7 ms·

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also ca

by natch 9y ago

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving. Maybe my wording is not perfect "they are capable of leaking" well you could argue that NSA didn't leak, it was possibly hacked by an outside actor. I don't think the distinction matters much though in this case. The main point is that they can no longer say "trust us" with a straight face.

jelly 9y ago
This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical) [1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... [2] https://news.ycombinator.com/item?id=15663985 https://news.ycombinator.com/item?id=15663985
- ethbro 9y ago
  It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...
  - drawnwren 9y ago
    To be fair, we were also executing people on the suspicion of treason in the 50s.
    - deleted 9y ago
      [deleted]
  - angry_octet 9y ago
    I can assure you that 'taking' data off these systems is non-trivial -- Snowden was one of the few people with physical access and admin access. Attempting to access a large amount of info in 24H would also set off alarms. There is also no end to the pain-in-the-ass rules. But the gist of what you are saying is correct, a lot more interconnection, a lot more software, using standard (albeit locked down) desktop operating systems. I think there was a realisation that the ultra-compartmented sharing-via-paper approach was killing effectiveness. What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source. All the powerpoints could all be individual data spills, collected over time. All the TAO tooling could be stuff that sat on the dev system behind some bastion host, ready to be pushed to staging servers. Personally, I would only let binaries get that far out, but operational exigencies occur, high side operators can be phished, etc.
    - peoplewindow 9y ago
      Yeah but Snowden had that level of access simply because he applied for the job, with the full intention of using it to do leaking.
      - angry_octet 9y ago
        That he was selected for this job is a fault of Congress, for imposing caps on government employee numbers (and salaries), but not contractors, during the greatest period of SIGINT expansion in history (also authorised by Congress), and then outsource their vetting to the cheapest bidder. Oh, and have a President that creates a secret law for side stepping the Constitution. Of course, given a defective Congress, what should the IC have done? Limit their use of computers? Stop sharing information? Encrypt everything on servers and decrypt client side via special hardware? Have someone watch the admins as if they are all wannabe traitors? Disperse honeypot systems and canary docs everywhere? Tripwire the heck out of every system? Fit explosive collars on systems administrators? Well, all those things and more have now been contemplated. Everything except 'stop collecting'.
cm2187 9y ago
Agree, though the only thing that gives me any comfort (and it is the same with google, gmail, facebook, etc) is that the amount of data they collect is nearly impossible to ex filtrate because of its sheer size.
- Canada 9y ago
  Once upon a time movies were too big to download, and now look.
  - aesclepius 9y ago
    When was that, 1999? That's nearly 20 years ago.
  - cm2187 9y ago
    Bandwidth has been increasing very slowly. And I think we will be stuck at 1gbit for a long time (and in many areas: if we ever reach it), just because there are no consumer use for higher bandwidth. Already 4k video resolution is a stretch, most people wouldn’t notice the difference to 1080p on a TV from they couch. So there will be a need to upgrade wholesale bandwidth just because the internet keeps growing, people are already talking about next gen game consoles to be cloud based (ie the rendering to be made remotely) which will add more traffic. But not 5 orders of magnitude. The amount of data stored by the gmails and facebooks of this world are mind blowing.
    - Canada 9y ago
      Who says attackers must use home or small office connections? Why can't the data be exfiltrated to a top tier data center with excellent peering?
      - cm2187 9y ago
        But consumer/corporate demand for bandwidth is what should ultimately drive increase in data center bandwidth. Another point is defeating monitoring. I am sure the NSA (or Google/Facebook) could not notice 1GB of upload, but I like to think that uploading 1PB of data would make all sorts of red lights flash in they network security control room.
kurthr 9y ago
Yes, and the corollary to that any foreign power that wants to spy on Americans need only focus on a single point of failure... our own security apparatus. It would be much more difficult to develop the data collection, storage, and management of that data on their own. We have paid to do it to our selves. Now maybe there are counter espionage methods developed... but the idea that our geopolitical competitors don't have a single other mole as a contractor with Snowden's level of access is no longer (and frankly never was) credible. You could probably make a similar argument about our advertising apparatus. Never develop a tool/weapon you can't afford to be used against you, because in the long term it will.
QAPereo 9y ago
The main point is that they can no longer say "trust us" with a straight face. If the politics of the last few decades has tried to teach us anything, it's that this is not true. No amount of shaming or obvious shortcomings will ever allow some people to bridge the reality/ideology-gaps in question. You don't see less lying as people are confronted with their lies, you're met with a hurricane of new lies, a Gish Gallop of misinformation, over and over. If all goes truly wrong, then people in power embrace the genuinely Orwellian and start talking about freedom in chains, or peace in war. Nothing shakes them out of it, and nothing really changes how some people view it. Or at least, nothing so minor as what the future might hold; most people seem to struggle with what's actually happening today, under their noses.
- ataturk 9y ago
  What will change them is when we little people have finally had enough of their bullshit and do what we should already be doing which is putting a stop to it. Trump getting elected was the first big signal for them cut their shit out. But they won't listen--the dissonance and excuses being made around Trump tells you everything you need to know. The next step if they don't listen is going to be way uglier.
daxorid 9y ago
Exfiltration is a problem. It's more difficult to exfil terabytes of individual citizen dossiers than ~2GB of malware, implants, tools, scripts, etc from classified and possibly even SCIF environments. Or it could be more prosaic than that: Money. The market value of NSA tooling is likely far far higher than the threat assessments of Joe Blow Smith in Hoboken, NJ.
- godelski 9y ago
  I don't think the concern is Joe Smith. The concern is high level people who can easily be blackmailed. Or even just someone who works in a classified setting. The value of blackmailing a few political elites is extremely powerful and profitable. Or even people in big companies like FAANG.
  - freeone3000 9y ago
    I don't think any blackmail would be effective at this point. When a man gets accused of molesting a teenager then gets elected to the Senate, I think the potential for blackmail has passed.
iamben 9y ago
I'm surprised this isn't used in privacy arguments more often. Every time governments and politicians suggest tracking everything we do for our safety with the assurance our data is safe, surely it's prudent to point out that if (arguably) the most secret and advanced cyber command in the world can't keep their weapons and secrets safe, what chance do you have?
- Deestan 9y ago
  "Don't worry. We are taking all precautions. It is 100% safe. Only a very few, select personell will have access to the data." They will just give the same bullshit answer as always. Sometimes throw in a new phrase ("24/7 guarded datacenter") to pretend they are not vulnerable to obvious risks.
  - at-fates-hands 9y ago
    You also forgot the part about how they always say, "Your data is safe, we can't get it without a court/judges approval." Which means from a FISA court. A closed, secret court no one hears about and no one is there to act as your advocate.
Pyxl101 9y ago
Maybe, maybe not. NSA hacking tools can't necessarily be kept privately within their network, because they have to be used to attack targets across the Internet -- they have to be deployed. By comparison, the data that the NSA collects can presumably be sucked into their airgapped network, where data has a way in but no way out.
- sorokod 9y ago
  Data has to be accessable to be of any use.
  - gtcode 9y ago
    Has Snowden or any whistleblower given any indication as to whether such networks are air-gapped, accessible from the internet, etc?
tempodox 9y ago
And if it can happen to them, how much more likely will it happen to everyone else who has heaps of data about you?
arca_vorago 9y ago
It doesnt even have to be leaked when they are sharing raw data with the Israelis, a country just as active in espionage against the US as China or Russia.

