9 ms·
UK spies continue “quantum insert” attack via LinkedIn, Slashdot pages
- archgoon 13y agoFor those who, like me, were baffled by the term "Quantum Insert", here's a Schneier article that describes the meaning of the term: https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html https://www.schneier.com/blog/archives/2013/10/how_the_nsa_a... In short, Quantum Insert, (rather QUANTUMINSERT), is essentially a Man in the Middle attack, where the NSA (or GHCQ in this case) injects code (potentially zero days) into the response to the http request. The network of servers that perform the injection and interception is apparently codenamed QUANTUM, and has nothing to do (to our knowledge) with Quantum Computing or Quantum Cryptography.
- Gnewt 13y agoIs this for users accessing sites like LinkedIn without HTTPS, or do you suppose that the NSA is signing trusted certs?
- justincormack 13y agoLinkedin does not make any attempt to force you onto https, so no reason to worry about it. Any site that redirects you to https from http could have that redirect hijacked I guess too. Presumably they just have a list of people and can wait to hack them until next time they visit slashdot or linkedin.
- scott_w 13y agoIt's even worse than that. LinkedIn actively moves you off HTTPS, and onto plain HTTP. Here's 2 situations: * https://linkedin.com https://linkedin.com Redirects To www.linkedin.com * https://www.linkedin.com https://www.linkedin.com works, but all links go to www.linkedin.com Not only that, but all the static resources are loaded over HTTP (FF and Chrome both warn about this). This shouldn't come as a surprise, because the LinkedIn team can't be trusted to lock their fucking car doors, let alone secure a website.
- throwawaykf 13y agoYour first link goes to an https page for me in Safari on iPad.
- scott_w 13y agoThe configurations are different for mobile devices. Mobile devices do link to https:// https:// but they still load the static files over HTTP.
- throwawaykf 13y agoHmm, I just tried going to that link in Chrome and Firefox on a MacBook Pro -- Still takes me to an https. Also, doing an "inspect element" on a couple of images on there show me "https://static.licdn.com/..." https://static.licdn.com/..." All the other links on that page (about, etc) do go to http://-only http://-only pages, but at least the links you provided and their static resources all go over https.
- Theodores 13y ago...presumably you have 'nothing to hide', then. Previous poster must be one of those kiddie porn obsessed al-qaeda terrorists, worthy of being Quantumed whereas you are good.
- DigitalJack 13y agohttps://www.eff.org/https-everywhere https://www.eff.org/https-everywhere
- abraham 13y agoYou can set LinkedIn to only server you SSL pages. https://help.linkedin.com/app/answers/detail/a_id/6021/ https://help.linkedin.com/app/answers/detail/a_id/6021/
- gaius 13y agoQuantum as in, the bad guys in the James Bond universe right now? You couldn't make it up...
- acqq 13y agoThanks for pointing that out, I didn't know: http://jamesbond.wikia.com/wiki/Quantum http://jamesbond.wikia.com/wiki/Quantum
- nly 13y agoI don't understand why timings are critical to the operation of the system. Wouldn't packet filtering + transparent proxying work just as effectively? Is this a TCP sequencing attack of some kind?
- akjj 13y agoPresumably they don't have the capability to filter or modify packets passing through the exchange. So when they see target's computer opening a connection, they have to generate a reply faster that reaches the computer before LinkedIn's server replies.
- omh 13y agoBut if they don't have the capability to modify packets, wouldn't the original LinkedIn packet get through as well? Perhaps the OS might ignore it, but it seems like it would show up in some cases.
- Udo 13y agoI would assume the original packets get dropped as duplicates at the router level, but if they do get through to the end user's computer there would be a way of detecting that this attack is underway.
- bigiain 13y agoHmmm, I wonder if there's a way to monitor for this on an OpenWRT router? I'd _guess_ since that's where the IP address for most people's home internet (and many people's work internet) terminates - that you'd be able to detect it there (and it isn't likely to be filtered/dropped by routers further up the chain in my ISP)?
- justincormack 13y agoNo, networks are dumb. They do not detect duplicates that would require vast storage! Unless you have a tcp (eg http) proxy on the route you will be the one filtering the duplicates.
- onedev 13y agoWhy is LinkedIn always in some sort of security snafoo? It seems like it's always them. Of course it's probably also my selective memories.
