11 ms·

30 spies dead after Iran cracked CIA comms network

353 points by new_guy 8y ago

Arnt 8y ago
This might get a little longwinded. Sorry. The following is from http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amaz... and describes the way the Russians implemented SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES: "differences in the way agency officers undercover as diplomats were treated from genuine foreign service officers (FSOs). The pay scale at entry was much higher for a CIA officer; after three to four years abroad a genuine FSO could return home, whereas an agency employee could not; real FSOs had to be recruited between the ages of 21 and 31, whereas this did not apply to an agency officer; only real FSOs had to attend the Institute of Foreign Service for three months before entering the service; naturalized Americans could not become FSOs for at least nine years but they could become agency employees; when agency officers returned home, they did not normally appear in State Department listings; should they appear they were classified as research and planning, research and intelligence, consular or chancery for security affairs; unlike FSOs, agency officers could change their place of work for no apparent reason; their published biographies contained obvious gaps; agency officers could be relocated within the country to which they were posted, FSOs were not; agency officers usually had more than one working foreign language; their cover was usually as a “political” or “consular” official (often vice-consul); internal embassy reorganizations usually left agency personnel untouched, whether their rank, their office space or their telephones; their offices were located in restricted zones within the embassy; they would appear on the streets during the working day using public telephone boxes; they would arrange meetings for the evening, out of town, usually around 7.30 p.m. or 8.00 p.m.; and whereas FSOs had to observe strict rules about attending dinner, agency officers could come and go as they pleased." I read the book. When a CIA agent's cover was blown, the CIA had a spare care and apartment and the agent's replacement needed just that, so they tended to reuse the car and apartment. And wondered why the replacement was then identified so quickly. So. After that long digression, here comes a hypothesis: Organisations that can keep their mistakes secret, can make themselves seem much more capable than other, similarly large organisations.
- AlexCoventry 8y ago
  > Organisations that can keep their mistakes secret, can make themselves seem much more capable And also much slower to learn from their mistakes. The history of the CIA is pretty depressing, in this regard. https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book) https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book)
  - ryanmarsh 8y ago
    Legacy of Ashes does a pretty good job to that end... https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/0307389006 https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/03...
- commandlinefan 8y ago
  > SELECT * FROM EMBASSY_EMPLOYEES WHERE CIA ftfy
- stevew20 8y ago
  TL;DR
- dorfsmay 8y ago
  > SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES Although I personally don't find this type of humour funny I can understand why beginners use it. However, if you are going to use it, please make an effort and get it right. In your attempt to showing off, you're just showing you don't know basic SQL.
  - danharaj 8y ago
    Care to guess what you've said about yourself with this critical comment? :^)
  - brrt 8y ago
    This is actually (almost) legal in teradata sql, which doesn't enforce clause order, but it doesn't accept an identifier as a predicate.
- 8y ago
sokoloff 8y ago
> And Google’s search functions allow users to employ advanced operators — like 'AND', 'OR' ELI5 not needed...
- MrQuincle 8y ago
  Maybe it's a very sophisticated way to tell that {AND,OR} are not functionally complete.
  - lordnacho 8y ago
    Right, it should just have either NAND or NOR. Much simpler.
- tspike 8y ago
  Sadly, not even supported anymore.
noobermin 8y ago
With stories like this it really makes you wonder how we as a nation have survived this long.
- maxerickson 8y ago
  Maybe (much) spy work isn't quite the serious business the national security apparatus would have us believe? I mean, it's obviously serious business to the people taking risks and doing the work on the ground, I'm talking about it actually being useful to the nation.
  - patrickaljord 8y ago
    Totally agree. While they do get a few wins, I wonder what's the ROI when you take all the failures and waste of resources into account. My guesstimate is not much but like other useless government programs, it hires a lot of people so nobody dares questioning it.
    - ardy42 8y ago
      > Totally agree. While they do get a few wins, I wonder what's the ROI when you take all the failures and waste of resources into account. Very far into positive territory, I'd imagine. Most day-to-day intelligence work probably doesn't have much effect, but every once in awhile they probably get a big win that's so massive that it justifies all the effort.
  - baybal2 8y ago
