6 ms·

An inside look at NSA tactics, techniques and procedures from China's lens

232 points by davikr 2y ago

themark 2y ago
It seems like the lack of operations during US holidays would be a big oversight.
vednig 2y ago
[flagged]
- rdtsc 2y ago
  > can I comment freely here Sure, we all have the freedom of speech here. Will you have freedom after speech though, I don't know? It depends on your particular situation ;-)
  - vednig 2y ago
    nothing it's just two biggest intelligence agencies fighting, I think keeping quiet is the safest bet
    - inetknght 2y ago
      Sometimes keeping quiet isn't the best form of defense though. So it really does depend on your situation.
  - boredpeter 2y ago
    [dead]
- deleted 2y ago
  [deleted]
rdtsc 2y ago
> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed systems in neighbouring countries to China SunOS? Wonder if it's because it's genuinely used still quite a bit or they simply had zero-days for it since many of those are old and unpatched?
- formerly_proven 2y ago
  Assuming they mean Solaris, it's still technically maintained, at least in the Oracle sense (of both "technically" and "maintained").
  - rdtsc 2y ago
    I assumed that much, SunOS is pretty ancient, last version was what, in early 1990s? Though, Solaris still would report a SunOS 5.$solarisver version or something like that. So I guess we can say it is a "SunOS" box if we wanted to.
    - jjtheblunt 2y ago
      SunOS 4.x is the BSD lineage and SunOS 5.x the Solaris lineage, or at least was when i worked at Sun.
- zdragnar 2y ago
  The same strategy is used to attribute attacks against US based targets by Russian, N.Korean and Iranian and other state or state sponsored actors. Time of day, holidays, etc. are (in tandem with other evidence) considered to be surprisingly reliable. If I were in charge of things I'd like to think that this sort of thing would be the first step I'd take to cover my tracks, but I still hear cyber security firms using it in their attributions.
  - kokx 2y ago
    The type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families. It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.
markus_zhang 2y ago
This is really interesting. I wonder how red-teams in State sponsored teams operate in real life. I guess every one has an NDA, but would love to get a general idea. I assume it's a jungle out there, so teams need to protect themselves 24/7/365 and I'm surprised to find no activities in holidays.
breppp 2y ago
It seems like the most efficient way of detecting NSA tools is a regular expression of two all caps dictionary words
- contingencies 2y ago
  BadJoke LoveIt. Similarly, 0day ABNF to identify probable NSA front companies: [optional-firstname] <surname> [optional-adjective] <"systems">
- lazide 2y ago
  BRILLANT SPECTRE finds your joke in bad taste (/s)
motohagiography 2y ago
glad to see the same basic tradecraft from 90s hacking, only very refined and industrialized. it's a durable skill. the focus on switches and routers is very pro, as they are the most opaque infra with the fewest forensic capabilities. iot is less reliable as RE'ing cheap devices and firmware for IoCs is accessible, where almost nobody outside the IC did core gear (word to phenolit from back in the day tho). the traffic redirection is interesting in that i would be curious if they rate limited it or used on device selectors in their implant to redirect traffic. the trade off between memory caching packets to sort on selectors vs.stealthy throughput would have been a fun design meeting. hunting these kinds of actors would be supremely fun. the main thing that protects them is few outside massive bureaucracies really care enough or find it economical, as the rewards are more in finding new zero day and not hunting state level threat actors. the exceptions who do (p0, citizenlab etc) are attached to massive orgs and dont really led themselves to privateering. amazing write up anyway.
- hnthrowaway0315 2y ago
  Thanks for sharing. You seem to have some knowledge of the APT scene. Can you please elaborate on the following points? - the focus on switches and routers is very pro (did you mean the defenders or the attackers?) - What kind of knowledge is a starting point to hunt these players? I assume very good Linux system admin skills that can protect the whole system well enough to maybe only allow some obscure entries, and then have enough RE/Red team knowledge to know how to focus on these entries. Does it make sense? - How do those APTs operate? I'd imagine there are at least 3 groups of people, group 1 = people who make tools, do analysis, RE and such -- they are the support guys; group 2 = people who directly execute the operations -- they don't need very in-depth knowledge but need to a whole range of knowledge to know where to look at and how to best use the tools; group 3 = blue team who protects the whole facility. And of course there are managers, admins, etc.
thaumasiotes 2y ago
> These insights stem from extensive research I did on Weixin Someone doing extensive research on Weixin might ordinarily realize that it's called "Wechat" in English.
