5 ms·

When I was an irresponsible high school grey hat (2001) I was part of a small group of people that shared exploits. We weren't that talented, but one of the guy

• draugadrotten 9y ago
  > . We weren't that talented, but one of the guys in our group was still able to get into the cameras in the parking lot of the CIA. Well, by now, 16 years later perhaps you will have learned about the concept of honeypots.
  • d33 9y ago
    How do you imagine a camera honeypot at the CIA parking lot? They'd still be leaking a lot of information if the image was true.
    • chrisper 9y ago
      I think he meant the job offer.
    • TeMPOraL 9y ago
      Did they go there in person and verify it's an actual CIA parking lot?
      • 3pt14159 9y ago
        IIRC, which isn’t garunteed due to the years involved, it was on an IP that when he did a reverse lookup for others on the subnet associated with a cia.gov subdomain or something like that. Plus it just looked American. But we could have misinterpreted it. And it could have just been a recruiting tool or honey pot. I get lost in forests of mirrors.
    • squarefoot 9y ago
      Not if the DVR is actually in their lab and video inputs are fed with streams coming from a place where trained personnel will show only what they want to show.
      • jtbayly 9y ago
        I can't even imagine what the purpose of this sort of honeypot would be. What a waste of money that would be. It's so absurd an idea that I would laugh at it if I didn't know how much money was spent and wasted by the federal government. Really the only way to explain it is this sort of thing. "Let's set up a whole fake parking lot, hire people to come and go in it, get a bunch of fake license plates, buy a bunch of cars, setup a camera surveillance system and feed it out onto the internet and see if anybody finds it!" "APPROVED! I don't care how much it costs!"
        • Drakim 9y ago
          You could probably save on reusing the video footage of another parking lot, instead of using actors.
          • squarefoot 9y ago
            "You could probably save on reusing the video footage of another parking lot, instead of using actors." Live or recorded video footage from somewhere else can be spotted as fake (car license plates, distant shop signs, different weather conditions, etc) and recorded footage will also eventually wrap around revealing it's recorded. It all depends on what they need to accomplish.
    • drawnwren 9y ago
      Why do you imagine the CIA parking lot would leak information? Keep in mind the CIA has been fighting an adversary they believe to have significantly infiltrated the US since at least the 30s. Anything that would be leaked by personnel being associated w/ the CIA is probably not done at the building with CIA on the side to begin with.
      • d33 9y ago
        Metadata. They can't keep everything in check.
• babuskov 9y ago
  I agree with the rest of your points, but that "shitty" high school hacker managed to hide his identity from CIA. You're underestimating him. Majority of wannabe hackers would screw up some detail and get discovered.
  • Fnoord 9y ago
    "Hiding your identity" is a relative premise, not an absolute one.
  • r3bl 9y ago
    Or, since he's taken steps to protect his identity, CIA might have offered a fake job offer for the purpose of him revealing his identity.
    • throwaway5665 9y ago
      I think this what happened.. the government has very formal hiring procedures, a government employee can’t just send spurious offer letters to foreign nationals.
      • user5994461 9y ago
        An email is not a job offer. It's just an invitation to interview. There are no procedures against that.
        • throwaway5665 9y ago
          He literally said job offer.
          • 3pt14159 9y ago
            I may have misrembered. It was so long ago.
      • sailfast 9y ago
        This is not necessarily the case for organizations that have special hiring authorities and/or contract dollars for use rapidly.
• AFNobody 9y ago
  > This is the problem with cyber security: Even if you're the most knowledgeable organization on earth you still fuck it up. Any one person can fuck up any one thing and if it isn't part of your predetermined threat vector analysis then it gets through and you lose everything. It isn't just cyber security but surveillance infrastructure in general. If you cultivate a large group of surveillance assets (even people) with a method of collection that can be effectively attacked, you are creating something worth the effort to attack. By creating a position that can be attacked, you will get attacked. And given enough attacks you will get attacked successfully sooner or later. It is safer to not build the surveillance apparatus in the first place because you _always_ lose control of it sooner or later.
