13 ms·

I fully understand that the operation is classified and details cannot be revealed, but I have to say: the description of the technical details is still a bad H

I fully understand that the operation is classified and details cannot be revealed, but I have to say: the description of the technical details is still a bad Hollywood movie [0]... > After that, the momentum started to build. One team would take screenshots to gather intelligence for later; another would lock ISIS videographers out of their own accounts. > "Reset Successful" one screen would say. > "Folder directory deleted," said another. Folder directory??? Did they also delete the "file document"? > The screens they were seeing on the Ops floor on the NSA campus were the same ones someone in Syria might have been looking at in real time, until someone in Syria hit refresh. Once he did that, he would see: 404 error: Destination unreadable. 404 error: Destination unreadable??? At least, use "unreachable"... > "Target 5 is done," someone would yell. > Someone else would walk across the room and cross the number off the big target sheet on the wall. "We're crossing names off the list. We're crossing accounts off the list. We're crossing IPs off the list," said Neil. And every time a number went down they would yell one word: "Jackpot!" [0] TV Tropes: Hollywood Hacking is when some sort of convoluted metaphor is used not only to describe hacking, but actually to put it into practice. Characters will come up with rubbish like, "Extinguish the firewall!" and "I'll use the Millennium Bug to launch an Overclocking Attack on the whole Internet!" https://tvtropes.org/pmwiki/pmwiki.php/Main/HollywoodHacking https://tvtropes.org/pmwiki/pmwiki.php/Main/HollywoodHacking

