10 ms·

Ex-NSA cyberspies reveal how they helped hack foes of UAE (2019)

194 points by jbegley 5y ago

chrononaut 5y ago
(2019)
- mikeyouse 5y ago
  In the news today since they were just charged with a bunch of Federal crimes for this work: https://www.reuters.com/world/us/american-hacker-mercenaries-face-us-charges-work-uae-2021-09-14/ https://www.reuters.com/world/us/american-hacker-mercenaries...
  - sterlind 5y ago
    > Former program operatives previously told Reuters they believed they were following the law because superiors promised them the U.S. government had approved the work. Absolute horseshit. This is 100% a loophole to give them some flimsy plausible deniability. If the NSA approves they should have confirmed with the actual NSA. Looks like the whistleblower wasn't charged, which is good, though you still have to be a pretty shitty person to go work on targeting journalists and dissidents in the first place. I suspect she didn't have moral qualms as much as she realized how much trouble she'd get in unless she came clean. I'm interested to learn how exactly any of this is legal. Isn't it illegal for Americans to hack anyone, regardless of where you live? Like could I really go to Russia and openly hack Ukraine as an American and not get charged when I come back to the US?
    - sophacles 5y ago
      Are you seriously gatekeeping the whistleblower? Like they did the right thing, but you can maybe imagine they weren't pure enough for you and therefore shitty? OK let me do that to you: You are commenting some good things, but i suspect you aren't doing it because you believe it, but rather you want some sweet karma. Therefore you are shitty human being. Feel shame person I've never interacted with before and have no other knowledge of. (Maybe check out the Darknet Diaries episode linked in the comments here and learn about the situation a bit before declaring the motives of a person you admit having no knowledge of.)
  - themodelplumber 5y ago
    > The defendants are being charged also with military export restriction violations. They are throwing the book at them. But there's also this other, amusing, cachet-related viewpoint: "I'm so badass that I was labeled a restricted military asset"...
  - deleted 5y ago
    [deleted]
anonymousDan 5y ago
So hacking human rights activists is ok, but hacking US citizens crosses the line? WTF?
- aha_throwaway 5y ago
  It's always like that. The last days in Afghan they kill 10 people, and no one hell accountable. All they do is labeled them as ISIS members. (https://www.nytimes.com/2021/09/10/world/asia/us-air-strike-drone-kabul-afghanistan-isis.html https://www.nytimes.com/2021/09/10/world/asia/us-air-strike-...)
  - 2OEH8eoCRo0 5y ago
    What would you like to be done about it?
    - hellcow 5y ago
      Tried as a war crime, perhaps? Murdering an aid worker and seven children, then trying to cover it up, seems pretty horrific to me.
      - 2OEH8eoCRo0 5y ago
        Who specifically should be tried?
        Taniwha 5y ago
        Let's start with the person who pushed without verifying that the targets were truly ISIS and work our way upwards
        2OEH8eoCRo0 5y ago
        What does that mean? The person who pulled the trigger to release the Hellfire from the drone?
deleted 5y ago
[deleted]
ragnot 5y ago
How do all these people hack into phones all the time? Is there just a cache of 0Days that they have access to or do they just get really clever with phishing attacks?
- sleibrock 5y ago
  According to the article, it seems like it was heavily based off of Apple iMessage zero-click exploits built into some platform. And even a bit of social engineering. Past that, who knows where they get exploits from? I imagine if they're renting servers with Bitcoins to perform computer attacks, these operatives are probably familiar with darknet sites for trading secrets as well.
- gonzo41 5y ago
  Pretty much, that also have 0 days on components, so it's a matter of putting together an exploit chain that gets them what they need.
  - AgentME 5y ago
    If software developers were ever held responsible for defects in their software that lead to breaches of privacy and harm caused through those breaches, I wonder how quickly software development practices would change. Memory unsafe languages like C would probably disappear as a choice for new projects in a heartbeat due to the liability.
- mike_d 5y ago
  Money. The going rate for iOS full chain (iMessage, Safari, or BT/WiFi exploit + sandbox escape, protection bypass, and persistence) is over two million dollars. The brokers then sell them for 2x-5x that amount. Reporting that same vulnerability to Apple can net you up to a million.
  - SilverRed 5y ago
    It seems pretty clear that just about every government has a large bank of exploits on just about every single system. We only hear about the ones that get exposed and fixed and not the 30 others in storage or active use.
JimBlackwood 5y ago
For those interested, there is a Darknet Diaries episode about this. [1] Really quite interesting, interview is with someone who worked for Project Raven, like Lori. [1] https://darknetdiaries.com/episode/47/ https://darknetdiaries.com/episode/47/
perihelions 5y ago
Follow-up, from today's news: "Three Former U.S. Intelligence Community and Military Personnel Agree to Pay More Than $1.68 Million to Resolve Criminal Charges Arising from Their Provision of Hacking-Related Services to a Foreign Government" https://www.justice.gov/opa/pr/three-former-us-intelligence-community-and-military-personnel-agree-pay-more-168-million https://www.justice.gov/opa/pr/three-former-us-intelligence-...
unyttigfjelltol 5y ago