    >Maybe (much) spy work isn't quite the serious business the national security apparatus would have us believe? Well,... the saying is "Allen Dulles was much of a clown first, politician second, and serviceman the third." Regarding US foreign intel service: when something the size and budget of CIA does recon, something useful will come out of it regardless of how lame is their tradecraft.
  - Gibbon1 8y ago
    I have an working theory that as an organization the CIA thinks it can 'win' via various cunning skulduggery. But the world doesn't really work that way. Like this, France in 1700 wasn't powerful because it's king and ministers were geniuses, it's military competent. It was powerful because it's agriculture could support 20 million peasants.
nwrk 8y ago
phpbb ?
strictnein 8y ago
This is just a rehash of Yahoo's article: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata...
- ummonk 8y ago
  Yeah, that's the original article and has a lot more detail.
- Guereric 8y ago
  Mods, please change link to this source.
deleted 8y ago
[deleted]
platz 8y ago
> originally intended to only be a temporary communications channel Some code never dies
charlysl 8y ago
Google Hacking (or Dorking): https://en.m.wikipedia.org/wiki/Google_hacking https://en.m.wikipedia.org/wiki/Google_hacking
TACIXAT 8y ago
I always like to think of the counter case, but note, this is pure speculation. Could the CIA have planted a fake insecure communications system in order to execute key players in Iran's nuclear program? It would be a force-amplifying move. Instead of having 15 spies, you could have 1 (the double agent in this case) who reveals the fake communications network, that in turn takes numerous other players off the board.
- ryanmarsh 8y ago
  FWIW: It’s been suggested by Qanon that the Clinton email server was compromised and this is how all those Chinese spies died. https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie...
  - curuinor 8y ago
    are you fucking posting qanon as a legitimate source for anything
  - hnmonkey 8y ago
    This is a pretty absurd connection that has zero evidence to back it up. It's an extraordinary claim so where's the actual evidence of it? Your NY Times story simply talks about the Chinese spies and doesn't actually prove what you said. So from the FWIW... what is it worth? It doesn't really seem like it's worth anything so why mention it?
    - ryanmarsh 8y ago
      You want proof that’s what happened or that’s what Q said? I can provide proof that Q said something but not that it’s true LOL. I thought was just an interesting corollary. It’s not hard to find what Q has said. It’s all in one place https://qmap.pub https://qmap.pub
      - hnmonkey 8y ago
        I'd like proof of the connection to which you are implying happened in your original statement. And I don't think corollary means what you think it means. A corollary is something that is a natural progression from one thing to another. Two things that go hand in hand and what you said does not in any way match that. It couldn't be farther from a corollary. What you said is an absurd conspiracy theory that invents a connection out of whole-cloth and discussing it without calling it out as such (as you did in your first comment, and as you appear to be ignoring in this comment with a laugh) is extremely dangerous. It's the same as saying 'Lot's of people are saying X' where X is a crazy thing and then just going on about your way. You are basically stating the X and giving it credence but pretending not to with a 'FWIW.'
Illniyar 8y ago
"But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels." Sounds familiar...
- onetimemanytime 8y ago
  Amazing...and they have essentially unlimited budgets. Protecting their spies is #1 in any agencies' book, otherwise who would tell you secrets? The saddest part: The "decider" probably got promoted as usual.
  - meowface 8y ago
    It seems like these issues are rarely solely due to unilateral technical incompetence; there's often at least one person who sees the true risk, tries to communicate the risk, and gets completely ignored. The Challenger disaster had several Thiokol engineers express major concerns in vain; this disaster had John Reidy (supposedly): >A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up. >“It was a recipe for disaster,” Reidy said. “We had a catastrophic failure on our hands that would ensnare a great many of our sources.” The person who could actually save the day and prevent the catastrophe gets ignored, marginalized, and/or fired. The people who were involved in the original disastrous decision keep moving up in the organization and usually keep their jobs after the catastrophe. So it's not like these organizations are lacking smart people: their institutional and bureaucratic incompetence just prevents those people from doing their job properly.
smaili 8y ago
https://news.ycombinator.com/item?id=18370900 https://news.ycombinator.com/item?id=18370900
liftbigweights 8y ago
Or it was intentionally left vulnerable with names of people the CIA wanted dead in Iran? If I were the CIA and I wanted a few of Iran's top nuclear scientists killed, I'd just make it seem like they were working for the CIA and let Iran's counterintelligence do the work for me.
- rossdavidh 8y ago
  That would be a really brilliant move. I doubt, however, that's the move that was made here.
- onetimemanytime 8y ago
