8 ms·

How the NSA Got So Smart So Fast

30 points by julienchastang 13y ago

joeguilmette 13y ago
I wonder if the NSA will open source their server architecture?
- mindcrime 13y ago
  Believe it or not, they do open source some of their stuff, sometimes. See, for example, Accumulo.[1][2] [1]: http://en.wikipedia.org/wiki/Apache_Accumulo http://en.wikipedia.org/wiki/Apache_Accumulo [2]: http://accumulo.apache.org/ http://accumulo.apache.org/
  - sliverstorm 13y ago
    Another classic example, SELinux.[1] [1]: http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overview http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overvie...
    - jlgaddis 13y ago
      SELinux saved my ass years ago, preventing exploitation of an outdated/vulnerable PHP application. Since then, it gets installed on every production server I deploy. Those who simply turn it off because it's a PITA are doing themselves a huge disservice.
      - daned 13y ago
        Would love to hear details on how it protected you.
        jlgaddis 13y ago
        An outdated version of a PHP application (which had a public vulnerability) was attacked, allowing arbitrary code execution. The "exploit" attempted to download and execute a remote file via TFTP. Ultimately, a "remote shell" would end up being installed on the server. SELinux, however, prevented the TFTP transfer from happening. We saw this in the audit logs, investigated, and discovered what had happened (and, of course, updated the PHP application). If the attack had succeeded, I'm convinced that it eventually would have ended up as a full ("root-level") compromise.
  - snowwrestler 13y ago
    I believe NSA has a dual mandate. We are hearing a lot lately about their efforts to discover and use intelligence via electronic means, but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications--this is where efforts like SELinux and the guide to securing OS X come from.
    - fnordfnordfnord 13y ago
      >but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications How can anyone find them credible in such a role with such huge glaring conflicts of interests, and their demonstrated lack of trustworthiness?
      - toomuchtodo 13y ago
        One hand doesn't know what the other hand is doing. Just because the DOD bombs civilians with drones in far off doesn't mean we should hold the National Park Service in the same light.
        fnordfnordfnord 13y ago
        The National Park Service isn't a division of the DOD.
        toomuchtodo 13y ago
        They're all a part of the US government.
        fnordfnordfnord 13y ago
        So all US government agencies are in effect one? What am I to make of the GAO constantly finding fraud and waste? A clever subterfuge?
mindcrime 13y ago
The question(s) I have about the NSA aren't "Do they use Hadoop, Spark, S4, MPI, OpenMP, etc." but rather things like: 1. Do they already have a functional quantum computer, capable of rendering most modern encryption useless? 2. Do they have a mathematical breakthrough that allows them to factor products of large prime numbers multiplied together, far faster than anyone suspects - which would render most / all modern encryption useless? 3. Have they planted backdoors and vulnerabilities in popular, widely distributed hardware / software platforms? etc.
- Zigurd 13y ago
  Number 3 is the most likely, along with pushbutton tools that automate attacking and extracting information from endpoint devices. The market among state actors for zero-day exploits is documented, while the other possibilities are out there with other "secret weapon" theories that are predicated on fundamental scientific breakthroughs.
  - dmix 13y ago
    Yeah, I'm not buying that the NSA has some crazy advanced technology that is kept secret. There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them? It's more likely their power is their access to the latest zero-day exploits via sourcing information - something they are extremely good at.
    - mindcrime 13y ago
      There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them? More to the point, they don't (presumably) have some secret pipeline of highly talented people. I mean, the pool of graduates in mathematics, statistics, computer science, etc., year in and year out, is available to everyone, NSA, other public sector, other private sector, etc. And while the NSA probably prioritizes hiring brilliant math wonks and what-not, so do wall street hedge fund companies, tech companies, etc. And given that at least some small percentage of "really smart people" would probably refuse to work for the NSA just on ideological grounds, I don't see any reason to believe that they have a monopoly on smart people who can do crypto research and what-not. As for their financing, however... I don't know. I'm not real big on conspiracy theories, but I don't doubt the existence of secret budgets and "off the books" stuff to fund certain government programs. I mean, just go back to the Iran/Contra affair[1] and you can see that some sneaky stuff does go on, at least on occasion. [1]: http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair
vsviridov 13y ago
Paywall for me... :(
- adamtj 13y ago
  http://lmgtfy.com/?q=How+the+NSA+Could+Get+So+Smart+So+Fast# http://lmgtfy.com/?q=How+the+NSA+Could+Get+So+Smart+So+Fast#
  - fnordfnordfnord 13y ago
    Most of the top links are just teasers which link to the paywalled story. Here is a complete (I assume) version. http://finance.yahoo.com/news/nsa-could-smart-fast-235100722.html?.tsrc=mobifone http://finance.yahoo.com/news/nsa-could-smart-fast-235100722...
    - adamtj 13y ago
      When I posted the link, the top result was the actual story. Simply add "site:wsj.com" to the search and the top link should be correct. If you click the link from google, you avoid the paywall.
    - vsviridov 13y ago
      Thanks, that worked :)
caycep 13y ago
welp if the PLA has a backdoor on my Shenzhen-made electronic goodies, I need an NSA backdoor in order to keep em honest. Also any conversation with "backdoor" could get dirty fast...
omonra 13y ago
Article behind paywall. Here is link that works: http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-252859/ http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2...

