5 ms·

Let's pretend you work for a non-US state intelligence agency. How would you find Hesgeth's personal computer in his office on the public Internet? A genuine th

by mmooss 2y ago

Let's pretend you work for a non-US state intelligence agency. How would you find Hesgeth's personal computer in his office on the public Internet? A genuine thought experiment.

o11c 2y ago
Write an article that he's likely to be interested in reading, spread the link, then mine the browser data just like every other website.
- wmf 2y ago
  Yep. The CIA uses these same techniques to track foreigners of interest (e.g. Putin's entourage) so we should assume other countries are attempting to use similar techniques on American officials.
- JumpCrisscross 2y ago
  Literally just @ him on X. These are the moments of strategic ineptitude you hoard zero days for decades to score.
  - Teever 2y ago
    I don't want to derail the conversation too much with this but this is the kind of thing that blows my mind with seeing obscenely wealthy/powerful people like Musk and Trump on social media. At some level of wealth you reach a point where no one can get to you physically. You're completely physically safe and isolated and can't be hurt. That means that the only way someone can get to you is through communicating with you and making you hurt yourself. That means that social media is your only weakness. This is how adversaries can affect your plans and goals and disrupt your mind. Yet so many of these people seem so oblivious to this and are as terminally online as your average 4channer or facebook mom. Does this speak to some sort of weakness in these kinds of people or the addictiveness of social media?
    - JumpCrisscross 2y ago
      > Does this speak to some sort of weakness in these kinds of people or the addictiveness of social media? They're online because their followers are online. Social media may be the actual lead pipes to our empire [1]. So yes, they are absolutely weaker than leaders with digital hygiene. But the reason they're there is because the American public is similarly weaker. [1] https://penelope.uchicago.edu/~grout/encyclopaedia_romana/wine/leadpoisoning.html https://penelope.uchicago.edu/~grout/encyclopaedia_romana/wi...
      - Teever 2y ago
        Sure, I get that there's utility in having an online presence, but these people are wealthy/powerful so they can afford to have someone do that work for them with the public non the wiser.
        sjsdaiuasgdia 2y ago
        That wouldn't give that kind of narcissist the same level of satisfaction as they get from the army of sycophants clicking "Like" on their latest hot take. I think that direct connection is particularly attractive to the right kind of narcissist. Might be the best drug they've ever had.
      - feisty0630 2y ago
        > Social media may be the actual lead pipes to our empire [1]. In America, the lead pipes of their empire are the literal lead pipes still in use all over the country.
    - deleted 2y ago
      [deleted]
    - WhompingWindows 2y ago
      Sorry, you think it's impossible to hurt Trump? Are you forgetting the bullet that passed an inch from his brain? A crazy person with a gun can change history in a second, and it would've been a terrible violent occurrence throughout society if it had come to pass.
punnerud 2y ago
You could locate the traffic to The White House using this triangulation trick: https://news.ycombinator.com/item?id=42780816 https://news.ycombinator.com/item?id=42780816 Title:”0-click deanonymization attack targeting Signal, Discord, other platforms” Maybe not 0-click anymore, but still applies if the user browsing the internet.
- ronnieboy493 2y ago
  Would that be illegal or are you simply just using public(?) data available to you?
overfeed 2y ago
Compromise the device of one of his contact and send him a juicy link via telegram that renders "Error: Not viewable on mobile" when opened a phone. Bonus points if the link has 0-day malware dropper
- mmooss 2y ago
  > Compromise the device of one of his contact ... Yes, I should have thought of that old and obvious one. It opens up a universe of possibilities.
rasz 2y ago
I would make Witkoff sit on his ass in hotel for 8 hours while my team one room over wirelessly breaks into his phone and gets into those Signal chats. https://news.sky.com/story/trumps-fixer-was-made-to-wait-eight-hours-to-meet-putin-it-felt-like-a-classic-power-play-13328525 https://news.sky.com/story/trumps-fixer-was-made-to-wait-eig... His personal PC? Send Big Ballz his way to do some upgrades https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... maybe a free Starlink dish https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html https://www.nytimes.com/2025/03/17/us/politics/elon-musk-sta...
- CoastalCoder 2y ago
  This assumes that the patsy needs to never discover that his device was compromised. I'm guessing there are a few scenarios where they could be tortured / blackmailed into compliance, even if it meant that the DoD would know about it in a day or two, and it would still be worth it. E.g., shortly before a real fight over Taiwan began. I really, really hope Hegseth gets his OPSEC act together, yesterday.
  - mmooss 2y ago
    Once they're in, often professionals will create many forms of hidden access and then remove evidence of the initial breach.
snowwrestler 2y ago
You would just send him a link in a Signal message. His phone number is widely known and he has Signal installed on his desktop computer. Signal’s protocol secures the message in transit. But their desktop app may or may not have client-side vulnerabilities. And if he clicks a link, you’re out of Signal and into the browser. If the link downloads a file, you’re into the OS.
- mmooss 2y ago
  There is a Signal social engineering vulnerability where the attacker gets people to click a link that links the attacker's device to the target's Signal account.
  - mrguyorama 2y ago
    There is a Signal social engineering vulnerability where you just happen to exist and have a Signal account and the SecDef invites you to what should be classified communications. I don't know why people think these incompetent buffoons would need 0-day vulnerabilities to get. Trump just tweeted pictures from classified spy satellites. If you want to know a secret of America's right now, you can either purchase it for a small amount out of Trump's bathroom, or just needle him with a "I bet you don't know/have...." and he will tell you whatever you want to know as a "Brag". At least one of the members of that chat was IN MOSCOW, I think even IN THE KREMLIN at the time. Several Republican party leaders were in a meeting with Putin in Moscow on July 4th 2018. They aren't TRYING to keep info out of the Kremlin's hands. They are so incompetent they couldn't keep it out of Beijing's hands if they wanted to.
gilbetron 2y ago
Drop a usb stick outside of his house. 100% he'll pick it up and plug it in. 1000% if you brand it with his favorite whiskey.

