11 ms·

CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

215 points by sunils34 6y ago

LinuxBender 6y ago
This happens in many corporations as well. It's fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team (infrastructure teams and developer teams hardening things) is not only boring to most, but it's also the team that gets the most grief from developers for inducing friction. If your company has a red team, ask how big the blue team is and if they have the same freedom to develop and implement mitigating controls as the red team has to exploit things. Hacker competitions mirror this. Red teams are allowed to bring in any exploits and do just about anything (as criminals would be expected to do) and the blue team are stifled by bureaucracy and not allowed to bring in anything.
- willcipriano 6y ago
  Hacker competitions often seem very contrived to me. I suspect that in order for the red team to make any progress you have to tie the blue teams hands behind their backs. Most of what I see from the penetration testing community is pretty gimmicky and situational generally and often doesn't take into account the attackers risk/reward ratio.
  - LinuxBender 6y ago
    I agree completely. I see it as entertainment and a way to recruit people out of college.
  - AnHonestComment 6y ago
    What would be a less gimmicky setup?
    - olivierduval 6y ago
      Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the budget for the cybersec can be reduced. So, for RedTeam, it's either a win or a tie. And for BlueTeam it's either a tie or a loss... If the BlueTeam could fight back, maybe this could change...
      - willcipriano 6y ago
        That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".
        DaiPlusPlus 6y ago
        Do the feds still attend DC? >:}
        birdyrooster 6y ago
        No and they don’t come because hackers asked them not to. >:/
        Shared404 6y ago
        Found the Fed.
        Bnshsysjab 6y ago
        Easier said than done, the red team can’t break real laws (routing through compromised hosts) where real hackers will.
      - mindslight 6y ago
        It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.
  - deleted 6y ago
    [deleted]
  - badrabbit 6y ago
    I disagree completely. Red team tools and techniques are different and gimmicky for a reason, their goal is to demonstrate lack of or effectiveness of security controls and processes. While bad guys have more time and more precise target. For example, 0days and disruptive actions are mostly prohibited for red teamers
- badrabbit 6y ago
  That's why "purple team" is the way (not sarcasm for people not aware of purple team methodology)
- thephyber 6y ago
  Another, related paradox is that in corporate org structures, the CIO is responsible for making sure the company's systems are available and working correctly, but the CISO is responsible for securing systems. Departments of CIOs can frequently be seen as a profit center which unlocks potential for the company while CISOs are almost always seen as a cost center which (ostensibly) slows the potential of the company. This also contributes to perverted incentives (like the red/blue teams) where the CIO frequently gets their way and is more likely to get budget while CISOs take all the blame when their budget increase requests get declined and IT is tasked with keeping unpatched systems up and stable rather than patching systems quickly. Obviously, the best orgs find a way to get both done, but resources are always scarce for the rest of us.
  - jtdev 6y ago
    I left a high pay info-sec position at a large insurance corporation for this very reason. CIO trumped CISO (fractional) on literally every security issue that was surfaced - and worse yet the CIO and CEO refused to acknowledge the risk being onboarded/ignored. The irony of insurance execs refusing to acknowledge information security risk was just too much.
    - thephyber 6y ago
      Strange. I can imagine the average corp board member underestimating the risk accumulated by consistently ignoring CISO request for more cybersecurity investments, but the insurance industry is used to dealing with the low-frequency, high-impact payouts. Do you think it was mis-communication, ignorance, greed, hubris, or something else?
      - jtdev 6y ago
        All of the above.
    - jcims 6y ago