The subject of the article hired Snowden into an NSA project just before he fled as a whistleblower, tried to resurrect her career for a private company doing espionage overseas, and after a few years ultimately made good by becoming a whistleblower herself against her spybosses. What a fantastic story arc! Hollywood....
- quxpar 5y ago
  And I thought I was failing up!
wolverine876 5y ago
Stroud's judgment is interesting; is the mistake predictable? > In 2013, her world changed. While stationed at NSA Hawaii, Stroud says, she made the fateful recommendation to bring a Dell technician already working in the building onto her team. That contractor was Edward Snowden. / “He’s former CIA, he’s local, he’s already cleared,” Stroud, 37, recalled. “He’s perfect!” Booz and the NSA would later approve Snowden’s transfer, providing him with even greater access to classified material. Then Stroud trusted the Project Raven employers, not only to start but over and over, as they had Stroud violate human rights (spying on journalists, 16 year olds, human rights activists), after Stroud discovered evidence of spying on Americans. And then Stroud didn't trust the FBI; note that the claimed motivation could simply fabricated - clearly Stroud wanted to do this work. > Two agents approached Stroud in 2016 at Virginia’s Dulles airport as she was returning to the UAE after a trip home. Stroud, afraid she might be under surveillance by the UAE herself, said she brushed off the FBI investigators. “I’m not telling you guys jack,” she recounted. And possibly this is related: > Still, she found the work exhilarating. “It was incredible because there weren’t these limitations like there was at the NSA. There wasn’t that bullshit red tape,” she said. “I feel like we did a lot of good work on counterterrorism.” Maybe those rules, the principles of human rights, and the FBI are there for a reason. Stroud seems to think they are unrelated to her character: > “I don’t think Americans should be doing this to other Americans,” she told Reuters. “I’m a spy, I get that. I’m an intelligence officer, but I’m not a bad one.” > Stroud said her background as an intelligence operative made her comfortable with human rights targets as long as they weren’t Americans. “We’re working on behalf of this country’s government, and they have specific intelligence objectives which differ from the U.S., and understandably so,” Stroud said. “You live with it.”
- retox 5y ago
  "Stroud said her background as an intelligence operative made her comfortable with human rights targets " should read "Stroud said her background as an intelligence operative made her comfortable with human rights _violations_"
tclancy 5y ago
Every once in a while, my brain asks a good question. https://www.state.gov/reports/country-reports-on-terrorism-2019/united-arab-emirates/ https://www.state.gov/reports/country-reports-on-terrorism-2... “ 2019 Terrorist Incidents: There were no terrorist attacks reported in the UAE in 2019.” Either they were extraordinarily good at their job or their job was bullshit. IBM Presents You Make the Call.
- baybal2 5y ago
  Maybe they don't paint a giant target on their forehead? Maybe that's the key?
  - tclancy 5y ago
    Yes, surely that’s the key. We are all being kept safe by these wonderful demigods who trade out human agency for safety. Feel good yet?
- kjaftaedi 5y ago
  Why would there be terrorist attacks in the UAE? There aren't even political parties in monarchies making political action more difficult, not to mention the UAE has less crime than Norway.
  - tclancy 5y ago
    Is your contention no monarchy has ever seen organized political resistance? I’m not sure what the crime rate has to do with it.
Goety 5y ago
Political blowback. Nothing new in this day and age but you have to wonder what is causing these rifts.
netsec_burn 5y ago
This company reached out to me a few years ago. They promised mid-range 6 figures and said a few people who worked in the intelligence community already worked there. I reached out to a few friends and they told me not to take the job. I'm happy I didn't.
makarovOverflow 5y ago
Is it just me or at this point Americans will do anything for profit? The last American with moral standard is currently living in exile in Russia. Lori Stroud is a disgrace, who after all these, she basically became a mercenary attempting to justify her disgraceful actions. What a time to be alive, so first we have 911 that changed the lives online and offline as we know it. Then we have never ending wars that costed lives around the world, topping that with a global surveillance machine with a rapacious appetite for private information. These behaviors are far from the American values preached everyday by the left and right. It’s time to look in the mirror.
- retox 5y ago
  It's the result of an atomized society. Fuck everyone else, I'm going to get mine.
someonewhocar3s 5y ago
it looks to me that there's enough money in it to also plant exploits. Additionally, the lack of "the simply secure stack", has been a persistent grok for me. Perhaps the interest 'for the invested' in having the hacks around is simply too great. I.E. their threat model is not 'against the automat', so the automat can be irreliable. It's clearly 100% opposed - to have insecure software and to produce a reliable public, public interaction or public order. We're actually deep and long into the failure mode. Please observe Bitcoin/bitcoin adoption progress (it's simple really; obvious/crude improved ledger technology, and records in said ledger, pretty mild). The 'civil order' lacks everything, and is best understood against the backdrop of 'the needs of industry'. I'm still holding out for ledger technology & improved civility, but so far the corruption of economic interests has not been disconnected systemically. It's an open question if we have the civility to implement something which is not an economic system.

