10 ms·

Former NSA Hacker Describes Being Recruited for UAE Spy Program

194 points by jbegley 5y ago

docdeek 5y ago
>> Who were they giving the laptops to? Other leaders. Leaders who were coming to visit [UAE] sheiks... “Thanks for coming. Just as a sign of our appreciation, here’s a bunch of stuff.” One of those things happened to be a laptop. We do know that they were turned on sometimes. What happened after that we don’t aways know the answers to. Got to be some sort of basic rule of being a leader not to take electronics from a foreign government and turn it on - or even do more than accept it to be gracious and then ensure it never goes anywhere near you.
- blitzar 5y ago
  You would think so. Or perhaps they chuck it to their kid as a freebie. Goodie bags with phones and cameras etc are popular at celebrity events. Perhaps this is how the celebrity nudes get leaked? Get free phone at party > go home and film a sex tape > featured on internet.
  - 2OEH8eoCRo0 5y ago
    Chuck it to their kid? Now you're on their LAN.
    - blitzar 5y ago
      I think that is probably the plan ... I doubt the president is going to use it as their work laptop. Best case scenario you get into their home network somehow.
  - deleted 5y ago
    [deleted]
  - mrkickling 5y ago
    The celebrity nudes (if you're referring to the fappening) were mainly phishing attacks from someone claiming to be icloud. I believe this episode talks about it: https://darknetdiaries.com/episode/34/ https://darknetdiaries.com/episode/34/
- qeternity 5y ago
  Given that decades ago, the Russians embedded completely passive microphones inside paintings and have them as gifts, undetectable to most equipment…yeah a full blown laptop should almost be an admission that “hey we’re trying to bug you”.
  - MomoXenosaga 5y ago
    Dont take a laptop from a stranger!
    - bierjunge 5y ago
      Nah, then they will try to get the information over other channels. Take the laptop and gift it to someone over craigslist or a similar site. It will take them some time to realize they are not monitoring you, using a persona, but a soccer mom from the suburbs who is really into social media and cooking. It won't make anything more secure, but it can buy you some time and waste the attackers resources.
      - atlasunshrugged 5y ago
        Now I'm picturing a series where actually it turns out that the person you sold it to is a major drug dealer or something and it plunges them into a web of international intrigue when the foreign government tries to blackmail them and then they come after you as revenge.
        torgian 5y ago
        I would watch this movie / tv series
  - joshuaissac 5y ago
    There was The Thing, a Soviet passive transmitter that was a replica of the Great Seal and gifted to the American embassy in Moscow. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
- aborsy 5y ago
  The laptop part made me laugh :) Even at work we are not allowed to accept electronics from other companies. I can’t imagine government officials or security people of a country using a full blown laptop provided by the government officials or security people of other countries! Sounds like a joke!
  - 0xdeadb00f 5y ago
    Perhapse most would just regift them or something. "Here, young nephew, a laptop I don't need"
    - LurkingPenguin 5y ago
      Or resell it. Looks like I've finally stumbled on my idea for YCombinator: TroHorse.io, the online marketplace for compromised electronics.
    - meowface 5y ago
      Seems like an excellent counterintelligence opportunity. "Handing us an obvious trap we can flip around and use to deceive you / see what information you're looking for? Thanks." Though I imagine UAE intelligence would also probably be accounting for that possibility, given it seems like such a natural thing to do in that scenario. Or maybe I'm overestimating both sides, depending on who's receiving the gift.
- atlasunshrugged 5y ago
  Yeah, this is absolutely insane. I worked briefly for an eastern european government (low level person, def not a senior official) and they even warned against having certain foreign apps on your personal/work mobile device. I don't remember them ever explicitly mentioning not to take and use electronics from a foreign government, probably because they thought it was so obvious it wouldn't be worth mentioning!
noptd 5y ago
