21 ms·
NSA Owns Everything (2015)
- schoen 6y ago(2015)
- mjevans 6y agoYet, still as scary and relevant today.
- panny 6y agoMore scary is how people in tech circles still call you paranoid when you call Intel ME/AMD PSP a backdoor. >We are also always open for ideas but our focus is on firmware, BIOS, BUS or driver level attacks. Anyone on WiFi AC or up are backdoored right now by NSA. All of them are compromised, no doubt in my mind. All the LTE. All the x86 hardware on the market. All of it. If you aren't running fully free software, you're affected. And if you are a rare case running fully free software, you're an easy target for interdictions, since there's so few of you.
- SlavikCA 6y agoHow does "running fully free software" helps alleviate "compromised x86"?
- waihtis 6y agoWrap up that fully free software with LibreBoot and you're good to go!
- marcosdumay 6y agoWrap with LibreBoot, replace all the non-free firmware, check your hardware on a microscope against embedded backdoors, oh, and don't forget to verify your stack's source and your building environment. But, well, you can stop at your CPU's manufacturer website, where you will find ME/PSP, well documented as a backdoor. It will save you the trouble of verifying the hardware and firmware.
- panny 6y agoIf you're running fully free software, you're not running x86, since it can't boot without backdoored binary blobs.
- Thorrez 6y agoWhat about Libreboot? Doesn't that allow booting x86 without binary blobs?
- panny 6y agoYes, very old hardware that's no longer on the market. I don't consider that a solution. Eventually that pool of hardware dries up.
- numpad0 6y agoThey still need some parts of blobs to configure/initialize the system and that “some” now means full MINIX kernel along its userland
- daffy 6y agoAre you saying a librebooted machine is still probably backdoored?
- j88439h84 6y agoCan you provide some evidence for these claims?
- panny 6y agoSnowden docs have been available for years. ShadowBrokers. Just this week a 20GB dump of private Intel source was dumped with backdoors included. It is beyond a reasonable doubt that x86 hardware has NSA backdoors in it. You're now sitting on a time bomb. Remember when the NSA tools were dumped with their secret Windows exploits? WannaCry? North Korea picked that up and launched ransomware attacks. That's the sort of thing that's going to happen again with the newly published Intel backdoors. Just wait and see. Tim Cook is 100% vindicated this week about not adding intentional iPhone backdoors.
- j88439h84 6y agoI don't remember WiFi or CPU backdoors in Snowden, ShadowBrokers, or Intel 2020. Unless by "backdoor" you just mean NSA holds zero days on various important technologies, which is reasonably likely given EternalBlue. Is that what you mean?
- DarthGhandi 6y agoThey don't need 0days when they can just easily corrupt the standards process. They've been doing it everywhere. The Wifi Alliance has made some heinously bad choices that if you attributed to incompetence simply make no sense, they treat anyone who questions them with disdain and shoots down attempts to fix the mess they make. WPA3 was hilariously broken a month after getting rolled out.
- numpad0 6y agoI can’t wait for those ME/PSP program to become declassified, because I have zero doubt it’s an op and someone’s going to do it. It’ll be exciting just as A-12/SR-71 docs!
- garmaine 6y agoThey will never be declassified.
- deleted 6y ago[deleted]
- dleslie 6y agoThe basic premise is false. > "Why did we never see it coming?" Many people saw it coming. I was warning about the possibility of dragnet surveillance, the existence of ECHELON, the use of the American security apparatus to steal trade secrets, the surveillance of non-American politicians, et al... For many, many years before Snowden. And I'm just some rando on the internet who follows the mainstream news! We were called _Conspiracy Theorists_; but when the action is _probably_ fact[0][1][2][3], why is it still ridiculed to say it might be happening? 0: https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-german-chancellery-decades-wikileaks-claims-merkel https://www.theguardian.com/us-news/2015/jul/08/nsa-tapped-g... 1: https://en.wikipedia.org/wiki/ECHELON https://en.wikipedia.org/wiki/ECHELON 2: https://fas.org/irp/program/process/991101-echelon-mj.htm https://fas.org/irp/program/process/991101-echelon-mj.htm 3: https://cryptome.org/echelon-cia2.htm https://cryptome.org/echelon-cia2.htm
- badrabbit 6y agoThere were others before snowden, like: James bamford https://media.ccc.de/v/31c3_-_6600_-_en_-_saal_2_-_201412281245_-_tell_no-one_-_james_bamford https://media.ccc.de/v/31c3_-_6600_-_en_-_saal_2_-_201412281... What snowden did was provide independently verifiable content and details of their activities. His leaks were outdates by half a decade by the time they were public too. Everyone sort of accepted the IC will do shady stuff to stop terrorists after 9/11 because "american lives" so it was a solid conspiracy theory backed (not proven) by facts at the time. We sort of hoped they didn't care enough to snoop into our boring lives.