by mmooss 2y ago

Let's pretend you work for a non-US state intelligence agency. How would you find Hesgeth's personal computer in his office on the public Internet? A genuine thought experiment.

o11c 2y ago

Write an article that he's likely to be interested in reading, spread the link, then mine the browser data just like every other website.

wmf 2y ago
Yep. The CIA uses these same techniques to track foreigners of interest (e.g. Putin's entourage) so we should assume other countries are attempting to use similar techniques on American officials.
JumpCrisscross 2y ago
Literally just @ him on X. These are the moments of strategic ineptitude you hoard zero days for decades to score.
- Teever 2y ago
  I don't want to derail the conversation too much with this but this is the kind of thing that blows my mind with seeing obscenely wealthy/powerful people like Musk and Trump on social media. At some level of wealth you reach a point where no one can get to you physically. You're completely physically safe and isolated and can't be hurt. That means that the only way someone can get to you is through communicating with you and making you hurt yourself. That means that social media is your only weakness. This is how adversaries can affect your plans and goals and disrupt your mind. Yet so many of these people seem so oblivious to this and are as terminally online as your average 4channer or facebook mom. Does this speak to some sort of weakness in these kinds of people or the addictiveness of social media?
  - JumpCrisscross 2y ago
    > Does this speak to some sort of weakness in these kinds of people or the addictiveness of social media? They're online because their followers are online. Social media may be the actual lead pipes to our empire [1]. So yes, they are absolutely weaker than leaders with digital hygiene. But the reason they're there is because the American public is similarly weaker. [1] https://penelope.uchicago.edu/~grout/encyclopaedia_romana/wine/leadpoisoning.html https://penelope.uchicago.edu/~grout/encyclopaedia_romana/wi...
    - Teever 2y ago
      Sure, I get that there's utility in having an online presence, but these people are wealthy/powerful so they can afford to have someone do that work for them with the public non the wiser.
      - sjsdaiuasgdia 2y ago
        That wouldn't give that kind of narcissist the same level of satisfaction as they get from the army of sycophants clicking "Like" on their latest hot take. I think that direct connection is particularly attractive to the right kind of narcissist. Might be the best drug they've ever had.
    - feisty0630 2y ago
      > Social media may be the actual lead pipes to our empire [1]. In America, the lead pipes of their empire are the literal lead pipes still in use all over the country.
  - deleted 2y ago
    [deleted]
  - WhompingWindows 2y ago
    Sorry, you think it's impossible to hurt Trump? Are you forgetting the bullet that passed an inch from his brain? A crazy person with a gun can change history in a second, and it would've been a terrible violent occurrence throughout society if it had come to pass.

