8 ms·

NSA finds Snowden hijacked officials’ logins

87 points by moonlighter 13y ago

beedogs 13y ago
AKA he typed "su". Or whatever the Windows equivalent is. I do this all the time to diagnose problems and no one has ever written an article about me. :/
- bigiain 13y ago
  FWIW, there are some things that lots of sysadmins do on a week-to-week basis as part of their job – that other people have ended up with felony convictions for… See: http://en.wikipedia.org/wiki/Randal_L._Schwartz http://en.wikipedia.org/wiki/Randal_L._Schwartz (Note: all 3 felony convictions were "expunged" eventually, but for 12 years he had all the restrictions and problems a convicted felon lives with, all for "doing his job", or possibly "overstepping the bounds of his authority while doing his job".)
  - letney 13y ago
    Also see: http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30/the-free-web-program-that-got-bradley-manning-convicted-of-computer-fraud/ http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30... Describing how Bradley Manning using 'wget' was considered computer fraud because it was not on the list of approved programs.
    - krichman 13y ago
      CFAA is a ridiculous mistake. It's like if you used a programmable coffee machine and the company's policy forbade making decaf you would be a felon.
Nate75Sanders 13y ago
"Snowden reportedly used high-ranking official's profiles to troll NSA's intranet." trawl?
- advice4u 13y ago
  To troll means to fish. In fact, looking up the definition of "trawl," it means "to troll" http://www.thefreedictionary.com/trawl http://www.thefreedictionary.com/trawl
  - Nursie 13y ago
    I think it's a US thing though. Obviously I know that in US English the word has both meanings, but in the UK a troll is something that hides under a bridge, and the fishing is trawling. Took me a while to figure out the humour inherent in the double meaning when I first came across it (in the 90s)
    - prawn 13y ago
      I always thought trawling involved dragging a net whereas you trolled with a lure (enticing fish out to chase it). e.g., you might trawl for prawns but troll for snook.
      - Nursie 13y ago
        Never heard that in UK english. I just assumed that with an american accent the words sounded the same so people stopped using 'trawl'... I've been wrong before though.
        thaumasiotes 13y ago
        I can confirm that this is not the case; trawl and troll shouldn't rhyme any more than Paul and pole, tall and toll, fall and foal, etc.
- jrockway 13y ago
  http://en.wiktionary.org/wiki/troll http://en.wiktionary.org/wiki/troll
CaveTech 13y ago
Article is filled with speculation and extremely vague details on his purported "attack". Seems largely like a filler article to me.
i386 13y ago
Unless this audit was independent, can we really trust their analysis? The NSAs credibility is shot at this point.
- bigiain 13y ago
  Presumably "independently audited" by the Presidentially approved investigator James "No means Yes" Clapper…
femto 13y ago
Spring clean time at the NSA? Apart from anything he might have done, Snowden has provided a convenient dumpster, which may be used to neatly wrap up and dispose of pesky unexplained incidents.
- gojomo 13y ago
  "General, these logs say your account pulled the intercepts for a bunch of corporate board meetings, everyone within two hops of Senator Wyden, and General Petraeus. That was all just brilliant superspy Snowden, right?"
ihsw 13y ago
Snowden's escape from the NSA exposed two things: 1) illegal kleptocratic behaviour on part of the government 2) gross security incompetence on part of the government. The NSA has spent all its time on #1 up until now, so they're going to hype him up as much as possible so as to diminish the embarrassment from #2. > He wasn't just a community college stooge, he was brilliant! The obscure flaw that he exploited has since been fixed, hooray too! Meanwhile 'sudo su' has been criminalized as a precaution.
- jonhohle 13y ago
  that's why I like to use `sudo sudo su' ;) And of course, `sudo vim', :!bash
  - eru 13y ago
    On a more serious note, you should (almost) never do `sudo vim', but stick to `sudoedit'.
    - onedev 13y ago
      I'm curious; what's the reasoning behind this?
      - aegiso 13y ago
        sudo vim means vim gets root privileges. Meaning vim can do anything it wants if it's bugged or somehow compromised. Not likely on an otherwie secure system but not impossible. sudoedit (according to the manpage) makes a copy of the file first, lets your editor edit it, then copies back when you're done -- so even a compromised editor couldn't do much damage beyond corrupting the given file.