- manzu 6y agoWe knew about mass surveillance via Echelon in Romania in the early 2000s... Mobile phones were just ramping up, best internet we had was PPPOE neighborhood networks.
- walrus01 6y agoIn 2013/2014, I don't think anybody who had read all of James Bamford's books was in any way surprised by the Snowden revelations. https://www.google.com/search?channel=fs&q=james+bamford+nsa https://www.google.com/search?channel=fs&q=james+bamford+nsa
- azinman2 6y agoYet somehow Russian / China are hacking the US left and right. If the NSA is so good, then at some point dont they have the responsibility to actively defend?
- harry8 6y agoBut are they really though? Could well be a threat there but I want actual evidence when the threat bogeyman is invoked in the name of more power. I believed the WMD lie. I hope I have learned from that. If we believe the NSA then your question is exactly the right one to ask and has some obvious implications.
- redis_mlc 6y ago> I believed the WMD lie. Iraq did have WMD - they used poison gas on Kurds. They also had an absolutely massive army that had to be confonted at some point. The Bush administration and their "aluminum tubes" was silly though. > I hope I have learned from that. What you haven't learned is that every bad thing reported has basically been true in recent history, if you pay attention.
- jialutu 6y agoI think this might interest you: https://en.wikipedia.org/wiki/Nayirah_testimony https://en.wikipedia.org/wiki/Nayirah_testimony So pretty much all of US's wars in Iraq has been based on lies.
- jjcon 6y agoI think you mean US, UK, Spain, Australia, Poland war's. Also, the war would have happened with or without her testimony so I'm not sure your point holds. https://en.m.wikipedia.org/wiki/Multi-National_Force_%E2%80%93_Iraq https://en.m.wikipedia.org/wiki/Multi-National_Force_%E2%80%...
- boomboomsubban 6y agoFrom the article, attacking is much cheaper than defense. If they were splitting their budget evenly between the two you wouldnl still hear about the US being hacked constantly.
- waihtis 6y ago2. You thought they were someone else Attribution in the cyberspace is still pretty shaky, even though there have been some high profile accusations flying around lately. Sometimes you see links being drawn to GRU on the basis of things like some executable having a compile time matching to a Russian time zone or a file being last modified by a user called "Dmitry." Seeing as the IC cyber business is already murky as hell, who knows which party is actually doing what. I think only the PLA plays with slightly more open cards, mostly because they just don't give a damn about being caught.
- boomboomsubban 6y ago> I think only the PLA plays with slightly more open cards, mostly because they just don't give a damn about being caught This kind of reputation makes them the an easy target for every other actor to take advantage of.
- bonestamp2 6y ago> I think only the PLA plays with slightly more open cards, mostly because they just don't give a damn about being caught. This tactic was invented by the KGB. It's not that they don't care, it's that if it looks like you did it, and there was no apparent attempt to conceal that it was you, then it actually seems more like you were framed by someone else and you didn't do it. In other words, the truth acts like its own disinformation campaign because people often assume the real criminal would try to conceal themselves.
- White_Wolf 6y agoI'm not sure your average Joe with no tech knowledge thinks that far. I'd say that most people that this sort of information at face value and don't bother to delve into it.
- closeparen 6y agoI always assumed that the KGB/FSB were and are so brazen because the state wants you to know about and fear its power.
