7 ms·
>But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromi
by solatic 8y ago
>But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to interact with its vetted sources, according to the former officials.
>In the words of one of the former officials, the CIA had “fucked up the firewall” between the two systems.
If you read between the lines, this raises the suspicion that there's a common underlying infrastructure which handles the communications, with management front-ends for different users which are firewalled off from each other, and the security of the system relied upon the firewall between the different front-ends to prevent users from finding out about each other. However, an attacker who compromised the "less secure" front end, could use that as a launching pad to attack the underlying communication infrastructure, and if the attacker pwned the infrastructure, then he'd have a back entrance to the "more secure" front end.
If that's the case, then somebody was grossly incompetent, depending on the age of the system: if the system is old enough, then somebody running ops in the CIA is incompetent, for continuing to operate a system whose security model ("all you need is a strong enough firewall!") was obsolete; if the system is young enough, then either the original architects, or the security engineers who certified the architecture (if there were any), for proposing an architecture with an obsolete security model.
Arguably, that incompetence amounts to criminal negligence, since it resulted in the deaths of US agents, and somebody should be tried for it.
- baybal2 8y agoHow stupid it is to spend so much effort on compartmentalising their intel net in the country, but have all spies report by dialing in into the same website in a country employing few brigades worth of people reading tcpdumps 24/7? Compare that to one way coded messages over hf radio: a place for pick up of a dead drop in n days is broadcasted, then it is picked up by a man who reads it, destroys it, and gtfos from the country. In that scheme nobody in any way contacts anybody in real time other that the HQ.
- nerdponx 8y agoMy guess is that this is actually relatively new system that was implemented after the criticisms in the week of the September 11 attacks. One of the stories you keep hearing is that the plot was not discovered in time because agencies were not sharing enough information.
- deleted 8y ago[deleted]
- brown9-2 8y agoOne would hope they created a new hostname/IP for each source, but even then it is astonishing that they used the same communication method for so many sources.
- nasredin 8y agoThere's still "number stations" broadcasting over shortwave radio. If it ain't broke, don't fix it?!
- etrevino 8y agoNumber stations, though, are usually used for things like one-time pads or to send a previously agreed upon command. Detailed instructions are not really what number stations are good for.
- baybal2 8y agotime, date, longitude, latitude is just below the length of an average number station transfer
- dsl 8y ago> Compare that to one way coded messages over hf radio Having a shortwave radio in your possession is justification enough to haul you in for questing in some countries. There is also relatively little "radio traffic" to inspect relative to internet traffic.
- covermydonkey 8y agoAgreed. > U.S. intelligence officers were also able to identify digital links between the covert communications system and the U.S. government itself, according to one former official—links the Chinese agencies almost certainly found as well. These digital links would have made it relatively easy for China to deduce that the covert communications system was being used by the CIA. In fact, some of these links pointed back to parts of the CIA’s own website, according to the former official. How was this approved? This is such an obvious no-no. Would have expected a completely standalone, ring-fenced platform with absolutely no relationship to the government's known IP addresses and domains?
- bcaa7f3a8bbc 8y agoWhat a shock. Even the CIA can be that incompetent?!
- paulie_a 8y agoI forget where this quote is from but "the CIA would fuck up a cup of coffee"
- SAI_Peregrinus 8y agoOr the joke: How do we know the CIA didn't kill Kennedy? He's dead isn't he?
- arminiusreturns 8y agoJoking aside they definitely played some role, at minimum by participating in the coverup.
- dalore 8y agoWhy are they using an off the shelf secure communication system from the Middle East? Surely something this important is a national secret and should be developed in house with your best minds. If it's off the shelf and others are using, then they can just buy the equipment and look for flaws (like this massive one).
- dillondoyle 8y agoI obviously have no technical info, but my guess from this article is that 'back entrance' is probably inferring too much. I would bet that communication apps A and B made connections to the same someCIADomain/IP range (or other less obvious metadata patterns, maybe the shared methods produced enough entropy on the whole to fingerprint). Thus even if one can't read the content of the message the firewall matches the discovered pattern === likely a spy; so if the less vetted App A source was compromised offline and thus the shared online pattern is now known so too are sources using App B who were less likely to be compromised offline.