by natch 9y ago

jelly 9y ago

This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical) [1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... [2] https://news.ycombinator.com/item?id=15663985 https://news.ycombinator.com/item?id=15663985

ethbro 9y ago
It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...
- drawnwren 9y ago
  To be fair, we were also executing people on the suspicion of treason in the 50s.
  - deleted 9y ago
    [deleted]
- angry_octet 9y ago
  I can assure you that 'taking' data off these systems is non-trivial -- Snowden was one of the few people with physical access and admin access. Attempting to access a large amount of info in 24H would also set off alarms. There is also no end to the pain-in-the-ass rules. But the gist of what you are saying is correct, a lot more interconnection, a lot more software, using standard (albeit locked down) desktop operating systems. I think there was a realisation that the ultra-compartmented sharing-via-paper approach was killing effectiveness. What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source. All the powerpoints could all be individual data spills, collected over time. All the TAO tooling could be stuff that sat on the dev system behind some bastion host, ready to be pushed to staging servers. Personally, I would only let binaries get that far out, but operational exigencies occur, high side operators can be phished, etc.
  - peoplewindow 9y ago
    Yeah but Snowden had that level of access simply because he applied for the job, with the full intention of using it to do leaking.
    - angry_octet 9y ago
      That he was selected for this job is a fault of Congress, for imposing caps on government employee numbers (and salaries), but not contractors, during the greatest period of SIGINT expansion in history (also authorised by Congress), and then outsource their vetting to the cheapest bidder. Oh, and have a President that creates a secret law for side stepping the Constitution. Of course, given a defective Congress, what should the IC have done? Limit their use of computers? Stop sharing information? Encrypt everything on servers and decrypt client side via special hardware? Have someone watch the admins as if they are all wannabe traitors? Disperse honeypot systems and canary docs everywhere? Tripwire the heck out of every system? Fit explosive collars on systems administrators? Well, all those things and more have now been contemplated. Everything except 'stop collecting'.

cm2187 9y ago

Agree, though the only thing that gives me any comfort (and it is the same with google, gmail, facebook, etc) is that the amount of data they collect is nearly impossible to ex filtrate because of its sheer size.