- boston_clone 2y ago
  Wechat is the internationalized version; Weixin is for mainland China. https://duckduckgo.com/?q=weixin+vs+wechat https://duckduckgo.com/?q=weixin+vs+wechat
  - thaumasiotes 2y ago
    I guess if ChatGPT told you to glue the cheese onto your pizza, you'd eat it that way. Wechat is also the mainland version. It's always been Wechat, and in particular it was Wechat years before they kicked me off of the mainland Chinese version† for registering an American phone number. The reality is exactly what I already told you: the app's name is 微信 in Chinese and Wechat in English. This is why coverage of Wechat's extensive market penetration in China always calls it "Wechat". Don't believe everything you read in the results of the stupidest web search you know how to run. If you try facts, you might like them! † By the way, "version" is really stretching things. There is no difference in the app. They don't keep your data within China, you go into a different advertising segment, and by default you connect to a different in-app sticker shop.
    - boston_clone 2y ago
      That would have been great to include with your initial comment instead of seemingly picking at nits and then making inflammatory comments. Always love the use of a dagger though, I don't see them too often online!
    - est 2y ago
      > There is no difference in the app There are tons of difference. Wexin has more adware/spyware, no CallKit on iOS, local payments. There's even a chat firewall between wexin and wechat.
kridsdale1 2y ago
I love the Windows 98 clip art.
alphalite 2y ago
I originally came here to comment how crazy it seems that DoD employees at NSA cannot be bothered to cover their tracks by working nonstandard hours/holidays (obviously Mil & Intel folks do this, they even get deployed!). But the thought occurred to me that attribution to NSA was likely a desired outcome here (“We can hack you too”) and there are probably many people at NSA working nonstandard hours/days to prevent attribution. I think the English language aspect is much more interesting and difficult/impossible to prevent.
- quanto 2y ago
  I agree, but I would go further and say (written) English language is as easy to emulate. There are technical people with great written English skills who will give away their non-Anglophone identities at the first sentence they speak.
- maxglute 2y ago
  Technical talent with transferable skills for higher paying work aren't incentivized to work on deployment schedule. But really, why assume NSA capable of obfuscating against PRC also stacked with talent. The parsimonious answer is then why bother, everyone knows they're deep in each others networks for decades and will continue to be. So let the hackers have their weekends.
- kelipso 2y ago
  It sounds exciting and all but it’s basically a boring government office job, the employees mostly have families, expect regular work hours, etc.
quanto 2y ago
> Chinese cyber organizations openly acknowledge and publicize their partnerships. This openness was particularly interesting to observe and may be influenced by cultural factors, such as the Confucian emphasis on shared knowledge and a political framework that encourages collective efforts. I or anyone outside obviously cannot verify the technical details. However, the above statement struck as particularly uninformed. As any engineer in East Asia can tell you, there is nothing especially collaborative about tech in Confucian culture; if anything, the engineers in that region admire the free speech and discussion traditionally prized in the Western culture. Calling Chinese political framework, especially in the context of national security, conducive to open public discussion was quite ironic to see. Edit: the punchline is this. If a friend who is always secretive and deceptive about his personal life is suddenly openly discussing his life, what does that say about the details he just disclosed and/or the situation he is currently in? source: I regularly work with engineers from that culture and studied relevant geopolitics.
- sangnoir 2y ago
  > As any engineer in East Asia can tell you, there is nothing especially collaborative about tech in Confucian culture IIRC, Bunnie (Huang) mentioned how freely data flows in Shenzhen for hardware hacking, versus pulling teeth trying to get data sheets for components from western component makers. > source: I regularly work with engineers from that culture and studied relevant geopolitics. (Winces)
  - TeMPOraL 2y ago
    > how freely data flows in Shenzhen for hardware hacking, versus pulling teeth trying to get data sheets for components from western component makers. That's different though. Shenzhen is where electronics factories are; they get the datasheets from western companies, but because said western companies can't really enforce their IP over there, the locals get to ignore it and use the datasheets however it's convenient for them.
    - tschwimmer 2y ago
dmix 2y ago