      I've been in infosec since the 90's. A lot of times I think this is on us. As much as I respect the technical acumen and creativity of my colleagues in the industry, I don't think we broadly understand risk that well and as a consequence we do a pretty bad job of communicating it. We tend to peg the panic meter with multiplied likelihoods and catastrophized impacts of possible scenarios while directly causing revenue losses by adding sometimes insane amounts of friction to the product delivery process. That's not to say there aren't cowboy CxOs recklessly ignoring reality, but accepting risks is part of the job. The real answer generally lies somewhere in the middle of the two extremes.
MintelIE 6y ago
That’s handy. CIA’s had problems with communists and Chinese and a bunch of other infiltrators since Wild Bill and his merry band of oppressed homosexuals. Always suspect subversion. Innocent mistakes aren’t made at this level.
rollulus 6y ago
https://outline.com/6pySsH https://outline.com/6pySsH
catsdanxe 6y ago
>34 terabytes of information, or about 2.2 billion pages. That's insane that they could leave so much data available to be stolen.
- Plutonsvea 6y ago
  Most of it likely useless and junk, or thousands of pages of logs I'm guessing. No doubt there is some juicy stuff in there though.
Aaronstotle 6y ago
I find it ironic that the CIA didn't bother to have it's systems secured/verified by the NSA. I'm sure the CIA thought that they were good enough, coming from an organization that was infiltrated from its inception, their hubris isn't surprising.
- LinuxBender 6y ago
  My limited understanding is that these orgs compete with each other for budget allocation and would never allow access into each others systems, but I could be wrong.
  - thephyber 6y ago
    All the more reason to criticize both of them. Half of the NSA's mission is to build/design secure communication systems for the US government and military.
  - fl0wenol 6y ago
    It's less about budget and more about we're not the DoD and can do whatever we please, stay the hell off our lawn. Even if it was a "hey, could you look at this and tell us what you think" with no obligation to address issues, it is undesirable to establish a precedence. They do use standards and recommendations from NSA/OMB for enterprise systems. But even the US Courts went that route, just with a lot of renaming of things so it can't be seen as being subservient to the Executive branch. There are some good frameworks and standards that you shouldn't waste time re-implementing.
    - blaser-waffle 6y ago
      Plus there is a reason you secure and compartmentalize information. The NSA may be comprised in some way, and giving them access means that deliberately or accidentally leak something vital. Same idea in reverse with the CIA -- maybe someone in the CIA is a bad actor and now knows the secret 0-days the NSA is using -- because they're busy locking them down -- and those get leaked.
  - 6y ago
tru3_power 6y ago
Reminds me of any “security” product. Next time you get the chance, I suggest you tear into any industry standard security tool and you’ll be surprised at what you find.
dijit 6y ago
Words can't describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless. Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn't be updated!) Exploit development is a glass cannon, remove all friction to modify the system and craft packets, invoke monitoring modes for hardware and frictionless tracing... that's going to have a security cost. This echo's a wider issue in the industry "Development" vs "Sysadmin" mindsets, where sysadmins are stifling and developers are all about removing barriers to progress faster and iterate more.
- bowmessage 6y ago
  What's the story re: backtrack2, for the uninformed?
  - dijit 6y ago
    I'm trying to find a citation here, but it's difficult because "Backtrack 2 ssh exploit defcon" is going to produce a lot of content which is unrelated. Anyway I can give you the skinny of the situation: 1) Backtrack 2 did not have an installer, it was a live-CD. But that doesn't stop you installing it by just copying the live environment to a disk (with some mount-binding and grub install, you're all good!) There were guides for doing this although they all had large warnings and the backtrack maintainers cautioned heavily against doing it. 2) because it was a liveCD there was no package update mechanism, it was not based on debian at the time so there was no apt or anything similar, even if there was there was no repositories, backtrack was a "tool" not a distro really. 3) sshd is one of the services that gets started on system boot for backtrack2. 4) someone at defcon unveilled an sshd exploit, a pretty nasty one, they had disclosed responsibly and everyone had been patched for at least 6 months, except the people who went against recommendations and installed backtrack2. They all got rooted. Bonus: everyone who ran backtrack2, without exception, ran it with the root user; as that was the default and they had patched software that normally complains about such things to not complain. xD