punnerud 2y ago

You could locate the traffic to The White House using this triangulation trick: https://news.ycombinator.com/item?id=42780816 https://news.ycombinator.com/item?id=42780816 Title:”0-click deanonymization attack targeting Signal, Discord, other platforms” Maybe not 0-click anymore, but still applies if the user browsing the internet.

ronnieboy493 2y ago
Would that be illegal or are you simply just using public(?) data available to you?

overfeed 2y ago

Compromise the device of one of his contact and send him a juicy link via telegram that renders "Error: Not viewable on mobile" when opened a phone. Bonus points if the link has 0-day malware dropper

mmooss 2y ago
> Compromise the device of one of his contact ... Yes, I should have thought of that old and obvious one. It opens up a universe of possibilities.

rasz 2y ago

I would make Witkoff sit on his ass in hotel for 8 hours while my team one room over wirelessly breaks into his phone and gets into those Signal chats. https://news.sky.com/story/trumps-fixer-was-made-to-wait-eight-hours-to-meet-putin-it-felt-like-a-classic-power-play-13328525 https://news.sky.com/story/trumps-fixer-was-made-to-wait-eig... His personal PC? Send Big Ballz his way to do some upgrades https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-... maybe a free Starlink dish https://www.nytimes.com/2025/03/17/us/politics/elon-musk-starlink-white-house.html https://www.nytimes.com/2025/03/17/us/politics/elon-musk-sta...

CoastalCoder 2y ago
This assumes that the patsy needs to never discover that his device was compromised. I'm guessing there are a few scenarios where they could be tortured / blackmailed into compliance, even if it meant that the DoD would know about it in a day or two, and it would still be worth it. E.g., shortly before a real fight over Taiwan began. I really, really hope Hegseth gets his OPSEC act together, yesterday.
- mmooss 2y ago
  Once they're in, often professionals will create many forms of hidden access and then remove evidence of the initial breach.

snowwrestler 2y ago

You would just send him a link in a Signal message. His phone number is widely known and he has Signal installed on his desktop computer. Signal’s protocol secures the message in transit. But their desktop app may or may not have client-side vulnerabilities. And if he clicks a link, you’re out of Signal and into the browser. If the link downloads a file, you’re into the OS.

mmooss 2y ago
There is a Signal social engineering vulnerability where the attacker gets people to click a link that links the attacker's device to the target's Signal account.
- mrguyorama 2y ago
  There is a Signal social engineering vulnerability where you just happen to exist and have a Signal account and the SecDef invites you to what should be classified communications. I don't know why people think these incompetent buffoons would need 0-day vulnerabilities to get. Trump just tweeted pictures from classified spy satellites. If you want to know a secret of America's right now, you can either purchase it for a small amount out of Trump's bathroom, or just needle him with a "I bet you don't know/have...." and he will tell you whatever you want to know as a "Brag". At least one of the members of that chat was IN MOSCOW, I think even IN THE KREMLIN at the time. Several Republican party leaders were in a meeting with Putin in Moscow on July 4th 2018. They aren't TRYING to keep info out of the Kremlin's hands. They are so incompetent they couldn't keep it out of Beijing's hands if they wanted to.

gilbetron 2y ago

Drop a usb stick outside of his house. 100% he'll pick it up and plug it in. 1000% if you brand it with his favorite whiskey.