        onedev 13y ago
        That's awesome I never knew that; thanks so much for explaining it!
res0nat0r 13y ago
> The National Security Agency (NSA) is the font of information security wisdom for the US defense and intelligence communities. But apparently, the NSA's own network security is so weak that a single administrator was able to hijack the credentials of a number of NSA employees with high-level security clearances and use them to download data from the agency's internal networks. Thats a bit hyperbolic and out of touch with reality. Sure I as a sysadmin with root to most UNIX machines in my companies environment could have been able to copy the raw Oracle db files to steal company secrets, SAP databases for other juicy data that I could sell to a competitor, run a network sniffer on important login servers to steal passwords, that is how the real world works. If anyone believes that you can totally lock down access to every system on your network from your trusted sysadmins and have 100% audibility and accountability you are unfortunately living in a fantasy land. NSA or not, this really isn't something that is 100% preventable.
- MichaelGG 13y ago
  Is it? I'd expect a write-only logging system that runs at a low level exporting logging to remote servers that other admins don't have access to. As the article suggests, you layer admins so no single person can truly compromise things. It should be pretty basic to catch someone that's resetting user's passwords.
  - bigiain 13y ago
    I had systems doing this in the late '90s, and I'm 100% certain I was following "current best practice" at the time, rather than having invented anything novel or notable… (Having sid that, I wonder how many people have patents or patent applications in for that idea right now?)
  - res0nat0r 13y ago
    Sure, you can remote syslog everything to a remote logging service, but: 1] Do you log every single thing that happens on the machine? 2] If not, did you actually log the proper set of commands that were used to possibly commit a crime? 3] Granted you are not a small startup, do you have a process in place already to data mine, extract and analyze these potentially dangerous commands from log sets that are potentially TB in size? 4] Do you have the personnel in place with the qualifications and time each day/week/month to audit these potentially large results? 5] If you've caught something, aren't you already too late? Do you have some type of magical software in place that will somehow recognize these types of crimes in progress and cut off access in realtime? Many of these articles totally ignore how these real world systems work (mainly I'm guessing because the authors have never been involved with companies that run 10k-200k servers around the world). It really is more complex than you think. Most companies that aren't startup size are continually playing catch up. Sure they need to put logging in place, auditing, yada yada. That is being balanced with the other day to day pressing tasks also. It always seems to be a game of catch up...
joshfraser 13y ago
If they couldn't detect Snowden, it raises the question of what the Chinese government has access to. I imagine every government and hacking group in the world is doing everything they can to get access to that pile of data. Even if you trust the US government not to abuse these capabilities, what will happen when that data falls into even worse hands?
samstave 13y ago
This appears to be a snowjob against Snowden, and BS -- Look at the language: 1. Snowden impersonated NSA officials, sources say 2. Edward Snowden accessed some secret national security documents by assuming the electronic identities of top NSA officials 3. forensic investigation has included trying to figure out which higher level officials Snowden impersonated 4. if an employee was on vacation while the on-line version of the employee was downloading a classified document, it might indicate that someone assumed the employee’s identity 5. NSA has already identified several instances where Snowden borrowed someone else’s user profile to access documents 6. “The damage, on a scale of 1 to 10, is a 12,” said a former intelligence official. 