, i.e. infiltrate and expose the NSA’s domestic surveillance programs.
    - wolf550e 9y ago
      But it's not patriotic to give NSA tools to the Russians, to hurt the ability of the NSA to spy on Russia.
      - lawnchair_larry 9y ago
        Why Russia?
      - convolvatron 9y ago
        its ultimately in the best interests of all of us to understand how little we can count on the systems we use today to keep information private. how likely do you think it is that the russians or the chinese or anyone really has developed similar exploits?
      - retailbuyout 9y ago
Wonnk13 9y ago
Living in Maryland, I've met several young people who put in a few years at the agency (including TAO) who then left for industry. Millenials don't care about a government pension, especially when you're in a windowless SCIF hacking Perl. The US Government as a whole has a massive talent retention problem. Only the mediocre will stay at NSA / CIA now and we'll probably see more of these leaks / hacks.
- azinman2 9y ago
  There’s a massive pay disparity between public and private, and those currently in power want to keep it that way and eat away even more at gov functions. That combined without a clear rallying call for public service (like the Cold War or collective pride) are a recipe for disaster.
  - milofeynman 9y ago
    Until this is fixed we'll continue to be reliant on Israel intelligence
  - somnolentsam 9y ago
    There is a big pay disparity, but the main thing is that engineers and other technical types have gone from having a big say in how problems get solved to being the problem itself. No amount of pay is going to retain people in those circumstances, except possibly those you don't want to retain. As far as money is concerned, NSA is way overfunded - it just spends money on the wrong things and wastes lots of resources due to inefficiency.
  - jorblumesea 9y ago
    I'm not even sure it's just pay. The govt is extremely inefficient and bureaucratic. If your thing is writing code, why go to a place like that? You'd spend half your day writing memos and wrangling red tape.
  - ataturk 9y ago
    I have relatives who are all steeped in public service hoo-ha because they attended a small, private college that upholds that as a primary value. I personally think they have taken it too far: Public service was traditionally not a career path and should not be looked upon as such. You do your service for a couple of years, then you go back to private enterprise. Career public servants are bureaucrats, have become a very negative voting bloc, and need to be reined in if for no other reason than public service pensions have brought this whole entire nation to the brink of collapse.
jhiska 9y ago
Proves that no computer network can be secured, and is specially interesting given that the entire US military is moving to operate as a giant computer network where everyone is a node in the system. They're setting themselves up for a hack so devastating that it will bring down their own country.
- SmooL 9y ago
  I think that it proves that it's _difficult_ to secure a computer network, not that it's impossible.
snowpanda 9y ago
It's interesting to see the complete lack of self-reflection on Jake Williams' part. “I felt like I’d been kicked in the gut." This is to how a lot of people felt after the Snowden leaks. “Every time it happens, you essentially have to start over.” This goes both ways too. Every time something is compromised by the NSA, we have to start encrypting yet another part of our lives. “It’s embarrassing that the people responsible for this have not been brought to justice.” Again, both ways. Why has the NSA not been brought to justice? Closed courts and hiding behind the "national security" argument comes to mind.
- techsupporter 9y ago
  > It's interesting to see the complete lack of self-reflection on Jake Williams' part. At the risk of putting words in his mouth, but based on chats I've had with people who do this kind of work: Mr Williams probably sees what he does as righteous, legal, and noble while The Others he rails against are evil, immoral, and unlawful. It's not self-reflection because he thinks he was in the right and those other people are not.
a-dub 9y ago
This is why friends don't let friends run Windows. It's not that hard.
- ilikeATMs 9y ago
  More than one exploit released by the shadow brokers was specifically targeted at Linux/Unix/Cisco and other operating systems... Its naive to think that other operating systems are somehow invulnerable to nation-state attackers.
  - a-dub 9y ago
    Yes but at least with open source software, you have a fighting chance of knowing what you're running. What's the open source equivalent of DUAL_EC_DRBG or Kaspersky Anti-Virus?
meowface 9y ago
I wonder why there don't seem to be leaks like these at other superpowers' intelligence/security organizations, like China's and Russia's? Is it the threat of torture/execution (and perhaps the same being done to their family)? Heightened fears due to stronger monitoring of employees? Or genuine loyalty / indoctrination?
- pulisse 9y ago
  The disparity in pay (and prestige) between public and private sectors is larger in the US than in most of the rest of the world. The NSA's counterpart agencies in other countries can recruit stronger talent, retain them longer, and offer them more professional pride.
- EthanHeilman 9y ago
  >I wonder why there don't seem to be leaks like these at other superpowers' intelligence/security organizations, like China's and Russia's? 1. Leaks have happened in Russia, for example the KGB archives that Mitrokhin stole [0]. 2. Somewhere above 845,000 people have TOP SECRET clearances in the US intelligence community[1]. I can't find size of the Russia and Chinese intelligence community but I would guess it is an order of magnitude smaller. 3. Privacy is not viewed with the same level of importance in Russia or China. The US and European intelligence communities are tasked with a mission which directly contradicts the core culture values of those societies. Additionally the US and EU countries have large non-state controlled media outlets allowing someone to blow the whistle. 4. Because of the Pentagon papers all leakers/whistleblowers have an example of intelligence leaks being beneficial and good for the country. Are there any similar role models in Russia or China that might motivate a whistleblower? 5. When the US captures intelligence from Russia or China the US generally does not leak it to make Russia or China look bad. Russia, and before that the Soviet Union, have been using espionage to make the US look bad for have 60 years. [0]: https://www.dailydot.com/layer8/kgb-documents-now-public-mitrokhin-archive/ https://www.dailydot.com/layer8/kgb-documents-now-public-mit... [1]: http://freebeacon.com/national-security/chinas-spy-network-united-states-includes-25000-intelligence-officers/ http://freebeacon.com/national-security/chinas-spy-network-u...
