6 ms·

I've started it and a few pages in I would largely agree with this review, it's very America-centric. You have to simultaneously believe that the NSA are the be

I've started it and a few pages in I would largely agree with this review, it's very America-centric. You have to simultaneously believe that the NSA are the best in the world, and that foreign hackers despite being nowhere near as smart managed to steal all their hacking tools, and it's lucky for them that they did otherwise they would have no chance against the NSA because they are the BEST! USA! USA! If it doesn't get better than that pretty quickly I'm unlikely to finish it.

ConnorLeet 6y ago
Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it?
- goatinaboat 6y ago
  Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it? No one knows who the Shadow Brokers are, unless that’s covered later in the book.
  - IggleSniggle 6y ago
    No one knows! I thought this was a compelling theory that I haven't seen mentioned elsewhere: https://threadreaderapp.com/thread/1224880979258441729.html https://threadreaderapp.com/thread/1224880979258441729.html
tptacek 6y ago
I listened to a discussion with Perlroth on a podcast where she said things that implied strongly that exploits, in general, writ large, were leaked NSA tradecraft. I don't have even 1/5th the skin in this game Halvar does, and I found it offensive enough to yell out loud in my car, just at the implication. In reality I think it's kind of an embarrassment how much CNE technology goes the other way, from industry and research to the IC. Not for moral reasons (though: I would have ethical problems selling bugs to attackers of any sort and am thankful I don't produce the kinds of bugs that have this market) so much as "it's not that hard to do this work and we should be getting more for our tax dollars".
ForHackernews 6y ago
I don't know if the NSA are the best in the world, but they're probably among the best-funded in the world. Stuxnet is close to a work of art; the degree of effort involved in hiding self-reinstalling malware inside hard-drive firmware is staggering.[0] Anyone who's ever tried to write Linux drivers for undocumented hardware can appreciate how insane it is that they managed to do it for a dozen different hard drive manufacturers. [0] https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-firmware-virus-stuxnet https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-fi...
- secfirstmd 6y ago
  Let's not forget. Stuxnet is 15ish years old also.
- moyix 6y ago
  Keep in mind that a motivated academic research team was able to write a hard drive firmware implant on their own as well: https://www.impeachdonaldtrump.net/Implementation.and.Implications.of.a.Stealth.Hard-Drive.Backdoor.pdf https://www.impeachdonaldtrump.net/Implementation.and.Implic... But yes, making it work for a bunch of manufacturers would be a lot of additional work (though easier if you can obtain the data sheets for the embedded microcontroller, which is probably doable if you're the NSA). Side note: don't blame me for the URL, it was just the first place I found that had a PDF of the paper.
cambalache 6y ago
Americans are quite insular so not really knowledgeable about the "outside" world. Maybe because the country is so big and important, maybe because arrogance or intellectual laziness. I would never forget this fragment from a class on El Quijote at Yale. "So what is spoken in the Bronx, Mexico City and Madrid? Castilian, which is Spanish, is what’s spoken, it’s spoken in those places. So you can erase that American prejudice from your mind if you ever had it. It is true — I mean, I had a colleague at Cornell, a very distinguished American medievalist who would ask me, “In what language do you write your scholarship, Roberto?” I said, “What do you mean? In English and Spanish.” He was worried that if I didn’t write in English being in Latin America, I didn’t have a language of culture in which I could write, because he didn’t think that in Latin America we had a language of culture. It is an American prejudice." https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture-1 https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture...
no-dr-onboard 6y ago
My organization was part of the author's book tour, we had a webinar with her earlier this year as she provided the book to the entire company. A couple of takeaways: - Author believes (or is at least attempting to make others believe that she believes) that the NSA is benevolent and not committed to any specific domestic program - Author frequently stated that 0-day purchasing platforms should not exist as it is a matter of opaque moral policy. - Author frequently states that contractors like Immunity are problematic because they sell tradecraft to "bad nations" for profit. - Worth noting that the author is also a NYT contributor and clings to a lot of those same notions. The overall sentiment of the author after her webinar was that she was egotistically confined to believing in US supremacy and very much in the midst of an ideological war against competing beliefs. Probably not going to get far in her book either in light of that webinar.