7. The NSA declined to comment <--- WTF, then who are the above sources? [Edit: I wanted to add a little bit of clarity here: the language used is very vague and references things that could never possible be confirmed: sources say, "might indicate", "has identified" --- This story is like a bunch of paragraphs typed out, randomly put into a hat then shaken onto the floor into the pattern of the story. It is not a decisive, cohesive piece of information -- then it is ended saying that the NSA has no comment. THe TITLE is "NSA finds Snowden hijacked officials’ logins" NSA FINDS.... So, if the NSA doesn't comment - and the "analysis by NBC" and the NSA declines to comment are all used -- then NOTHING in this piece can be believed. Even if the entire premise is true - this is hands down the worst framing of the information, supposedly factual, one could imagine! --- In my informed IT professional opinion, they are using this to brand him a hacker - and they make a bunch of "what if" type claims. Then they slide into a confirmed report. Then they claim the damage is off the scale (12 on a scale of 1-10) This is a completely MISO built PR piece for the NSA. As administrator on any system (administrator in Windows, and Root in *nix) one will have access to whatever you want. Whilst at lockheed, I had admin rights to every machine and document in my realm - I would have had no need to "impersonate" any other lockheed employee... The mistake here is if NSA was using the same root passwords/keys across entire tiers of machines. In that case - call it criminal negligence on the part of whomever architected that disaster.
- vpeters25 13y ago
  My thoughts exactly, they are setting him up for CFAA charges either to pile up on him or so they can drop espionage taking away the reasons for Russia's asylum.
zero_intp 13y ago
Personal observation: Internal security best practices in spy organizations are rarely 'overlooked'. It is all about trade-offs. II think the more important question is "why would the NSA have lax internal oversight on both user-privledges AND audit-logs?" The answer is that it is much easier for black bag operations to be scrubbed from potential oversight when an individual holds the power to run the hidden|illegal analysis and clean their own log trails.
ajw0100 13y ago
Am I the only one who finds it funny that the article quoted Oracle's Enterprise Manager docs?
- ozten 13y ago
  Clearly, Oracle is unbreakable.
joelrunyon 13y ago
Has anyone figured out exactly how high Snowden's clearance went? They're really non-specific about what he did (and play it off like he couldn't do anything), but it's coming across more & more like he really had his crap together.
kyzyl 13y ago
To me this simply looks like the folks in charge are locking in their cyber crimes case against Snowden. If he's ever brought in--for whatever reason--and even if he magically avoids every charge of espionage, treason, leaking, spying, misuse of company keyboards, or whatever, they'll have the hacking angle sunk so deep that it won't matter. If Bradley Manning got what he did for scary wget wizardry (making no statement about the validity of that charge or verdict) then I think Snowden can safely expect more consecutive life sentences than he has fingers and toes.
deleted 13y ago
[deleted]
GigabyteCoin 13y ago
It's this kind of stuff that really scares me. 1) Some government agency builds massive computer system containing lots of information about the general public. 2) There are numerous obvious holes in the "massive" computer system for obvious reasons (government's haste, lack of oversight, etc). 3) The government's computers get hacked. In my opinion, numbers two and three are inevitable when number one takes place. Something similar just happened in Canada a few years ago with all of our driving information: http://www.huffingtonpost.ca/2012/11/06/service-ontario-kiosks-ontario-government_n_2081077.html http://www.huffingtonpost.ca/2012/11/06/service-ontario-kios...
- ohwp 13y ago
  And this is one of the reasons why the argument 'got nothing to hide' doesn't count. When a hacker can access all this information it becomes easy to steal someones identity.
  - GigabyteCoin 13y ago
    Can you imagine the level of backlash any government would receive if it was discovered identities were being stolen directly from them? Something like that would be grounds for a complete loss of trust in my books.
- frank_boyd 13y ago
  And it will always be happening, as long as data gets stored. The only way to prevent it is to not store data.
  - jleader 13y ago
    That's not entirely true. Take for example, passwords. If your requirement is "store passwords securely, so they can only be used to check logins", then you implement that as salted, one-way encryption. But if you add the shadow requirement "and be able to retrieve anyone's password when the government requests it", then your password storage will inevitably be much more vulnerable.
bingeboy 13y ago
Quis custodiet ipsos custodes?
deleted 13y ago
[deleted]

