5 ms·

> Members of a hacking group linked to the Chinese government called APT 5 hijacked the NSA algorithm Just wanted to acknowledge how brilliant that is. They co

by rdtsc 5y ago

> Members of a hacking group linked to the Chinese government called APT 5 hijacked the NSA algorithm Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. NSA advocated for that backdoor to be included in the standards. The US government then would be embarrassed and would want to cover up any issues related to it, including the fact that it was taken over by someone else! Gotta wonder what that Monday morning meeting was like at the NSA when they realized what had happened.

SomeBoolshit 5y ago
Probably pretty chill internally. "The thing we knew would happen and that every expert said would happen happened."
- kafkaIncarnate 5y ago
  "It fell within the acceptable matrix risk parameters."
- azemetre 5y ago
  I think you may be surprised, in the NSA they refer to some exploits as NOBUS (nobody but us) where they earnestly believed that only they had the knowledge and capability to find and carry out certain exploits. https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
  - pc86 5y ago
    It seems silly now, especially as the civilian bar for these types of exploits continually lowers, but it's not unreasonable for them to have believed something like this decades ago, especially before widespread computer usage.
  - vmception 5y ago
    The NSA is staffed by non-target candidates that would never get a meeting in Silicon Valley, largely from DC area universities. Although there is no real skills gap between target school graduates and non-targets, this observation also serves the dual purpose of undermining the NSA’s perceived omnipotence.
  - datavirtue 5y ago
    They are happy to turn your security into obscurity for their benefit--everything else be damned.
  - cryptonector 5y ago
    Use of the NSA's private key for the Dual_EC's backdoor would have been NOBUS (unless it were stolen). Changing the Dual_EC backdoor's public key in shipping products would NOT have been NOBUS.
baby 5y ago
There were two backdoors that were discovered at the time btw, the other one was a hardcoded password that could get you in any router (or something like that?) Odds are that there are more that weren't caught.
- JackGreyhat 5y ago
  Correct. Same as Fortinet: https://betanews.com/2016/01/12/fortinet-firewalls-feature-hard-coded-password-that-acts-as-a-backdoor/ https://betanews.com/2016/01/12/fortinet-firewalls-feature-h...
codetrotter 5y ago
> The US government then would be embarrassed and would want to cover up any issues related to it, including the fact that it was taken over by someone else! I feel more like, there’s a chance that by modifying an intentional backdoor it could be that it would go unnoticed because anyone at the NSA looking at it may skip over reviewing closely the part of the code that has the known backdoor in it.
c7DJTLrn 5y ago
When an Agency with the purpose of ensuring the Security of the Nation does the exact opposite... makes you wonder why they even exist.
- zach_garwood 5y ago
  "What would you say you do here?"
- BuyMyBitcoins 5y ago
  Don’t worry though, I’m sure Congress is on the case and will put things back on track! /s
joe_the_user 5y ago
Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. Steal the other guy's stuff is no longer brilliant, it's not even surprising. It shouldn't have been surprising to "brilliant" people advocating back doors back in the day.
mike_d 5y ago
> Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. It is much more plausible that US companies didn't want to name and shame their biggest customer than the Chinese reverse engineering a cryptographic backdoor. This could have been supported by the general NSA/GCHQ efforts to ensure their activies are mis-attributed. The "it was China" determination was made by Mandiant, a company that receives over half its revenue from the US government (per the 2014 FireEye M&A call). Heck, Microsoft (Longhorn), SecureWorks (Platinum Colony), and Google (GOSSIPGIRL) are the only US companies that have even publicly assigned names to track US linked APT groups.
- dmos62 5y ago
  > Heck, Microsoft (Longhorn), SecureWorks (Platinum Colony), and Google (GOSSIPGIRL) are the only US companies that have even publicly assigned names to track US linked APT groups. I didn't understand this statement, but it's intrigued me. What are the names for and how do they lead to tracking US-linked APT (advanced, persistent threat a.k.a state sponsored) groups and who's doing the tracking?
  - mike_d 5y ago
    The original idea was to assign a name to a unique set of techniques and tools. That way you can collaborate with other organizations and have a common language to describe attackers. Many companies decided to start using their own naming schemes to avoid giving free marketing to the first company to name a group, so you have to do a bit of work to know that all the names I mentioned in my previous post refer to the same group. CrowdStrike has a naming scheme that includes implied classes for specific countries of origin. For example you may have heard of "FANCY BEAR" which is part of the BEAR family but different from the "COZY BEAR" group. Everyone in the industry knows FANCY BEAR is the Russian GRU and COZY BEAR is Russian SVR, but by using the code names nobody has to come out and say it publicly (or face the consequences of being wrong). The three companies I named are the only US based ones I know of that have publicly assigned named to US based threat actors. Kaspersky Antivirus (a Russian company) calls them the "Equation Group" due to their love of complex encryption, and the Hungarian government calls them "Tilded Team." If you ask Mandiant or CrowdStrike - they don't exist.