> There were no red flags because I was so naive. But… there’s a ton of red flags [in retrospect]…. [For example] when you’re in the interview process and you’re talking about defending [the UAE] and … doing tracking of terrorist activity,… but then you’re [being asked] very specific questions about integrated enterprise Windows environments and [how you might hack them]. Guess who doesn’t have those type of networks? Terrorist organizations. So why [is the recruiter] asking these kinds of questions…? > So had I been really cognizant of where or what I was stepping into, I probably would have known during even the interview process that something is a little bit amiss here. Given the number of trainings that he would have attended while working at the NSA, I find it hard to believe that his OpSec radar wouldn't have been going off at that point. Having read the remainder of the interview, IMO the entire series of events can be summarized as follows: >Things were fishy from the start, but the compensation was good so I was happy to collect a paycheck until all plausible deniability went out the window. Knowing the gravy train wouldn't last forever and that the US govt would one day come knocking, I denied a position at DarkMatter and moved back to the states.
- qeternity 5y ago
  > Given the number of trainings that he would have attended while working at the NSA, I find it hard to believe that his OpSec radar wouldn't have been going off at that point. These types of training tend to be very specific, and certainly do not involve questioning chain of command. This is why he immediately noticed things like possible surveillance, but it took him much longer to question the mission and his commanding officer.
  - noptd 5y ago
    >These types of training tend to be very specific, and certainly do not involve questioning chain of command. True, but this excerpt was describing his initial interview process with CyberPoint. I agree with the general sentiment though.
  - sneak 5y ago
    I think a lot of the external view of the NSA's training is tinted by Snowden's books and writing. It is important to remember that Snowden was also CIA before he worked at NSA, and went through full CIA training for CIA staff stationed in foreign embassies (he was in Geneva, and I think Japan?).
StrLght 5y ago
Previous discussions from last week on this topic: https://news.ycombinator.com/item?id=28541117 https://news.ycombinator.com/item?id=28541117 https://news.ycombinator.com/item?id=28530963 https://news.ycombinator.com/item?id=28530963
macevilc 5y ago
Obviously he thought it was for defensive purposes when charged for breaking a law.
aphroz 5y ago
I find it hard to believe that you can work for the NSA without being given proper training to detect this kind of maneuver.
- raducu 5y ago
  Quite the opposite. The NSA would not provide the type of training that would make its own employees question the NSA itself, I'm sure you receive the exact amount of training to do your job and not more.
  - jjitz 5y ago
    this is untrue
- wil421 5y ago
  They were making over $200k a year and probably had stipends for living expenses. Money will make you blind.
rishabhd 5y ago
Reminds of the ordeal of Simone. https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Emirates-Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/ https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Em...
aosaigh 5y ago
There is a great Darknet Diaries podcast episode about this (I assume it's the same "David"): https://darknetdiaries.com/episode/47/ https://darknetdiaries.com/episode/47/ https://podcasts.apple.com/gb/podcast/ep-47-project-raven/id1296350485?i=1000450079822 https://podcasts.apple.com/gb/podcast/ep-47-project-raven/id...
- tmearnest 5y ago
  I just looked up the link to share this, but you already got to it so I’m going to sell Darknet Diaries to y’all. This podcast series is one of my favorites. It some how manages to find a balance between being technical and accessible to the average person. Jack Resider is a great story teller. The level of care and detail they put into their research is incredible and they share the primary sources if you want to go even deeper. If you like podcasts, give this a listen. Physical pentest episodes are my favorite.
  - Taylor_OD 5y ago
    Another thumbs up for darknet diaries. I love the show. The host balances technical talk and telling a story incredibly well and he covers all types of stories. Really anything "hacking" related you can think of there is probably an episode on.
    - mszcz 5y ago
      Seconded. He really has a knack for telling stories and drawing narratives. As others have pointed out his stories are accessible to both the technical and non-technical people.
pluc 5y ago
Way to make sure that the next ones don't make it out alive
joshsyn 5y ago
If we are not okay with foreign countries spying, why are we okay with our own government spying on us?
- pageandrew 5y ago
  We're not. There was huge outrage when the Snowden documents were released, and the warrantless surveillance program was judged to be unconstitutional in 2020.
truthwhisperer 5y ago
Sure hope he gets prison time. Love your country

