10 ms·

I don't think there is anything fishy here, although I don't think the NSA can just install anything on my computer, even if I were based in the US. There is a

I don't think there is anything fishy here, although I don't think the NSA can just install anything on my computer, even if I were based in the US. There is a lot of bluffing when it comes to cyber security. Still it might be quite a useful tool.

NotSwift 5y ago
There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty certain that they know a lot of them. The computers of most people are vulnerable even to normal cyber criminals, the NSA is a lot more powerful.
- inlikealamb 5y ago
  Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?
  - killjoywashere 5y ago
    Most people hear "social engineering" and think of someone playing journalist to get access to places. The NSA's idea of social engineering is having the CIA work with the BND to buy Crypto AG.
    - inlikealamb 5y ago
      how many "former" government employees work at Google?
  - NotSwift 5y ago
    Social engineering can be highly effective. However, from what we know about the NSA, especially from the Snowden leaks, it appears to be mainly a technical agency. It seems likely that the NSA does not use social engineering on a large scale itself but hands it off to other agencies like the CIA or the FBI.
nix23 5y ago
>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.
- raxxorrax 5y ago
  I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities. Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device. And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about industrial espionage.
  - nix23 5y ago
    >From operations that went public Are you talking about Snowden's powerpoint slides or the Shadow Brokers arsenal?
  - atatatat 5y ago
    Wisen up.
  - killjoywashere 5y ago
    You don't even exist to them. The NSA wants to infiltrate nations. They do stuff like hire a friendly foreign nation to quietly buy a security company their target depends on and then exploit that vulnerability from a host in a fourth nation.
  - NotSwift 5y ago
    The NSA is an agency with a yearly budget of approximately 10 billion dollars. There are not many companies that can match that.
- nextlevelwizard 5y ago
  What’s with the doomer mentality. NSA isn’t some magical unicorn that can just walk through everything
o8r3oFTZPE 5y ago
"There is a lot of bluffing when it comes to cyber security." I wish this topic received more discussion.
- nix23 5y ago
  Yes we can talk about that, let's start with the FSB an why they are always so stupid ;) to left the compilation time with the working-hours of moscow and the cyrillic keyboard in the compiled binary.
  - imwillofficial 5y ago
    It’s almost as if it’s not the FSB… but somebody making it look like it was… (See the Vault7 leak attribution masking)
ragona 5y ago
I’m quite sure they could, but mostly just because they could simply walk into your house and tamper with the hardware. You don’t need a fancy zero day when you’re the government.
- klyrs 5y ago
  Funny thing about lockdown/wfh4l... they're really gonna wait a while to get in
  - rytis 5y ago
    Turn up with a bunch of fire engines, and a gas company van. Knock on your door, and 3-4 neighbors on each side, for good measure. Tell there's been a report of a gas leak, and you need everyone to leave their houses/apartments immediately for the inspection. 15-20 mins later - you can come back in, all's safe. Thank you for your cooperation.
user3939382 5y ago
If they could install a virus on Iran's air-gapped uranium centrifuge industrial control systems, I'm pretty sure they could get one on your computer.
- bitsculpt 5y ago
  yeah but I just finished doing a security update /s
- nextlevelwizard 5y ago
  Bribing people in generally corrupt and poor countries to smuggle a USB stick is kind a different than just breaking into random persons home in a country with relatively low corruption. Latter might actually be more difficult. Obviously depends on what your end goal is
  - ozfive 5y ago
    Ever heard of a bump key? It's easy to break into a home in a country with relatively low corruption. One might even say easier. It just comes down to whether you have one person corrupt enough to use it. A locked door is nothing more than a social contract. Door is locked means do not come in. Tell that to the person with a bump key.
  - arthurcolle 5y ago
    Passing an infected USB stick to operators in poorer countries (as you say) is hardly the most impressive part of the deployment procedure.
    - nextlevelwizard 5y ago
      but literally the most important when you need to attack air gapped machine
      - arthurcolle 5y ago
        No, it's not the most important. The most important was clearly obtaining the PLC zero days to infect the physical machines. It's unclear to me why you choose to be so explicitly obtuse but in any case, for your own personal edification, feel free to read some details on how it went down - [0] https://www.wikiwand.com/en/Stuxnet https://www.wikiwand.com/en/Stuxnet [1] https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ [1] https://www.hsdl.org/?view&did=792239 https://www.hsdl.org/?view&did=792239
px43 5y ago
I guarantee that whatever browser you use, they have 0day for it. Whatever ISP you use, they can inject traffic into it, and they have a much easier time about it if you aren't in the US. If you're someone who uses the Internet, the NSA can take over whatever you use to browse with and have their way with it. If you don't, well that's what their interdiction program is for. The thing is though, the economics of 0day indicate that the more you use it, the more likely it is that it'll get burnt, and supply is limited. They can certainly hack anyone, but it doesn't scale, so they can't simply hack everyone. They can maybe use these techniques on a handful of targets per year, so they make it count, but most of their intelligence comes from the data we all give away for free every day.
- zarzavat 5y ago
  Indeed the best protection against getting 0day'd is probably to be into computer security. I feel confident that the NSA is not throwing 0days at computer security professionals; whereas they could use them on the average person with little risk of detection.
dhx 5y ago
I think a lot of people underestimate how hard it would be to build something like Ghidra not from a technical perspective, but from an avoiding big organisation bureaucracy perspective. Unlike a typical bureaucracy however, and amongst other problems[1], the barrier for entry for hiring is extremely high, everything happens within an echo chamber (closed community with little external influence) and paranoia and overbearing security process has a freezing effect on morale and the use of modern workplace practices and technology. Whilst other companies and organisations hire staff quickly who can more freely experiment with the latest technology from a hip coffee shop or their home, someone at an organisation like the NSA after waiting a year to start the job and after having hiked 8km from their car to a windowless and soulless building in the middle of nowhere instead has to fill out dozens of forms and seek dozens of approvals just to consider the idea of experimenting with some new technology. I am amazed something as useful as Ghidra could actually be built within such a large bureaucracy in modern times, and then even more amazed that someone managed to get it released as open source software to ensure it continues to be maintained and useful long after the next internal reorganisation and exodus of developers. [1] https://news.ycombinator.com/item?id=16057449 https://news.ycombinator.com/item?id=16057449
- deleted 5y ago
  [deleted]
karteum 5y ago
The Google Service Framework (which is installed on 99.999% of Android phones) gives a root access to Google on your device, and Google has the power to silently install/uninstall apps...