- boomboomsubban 9y ago
mnm1 9y ago
Great. I hope this continues. The more the NSA has problems, the better off the rest of the rest of us are. It's unlikely the institution is even lawful--its practices certainly aren't. At the very least, it proves that the government cannot itself keep secrets, so it really needs to shut up about trying to put backdoors into software when it can't protect its own most vital software assets from leaking. I guarantee if Android or iOS had such government mandated backdoors, they keys would leak in under a year. I simply don't see a reason for the NSA to exist, but as long as it exists, I hope its mission of spying on Americans under the disguise of being an international spy agency is thwarted in any way. Unfortunately, I wouldn't be surprised if these leaks were intentional. With the current administration's relationship to Russia, this would hardly be surprising. Instead of a 'shadow war' with Russia, a 'shadow alliance,' at this point is just as likely. Regardless, the NSA shouldn't be stockpiling such software, but once again, since there are absolutely no repercussions for them doing so, they are allowed to do so leading to disastrous consequences.
- QAPereo 9y ago
  Unless “us” is other alphabet agencies competing for the same budget, be realistic. The NSA is not the problem, it’s the attitude, culture, and insane funding of their mission which is the problem. The failure of the agency will not change that, just redirect it.
- deleted 9y ago
  [deleted]
- cryoshon 9y ago
  agreed entirely. we need to stop thinking of maladaptive institutions as features of society gone askew, but rather as dark patterns that have emerged as a result of historical pressures. what's the best way to stop a dark pattern at the large scale? trip it up at the small scale, where it can't react with its weight. leak their information. jam their systems. turn off their water supply. make them show their hand for something that isn't quite worth it. the shadow war with russia can be brough to peace later-- they know the boundary of the game we play. for now, we must clean our own house.
- 9y ago
bitmapbrother 9y ago
The NSA are habitual liars. Of course this is what they want you to believe. It makes their job easier.
c3534l 9y ago
> N.S.A. employees have been subjected to polygraphs Oh,good to see an organization entrusted with an unconstitutional amount of data on Americans is defending against those threats with rank pseudoscience. Maybe they should hire a psychic to find that mole of theirs.
- Sebguer 9y ago
  Realistically, they probably have.
floofyfloofer 9y ago
Has anyone done a TCO of the NSA? Like, if the NSA takes $X bn / year to run, and has $Y bn / year in negative externalities for US companies by leaking their malware, then just how much have they cost the US economy?
yeukhon 9y ago
This is a tricky industry. NSA hires a lot of folks from the underground world. The problem is most of these folks do not pledge any allegiances - not that it really matters, as we have seen many of the leaks from the past 6-7 years are leaked by U.S. citizens. But the fact NSA is hiring freelancers to do the work should be an alarm when it comes to "national security" as NSA claims its mission. I am sure NSA does have a vetting, but how much? How good is the vetting? Is there a post-work surveillance? We don't know.
yuhong 9y ago
My favorite is how NSA is funded by government debt, which is their way of printing money. This is also true for the FBI too with the scare against encryption. One of the reasons we got off the gold standard decades ago was military spending.
- retailbuyout 9y ago
  Currency is just printed debt. What’s your point?
  - yuhong 9y ago
    The point is that the debt can increase forever since we got off gold.
    - retailbuyout 9y ago
      This isn’t necessarily hard or bad, though. If I take $100 and loan it to my neigbor, the debt appears from nowhere. Heck, theoretically, he could loan it right back under different terms and create more debt. Debt isn’t necessarily bad—the fear is you’re builidng on jenga blocks, not that some guy is going to show up with a wrench.
      - yuhong 9y ago
        In this case we are talking about government debt though. Congress does have some control over it with "appropriations" I think.
audiometry 9y ago
That ex-NSA guy calling his company "Rendition Infosec" -- how disgusting. Gives insight to his character.
feelin_googley 9y ago
"Antivirus is the ultimate back door," Blake Darche, a former N.S.A. operator and co-founder of Area 1 Security. "It provides consistent, reliable and remote access that can be used for any purpose, from launching a destructive attack to conducting espionage on thousands or even millions of users." Humble opinion: s/Antivirus/Automatic updates/ Perhaps antivirus were in fact an early experiment to test the feasbility of automatic software updates. I recall many years ago, pre-smartphone, users being advised to leave their computers online 24/7 "so antivirus could download updates". Yikes.
nikcub 9y ago
AFAIK Jake Williams didn't get singled out because he only "wrote a blog post" about Shadow Brokers - it was because he was involved in a Twitter based dispute with Shadow Brokers. Somebody created a fake Twitter account and were sending all sorts of tweets to the Shadow Brokers, someone who was either in the IC or formerly in the IC. This is why the Shadow Brokers outed him in this post[0] > TheShadowBrokers is having special invitation message for “doctor” person theshadowbrokers is meeting on Twitter. “Doctor” person is writing ugly tweets to theshadowbrokers not unusual but “doctor” person is living in Hawaii and is sounding knowledgeable about theequationgroup. > Then “doctor” person is deleting ugly tweets, maybe too much drinking and tweeting? Is very strange, so theshadowbrokers is doing some digging. TheShadowBrokers is thinking “doctor” person is former EquationGroup developer who built many tools and hacked organization in China. > TheShadowBrokers is thinking “doctor” person is co-founder of new security company and is having much venture capital. It was easy for everyone on Twitter to figure out who he/she/they were referring to. I think this is important context - Shadow Brokers aren't just outing random operatives, they're flexing their access and abilities when being prompted to I also wonder if this wasn't part of a plan to bring the Shadow Brokers out of their shell a little - coax them