- gnur 6y agoThe hiding of the malicious code in arm processors of ssds and in the BIOS seem like this is mainly targeted at people running their own hardware. Does this mean running in a public cloud might actually be more secure? Or do we just have to assume that the NSA has their hardware in place in any cloud provider and that there actually is no security possible in the cloud?
- sbierwagen 6y agoWhy on Earth would public cloud be more secure? If the NSA has dedicated rack space in AT&T switching facilities, what makes you think they don't have offices at Microsoft, Amazon, Cloudflare, etc? https://en.wikipedia.org/wiki/Room_641A https://en.wikipedia.org/wiki/Room_641A
- luckylion 6y ago> Does this mean running in a public cloud might actually be more secure? If that public Cloud is from an American company: obviously no. And whether you prefer some Chinese intelligence service having access to your data probably depends on what you want to do.
- nix23 6y agoNot just because of Intelligence services but also because of the CLOUD Act / Data Residency.
- jauer 6y ago> Does this mean running in a public cloud might actually be more secure? Yes with two conditions: 1. your public cloud is run by an Amazon, Google, Microsoft-type company (FANMAG) 2. You trust the company to lean on rule of law. 1. Very few providers have the capability and desire to put the work into supply chain security, things like OpenTitan, etc. 2. They might hand over your data in response to warrant, but their systems are designed to prevent covert extraction of data. The company should have a track-record of pushing back against overly broad warrants.
- 6y ago
- deleted 6y ago[deleted]
- exikyut 6y agoAn observation: The exfiltration protocol described in the "misdirection" section has "Dated: 24 Feb 98" in the bottom right corner. That it's being regarded as reasonably novel is a good measure of just how broken the collective security discussion is. Just as broken as the PGP situation, thinking about it; in which case everything is operating as intended... moving on...
- yc3po 6y agoIt clearly shows how much effort the US govt went to undermine it's citizen's security. I mean 1998....
- upofadown 6y ago>Just as broken as the PGP situation... Context? I remember that Snowden regarded PGP as a usable defence against his former bosses.
- justanotheranon 6y agonice catch. that date of 1998 is a Big Fucking Deal. the Patriot Act was passed in October 2001. the narrative we have all be lead to believe is that NSA only ramped up domestic mass surveillance in 2001. but why would NSA have a protocol for exfil across passive sensor hops in 1998? passive exfil only works if you have sensors mirroring backbone traffic at all the biggest upstream meetme rooms. but NSA supposedly wasnt legally allowed to install Boeing Narus mirror routers at ISPs until 2001. what this 1998 date means is that NSA TURMOIL--passive sensor ingest, had to exist PRIOR TO 2001. this even screws Bill Binney's narrative that the system he designed--THINTHREAD, which he says would spy on all traffic without violating our privacy laws, was built in 1999-2000. THINTHREAD was ultimately canceled and Hayden chose STELLARWIND instead. but this screencap show FASHIONCLEFT already existed in 1998. therefore NSA has been spying on the whole Internet for waaaay longer than the official narrative says. i was one of those conspiracy theorists ranting on USENET about ECHELON back in 1998. turns out, we were RIGHT.
- nyolfen 6y ago>passive exfil only works if you have sensors mirroring backbone traffic at all the biggest upstream meetme rooms. but NSA supposedly wasnt legally allowed to install Boeing Narus mirror routers at ISPs until 2001. you're assuming this is intended for american infrastructure. they were probably violating the civil rights of americans before 9/11, but this is an inconclusive piece of evidence.
- raxxorrax 6y agoI think the intelligence community made a bit of a joke of themselves honestly. Especially on the topic of electoral manipulation. They deserve it. Although there was large political influence, it really doesn't shine a good light on them and their capabilities or more probable what they make of them. That said, I think restricting their abilities is the way forward, otherwise you just get a new form of a cold war, which in hindsight was just stupid. Their current capabilities cannot be justified with security concerns and if so, they should at least be able to fix the IT of prominent political actors. They scared the right people to get privileges to data that is formally protected in most western countries. So not only do they do a bad job, they are also criminals.