I wonder if the NSA will open source their server architecture?

mindcrime 13y ago
Believe it or not, they do open source some of their stuff, sometimes. See, for example, Accumulo.[1][2] [1]: http://en.wikipedia.org/wiki/Apache_Accumulo http://en.wikipedia.org/wiki/Apache_Accumulo [2]: http://accumulo.apache.org/ http://accumulo.apache.org/
- sliverstorm 13y ago
  Another classic example, SELinux.[1] [1]: http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overview http://en.wikipedia.org/wiki/Security-Enhanced_Linux#Overvie...
  - jlgaddis 13y ago
    SELinux saved my ass years ago, preventing exploitation of an outdated/vulnerable PHP application. Since then, it gets installed on every production server I deploy. Those who simply turn it off because it's a PITA are doing themselves a huge disservice.
    - daned 13y ago
      Would love to hear details on how it protected you.
      - jlgaddis 13y ago
        An outdated version of a PHP application (which had a public vulnerability) was attacked, allowing arbitrary code execution. The "exploit" attempted to download and execute a remote file via TFTP. Ultimately, a "remote shell" would end up being installed on the server. SELinux, however, prevented the TFTP transfer from happening. We saw this in the audit logs, investigated, and discovered what had happened (and, of course, updated the PHP application). If the attack had succeeded, I'm convinced that it eventually would have ended up as a full ("root-level") compromise.
- snowwrestler 13y ago
  I believe NSA has a dual mandate. We are hearing a lot lately about their efforts to discover and use intelligence via electronic means, but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications--this is where efforts like SELinux and the guide to securing OS X come from.
  - fnordfnordfnord 13y ago
    >but I believe they are also responsible for providing guidance on how the U.S. can secure its own electronic communications How can anyone find them credible in such a role with such huge glaring conflicts of interests, and their demonstrated lack of trustworthiness?
    - toomuchtodo 13y ago
      One hand doesn't know what the other hand is doing. Just because the DOD bombs civilians with drones in far off doesn't mean we should hold the National Park Service in the same light.
      - fnordfnordfnord 13y ago
        The National Park Service isn't a division of the DOD.
        toomuchtodo 13y ago
        They're all a part of the US government.
        fnordfnordfnord 13y ago
        So all US government agencies are in effect one? What am I to make of the GAO constantly finding fraud and waste? A clever subterfuge?

The question(s) I have about the NSA aren't "Do they use Hadoop, Spark, S4, MPI, OpenMP, etc." but rather things like: 1. Do they already have a functional quantum computer, capable of rendering most modern encryption useless? 2. Do they have a mathematical breakthrough that allows them to factor products of large prime numbers multiplied together, far faster than anyone suspects - which would render most / all modern encryption useless? 3. Have they planted backdoors and vulnerabilities in popular, widely distributed hardware / software platforms? etc.

Zigurd 13y ago
Number 3 is the most likely, along with pushbutton tools that automate attacking and extracting information from endpoint devices. The market among state actors for zero-day exploits is documented, while the other possibilities are out there with other "secret weapon" theories that are predicated on fundamental scientific breakthroughs.
- dmix 13y ago
  Yeah, I'm not buying that the NSA has some crazy advanced technology that is kept secret. There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them? It's more likely their power is their access to the latest zero-day exploits via sourcing information - something they are extremely good at.
  - mindcrime 13y ago
    There are highly skilled and better financed tech companies with huge R&D teams. Why would the NSA be able to outperform them? More to the point, they don't (presumably) have some secret pipeline of highly talented people. I mean, the pool of graduates in mathematics, statistics, computer science, etc., year in and year out, is available to everyone, NSA, other public sector, other private sector, etc. And while the NSA probably prioritizes hiring brilliant math wonks and what-not, so do wall street hedge fund companies, tech companies, etc. And given that at least some small percentage of "really smart people" would probably refuse to work for the NSA just on ideological grounds, I don't see any reason to believe that they have a monopoly on smart people who can do crypto research and what-not. As for their financing, however... I don't know. I'm not real big on conspiracy theories, but I don't doubt the existence of secret budgets and "off the books" stuff to fund certain government programs. I mean, just go back to the Iran/Contra affair[1] and you can see that some sneaky stuff does go on, at least on occasion. [1]: http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair http://en.wikipedia.org/wiki/Iran%E2%80%93Contra_affair

vsviridov 13y ago

Paywall for me... :(

adamtj 13y ago
http://lmgtfy.com/?q=How+the+NSA+Could+Get+So+Smart+So+Fast# http://lmgtfy.com/?q=How+the+NSA+Could+Get+So+Smart+So+Fast#
- fnordfnordfnord 13y ago
  Most of the top links are just teasers which link to the paywalled story. Here is a complete (I assume) version. http://finance.yahoo.com/news/nsa-could-smart-fast-235100722.html?.tsrc=mobifone http://finance.yahoo.com/news/nsa-could-smart-fast-235100722...
  - adamtj 13y ago
    When I posted the link, the top result was the actual story. Simply add "site:wsj.com" to the search and the top link should be correct. If you click the link from google, you avoid the paywall.
  - vsviridov 13y ago
    Thanks, that worked :)

caycep 13y ago

welp if the PLA has a backdoor on my Shenzhen-made electronic goodies, I need an NSA backdoor in order to keep em honest. Also any conversation with "backdoor" could get dirty fast...

omonra 13y ago

Article behind paywall. Here is link that works: http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-252859/ http://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2...