into revealing a little more about themselves than the usual document and software dumps - which would require the NSA to spend money to get a picture of what tools are available. Jake says to the NYTimes that he isn't working with the NSA - but he'd also say this if he were working with the NSA to get a little more out of Shadow Brokers I've never bought the theory that Shadow Brokers is Russia, or that it was Harold T Martin (or stolen from him). I think the Jake Williams incident lends further credibility to the theory that it is a former TAO or NSA employee. The fake Russian style writing of the Shadow Brokers isn't ordinary bad English Russian (which has a number of characteristics that aren't reflected in how Shadow Brokers write). As the article mentions, there are also far too many cultural and infosec "inside baseball" references in the writing of Shadow Brokers for it to not be someone who is either familiar with the community or part of it. I also don't recall Russian ops having OPSEC this good - to the point where they can't be identified or linked. The good OPSEC suggests the person/people behind the Shadow Brokers are familiar with what the NSA are capable of, and what they're not. Most Russian and Chinese ops are usually linked one way or another back to to them as they're less concerned about OPSEC as they have the operational advantage of not fearing arrest or extradition Differences between SB and Fancy Bear or Russian ops: bad security practices (not locking down bitly) vs good, using clearnet domains[1] emails[3] vs steemit and onions, using VPNs rather than Tor, the use of Bitcoin vs Monero/Zcash, speaking only (broken) English vs either plain English or Russian[2], financial motive vs political motive, etc. It feels like someone upset with the NSA, who knows the organization very well and is also motivated financially - but I wouldn't attribute greater than 50-60% certainty to any theory at the moment. If the Shadow Brokers go on to never be identified it would really be an incredible situation. [0] https://steemit.com/shadowbrokers/@theshadowbrokers/theshadowbrokers-monthly-dump-service-july-2017 https://steemit.com/shadowbrokers/@theshadowbrokers/theshado... [1] https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign https://www.secureworks.com/research/threat-group-4127-targe... [2] https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... [3] https://www.threatconnect.com/blog/fancy-bear-anti-doping-agency-phishing/ https://www.threatconnect.com/blog/fancy-bear-anti-doping-ag...
cm2187 9y ago
I like to think of malware and security vulnerabilities as biological weapons. They have in common that is you lose control of them, they become very hard to control and will indiscriminately hurt your own population and the enemy.
ataturk 9y ago
There's a lot of discussion about whether this NY Times article is a cover story for whatever is going to take place next politically. I have no idea. I'm no fan of the NSA or the CIA, they can all die in a fire for all I care.
pdimitar 9y ago
Whoever is hitting NSA is doing it expertly. What I managed to extract from the article (do point out any flaws, I am open to them and I am just trying to do some mini-analysis here without taking sides): - The attackers understand that warning the wide public will net zero results, now and centuries in the future. Homo Sapiens hasn't evolved enough of a collective conscience to actually act on revelations such as Snowden's, that's the historically obvious fact. Even the words of the biggest security experts like Schneier fall on deaf ears either because the politicians are better at rhetoric or because the public is too busy posting their food pictures on Instagram, or (as I believe) a mix of both. So they opted for the nuclear approach: release the hacking tools and demonstrate practically to the world the dangers of these hidden-under-the-table hacking tools. And now many more business people and politicians pay more attention than before. This is a sound psychological attack technique. Demonstrate that your opponent's claims for doing the best for the populace are not holding to reality. Even though I find this immoral and potentially dangerous IMO none of us can deny the devastating results to NSA's reputation. - Spread FUD and never share anything truly revealing. They use language fuzzing techniques, occasionally engage in political debates without clarify which side they ally with (saying they are on Trump's side means nothing), use both old and new hacking tools and other files, use vague speak to shift suspicion to former NSA employees or contractors (I imagine this is done so they exhaust the agency while it tries to plug yet another leak which might as well be imaginary -- but they can't risk it and the attackers know it) -- all of these tarnish the image of the NSA and forces them to work extra to try and find moles, fix bugs in their own defense systems, go on internal witch hunts, double down on efforts to find the remote hackers, compartmentalize their physical and virtual clearance levels, etc. As mentioned in the parentheses, the attackers seem to aim to exhaust the agency and IMO it's working -- although none of us keyboard warriors in HN can't know for sure of course. - Have time work for you. The fact that Shadow Brokers are hunted by a lot of law-enforcement agencies for like what, 15 months now? -- is projecting a clear image to the world that these agencies aren't as ubiquitous as they would want us to think. This probably encourages other people to try and hit other (or same) agencies all over the world. Not sure if that is good or bad -- opponents of this approach might say it will lead to anarchy and chaos but in my opinion (partially founded by rudimentary knowledge of chaos theory and game theory) the living systems like ours have plenty of emergency levers to pull them back into a more balanced state. It's 50/50 though, I don't claim anything either way. In any case though, the agencies' inability to catch these people makes the wide public lose confidence in them. ---- Please note I am not taking sides here. I do believe NSA does a lot of unethical things and should be held much more accountable than it is right now, but I am uncertain if what Shadow Brokers is doing is the right way to achieve that result. It might as well make NSA and friends become even more paranoid and actually become much better and more subtle in its mass surveillance... which is a loss for everybody but them. Oh well, time will tell. In any case, this is interesting news and development and I am slightly pleased that the intelligence agencies get some run for their money. And slightly terrified of the possible consequences.