> In total, 54 jump servers and 5 proxy servers were used to perform the attack coming from 17 different countries including Japan, South Korea, Sweden, Poland and Ukraine with 70% of the attacks coming from China’s neighbouring countries. I'm guessing this is so when they do data exfiltration (and hosted MITM) it's not sending a ton of data to a single server, but spreads them out. > SECONDDATE: This tool was allegedly used by TAO (NSA) to hack into the office intranet of the University. Attribution of SECONDDATE was discovered through collaboration with other industry partners. They found thousands of network devices running this spyware – where the communications went back to NSA servers located in Germany, Japan, South Korea and Taiwan. This tool was used to redirect user traffic to the FOXACID platform. > SECONDDATE – Backdoor installed on network edge devices such as gateways and border routers to filter, and hijack mass amounts of data in a MiTM. This was placed on the border routers of the University to hijack traffic to redirect to NSA’s FOXACID platform.
ThinkBeat 2y ago
Given how US is attacking their enemies and at times their allies, 24/7 it is amazing how little we ever hear about it.
- Mountain_Skies 2y ago
  If we were in Russia or China, we'd likely hear about US actions in this area quite a bit more. With allies, well, there's a lot of mutual back scrubbing going on.
- WarOnPrivacy 2y ago
  Regarding unwarranted surveillance of Americans not suspected of a crime (and by extension, our allies): Throughout my longish life, these things have not changed. ~All federal politicians support/expand it and then obfuscate their part. News orgs don't/won't cover it (most of the time). The reason is every possible reason. Stated differently: Reluctance is a forgone conclusion; every editor/journalist has their own why. There is an excess of voters who compulsively give Gov the benefit of the doubt. At least where Gov favors it's interests over ours. (modern version: Where Gov acts in good faith and places our interest first, wound-up voters endlessly crap all over that [because agendas].)
- markus_zhang 2y ago
  China did publish some information once for a while. But the information is usually in Chinese and lacking details.
- mmonaghan 2y ago
  Everyone is always attacking everyone else at all times, its not just the US.
  - Nectar0516 2y ago
    Well, yes, but we hear quite a bit about China or Russia or North Korea or wherever attacking us. I've quite literally seen people ask "why don't we attack them back?"
mmooss 2y ago
> The Northwestern Polytechnical University had allegedly suffered multiple breaches throughout the years where several pieces of malware uncovered in prior investigations (prior to Shadow Broker’s leak) were allegedly the same tools described in the Shadow Broker’s leak. What is Shadow Broker, does anyone know?
- not_a_bot_4sho 2y ago
  > What is Shadow Broker, does anyone know? Nyet
- TecoAndJix 2y ago
  https://en.wikipedia.org/wiki/The_Shadow_Brokers https://en.wikipedia.org/wiki/The_Shadow_Brokers
mmooss 2y ago
> 1. Attack Times > * One of the frameworks used by TAO that was forensically uncovered during the incident named “NOPEN” requires human operation. As such, a lot of the attack required hands-on-keyboard and data analysis of the incident timeline showed 98% of all the attacks occurred during 9am – 4pm EST (US working hours). > * There were zero cyber-attacks on Saturdays and Sundays with all attacks centralised between Mon-Fri. > * No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. > * No attacks occurred during Christmas. It's surprising the NSA would be this sloppy and obvious, or maybe they don't care about attribution in this situation, or maybe someone else did it. But I've read attribution of Chinese attackers using work hours and thought the attackers were sloppy and obvious. > A key observation from the Chinese case notes was the extensive use of big data analysis, particularly in tracking “hands-on keyboard” activity. This approach enabled Qihoo 360 to identify patterns, such as the alleged absence of activity on Memorial Day, and precisely documenting the operational hours of the attackers, allowing 360 to isolate activity to Monday-Friday, EST working hours. If the blogger's claim of experience is true, they must know about the things I've read. I wonder what they are thinking of.
klooney 2y ago
> 98% of all the attacks occurred during 9am – 4pm EST (US working hours). > There were zero cyber-attacks on Saturdays and Sundays with all attacks centralised between Mon-Fri. > No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. > No attacks occurred during Christmas. Come on guys, if Satoshi can cover his timezones tracks, so can you.
iudqnolq 2y ago
> Second date has capabilities of network eavesdropping, MiTM, and code injection This is probably a dumb question but doesn't that require an SSL cert? Obviously the NSA can get someone to issue a cert for a domain they don't own but wouldn't that be visible? Couldn't you have every user device log the SSL certs it sees to detect this attack? What about CT?