- submeta 6y agoI remember how the public was shocked in Germany in 2013 about the revelations. What we learned was way beyond what everybody thought possible. One of the most important figures discussing the implications for our democracy and the impact on our behaviour in light of the knowledge that we have no privacy at all was the editor of the German newspaper FAZ: Frank Schirrmacher. Unfortunately he died in 2014, very young, aged fiftysomething. After 2014/2015 these topics were discussed less and less here in Germany. Currently nobody talks about these things anymore.
- phito 6y agoI am still being labelled as a conspiracy theory nutcase whenever I talk about this subject to people.
- 6510 6y agoThen, if you explain that there is reason to believe the term conspiracy theories was created and popularized specifically to indoctrinate them into responding exactly the way they are responding (like programmable robots).. then they just call ``conspiracyTheories(yourTheory)`` again to "validate" it and you lose 20% of your remaining credibility. I just go with a bit of ridicule. Something like: It is not that sophisticated, educated, wealthy and influential people in power could get together and have some kind of plan. If they did it couldn't possibly escape your attention but if it did it wouldn't be interesting enough for you to talk about. Or maybe it isn't that. Maybe the quality of government depends entirely on the citizens? If you think drag net spying is a good idea is a yes/no question. If you don't care means yes which in turn means they should be doing it. Same goes for enriching themselves at your expense. I mean if you approve of it?? Or is not caring and approving not the same thing?
- agumonkey 6y agoOne thing I'm curious is what's the source of energy behind all this. NSA failed to stop many important accidents (9/11, covid) .. Is it a survival bias and they're still keeping people safe without saying it or is it some finance/intelligence blackhole spinning due to some political quicksand ?
- somesortofsystm 6y agoIn a society governed through secrets, we can never know what the sovereign is really doing in our name. This is the case with the USA today - it is not truly an open society, but one of layers .. and those with the 'special privilege' of having security clearances are desperate to maintain that socially high-class standing among themselves, so they wrap more and more secret agency around the issue so that the general public can never know, truly, what their sovereign is doing. This allows immense corruption and profiteering. However, its not all just "ma' capitalism" - there are very strong indicators that a socialist superstate is being constructed within this society, which is parasitically feeding on the corpse of America today. Many consider the US military industrial complex the largest socialist organization that ever existed - it certainly crosses a lot of the boxes.
- chacha2 6y agoSocialism is when the Government does stuff. Rich capitalists lobbying and corrupting the Government to give their private organizations more money is Socialism. Socialism is destroying America!! Can't you see??!
- somesortofsystm 6y agoSpecifically, the American Military-Industrial complex is a socialist welfare state hell-bent on owning all means of production in America, yes. It produces nothing of any value to society, and demands that it be fed from the coffers before anything else. And yes, it is the American government doing this.
- Cthulhu_ 6y ago
- yc3po 6y agoThe Snowden revelations were a God send to our industry. Imagine if we all were still using insecure protocols like plain HTTP today.
- DethNinja 6y agoIt doesn’t matter whether you use encryption or not. State got backdoors at cpu level. So long as you are connected to Internet you have to assume that data is not secure against state surveillance. Encryption is against lower level non-state actors. State-level surveillance can be eliminated through physical data diodes but it is would be very capital intensive.
- ThinkBeat 6y agoI knew about this prior to 2000 Within my hacking community it was well know. We used to do that thing were you send out massive amounts of email with trigger words to cause problems. I think it created 0 problems. It was an open secret. Well I guess at the time a conspiracy theory. One that has been proven true and it was much worse than we thought
- linhchi 6y agoHey, does anybody have that documents from Spiegel? I clicked the link but it says not found. Probably it is from 5 years ago so they take down the pdf documents.
- justanotheranon 6y agothat sucks that link rot is slowly erasing the news reports of Snowden's leaks. how are younger people supposed to defend themselves if the past is erased? there are 2 sites which archive the complete Snowden leaks: https://search.edwardsnowden.com/search?utf8=%E2%9C%93&q=spiegel https://search.edwardsnowden.com/search?utf8=%E2%9C%93&q=spi... https://snowdenarchive.cjfe.org/greenstone/cgi-bin/library.cgi https://snowdenarchive.cjfe.org/greenstone/cgi-bin/library.c...