  "Ali, this is James. See you at [Iranian landmark,] but 50 meters to the left of the place we met last time."
- Nasrudith 8y ago
  That would still be a pretty dumb move in itself - nobody would want to work with anyone who claims to have CIA connections not even for vast amounts of bribery. I know that countries with less than stellar records of civil rights don't care too much about due process but the not a violent complete moron thing to do would be to ask questions before shooting - namely being sure that they actually are spies or traitors and investigate the claims. For one it could point out peripheral connections down the chain and you know make sure that you aren't getting 'spies lists' of anyone who is close to finding the actual spy. Granted in that sector it seems that there isn't a scarcity of violent immoral morons even in the west given a love for torture among the CIA. Given the known effects pushing torture is really saying a few things: They want to be able to fool themselves by hearing exactly what they want to hear. They want their foes to fight to the death like a cornered rattlesnake - putting their last breaths in killing as many as possible in the face of insurmountable odds. Finally they want no mercy shown to them if captured. There are no words for that except evil and stupid - their deaths will not be mourned no matter how horrific because they deserve it and the world will be better off with their passing. I guess that means that the CIA really may be that stupid which isn't a surprise given their real goal with Castro appears to have been to make him as assassination resistant as possible.
lkrubner 8y ago
The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? Maybe Edward Tufte will write about this someday, as this might be another example where user interface design ended up having a big impact on world history (Tufte has written about John Snow using a clever map to end the cholera epidemic in London in 1853 and the Challenger shuttle disaster of 1986, the launch being allowed partly because the engineers from Thiokol were not able to present their information in a comprehensible way). The article says: "But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels. "It was never meant to be used long term for people to talk to sources," the report quotes one official as saying." So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use? Protected communication is not a sideline for the CIA, it is the core competency. This is something the CIA is supposed to be good at.
- ardy42 8y ago
  > The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? My understanding is that this channel was used for "un-vetted" sources, which I take to mean sources the CIA didn't yet fully trust with their main communications systems. I'm sure they're constantly approached by double-agents looking for information about how they communicate with their sources, so they need more "throwaway" systems for people who potentially could be double agents to use. The original reporting is better than this Register summary: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata.... I think Ars Technica had a better summary: https://arstechnica.com/tech-policy/2018/11/how-did-iran-find-cia-spies-they-googled-it/ https://arstechnica.com/tech-policy/2018/11/how-did-iran-fin....
  - platz 8y ago
drakenot 8y ago
What were these communication channels the CIA was using that was being indexed by Google? Some public forum or something?
- boomboomsubban 8y ago
  They made websites for fake companies offering job and visa opportunities. People would reply and end up recruited. I'm not sure how exactly they used it for further communication though.
jamisteven 8y ago
Bit of a mis-leading headline considering the article states: "After a double agent showed Iran's government one of the sites, they were then able to use Google to identify other sites the intel agency was using and began to intercept communications."
- anilakar 8y ago
  One of my favorite pastime activities: googling for certain unsecured automation systems and messing around with them. They can be found with zero false positive rate thanks to an obvious misspelling on the login page. There's no need to resort to inurl, intitle and similar modifiers that trigger the captcha almost every time.
robterrin 8y ago
And this is eight years after the largest HIPAA violation ever (at the time) at NY Presbyterian suffered because a physician programmer was allowed to take down a firewall and Google started indexing patient records. https://www.businessinsider.com/new-york-presbyterian-columbia-hipaa-settlement-2014-5 https://www.businessinsider.com/new-york-presbyterian-columb...
blattimwind 8y ago
> Web scraping is a two-edged sword No, doing this is: > But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels.
rossdavidh 8y ago