jokoon 6y ago
Unless you make engineers and entire companies focus on security through proper designs and standards, nothing will be secure. Most software is unsecure because geopolitically, the countries who make software are also the one who are able to penetrate those systems better than the rest of the world. No government will push to improve door locks unless that government isn't the most capable of defeating those locks. It's a cost/benefit function. Right now, improving software security is a net loss for the US. So it won't happen when the US is controlling the computer and software industry. So I'm not surprised to see even the best experts being beaten so easily.
deleted 6y ago
[deleted]
cybervasi 6y ago
Guarding information and guarding physical assets have one thing in common. It is largely a passive exercise in waiting for something to happen. For this reason it is very boring and unreliable. The only way to improve the situation is to have active and random drills when someone attempts to steal the assets. This would make the work of the Blue team a lot more rewarding rather than just be relegated to mindless blocking access to anything and everything.
- mox1 6y ago
  I mean you have more or less described a modern Cyber security Red Team.
OliverJones 6y ago
How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed? To misquote Dr. Strangelove, "ze whole point of ze secret hack is lost if you don't keep it a secret." https://youtu.be/2yfXgu37iyI?t=205 https://youtu.be/2yfXgu37iyI?t=205 Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online. Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe. And when will these state actors with unlimited funding figure out that NOBODY can keep secrets forever, not even them?
- chiefalchemist 6y ago
  Absolutely. So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Put another way: perhaps it's not an accident? And perhaps some of what was leaked was a decoy? Yes, keeping secrets is difficult. All the more reason to take advantage of that.
  - boomboomsubban 6y ago
    >So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Like leaving data of their secret assets available on Google searches, leading to hundreds of deaths? And firing the employee who warned then of the problem seven years before it was exploited?
    - chiefalchemist 6y ago
      I would suggest you research a bit on how intelligent and counter-intelligence actually works; not the Hollywood version.
      - boomboomsubban 6y ago
        I have, I was describing the CIA's recent history. Thinking CIA incompetence is some classic subterfuge is more of a Hollywood plot. https://finance.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://finance.yahoo.com/news/cias-communications-suffered-...
badrabbit 6y ago
A hacking unit is offensive. It's like saying, "america's elite nuclear force failed to stop an ICBM". Blowing up things (attack) is a different ballgame than defenfing things. Think of it this way if you are a hacker devoting 40hrs a week carefully studying and planning to infiltrate a network, you will succeed. APT actors have entire groups of teams dedicated to infiltrating one target at a time. Getting in is feasible, persisting,lateral movement and exfiltration without getting caught is very difficult but even commercial tools like cobaltstrike are built to allow different teams to focus on different stages of a hack.
- phoe-krk 6y ago
  You screw up at offense if your weapons are destroyed or disabled. In case of exploits, this is exactly what happens when they leak out. Your ability to attack in this case is equivalent to keep your arms useful.
  - badrabbit 6y ago
    This isn't what happened, their weapons were exposed and adversaries now know about them. Their effectiveness is still greater than 0. Digital weapons are copied not stolen, this is the equivalent of russians sendig spies to the US to steal nuke secrerts and the they developed their own nuke. The fact that the US has nukes has nothing to do with their ability to keep secrets and keep out spies. Furthetmore, russians having nukes did not make american nukes ineffective, they simply lost an advantage and to be frank it was only a mattet of time. Just like with the cia hack. And it will happen again!
- thephyber 6y ago