- feralimal 6y agoThe Snowden stuff was the event that shook me to my core. I was a happy technologist till then, thinking that such was the nature of life and progress simply was unfolding in front of me. However, the way the event was covered by the media - told a different story. The media focussed on the man rather than the info he provided, so the conversation was 'where was he?', 'where was his girlfriend?', etc - that told me everything. They hardly touched on what was provided and what that meant (that we were being spied on 24/7). And what was provided took years to come out...... So, the media are complicit - just another arm of the governance structure we find. The intercept, the MSM, all are just playing a role in mis-informing the people. Since then, I have even come to change my views on the Snowden event itself. I think this was an intentional release of data, an orchestrated event. Snowden is probably a character created by some agency. He may not be a real person - things like bits of his glasses disappearing indicate that he could be CGI. Perhaps this sounds crazy - but if you are in the business of governance, you want to manage everything, even the opposition. (Think 1984 and the way that the opposition is created and controlled in that book). Why would "they" create Snowden and the release of apparently top secret files? Well, if you know what is coming you do not respond with shock, you do not reject it out of hand. You acclimatise to the new reality. There was little we could do with the Snowden event, except watch it play out. We were put on notice and informed of what was/is coming. And what's coming is a technocratic system with very fine grained control in the hands of the technocrats.
- neolog 6y agoI found this comment so shocking I went and read your post history and I'm really interested how this view arises. Can I ask your background that made you think this way?
- sumtechguy 6y agoI 'follow' these theories. Most are junk. Most have a hinge-pin of a idea that if pulled out the whole thing collapses. The supporting evidence is usually designed to make that idea stronger. I use the a modified mythbusters classification of them. 'busted', 'unlikely', 'plausible', 'confirmed'. I have never heard the snoweden is a totally made up generated person before. Other than he is a CIA actor theory. That just means I am not an expert on this. But it could be 'sorta plausible'. NSA is probably a good generation ahead of most of the world tech wise. They have the compute power for it and the brain power for it. So a deepfake from them is 'plausible'. But I lean towards unlikely in that case. As what we see from deepfakes is kind of weird and strange. Some bit of him 'popping' is probably a camera roll shutter thing. He seems like he is a guy who did something, because what he saw was bad. When something jumps from 'busted' over to the 'confirmed' category that is when you can raise an eyebrow. That happens very rarely. The 2016 email dumps of Hillary did that in a few cases. Which was surprising. As to how you can end up 'there'. Well it mostly depends on what news feeds you let into your life, and do not go into them with a health dose of deep skepticism. Youtube can get a bit stuck on particular things as its alg feeds on engagement. Watch 1 video from someone and you have kind of exhausted your other threads of thought in their system and it will go hog wild and show you a different class of stuff if it is not on their 'do not show this to people list'. Remember ML/AI is basically very fancy cubic spline fitting across many nodes with some calculus thrown in and N stages. But if you end up between two points you can get strange results. But a computer does not know a garbage result from a good one. So it gives it to you with a 90% confidence. If something jumps categories some people like that idea. They like the idea they can say 'Ive know about that for years'. I think it also gives comfort to them if they can not make sense of an idea. But my jedi mind skills are weak so I can not read minds :)
- staticassertion 6y agoNot really many relevant comments in this thread. Everyone seems to have read the first sentence (if even), interpreted it as 'why did no one think the NSA was hacking?', and responded. It's a shame, this is a great piece, I think. The question is, with all of these companies performing IR, why didn't they see mass exfiltration and C2? I think the article lays out largely correct claims. I personally would imagine (2) and (5) to be the most significant. Regarding (2), it is so hard during an incident to know exactly what is attacker behavior and what isn't, to know that it's all the same attacker, etc. It isn't so uncommon to go digging into an incident only to find some unrelated malware - and in fact many companies find out they're owned from their pentesters. With regards to (5), defenders have frankly been to slow to evolve. The people investigating these attacks likely only have a rudimentary understanding of TCP/IP, have virtually no ability to read or write code, and mostly are trained to build and enforce policy. The idea that they can catch even basic attackers in realtime is a joke, that they are to also be tasked with catching the NSA is just a depressing, hard to swallow reality. Attackers are out here building up toolchains from scratch - anyone who isn't doing that is called a script kiddy. And yet defenders who can't build a single thing, who can only throw tools at a problem, are the standard. Attackers are flat out better than defenders - they work smarter, they have better capabilities, and defenders don't even seen to care en masse. As Alex Stamos said (paraphrasing), most companies aren't even "playing the game", and it's a select few that even know what game to play - not even that they're playing well, but at least they showed up to the right ballpark (I'm butchering his statement). The vast majority of companies employee outdated models of security and incident response is probably the least mature, with devops pushing more and more infrastructure and product security engineers over IT admins. No doubt that NSA's scale allowing novel forms of exfil like passive collection also played a major part. What a sad state. Having taken VC money to try to improve the situation I do always laugh when thinkst talks about that :) but much respect!
