5 ms·

This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description o

by jelly 9y ago

This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical) [1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... [2] https://news.ycombinator.com/item?id=15663985 https://news.ycombinator.com/item?id=15663985

ethbro 9y ago
It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...
- drawnwren 9y ago
  To be fair, we were also executing people on the suspicion of treason in the 50s.
  - deleted 9y ago
    [deleted]
- angry_octet 9y ago
  I can assure you that 'taking' data off these systems is non-trivial -- Snowden was one of the few people with physical access and admin access. Attempting to access a large amount of info in 24H would also set off alarms. There is also no end to the pain-in-the-ass rules. But the gist of what you are saying is correct, a lot more interconnection, a lot more software, using standard (albeit locked down) desktop operating systems. I think there was a realisation that the ultra-compartmented sharing-via-paper approach was killing effectiveness. What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source. All the powerpoints could all be individual data spills, collected over time. All the TAO tooling could be stuff that sat on the dev system behind some bastion host, ready to be pushed to staging servers. Personally, I would only let binaries get that far out, but operational exigencies occur, high side operators can be phished, etc.
  - peoplewindow 9y ago
    Yeah but Snowden had that level of access simply because he applied for the job, with the full intention of using it to do leaking.
    - angry_octet 9y ago
      That he was selected for this job is a fault of Congress, for imposing caps on government employee numbers (and salaries), but not contractors, during the greatest period of SIGINT expansion in history (also authorised by Congress), and then outsource their vetting to the cheapest bidder. Oh, and have a President that creates a secret law for side stepping the Constitution. Of course, given a defective Congress, what should the IC have done? Limit their use of computers? Stop sharing information? Encrypt everything on servers and decrypt client side via special hardware? Have someone watch the admins as if they are all wannabe traitors? Disperse honeypot systems and canary docs everywhere? Tripwire the heck out of every system? Fit explosive collars on systems administrators? Well, all those things and more have now been contemplated. Everything except 'stop collecting'.
    - boomboomsubban 9y ago
      He had that access as he had been working for first the CIA, then the NSA, for five years before he decided to become a whistleblower.
- nickpsecurity 9y ago
  "It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization." It's on purpose. After 9/11, the intelligence agencies were lambasted for not sharing information. They were told the next one (a) couldn't happen and (b) would be their fault if it did. Lots of other motivations for the expansion in power, too. One side effect of this was compartmentalization was weakened a lot across the board. Over time, the security strength of things such as cross-domain solutions and endpoints had been dropping. The rush to get everything in that could benefit the mission increased that further. Yeah, they're probably more vulnerable now than they ever were with more information to take with less chance of detection. Government and private sector. Their people like Roger Schell and Brian Snow warned them for a long time. Private contractors warned them. Those such as Aesec, BAE, and Green Hills even built and paid for evaluations of the kind of tech they said they wanted. They just used it less and less with stuff easy to hack being used more and more. In Snowden's case, the level of security was worse than a lot of enterprises with far less money.
- ENOTTY 9y ago
  Under what basis do you assert that intelligence in the 60s was done primarily using human intelligence? The full history of intelligence collection during the Cold War has not yet been fully declassified.

by jelly 9y ago

ethbro 9y ago

It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization. We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours. My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them. It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable. [1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/csi-studies/studies/vol53no4/201ccunning-passages-contrived-corridors201d.html https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...

drawnwren 9y ago
To be fair, we were also executing people on the suspicion of treason in the 50s.
- deleted 9y ago
  [deleted]
angry_octet 9y ago
I can assure you that 'taking' data off these systems is non-trivial -- Snowden was one of the few people with physical access and admin access. Attempting to access a large amount of info in 24H would also set off alarms. There is also no end to the pain-in-the-ass rules. But the gist of what you are saying is correct, a lot more interconnection, a lot more software, using standard (albeit locked down) desktop operating systems. I think there was a realisation that the ultra-compartmented sharing-via-paper approach was killing effectiveness. What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source. All the powerpoints could all be individual data spills, collected over time. All the TAO tooling could be stuff that sat on the dev system behind some bastion host, ready to be pushed to staging servers. Personally, I would only let binaries get that far out, but operational exigencies occur, high side operators can be phished, etc.
- peoplewindow 9y ago
  Yeah but Snowden had that level of access simply because he applied for the job, with the full intention of using it to do leaking.
  - angry_octet 9y ago
    That he was selected for this job is a fault of Congress, for imposing caps on government employee numbers (and salaries), but not contractors, during the greatest period of SIGINT expansion in history (also authorised by Congress), and then outsource their vetting to the cheapest bidder. Oh, and have a President that creates a secret law for side stepping the Constitution. Of course, given a defective Congress, what should the IC have done? Limit their use of computers? Stop sharing information? Encrypt everything on servers and decrypt client side via special hardware? Have someone watch the admins as if they are all wannabe traitors? Disperse honeypot systems and canary docs everywhere? Tripwire the heck out of every system? Fit explosive collars on systems administrators? Well, all those things and more have now been contemplated. Everything except 'stop collecting'.
  - boomboomsubban 9y ago
    He had that access as he had been working for first the CIA, then the NSA, for five years before he decided to become a whistleblower.
nickpsecurity 9y ago
"It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization." It's on purpose. After 9/11, the intelligence agencies were lambasted for not sharing information. They were told the next one (a) couldn't happen and (b) would be their fault if it did. Lots of other motivations for the expansion in power, too. One side effect of this was compartmentalization was weakened a lot across the board. Over time, the security strength of things such as cross-domain solutions and endpoints had been dropping. The rush to get everything in that could benefit the mission increased that further. Yeah, they're probably more vulnerable now than they ever were with more information to take with less chance of detection. Government and private sector. Their people like Roger Schell and Brian Snow warned them for a long time. Private contractors warned them. Those such as Aesec, BAE, and Green Hills even built and paid for evaluations of the kind of tech they said they wanted. They just used it less and less with stuff easy to hack being used more and more. In Snowden's case, the level of security was worse than a lot of enterprises with far less money.
ENOTTY 9y ago
Under what basis do you assert that intelligence in the 60s was done primarily using human intelligence? The full history of intelligence collection during the Cold War has not yet been fully declassified.