87 points by moonlighter 13y ago

AKA he typed "su". Or whatever the Windows equivalent is. I do this all the time to diagnose problems and no one has ever written an article about me. :/

bigiain 13y ago
FWIW, there are some things that lots of sysadmins do on a week-to-week basis as part of their job – that other people have ended up with felony convictions for… See: http://en.wikipedia.org/wiki/Randal_L._Schwartz http://en.wikipedia.org/wiki/Randal_L._Schwartz (Note: all 3 felony convictions were "expunged" eventually, but for 12 years he had all the restrictions and problems a convicted felon lives with, all for "doing his job", or possibly "overstepping the bounds of his authority while doing his job".)
- letney 13y ago
  Also see: http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30/the-free-web-program-that-got-bradley-manning-convicted-of-computer-fraud/ http://www.washingtonpost.com/blogs/worldviews/wp/2013/07/30... Describing how Bradley Manning using 'wget' was considered computer fraud because it was not on the list of approved programs.
  - krichman 13y ago
    CFAA is a ridiculous mistake. It's like if you used a programmable coffee machine and the company's policy forbade making decaf you would be a felon.

Nate75Sanders 13y ago

"Snowden reportedly used high-ranking official's profiles to troll NSA's intranet." trawl?

advice4u 13y ago
To troll means to fish. In fact, looking up the definition of "trawl," it means "to troll" http://www.thefreedictionary.com/trawl http://www.thefreedictionary.com/trawl
- Nursie 13y ago
  I think it's a US thing though. Obviously I know that in US English the word has both meanings, but in the UK a troll is something that hides under a bridge, and the fishing is trawling. Took me a while to figure out the humour inherent in the double meaning when I first came across it (in the 90s)
  - prawn 13y ago
    I always thought trawling involved dragging a net whereas you trolled with a lure (enticing fish out to chase it). e.g., you might trawl for prawns but troll for snook.
    - Nursie 13y ago
      Never heard that in UK english. I just assumed that with an american accent the words sounded the same so people stopped using 'trawl'... I've been wrong before though.
      - thaumasiotes 13y ago
        I can confirm that this is not the case; trawl and troll shouldn't rhyme any more than Paul and pole, tall and toll, fall and foal, etc.
jrockway 13y ago
http://en.wiktionary.org/wiki/troll http://en.wiktionary.org/wiki/troll

CaveTech 13y ago

Article is filled with speculation and extremely vague details on his purported "attack". Seems largely like a filler article to me.

i386 13y ago

Unless this audit was independent, can we really trust their analysis? The NSAs credibility is shot at this point.

bigiain 13y ago
Presumably "independently audited" by the Presidentially approved investigator James "No means Yes" Clapper…

femto 13y ago

Spring clean time at the NSA? Apart from anything he might have done, Snowden has provided a convenient dumpster, which may be used to neatly wrap up and dispose of pesky unexplained incidents.

gojomo 13y ago
"General, these logs say your account pulled the intercepts for a bunch of corporate board meetings, everyone within two hops of Senator Wyden, and General Petraeus. That was all just brilliant superspy Snowden, right?"

ihsw 13y ago

Snowden's escape from the NSA exposed two things: 1) illegal kleptocratic behaviour on part of the government 2) gross security incompetence on part of the government. The NSA has spent all its time on #1 up until now, so they're going to hype him up as much as possible so as to diminish the embarrassment from #2. > He wasn't just a community college stooge, he was brilliant! The obscure flaw that he exploited has since been fixed, hooray too! Meanwhile 'sudo su' has been criminalized as a precaution.