194 points by jbegley 5y ago

>> Who were they giving the laptops to? Other leaders. Leaders who were coming to visit [UAE] sheiks... “Thanks for coming. Just as a sign of our appreciation, here’s a bunch of stuff.” One of those things happened to be a laptop. We do know that they were turned on sometimes. What happened after that we don’t aways know the answers to. Got to be some sort of basic rule of being a leader not to take electronics from a foreign government and turn it on - or even do more than accept it to be gracious and then ensure it never goes anywhere near you.

blitzar 5y ago
You would think so. Or perhaps they chuck it to their kid as a freebie. Goodie bags with phones and cameras etc are popular at celebrity events. Perhaps this is how the celebrity nudes get leaked? Get free phone at party > go home and film a sex tape > featured on internet.
- 2OEH8eoCRo0 5y ago
  Chuck it to their kid? Now you're on their LAN.
  - blitzar 5y ago
    I think that is probably the plan ... I doubt the president is going to use it as their work laptop. Best case scenario you get into their home network somehow.
- deleted 5y ago
  [deleted]
- mrkickling 5y ago
  The celebrity nudes (if you're referring to the fappening) were mainly phishing attacks from someone claiming to be icloud. I believe this episode talks about it: https://darknetdiaries.com/episode/34/ https://darknetdiaries.com/episode/34/
qeternity 5y ago
Given that decades ago, the Russians embedded completely passive microphones inside paintings and have them as gifts, undetectable to most equipment…yeah a full blown laptop should almost be an admission that “hey we’re trying to bug you”.
- MomoXenosaga 5y ago
  Dont take a laptop from a stranger!
  - bierjunge 5y ago
    Nah, then they will try to get the information over other channels. Take the laptop and gift it to someone over craigslist or a similar site. It will take them some time to realize they are not monitoring you, using a persona, but a soccer mom from the suburbs who is really into social media and cooking. It won't make anything more secure, but it can buy you some time and waste the attackers resources.
    - atlasunshrugged 5y ago
      Now I'm picturing a series where actually it turns out that the person you sold it to is a major drug dealer or something and it plunges them into a web of international intrigue when the foreign government tries to blackmail them and then they come after you as revenge.
      - torgian 5y ago
        I would watch this movie / tv series
- joshuaissac 5y ago
  There was The Thing, a Soviet passive transmitter that was a replica of the Great Seal and gifted to the American embassy in Moscow. https://en.wikipedia.org/wiki/The_Thing_(listening_device) https://en.wikipedia.org/wiki/The_Thing_(listening_device)
aborsy 5y ago
The laptop part made me laugh :) Even at work we are not allowed to accept electronics from other companies. I can’t imagine government officials or security people of a country using a full blown laptop provided by the government officials or security people of other countries! Sounds like a joke!
- 0xdeadb00f 5y ago
  Perhapse most would just regift them or something. "Here, young nephew, a laptop I don't need"
  - LurkingPenguin 5y ago
    Or resell it. Looks like I've finally stumbled on my idea for YCombinator: TroHorse.io, the online marketplace for compromised electronics.
  - meowface 5y ago
    Seems like an excellent counterintelligence opportunity. "Handing us an obvious trap we can flip around and use to deceive you / see what information you're looking for? Thanks." Though I imagine UAE intelligence would also probably be accounting for that possibility, given it seems like such a natural thing to do in that scenario. Or maybe I'm overestimating both sides, depending on who's receiving the gift.
atlasunshrugged 5y ago
Yeah, this is absolutely insane. I worked briefly for an eastern european government (low level person, def not a senior official) and they even warned against having certain foreign apps on your personal/work mobile device. I don't remember them ever explicitly mentioning not to take and use electronics from a foreign government, probably because they thought it was so obvious it wouldn't be worth mentioning!