  It's more analogous to saying "the defense contractors for a new stealth plane failed to protect the designs and prototypes, so the enemy now has all of the detailed info they need to build countermeasures against this stealth technology". Securing the plans for stealth is a key requirement of the stealth continuing to work. Also, I'm sure those members of "the hacking team" weren't allowed to discuss their work with their family/friends, so it's not terribly unrealistic to expect them to use even just basic security hygiene (eg. don't share admin passwords).
Veserv 6y ago
The article tries to make it sound like the failure is a lack of prioritization and if they just focused correctly the problem could have been avoided, but I do not see why anybody would assume they would be able to protect their systems even if they tried. How well protected do you think cyber-weapons designed to surveil countries, disable infrastructure, and destabilize governments should be? How capable and well-funded should the attacker need to be before gaining access to cyber-weapons designed to kill economies and people? $1B, $10B? A team of 1,000, 10,000? Does anyone know of any system or organization in existence that would even be willing to claim they can stop a team of 1000 dedicated hackers working full-time for 10 years funded with $1B let alone put it in writing? What is the highest you have heard? Is it even in the general ballpark? It is absurd to assume that the failure to solve the problem is just a lack of prioritization if no one even claims to be able to solve it and it is meaningless to propose that they should adopt policies that do not even claim to be able to protect against the actual threat model let alone have evidence of such protection. They either need to find someone who will make the extraordinary claim that they can provide an actual defense and have the extraordinary evidence to back up that extraordinary claim or they MUST NOT deploy such systems since they can not be protected.
- SXX 6y ago
  Yeah I guess some people really misunderstood how hard making secure system is. Of course you can't claim to kill economy or too many people with it, but really you don't even need that kind of funding to break into most networks. I guess it's safe to say that even with $1M of funding and small team of dedicated security researchers coupled with right people for social engineering you can break into any network. Everyone can be fooled and humans are always the weakest spot. Especially now when information about everyone is publicly available on social networks so you can gather all information you need remotely. And when it's come to hacking into networks of company with no dedicated budget for cybersecurity cost of attack would be one or two orders of magnitude lower. Some self-organized groups of hobbyists prove you can even do it with no funding at all.
mtgp1000 6y ago
I saw a screenshot of a CNN article which said that that the CIA frequently used tactics to make hacks appear as though they were from Russia. Which is something I always suspected was relatively easy to do...change some logs, some timestamps, use some existing code...I'm not a hacker per se, but most of us write code here and deal with these kinds of things... So does anything in this vault possibly call certain recent allegations of Russian interference into question?
- 0xy 6y ago
  The intelligence community's opinion that the DNC hack was done by Russia was based upon the single source of a private organization CrowdStrike. But given all the heavy hitting nation states regularly frame others, "Russia's fingerprints" can mean either they did it or they didn't, so it's functionally worthless.
  - alwayseasy 6y ago
    You're either misleading or ill-informed. Since 2016 it is well documented Russia intervened through hacking and disinfo operations.
    - tick_tock_tick 6y ago
      It's my understanding that nothing truly concrete has been shown to the public?
      - alwayseasy 6y ago
        There has been direct testimony from intelligence officials and thousands of pages of reports including very technical details. Do you want server logs, intercepts, confessions? All these provide nothing of value to the general public. When intelligence agencies share clear evidence a dictator gassed his own civilian population, no one cares or trolls ask for more evidence.
        6y ago
wideawake 6y ago
Guess it's good to know that even big gov orgs are disfunctional
- blaser-waffle 6y ago
  all big orgs are dysfunctional. successful big orgs manage to work around it to a greater or lesser degree.

