7 ms·
Interesting read. I wonder whether this was an attempt at social engineering†? While we tend to think of the NSA (or other foreign agencies in this field) worki
by webmobdev 6y ago
Interesting read. I wonder whether this was an attempt at social engineering†? While we tend to think of the NSA (or other foreign agencies in this field) working on intercepting information only through electronic means, sometimes a direct approach is often easier (obligatory - xkcd: https://xkcd.com/538/ https://xkcd.com/538/).
Perhaps all they wanted was the source code of his application to repackage (after introducing a backdoor) and distribute it on the internet or directly to targets of interest ... perhaps it was part of his training ...
†Social Engineering (https://en.wikipedia.org/wiki/Social_engineering_(security) https://en.wikipedia.org/wiki/Social_engineering_(security)) in the context of information security, is the psychological manipulation of people into performing actions or divulging confidential information.
- burrows 6y agoOnly works if the 411 call was MiTMd. edit I was confused and my reply is confusing. I was trying to say that a third party could have stolen the source code by MiTMing the 411 call.
- webmobdev 6y agoI meant perhaps NSA agents are trained in social engineering too. Or it may not have been the NSA, but FBI or CIA or even Military Intelligence too, pretending to be NSA.
- papermachete 6y agoAre you being naive on purpose, friend?
- webmobdev 6y agoLooks like I missed something ... ? What's the context in which you think so?
- papermachete 6y agoIf we are to trust anything on the web, then social engineering is a basic part of NSA education.
- webmobdev 6y agoWell, you are saying so on the web - so it must be true! ;)
- burrows 6y agoYou think the NSA impersonated themselves?
- choward 6y agoOr if someone who worked for 411 or a hacker changed the number for the naval base to be one they controlled. Dave could be the CEO of 411 for all I know.
- burrows 6y ago> Or if someone who worked for 411 or a hacker changed the number for the naval base to be one they controlled. Dave could be the CEO of 411 for all I know. Agreed. A couple of ideas for better authenticating the NSA boogeyman. 1. Verify the number in a phone book. 2. Call a friend and ask them to follow the 411 protocol. 3. Drive to a hotel in a different state then follow the 411 protocol. 4. Overnight a cell phone to the NSA headquarters and wait for Dave to call you from it. 5. Call the FBI and ask them for the NSA number.
- tren-hard 6y ago6. It's Connecticut not Montana, an FBI agent should be available to confirm in person this is a real request.
- Mountain_Skies 6y agoAlso wonder if the correct number to dial would have been 301-555-1212 as that's directory assistance in Bethesda rather than local directory assistance.
- ahofmann 6y agoWhy? OP got instructions on how to get to Dave's house and there were several steps involved. Somewhere in Bethesta base there may be an NSA staff member sitting there who receives the call from OP and routes it accordingly. No hacking of any kind is required, just a functioning chain of command.
- danilocesar 6y agoit doesn't need to be a MITM. He was called in a land line. The caller could just have pretended to hangout and faked tones when the author called back. I'm not saying that is what happened, but it's way easier than a real 411 MITM.
- burrows 6y agoThis doesn't explain getting a fake NSA number from 411.
- jerf 6y ago"Perhaps all they wanted was the source code of his application to repackage (after introducing a backdoor)" A counterargument against that is A: if the goal is to produce a version with a backdoor, they don't need the source to accomplish that and B: if that was the goal, they wouldn't want to give the original author any reason to know they were asking about it, so that when the backdoor is found in the wild he can pipe up and go "Oh, yeah, that reminds me, the NSA got my source code a few months ago..."
- webmobdev 6y ago> if the goal is to produce a version with a backdoor, they don't need the source to accomplish that It certainly would make their job easier (and be a lot cheaper)! > B: if that was the goal, they wouldn't want to give the original author any reason to know they were asking about it, That's a good point - unless they were targeting a specific target.