3 ms·

"forensic analysis revealed an intruder had executed commands that appeared to involve search and [removal] of data. This party also used sophisticated methods

"forensic analysis revealed an intruder had executed commands that appeared to involve search and [removal] of data. This party also used sophisticated methods to remove all possible indications of unauthorized activity, and alter system times to cause further confusion." Doesn't sound so dumb to me. Specifically removing data and then covering up traces of being there - sounds a little more than a 'script-bound teenager'. And now, in light of NSA/PRISM - we have a good suspect is in a case like this. At the very least, there is grounds here to issue a suponea to the NSA since they should have plenty of data about her internet connection that could help in determining the responsible party.

tptacek 13y ago
You think the forensics capabilities of the Washington Post have a chance of detecting NSA? You think if NSA breaks into a laptop, it would be apparent to a forensics person that they'd "covered up traces of being there"? Teenagers had rootkits that swapped out system libraries to hide processes and binaries back in 1996. The very, very lame teenagers had utmp and wtmp editors to "cover up their traces". It's worth taking a moment to examine your thought processes here. "Now, in light of NSA/PRISM, we have a good suspect"? We clearly do not.
- hga 13y ago
  Ummm, this is as reported by CBS as reported by whomever they hired to do the forensic analysis. And yes, if "the NSA" were to break in it's possible they might not be able to do it tracelessly. E.g. no one as of yet is suspecting a black bag job.
  - tptacek 13y ago
    We are thus far discussing technical details of an attack that would be easy for a teenager to have carried out in 1999, let alone 2013, and are attributing them to the world's most experienced computer security organization. I think that's happening because it's much more fun to think about NSA breaking into media laptops than it is to think about random Eastern European hackers doing the same, and HN has a profound bias towards whichever narrative is more fun to talk about.
    - mrschwabe 13y ago
      Maybe its 'fun' to talk about or maybe it's just the first logical assumption given the circumstances. Have you read the news man? Everybody should have a bias to blaming the NSA for breaking into journalist laptops! Geez, they have motives and the means.
      - tptacek 13y ago
        This is pure innuendo.
    - ben1040 13y ago
      Yep. It seems logical that an high profile reporter might be a target for other potential attackers who are not the NSA. Even if it's just some smart teenager somewhere, doing it "for the lulz" to say they got someone of that level. I can also imagine that an investigative journalist, whose livelihood is made in part based upon tips received from people external to the newsroom, might easily become a target for a spear phishing attack from any of those potential actors. But to immediately attribute this to the NSA strictly based on the facts laid down in this article, that seems like making a heavy use of a Jump to Conclusions Mat.
    - hga 13y ago
      You maybe positing that this could be the NSA; me, I hope they're not quite that corrupt as of yet. I'm assuming other state actors (the DoJ currently is saying "Not to our knowledge"), or someone attacking for political motives but not a formal state actor.
      - tptacek 13y ago
        I'm the opposite of believing someone working for the USG hacked into a reporter's laptop. I believe "someone attacking for political motives but not a formal state actor" is the second most likely scenario, after "laptop was randomly popped by a drive-by Java or Flash vulnerability and WaPo wants it to be more newsworthy than it is". I sound cynical about news organizations here, but I'm not. I just think they suck at reporting on computer security stories.
  - mrschwabe 13y ago
    Exactly! And to compliment your second point; in light of the biggest intelligence leak in history just last week - at the hands of just one frustrated sysadmin; it illustrates just how inept these agencies can be.
    - tptacek 13y ago
      NSA's attack/penetration teams are not inept.

tptacek 13y ago

You think the forensics capabilities of the Washington Post have a chance of detecting NSA? You think if NSA breaks into a laptop, it would be apparent to a forensics person that they'd "covered up traces of being there"? Teenagers had rootkits that swapped out system libraries to hide processes and binaries back in 1996. The very, very lame teenagers had utmp and wtmp editors to "cover up their traces". It's worth taking a moment to examine your thought processes here. "Now, in light of NSA/PRISM, we have a good suspect"? We clearly do not.

hga 13y ago
Ummm, this is as reported by CBS as reported by whomever they hired to do the forensic analysis. And yes, if "the NSA" were to break in it's possible they might not be able to do it tracelessly. E.g. no one as of yet is suspecting a black bag job.
- tptacek 13y ago
  We are thus far discussing technical details of an attack that would be easy for a teenager to have carried out in 1999, let alone 2013, and are attributing them to the world's most experienced computer security organization. I think that's happening because it's much more fun to think about NSA breaking into media laptops than it is to think about random Eastern European hackers doing the same, and HN has a profound bias towards whichever narrative is more fun to talk about.
  - mrschwabe 13y ago
    Maybe its 'fun' to talk about or maybe it's just the first logical assumption given the circumstances. Have you read the news man? Everybody should have a bias to blaming the NSA for breaking into journalist laptops! Geez, they have motives and the means.
    - tptacek 13y ago
      This is pure innuendo.
  - ben1040 13y ago
    Yep. It seems logical that an high profile reporter might be a target for other potential attackers who are not the NSA. Even if it's just some smart teenager somewhere, doing it "for the lulz" to say they got someone of that level. I can also imagine that an investigative journalist, whose livelihood is made in part based upon tips received from people external to the newsroom, might easily become a target for a spear phishing attack from any of those potential actors. But to immediately attribute this to the NSA strictly based on the facts laid down in this article, that seems like making a heavy use of a Jump to Conclusions Mat.
  - hga 13y ago
    You maybe positing that this could be the NSA; me, I hope they're not quite that corrupt as of yet. I'm assuming other state actors (the DoJ currently is saying "Not to our knowledge"), or someone attacking for political motives but not a formal state actor.
    - tptacek 13y ago
      I'm the opposite of believing someone working for the USG hacked into a reporter's laptop. I believe "someone attacking for political motives but not a formal state actor" is the second most likely scenario, after "laptop was randomly popped by a drive-by Java or Flash vulnerability and WaPo wants it to be more newsworthy than it is". I sound cynical about news organizations here, but I'm not. I just think they suck at reporting on computer security stories.
- mrschwabe 13y ago
  Exactly! And to compliment your second point; in light of the biggest intelligence leak in history just last week - at the hands of just one frustrated sysadmin; it illustrates just how inept these agencies can be.
  - tptacek 13y ago
    NSA's attack/penetration teams are not inept.