14 ms·
Snowden impersonated NSA officials, sources say
- randallu 13y agoWas he brilliant? Or is that just a story -- "nobody else out of NSA's 20,000 employees is spying on people they shouldn't because they're just "great" not "brilliant", so don't worry!"
- walshemj 13y agoprobably a quote from a non techie think Bob howards bosses from the laundry that sort of level of technical knowledge.
- avelis 13y agoI know the article is only to report what is said and it might be taken out of context. However, I am disturbed by the kind of mentality around hiring "great" and "brilliant" employee's. I see no future with that kind of organizational thinking.
- sczkid 13y agoIf the NSA didn't guard against him using accounts with more clearance to download documents he wasn't supposed to have access to, I don't think Snowden's intelligence is what we should be worried about.
- jrs235 13y agoWhich I don't understand... they're claiming that we should trust them but they aren't (or shouldn't be [hiring]) the most brilliant people. So, how many other holes exist in their systems and oversight that are unknown because there aren't brilliant people finding them?
- deleted 13y ago[deleted]
- jonknee 13y agoWhat are you referencing? The quote (from an NBC story): > “Every day, they are learning how brilliant [Snowden] was,” said a former U.S. official with knowledge of the case. “This is why you don’t hire brilliant people for jobs like this. You hire smart people. Brilliant people get you in trouble.”
- rhizome 13y agoSpeaking from experience, detailed auditing is covered by even the most basic Windows Server admin course. It's not a question of brilliance.
- walshemj 13y agoAs is knowing what MAC and DAC are
- rhizome 13y agoNot only that, but isn't the NSA required to have a sufficient level of auditing to detect (or at least record) those accesses before the systems are even fired up?
- shortcj 13y agoShould the NSA director outsource NSAnet root?
- DamnYuppie 13y agoApparently the answer is yes...
- kleiba 13y agoAre they talking about su?
- sliverstorm 13y agoThat would be my guess.
- rhizome 13y agoNot only that, but su rather than sudo. My guess is that they'll need another $10B to plug this hacker backdoor.
- WestCoastJustin 13y agoI think it might be a little more complex than that, but in essence, yes. In these types of environments you will have certificates (browser based or otherwise), he could have fabricated digital keys or stolen these from some type of key store, and then used them on his behalf. > NSA Director Keith Alexander told the House Permanent Select Committee on Intelligence that Snowden fabricated digital keys that gave him access to areas way above his clearance as a low-level contractor and systems administrator. [1] [1] http://www.businessinsider.com/edward-snowden-copied-a-lot-of-nsa-files-2013-6 http://www.businessinsider.com/edward-snowden-copied-a-lot-o...
- rhizome 13y agoHistory tells us that these agencies routinely redefine mundane concepts, so your point depends entirely on what they mean by "digital key."
- betterunix 13y agoMore likely runcon: http://linux.die.net/man/1/runcon http://linux.die.net/man/1/runcon
- deleted 13y ago[deleted]
- danielharan 13y agoWho wants to go work at the NSA now that it implies they merely believe you smart, not brilliant?
- sliverstorm 13y agoIMO the solution is not keeping the top cryptographers, security experts, et al. out of the agency that is supposed to protect the country from the top cryptographers and security experts from other countries. Seems like a flawed idea right from the start. You just need to make sure the people you hire are actually on your side.
- eliasmacpherson 13y agoI disagree, the solution is more likely not doing anything morally questionable because the pool of talented people without morals is significantly shallower than the pool with, in my experience.
- john_b 13y agoThat may work in theory, but it's not always possible to know who's on your side. For an especially control-obsessed agency like the NSA that wants to know everything, this approach is completely unpalatable. Large institutions with sensitive information, whether public or private, generally don't know or trust their lower level employees (and a sysadmin is "lower level" in this context). They want solutions that prevent access by default. The NSA seems to have figured out that relying on sysadmins as a trusted party (a contracted trusted party, specifically) exposed a big hole in their ability to control things. It should have been obvious that contracting out a role that requires an extreme amount of trust was a bad idea, but large institutions often don't learn obvious lessons until someone makes them pay for their mistake.
- sliverstorm 13y agoI don't disagree with anything you've said about holes in security. I just think it's silly to say the solution is to hire stupider people.
- clueless123 13y agoThis is why you don't hire ethical people for jobs like these.
- Ellipsis753 13y agoWhy would you give someone the ability to impersonate people with higher clearance? That seems like poor design from the start.
- theg2 13y agoThat is the issue with technology and those in power who don't know how to use it. If a General or higher up is having an issue with classified data, it's not like he can just look at the error message and then go home for the day, he requires an IT team to help and maintain the systems. A DBA can't do their job if they can't access the databases they manage/design/maintain.