jonhohle 13y ago
that's why I like to use `sudo sudo su' ;) And of course, `sudo vim', :!bash
- eru 13y ago
  On a more serious note, you should (almost) never do `sudo vim', but stick to `sudoedit'.
  - onedev 13y ago
    I'm curious; what's the reasoning behind this?
    - aegiso 13y ago
      sudo vim means vim gets root privileges. Meaning vim can do anything it wants if it's bugged or somehow compromised. Not likely on an otherwie secure system but not impossible. sudoedit (according to the manpage) makes a copy of the file first, lets your editor edit it, then copies back when you're done -- so even a compromised editor couldn't do much damage beyond corrupting the given file.
      - onedev 13y ago
        That's awesome I never knew that; thanks so much for explaining it!

res0nat0r 13y ago

> The National Security Agency (NSA) is the font of information security wisdom for the US defense and intelligence communities. But apparently, the NSA's own network security is so weak that a single administrator was able to hijack the credentials of a number of NSA employees with high-level security clearances and use them to download data from the agency's internal networks. Thats a bit hyperbolic and out of touch with reality. Sure I as a sysadmin with root to most UNIX machines in my companies environment could have been able to copy the raw Oracle db files to steal company secrets, SAP databases for other juicy data that I could sell to a competitor, run a network sniffer on important login servers to steal passwords, that is how the real world works. If anyone believes that you can totally lock down access to every system on your network from your trusted sysadmins and have 100% audibility and accountability you are unfortunately living in a fantasy land. NSA or not, this really isn't something that is 100% preventable.

MichaelGG 13y ago
Is it? I'd expect a write-only logging system that runs at a low level exporting logging to remote servers that other admins don't have access to. As the article suggests, you layer admins so no single person can truly compromise things. It should be pretty basic to catch someone that's resetting user's passwords.
- bigiain 13y ago
  I had systems doing this in the late '90s, and I'm 100% certain I was following "current best practice" at the time, rather than having invented anything novel or notable… (Having sid that, I wonder how many people have patents or patent applications in for that idea right now?)
- res0nat0r 13y ago
  Sure, you can remote syslog everything to a remote logging service, but: 1] Do you log every single thing that happens on the machine? 2] If not, did you actually log the proper set of commands that were used to possibly commit a crime? 3] Granted you are not a small startup, do you have a process in place already to data mine, extract and analyze these potentially dangerous commands from log sets that are potentially TB in size? 4] Do you have the personnel in place with the qualifications and time each day/week/month to audit these potentially large results? 5] If you've caught something, aren't you already too late? Do you have some type of magical software in place that will somehow recognize these types of crimes in progress and cut off access in realtime? Many of these articles totally ignore how these real world systems work (mainly I'm guessing because the authors have never been involved with companies that run 10k-200k servers around the world). It really is more complex than you think. Most companies that aren't startup size are continually playing catch up. Sure they need to put logging in place, auditing, yada yada. That is being balanced with the other day to day pressing tasks also. It always seems to be a game of catch up...

joshfraser 13y ago

If they couldn't detect Snowden, it raises the question of what the Chinese government has access to. I imagine every government and hacking group in the world is doing everything they can to get access to that pile of data. Even if you trust the US government not to abuse these capabilities, what will happen when that data falls into even worse hands?

