7 ms·

CIA bothered to get it from NSA it must be good for something, or has extra features not available in IDA Pro. Maybe they simply don't want to pay IDA Pro lice

by rdtsc 8y ago

CIA bothered to get it from NSA it must be good for something, or has extra features not available in IDA Pro. Maybe they simply don't want to pay IDA Pro licenses $3k a pop. Getting an enterprise organization or the government to pay for stuff like that is not trivial sometimes. CIA also made this a standard part of a developer's setup: https://wikileaks.org/ciav7p1/cms/page_34308123.html https://wikileaks.org/ciav7p1/cms/page_34308123.html Install XCode, setup SSH, IRC, and install Ghidra ...

JumpCrisscross 8y ago
> Maybe they simply don't want to pay IDA Pro licenses $3k a pop What prevents three-letter agencies from using software without paying for it? Tendering a bid usually requires surrendering source code. One's odds of finding out about unauthorized use is slim. And even if you do, legal discovery can be blocked on national security grounds.
- JoeSmithson 8y ago
  The law and personal morality, the same thing that stops almost all immoral actions in society.
  - korethr 8y ago
    The revealed track record of the various three-letter-agencies in the past decade does not vote in their favor in this case.
    - burgerboy 8y ago
      Do you always think in black and white?
    - azinman2 8y ago
      Track record of software piracy?
    - ummonk 8y ago
      I don’t think their track record shows them caring enough about money that they’d break the law to do it. Sure they’ll happily break civil liberties laws or laws regarding assassinating foreign politicians and the like, but that is because those can’t be solved by simply spending more.
    - jjoonathan 8y ago
      That's not how it works. Big people get away with breaking big rules, but little people do not get away with breaking little rules.
    - ALittleLight 8y ago
      I don't think it's quite "the law and personal morality" as much as it is "not my money to pay for the licenses, whereas I might get fired, pay a fine, or go to jail if I give the direction to steal the software." In the same way, it's not my personal morality or the law that prevents me from stealing the supplies my company needs in order to help my employer cut costs or burning down the buildings of our rivals. Those things wouldn't help me personally but they expose me to lots of risk. That the law and morality agree with self interest is a happy coincidence.
- wolfgke 8y ago
  > What prevents three-letter agencies from using software without paying for it? I would argue because the three-letter agencies want that the software continues to be maintained. And perhaps anything illegal that an agency does yields bad PR if it comes out. So they try to do only illegal things that they believe are worth the PR risk. Illegal copies of software probably is not.
  - gh02t 8y ago
    It's likely the same reason that most businesses are willing to pay for software: service and support, as well as many vendors likely being willing to implement custom features. On top of that, none of those agencies are likely to be willing to download some pirated crack for whatever piece of software they need, so that means if they want it for free they have to crack it themselves. Which requires them to divert people who could otherwise be doing things that are actually relevant to their missions. There is plenty of funding in these agencies to buy software and there's little to be gained from stealing it.
- rdtsc 8y ago
  > What prevents three-letter agencies from using software without paying for it? Nothing, but they'd have to rationalize it. As an organization they need to tell themselves why they are doing it, if it is going to happen officially. So someone has to write "disable licensing..." in the setup instructions. And while killing and other things can be rationalized ("War on Terror, etc...") some petty stuff in comparison like breaking IDA Pro's licensing paradoxically might be harder. Another thing is that on the surface at least, people who are hired have to pass polygraph tests and have to reveal if they committed crimes or stole things etc. It used to be that NSA would reject people who admitted to pirating software or music in the past. So they'd have to solve that "inconsistency". Another reason is well, they that could get sued. The military and other government offices have been sued by software makers in the past so it's not outrageous as it seems: https://torrentfreak.com/u-s-caught-pirating-military-software-pays-50-million-to-settle-131127/ https://torrentfreak.com/u-s-caught-pirating-military-softwa...
  - everdrive 8y ago
    Despite what some folks claim, the three letter agencies don't break the law. They have lawyers and general council, and bend over backwards not to do anything illegal. This is not to say that the law is always sensible, moral, or interpreted the way an average individual might interpret the law.
    - JohnStrangeII 8y ago
      I'd like to see the US law that states that it's legal for US citizens to kidnap people abroad and torture them for months in secret prisons.
      - SpelingBeeChamp 8y ago
        Broadly, the law doesn't work by allowing things. Imagine if the police could walk up to you in any situation and demand that you prove the legality of any part of whatever it is that you are (or are not) doing.
- burfog 8y ago
  The government insists on paying full price for everything they use. They would of course make an exception for national security if needed, but "don't want to pay $3k a pop" isn't going to qualify.
  - lozaning 8y ago
    My experience has been they insist on paying their GSA schedule price, which generally is below list.
    - tptacek 8y ago
      It’s below list, but every procurer on earth knows that, so it’s above the price private companies pay. When I was in product management, GSA price lists were my trick to learn what competitors charged.
