8 ms·
Leaked Files Show How NSA Tracks Other Countries’ Hackers
- jonathanstrange 9y agoWhen I read this (interesting) article, I was wondering whether there is any free or commercial tool for detecting those indicators of compromise on GNU/Linux machines. I know rootkithunter, but that seems to be fairly weak heuristically. Other tools like tripwire, on the other hand, are based on snapshots and hashes and only monitor changes. I'd be interested in a tool that can indicate suspicious kernel modifications, USB drivers and other software that behaves in unusual ways without triggering tons of false positives and independently of any certificates or whether the software comes from a supposedly trusted repository. But AFAIK, there is not even a key logger detection tool for Linux.
- DyslexicAtheist 9y agofor production systems you could run the kernel under an apparmor profile. also mentioned in this awesome talk[1] [1] https://www.youtube.com/watch?v=346WmxQ5xtk https://www.youtube.com/watch?v=346WmxQ5xtk
- irundebian 9y agoI don't think that it makes sense in a technical point of view to try to observe something if an attacker has already compromised your kernel. As soon as this happens, there is nothing you can do, which is foolproof as long we don't have kernels which are separating privileges within the system. If you want to observer something you have to depend on a trust anchor. In most today systems you don't have a trust anchor when the kernel is compromised.
- deleted 9y ago[deleted]
- spydum 9y agosure, IOC monitoring can be done via osquery (free), or tanium ($$$). You just have to build your own ruleset to pickup IOCs. Linux has AV, and nextgen stuff like Cylance (works but super buggy, runs as a kernel module). You also have other HIDS, like bro, snort, and so on, but those mostly look for suspicious network traffic. Microsoft OMS has been making some plays here, it frequently flags unusually process execution for me (eg: Python running from an uncommon path or some such)
- debeers 9y agoYara is used to find file system artifacts https://virustotal.github.io/yara/ https://virustotal.github.io/yara/
- arca_vorago 9y agoLet me introduce you to ossec and syslog/rsyslog/syslog-ng along with the newfound power of systemd and some gpg fun, with a side of nftables.
- yAnonymous 9y ago“They started to become concerned about sitting on a box with our tools and there being other actors there that could steal or figure out what we were doing.” Seeing as they had all their tools stolen, that must have worked out really well.
- _n_b_ 9y agoThis seems like something completely sensible and even predictable for the NSA to do.
- nerdponx 9y agoIt's cool to see how it is done.
- yjftsjthsd-h 9y agoYeah, of all things to leak... even pre-Snowden, this is what I would expect the NSA to do, because watching other countries' intelligence agencies is what they're supposed to do.
- ryanlol 9y agoYou say this like it’s not obvious. Just because what they’re doing is OK doesn’t make it uninteresting. There are lots of posts on HN about completely sensible things. Why does the NSA need defending this badly anyway?
- chockZ 9y agoI think people are conditioned to associate "leaks" with "scandals" (especially when it comes to the three letter agencies), when in actuality this "leak" is just a revelation of completely reasonable and expected activities.
- badrabbit 9y ago> “It’s a big myth that there are thousands of [signatures] for any particular groups,” he notes. “These [TerritorialDispute] guys really focus on finding the two or three telltale signs that could lock you in [on an APT].” I have a hard time accepting that. Sure,if it was a financially motivated actor or common malware a few "high quality" indicators are all you need. But APT actors know they are being tracked by their adversary using these same indicators. It isn't difficult or costly for them to avoid reuse of infrastructure and tooling. The few attribtions I looked at in detail require a more speculative and somewhat imprecise correlation by humans as opposed to clear and static indicators. Please correct my ignorance if I am wrong. EDIT: Security companies do use "thousands" of signatures and indicators to find events that might possibly be associates with an APT group. Why is the NSA special? That's what I can't accept. As good as the NSA is,multi billion dollar security companies are not far behind (I would say some are even ahead when it comes to defensive security)
- spydum 9y agoAPT groups have a set of tools, techniques, and processes (ttps) that they use. They evolve over time, but generally consistent per APT group. It's maybe dozens of methods and signature moves that teams use to attribute the actor. Malware packages and so on leak data, c2 servers might get reused (or the way the c2 was obtained might inform something). From the attacker point of view, you don't change your methods if they are working. However due to this, you are right: it's incredibly messy and attribution is mostly bullshit. If you notice, it mostly warns the operator to seek help, so others can try to confirm.
- irundebian 9y agoYou could actually say that from the attacker points of view, you should change your methods permanently to avoid tracking / fingerprinting.
- yjftsjthsd-h 9y agoExactly; even individuals know that good opsec means changing your footprint; why would full state actors not do so?
- 2close4comfort 9y agoInteresting to see Zetter writing for the Intercept again after a sizeable absence...
- boomboomsubban 9y agoCan't find anything about it but as she published little elsewhere I would guess another book.
- icco 9y agoSeems like her publishing speed is pretty consistent. Probably just doing research? https://theintercept.com/staff/kimzetter/ https://theintercept.com/staff/kimzetter/
- knodi 9y agoAs they should...
- jorblumesea 9y agoThis is exactly what the NSA was designed to do. Why is the NSA doing its job news?
- latexr 9y agoThe news isn’t that they’re doing it, but that the documents detail how they do it. Disclaimer: I haven’t read the article yet, I’m basing this on the title.
- caf 9y agoIt is at least somewhat interesting that there is so much state-sponsored attacking going on that the incidence of two different states/teams ending up on the same box is not only non-negligible, but even common. It also makes you wonder why it isn't commonplace to harden targets against the exploit that was used to get in, to deny that space to competitors. Perhaps it is, and it's just that there's so many vulnerabilities out there that it's common for multiple teams to break into the same box via different exploits.
- excalibur 9y ago> It turns out those scripts and tools are just as interesting as the exploits. They show that in 2013 — the year the NSA tools were believed to have been stolen by the Shadow Brokers — the agency was tracking at least 45 different nation-state operations, known in the security community as Advanced Persistent Threats, or APTs. Some of these appear to be operations known by the broader security community — but some may be threat actors and operations currently unknown to researchers. Plot twist: Around 20 of them turn out to be separate clandestine programs operated by the US Government.
- boomboomsubban 9y agoOne of the APTs links to Stuxnet, so probably yes.
- meowface 9y agoStuxnet is considered to be a joint project between Israel and the US, so it's quite possible the APT group was Israeli.