232 points by davikr 2y ago

themark 2y ago

It seems like the lack of operations during US holidays would be a big oversight.

vednig 2y ago

[flagged]

rdtsc 2y ago
> can I comment freely here Sure, we all have the freedom of speech here. Will you have freedom after speech though, I don't know? It depends on your particular situation ;-)
- vednig 2y ago
  nothing it's just two biggest intelligence agencies fighting, I think keeping quiet is the safest bet
  - inetknght 2y ago
    Sometimes keeping quiet isn't the best form of defense though. So it really does depend on your situation.
- boredpeter 2y ago
  [dead]
deleted 2y ago
[deleted]

rdtsc 2y ago

> No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. Simple but effective. A good non-NSA agency should also learn from this to be able to effectively false-flag as NSA, as long as they are flexible enough to allow off-hours and overtime pay and remember to respect the US federal holidays. > Two zero-days were used to breach any company with SunOS-exposed systems in neighbouring countries to China SunOS? Wonder if it's because it's genuinely used still quite a bit or they simply had zero-days for it since many of those are old and unpatched?

formerly_proven 2y ago
Assuming they mean Solaris, it's still technically maintained, at least in the Oracle sense (of both "technically" and "maintained").
- rdtsc 2y ago
  I assumed that much, SunOS is pretty ancient, last version was what, in early 1990s? Though, Solaris still would report a SunOS 5.$solarisver version or something like that. So I guess we can say it is a "SunOS" box if we wanted to.
  - jjtheblunt 2y ago
    SunOS 4.x is the BSD lineage and SunOS 5.x the Solaris lineage, or at least was when i worked at Sun.
zdragnar 2y ago
The same strategy is used to attribute attacks against US based targets by Russian, N.Korean and Iranian and other state or state sponsored actors. Time of day, holidays, etc. are (in tandem with other evidence) considered to be surprisingly reliable. If I were in charge of things I'd like to think that this sort of thing would be the first step I'd take to cover my tracks, but I still hear cyber security firms using it in their attributions.
- kokx 2y ago
  The type of work the people working at an APT do, is mainly office work, while it still is very much "hands-on-keyboard" work (so you cannot set an action to automatically occur when nobody is checking the results in the middle of the night). You might want to try shuffling this up when you are in charge, but your (usually highly skilled and expensive) employees probably don't want to be working weird shifts all the time. Especially when they have families. It also may not be worth it. Generally APT's want to stay under the radar while they are executing. But after the goals have been reached, most of the time it doesn't matter much if they get attributed. We have yet to see real consequences against any APT's. So paying your employees more to work night shifts, likely doesn't stack up against the consequences of attribution.

markus_zhang 2y ago

This is really interesting. I wonder how red-teams in State sponsored teams operate in real life. I guess every one has an NDA, but would love to get a general idea. I assume it's a jungle out there, so teams need to protect themselves 24/7/365 and I'm surprised to find no activities in holidays.

breppp 2y ago

It seems like the most efficient way of detecting NSA tools is a regular expression of two all caps dictionary words

contingencies 2y ago
BadJoke LoveIt. Similarly, 0day ABNF to identify probable NSA front companies: [optional-firstname] <surname> [optional-adjective] <"systems">
lazide 2y ago
BRILLANT SPECTRE finds your joke in bad taste (/s)

motohagiography 2y ago

glad to see the same basic tradecraft from 90s hacking, only very refined and industrialized. it's a durable skill. the focus on switches and routers is very pro, as they are the most opaque infra with the fewest forensic capabilities. iot is less reliable as RE'ing cheap devices and firmware for IoCs is accessible, where almost nobody outside the IC did core gear (word to phenolit from back in the day tho). the traffic redirection is interesting in that i would be curious if they rate limited it or used on device selectors in their implant to redirect traffic. the trade off between memory caching packets to sort on selectors vs.stealthy throughput would have been a fun design meeting. hunting these kinds of actors would be supremely fun. the main thing that protects them is few outside massive bureaucracies really care enough or find it economical, as the rewards are more in finding new zero day and not hunting state level threat actors. the exceptions who do (p0, citizenlab etc) are attached to massive orgs and dont really led themselves to privateering. amazing write up anyway.

hnthrowaway0315 2y ago
Thanks for sharing. You seem to have some knowledge of the APT scene. Can you please elaborate on the following points? - the focus on switches and routers is very pro (did you mean the defenders or the attackers?) - What kind of knowledge is a starting point to hunt these players? I assume very good Linux system admin skills that can protect the whole system well enough to maybe only allow some obscure entries, and then have enough RE/Red team knowledge to know how to focus on these entries. Does it make sense? - How do those APTs operate? I'd imagine there are at least 3 groups of people, group 1 = people who make tools, do analysis, RE and such -- they are the support guys; group 2 = people who directly execute the operations -- they don't need very in-depth knowledge but need to a whole range of knowledge to know where to look at and how to best use the tools; group 3 = blue team who protects the whole facility. And of course there are managers, admins, etc.