      - civilitty 8y ago
        Isn't it an easy way to get blacklisted if you sell to private companies below the GSA price? At least that seems to be the predominant assumption most scientific equipment companies operate under.
        tptacek 8y ago
        I don't know, maybe that is a thing, and maybe things have changed, but when I was doing product pricing, our assumption was that the GSA price was going to be somewhat higher than the "discounted" price most customers would pay.
        jacobr1 8y ago
        The common trick to change the product, such that it is different is some non-fundamental way. Then it isn't the "same" product.
- dsl 8y ago
  Absolutely nothing, and in many cases they prefer it. State sponsored malware will often do an inventory of the system they are running on, and send details back to help identify the machines that are being used to analyze the samples. NSA steals things like IDA when they come across them (in the same way they target companies to steal things like code signing certificates) so the analysis environment is completely non-attributable.
- arusahni 8y ago
  If you're willing to go this far with your reasoning: Intellectual property and copyright only exist because governments choose to recognize them. Licenses are only as good as the frameworks in which they're constructed. :-)
- da_chicken 8y ago
  > What prevents three-letter agencies from using software without paying for it? The law, same as anyone else. Having worked in the public sector, there's a lot more law than there is compared to the private sector. That's because anything that the legislature does or doesn't want your organization to do has to be coded in law. That's the legislatures only means of direction. Further, executive directives related to your organization also carry the force of law. What that means is you can't not follow it. You can't chose to ignore the law or executive directives. You don't get to ask for clarifications or exceptions. The former come from a judge and the latter do not exist until the legislature creates them. It doesn't matter that there's no direct penalty for it; you're not allowed to chose to not follow it. This is one of the worst parts about the public sector: there is often much less wiggle room, especially for broad issues. I'm sure that the TLAs negotiate with IDA for site licenses, or bind them to confidentiality contracts, but I have no doubt at all that they legitimately pay for the COTS products they use.
  - A2017U1 8y ago
    Spare us the lecture please, the rampant systemic law breaking over the last 50 years by government agencies is a known fact. Keyword: Systemic Who has been punished for the numerous constitutional breaches by the TLA's? At last glance absolutely no one and that's not going to change. Meanwhile the whistleblower who spoke up about illegal government activities is in exile and can likely never travel anywhere on Earth for the rest of his life.
    - madez 8y ago
      The breaches of law you mentioned are of a specific kind, and I wager that the agencies did not agree in every case that they breached the law. On the other hand, blatantly stealing their tools instead of buying them is not the same kind of breaching the law, and it is obvious to everbody that it is illegal. Also, even more so than persons, institutions can behave contradictivly when viewed from the outside. From within it may seem consistent and sound to surveil everybody and legally buying the tools they use for it. The evil is banal.
- jjoonathan 8y ago
  IDA isn't written by a company in US jurisdiction, for starters -- using it would be an exploitable liability.
- empath75 8y ago
  What would the motivation be to not pay for it? Nobody gets rewarded in government for not spending money.
- dingoegret 8y ago
  Implying three letter agencies can subvert the courts.
- joewee 8y ago
  Most US government agencies audit software installed to verify that they have the appropriate licenses. I don’t know about intel agencies but I have to assume it’s the same. Also installing software illegally or that hasn’t been approved is a pretty serious security violation in government and in any enterprise that takes security seriously.
deleted 8y ago
[deleted]
SudoEpoch 8y ago
SSH and IRC are the core at which hackerdom is achieved.
bsder 8y ago
Unlikely. More like the truly paranoid security types probably don't trust IDA Pro not to have a back door. A home grown NSA tool is unlikely to have an intentional backdoor in the version they give to the CIA.
orbital-decay 8y ago
It could also be a trust issue. Ilfak Guilfanov and Hex-Rays are known to be picky about their clients. They also aren't under US jurisdiction.
- saagarjha 8y ago
  > Ilfak Guilfanov and Hex-Rays are known to be picky about their clients. This was mostly to combat piracy, as far as I was aware–I doubt that there is any nationalistic or moral reasons behind it. So I don't see this being a major issue in this case.
  - civilitty 8y ago
    Did that ever work? Even after finally buying a license I would pirate it when I couldn't find my license info and I don't think I've ever had trouble finding the latest version.
    - saagarjha 8y ago
      No idea; it's possible that Ilfak has kept you on a list internally and is waiting for you to annoy him sufficiently for him to activate a remote kill-switch ;) Honestly, I'm semi-confident that he does this just because he can…
  - orbital-decay 8y ago
    Sure thing, but who can guarantee they won't come with their own reason not to sell it next time, other than a background check? The mere fact they differentiate between clients and are non-domestic could probably be enough for a national intelligence service to view them as unreliable, and to develop their own alternative to a vital tool.