noptd 5y ago

> There were no red flags because I was so naive. But… there’s a ton of red flags [in retrospect]…. [For example] when you’re in the interview process and you’re talking about defending [the UAE] and … doing tracking of terrorist activity,… but then you’re [being asked] very specific questions about integrated enterprise Windows environments and [how you might hack them]. Guess who doesn’t have those type of networks? Terrorist organizations. So why [is the recruiter] asking these kinds of questions…? > So had I been really cognizant of where or what I was stepping into, I probably would have known during even the interview process that something is a little bit amiss here. Given the number of trainings that he would have attended while working at the NSA, I find it hard to believe that his OpSec radar wouldn't have been going off at that point. Having read the remainder of the interview, IMO the entire series of events can be summarized as follows: >Things were fishy from the start, but the compensation was good so I was happy to collect a paycheck until all plausible deniability went out the window. Knowing the gravy train wouldn't last forever and that the US govt would one day come knocking, I denied a position at DarkMatter and moved back to the states.

qeternity 5y ago
> Given the number of trainings that he would have attended while working at the NSA, I find it hard to believe that his OpSec radar wouldn't have been going off at that point. These types of training tend to be very specific, and certainly do not involve questioning chain of command. This is why he immediately noticed things like possible surveillance, but it took him much longer to question the mission and his commanding officer.
- noptd 5y ago
  >These types of training tend to be very specific, and certainly do not involve questioning chain of command. True, but this excerpt was describing his initial interview process with CyberPoint. I agree with the general sentiment though.
- sneak 5y ago
  I think a lot of the external view of the NSA's training is tinted by Snowden's books and writing. It is important to remember that Snowden was also CIA before he worked at NSA, and went through full CIA training for CIA staff stationed in foreign embassies (he was in Geneva, and I think Japan?).

StrLght 5y ago

Previous discussions from last week on this topic: https://news.ycombinator.com/item?id=28541117 https://news.ycombinator.com/item?id=28541117 https://news.ycombinator.com/item?id=28530963 https://news.ycombinator.com/item?id=28530963

macevilc 5y ago

Obviously he thought it was for defensive purposes when charged for breaking a law.

aphroz 5y ago

I find it hard to believe that you can work for the NSA without being given proper training to detect this kind of maneuver.

raducu 5y ago
Quite the opposite. The NSA would not provide the type of training that would make its own employees question the NSA itself, I'm sure you receive the exact amount of training to do your job and not more.
- jjitz 5y ago
  this is untrue
wil421 5y ago
They were making over $200k a year and probably had stipends for living expenses. Money will make you blind.

rishabhd 5y ago

Reminds of the ordeal of Simone. https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Emirates-Intelligence-Tried-to-Hire-me-to-Spy-on-its-People/ https://www.evilsocket.net/2016/07/27/How-The-United-Arab-Em...

aosaigh 5y ago

There is a great Darknet Diaries podcast episode about this (I assume it's the same "David"): https://darknetdiaries.com/episode/47/ https://darknetdiaries.com/episode/47/ https://podcasts.apple.com/gb/podcast/ep-47-project-raven/id1296350485?i=1000450079822 https://podcasts.apple.com/gb/podcast/ep-47-project-raven/id...

tmearnest 5y ago
I just looked up the link to share this, but you already got to it so I’m going to sell Darknet Diaries to y’all. This podcast series is one of my favorites. It some how manages to find a balance between being technical and accessible to the average person. Jack Resider is a great story teller. The level of care and detail they put into their research is incredible and they share the primary sources if you want to go even deeper. If you like podcasts, give this a listen. Physical pentest episodes are my favorite.
- Taylor_OD 5y ago
  Another thumbs up for darknet diaries. I love the show. The host balances technical talk and telling a story incredibly well and he covers all types of stories. Really anything "hacking" related you can think of there is probably an episode on.
  - mszcz 5y ago
    Seconded. He really has a knack for telling stories and drawing narratives. As others have pointed out his stories are accessible to both the technical and non-technical people.

pluc 5y ago

Way to make sure that the next ones don't make it out alive

joshsyn 5y ago

If we are not okay with foreign countries spying, why are we okay with our own government spying on us?

pageandrew 5y ago
We're not. There was huge outrage when the Snowden documents were released, and the warrantless surveillance program was judged to be unconstitutional in 2020.

truthwhisperer 5y ago

Sure hope he gets prison time. Love your country