194 points by jbegley 5y ago

chrononaut 5y ago

(2019)

mikeyouse 5y ago
In the news today since they were just charged with a bunch of Federal crimes for this work: https://www.reuters.com/world/us/american-hacker-mercenaries-face-us-charges-work-uae-2021-09-14/ https://www.reuters.com/world/us/american-hacker-mercenaries...
- sterlind 5y ago
  > Former program operatives previously told Reuters they believed they were following the law because superiors promised them the U.S. government had approved the work. Absolute horseshit. This is 100% a loophole to give them some flimsy plausible deniability. If the NSA approves they should have confirmed with the actual NSA. Looks like the whistleblower wasn't charged, which is good, though you still have to be a pretty shitty person to go work on targeting journalists and dissidents in the first place. I suspect she didn't have moral qualms as much as she realized how much trouble she'd get in unless she came clean. I'm interested to learn how exactly any of this is legal. Isn't it illegal for Americans to hack anyone, regardless of where you live? Like could I really go to Russia and openly hack Ukraine as an American and not get charged when I come back to the US?
  - sophacles 5y ago
    Are you seriously gatekeeping the whistleblower? Like they did the right thing, but you can maybe imagine they weren't pure enough for you and therefore shitty? OK let me do that to you: You are commenting some good things, but i suspect you aren't doing it because you believe it, but rather you want some sweet karma. Therefore you are shitty human being. Feel shame person I've never interacted with before and have no other knowledge of. (Maybe check out the Darknet Diaries episode linked in the comments here and learn about the situation a bit before declaring the motives of a person you admit having no knowledge of.)
- themodelplumber 5y ago
  > The defendants are being charged also with military export restriction violations. They are throwing the book at them. But there's also this other, amusing, cachet-related viewpoint: "I'm so badass that I was labeled a restricted military asset"...
- deleted 5y ago
  [deleted]

anonymousDan 5y ago

So hacking human rights activists is ok, but hacking US citizens crosses the line? WTF?