- jnwatson 6y ago> The question is, with all of these companies performing IR, why didn't they see mass exfiltration and C2? 1. Good tradecraft means that, except for skilled IR folk, they wouldn't see mass exfil/C2. 2. American IR companies know what side of their bread is buttered on. From both employees' personal allegiances to their former employers and the company's active government contracts, there's not a lot of incentive to report on their own government's actions.
- ThinkBeat 6y agoI think that the most severe vulnerabilities that are found have been known about for a long time by our intelligence community and likely others. I doubt much of anything off the shelf for companies even if they open their wallets a lot can be realistically expected to defeat against advanced well funded nation state intrusions. I would not add North Korea or Iran to that list. I think they are far behind. Maybe North Korea gets some scarps from China The US has without a doubt the most powerful position. All major operating systems are made here. GitHub is for the most part here. A lot of equipment comes from there or at least in warehouses or just pass through. Given ample opportunities for modification. We have the FAANG. Twitter and lots of other worldwide platforms that have millions of users. All slurped Up by the NSA (at least if they want to). The US has a very coveted position. Presumably China possibly is next. So much manufacturing happens there on whole equipment or parts for it. Should give them rich opportunity to modify products they are interested inn.
- mtgx 6y agoSo we know that Microsoft had a multi-billion dollar incentive from the NSA to buy Skype and remove its P2P encryption. And then we know that Microsoft removed P2P encryption as soon as it bought Skype, and then it joined the PRISM program revealed by Snowden. https://www.theregister.com/2009/02/12/nsa_offers_billions_for_skype_pwnage/ https://www.theregister.com/2009/02/12/nsa_offers_billions_f... I wonder if GitHub was bought for the same reason (the NSA could silently add backdoors to software code hosted on GitHub without the UX revealing anything of the kind). Now that we're openly seeing how the US freaks about about "national security" because other countries might own these highly popular chip platforms or social media companies, I wonder what other events played in the same way in the past - like what other companies did the US "had to have" for the purpose of enabling much easier spying on rivals, and then "suddenly" some American company offered to buy out those companies. Now I'm not necessarily saying this is the one and only reason these companies made these acquisition - most likely, in most cases, NSA approached the companies that would be open to the idea because it could also prove strategic for their business in some way. So it would be a "win-win" for these companies to both acquire a possibly useful technology, as well as get paid later on by the US government through various "unrelated contracts" that would pay for these deals.
- daodedickinson 6y ago"Skilled adversaries operating under cover of a rioting mob is hardly a new tactic". It's also hardly an old tactic. All I will say is that when I was forced by personal experience to inexorably learn the scope of what can be covered up is at least two orders of magnitude beyond what I'd thought possible... it gave me and still gives me waking nightmares and sleep deprivation.