  • chronic193 9y ago
    > It is safer to not build the surveillance apparatus in the first place because you _always_ lose control of it sooner or later. I'd rather be able to watch and data mine citizens for 6 months to a year, before control is lost. And companies do.
  • 3pt14159 9y ago
    I disagree with your conclusion, but I think your comment has a ton of truth to it. It's like that meme with the smiling black guy: "You can't write any bugs if you don't write any code." But the truth is that all the infrastructure for surveillance is going to be built anyway, if not by us then by our enemies or private industry. It's better to accept that it is going to be built and use our resources as best we can to protect the world.
    • AFNobody 9y ago
      > But the truth is that all the infrastructure for surveillance is going to be built anyway, if not by us then by our enemies or private industry. It's better to accept that it is going to be built and use our resources as best we can to protect the world. Of course. And then you attack _their_ surveillance infrastructure and take the fruit of their investments periodically. Attacking surveillance infrastructure (tbh) seems more productive than building it.
• userbinator 9y ago
  They emailed back with a job offer. Back then we assumed it was trap to get him to travel to the USA from Canada, but these days, based on what I've seen, I think it was legitimate. I think it is a trap of sorts --- "join us and help build the future dystopian surveillance state, or we'll find out who you are and arrest you".
• dopamean 9y ago
  I received an offer from the FBI in 2003 for something I did in 2001. I was similarly distrustful even though I had already been caught and punished. It was the most surreal and frankly unnerving experience.
  • pavel_lishin 9y ago
    You managed to go through the legal system in under two years? Impressive.
    • dopamean 9y ago
      I think a combination of it being pre 9/11, me being 15, and expensive lawyers helped things along. I was arrested in February of 2001 and it was done by my birthday in September.
• kalleboo 9y ago
  > This is the problem with cyber security This is why I think cryptocurrency is a terrible idea. Even if nobody ever finds a problem with the system itself (unlikely on an infinite timescale), every bank will get hacked at some point, and with no rollbacks it will eventually end in disaster.
  • 45h34jh53k4j 9y ago
    but there are so many things that have this 'irreversible' property in the real world. Identities. Secrets. Exploits. Once (hacked) you cant get the genie back in the bottle. I feel this irreversibility is what is of real value in an information economy. Cryptocurrency is similar. Its 'real', unlike USD/EUR/etc, which are insured. At best its a record in a centralized db. Please rethink your position on disaster :-) If 2017 is anything to go by, the world is more resilient to disaster than believed.
• walrus01 9y ago
  > the CIA this is why anything sensitive is air gapped and inside a SCIF... but good luck getting everyone to adhere to that all of the time. it's a hard problem to solve when people want things to "just work".
  • 3pt14159 9y ago
    True. Also, the problem with air gaps is that people come to depend on them. According to documents about stuxnet and the Snowden leaks, the CIA has said that air gaps have never stopped them, so why should we think that it's any different? Also, many places people think are air gapped aren't any more. Think smart lightbulbs and bluetooth worms. A hacked android device that gets too close to the perimeter can infect the lightbulb which infects the next one on and down the chain. If someone networks the control computer for the lights to the same network with the classified files it's lights out. I think of the internet less of a binary thing these days and more of a spectrum. Things can be "pretty dark" like in the basement of NORAD or "white hot" like the twitter feed of Donald Trump. But twitter still goes down sometimes and data can be exfiltrated in so many ways. What's the baud on opening and closing vents and reading it from space satellites?
    • tomerv 9y ago
      >What's the baud on opening and closing vents and reading it from space satellites? Here's an example where researchers used a scanner in an office building to exfiltrate data from the network. Malware on the network activates the scanner in a certain pattern, which lights up the room. The difference in lighting is recorded using a drone outside across the parking lot: https://www.bankinfosecurity.com/black-hat-europe-beware-air-gaps-a-7442 https://www.bankinfosecurity.com/black-hat-europe-beware-air...