- _bxg1 8y agoThis makes a good case for an official software engineering licensing program like what we have for other kinds of engineers, at least for high-risk things like medical control systems and government security. Right now, a nontechnical person has no basis for evaluating the quality of engineer which they hired to do this job, except by asking other engineers, etc.
- SEJeff 8y agoHere I was always assuming they employed the types of people who read HN to build systems like this. I'd expect e2e crypto, perfect forward secrecy, perhaps something akin to tor, and maybe even the ability to use steganography to disguise the fact any comms were really happening at all. Oh look at this cute kitten picture, let me save it and then get the encrypted code out of it. That's great, let me upload this equally cute puppy riding a skateboard picture to the forum that contains my reply.
- nyolfen 8y agoit wouldn’t surprise me if it was a tor service via bridge. the snowden docs showed that gchq uses tor to communicate with assets. a big part of the value of tor is that even if youre detected connecting to it, that doesnt prove youre doing anything in particular on it, only that you’re using the network.
- SEJeff 8y agoTor was funded by the DoD / CIA for exactly this: https://surveillancevalley.com/blog/fact-checking-the-tor-projects-government-ties https://surveillancevalley.com/blog/fact-checking-the-tor-pr...
- sandworm101 8y agoBetween the lines: it was Tor. Deploys on computers. Web-based. Detectable through decryption or pattern analysis. Firewalls. It was a pair of Tor hidden services. The mistake was probably that they ran both on the same machine with only a firewall separating them, rather than physically different servers.
- jandrese 8y agoAnd on the hidden website there was a link back to cia.gov somewhere. On the other hand I'm surprised tor works in China at all. I would expect the Great Firewall to shut down all entrance/exit nodes going into or out of the country, except maybe for a few controlled by the government.
- t3soro 8y agoIf you're the CIA, you have installed dark fiber or at least satellites bridging your Chinese Tor nodes to the rest of the worldwide Tor network.
- Hello71 8y agoThe security level varies frequently. It's known that meek still works in China, which is probably a major reason why both Google and Amazon have shut down domain fronting.
- hackermailman 8y agoWhich sounds like a management decision to cut costs by running them on the same server. This is probably why we are seeing ex regime department heads in the news lately as political pundits in hopes they create enough deflection to avoid prosecution for 30+ agents dying on their watch.
- obmelvin 8y agoDo you seriously think the CIA cared about server costs for something like this?
- st26 8y agoTo me, preventing this seems like exactly the sort of thing the NSA ought to be for.
- yardie 8y agoThere was a time when the NSA was in the white hat business; securing networks, identifying vulnerabilities and contributing to net sec projects. SELinux has been their most famous contribution. This all changed with the war on terrorism. Finding and exploiting vulnerabilities was the mission.
- jonnybgood 8y agoIt hasn’t changed. Why you’re referring to falls under Information Assurance in their mission statement.
- Kalium 8y agoExactly. It tends to not make the news, but it's all there still.
- jessaustin 8y agoIf we assume they're "there still", TFA seems to indicate that they could be doing a better job?
- Kalium 8y agoThe CIA has a tendency to do its own thing, and the NSA found the vulnerabilities. To my mind, this suggests that the NSA is competent at their job when allowed to do it. Further, the CIA could stand to benefit by allowing the specialists at the NSA to perform their function rather than trying to replicate it in-house. This is naught but my opinion, and I understand where others might differ in their reading of the situation presented to us.
- 394549 8y ago
- hackinthebochs 8y ago> and the security of the system relied upon the firewall between the different front-ends I really don't think there's anything to conclude from the "firewall" comment. This term has become a layman way of describing any kind of intended separation between computer systems. People know what firewalls are and so it becomes an overused analogy. It's like how passwords are described as being "encrypted" in layman media.
- xkcd-sucks 8y agoThe experts in opsec forgot to apply their common sense rules (compartmentalization) to their own software
- rb808 8y agoWhat are the salaries the CIA is paying? I doubt they have "the best" on it.
- debt 8y agoThe CIA is incompetent. It’s their system.