- jacquesm 6y agoThe difference between a theory, a conspiracy theory and the truth are best described by varying levels of evidence. A theory is not currently accepted as the truth, but it might be the truth. A conspiracy theory is something that has been proven to be untrue, but people still believe it and pass it on. The truth is the internally consistent and fact supported state of the world as it was and as it is. There were many people who were going out on a limb with the assertion that the NSA was probably vacuuming it all up, they had means, motive and opportunity handed to them on a golden platter, on top of that it corresponded with what we would expect to do ourselves when in that position (not that there was any such temptation). The hacker community was well capable of seeing this as a theory, rather than as a conspiracy simply for absence of proof. That didn't stop others from labeling the hacker community as a bunch of conspiracy theorists simply because they could not imagine it to be the truth, but a lack of imagination is not the same as proof and the output of such a process is better described as wishful thinking than rational thought. Snowden changed all that. All it took was one person willing to burn their career to provide the proof. But beyond that nothing much has changed.
- amiga_500 6y ago> All it took was one person willing to burn their career to provide the proof. So many of the below posts are about all kinds of crazy conspiracy theories (most of them vastly overreach the competence of the USA), but this part hits the nail. USA's problem is the culture. The idea that if each person pursues their own self-interest it will amount, in aggregate, to the best possible outcome - this is totally flawed. Your individualism leads not to "freedom" but to accountants who help companies dodge (not avoid) tax, to politicians who don't speak up because it will damage their career, to bankers who extend credit when they know it's unsustainable in pursuit of their bonus, to news anchors who hold their tongue to avoid upsetting sponsors, on and on. Just reading the biography of Washington right now. I doubt he'd have taken one bullet in the hat for you guys if he could see you now. Snowden is his heir, the rest are not. Your problem is cultural. That's a big problem. It won't be addressed as the first hurdle is jingoism. Anyone attempting to converse is labelled an anti-American, even though the current America isn't American.
- 6y ago
- andy_ppp 6y agoI’m really interested in how low level the hacking is, specifically network card and hard disk firmware. Does anyone have breakdowns of how these work or copies seen in the wild? I particularly liked the bit in the article about hiding data in packets intended for other hosts and harvesting them through passive relays. Is there a way to detect this sort of thing? Is everything really compromised?
- Liquix 6y ago> Is everything really compromised? Given the documents and budgets which have leaked so far - it seems more sensible to assume that all hardware & software is compromised until proven otherwise. From the limited information provided so far we can see that if you use any Intel CPU, any Seagate/Hitachi/Fujitsu/Samsung hard drive, any version of windows, most commercially available routers, notepad++, or VLC - the NSA has access. Their scope is ridiculous.
- jmholla 6y agoForgive my ignorance, but notepad++ and VLC?
- Liquix 6y agohttps://wikileaks.org/ciav7p1/cms/page_26968090.html https://wikileaks.org/ciav7p1/cms/page_26968090.html https://notepad-plus-plus.org/news/v733-fix-cia-hacking-npp-issue/ https://notepad-plus-plus.org/news/v733-fix-cia-hacking-npp-... My bad, that one was the CIA.
- closeparen 6y agoIf only it were so easy. With the backdoors in all our hands, we could find them. Rather, the NSA has the capability to subvert these things. Sometimes before they reach you, sometimes remotely. But you’d be “lucky” to come across one where they’ve actually done it.
- justanotheranon 6y agoconsider what info NSA has access to with it's stunning global passive adversary infrastructure. to you or me, developing exploit implants on a systematic scale targetting the firmwarw of every model of every harddrive of every vendor seems technically impossible to us outsiders. but NSA has access to the emails, internal bug trackers and source code repos of the entire dev teams at all of those vendors. think how easy it would be to hack all firmware on an indistrial scale when you can cheat and read the blueprints? NSA is the biggest cheater. i no longer consider them as being gods of cyberwar. rather, they merely tricked us all to believe NSA was not mass surveilling everyone, then we were blinded to the scale of what was really possible behind the curtain. if we had the source code to the firmware of every hard drive, we could do exactly the same thing NSA did. also, yes, do not ever trust a computer. remember the photo of David Miranda's macbook motherboard after his laptop was siezed when he was connecting to a flight in London and acting as the courier between Laura Poitras in Berlin and Greenwald in Brazil? the photo showed GCHQ melted like a dozen chip on his motherboards. when that photo came out, it was puzzling, because the Snowden leaks about NSA hacking firmwares had not yet leaked. in hindsight, now we know. NSA and FVEYs physically destroyed every chip that they could implant, out of fear that someone else could BADBIOS attack David's macbook and steal the Snowden cache.