311 points by sgustard 9y ago

Good. Working as intended. They could use some slowing and shaking. > calling into question [..] its very value to national security Its what now?

jhiska 9y ago
When Americans rejoice that their own institutions are failing... it speaks to how they view their own government as an enemy. What are elections for in a representative democracy if the people elected don't represent the majority?
- marssaxman 9y ago
  America would like to become a representative democracy when it grows up, but it has a long way to go yet.

sebcat 9y ago

> The agency regarded as the world’s leader in breaking into adversaries’ computer networks failed to protect its own. Those are two very different things. Focusing on one of them doesn't automatically benefit your efforts on the other.

noobermin 9y ago
The hope is that one's level of expertise in those areas are correlated.
magicalist 9y ago
> Focusing on one of them doesn't automatically benefit your efforts on the other. Uh, yeah. It isn't saying, "why did defense fail to automatically follow from offense?" It's literally just saying they failed to protect their own network, whether technically or organizationally.
chiefalchemist 9y ago
I don't think I see it that way. If you have the best then you should test your systems against being exploited by the best. And then harden from there. If you have the knowledge - knowing you're a prome target- why not double its value? As it is, their approach strikes me as one of arrogance, or (ironically) lack of intelligence about foreign threats, or worse...both. Both is not what we're paying them for.
kevin_thibedeau 9y ago
NSA is also responsible for establishing computer security practices for the rest of the government to follow. That they don't eat their own dogfood is damning.
- meowface 9y ago
  They do typically eat their own dogfood when it comes to the security practices they propose. Dual_EC_DRBG is the big exception, but it's generally considered that most of the rest of their cryptographic standards are secure and suitable for public and government use. There are likely many conflicting departments and teams within NSA. Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk.
  - retailbuyout 9y ago
    > Many are probably trying to fight for the public's security and have for years, with cryptographers earnestly trying to develop secure and efficient algorithms. They are probably at odds with the other forces in the organization that seek to play the espionage game, even if it puts the country at risk. Directly at odds. I don’t believe you should encourage anyone to trust known espionage. If it’s good advice, someone else will say it too you can trust independently.
- fujiters 9y ago
  We should also keep in mind that finding an exploit or two is much easier than making sure that nothing on your network can be exploited. I wouldn't expect even the best in the world to be able to thwart all attacks.

larkeith 9y ago

Cause for celebration for all who support privacy and security.

mirimir 9y ago
I get the sentiment. But now the tools are available to more criminals. And that's hardly good, is it?
- CyberSpyz 9y ago
  Security by obscurity? No it doesn't work. Good to know our systems aren't private.
- JumpCrisscross 9y ago
  The bugs were always there.
- FooHentai 9y ago
  Yes, it's great. Public availability of these tools means the exploits they leverage will be swiftly mitigated. They will be of no use to criminals, outside of the narrow window between disclosure and mitigation. Had the NSA acted with integrity and disclosed these vulnerabilities rather than hoarding them, that window would be even smaller.

totalZero 9y ago

Does this seem like sensationalist junk journalism to anyone else? We already know the NYT has an axe to grind regarding this administration, and they take some jabs here too. Even if you hate Trump, you should have the clarity to see that this article feeds into the Russia investigation by hyping up the harms of Russian meddling to stir up anti-Trump fervor over collusion, even though the events took place before he became President.

empath75 9y ago
When you say this administration, do you mean Putin or trump?
- Fjolsvith 9y ago
  Probably Trump. However, many of the issues the NSA faces occurred before Trump's administration.
  - chiefalchemist 9y ago
    That's true. The concern should be Trump's sense of priorities. He's so easily distracted. He's seemingly more focused on Twitter than the NSA. He, similar to Obama, is the wrong "leader" at the wrong time. We're off course and getting more and more so with each day.
    - totalZero 9y ago
      I'm just saying the NYT has clearly demonstrated that it has taken sides as a publication, and this bias doesn't make for good journalism, whether you agree with the bias or not.
    - 0xbear 9y ago
      I think it’s everybody else that’s “easily distracted”. He uses his Twitter as a laser pointer with a cat, and he has been doing so for years. You don’t win an election against the Clinton political dynasty if you’re “easily distracted”.

none_to_remain 9y ago

"Rendition Infosec" - give me a break, you were a peeping tom secret policeman, not a kidnapping secret policeman.

Wonnk13 9y ago
I love how he refers to himself as an "operator" - like he's going downrange with SEALs or some shit.
- walshemj 9y ago
  A quick google finds its a compromise worthy of the laundry file "We settled on the name ‘operator’ to designate an operational member of the unit (as opposed to a member of the support staff) due to some legal and political situations. We couldn’t use ‘operative’ because that name had certain espionage connotations from the CIA. The term ‘agent’ had some legal issues. An agent carries a legal commission to perform certain duties and a governmental authority empowered by a state or federal constitution issues that commission. In our case, we would perform our duties under the authority of the federal government as administered by the Department of Defense and the Department of the Army. But in the military, only officers carry legal commissions from the President and are confirmed by Congress. Sergeants, who are noncommissioned officers, are authorized to perform their duties by virtue of appointment by the Secretary of the Army. Sergeants therefore cannot be agents of the government. And since almost every operational member of Delta Force is a sergeant, we needed to choose a different name for ourselves. Hence, operator. If that sounds sort of convoluted, it’s because it is. But if you work for any governmental entity, it will make perfect sense to you."
  - nyolfen 9y ago
    this sounds more like a joke about government bureaucracy than anything. it seems much more likely that it's simply derived from 'special operations'.
    - walshemj 9y ago

leeoniya 9y ago

> "The fundamental purpose of intelligence is to be able to effectively penetrate our adversaries in order to gather vital intelligence. By its very nature, that only works if secrecy is maintained and our codes are protected." lol "codes"

4gotpassthrow 9y ago
I think they're referring to cryptographic codes which makes it sound less awkward. https://en.wikipedia.org/wiki/Code_(cryptography) https://en.wikipedia.org/wiki/Code_(cryptography)
burke 9y ago
I’m not even peripherally involved in the IC but I think this is being used to refer to e.g. cryptographic protocols, rather than source code.
spaceseaman 9y ago
Pretty common to use that terminology in the sciences and government work for small "kernels" of code that does one thing really well. EX: Water simulation codes, cryptographic codes, FEM codes, etc.
saltcured 9y ago
When I was roaming the halls of UC Berkeley 25 years ago, the use of countable "codes" was idiomatic in the numerical computing sphere at the intersection of computer science, mathematics, and parallel computing. A code was more or less a program or application. A frequently linked idiom was "kernel" to refer to the inner-loop of a particular numerical simulation, generalizing a "filter kernel" (matrix of coefficients) in signal processing/convolution. I have heard similar usage from academics working in various US national labs, so it was not confined to a single coffee klatch. Some of the professors and postdocs using it back then are probably lab directors and program managers by now. I can easily imagine that this usage would be widespread among academic and federal lab computing environments. Like many kinds of jargon, it is both more precise in its meaning when used properly, but also what you might consider a "dog whistle" used for virtue signaling.
9y ago

dasil003 9y ago

I don't think it's exactly right to say they should have focused on defense. The first mistake was focusing on installing a surveillance apparatus and using fear mongering to sell it politically while giving short thrift to the actual principles justifying the decision. In doing so they lost the moral high ground and opened the door for Snowdens and worse. I'm not saying the NSA has ever been a paragon of ethics, but you've got to have some standards or no amount of vetting is going to be sufficient to suppress everyone's conscience.