So, security is intrinsically difficult for an organization to get right, because the learning landscape is not continuous. You don't have gradually increasing costs from going in a particular direction; you have apparently zero costs, maybe even rewards, from going in that direction until suddenly OMFG WE HAVE A PROBLEM! This is hard for any machine learning algorithm to deal with, and it is hard for individuals to deal with, and so no surprise that it is hard for organizations to deal with. Lax security, in most cases, yields zero apparent costs until suddenly it is very expensive. All of which is outweighed by the fact that dealing with this kind of thing is the CIA's reason for existence as a separate intelligence agency, outside of the military (since Pearl Harbor). I am not at all convinced that we would be doing worse to fold intelligence back into the military as it was pre-WWII, because having a culture that understands this kind of problem is the CIA's whole purpose for being separate, and it doesn't seem to have worked.
lordgrenville 8y ago
Isn't this article just a restatement of the original Yahoo news story here? https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata...
- meowface 8y ago
  Yes.
jxcole 8y ago
I've always thought that the CIA was completely incompetent, but I've never seen more conclusive evidence than this. I've never worked with anyone so flippant about security, but no one should ever expose secrets without proper auth. I won't even expose user address without cert or password auth. It just goes to show you that the old adage is true: if you are a completent programmer you don't end up in government.
salimmadjd 8y ago
This incident is now used to as part of a collective PR case for military action in Iran. Earlier articles [0] on this CIA failure points to China breaking the network. Which is odd now that it’s used to make the case against Iran. [0] https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/ https://foreignpolicy.com/2018/08/15/botched-cia-communicati...
seancoleman 8y ago
It’s easy to target poor security as the culprit, but it seems another root cause is such bad UX of official, secure communication channels that drove these agents to chat in this alternative, vulnerable system. Just as a river follows the path of least resistance, so too will users follow the best UX software. Bad UX kills.
- njharman 8y ago
  UX can't provide security. It can only provide better UX. Security is a spectrum from convienent/useful to secure. They are mutually exclusive characteristics. Perfect UX won't remove inconvience of having to preaarange deliver of one time pads, biometric twofactor auth, waiting out of band confirmation of your identity, etc. All of those can have horrible UX on top of the inconvienence. But even with perfect UX they will never be frtionless as being able to use any device, on any network, using any app/OS, to post on a useless/passwordless site.
  - njharman 8y ago
    As an example. Having the internet searchable is useful, us convienent. But it reduces security because of its convienence. This breach would not have happened without that convienence. UX could have made it easier to remember to robots file. So could process, or review or other security practices. But no UX is gonna solve fact that internet is insecure due to its convienence. The internet can never be secure. At best you can get lower levels of insecurity.
jorblumesea 8y ago
The NYT has a much better write up: https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... Basically, an internal mole leaked the network, which the Chinese then exploited to roll up the agents. It's not like China just stumbled upon it, they were tipped off. While the nature of the platform didn't help, the roll up was caused by a double agent.
- partiallypro 8y ago
  Is this the same breach? People are talking like this is separate from the one you linked to.
trhway 8y ago
there are couple things come to mind in that context - that story of Iran MITM-ing HTTPS using a small CA they either hacked and/or acquired and Siemens spying software/hardware at Iran's telcos.
awaisraad 8y ago
Intelligence chiefs of four countries (Iran, Russian, China and Pakistan) met in July, 2018 https://tribune.com.pk/story/1756290/1-pakistan-regional-spymasters-resolve-counter-islamic-state-afghanistan/ https://tribune.com.pk/story/1756290/1-pakistan-regional-spy... I guess this meeting had something to do with all of this.
- boomboomsubban 8y ago
  These deaths took place 5+ years ago, sharing information about a mutual border/former border seems more likely.
aeriklawson 8y ago
Weren't these just CIA informants i.e. not actual CIA officers? I think the word "spies" is a bit misleading.
cyphunk 8y ago
> A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up. strongbox.gov is needed to protect people with brains from being strong-armed by management without brains: https://medium.com/@cyphunk/the-nature-of-conflict-is-changing-f9ef39709cab https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...
sytelus 8y ago
Why kill spies? I would think turning local spy in to double agent would be far more beneficial. Or at least feed them wrong information you want. Killing spies simply replaces them.
- slivym 8y ago
  The second you go after anyone using the communication channel it's fairly likely the entire channel will shut down or change so you're much better off moving quickly on everyone you identify than leaving them out where they might disappear. This is especially true since the information China used was provided by Iran - so was very likely to leak sooner or later. Once you've rounded up all the spies it's up to the government what to do, but either they can trade them, imprison them or kill them and I guess this time they decided it was best to just send a message.