giancarlostoro 6y ago
It is very possible they are using utilities to pull this off developed by someone else. They may have training for the utilities they have but that doesnt make them IT experts.
the_af 6y ago
Agreed. The whole article reads like a mix of Hollywood Hacking and a puff piece. Very likely something happened, but it almost certainly wasn't like this.
- acqq 6y ago
  The article is different from what was aired, which appears to me to be more interesting, as it starts with: "On August 24, 2015, a 21-year-old British hacker named TriCk stepped out of an Internet cafe in Raqqa, Syria, and climbed into his car. He didn't know it, but he'd been under surveillance for days. He pulled into a gas station, and just as he started filling the tank, a single Hellfire missile came down on him like a meteor from the sky. He was killed instantly." And it seems to be longer too. https://www.npr.org/transcripts/763545811 https://www.npr.org/transcripts/763545811 They also later identify the "British hacker's" name: Junaid Hussain. A report from Britain, 2015, claims it wasn't an operation done by the U.S. alone: https://www.birminghammail.co.uk/news/midlands-news/isis-terrorist-junaid-hussain-killed-10069425 https://www.birminghammail.co.uk/news/midlands-news/isis-ter...
  - 082349872349872 6y ago
    https://xkcd.com/538/ https://xkcd.com/538/ with a USD 70k wrench? (even at that price, and including delivery, those wrenches sound much cheaper than Operation Glowing Symphony as described, involving headcount from at least three eyes) Kipling on empire, in Her Majesty's Servants (a story addressed to children but not necessarily intended for them): > "But are the beasts as wise as the men?" said the chief. > "They obey, as the men do. Mule, horse, elephant, or bullock, he obeys his driver, and the driver his sergeant, and the sergeant his lieutenant, and the lieutenant his captain, and the captain his major, and the major his colonel, and the colonel his brigadier commanding three regiments, and the brigadier his general, who obeys the Viceroy, who is the servant of the Empress. Thus it is done." > "Would it were so in Afghanistan!" said the chief; "for there we obey only our own wills." > "And for that reason," said the native officer, twirling his moustache, "your Amir whom you do not obey must come here and take orders from our Viceroy."
    - acqq 6y ago
      Returning to the topic and 2020, from the transcript of the 50-minute show I've mentioned: "Nakasone said the American people shouldn't worry about the 2020 elections because Cybercom is prepared to prevent the Russians from repeating what they did in 2016." "TEMPLE-RASTON: Even saying that much is new. Remember - offensive cyber not so long ago was something they didn't talk about, and now, all of a sudden, they seem to be. So why is General Nakasone talking about this now? DEIBERT: What's happening here is part of a deterrent justification." Then they give an explanation of this using some lines from Dr. Strangelove. By the way, the show was "written and hosted by Dina Temple-Raston," who also wrote the article, and I liked the show. ----- Edit: responding to "deterrent could easily be communicated privately" below: -- no, that's too narrow thinking: consider the potential target as "anybody who'd be willing to try it at home." That's a much bigger target group than potential workers. Also consider every "it" that people would be potentially scared to do. Edit2: re. the edit of the post below involving joke with the submarines -- I fail to see any relation to anything discussed here, and I'd also like to know if anybody but the writer even understands what the joke is. I honestly don't. Meh. Edit3: re "MAD": Like I've said I don't believe it's about MAD, but "anybody who'd be willing to try it at home." Anybody in front of the computer anywhere in the world, including, but not exclusively, some future "Junaid Hussain." (and, if I'm closer to the correct answer, Cybercom can give me 10 upvotes here). Edit4: I think I understand it now after it's added that the "joke meant to illustrate MAD" -- I guess he didn't follow the link, but reacted to "Dr. Strangelove" reference believing it's about MAD, even if it never was. As per transcript, it's there to argue: "if you keep it a secret [i.e. American offensive cyber operations] - you could say the same thing about American offensive cyber operations. They've been so stealthy for so long, maybe people don't realize the U.S. has them." Note "people." As is, people wouldn't be scared to do something the U.S. doesn't like, instead of thinking who'd be the target of next U.S. drone attack.
sillysaurusx 6y ago
Ok, I'll tell you how it goes in the real world. I worked for a somewhat HN-famous pentesting company several years ago. "So, X has been infiltrating <company> for the past few days." "Really? <company>? <famous company>?" "Yep. We're keeping them looped in on everything, and they told us to try to get as far as possible. Apparently they were running <outdated version> of <software> on one of their boxes, and <scanner> picked it up." "That actually happens?" "He's <highly surprising claim> right now. You'd be surprised how far you can get, jumping from one box to another." I can't give much more detail than that, for obvious reasons, but the reality is that it's very methodical, very "boring" work. It's basically a giant matrix of probabilities: there are hundreds of thousands of attack vectors, and your job is to tap as many as possible, sorted by probability of effectiveness, until something sticks. Then use your head to get further, adapting to the situation on the fly. And ... writing reports. Jesus, if someone had told me that 70% of your day would be spent writing reports, I probably wouldn't have joined. But the 30% of other stuff made up for it. That feeling you get when you break into somewhere you're not supposed to be, and that you were paid to do it, is amazing. The rules change from engagement to engagement, but usually it's "do whatever you want, but don't modify any data, i.e. no destructive actions, and all info you've collected will be deleted at the end of the engagement." Must be interesting to be a spook in the NSA doing that kind of stuff offensively. Also, it might seem absurd that I'm comparing this story to the most elite hackers in the developed world. And maybe it is. But if you knew which <company> it was, and exactly what <highly surprising claim> was, you'd be shocked that one or two smart developers poking at internals were able to compromise the entire corporate network of <famous company>, to the point of being able to... well. Let's just say, I wish I could say. It's a weird feeling, seeing it with my own eyes, knowing it's true, and never being able to talk fully about it. :) So I imagine the NSA spooks are doing similarlly-methodical work, with some cheat codes like "we intercepted their computer before delivery and installed a backdoor that only activates when we send a specially malformed packet that would normally be dropped and is therefore invisible, which grants us access as needed."
- 082349872349872 6y ago
  If the cheat codes were along the lines of "as long as they're using anyone's routers but Huawei's" they would not even require interception and customisation.
bryanrasmussen 6y ago
> "Folder directory deleted," said another. maybe they're dealing with the kind of people who name their folders "directory"
- rebuilder 6y ago
  Or the truly perverse kind who name their directories "Folder"
culturestate 6y ago
> Folder directory??? Did they also delete the "file document"? I obviously don't know how accurate this piece is but a "folder directory" is, or at least used to be, a legit way to describe a folder full of folders. You'll see outdated/unorthodox terminology like this all the time in old systems, and even some newer ones that were built or maintained by people who aren't native English speakers. Daily WTF used to be filled with this kind of stuff.
- segfaultbuserr 6y ago
  > a "folder directory" is, or at least used to be, a legit way to describe a folder full of folders. Thanks, that's interesting.
EmilioMartinez 6y ago
They did do one healthy clarification to that effect: >And what they contained weren't glowing lines of code: Instead, Neil could see login screens.