samstave 13y ago

This appears to be a snowjob against Snowden, and BS -- Look at the language: 1. Snowden impersonated NSA officials, sources say 2. Edward Snowden accessed some secret national security documents by assuming the electronic identities of top NSA officials 3. forensic investigation has included trying to figure out which higher level officials Snowden impersonated 4. if an employee was on vacation while the on-line version of the employee was downloading a classified document, it might indicate that someone assumed the employee’s identity 5. NSA has already identified several instances where Snowden borrowed someone else’s user profile to access documents 6. “The damage, on a scale of 1 to 10, is a 12,” said a former intelligence official. 7. The NSA declined to comment <--- WTF, then who are the above sources? [Edit: I wanted to add a little bit of clarity here: the language used is very vague and references things that could never possible be confirmed: sources say, "might indicate", "has identified" --- This story is like a bunch of paragraphs typed out, randomly put into a hat then shaken onto the floor into the pattern of the story. It is not a decisive, cohesive piece of information -- then it is ended saying that the NSA has no comment. THe TITLE is "NSA finds Snowden hijacked officials’ logins" NSA FINDS.... So, if the NSA doesn't comment - and the "analysis by NBC" and the NSA declines to comment are all used -- then NOTHING in this piece can be believed. Even if the entire premise is true - this is hands down the worst framing of the information, supposedly factual, one could imagine! --- In my informed IT professional opinion, they are using this to brand him a hacker - and they make a bunch of "what if" type claims. Then they slide into a confirmed report. Then they claim the damage is off the scale (12 on a scale of 1-10) This is a completely MISO built PR piece for the NSA. As administrator on any system (administrator in Windows, and Root in *nix) one will have access to whatever you want. Whilst at lockheed, I had admin rights to every machine and document in my realm - I would have had no need to "impersonate" any other lockheed employee... The mistake here is if NSA was using the same root passwords/keys across entire tiers of machines. In that case - call it criminal negligence on the part of whomever architected that disaster.

vpeters25 13y ago
My thoughts exactly, they are setting him up for CFAA charges either to pile up on him or so they can drop espionage taking away the reasons for Russia's asylum.

zero_intp 13y ago

Personal observation: Internal security best practices in spy organizations are rarely 'overlooked'. It is all about trade-offs. II think the more important question is "why would the NSA have lax internal oversight on both user-privledges AND audit-logs?" The answer is that it is much easier for black bag operations to be scrubbed from potential oversight when an individual holds the power to run the hidden|illegal analysis and clean their own log trails.

ajw0100 13y ago

Am I the only one who finds it funny that the article quoted Oracle's Enterprise Manager docs?

ozten 13y ago
Clearly, Oracle is unbreakable.

joelrunyon 13y ago

Has anyone figured out exactly how high Snowden's clearance went? They're really non-specific about what he did (and play it off like he couldn't do anything), but it's coming across more & more like he really had his crap together.

kyzyl 13y ago

To me this simply looks like the folks in charge are locking in their cyber crimes case against Snowden. If he's ever brought in--for whatever reason--and even if he magically avoids every charge of espionage, treason, leaking, spying, misuse of company keyboards, or whatever, they'll have the hacking angle sunk so deep that it won't matter. If Bradley Manning got what he did for scary wget wizardry (making no statement about the validity of that charge or verdict) then I think Snowden can safely expect more consecutive life sentences than he has fingers and toes.

deleted 13y ago

[deleted]

GigabyteCoin 13y ago

It's this kind of stuff that really scares me. 1) Some government agency builds massive computer system containing lots of information about the general public. 2) There are numerous obvious holes in the "massive" computer system for obvious reasons (government's haste, lack of oversight, etc). 3) The government's computers get hacked. In my opinion, numbers two and three are inevitable when number one takes place. Something similar just happened in Canada a few years ago with all of our driving information: http://www.huffingtonpost.ca/2012/11/06/service-ontario-kiosks-ontario-government_n_2081077.html http://www.huffingtonpost.ca/2012/11/06/service-ontario-kios...

ohwp 13y ago
And this is one of the reasons why the argument 'got nothing to hide' doesn't count. When a hacker can access all this information it becomes easy to steal someones identity.
- GigabyteCoin 13y ago
  Can you imagine the level of backlash any government would receive if it was discovered identities were being stolen directly from them? Something like that would be grounds for a complete loss of trust in my books.
frank_boyd 13y ago
And it will always be happening, as long as data gets stored. The only way to prevent it is to not store data.
- jleader 13y ago
  That's not entirely true. Take for example, passwords. If your requirement is "store passwords securely, so they can only be used to check logins", then you implement that as salted, one-way encryption. But if you add the shadow requirement "and be able to retrieve anyone's password when the government requests it", then your password storage will inevitably be much more vulnerable.

bingeboy 13y ago

Quis custodiet ipsos custodes?

deleted 13y ago

[deleted]