aha_throwaway 5y ago
It's always like that. The last days in Afghan they kill 10 people, and no one hell accountable. All they do is labeled them as ISIS members. (https://www.nytimes.com/2021/09/10/world/asia/us-air-strike-drone-kabul-afghanistan-isis.html https://www.nytimes.com/2021/09/10/world/asia/us-air-strike-...)
- 2OEH8eoCRo0 5y ago
  What would you like to be done about it?
  - hellcow 5y ago
    Tried as a war crime, perhaps? Murdering an aid worker and seven children, then trying to cover it up, seems pretty horrific to me.
    - 2OEH8eoCRo0 5y ago
      Who specifically should be tried?
      - Taniwha 5y ago
        Let's start with the person who pushed without verifying that the targets were truly ISIS and work our way upwards
        2OEH8eoCRo0 5y ago
        What does that mean? The person who pulled the trigger to release the Hellfire from the drone?

deleted 5y ago

[deleted]

ragnot 5y ago

How do all these people hack into phones all the time? Is there just a cache of 0Days that they have access to or do they just get really clever with phishing attacks?

sleibrock 5y ago
According to the article, it seems like it was heavily based off of Apple iMessage zero-click exploits built into some platform. And even a bit of social engineering. Past that, who knows where they get exploits from? I imagine if they're renting servers with Bitcoins to perform computer attacks, these operatives are probably familiar with darknet sites for trading secrets as well.
gonzo41 5y ago
Pretty much, that also have 0 days on components, so it's a matter of putting together an exploit chain that gets them what they need.
- AgentME 5y ago
  If software developers were ever held responsible for defects in their software that lead to breaches of privacy and harm caused through those breaches, I wonder how quickly software development practices would change. Memory unsafe languages like C would probably disappear as a choice for new projects in a heartbeat due to the liability.
mike_d 5y ago
Money. The going rate for iOS full chain (iMessage, Safari, or BT/WiFi exploit + sandbox escape, protection bypass, and persistence) is over two million dollars. The brokers then sell them for 2x-5x that amount. Reporting that same vulnerability to Apple can net you up to a million.
- SilverRed 5y ago
  It seems pretty clear that just about every government has a large bank of exploits on just about every single system. We only hear about the ones that get exposed and fixed and not the 30 others in storage or active use.

JimBlackwood 5y ago

For those interested, there is a Darknet Diaries episode about this. [1] Really quite interesting, interview is with someone who worked for Project Raven, like Lori. [1] https://darknetdiaries.com/episode/47/ https://darknetdiaries.com/episode/47/

perihelions 5y ago

Follow-up, from today's news: "Three Former U.S. Intelligence Community and Military Personnel Agree to Pay More Than $1.68 Million to Resolve Criminal Charges Arising from Their Provision of Hacking-Related Services to a Foreign Government" https://www.justice.gov/opa/pr/three-former-us-intelligence-community-and-military-personnel-agree-pay-more-168-million https://www.justice.gov/opa/pr/three-former-us-intelligence-...

unyttigfjelltol 5y ago

The subject of the article hired Snowden into an NSA project just before he fled as a whistleblower, tried to resurrect her career for a private company doing espionage overseas, and after a few years ultimately made good by becoming a whistleblower herself against her spybosses. What a fantastic story arc! Hollywood....

quxpar 5y ago
And I thought I was failing up!