by rdtsc 8y ago

JumpCrisscross 8y ago

> Maybe they simply don't want to pay IDA Pro licenses $3k a pop What prevents three-letter agencies from using software without paying for it? Tendering a bid usually requires surrendering source code. One's odds of finding out about unauthorized use is slim. And even if you do, legal discovery can be blocked on national security grounds.

JoeSmithson 8y ago
The law and personal morality, the same thing that stops almost all immoral actions in society.
- korethr 8y ago
  The revealed track record of the various three-letter-agencies in the past decade does not vote in their favor in this case.
  - burgerboy 8y ago
    Do you always think in black and white?
  - azinman2 8y ago
    Track record of software piracy?
  - ummonk 8y ago
    I don’t think their track record shows them caring enough about money that they’d break the law to do it. Sure they’ll happily break civil liberties laws or laws regarding assassinating foreign politicians and the like, but that is because those can’t be solved by simply spending more.
  - jjoonathan 8y ago
    That's not how it works. Big people get away with breaking big rules, but little people do not get away with breaking little rules.
  - ALittleLight 8y ago
    I don't think it's quite "the law and personal morality" as much as it is "not my money to pay for the licenses, whereas I might get fired, pay a fine, or go to jail if I give the direction to steal the software." In the same way, it's not my personal morality or the law that prevents me from stealing the supplies my company needs in order to help my employer cut costs or burning down the buildings of our rivals. Those things wouldn't help me personally but they expose me to lots of risk. That the law and morality agree with self interest is a happy coincidence.
wolfgke 8y ago
> What prevents three-letter agencies from using software without paying for it? I would argue because the three-letter agencies want that the software continues to be maintained. And perhaps anything illegal that an agency does yields bad PR if it comes out. So they try to do only illegal things that they believe are worth the PR risk. Illegal copies of software probably is not.
- gh02t 8y ago
  It's likely the same reason that most businesses are willing to pay for software: service and support, as well as many vendors likely being willing to implement custom features. On top of that, none of those agencies are likely to be willing to download some pirated crack for whatever piece of software they need, so that means if they want it for free they have to crack it themselves. Which requires them to divert people who could otherwise be doing things that are actually relevant to their missions. There is plenty of funding in these agencies to buy software and there's little to be gained from stealing it.
rdtsc 8y ago
> What prevents three-letter agencies from using software without paying for it? Nothing, but they'd have to rationalize it. As an organization they need to tell themselves why they are doing it, if it is going to happen officially. So someone has to write "disable licensing..." in the setup instructions. And while killing and other things can be rationalized ("War on Terror, etc...") some petty stuff in comparison like breaking IDA Pro's licensing paradoxically might be harder. Another thing is that on the surface at least, people who are hired have to pass polygraph tests and have to reveal if they committed crimes or stole things etc. It used to be that NSA would reject people who admitted to pirating software or music in the past. So they'd have to solve that "inconsistency". Another reason is well, they that could get sued. The military and other government offices have been sued by software makers in the past so it's not outrageous as it seems: https://torrentfreak.com/u-s-caught-pirating-military-software-pays-50-million-to-settle-131127/ https://torrentfreak.com/u-s-caught-pirating-military-softwa...
- everdrive 8y ago
  Despite what some folks claim, the three letter agencies don't break the law. They have lawyers and general council, and bend over backwards not to do anything illegal. This is not to say that the law is always sensible, moral, or interpreted the way an average individual might interpret the law.
  - JohnStrangeII 8y ago
    I'd like to see the US law that states that it's legal for US citizens to kidnap people abroad and torture them for months in secret prisons.
    - SpelingBeeChamp 8y ago
      Broadly, the law doesn't work by allowing things. Imagine if the police could walk up to you in any situation and demand that you prove the legality of any part of whatever it is that you are (or are not) doing.
burfog 8y ago
The government insists on paying full price for everything they use. They would of course make an exception for national security if needed, but "don't want to pay $3k a pop" isn't going to qualify.
- lozaning 8y ago
  My experience has been they insist on paying their GSA schedule price, which generally is below list.
  - tptacek 8y ago
    It’s below list, but every procurer on earth knows that, so it’s above the price private companies pay. When I was in product management, GSA price lists were my trick to learn what competitors charged.
    - civilitty 8y ago
      Isn't it an easy way to get blacklisted if you sell to private companies below the GSA price? At least that seems to be the predominant assumption most scientific equipment companies operate under.
      - tptacek 8y ago
        I don't know, maybe that is a thing, and maybe things have changed, but when I was doing product pricing, our assumption was that the GSA price was going to be somewhat higher than the "discounted" price most customers would pay.
      - jacobr1 8y ago
        The common trick to change the product, such that it is different is some non-fundamental way. Then it isn't the "same" product.
dsl 8y ago
Absolutely nothing, and in many cases they prefer it. State sponsored malware will often do an inventory of the system they are running on, and send details back to help identify the machines that are being used to analyze the samples. NSA steals things like IDA when they come across them (in the same way they target companies to steal things like code signing certificates) so the analysis environment is completely non-attributable.
arusahni 8y ago
If you're willing to go this far with your reasoning: Intellectual property and copyright only exist because governments choose to recognize them. Licenses are only as good as the frameworks in which they're constructed. :-)
da_chicken 8y ago
> What prevents three-letter agencies from using software without paying for it? The law, same as anyone else. Having worked in the public sector, there's a lot more law than there is compared to the private sector. That's because anything that the legislature does or doesn't want your organization to do has to be coded in law. That's the legislatures only means of direction. Further, executive directives related to your organization also carry the force of law. What that means is you can't not follow it. You can't chose to ignore the law or executive directives. You don't get to ask for clarifications or exceptions. The former come from a judge and the latter do not exist until the legislature creates them. It doesn't matter that there's no direct penalty for it; you're not allowed to chose to not follow it. This is one of the worst parts about the public sector: there is often much less wiggle room, especially for broad issues. I'm sure that the TLAs negotiate with IDA for site licenses, or bind them to confidentiality contracts, but I have no doubt at all that they legitimately pay for the COTS products they use.
- A2017U1 8y ago
  Spare us the lecture please, the rampant systemic law breaking over the last 50 years by government agencies is a known fact. Keyword: Systemic Who has been punished for the numerous constitutional breaches by the TLA's? At last glance absolutely no one and that's not going to change. Meanwhile the whistleblower who spoke up about illegal government activities is in exile and can likely never travel anywhere on Earth for the rest of his life.
  - madez 8y ago
    The breaches of law you mentioned are of a specific kind, and I wager that the agencies did not agree in every case that they breached the law. On the other hand, blatantly stealing their tools instead of buying them is not the same kind of breaching the law, and it is obvious to everbody that it is illegal. Also, even more so than persons, institutions can behave contradictivly when viewed from the outside. From within it may seem consistent and sound to surveil everybody and legally buying the tools they use for it. The evil is banal.
jjoonathan 8y ago
IDA isn't written by a company in US jurisdiction, for starters -- using it would be an exploitable liability.
empath75 8y ago
What would the motivation be to not pay for it? Nobody gets rewarded in government for not spending money.
dingoegret 8y ago
Implying three letter agencies can subvert the courts.
joewee 8y ago
Most US government agencies audit software installed to verify that they have the appropriate licenses. I don’t know about intel agencies but I have to assume it’s the same. Also installing software illegally or that hasn’t been approved is a pretty serious security violation in government and in any enterprise that takes security seriously.