chickenbane 9y ago
I disagree; it's a focus of their existence that appears to be abandoned by the NSA - and that's dearly needed right now. From the front page of nsa.gov: "Defending our Nation. Securing the Future." The second point from their What we do page - "Defends vital networks". In the opening paragraph of Wikipedia: "The NSA is also tasked with the protection of U.S. communications networks and information systems". Etc. For all the prestige of the TAO, who claims that the US networks are secure and well defended? I read the news and see the nation's voting, power, media, and other critical infrastructure are all being hacked. Notably Equifax, a steward of all Americans most valuable information, was compromised in trivial fashion. Our peers working at Google, Facebook, Twitter, etc are being attacked nonstop by foreign actors and they are rightfully being held to account by congress. But in my opinion the social networks are secondary compared to the primary infrastructure that honestly does not have access to the best talent should be aided by NSA.
- someguydave 9y ago
  Yeah but think about it - imagine government employees shift their entire focus onto "securing US networks". What would they do, exactly? Build their own open-source chip designs from scratch? Because that's pretty much step one.
  - chickenbane 9y ago
    We are very far from trusted hardware. It's very easy to imagine what they would do - step one is helping American networks use the best practices - use open-source software, keep dependencies up-to-date, have bug bounties to find vulnerabilities in popular frameworks, etc. Step two would be to consider some shared infrastructure, probably subcontracting with a cloud provider (AWS/Azure/GCP), hopefully multiple. Once we get to that step, then you can start considering things like Google's Titan (https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-security-in-plaintext.html https://cloudplatform.googleblog.com/2017/08/Titan-in-depth-...). But there's a lot of low hanging fruit before we get there.

saas_co_de 9y ago

This is something I have been wondering about: how did both the CIA and NSA have their toolkits leaked within months of each other? Either one of these agencies suffering such a major security breach would be extraordinary but both at the same time is unprecedented.

Scipio_Afri 9y ago
I would guess that their cyber offensive operation computers, which if I were to design from a systems level their IT department probably is distinct from other parts of their network, is different than their intelligence gathering and storing methods because sources and methods are the most tightly held secrets of any intelligence agency. Plus you probably don't want your computers that you're using for offensive operations to look any different than a normal computer on the internet.. so my guess is that is that there was an exploit of an offensive computer somehow through that back to a secured network where those tools were developed and deployed... probably through the method of remote command and control. I'm surprised they haven't found the method of infiltration yet. But my guess is they should seriously look into unknown vulnerabilities. But it's also true (if Wikipedia is to believe believed) that agencies work together in joint operations. In that case it would only take one rouge agent to get physical access to leaking materials that would effect both agencies if they were part of the joint operations.
- retailbuyout 9y ago
  A) this doesn’t require a rogue agent, just an insecure one. B) you just need the same attack to work twice; less extraordinary than an uncorrelated coincidence C) possibly some might have access to both. I think this is unlikely, but again, less unlikely than an uncorrelated coincidence.
deleted 9y ago
[deleted]

natch 9y ago

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving. Maybe my wording is not perfect "they are capable of leaking" well you could argue that NSA didn't leak, it was possibly hacked by an outside actor. I don't think the distinction matters much though in this case. The main point is that they can no longer say "trust us" with a straight face.

jelly 9y ago
This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical) [1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... [2] https://news.ycombinator.com/item?id=15663985 https://news.ycombinator.com/item?id=15663985
- ethbro 9y ago
  It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...

draw_down 9y ago

Sorry but NSA has no one to blame but themselves.

SomeStupidPoint 9y ago

> Some veteran intelligence officials believe a lopsided focus on offensive cyberweapons and hacking tools has, for years, left American cyberdefense dangerously porous. > “We have had a train wreck coming,” said Mike McConnell, the former N.S.A. director and national intelligence director. “We should have ratcheted up the defense parts significantly.” Yes, I think many have said this for years. I'm glad someone high-up went on record. I'm not against what the TAO does, but the NSA (and more broadly, the US government) has massively failed to develop defensive capabilities. I hope the NSA will use this as a moment of introspection, and up their defensive work -- particularly opensource collaborations and research. (The IAD github page[0] is awesome in this regard; as are things like SELinux. On the research side, things like HoTT as a basis for verified software; which has some DoD funding, but would be so much more if NSA researchers collaborated.) I get that attacking things is cool -- but we really need help defending the national infrastructure against constant assault. It's in rough shape. I hope the people at the NSA -- particularly those comissioned -- will reflect on why they're there, and take the stance that the safety of the nation is paramount. Then work towards that, as I know they're more than capable of. [0] https://github.com/iadgov https://github.com/iadgov

badrabbit 9y ago

In any military force,turning your weapon against your own people is worse than being a traitor,running from battle in cowardice or surrendering to the enemy. Their continued attack(yes,using malware and implants against someone is an attack) against their own people is in my opinion completely shameful and unpatriotic. As someone who has no intention of breaking any law or of harming the united states,it is simply not ok for me to have to include my government as part of any threat model or as a potential attacker.

ethbro 9y ago
This would be your person opinion, given that the militaries of the US, the UK, China, Russia, Vietnam, Korea, Japan, Mexico, Spain, etc. (probably easier to name those that haven't) have officially performed such actions, with the soldiers in question receiving official honors and rewards?
- Zelphyr 9y ago
  Just because a lot of countries have done it doesn't make it any less shameful.
  - ethbro 9y ago
    It does mean it's not universally held to be shameful.
    - retailbuyout 9y ago
      Militaries have shame?!?!
    - pm90 9y ago
      I don't think that's the case either. Its more of a "ain't broken so why fixit" problem which hasn't affected people on a personal level just yet, so it isn't regulated as much. Its astonishing to me that in the US it requires a court order to tap someone's phone and yet the NSA collects and analyzes the online data of US citizens...