thaumasiotes 2y ago

> These insights stem from extensive research I did on Weixin Someone doing extensive research on Weixin might ordinarily realize that it's called "Wechat" in English.

boston_clone 2y ago
Wechat is the internationalized version; Weixin is for mainland China. https://duckduckgo.com/?q=weixin+vs+wechat https://duckduckgo.com/?q=weixin+vs+wechat
- thaumasiotes 2y ago
  I guess if ChatGPT told you to glue the cheese onto your pizza, you'd eat it that way. Wechat is also the mainland version. It's always been Wechat, and in particular it was Wechat years before they kicked me off of the mainland Chinese version† for registering an American phone number. The reality is exactly what I already told you: the app's name is 微信 in Chinese and Wechat in English. This is why coverage of Wechat's extensive market penetration in China always calls it "Wechat". Don't believe everything you read in the results of the stupidest web search you know how to run. If you try facts, you might like them! † By the way, "version" is really stretching things. There is no difference in the app. They don't keep your data within China, you go into a different advertising segment, and by default you connect to a different in-app sticker shop.
  - boston_clone 2y ago
    That would have been great to include with your initial comment instead of seemingly picking at nits and then making inflammatory comments. Always love the use of a dagger though, I don't see them too often online!
  - est 2y ago
    > There is no difference in the app There are tons of difference. Wexin has more adware/spyware, no CallKit on iOS, local payments. There's even a chat firewall between wexin and wechat.

kridsdale1 2y ago

I love the Windows 98 clip art.

alphalite 2y ago

I originally came here to comment how crazy it seems that DoD employees at NSA cannot be bothered to cover their tracks by working nonstandard hours/holidays (obviously Mil & Intel folks do this, they even get deployed!). But the thought occurred to me that attribution to NSA was likely a desired outcome here (“We can hack you too”) and there are probably many people at NSA working nonstandard hours/days to prevent attribution. I think the English language aspect is much more interesting and difficult/impossible to prevent.

quanto 2y ago
I agree, but I would go further and say (written) English language is as easy to emulate. There are technical people with great written English skills who will give away their non-Anglophone identities at the first sentence they speak.
maxglute 2y ago
Technical talent with transferable skills for higher paying work aren't incentivized to work on deployment schedule. But really, why assume NSA capable of obfuscating against PRC also stacked with talent. The parsimonious answer is then why bother, everyone knows they're deep in each others networks for decades and will continue to be. So let the hackers have their weekends.
kelipso 2y ago
It sounds exciting and all but it’s basically a boring government office job, the employees mostly have families, expect regular work hours, etc.

quanto 2y ago

> Chinese cyber organizations openly acknowledge and publicize their partnerships. This openness was particularly interesting to observe and may be influenced by cultural factors, such as the Confucian emphasis on shared knowledge and a political framework that encourages collective efforts. I or anyone outside obviously cannot verify the technical details. However, the above statement struck as particularly uninformed. As any engineer in East Asia can tell you, there is nothing especially collaborative about tech in Confucian culture; if anything, the engineers in that region admire the free speech and discussion traditionally prized in the Western culture. Calling Chinese political framework, especially in the context of national security, conducive to open public discussion was quite ironic to see. Edit: the punchline is this. If a friend who is always secretive and deceptive about his personal life is suddenly openly discussing his life, what does that say about the details he just disclosed and/or the situation he is currently in? source: I regularly work with engineers from that culture and studied relevant geopolitics.

sangnoir 2y ago
> As any engineer in East Asia can tell you, there is nothing especially collaborative about tech in Confucian culture IIRC, Bunnie (Huang) mentioned how freely data flows in Shenzhen for hardware hacking, versus pulling teeth trying to get data sheets for components from western component makers. > source: I regularly work with engineers from that culture and studied relevant geopolitics. (Winces)
- TeMPOraL 2y ago
  > how freely data flows in Shenzhen for hardware hacking, versus pulling teeth trying to get data sheets for components from western component makers. That's different though. Shenzhen is where electronics factories are; they get the datasheets from western companies, but because said western companies can't really enforce their IP over there, the locals get to ignore it and use the datasheets however it's convenient for them.
  - tschwimmer 2y ago