deleted 8y ago

[deleted]

SudoEpoch 8y ago

SSH and IRC are the core at which hackerdom is achieved.

bsder 8y ago

Unlikely. More like the truly paranoid security types probably don't trust IDA Pro not to have a back door. A home grown NSA tool is unlikely to have an intentional backdoor in the version they give to the CIA.

orbital-decay 8y ago

It could also be a trust issue. Ilfak Guilfanov and Hex-Rays are known to be picky about their clients. They also aren't under US jurisdiction.

saagarjha 8y ago
> Ilfak Guilfanov and Hex-Rays are known to be picky about their clients. This was mostly to combat piracy, as far as I was aware–I doubt that there is any nationalistic or moral reasons behind it. So I don't see this being a major issue in this case.
- civilitty 8y ago
  Did that ever work? Even after finally buying a license I would pirate it when I couldn't find my license info and I don't think I've ever had trouble finding the latest version.
  - saagarjha 8y ago
    No idea; it's possible that Ilfak has kept you on a list internally and is waiting for you to annoy him sufficiently for him to activate a remote kill-switch ;) Honestly, I'm semi-confident that he does this just because he can…
- orbital-decay 8y ago
  Sure thing, but who can guarantee they won't come with their own reason not to sell it next time, other than a background check? The mere fact they differentiate between clients and are non-domestic could probably be enough for a national intelligence service to view them as unreliable, and to develop their own alternative to a vital tool.