215 points by sunils34 6y ago

This happens in many corporations as well. It's fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team (infrastructure teams and developer teams hardening things) is not only boring to most, but it's also the team that gets the most grief from developers for inducing friction. If your company has a red team, ask how big the blue team is and if they have the same freedom to develop and implement mitigating controls as the red team has to exploit things. Hacker competitions mirror this. Red teams are allowed to bring in any exploits and do just about anything (as criminals would be expected to do) and the blue team are stifled by bureaucracy and not allowed to bring in anything.

willcipriano 6y ago
Hacker competitions often seem very contrived to me. I suspect that in order for the red team to make any progress you have to tie the blue teams hands behind their backs. Most of what I see from the penetration testing community is pretty gimmicky and situational generally and often doesn't take into account the attackers risk/reward ratio.
- LinuxBender 6y ago
  I agree completely. I see it as entertainment and a way to recruit people out of college.
- AnHonestComment 6y ago
  What would be a less gimmicky setup?
  - olivierduval 6y ago
    Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the budget for the cybersec can be reduced. So, for RedTeam, it's either a win or a tie. And for BlueTeam it's either a tie or a loss... If the BlueTeam could fight back, maybe this could change...
    - willcipriano 6y ago
      That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".
      - DaiPlusPlus 6y ago
        Do the feds still attend DC? >:}
        birdyrooster 6y ago
        No and they don’t come because hackers asked them not to. >:/
        Shared404 6y ago
        Found the Fed.
      - Bnshsysjab 6y ago
        Easier said than done, the red team can’t break real laws (routing through compromised hosts) where real hackers will.
    - mindslight 6y ago
      It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.
- deleted 6y ago
  [deleted]
- badrabbit 6y ago
  I disagree completely. Red team tools and techniques are different and gimmicky for a reason, their goal is to demonstrate lack of or effectiveness of security controls and processes. While bad guys have more time and more precise target. For example, 0days and disruptive actions are mostly prohibited for red teamers
badrabbit 6y ago
That's why "purple team" is the way (not sarcasm for people not aware of purple team methodology)
thephyber 6y ago
Another, related paradox is that in corporate org structures, the CIO is responsible for making sure the company's systems are available and working correctly, but the CISO is responsible for securing systems. Departments of CIOs can frequently be seen as a profit center which unlocks potential for the company while CISOs are almost always seen as a cost center which (ostensibly) slows the potential of the company. This also contributes to perverted incentives (like the red/blue teams) where the CIO frequently gets their way and is more likely to get budget while CISOs take all the blame when their budget increase requests get declined and IT is tasked with keeping unpatched systems up and stable rather than patching systems quickly. Obviously, the best orgs find a way to get both done, but resources are always scarce for the rest of us.
- jtdev 6y ago
  I left a high pay info-sec position at a large insurance corporation for this very reason. CIO trumped CISO (fractional) on literally every security issue that was surfaced - and worse yet the CIO and CEO refused to acknowledge the risk being onboarded/ignored. The irony of insurance execs refusing to acknowledge information security risk was just too much.
  - thephyber 6y ago
    Strange. I can imagine the average corp board member underestimating the risk accumulated by consistently ignoring CISO request for more cybersecurity investments, but the insurance industry is used to dealing with the low-frequency, high-impact payouts. Do you think it was mis-communication, ignorance, greed, hubris, or something else?
    - jtdev 6y ago
      All of the above.
  - jcims 6y ago
    I've been in infosec since the 90's. A lot of times I think this is on us. As much as I respect the technical acumen and creativity of my colleagues in the industry, I don't think we broadly understand risk that well and as a consequence we do a pretty bad job of communicating it. We tend to peg the panic meter with multiplied likelihoods and catastrophized impacts of possible scenarios while directly causing revenue losses by adding sometimes insane amounts of friction to the product delivery process. That's not to say there aren't cowboy CxOs recklessly ignoring reality, but accepting risks is part of the job. The real answer generally lies somewhere in the middle of the two extremes.

MintelIE 6y ago

That’s handy. CIA’s had problems with communists and Chinese and a bunch of other infiltrators since Wild Bill and his merry band of oppressed homosexuals. Always suspect subversion. Innocent mistakes aren’t made at this level.

rollulus 6y ago

https://outline.com/6pySsH https://outline.com/6pySsH

catsdanxe 6y ago

>34 terabytes of information, or about 2.2 billion pages. That's insane that they could leave so much data available to be stolen.

Plutonsvea 6y ago
Most of it likely useless and junk, or thousands of pages of logs I'm guessing. No doubt there is some juicy stuff in there though.

Aaronstotle 6y ago

I find it ironic that the CIA didn't bother to have it's systems secured/verified by the NSA. I'm sure the CIA thought that they were good enough, coming from an organization that was infiltrated from its inception, their hubris isn't surprising.

LinuxBender 6y ago
My limited understanding is that these orgs compete with each other for budget allocation and would never allow access into each others systems, but I could be wrong.
- thephyber 6y ago
  All the more reason to criticize both of them. Half of the NSA's mission is to build/design secure communication systems for the US government and military.
- fl0wenol 6y ago
  It's less about budget and more about we're not the DoD and can do whatever we please, stay the hell off our lawn. Even if it was a "hey, could you look at this and tell us what you think" with no obligation to address issues, it is undesirable to establish a precedence. They do use standards and recommendations from NSA/OMB for enterprise systems. But even the US Courts went that route, just with a lot of renaming of things so it can't be seen as being subservient to the Executive branch. There are some good frameworks and standards that you shouldn't waste time re-implementing.
  - blaser-waffle 6y ago
    Plus there is a reason you secure and compartmentalize information. The NSA may be comprised in some way, and giving them access means that deliberately or accidentally leak something vital. Same idea in reverse with the CIA -- maybe someone in the CIA is a bad actor and now knows the secret 0-days the NSA is using -- because they're busy locking them down -- and those get leaked.
- 6y ago

tru3_power 6y ago

Reminds me of any “security” product. Next time you get the chance, I suggest you tear into any industry standard security tool and you’ll be surprised at what you find.