Canada 9y ago
Once upon a time movies were too big to download, and now look.
- aesclepius 9y ago
  When was that, 1999? That's nearly 20 years ago.
- cm2187 9y ago
  Bandwidth has been increasing very slowly. And I think we will be stuck at 1gbit for a long time (and in many areas: if we ever reach it), just because there are no consumer use for higher bandwidth. Already 4k video resolution is a stretch, most people wouldn’t notice the difference to 1080p on a TV from they couch. So there will be a need to upgrade wholesale bandwidth just because the internet keeps growing, people are already talking about next gen game consoles to be cloud based (ie the rendering to be made remotely) which will add more traffic. But not 5 orders of magnitude. The amount of data stored by the gmails and facebooks of this world are mind blowing.
  - Canada 9y ago
    Who says attackers must use home or small office connections? Why can't the data be exfiltrated to a top tier data center with excellent peering?
    - cm2187 9y ago
      But consumer/corporate demand for bandwidth is what should ultimately drive increase in data center bandwidth. Another point is defeating monitoring. I am sure the NSA (or Google/Facebook) could not notice 1GB of upload, but I like to think that uploading 1PB of data would make all sorts of red lights flash in they network security control room.

kurthr 9y ago

Yes, and the corollary to that any foreign power that wants to spy on Americans need only focus on a single point of failure... our own security apparatus. It would be much more difficult to develop the data collection, storage, and management of that data on their own. We have paid to do it to our selves. Now maybe there are counter espionage methods developed... but the idea that our geopolitical competitors don't have a single other mole as a contractor with Snowden's level of access is no longer (and frankly never was) credible. You could probably make a similar argument about our advertising apparatus. Never develop a tool/weapon you can't afford to be used against you, because in the long term it will.

QAPereo 9y ago

The main point is that they can no longer say "trust us" with a straight face. If the politics of the last few decades has tried to teach us anything, it's that this is not true. No amount of shaming or obvious shortcomings will ever allow some people to bridge the reality/ideology-gaps in question. You don't see less lying as people are confronted with their lies, you're met with a hurricane of new lies, a Gish Gallop of misinformation, over and over. If all goes truly wrong, then people in power embrace the genuinely Orwellian and start talking about freedom in chains, or peace in war. Nothing shakes them out of it, and nothing really changes how some people view it. Or at least, nothing so minor as what the future might hold; most people seem to struggle with what's actually happening today, under their noses.

ataturk 9y ago
What will change them is when we little people have finally had enough of their bullshit and do what we should already be doing which is putting a stop to it. Trump getting elected was the first big signal for them cut their shit out. But they won't listen--the dissonance and excuses being made around Trump tells you everything you need to know. The next step if they don't listen is going to be way uglier.

daxorid 9y ago

Exfiltration is a problem. It's more difficult to exfil terabytes of individual citizen dossiers than ~2GB of malware, implants, tools, scripts, etc from classified and possibly even SCIF environments. Or it could be more prosaic than that: Money. The market value of NSA tooling is likely far far higher than the threat assessments of Joe Blow Smith in Hoboken, NJ.

godelski 9y ago
I don't think the concern is Joe Smith. The concern is high level people who can easily be blackmailed. Or even just someone who works in a classified setting. The value of blackmailing a few political elites is extremely powerful and profitable. Or even people in big companies like FAANG.
- freeone3000 9y ago
  I don't think any blackmail would be effective at this point. When a man gets accused of molesting a teenager then gets elected to the Senate, I think the potential for blackmail has passed.

iamben 9y ago

I'm surprised this isn't used in privacy arguments more often. Every time governments and politicians suggest tracking everything we do for our safety with the assurance our data is safe, surely it's prudent to point out that if (arguably) the most secret and advanced cyber command in the world can't keep their weapons and secrets safe, what chance do you have?

Deestan 9y ago
"Don't worry. We are taking all precautions. It is 100% safe. Only a very few, select personell will have access to the data." They will just give the same bullshit answer as always. Sometimes throw in a new phrase ("24/7 guarded datacenter") to pretend they are not vulnerable to obvious risks.
- at-fates-hands 9y ago
  You also forgot the part about how they always say, "Your data is safe, we can't get it without a court/judges approval." Which means from a FISA court. A closed, secret court no one hears about and no one is there to act as your advocate.

Pyxl101 9y ago

Maybe, maybe not. NSA hacking tools can't necessarily be kept privately within their network, because they have to be used to attack targets across the Internet -- they have to be deployed. By comparison, the data that the NSA collects can presumably be sucked into their airgapped network, where data has a way in but no way out.

sorokod 9y ago
Data has to be accessable to be of any use.
- gtcode 9y ago
  Has Snowden or any whistleblower given any indication as to whether such networks are air-gapped, accessible from the internet, etc?

tempodox 9y ago

And if it can happen to them, how much more likely will it happen to everyone else who has heaps of data about you?

arca_vorago 9y ago

It doesnt even have to be leaked when they are sharing raw data with the Israelis, a country just as active in espionage against the US as China or Russia.