giancarlostoro 6y ago

It is very possible they are using utilities to pull this off developed by someone else. They may have training for the utilities they have but that doesnt make them IT experts.

the_af 6y ago

Agreed. The whole article reads like a mix of Hollywood Hacking and a puff piece. Very likely something happened, but it almost certainly wasn't like this.

acqq 6y ago
The article is different from what was aired, which appears to me to be more interesting, as it starts with: "On August 24, 2015, a 21-year-old British hacker named TriCk stepped out of an Internet cafe in Raqqa, Syria, and climbed into his car. He didn't know it, but he'd been under surveillance for days. He pulled into a gas station, and just as he started filling the tank, a single Hellfire missile came down on him like a meteor from the sky. He was killed instantly." And it seems to be longer too. https://www.npr.org/transcripts/763545811 https://www.npr.org/transcripts/763545811 They also later identify the "British hacker's" name: Junaid Hussain. A report from Britain, 2015, claims it wasn't an operation done by the U.S. alone: https://www.birminghammail.co.uk/news/midlands-news/isis-terrorist-junaid-hussain-killed-10069425 https://www.birminghammail.co.uk/news/midlands-news/isis-ter...
- 082349872349872 6y ago
  https://xkcd.com/538/ https://xkcd.com/538/ with a USD 70k wrench? (even at that price, and including delivery, those wrenches sound much cheaper than Operation Glowing Symphony as described, involving headcount from at least three eyes) Kipling on empire, in Her Majesty's Servants (a story addressed to children but not necessarily intended for them): > "But are the beasts as wise as the men?" said the chief. > "They obey, as the men do. Mule, horse, elephant, or bullock, he obeys his driver, and the driver his sergeant, and the sergeant his lieutenant, and the lieutenant his captain, and the captain his major, and the major his colonel, and the colonel his brigadier commanding three regiments, and the brigadier his general, who obeys the Viceroy, who is the servant of the Empress. Thus it is done." > "Would it were so in Afghanistan!" said the chief; "for there we obey only our own wills." > "And for that reason," said the native officer, twirling his moustache, "your Amir whom you do not obey must come here and take orders from our Viceroy."
  - acqq 6y ago
    Returning to the topic and 2020, from the transcript of the 50-minute show I've mentioned: "Nakasone said the American people shouldn't worry about the 2020 elections because Cybercom is prepared to prevent the Russians from repeating what they did in 2016." "TEMPLE-RASTON: Even saying that much is new. Remember - offensive cyber not so long ago was something they didn't talk about, and now, all of a sudden, they seem to be. So why is General Nakasone talking about this now? DEIBERT: What's happening here is part of a deterrent justification." Then they give an explanation of this using some lines from Dr. Strangelove. By the way, the show was "written and hosted by Dina Temple-Raston," who also wrote the article, and I liked the show. ----- Edit: responding to "deterrent could easily be communicated privately" below: -- no, that's too narrow thinking: consider the potential target as "anybody who'd be willing to try it at home." That's a much bigger target group than potential workers. Also consider every "it" that people would be potentially scared to do. Edit2: re. the edit of the post below involving joke with the submarines -- I fail to see any relation to anything discussed here, and I'd also like to know if anybody but the writer even understands what the joke is. I honestly don't. Meh. Edit3: re "MAD": Like I've said I don't believe it's about MAD, but "anybody who'd be willing to try it at home." Anybody in front of the computer anywhere in the world, including, but not exclusively, some future "Junaid Hussain." (and, if I'm closer to the correct answer, Cybercom can give me 10 upvotes here). Edit4: I think I understand it now after it's added that the "joke meant to illustrate MAD" -- I guess he didn't follow the link, but reacted to "Dr. Strangelove" reference believing it's about MAD, even if it never was. As per transcript, it's there to argue: "if you keep it a secret [i.e. American offensive cyber operations] - you could say the same thing about American offensive cyber operations. They've been so stealthy for so long, maybe people don't realize the U.S. has them." Note "people." As is, people wouldn't be scared to do something the U.S. doesn't like, instead of thinking who'd be the target of next U.S. drone attack.