dijit 6y ago

Words can't describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless. Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn't be updated!) Exploit development is a glass cannon, remove all friction to modify the system and craft packets, invoke monitoring modes for hardware and frictionless tracing... that's going to have a security cost. This echo's a wider issue in the industry "Development" vs "Sysadmin" mindsets, where sysadmins are stifling and developers are all about removing barriers to progress faster and iterate more.

bowmessage 6y ago
What's the story re: backtrack2, for the uninformed?
- dijit 6y ago
  I'm trying to find a citation here, but it's difficult because "Backtrack 2 ssh exploit defcon" is going to produce a lot of content which is unrelated. Anyway I can give you the skinny of the situation: 1) Backtrack 2 did not have an installer, it was a live-CD. But that doesn't stop you installing it by just copying the live environment to a disk (with some mount-binding and grub install, you're all good!) There were guides for doing this although they all had large warnings and the backtrack maintainers cautioned heavily against doing it. 2) because it was a liveCD there was no package update mechanism, it was not based on debian at the time so there was no apt or anything similar, even if there was there was no repositories, backtrack was a "tool" not a distro really. 3) sshd is one of the services that gets started on system boot for backtrack2. 4) someone at defcon unveilled an sshd exploit, a pretty nasty one, they had disclosed responsibly and everyone had been patched for at least 6 months, except the people who went against recommendations and installed backtrack2. They all got rooted. Bonus: everyone who ran backtrack2, without exception, ran it with the root user; as that was the default and they had patched software that normally complains about such things to not complain. xD

jokoon 6y ago

Unless you make engineers and entire companies focus on security through proper designs and standards, nothing will be secure. Most software is unsecure because geopolitically, the countries who make software are also the one who are able to penetrate those systems better than the rest of the world. No government will push to improve door locks unless that government isn't the most capable of defeating those locks. It's a cost/benefit function. Right now, improving software security is a net loss for the US. So it won't happen when the US is controlling the computer and software industry. So I'm not surprised to see even the best experts being beaten so easily.

deleted 6y ago

[deleted]

cybervasi 6y ago

Guarding information and guarding physical assets have one thing in common. It is largely a passive exercise in waiting for something to happen. For this reason it is very boring and unreliable. The only way to improve the situation is to have active and random drills when someone attempts to steal the assets. This would make the work of the Blue team a lot more rewarding rather than just be relegated to mindless blocking access to anything and everything.

mox1 6y ago
I mean you have more or less described a modern Cyber security Red Team.

OliverJones 6y ago

How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed? To misquote Dr. Strangelove, "ze whole point of ze secret hack is lost if you don't keep it a secret." https://youtu.be/2yfXgu37iyI?t=205 https://youtu.be/2yfXgu37iyI?t=205 Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online. Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe. And when will these state actors with unlimited funding figure out that NOBODY can keep secrets forever, not even them?

chiefalchemist 6y ago
Absolutely. So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Put another way: perhaps it's not an accident? And perhaps some of what was leaked was a decoy? Yes, keeping secrets is difficult. All the more reason to take advantage of that.
- boomboomsubban 6y ago
  >So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Like leaving data of their secret assets available on Google searches, leading to hundreds of deaths? And firing the employee who warned then of the problem seven years before it was exploited?
  - chiefalchemist 6y ago
    I would suggest you research a bit on how intelligent and counter-intelligence actually works; not the Hollywood version.
    - boomboomsubban 6y ago
      I have, I was describing the CIA's recent history. Thinking CIA incompetence is some classic subterfuge is more of a Hollywood plot. https://finance.yahoo.com/news/cias-communications-suffered-catastrophic-compromise-started-iran-090018710.html https://finance.yahoo.com/news/cias-communications-suffered-...

badrabbit 6y ago

A hacking unit is offensive. It's like saying, "america's elite nuclear force failed to stop an ICBM". Blowing up things (attack) is a different ballgame than defenfing things. Think of it this way if you are a hacker devoting 40hrs a week carefully studying and planning to infiltrate a network, you will succeed. APT actors have entire groups of teams dedicated to infiltrating one target at a time. Getting in is feasible, persisting,lateral movement and exfiltration without getting caught is very difficult but even commercial tools like cobaltstrike are built to allow different teams to focus on different stages of a hack.