353 points by new_guy 8y ago

Arnt 8y ago

This might get a little longwinded. Sorry. The following is from http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amazing_success_identifying_cia_agents_in_the_field/ http://www.salon.com/2015/09/26/how_to_explain_the_kgbs_amaz... and describes the way the Russians implemented SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES: "differences in the way agency officers undercover as diplomats were treated from genuine foreign service officers (FSOs). The pay scale at entry was much higher for a CIA officer; after three to four years abroad a genuine FSO could return home, whereas an agency employee could not; real FSOs had to be recruited between the ages of 21 and 31, whereas this did not apply to an agency officer; only real FSOs had to attend the Institute of Foreign Service for three months before entering the service; naturalized Americans could not become FSOs for at least nine years but they could become agency employees; when agency officers returned home, they did not normally appear in State Department listings; should they appear they were classified as research and planning, research and intelligence, consular or chancery for security affairs; unlike FSOs, agency officers could change their place of work for no apparent reason; their published biographies contained obvious gaps; agency officers could be relocated within the country to which they were posted, FSOs were not; agency officers usually had more than one working foreign language; their cover was usually as a “political” or “consular” official (often vice-consul); internal embassy reorganizations usually left agency personnel untouched, whether their rank, their office space or their telephones; their offices were located in restricted zones within the embassy; they would appear on the streets during the working day using public telephone boxes; they would arrange meetings for the evening, out of town, usually around 7.30 p.m. or 8.00 p.m.; and whereas FSOs had to observe strict rules about attending dinner, agency officers could come and go as they pleased." I read the book. When a CIA agent's cover was blown, the CIA had a spare care and apartment and the agent's replacement needed just that, so they tended to reuse the car and apartment. And wondered why the replacement was then identified so quickly. So. After that long digression, here comes a hypothesis: Organisations that can keep their mistakes secret, can make themselves seem much more capable than other, similarly large organisations.

AlexCoventry 8y ago
> Organisations that can keep their mistakes secret, can make themselves seem much more capable And also much slower to learn from their mistakes. The history of the CIA is pretty depressing, in this regard. https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book) https://en.wikipedia.org/wiki/Legacy_of_Ashes_(book)
- ryanmarsh 8y ago
  Legacy of Ashes does a pretty good job to that end... https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/0307389006 https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/03...
commandlinefan 8y ago
> SELECT * FROM EMBASSY_EMPLOYEES WHERE CIA ftfy
stevew20 8y ago
TL;DR
dorfsmay 8y ago
> SELECT * WHERE CIA FROM EMBASSY_EMPLOYEES Although I personally don't find this type of humour funny I can understand why beginners use it. However, if you are going to use it, please make an effort and get it right. In your attempt to showing off, you're just showing you don't know basic SQL.
- danharaj 8y ago
  Care to guess what you've said about yourself with this critical comment? :^)
- brrt 8y ago
  This is actually (almost) legal in teradata sql, which doesn't enforce clause order, but it doesn't accept an identifier as a predicate.
8y ago

sokoloff 8y ago

> And Google’s search functions allow users to employ advanced operators — like 'AND', 'OR' ELI5 not needed...

MrQuincle 8y ago
Maybe it's a very sophisticated way to tell that {AND,OR} are not functionally complete.
- lordnacho 8y ago
  Right, it should just have either NAND or NOR. Much simpler.
tspike 8y ago
Sadly, not even supported anymore.

noobermin 8y ago

With stories like this it really makes you wonder how we as a nation have survived this long.

maxerickson 8y ago
Maybe (much) spy work isn't quite the serious business the national security apparatus would have us believe? I mean, it's obviously serious business to the people taking risks and doing the work on the ground, I'm talking about it actually being useful to the nation.
- patrickaljord 8y ago
  Totally agree. While they do get a few wins, I wonder what's the ROI when you take all the failures and waste of resources into account. My guesstimate is not much but like other useless government programs, it hires a lot of people so nobody dares questioning it.
  - ardy42 8y ago
    > Totally agree. While they do get a few wins, I wonder what's the ROI when you take all the failures and waste of resources into account. Very far into positive territory, I'd imagine. Most day-to-day intelligence work probably doesn't have much effect, but every once in awhile they probably get a big win that's so massive that it justifies all the effort.
- baybal2 8y ago
  >Maybe (much) spy work isn't quite the serious business the national security apparatus would have us believe? Well,... the saying is "Allen Dulles was much of a clown first, politician second, and serviceman the third." Regarding US foreign intel service: when something the size and budget of CIA does recon, something useful will come out of it regardless of how lame is their tradecraft.
- Gibbon1 8y ago
  I have an working theory that as an organization the CIA thinks it can 'win' via various cunning skulduggery. But the world doesn't really work that way. Like this, France in 1700 wasn't powerful because it's king and ministers were geniuses, it's military competent. It was powerful because it's agriculture could support 20 million peasants.