dmix 2y ago

> In total, 54 jump servers and 5 proxy servers were used to perform the attack coming from 17 different countries including Japan, South Korea, Sweden, Poland and Ukraine with 70% of the attacks coming from China’s neighbouring countries. I'm guessing this is so when they do data exfiltration (and hosted MITM) it's not sending a ton of data to a single server, but spreads them out. > SECONDDATE: This tool was allegedly used by TAO (NSA) to hack into the office intranet of the University. Attribution of SECONDDATE was discovered through collaboration with other industry partners. They found thousands of network devices running this spyware – where the communications went back to NSA servers located in Germany, Japan, South Korea and Taiwan. This tool was used to redirect user traffic to the FOXACID platform. > SECONDDATE – Backdoor installed on network edge devices such as gateways and border routers to filter, and hijack mass amounts of data in a MiTM. This was placed on the border routers of the University to hijack traffic to redirect to NSA’s FOXACID platform.

ThinkBeat 2y ago

Given how US is attacking their enemies and at times their allies, 24/7 it is amazing how little we ever hear about it.

Mountain_Skies 2y ago
If we were in Russia or China, we'd likely hear about US actions in this area quite a bit more. With allies, well, there's a lot of mutual back scrubbing going on.
WarOnPrivacy 2y ago
Regarding unwarranted surveillance of Americans not suspected of a crime (and by extension, our allies): Throughout my longish life, these things have not changed. ~All federal politicians support/expand it and then obfuscate their part. News orgs don't/won't cover it (most of the time). The reason is every possible reason. Stated differently: Reluctance is a forgone conclusion; every editor/journalist has their own why. There is an excess of voters who compulsively give Gov the benefit of the doubt. At least where Gov favors it's interests over ours. (modern version: Where Gov acts in good faith and places our interest first, wound-up voters endlessly crap all over that [because agendas].)
markus_zhang 2y ago
China did publish some information once for a while. But the information is usually in Chinese and lacking details.
mmonaghan 2y ago
Everyone is always attacking everyone else at all times, its not just the US.
- Nectar0516 2y ago
  Well, yes, but we hear quite a bit about China or Russia or North Korea or wherever attacking us. I've quite literally seen people ask "why don't we attack them back?"

mmooss 2y ago

> The Northwestern Polytechnical University had allegedly suffered multiple breaches throughout the years where several pieces of malware uncovered in prior investigations (prior to Shadow Broker’s leak) were allegedly the same tools described in the Shadow Broker’s leak. What is Shadow Broker, does anyone know?

not_a_bot_4sho 2y ago
> What is Shadow Broker, does anyone know? Nyet
TecoAndJix 2y ago
https://en.wikipedia.org/wiki/The_Shadow_Brokers https://en.wikipedia.org/wiki/The_Shadow_Brokers

mmooss 2y ago

> 1. Attack Times > * One of the frameworks used by TAO that was forensically uncovered during the incident named “NOPEN” requires human operation. As such, a lot of the attack required hands-on-keyboard and data analysis of the incident timeline showed 98% of all the attacks occurred during 9am – 4pm EST (US working hours). > * There were zero cyber-attacks on Saturdays and Sundays with all attacks centralised between Mon-Fri. > * No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. > * No attacks occurred during Christmas. It's surprising the NSA would be this sloppy and obvious, or maybe they don't care about attribution in this situation, or maybe someone else did it. But I've read attribution of Chinese attackers using work hours and thought the attackers were sloppy and obvious. > A key observation from the Chinese case notes was the extensive use of big data analysis, particularly in tracking “hands-on keyboard” activity. This approach enabled Qihoo 360 to identify patterns, such as the alleged absence of activity on Memorial Day, and precisely documenting the operational hours of the attackers, allowing 360 to isolate activity to Monday-Friday, EST working hours. If the blogger's claim of experience is true, they must know about the things I've read. I wonder what they are thinking of.

klooney 2y ago

> 98% of all the attacks occurred during 9am – 4pm EST (US working hours). > There were zero cyber-attacks on Saturdays and Sundays with all attacks centralised between Mon-Fri. > No attacks occurred during Memorial Day and Independence Day holidays which were unique American holidays. > No attacks occurred during Christmas. Come on guys, if Satoshi can cover his timezones tracks, so can you.

iudqnolq 2y ago

> Second date has capabilities of network eavesdropping, MiTM, and code injection This is probably a dumb question but doesn't that require an SSL cert? Obviously the NSA can get someone to issue a cert for a domain they don't own but wouldn't that be visible? Couldn't you have every user device log the SSL certs it sees to detect this attack? What about CT?