phoe-krk 6y ago
You screw up at offense if your weapons are destroyed or disabled. In case of exploits, this is exactly what happens when they leak out. Your ability to attack in this case is equivalent to keep your arms useful.
- badrabbit 6y ago
  This isn't what happened, their weapons were exposed and adversaries now know about them. Their effectiveness is still greater than 0. Digital weapons are copied not stolen, this is the equivalent of russians sendig spies to the US to steal nuke secrerts and the they developed their own nuke. The fact that the US has nukes has nothing to do with their ability to keep secrets and keep out spies. Furthetmore, russians having nukes did not make american nukes ineffective, they simply lost an advantage and to be frank it was only a mattet of time. Just like with the cia hack. And it will happen again!
thephyber 6y ago
It's more analogous to saying "the defense contractors for a new stealth plane failed to protect the designs and prototypes, so the enemy now has all of the detailed info they need to build countermeasures against this stealth technology". Securing the plans for stealth is a key requirement of the stealth continuing to work. Also, I'm sure those members of "the hacking team" weren't allowed to discuss their work with their family/friends, so it's not terribly unrealistic to expect them to use even just basic security hygiene (eg. don't share admin passwords).

Veserv 6y ago

The article tries to make it sound like the failure is a lack of prioritization and if they just focused correctly the problem could have been avoided, but I do not see why anybody would assume they would be able to protect their systems even if they tried. How well protected do you think cyber-weapons designed to surveil countries, disable infrastructure, and destabilize governments should be? How capable and well-funded should the attacker need to be before gaining access to cyber-weapons designed to kill economies and people? $1B, $10B? A team of 1,000, 10,000? Does anyone know of any system or organization in existence that would even be willing to claim they can stop a team of 1000 dedicated hackers working full-time for 10 years funded with $1B let alone put it in writing? What is the highest you have heard? Is it even in the general ballpark? It is absurd to assume that the failure to solve the problem is just a lack of prioritization if no one even claims to be able to solve it and it is meaningless to propose that they should adopt policies that do not even claim to be able to protect against the actual threat model let alone have evidence of such protection. They either need to find someone who will make the extraordinary claim that they can provide an actual defense and have the extraordinary evidence to back up that extraordinary claim or they MUST NOT deploy such systems since they can not be protected.

SXX 6y ago
Yeah I guess some people really misunderstood how hard making secure system is. Of course you can't claim to kill economy or too many people with it, but really you don't even need that kind of funding to break into most networks. I guess it's safe to say that even with $1M of funding and small team of dedicated security researchers coupled with right people for social engineering you can break into any network. Everyone can be fooled and humans are always the weakest spot. Especially now when information about everyone is publicly available on social networks so you can gather all information you need remotely. And when it's come to hacking into networks of company with no dedicated budget for cybersecurity cost of attack would be one or two orders of magnitude lower. Some self-organized groups of hobbyists prove you can even do it with no funding at all.

mtgp1000 6y ago

I saw a screenshot of a CNN article which said that that the CIA frequently used tactics to make hacks appear as though they were from Russia. Which is something I always suspected was relatively easy to do...change some logs, some timestamps, use some existing code...I'm not a hacker per se, but most of us write code here and deal with these kinds of things... So does anything in this vault possibly call certain recent allegations of Russian interference into question?

0xy 6y ago
The intelligence community's opinion that the DNC hack was done by Russia was based upon the single source of a private organization CrowdStrike. But given all the heavy hitting nation states regularly frame others, "Russia's fingerprints" can mean either they did it or they didn't, so it's functionally worthless.
- alwayseasy 6y ago
  You're either misleading or ill-informed. Since 2016 it is well documented Russia intervened through hacking and disinfo operations.
  - tick_tock_tick 6y ago
    It's my understanding that nothing truly concrete has been shown to the public?
    - alwayseasy 6y ago
      There has been direct testimony from intelligence officials and thousands of pages of reports including very technical details. Do you want server logs, intercepts, confessions? All these provide nothing of value to the general public. When intelligence agencies share clear evidence a dictator gassed his own civilian population, no one cares or trolls ask for more evidence.
      - 6y ago

wideawake 6y ago

Guess it's good to know that even big gov orgs are disfunctional

blaser-waffle 6y ago
all big orgs are dysfunctional. successful big orgs manage to work around it to a greater or lesser degree.