nwrk 8y ago

phpbb ?

strictnein 8y ago

This is just a rehash of Yahoo's article: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata...

ummonk 8y ago
Yeah, that's the original article and has a lot more detail.
Guereric 8y ago
Mods, please change link to this source.

deleted 8y ago

[deleted]

platz 8y ago

> originally intended to only be a temporary communications channel Some code never dies

charlysl 8y ago

Google Hacking (or Dorking): https://en.m.wikipedia.org/wiki/Google_hacking https://en.m.wikipedia.org/wiki/Google_hacking

TACIXAT 8y ago

I always like to think of the counter case, but note, this is pure speculation. Could the CIA have planted a fake insecure communications system in order to execute key players in Iran's nuclear program? It would be a force-amplifying move. Instead of having 15 spies, you could have 1 (the double agent in this case) who reveals the fake communications network, that in turn takes numerous other players off the board.

ryanmarsh 8y ago
FWIW: It’s been suggested by Qanon that the Clinton email server was compromised and this is how all those Chinese spies died. https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie...
- curuinor 8y ago
  are you fucking posting qanon as a legitimate source for anything
- hnmonkey 8y ago
  This is a pretty absurd connection that has zero evidence to back it up. It's an extraordinary claim so where's the actual evidence of it? Your NY Times story simply talks about the Chinese spies and doesn't actually prove what you said. So from the FWIW... what is it worth? It doesn't really seem like it's worth anything so why mention it?
  - ryanmarsh 8y ago
    You want proof that’s what happened or that’s what Q said? I can provide proof that Q said something but not that it’s true LOL. I thought was just an interesting corollary. It’s not hard to find what Q has said. It’s all in one place https://qmap.pub https://qmap.pub
    - hnmonkey 8y ago
      I'd like proof of the connection to which you are implying happened in your original statement. And I don't think corollary means what you think it means. A corollary is something that is a natural progression from one thing to another. Two things that go hand in hand and what you said does not in any way match that. It couldn't be farther from a corollary. What you said is an absurd conspiracy theory that invents a connection out of whole-cloth and discussing it without calling it out as such (as you did in your first comment, and as you appear to be ignoring in this comment with a laugh) is extremely dangerous. It's the same as saying 'Lot's of people are saying X' where X is a crazy thing and then just going on about your way. You are basically stating the X and giving it credence but pretending not to with a 'FWIW.'

Illniyar 8y ago

"But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels." Sounds familiar...

onetimemanytime 8y ago
Amazing...and they have essentially unlimited budgets. Protecting their spies is #1 in any agencies' book, otherwise who would tell you secrets? The saddest part: The "decider" probably got promoted as usual.
- meowface 8y ago
  It seems like these issues are rarely solely due to unilateral technical incompetence; there's often at least one person who sees the true risk, tries to communicate the risk, and gets completely ignored. The Challenger disaster had several Thiokol engineers express major concerns in vain; this disaster had John Reidy (supposedly): >A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up. >“It was a recipe for disaster,” Reidy said. “We had a catastrophic failure on our hands that would ensnare a great many of our sources.” The person who could actually save the day and prevent the catastrophe gets ignored, marginalized, and/or fired. The people who were involved in the original disastrous decision keep moving up in the organization and usually keep their jobs after the catastrophe. So it's not like these organizations are lacking smart people: their institutional and bureaucratic incompetence just prevents those people from doing their job properly.

smaili 8y ago

https://news.ycombinator.com/item?id=18370900 https://news.ycombinator.com/item?id=18370900

liftbigweights 8y ago

Or it was intentionally left vulnerable with names of people the CIA wanted dead in Iran? If I were the CIA and I wanted a few of Iran's top nuclear scientists killed, I'd just make it seem like they were working for the CIA and let Iran's counterintelligence do the work for me.