- motohagiography 6y agoIn terms of your experts being wrong, reality is, you likely didn't want your experts to tell you about this stuff at all. If you added state actors to a threat model even after Snowden, there were corporate managers in random companies who would shut down the conversation, end the conference call, or leave the room and you'd find out indirectly that someone somewhere had found problem with your contract and it was being ended. If you knew, what would you really do? There are insiders and outsiders, and if you talk about this stuff, you are an outsider. Life strategy-wise, which one are you going to be? It sounds jaded, but really, having been one of those experts playing in this invisible sandbox, I used the tools I had and worked with integrity. That I didn't defeat a multi-trillion dollar conspiracy of hundreds of thousands of people doesn't bother me much, and where I scored a few points on them, I feel pretty good about it.
- jacquesm 6y agoIf you walk into any of these things in real life: tread very carefully.
- mellow2020 6y ago> I just sometimes ask myself if people in previous centuries thought and lived as superficially as today. Or if, piece by piece, as times fade, their bad aspects retreat to the background and their goodness shines especially bright? At any rate I think that the individual, regardless of outcome, has to be vigilant, and especially when it is made hard for them. You also believe that this can never be levelled upwards, as desirable as that seems. When there is levelling, it always happens downwards. But here, too, there is a brilliant opportunity offered by fate to prove ourselves. Maybe one should not underestimate that, either. -- Sophie Scholl
- jacquesm 6y agoGreat quote and great person. And how her life ended is a good indicator that what I wrote isn't nonsense. But I actually meant it in a more present day technical and less all-out fascism way. Still, the principles remain the same.
- atlgator 6y agoRemember when it was just a conspiracy theory that the NSA was eavesdropping on Americans?
- justcomments12 6y agoIn practice Indian/Chinese bot networks control the Google rankings and thus entire industries, not Google/NSA. It's not just corona crisis that's hurting western economies. edit: why down vote? We can pretend negative SEO networks don't exist on a massive scale, but that wouldn't be truth.
- throwaway_dcnt 6y agoThe tools and techniques to defend against such attacks are constantly under attack themselves. The latest round of mozilla layoffs targeting large swaths of rust team is one such example. The way these attacks are orchestrated, it is difficult to pinpoint their origin or even to establish if these are indeed attacks.
- raincom 6y agoThere are some dialogical strategies people use to avoid any discussion. One such is "conspiracy theory". Next time, when TPTB don't want to have a discussion, they will have their media buddies call their opponents conspiracy theorists. That way, there will never have any dialogue, thereby preventing any accountability of TPTB.
- ed25519FUUU 6y agoIt's still amazing to me that the mainstream media is insisting that incumbent politicians and power players weren't spying on their rivals using the full strength and force of the American intelligence community. This isn't a red vs blue issue here. It's about whether or not we're going to allow the powerful to pick and choose election winners.
- WarOnPrivacy 6y agoTakeaways: 1) If the NSA interacts with you, you are a victim. It's possible there are no meaningful exceptions to that. 2) The NSA interacts with Americans (not suspected of a crime) as if we were a hostile foreign actor. 3) It is both sound and safe to presume that the IC community has lost it's way. This is true during every administration. It may be somewhat less true, for a time, after a bit of IC wrongdoing is outed. 4) IC chiefs lie to the public to the point where it's unclear if they ever tell a meaningful truth. 5) The National Security portion of NSA's title implies that the interests served by the agency are US Gov's but not the public's. 6) The NSA does not even pretend to defend the Constitution of the United States against all enemies [to the Constitution], foreign and domestic; or to bear true faith and allegiance to the same [Constitution].