by rdtsc 5y ago

SomeBoolshit 5y ago

Probably pretty chill internally. "The thing we knew would happen and that every expert said would happen happened."

kafkaIncarnate 5y ago
"It fell within the acceptable matrix risk parameters."
azemetre 5y ago
I think you may be surprised, in the NSA they refer to some exploits as NOBUS (nobody but us) where they earnestly believed that only they had the knowledge and capability to find and carry out certain exploits. https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
- pc86 5y ago
  It seems silly now, especially as the civilian bar for these types of exploits continually lowers, but it's not unreasonable for them to have believed something like this decades ago, especially before widespread computer usage.
- vmception 5y ago
  The NSA is staffed by non-target candidates that would never get a meeting in Silicon Valley, largely from DC area universities. Although there is no real skills gap between target school graduates and non-targets, this observation also serves the dual purpose of undermining the NSA’s perceived omnipotence.
- datavirtue 5y ago
  They are happy to turn your security into obscurity for their benefit--everything else be damned.
- cryptonector 5y ago
  Use of the NSA's private key for the Dual_EC's backdoor would have been NOBUS (unless it were stolen). Changing the Dual_EC backdoor's public key in shipping products would NOT have been NOBUS.

baby 5y ago

There were two backdoors that were discovered at the time btw, the other one was a hardcoded password that could get you in any router (or something like that?) Odds are that there are more that weren't caught.

JackGreyhat 5y ago
Correct. Same as Fortinet: https://betanews.com/2016/01/12/fortinet-firewalls-feature-hard-coded-password-that-acts-as-a-backdoor/ https://betanews.com/2016/01/12/fortinet-firewalls-feature-h...

codetrotter 5y ago

> The US government then would be embarrassed and would want to cover up any issues related to it, including the fact that it was taken over by someone else! I feel more like, there’s a chance that by modifying an intentional backdoor it could be that it would go unnoticed because anyone at the NSA looking at it may skip over reviewing closely the part of the code that has the known backdoor in it.

c7DJTLrn 5y ago

When an Agency with the purpose of ensuring the Security of the Nation does the exact opposite... makes you wonder why they even exist.

zach_garwood 5y ago
"What would you say you do here?"
BuyMyBitcoins 5y ago
Don’t worry though, I’m sure Congress is on the case and will put things back on track! /s

joe_the_user 5y ago

Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. Steal the other guy's stuff is no longer brilliant, it's not even surprising. It shouldn't have been surprising to "brilliant" people advocating back doors back in the day.

mike_d 5y ago

> Just wanted to acknowledge how brilliant that is. They could have made any other code change, but it was genius using NSA's own backdoor. It is much more plausible that US companies didn't want to name and shame their biggest customer than the Chinese reverse engineering a cryptographic backdoor. This could have been supported by the general NSA/GCHQ efforts to ensure their activies are mis-attributed. The "it was China" determination was made by Mandiant, a company that receives over half its revenue from the US government (per the 2014 FireEye M&A call). Heck, Microsoft (Longhorn), SecureWorks (Platinum Colony), and Google (GOSSIPGIRL) are the only US companies that have even publicly assigned names to track US linked APT groups.

dmos62 5y ago
> Heck, Microsoft (Longhorn), SecureWorks (Platinum Colony), and Google (GOSSIPGIRL) are the only US companies that have even publicly assigned names to track US linked APT groups. I didn't understand this statement, but it's intrigued me. What are the names for and how do they lead to tracking US-linked APT (advanced, persistent threat a.k.a state sponsored) groups and who's doing the tracking?
- mike_d 5y ago
  The original idea was to assign a name to a unique set of techniques and tools. That way you can collaborate with other organizations and have a common language to describe attackers. Many companies decided to start using their own naming schemes to avoid giving free marketing to the first company to name a group, so you have to do a bit of work to know that all the names I mentioned in my previous post refer to the same group. CrowdStrike has a naming scheme that includes implied classes for specific countries of origin. For example you may have heard of "FANCY BEAR" which is part of the BEAR family but different from the "COZY BEAR" group. Everyone in the industry knows FANCY BEAR is the Russian GRU and COZY BEAR is Russian SVR, but by using the code names nobody has to come out and say it publicly (or face the consequences of being wrong). The three companies I named are the only US based ones I know of that have publicly assigned named to US based threat actors. Kaspersky Antivirus (a Russian company) calls them the "Equation Group" due to their love of complex encryption, and the Hungarian government calls them "Tilded Team." If you ask Mandiant or CrowdStrike - they don't exist.