rossdavidh 8y ago
That would be a really brilliant move. I doubt, however, that's the move that was made here.
onetimemanytime 8y ago
"Ali, this is James. See you at [Iranian landmark,] but 50 meters to the left of the place we met last time."
Nasrudith 8y ago
That would still be a pretty dumb move in itself - nobody would want to work with anyone who claims to have CIA connections not even for vast amounts of bribery. I know that countries with less than stellar records of civil rights don't care too much about due process but the not a violent complete moron thing to do would be to ask questions before shooting - namely being sure that they actually are spies or traitors and investigate the claims. For one it could point out peripheral connections down the chain and you know make sure that you aren't getting 'spies lists' of anyone who is close to finding the actual spy. Granted in that sector it seems that there isn't a scarcity of violent immoral morons even in the west given a love for torture among the CIA. Given the known effects pushing torture is really saying a few things: They want to be able to fool themselves by hearing exactly what they want to hear. They want their foes to fight to the death like a cornered rattlesnake - putting their last breaths in killing as many as possible in the face of insurmountable odds. Finally they want no mercy shown to them if captured. There are no words for that except evil and stupid - their deaths will not be mourned no matter how horrific because they deserve it and the world will be better off with their passing. I guess that means that the CIA really may be that stupid which isn't a surprise given their real goal with Castro appears to have been to make him as assassination resistant as possible.

lkrubner 8y ago

The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? Maybe Edward Tufte will write about this someday, as this might be another example where user interface design ended up having a big impact on world history (Tufte has written about John Snow using a clever map to end the cholera epidemic in London in 1853 and the Challenger shuttle disaster of 1986, the launch being allowed partly because the engineers from Thiokol were not able to present their information in a comprehensible way). The article says: "But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels. "It was never meant to be used long term for people to talk to sources," the report quotes one official as saying." So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use? Protected communication is not a sideline for the CIA, it is the core competency. This is something the CIA is supposed to be good at.

ardy42 8y ago
> The question is, why did they need an informal communication channel? What made this easy, and why was using a correct channel considered too difficult? My understanding is that this channel was used for "un-vetted" sources, which I take to mean sources the CIA didn't yet fully trust with their main communications systems. I'm sure they're constantly approached by double-agents looking for information about how they communicate with their sources, so they need more "throwaway" systems for people who potentially could be double agents to use. The original reporting is better than this Register summary: https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata.... I think Ars Technica had a better summary: https://arstechnica.com/tech-policy/2018/11/how-did-iran-find-cia-spies-they-googled-it/ https://arstechnica.com/tech-policy/2018/11/how-did-iran-fin....
- platz 8y ago

drakenot 8y ago

What were these communication channels the CIA was using that was being indexed by Google? Some public forum or something?

boomboomsubban 8y ago
They made websites for fake companies offering job and visa opportunities. People would reply and end up recruited. I'm not sure how exactly they used it for further communication though.

jamisteven 8y ago

Bit of a mis-leading headline considering the article states: "After a double agent showed Iran's government one of the sites, they were then able to use Google to identify other sites the intel agency was using and began to intercept communications."

anilakar 8y ago
One of my favorite pastime activities: googling for certain unsecured automation systems and messing around with them. They can be found with zero false positive rate thanks to an obvious misspelling on the login page. There's no need to resort to inurl, intitle and similar modifiers that trigger the captcha almost every time.

robterrin 8y ago

And this is eight years after the largest HIPAA violation ever (at the time) at NY Presbyterian suffered because a physician programmer was allowed to take down a firewall and Google started indexing patient records. https://www.businessinsider.com/new-york-presbyterian-columbia-hipaa-settlement-2014-5 https://www.businessinsider.com/new-york-presbyterian-columb...

blattimwind 8y ago

> Web scraping is a two-edged sword No, doing this is: > But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels.

rossdavidh 8y ago

So, security is intrinsically difficult for an organization to get right, because the learning landscape is not continuous. You don't have gradually increasing costs from going in a particular direction; you have apparently zero costs, maybe even rewards, from going in that direction until suddenly OMFG WE HAVE A PROBLEM! This is hard for any machine learning algorithm to deal with, and it is hard for individuals to deal with, and so no surprise that it is hard for organizations to deal with. Lax security, in most cases, yields zero apparent costs until suddenly it is very expensive. All of which is outweighed by the fact that dealing with this kind of thing is the CIA's reason for existence as a separate intelligence agency, outside of the military (since Pearl Harbor). I am not at all convinced that we would be doing worse to fold intelligence back into the military as it was pre-WWII, because having a culture that understands this kind of problem is the CIA's whole purpose for being separate, and it doesn't seem to have worked.

