5 ms·

> I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all over the Internet).

> I made local presentations at 0xOpoSec and BSidesLisbon but those slides were never published for obvious reasons (aka live implants all over the Internet). I don't understand. Or does this mean because the malware was being used you refused to publish documentation about it? Because you think people targeted by nation states are evil? Intelligence services are the worst terrorist organizations, and most people targeted by them are in fact very friendly persons. If only intelligence services dealt with the actual criminals and not revolutionaries, we wouldn't be having corruption and power abuse scandals every other week in all "developed" nations.

_8j50 5y ago
Live implants, means if they published you or I can access the implants and therefore the victims' systems.
- southerntofu 5y ago
  If you've got root RCE can't you use it to "close" the implant and make sure noone gets hurt like some have been doing to counteract IoT botnets? How is leaving a gaping hole better? EDIT: To those saying it would be a legal liability risk, isn't it a criminal offense in your jurisdiction if you know about a danger to someone else, not to do something about it if only warn them? (non-assistance à personne en danger, in french law) Or couldn't you partner with a security research lab with better legal counsel?
  - waihtis 5y ago
    depends if you want to take the risk of being prosecuted for illegitimately accessing multiple computer resources
  - _8j50 5y ago
    That's illegal. You can't break into someones house to kick out a burglar. The people that have counteracted and kicked out bots from botnets broke laws in several countries (fed crime in US), which is why they don't publicize their identity (even if they did, prosecutors may not come after them). You need the consent of the system owner to help them with the intrusion, otherwise anyone can hack into someone else's computer and say they were there to get rid of some malware.
  - user-the-name 5y ago
    You would be taking on a lot liability and responsibility if you did that.
  - jdavis703 5y ago
    > isn't it a criminal offense in your jurisdiction if you know about a danger to someone else, not to do something about it if only warn them? In America where the NSA is located? I’ve never written “lol” on this site, but this time called for it. Since you’re in France I’ll now explain nicely. Not even our cops have any legal requirement to intervene: both when there’s an active crime or even if they see another cop committing a crime in the line of duty (e.g. excessive force). And civilians (in the American press both military and “deputized” police are called non-civilian) will frequently ignore all manner of crimes, from shootouts to a person overdosing on drugs.
    - taway9001 5y ago
      US LEO here. This is not exactly correct. At least this bit: "both when there’s an active crime or even if they see another cop committing a crime in the line of duty (e.g. excessive force)." Cops generally have no duty to protect anybody. That's not their job, no matter what the decals on the squad say. But if you're on duty, and you witness a crime being committed right in front of you, especially if it's something as serious as a violent felony, and literally ignore it, and anybody finds out, you'll at least probably be fired. Depending on the jurisdiction and totality of circumstances, it may also be a crime.
      - edoceo 5y ago
        Doesn't work like that in Seattle. Police actively ignore drug use in the (clean) parks, even with complaining witness. Police point and laugh at homeless fighting each other. Source: my eyes.
        orangepurple 5y ago
        That behavior comes from the police chief and district attorney explicitly telling street level cops what they can't police.
        edoceo 5y ago
        I know where it comes from. And regardless of management, my observations are counter to the parent comment, claiming an LEO would be fired for ignoring violent crime.
- 7647538jddh 5y ago
  But the victims have already been compromised by one of the most malicious organizations on the planet. Being further compromised would probably be more likely to help than hurt, as it would make it more likely that whatever the NSA is doing is discovered or disrupted.
  - _8j50 5y ago
    So you notify the victims so they can do something about it. I mean you yourself just said how sophisticated the threat was, shouldn't they know an implant accessed sensitive data and may have tampered with the integrity if data as well? Cutting off access is just containment, not eradication. Any operator worth his salt would have multiple ways back in for when the primary implant is burned. A proper incident response involves the consent and participation if the victim,the implant/malware is not the problem, what was and might be done using it is.
xwolfi 5y ago
I sure wouldnt want you to have access to these :p
- southerntofu 5y ago
  Not interested anyway, but thanks! :P I just want holes to be fixed.
imwillofficial 5y ago
You don’t understand why somebody wouldn’t want to publicly kick the beehive that is the NSA. I’d imagine He didn’t want to get thrown in the back of a van and disappeared. Even more mundane punishment could be quite severe.