NotSwift 5y ago

There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty certain that they know a lot of them. The computers of most people are vulnerable even to normal cyber criminals, the NSA is a lot more powerful.

inlikealamb 5y ago
Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?
- killjoywashere 5y ago
  Most people hear "social engineering" and think of someone playing journalist to get access to places. The NSA's idea of social engineering is having the CIA work with the BND to buy Crypto AG.
  - inlikealamb 5y ago
    how many "former" government employees work at Google?
- NotSwift 5y ago
  Social engineering can be highly effective. However, from what we know about the NSA, especially from the Snowden leaks, it appears to be mainly a technical agency. It seems likely that the NSA does not use social engineering on a large scale itself but hands it off to other agencies like the CIA or the FBI.

nix23 5y ago

>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.

raxxorrax 5y ago
I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities. Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device. And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about industrial espionage.
- nix23 5y ago
  >From operations that went public Are you talking about Snowden's powerpoint slides or the Shadow Brokers arsenal?
- atatatat 5y ago
  Wisen up.
- killjoywashere 5y ago
  You don't even exist to them. The NSA wants to infiltrate nations. They do stuff like hire a friendly foreign nation to quietly buy a security company their target depends on and then exploit that vulnerability from a host in a fourth nation.
- NotSwift 5y ago
  The NSA is an agency with a yearly budget of approximately 10 billion dollars. There are not many companies that can match that.
nextlevelwizard 5y ago
What’s with the doomer mentality. NSA isn’t some magical unicorn that can just walk through everything

o8r3oFTZPE 5y ago

"There is a lot of bluffing when it comes to cyber security." I wish this topic received more discussion.

nix23 5y ago
Yes we can talk about that, let's start with the FSB an why they are always so stupid ;) to left the compilation time with the working-hours of moscow and the cyrillic keyboard in the compiled binary.
- imwillofficial 5y ago
  It’s almost as if it’s not the FSB… but somebody making it look like it was… (See the Vault7 leak attribution masking)

ragona 5y ago

I’m quite sure they could, but mostly just because they could simply walk into your house and tamper with the hardware. You don’t need a fancy zero day when you’re the government.