- pothibo 13y agoThe same reason a secretary would have the keys to unlock her boss' secret file drawer. Convenience.
- pilom 13y agoI'm highly skeptical of the reporting. He may have impersonated other accounts to cover his tracks but if he had physical access to a system or the user database of a system then he was "authorized" to see all of the data on that system. Or they are doing IT security worse in that office than it is usually done.
- sigzero 13y agoNo he wasn't. Security is a "need to know". Just because you have a TS clearance for example doesn't mean you have access to all TS information out there. If you step over that then you get slapped down.
- stcredzero 13y ago> they are doing IT security worse in that office than it is usually done Two things that are undeniable: 1) They were doing IT security worse than the level which was actually needed 2) All the while, they were telling the world that effective mechanisms were in place which would prevent abuses. So they weren't doing what they were supposed to and they were deceiving the public about it. Whether or not this was intentional is just secondary.
- defen 13y agoWasn't the original story that he was a high school dropout, glorified keyboard jockey who was way overpaid for what his job entailed? These guys need to get the message straight.
- kirksan 13y agoSo the guy knew how to type "su - kalexander".
- pothibo 13y agoSpinning the story so if fits the "Snowden is a traitor" agenda. >> "You hire smart people. Brilliant people get you in trouble.” What does that even mean?
- betterunix 13y agoBrilliant people see through the propaganda that the government needs to feed its own employees. Brilliant people are harder to train to be a cog in the machine. The NSA needs people who are just intelligent enough to solve infrastructure / software / etc. problems, but not so smart that they start questioning the broader goals of the organization. The army breaks down a soldier's individuality as part of a soldier's training. The NSA does not have that luxury (as far as I know), and Booz Allen Hamilton certainly does not.
- stcredzero 13y agoThe use of the word "impersonated" stinks to high heaven. There is a big difference between an admin logging in as someone else and someone "impersonating" someone on TV or over the phone. That would be like having secret documents in a drawer marked "John Smith," then saying that someone who opened that drawer and took some documents was "impersonating" John Smith. Then there's the bit about "hiring brilliant people." What's so brilliant about someone with root access having access to everything? Nothing. That's what root access enables. It's not a case of Snowden's brilliance. It's a case of the NSA's administrative incompetence: there should be auditing in place. EDIT: So there was RBAC in place. Evidently, the implementation was botched. Amounts to the same thing: "security theater." This actually bolsters Snowden's case that whistleblowing was justified.
- AsymetricCom 13y agoThere is no "root access" implied in this article. Read about RBAC to understand this.
- betterunix 13y agoIt looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Log in as a user and you get "Hotel California" security -- you cannot escape your role. Log in as an administrator and you are not confined to any role and can just walk all over everything. Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user.
- stcredzero 13y ago> It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Presenting that as "impersonation" to the general public is deceptive, regardless of whether it is intended to be or not.
- AsymetricCom 13y ago
- AsymetricCom 13y agoI know I'll get downvoted for this. Please be a contributing community member of HN and state why. Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? I have yet to see any serious abuse of the NSA's power. The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses. Leaking those kind of emails can be spun to state the opposite, when those emails are direct evidence that such abuses are tracked and presumably punished. I've seen articles that have said "what if they use this power to subvert political dissidents" Well, what if they actually have checks built into this system as they have claimed and this new information proves? Such rumor spinning gets us nowhere as a society. Wouldn't that make Snowden a spy with his own self interests at heart, not the interests of the American people? Leaking piece-meal like he has is in his interests, not ours. http://en.wikipedia.org/wiki/2013_mass_surveillance_disclosures#Collection_and_Analysis_Programs_or_Hardware http://en.wikipedia.org/wiki/2013_mass_surveillance_disclosu... Look at the scope of these systems. The fact that no abuses have come up (locally) is quite telling, imho. When this same type of hardware is in the hands of countries like China, we see these abuses. Is China seeing something we don't and just not telling us? I highly doubt it.
- cma 13y ago>Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? Are the two mutually incompatible? >The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses. The love interest thing wasn't part of a leak, was it? I thought they just voluntarily disclosed it, probably to distract from thoughts of domestic spying on e.g. politcal views, rather than petty tabloid personal stuff.
- deleted 13y ago[deleted]
- deleted 13y ago[deleted]
- 13y ago
- ChikkaChiChi 13y agoAren't these stories sort of the very definition of spin propaganda? At least Snowden hasn't been locked away in a hole for three years only to be brought out into the public to tell everyone he's really thinks his a woman.
- gojomo 13y agoWell, thank goodness only one "brilliant" person has ever snuck past the NSA's defenses. If two or more ever got in, they'd establish themselves as our hereditary emperors in no time.