6 ms·
One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hard
by declan_roberts 3y ago
One thing I notice about state-level espionage and backdoors. The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. Hardware backdoors make sense since much of it passes through the USA.
Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors. A much harder game to play.
- wolverine876 3y ago> The USA seems to have an affinity for hardware interdiction as opposed to software backdoors. What are some examples?
- nick238 3y agoThe Clipper chip? Not sure if that's what they had in mind. Nowadays it's maybe just how the NSA has rooms attached to backbone providers like https://theintercept.com/2018/06/25/att-internet-nsa-spy-hubs/ https://theintercept.com/2018/06/25/att-internet-nsa-spy-hub...
- AlexCoventry 3y agohttps://en.wikipedia.org/wiki/Tailored_Access_Operations https://en.wikipedia.org/wiki/Tailored_Access_Operations
- acid__ 3y agoBe sure to check out the mentioned catalog. [1] The NSA's capabilities back in 2008 were pretty astonishing: "RAGEMASTER" A $30 device that taps a VGA cable and transmits the contents of your screen to the NSA van sitting outside! Crazy stuff. Makes you wonder what they've built in the last 15 years. [1] https://en.wikipedia.org/wiki/ANT_catalog https://en.wikipedia.org/wiki/ANT_catalog
- masklinn 3y agoToday you’ve got open access USB cable which can stream your shit out on WiFi, no doubt the NSA has worse.
- gowld 3y agoThis goes back to WWII. USA solves problems with manufacturing and money. Europeans relatively lack both, so they solve problems with their brains.
- hybridtupel 3y agoIsrael is not in Europe
- Alezz 3y agoThe perfect definition of Europe is if they took part in the Eurovision Song Contest.
- nmat 3y agoAustralia participates in the Eurovision Song Contest.
- willsmith72 3y agoand now i get to identify as european in heated internet debates
- jessekv 3y agoBut they know they are "not the same".
- bawolff 3y ago> Other countries such as Israel are playing the long-con with very well engineered, multi-year software backdoors What is this in reference to?
- markus92 3y agoStuxnet?
- ginko 3y agoProbably Stuxnet.
- bawolff 3y agoStuxnet was not a backdoor.
- deleted 3y ago[deleted]
- hammock 3y agoBob Maxwell (Ghislaine's father) sold backdoored software to corporations and governments all around the world, including US targets, on behalf of Israel's Mossad. "The Maxwell-Mossad team steals spy software PROMIS from the United States, Mossad puts an undetectable trap door in it so Mossad can track the activities of anyone using it, then Maxwell sells it around the world (including back to the U.S. -- with the trap door)." https://kclibrary.bibliocommons.com/v2/record/S120C257904 https://kclibrary.bibliocommons.com/v2/record/S120C257904
- Voultapher 3y agoNSO Group They are an Israel based company, that sell zero-click RCEs for phones and more. Such malicious software was involved in the murder of journalist Jamal Khashoggi. Their exploits, developed in-house as well as presumably partially bought on the black market, are some of the most sophisticated exploits found in the wild, e.g. https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-i... > JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.
- greggsy 3y agoI mean, they’re just the high profile ones. China makes and ships a lot of hardware, and the US makes and ships a lot of software.
- fpgaminer 3y agoMy completely unexpert opinion, informed by listening to all the episodes of Darknet Diaries, agrees with this. US intelligence likes to just bully/bribe/blackmail the supply chain. They've got crypto chops, but I don't recall any terribly sophisticated implants like this one (except Stuxnet, which was likely Israel's work funded/assisted by the US). NK isn't terribly sophisticated, and their goal is money, so that doesn't match either. Russia is all over the place in terms of targets/sophistication/etc because of their laws (AFAIK it's legal for any citizen to wage cyberwarfare on anything and everything except domestically), but this feels a bit beyond anything I recall them accomplishing at a state level. Israeli organizations have a long history of highly sophisticated cyberwarfare (Stuxnet, NSO group, etc), and they're good about protecting their access to exploits. That seems to fit the best. That said, saying "Israeli organization" casts a wide net since it's such a boiling hotspot for cybersecurity professionals. Could be the work of the government, could be co-sponsored by the US, or could just be a group of smart people building another NSO group.
- formerly_proven 3y ago> Russia is all over the place in terms of targets/sophistication/etc ... but this feels a bit beyond anything I recall them accomplishing at a state level. https://en.wikipedia.org/wiki/Triton_(malware) https://en.wikipedia.org/wiki/Triton_(malware) (https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical https://www.justice.gov/opa/pr/four-russian-government-emplo...)
- croemer 3y agoJia Tan's GitHub activity was mostly 10-18@UTC, consistent with Europe/Israel/Russia
- jeroenhd 3y agoIt's rather trivial to fake git commits. Basing this stuff on email times (especially replies to emails sent that same day) would be more relevant. However. if this operation was pulled off with the precision and opsec that it seems to have been, I wouldn't be too surprised if whatever group is behind this attack would've sent over + funded a developer somewhere in a time zone of their choice. No doubt any nation state is able to station someone in Russia/Israel/one of the n-eyes countries. I doubt OSINT will figure out who is really behind this, but I'm sure governments will, soon enough. Whether or not they report the truth of their findings, and if one should trust the official reporting, is yet another tough question.
- db48x 3y agoThe git timestamps in the git commits probably were faked, but they implicate China. There were a handful of apparent slippups though, and if we take those timestamps to be correct then it looks like they were in eastern Europe (or possibly Finland, the Baltics, or the Mediterranean coast all the way down to Egypt). And if we instead assume that these timestamps are a second–level misdirection then there is a huge complexity penalty; my money is on the simpler answer (but not all my money; it’s not a sure bet).
- croemer 3y agoI'm basing this on Github's activity archive as queried through Clickhouse - which is much harder to fake than git commits: https://play.clickhouse.com/play?user=play#U0VMRUNUCiAgY3JlYXRlZF9hdCwKICBhY3Rvcl9sb2dpbiwKICByZXBvX25hbWUsCiAgZXZlbnRfdHlwZSwKICB0aXRsZQpGUk9NCiAgZ2l0aHViX2V2ZW50cwpXSEVSRQogIGFjdG9yX2xvZ2luID0gJ0ppYVQ3NScKT1JERVIgQlkKICBjcmVhdGVkX2F0IERFU0MK https://play.clickhouse.com/play?user=play#U0VMRUNUCiAgY3JlY... See the writeup here: https://til.simonwillison.net/clickhouse/github-explorer https://til.simonwillison.net/clickhouse/github-explorer