appleflaxen 9y ago

The biggest indictment of the NSA is the fact that there has been no visible internal dissent after Snowden regarding mass surveillance. Their willingness to overlook the constitution because it's inconvenient is a far bigger problem than leaks, IMO.

godzillabrennus 9y ago
I believe this is the underlying cause of their security issues. People involved cannot voice their dissent so they act it out. The NSA and CIA are institutions established to protect a nation that abides by the rule of law. When the rule of law is brushed aside the people who are part of that system rebel.
- JumpCrisscross 9y ago
  I very frankly believe one of the more patriotic things an American with the ability can do is emulate Snowden, i.e. infiltrate and expose the NSA’s domestic surveillance programs.
  - wolf550e 9y ago
    But it's not patriotic to give NSA tools to the Russians, to hurt the ability of the NSA to spy on Russia.
    - lawnchair_larry 9y ago
      Why Russia?
    - convolvatron 9y ago
      its ultimately in the best interests of all of us to understand how little we can count on the systems we use today to keep information private. how likely do you think it is that the russians or the chinese or anyone really has developed similar exploits?
    - retailbuyout 9y ago

Wonnk13 9y ago

Living in Maryland, I've met several young people who put in a few years at the agency (including TAO) who then left for industry. Millenials don't care about a government pension, especially when you're in a windowless SCIF hacking Perl. The US Government as a whole has a massive talent retention problem. Only the mediocre will stay at NSA / CIA now and we'll probably see more of these leaks / hacks.

azinman2 9y ago
There’s a massive pay disparity between public and private, and those currently in power want to keep it that way and eat away even more at gov functions. That combined without a clear rallying call for public service (like the Cold War or collective pride) are a recipe for disaster.
- milofeynman 9y ago
  Until this is fixed we'll continue to be reliant on Israel intelligence
- somnolentsam 9y ago
  There is a big pay disparity, but the main thing is that engineers and other technical types have gone from having a big say in how problems get solved to being the problem itself. No amount of pay is going to retain people in those circumstances, except possibly those you don't want to retain. As far as money is concerned, NSA is way overfunded - it just spends money on the wrong things and wastes lots of resources due to inefficiency.
- jorblumesea 9y ago
  I'm not even sure it's just pay. The govt is extremely inefficient and bureaucratic. If your thing is writing code, why go to a place like that? You'd spend half your day writing memos and wrangling red tape.
- ataturk 9y ago
  I have relatives who are all steeped in public service hoo-ha because they attended a small, private college that upholds that as a primary value. I personally think they have taken it too far: Public service was traditionally not a career path and should not be looked upon as such. You do your service for a couple of years, then you go back to private enterprise. Career public servants are bureaucrats, have become a very negative voting bloc, and need to be reined in if for no other reason than public service pensions have brought this whole entire nation to the brink of collapse.

jhiska 9y ago

Proves that no computer network can be secured, and is specially interesting given that the entire US military is moving to operate as a giant computer network where everyone is a node in the system. They're setting themselves up for a hack so devastating that it will bring down their own country.

SmooL 9y ago
I think that it proves that it's _difficult_ to secure a computer network, not that it's impossible.

snowpanda 9y ago

It's interesting to see the complete lack of self-reflection on Jake Williams' part. “I felt like I’d been kicked in the gut." This is to how a lot of people felt after the Snowden leaks. “Every time it happens, you essentially have to start over.” This goes both ways too. Every time something is compromised by the NSA, we have to start encrypting yet another part of our lives. “It’s embarrassing that the people responsible for this have not been brought to justice.” Again, both ways. Why has the NSA not been brought to justice? Closed courts and hiding behind the "national security" argument comes to mind.

techsupporter 9y ago
> It's interesting to see the complete lack of self-reflection on Jake Williams' part. At the risk of putting words in his mouth, but based on chats I've had with people who do this kind of work: Mr Williams probably sees what he does as righteous, legal, and noble while The Others he rails against are evil, immoral, and unlawful. It's not self-reflection because he thinks he was in the right and those other people are not.

a-dub 9y ago

This is why friends don't let friends run Windows. It's not that hard.

ilikeATMs 9y ago
More than one exploit released by the shadow brokers was specifically targeted at Linux/Unix/Cisco and other operating systems... Its naive to think that other operating systems are somehow invulnerable to nation-state attackers.
- a-dub 9y ago
  Yes but at least with open source software, you have a fighting chance of knowing what you're running. What's the open source equivalent of DUAL_EC_DRBG or Kaspersky Anti-Virus?

meowface 9y ago

I wonder why there don't seem to be leaks like these at other superpowers' intelligence/security organizations, like China's and Russia's? Is it the threat of torture/execution (and perhaps the same being done to their family)? Heightened fears due to stronger monitoring of employees? Or genuine loyalty / indoctrination?