_8j50 5y ago

Live implants, means if they published you or I can access the implants and therefore the victims' systems.

southerntofu 5y ago
If you've got root RCE can't you use it to "close" the implant and make sure noone gets hurt like some have been doing to counteract IoT botnets? How is leaving a gaping hole better? EDIT: To those saying it would be a legal liability risk, isn't it a criminal offense in your jurisdiction if you know about a danger to someone else, not to do something about it if only warn them? (non-assistance à personne en danger, in french law) Or couldn't you partner with a security research lab with better legal counsel?
- waihtis 5y ago
  depends if you want to take the risk of being prosecuted for illegitimately accessing multiple computer resources
- _8j50 5y ago
  That's illegal. You can't break into someones house to kick out a burglar. The people that have counteracted and kicked out bots from botnets broke laws in several countries (fed crime in US), which is why they don't publicize their identity (even if they did, prosecutors may not come after them). You need the consent of the system owner to help them with the intrusion, otherwise anyone can hack into someone else's computer and say they were there to get rid of some malware.
- user-the-name 5y ago
  You would be taking on a lot liability and responsibility if you did that.
- jdavis703 5y ago
  > isn't it a criminal offense in your jurisdiction if you know about a danger to someone else, not to do something about it if only warn them? In America where the NSA is located? I’ve never written “lol” on this site, but this time called for it. Since you’re in France I’ll now explain nicely. Not even our cops have any legal requirement to intervene: both when there’s an active crime or even if they see another cop committing a crime in the line of duty (e.g. excessive force). And civilians (in the American press both military and “deputized” police are called non-civilian) will frequently ignore all manner of crimes, from shootouts to a person overdosing on drugs.
  - taway9001 5y ago
    US LEO here. This is not exactly correct. At least this bit: "both when there’s an active crime or even if they see another cop committing a crime in the line of duty (e.g. excessive force)." Cops generally have no duty to protect anybody. That's not their job, no matter what the decals on the squad say. But if you're on duty, and you witness a crime being committed right in front of you, especially if it's something as serious as a violent felony, and literally ignore it, and anybody finds out, you'll at least probably be fired. Depending on the jurisdiction and totality of circumstances, it may also be a crime.
    - edoceo 5y ago
      Doesn't work like that in Seattle. Police actively ignore drug use in the (clean) parks, even with complaining witness. Police point and laugh at homeless fighting each other. Source: my eyes.
      - orangepurple 5y ago
        That behavior comes from the police chief and district attorney explicitly telling street level cops what they can't police.
        edoceo 5y ago
        I know where it comes from. And regardless of management, my observations are counter to the parent comment, claiming an LEO would be fired for ignoring violent crime.
7647538jddh 5y ago
But the victims have already been compromised by one of the most malicious organizations on the planet. Being further compromised would probably be more likely to help than hurt, as it would make it more likely that whatever the NSA is doing is discovered or disrupted.
- _8j50 5y ago
  So you notify the victims so they can do something about it. I mean you yourself just said how sophisticated the threat was, shouldn't they know an implant accessed sensitive data and may have tampered with the integrity if data as well? Cutting off access is just containment, not eradication. Any operator worth his salt would have multiple ways back in for when the primary implant is burned. A proper incident response involves the consent and participation if the victim,the implant/malware is not the problem, what was and might be done using it is.

xwolfi 5y ago

I sure wouldnt want you to have access to these :p

southerntofu 5y ago
Not interested anyway, but thanks! :P I just want holes to be fixed.

imwillofficial 5y ago

You don’t understand why somebody wouldn’t want to publicly kick the beehive that is the NSA. I’d imagine He didn’t want to get thrown in the back of a van and disappeared. Even more mundane punishment could be quite severe.