klyrs 5y ago
Funny thing about lockdown/wfh4l... they're really gonna wait a while to get in
- rytis 5y ago
  Turn up with a bunch of fire engines, and a gas company van. Knock on your door, and 3-4 neighbors on each side, for good measure. Tell there's been a report of a gas leak, and you need everyone to leave their houses/apartments immediately for the inspection. 15-20 mins later - you can come back in, all's safe. Thank you for your cooperation.

user3939382 5y ago

If they could install a virus on Iran's air-gapped uranium centrifuge industrial control systems, I'm pretty sure they could get one on your computer.

bitsculpt 5y ago
yeah but I just finished doing a security update /s
nextlevelwizard 5y ago
Bribing people in generally corrupt and poor countries to smuggle a USB stick is kind a different than just breaking into random persons home in a country with relatively low corruption. Latter might actually be more difficult. Obviously depends on what your end goal is
- ozfive 5y ago
  Ever heard of a bump key? It's easy to break into a home in a country with relatively low corruption. One might even say easier. It just comes down to whether you have one person corrupt enough to use it. A locked door is nothing more than a social contract. Door is locked means do not come in. Tell that to the person with a bump key.
- arthurcolle 5y ago
  Passing an infected USB stick to operators in poorer countries (as you say) is hardly the most impressive part of the deployment procedure.
  - nextlevelwizard 5y ago
    but literally the most important when you need to attack air gapped machine
    - arthurcolle 5y ago
      No, it's not the most important. The most important was clearly obtaining the PLC zero days to infect the physical machines. It's unclear to me why you choose to be so explicitly obtuse but in any case, for your own personal edification, feel free to read some details on how it went down - [0] https://www.wikiwand.com/en/Stuxnet https://www.wikiwand.com/en/Stuxnet [1] https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/ [1] https://www.hsdl.org/?view&did=792239 https://www.hsdl.org/?view&did=792239

px43 5y ago

I guarantee that whatever browser you use, they have 0day for it. Whatever ISP you use, they can inject traffic into it, and they have a much easier time about it if you aren't in the US. If you're someone who uses the Internet, the NSA can take over whatever you use to browse with and have their way with it. If you don't, well that's what their interdiction program is for. The thing is though, the economics of 0day indicate that the more you use it, the more likely it is that it'll get burnt, and supply is limited. They can certainly hack anyone, but it doesn't scale, so they can't simply hack everyone. They can maybe use these techniques on a handful of targets per year, so they make it count, but most of their intelligence comes from the data we all give away for free every day.

zarzavat 5y ago
Indeed the best protection against getting 0day'd is probably to be into computer security. I feel confident that the NSA is not throwing 0days at computer security professionals; whereas they could use them on the average person with little risk of detection.

dhx 5y ago

I think a lot of people underestimate how hard it would be to build something like Ghidra not from a technical perspective, but from an avoiding big organisation bureaucracy perspective. Unlike a typical bureaucracy however, and amongst other problems[1], the barrier for entry for hiring is extremely high, everything happens within an echo chamber (closed community with little external influence) and paranoia and overbearing security process has a freezing effect on morale and the use of modern workplace practices and technology. Whilst other companies and organisations hire staff quickly who can more freely experiment with the latest technology from a hip coffee shop or their home, someone at an organisation like the NSA after waiting a year to start the job and after having hiked 8km from their car to a windowless and soulless building in the middle of nowhere instead has to fill out dozens of forms and seek dozens of approvals just to consider the idea of experimenting with some new technology. I am amazed something as useful as Ghidra could actually be built within such a large bureaucracy in modern times, and then even more amazed that someone managed to get it released as open source software to ensure it continues to be maintained and useful long after the next internal reorganisation and exodus of developers. [1] https://news.ycombinator.com/item?id=16057449 https://news.ycombinator.com/item?id=16057449

deleted 5y ago
[deleted]

karteum 5y ago

The Google Service Framework (which is installed on 99.999% of Android phones) gives a root access to Google on your device, and Google has the power to silently install/uninstall apps...