pulisse 9y ago
The disparity in pay (and prestige) between public and private sectors is larger in the US than in most of the rest of the world. The NSA's counterpart agencies in other countries can recruit stronger talent, retain them longer, and offer them more professional pride.
EthanHeilman 9y ago
>I wonder why there don't seem to be leaks like these at other superpowers' intelligence/security organizations, like China's and Russia's? 1. Leaks have happened in Russia, for example the KGB archives that Mitrokhin stole [0]. 2. Somewhere above 845,000 people have TOP SECRET clearances in the US intelligence community[1]. I can't find size of the Russia and Chinese intelligence community but I would guess it is an order of magnitude smaller. 3. Privacy is not viewed with the same level of importance in Russia or China. The US and European intelligence communities are tasked with a mission which directly contradicts the core culture values of those societies. Additionally the US and EU countries have large non-state controlled media outlets allowing someone to blow the whistle. 4. Because of the Pentagon papers all leakers/whistleblowers have an example of intelligence leaks being beneficial and good for the country. Are there any similar role models in Russia or China that might motivate a whistleblower? 5. When the US captures intelligence from Russia or China the US generally does not leak it to make Russia or China look bad. Russia, and before that the Soviet Union, have been using espionage to make the US look bad for have 60 years. [0]: https://www.dailydot.com/layer8/kgb-documents-now-public-mitrokhin-archive/ https://www.dailydot.com/layer8/kgb-documents-now-public-mit... [1]: http://freebeacon.com/national-security/chinas-spy-network-united-states-includes-25000-intelligence-officers/ http://freebeacon.com/national-security/chinas-spy-network-u...
boomboomsubban 9y ago

mnm1 9y ago

Great. I hope this continues. The more the NSA has problems, the better off the rest of the rest of us are. It's unlikely the institution is even lawful--its practices certainly aren't. At the very least, it proves that the government cannot itself keep secrets, so it really needs to shut up about trying to put backdoors into software when it can't protect its own most vital software assets from leaking. I guarantee if Android or iOS had such government mandated backdoors, they keys would leak in under a year. I simply don't see a reason for the NSA to exist, but as long as it exists, I hope its mission of spying on Americans under the disguise of being an international spy agency is thwarted in any way. Unfortunately, I wouldn't be surprised if these leaks were intentional. With the current administration's relationship to Russia, this would hardly be surprising. Instead of a 'shadow war' with Russia, a 'shadow alliance,' at this point is just as likely. Regardless, the NSA shouldn't be stockpiling such software, but once again, since there are absolutely no repercussions for them doing so, they are allowed to do so leading to disastrous consequences.

QAPereo 9y ago
Unless “us” is other alphabet agencies competing for the same budget, be realistic. The NSA is not the problem, it’s the attitude, culture, and insane funding of their mission which is the problem. The failure of the agency will not change that, just redirect it.
deleted 9y ago
[deleted]
cryoshon 9y ago
agreed entirely. we need to stop thinking of maladaptive institutions as features of society gone askew, but rather as dark patterns that have emerged as a result of historical pressures. what's the best way to stop a dark pattern at the large scale? trip it up at the small scale, where it can't react with its weight. leak their information. jam their systems. turn off their water supply. make them show their hand for something that isn't quite worth it. the shadow war with russia can be brough to peace later-- they know the boundary of the game we play. for now, we must clean our own house.
9y ago

bitmapbrother 9y ago

The NSA are habitual liars. Of course this is what they want you to believe. It makes their job easier.

c3534l 9y ago

> N.S.A. employees have been subjected to polygraphs Oh,good to see an organization entrusted with an unconstitutional amount of data on Americans is defending against those threats with rank pseudoscience. Maybe they should hire a psychic to find that mole of theirs.

Sebguer 9y ago
Realistically, they probably have.

floofyfloofer 9y ago

Has anyone done a TCO of the NSA? Like, if the NSA takes $X bn / year to run, and has $Y bn / year in negative externalities for US companies by leaking their malware, then just how much have they cost the US economy?

yeukhon 9y ago

This is a tricky industry. NSA hires a lot of folks from the underground world. The problem is most of these folks do not pledge any allegiances - not that it really matters, as we have seen many of the leaks from the past 6-7 years are leaked by U.S. citizens. But the fact NSA is hiring freelancers to do the work should be an alarm when it comes to "national security" as NSA claims its mission. I am sure NSA does have a vetting, but how much? How good is the vetting? Is there a post-work surveillance? We don't know.

yuhong 9y ago

My favorite is how NSA is funded by government debt, which is their way of printing money. This is also true for the FBI too with the scare against encryption. One of the reasons we got off the gold standard decades ago was military spending.

retailbuyout 9y ago
Currency is just printed debt. What’s your point?
- yuhong 9y ago
  The point is that the debt can increase forever since we got off gold.
  - retailbuyout 9y ago
    This isn’t necessarily hard or bad, though. If I take $100 and loan it to my neigbor, the debt appears from nowhere. Heck, theoretically, he could loan it right back under different terms and create more debt. Debt isn’t necessarily bad—the fear is you’re builidng on jenga blocks, not that some guy is going to show up with a wrench.
    - yuhong 9y ago
      In this case we are talking about government debt though. Congress does have some control over it with "appropriations" I think.

audiometry 9y ago

That ex-NSA guy calling his company "Rendition Infosec" -- how disgusting. Gives insight to his character.

feelin_googley 9y ago

"Antivirus is the ultimate back door," Blake Darche, a former N.S.A. operator and co-founder of Area 1 Security. "It provides consistent, reliable and remote access that can be used for any purpose, from launching a destructive attack to conducting espionage on thousands or even millions of users." Humble opinion: s/Antivirus/Automatic updates/ Perhaps antivirus were in fact an early experiment to test the feasbility of automatic software updates. I recall many years ago, pre-smartphone, users being advised to leave their computers online 24/7 "so antivirus could download updates". Yikes.