wolverine876 5y ago

Stroud's judgment is interesting; is the mistake predictable? > In 2013, her world changed. While stationed at NSA Hawaii, Stroud says, she made the fateful recommendation to bring a Dell technician already working in the building onto her team. That contractor was Edward Snowden. / “He’s former CIA, he’s local, he’s already cleared,” Stroud, 37, recalled. “He’s perfect!” Booz and the NSA would later approve Snowden’s transfer, providing him with even greater access to classified material. Then Stroud trusted the Project Raven employers, not only to start but over and over, as they had Stroud violate human rights (spying on journalists, 16 year olds, human rights activists), after Stroud discovered evidence of spying on Americans. And then Stroud didn't trust the FBI; note that the claimed motivation could simply fabricated - clearly Stroud wanted to do this work. > Two agents approached Stroud in 2016 at Virginia’s Dulles airport as she was returning to the UAE after a trip home. Stroud, afraid she might be under surveillance by the UAE herself, said she brushed off the FBI investigators. “I’m not telling you guys jack,” she recounted. And possibly this is related: > Still, she found the work exhilarating. “It was incredible because there weren’t these limitations like there was at the NSA. There wasn’t that bullshit red tape,” she said. “I feel like we did a lot of good work on counterterrorism.” Maybe those rules, the principles of human rights, and the FBI are there for a reason. Stroud seems to think they are unrelated to her character: > “I don’t think Americans should be doing this to other Americans,” she told Reuters. “I’m a spy, I get that. I’m an intelligence officer, but I’m not a bad one.” > Stroud said her background as an intelligence operative made her comfortable with human rights targets as long as they weren’t Americans. “We’re working on behalf of this country’s government, and they have specific intelligence objectives which differ from the U.S., and understandably so,” Stroud said. “You live with it.”

retox 5y ago
"Stroud said her background as an intelligence operative made her comfortable with human rights targets " should read "Stroud said her background as an intelligence operative made her comfortable with human rights _violations_"

tclancy 5y ago

Every once in a while, my brain asks a good question. https://www.state.gov/reports/country-reports-on-terrorism-2019/united-arab-emirates/ https://www.state.gov/reports/country-reports-on-terrorism-2... “ 2019 Terrorist Incidents: There were no terrorist attacks reported in the UAE in 2019.” Either they were extraordinarily good at their job or their job was bullshit. IBM Presents You Make the Call.

baybal2 5y ago
Maybe they don't paint a giant target on their forehead? Maybe that's the key?
- tclancy 5y ago
  Yes, surely that’s the key. We are all being kept safe by these wonderful demigods who trade out human agency for safety. Feel good yet?
kjaftaedi 5y ago
Why would there be terrorist attacks in the UAE? There aren't even political parties in monarchies making political action more difficult, not to mention the UAE has less crime than Norway.
- tclancy 5y ago
  Is your contention no monarchy has ever seen organized political resistance? I’m not sure what the crime rate has to do with it.

Goety 5y ago

Political blowback. Nothing new in this day and age but you have to wonder what is causing these rifts.

netsec_burn 5y ago

This company reached out to me a few years ago. They promised mid-range 6 figures and said a few people who worked in the intelligence community already worked there. I reached out to a few friends and they told me not to take the job. I'm happy I didn't.

makarovOverflow 5y ago

Is it just me or at this point Americans will do anything for profit? The last American with moral standard is currently living in exile in Russia. Lori Stroud is a disgrace, who after all these, she basically became a mercenary attempting to justify her disgraceful actions. What a time to be alive, so first we have 911 that changed the lives online and offline as we know it. Then we have never ending wars that costed lives around the world, topping that with a global surveillance machine with a rapacious appetite for private information. These behaviors are far from the American values preached everyday by the left and right. It’s time to look in the mirror.

retox 5y ago
It's the result of an atomized society. Fuck everyone else, I'm going to get mine.

someonewhocar3s 5y ago

it looks to me that there's enough money in it to also plant exploits. Additionally, the lack of "the simply secure stack", has been a persistent grok for me. Perhaps the interest 'for the invested' in having the hacks around is simply too great. I.E. their threat model is not 'against the automat', so the automat can be irreliable. It's clearly 100% opposed - to have insecure software and to produce a reliable public, public interaction or public order. We're actually deep and long into the failure mode. Please observe Bitcoin/bitcoin adoption progress (it's simple really; obvious/crude improved ledger technology, and records in said ledger, pretty mild). The 'civil order' lacks everything, and is best understood against the backdrop of 'the needs of industry'. I'm still holding out for ledger technology & improved civility, but so far the corruption of economic interests has not been disconnected systemically. It's an open question if we have the civility to implement something which is not an economic system.