sillysaurusx 6y ago

Ok, I'll tell you how it goes in the real world. I worked for a somewhat HN-famous pentesting company several years ago. "So, X has been infiltrating <company> for the past few days." "Really? <company>? <famous company>?" "Yep. We're keeping them looped in on everything, and they told us to try to get as far as possible. Apparently they were running <outdated version> of <software> on one of their boxes, and <scanner> picked it up." "That actually happens?" "He's <highly surprising claim> right now. You'd be surprised how far you can get, jumping from one box to another." I can't give much more detail than that, for obvious reasons, but the reality is that it's very methodical, very "boring" work. It's basically a giant matrix of probabilities: there are hundreds of thousands of attack vectors, and your job is to tap as many as possible, sorted by probability of effectiveness, until something sticks. Then use your head to get further, adapting to the situation on the fly. And ... writing reports. Jesus, if someone had told me that 70% of your day would be spent writing reports, I probably wouldn't have joined. But the 30% of other stuff made up for it. That feeling you get when you break into somewhere you're not supposed to be, and that you were paid to do it, is amazing. The rules change from engagement to engagement, but usually it's "do whatever you want, but don't modify any data, i.e. no destructive actions, and all info you've collected will be deleted at the end of the engagement." Must be interesting to be a spook in the NSA doing that kind of stuff offensively. Also, it might seem absurd that I'm comparing this story to the most elite hackers in the developed world. And maybe it is. But if you knew which <company> it was, and exactly what <highly surprising claim> was, you'd be shocked that one or two smart developers poking at internals were able to compromise the entire corporate network of <famous company>, to the point of being able to... well. Let's just say, I wish I could say. It's a weird feeling, seeing it with my own eyes, knowing it's true, and never being able to talk fully about it. :) So I imagine the NSA spooks are doing similarlly-methodical work, with some cheat codes like "we intercepted their computer before delivery and installed a backdoor that only activates when we send a specially malformed packet that would normally be dropped and is therefore invisible, which grants us access as needed."

082349872349872 6y ago
If the cheat codes were along the lines of "as long as they're using anyone's routers but Huawei's" they would not even require interception and customisation.

bryanrasmussen 6y ago

> "Folder directory deleted," said another. maybe they're dealing with the kind of people who name their folders "directory"

rebuilder 6y ago
Or the truly perverse kind who name their directories "Folder"

culturestate 6y ago

> Folder directory??? Did they also delete the "file document"? I obviously don't know how accurate this piece is but a "folder directory" is, or at least used to be, a legit way to describe a folder full of folders. You'll see outdated/unorthodox terminology like this all the time in old systems, and even some newer ones that were built or maintained by people who aren't native English speakers. Daily WTF used to be filled with this kind of stuff.

segfaultbuserr 6y ago
> a "folder directory" is, or at least used to be, a legit way to describe a folder full of folders. Thanks, that's interesting.

EmilioMartinez 6y ago

They did do one healthy clarification to that effect: >And what they contained weren't glowing lines of code: Instead, Neil could see login screens.