nikcub 9y ago

AFAIK Jake Williams didn't get singled out because he only "wrote a blog post" about Shadow Brokers - it was because he was involved in a Twitter based dispute with Shadow Brokers. Somebody created a fake Twitter account and were sending all sorts of tweets to the Shadow Brokers, someone who was either in the IC or formerly in the IC. This is why the Shadow Brokers outed him in this post[0] > TheShadowBrokers is having special invitation message for “doctor” person theshadowbrokers is meeting on Twitter. “Doctor” person is writing ugly tweets to theshadowbrokers not unusual but “doctor” person is living in Hawaii and is sounding knowledgeable about theequationgroup. > Then “doctor” person is deleting ugly tweets, maybe too much drinking and tweeting? Is very strange, so theshadowbrokers is doing some digging. TheShadowBrokers is thinking “doctor” person is former EquationGroup developer who built many tools and hacked organization in China. > TheShadowBrokers is thinking “doctor” person is co-founder of new security company and is having much venture capital. It was easy for everyone on Twitter to figure out who he/she/they were referring to. I think this is important context - Shadow Brokers aren't just outing random operatives, they're flexing their access and abilities when being prompted to I also wonder if this wasn't part of a plan to bring the Shadow Brokers out of their shell a little - coax them into revealing a little more about themselves than the usual document and software dumps - which would require the NSA to spend money to get a picture of what tools are available. Jake says to the NYTimes that he isn't working with the NSA - but he'd also say this if he were working with the NSA to get a little more out of Shadow Brokers I've never bought the theory that Shadow Brokers is Russia, or that it was Harold T Martin (or stolen from him). I think the Jake Williams incident lends further credibility to the theory that it is a former TAO or NSA employee. The fake Russian style writing of the Shadow Brokers isn't ordinary bad English Russian (which has a number of characteristics that aren't reflected in how Shadow Brokers write). As the article mentions, there are also far too many cultural and infosec "inside baseball" references in the writing of Shadow Brokers for it to not be someone who is either familiar with the community or part of it. I also don't recall Russian ops having OPSEC this good - to the point where they can't be identified or linked. The good OPSEC suggests the person/people behind the Shadow Brokers are familiar with what the NSA are capable of, and what they're not. Most Russian and Chinese ops are usually linked one way or another back to to them as they're less concerned about OPSEC as they have the operational advantage of not fearing arrest or extradition Differences between SB and Fancy Bear or Russian ops: bad security practices (not locking down bitly) vs good, using clearnet domains[1] emails[3] vs steemit and onions, using VPNs rather than Tor, the use of Bitcoin vs Monero/Zcash, speaking only (broken) English vs either plain English or Russian[2], financial motive vs political motive, etc. It feels like someone upset with the NSA, who knows the organization very well and is also motivated financially - but I wouldn't attribute greater than 50-60% certainty to any theory at the moment. If the Shadow Brokers go on to never be identified it would really be an incredible situation. [0] https://steemit.com/shadowbrokers/@theshadowbrokers/theshadowbrokers-monthly-dump-service-july-2017 https://steemit.com/shadowbrokers/@theshadowbrokers/theshado... [1] https://www.secureworks.com/research/threat-group-4127-targets-hillary-clinton-presidential-campaign https://www.secureworks.com/research/threat-group-4127-targe... [2] https://www.fireeye.com/blog/threat-research/2014/10/apt28-a-window-into-russias-cyber-espionage-operations.html https://www.fireeye.com/blog/threat-research/2014/10/apt28-a... [3] https://www.threatconnect.com/blog/fancy-bear-anti-doping-agency-phishing/ https://www.threatconnect.com/blog/fancy-bear-anti-doping-ag...

cm2187 9y ago

I like to think of malware and security vulnerabilities as biological weapons. They have in common that is you lose control of them, they become very hard to control and will indiscriminately hurt your own population and the enemy.

ataturk 9y ago

There's a lot of discussion about whether this NY Times article is a cover story for whatever is going to take place next politically. I have no idea. I'm no fan of the NSA or the CIA, they can all die in a fire for all I care.

pdimitar 9y ago

Whoever is hitting NSA is doing it expertly. What I managed to extract from the article (do point out any flaws, I am open to them and I am just trying to do some mini-analysis here without taking sides): - The attackers understand that warning the wide public will net zero results, now and centuries in the future. Homo Sapiens hasn't evolved enough of a collective conscience to actually act on revelations such as Snowden's, that's the historically obvious fact. Even the words of the biggest security experts like Schneier fall on deaf ears either because the politicians are better at rhetoric or because the public is too busy posting their food pictures on Instagram, or (as I believe) a mix of both. So they opted for the nuclear approach: release the hacking tools and demonstrate practically to the world the dangers of these hidden-under-the-table hacking tools. And now many more business people and politicians pay more attention than before. This is a sound psychological attack technique. Demonstrate that your opponent's claims for doing the best for the populace are not holding to reality. Even though I find this immoral and potentially dangerous IMO none of us can deny the devastating results to NSA's reputation. - Spread FUD and never share anything truly revealing. They use language fuzzing techniques, occasionally engage in political debates without clarify which side they ally with (saying they are on Trump's side means nothing), use both old and new hacking tools and other files, use vague speak to shift suspicion to former NSA employees or contractors (I imagine this is done so they exhaust the agency while it tries to plug yet another leak which might as well be imaginary -- but they can't risk it and the attackers know it) -- all of these tarnish the image of the NSA and forces them to work extra to try and find moles, fix bugs in their own defense systems, go on internal witch hunts, double down on efforts to find the remote hackers, compartmentalize their physical and virtual clearance levels, etc. As mentioned in the parentheses, the attackers seem to aim to exhaust the agency and IMO it's working -- although none of us keyboard warriors in HN can't know for sure of course. - Have time work for you. The fact that Shadow Brokers are hunted by a lot of law-enforcement agencies for like what, 15 months now? -- is projecting a clear image to the world that these agencies aren't as ubiquitous as they would want us to think. This probably encourages other people to try and hit other (or same) agencies all over the world. Not sure if that is good or bad -- opponents of this approach might say it will lead to anarchy and chaos but in my opinion (partially founded by rudimentary knowledge of chaos theory and game theory) the living systems like ours have plenty of emergency levers to pull them back into a more balanced state. It's 50/50 though, I don't claim anything either way. In any case though, the agencies' inability to catch these people makes the wide public lose confidence in them. ---- Please note I am not taking sides here. I do believe NSA does a lot of unethical things and should be held much more accountable than it is right now, but I am uncertain if what Shadow Brokers is doing is the right way to achieve that result. It might as well make NSA and friends become even more paranoid and actually become much better and more subtle in its mass surveillance... which is a loss for everybody but them. Oh well, time will tell. In any case, this is interesting news and development and I am slightly pleased that the intelligence agencies get some run for their money. And slightly terrified of the possible consequences.