- draugadrotten 13y ago> Why is LinkedIn always in some sort of security snafoo? It seems like it's always them. Target Awareness - many users of LinkedIn are not aware they could be targets Target Identity - people usually browse LinkedIn with a single identity which can rather easily be linked to a real person, making targeting easier. Network effect - Target connections to the real target which may be cautious and/or heavily protected etc
- consonants 13y agoHigh value targets exchanging high value information on a network with high value activity.
- VLM 13y ago""nine salaried employees” of the Organization of Petroleum Exporting Countries (OPEC), the global oil cartel." So they get those guys via /.? Well I guess with the recent demise of theoildrum.com, they've gotta go somewhere.
- Zigurd 13y agoAt least the OPEC guys are paying attention. No search results on LinkedIn for OPEC as current company.
- Amadou 13y agoI don't use linkedin, but that doesn't seem right: http://www.linkedin.com/title/opec http://www.linkedin.com/title/opec
- Zigurd 13y agoI searched on OPEC as the current or former employer. None of these, as far as I can tell, are actually employed by OPEC. One is a liason from the Iran national oil ministry with a private profile, so the name isn't revealed in the search.
- Amadou 13y agoWithout an account I can only see the first 5 of the ~300 hits. But Yasser Mufti looks like an OPEC employee to me, he's listed as the chairman of the board of governors. Maybe he's technically on Aramco's payroll, but I think that would be nitpicking since OPEC is funded by member companies. http://www.bloomberg.com/news/2013-09-25/saudi-arabia-opec-governor-mufti-said-to-leave-by-end-of-2013.html http://www.bloomberg.com/news/2013-09-25/saudi-arabia-opec-g...
- w_t_payne 13y agoSo does this mean that engineers are legitimate targets for NSA/GCHQ?
- ihsw 13y agoNobody is ever an illegitimate target.
- eriksank 13y agoYes. They need access to the information streams that these guys are managing. Anti Money Laundering (AML) regulations make sure that we know exactly where you hold your money. We know where you live. They need to complement this with real-time data. Your net worth has now become a bounty on your head. In order to transaction your balances away, we will need to first transaction you away.
- acd 13y agoHow do you know if LinkedIn look a like spam mails was a quantum trying to insert malicious code? I have gotten similar targeted look a like LinkedIn links.
- jamhan 13y agoHere's a link to the article (in German) on Der Spiegel website (not magazine): http://www.spiegel.de/netzwelt/netzpolitik/britischer-gchq-nutzt-gefaelschte-linkedin-seiten-a-932714.html http://www.spiegel.de/netzwelt/netzpolitik/britischer-gchq-n... Here's an English version: http://www.spiegel.de/international/europe/british-spy-agency-gchq-hacked-belgian-telecoms-firm-a-923406.html http://www.spiegel.de/international/europe/british-spy-agenc...
- brown9-2 13y agoSo a member of Congress laments poor Congressional oversight of the US intelligence community. How about trying to do something about it?
- dmix 13y agoHe proposed firing the head of the NSA, Keith Alexander, as the solution. Because in politics changing the leaders at the top is always the solution (that the public is sold) to fixing the large broken systems beneath it.
- pyre 13y agoNot that Keith Alexander should retain his job though... It's just not a comprehensive solution to the problem.
- a3n 13y agoIt is if the problem is to get the public to STFU and forget. Which it usually is, to people of McCain and Alexander's ilk. And by the way firing Alexander would be almost liking giving a cop paid vacation for shooting someone. He was going to retire in a few months anyway, and if he was to be fired he would almost certainly retain his very, very good military retirement. And then he'll work as a do-nothing name on the masthead consultant at some private equity or think tank.
- spin 13y agoYou can't have actual oversight of your employees if they are actively lying to you. Therefore, you should fire employees that lie to you.
- deleted 13y ago[deleted]
- hnriot 13y agowhy do you think that?
- XorNot 13y agoBecause trying to confirm his paranoia runs the risk of disproving it.
- Paul_S 13y agoI have no idea how you could make that logical jump. I think it's more likely you own a smartphone and have applications installed that have enough privileges to siphon all your call history and then your data is up for grabs by anyone who wants it. Do you read the privileges required by the app before clicking install?
- deleted 13y ago[deleted]
- tedunangst 13y agoSomething similar happened to me. One day I got a call from a wrong number. The next day a letter addressed to my neighbor showed up in my mailbox. Very suspicious.