ConnorLeet 6y ago

Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it?

goatinaboat 6y ago
Wasn't the NSA tool leak due to an ex-NSA contractor intentionally leaking it? No one knows who the Shadow Brokers are, unless that’s covered later in the book.
- IggleSniggle 6y ago
  No one knows! I thought this was a compelling theory that I haven't seen mentioned elsewhere: https://threadreaderapp.com/thread/1224880979258441729.html https://threadreaderapp.com/thread/1224880979258441729.html

tptacek 6y ago

I listened to a discussion with Perlroth on a podcast where she said things that implied strongly that exploits, in general, writ large, were leaked NSA tradecraft. I don't have even 1/5th the skin in this game Halvar does, and I found it offensive enough to yell out loud in my car, just at the implication. In reality I think it's kind of an embarrassment how much CNE technology goes the other way, from industry and research to the IC. Not for moral reasons (though: I would have ethical problems selling bugs to attackers of any sort and am thankful I don't produce the kinds of bugs that have this market) so much as "it's not that hard to do this work and we should be getting more for our tax dollars".

ForHackernews 6y ago

I don't know if the NSA are the best in the world, but they're probably among the best-funded in the world. Stuxnet is close to a work of art; the degree of effort involved in hiding self-reinstalling malware inside hard-drive firmware is staggering.[0] Anyone who's ever tried to write Linux drivers for undocumented hardware can appreciate how insane it is that they managed to do it for a dozen different hard drive manufacturers. [0] https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-firmware-virus-stuxnet https://www.theverge.com/2015/2/16/8048243/nsa-hard-drive-fi...

secfirstmd 6y ago
Let's not forget. Stuxnet is 15ish years old also.
moyix 6y ago
Keep in mind that a motivated academic research team was able to write a hard drive firmware implant on their own as well: https://www.impeachdonaldtrump.net/Implementation.and.Implications.of.a.Stealth.Hard-Drive.Backdoor.pdf https://www.impeachdonaldtrump.net/Implementation.and.Implic... But yes, making it work for a bunch of manufacturers would be a lot of additional work (though easier if you can obtain the data sheets for the embedded microcontroller, which is probably doable if you're the NSA). Side note: don't blame me for the URL, it was just the first place I found that had a PDF of the paper.

cambalache 6y ago

Americans are quite insular so not really knowledgeable about the "outside" world. Maybe because the country is so big and important, maybe because arrogance or intellectual laziness. I would never forget this fragment from a class on El Quijote at Yale. "So what is spoken in the Bronx, Mexico City and Madrid? Castilian, which is Spanish, is what’s spoken, it’s spoken in those places. So you can erase that American prejudice from your mind if you ever had it. It is true — I mean, I had a colleague at Cornell, a very distinguished American medievalist who would ask me, “In what language do you write your scholarship, Roberto?” I said, “What do you mean? In English and Spanish.” He was worried that if I didn’t write in English being in Latin America, I didn’t have a language of culture in which I could write, because he didn’t think that in Latin America we had a language of culture. It is an American prejudice." https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture-1 https://oyc.yale.edu/spanish-and-portuguese/span-300/lecture...

no-dr-onboard 6y ago

My organization was part of the author's book tour, we had a webinar with her earlier this year as she provided the book to the entire company. A couple of takeaways: - Author believes (or is at least attempting to make others believe that she believes) that the NSA is benevolent and not committed to any specific domestic program - Author frequently stated that 0-day purchasing platforms should not exist as it is a matter of opaque moral policy. - Author frequently states that contractors like Immunity are problematic because they sell tradecraft to "bad nations" for profit. - Worth noting that the author is also a NYT contributor and clings to a lot of those same notions. The overall sentiment of the author after her webinar was that she was egotistically confined to believing in US supremacy and very much in the midst of an ideological war against competing beliefs. Probably not going to get far in her book either in light of that webinar.