lordgrenville 8y ago

Isn't this article just a restatement of the original Yahoo news story here? https://www.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://www.yahoo.com/news/cias-communications-suffered-cata...

meowface 8y ago
Yes.

jxcole 8y ago

I've always thought that the CIA was completely incompetent, but I've never seen more conclusive evidence than this. I've never worked with anyone so flippant about security, but no one should ever expose secrets without proper auth. I won't even expose user address without cert or password auth. It just goes to show you that the old adage is true: if you are a completent programmer you don't end up in government.

salimmadjd 8y ago

This incident is now used to as part of a collective PR case for military action in Iran. Earlier articles [0] on this CIA failure points to China breaking the network. Which is odd now that it’s used to make the case against Iran. [0] https://foreignpolicy.com/2018/08/15/botched-cia-communications-system-helped-blow-cover-chinese-agents-intelligence/ https://foreignpolicy.com/2018/08/15/botched-cia-communicati...

seancoleman 8y ago

It’s easy to target poor security as the culprit, but it seems another root cause is such bad UX of official, secure communication channels that drove these agents to chat in this alternative, vulnerable system. Just as a river follows the path of least resistance, so too will users follow the best UX software. Bad UX kills.

njharman 8y ago
UX can't provide security. It can only provide better UX. Security is a spectrum from convienent/useful to secure. They are mutually exclusive characteristics. Perfect UX won't remove inconvience of having to preaarange deliver of one time pads, biometric twofactor auth, waiting out of band confirmation of your identity, etc. All of those can have horrible UX on top of the inconvienence. But even with perfect UX they will never be frtionless as being able to use any device, on any network, using any app/OS, to post on a useless/passwordless site.
- njharman 8y ago
  As an example. Having the internet searchable is useful, us convienent. But it reduces security because of its convienence. This breach would not have happened without that convienence. UX could have made it easier to remember to robots file. So could process, or review or other security practices. But no UX is gonna solve fact that internet is insecure due to its convienence. The internet can never be secure. At best you can get lower levels of insecurity.

jorblumesea 8y ago

The NYT has a much better write up: https://www.nytimes.com/2017/05/20/world/asia/china-cia-spies-espionage.html https://www.nytimes.com/2017/05/20/world/asia/china-cia-spie... Basically, an internal mole leaked the network, which the Chinese then exploited to roll up the agents. It's not like China just stumbled upon it, they were tipped off. While the nature of the platform didn't help, the roll up was caused by a double agent.

partiallypro 8y ago
Is this the same breach? People are talking like this is separate from the one you linked to.

trhway 8y ago

there are couple things come to mind in that context - that story of Iran MITM-ing HTTPS using a small CA they either hacked and/or acquired and Siemens spying software/hardware at Iran's telcos.

awaisraad 8y ago

Intelligence chiefs of four countries (Iran, Russian, China and Pakistan) met in July, 2018 https://tribune.com.pk/story/1756290/1-pakistan-regional-spymasters-resolve-counter-islamic-state-afghanistan/ https://tribune.com.pk/story/1756290/1-pakistan-regional-spy... I guess this meeting had something to do with all of this.

boomboomsubban 8y ago
These deaths took place 5+ years ago, sharing information about a mutual border/former border seems more likely.

aeriklawson 8y ago

Weren't these just CIA informants i.e. not actual CIA officers? I think the word "spies" is a bit misleading.

cyphunk 8y ago

> A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up. strongbox.gov is needed to protect people with brains from being strong-armed by management without brains: https://medium.com/@cyphunk/the-nature-of-conflict-is-changing-f9ef39709cab https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...

sytelus 8y ago

Why kill spies? I would think turning local spy in to double agent would be far more beneficial. Or at least feed them wrong information you want. Killing spies simply replaces them.

slivym 8y ago
The second you go after anyone using the communication channel it's fairly likely the entire channel will shut down or change so you're much better off moving quickly on everyone you identify than leaving them out where they might disappear. This is especially true since the information China used was provided by Iran - so was very likely to leak sooner or later. Once you've rounded up all the spies it's up to the government what to do, but either they can trade them, imprison them or kill them and I guess this time they decided it was best to just send a message.