- grey-area 13y agoThe more I read about these attacks, the more I wonder if these spies consider themselves completely above the law. Which law would govern or moderate their behaviour here in spying on politicians and companies in allied countries? Where are the boundaries, or is anyone of interest a potential target? Is all data fair game for GCHQ/NSA?
- lignuist 13y agoI'm pretty sure that some of them are aware that they are criminals, but probably the power of the money is stronger than the power of their ethics.
- deleted 13y ago[deleted]
- eriksank 13y agoThere is simply too much money to be made in knowing where someone lives and in what bank accounts, 401k, and IRA accounts his net worth is stored. This person will not just die, my friend. This person will be died.
- bigiain 13y agoI strongly suspect, that like most cops – they honestly believe they're "doing the right thing", and at the same time that "those laws don't apply to us while we're doing our job". Having said that, as a "non-US person" it's been both a sobering realisation and an extended moment of "well _duh!_" in the wake of the Snowden revelations. Part of me agrees that if _I_ were an American taxpayer, the NSA is doing exactly what they're paid for - invading non-US-citizens privacy on the grounds that maybe it'll help protect American interests. Any expectation of "reasonable restraint" on their invasive prying is, in retrospect, completely foolhardy on my part. Even expecting the US legal/political system to rein them in based on "fairness" or "good manners" or even "basic human rights" is also stupidly over optimistic. The _only_ possible parties who might work in _my_ interests here, are organisations like the EFF (who I doubt have anything like the power needed to effect major change to organisations like the NSA, FBI, CIA, and FISA) - or businesses directly financially affected my loss of trust - Microsoft/Google/Yahoo/Facebook/Apple/Dropbox (the directly implicated PRISM participants) as well as less blatantly complicit but now highly suspect companies like Amazon, eBay/PayPal, Dell, HP, LinkedIn, Twitter, FourSquare, Instagram, Pintrest, all of whom I'd be foolish to assume haven't already caved to the sort of requests Lavabit refused to, and to a lesser but equally valid extent - any company hosting infrastructure in any of the Five Eyes nations. While I don't doubt that China, Germany, Brazil, Russia, and everybody else also have well funded agencies tasked with invading the privacy of their non-citizens (as well as their own citizens to a greater or lesser degree), it's likely that Australia, Canada, New Zealand, and The UK all have access to the tools and expertise of what's likely to be the most advanced digital attacker on the planet. My personal goal now is to reduce my reliance on US and Five Eyes based internet companies, both directly financially where I'm paying for the service, and all the indirectly financial ways I allow them to monetize me - hello adblock, hello no-script, hello self destructing cookie addon, helle better privacy addon (and goodby LSO cookies), hello private browsing windows everywhere… As somebody who uses Google Analytics extensively at work, I _hate_ it when people do exactly what I'm doing - but financially hitting the only organisations with any power to change domestic US policy to better align with my interest is the only sensible option I have. (Coupled, of course, with implementing/promoting strong crypto, secure anonymity, and internet service and protocols that make metadata and network analysis much less useful and as resistant as possible to the massive-scale "hoover up everything on the backbones" type surveillance we now know is already happening.)
- SideburnsOfDoom 13y agoLet's hear how this targeting of engineers from specific European telecoms firms could somehow be an anti-terror measure!?
- lstamour 13y agoObviously if they have access to global communications networks they wouldn't otherwise be able to peer into, they're keeping Amurica safe.
- eriksank 13y agoWhat is your financial net worth? Let me tell you where you hold your money, your stocks, your IRA, your 401k, and everything else that my friendly crook in the bank will transaction away, while I will transaction you away, mister America-safe, law-abiding citizen-idiot.
- a3n 13y agoBecause they aren't the ultimate targets. They're trying to get their credentials, access and capabilities, so they can then go after whoever they're really interested in without having to ask, bribe or compel the company. Open question whether their ultimate targets are terrorists or "everybody."
- eriksank 13y agoEverybody with enough financial net worth to make sure he does not just die but will be died. Strange transactions on your accounts, my friend. The balance is almost gone. Is that why you have had an accident?
- a3n 13y agoYou know, I never thought of that, but of course they can steal from accounts. Traditional bad guys do it all the time, why not government bad guys. They're probably officially doing it now to major players, and "rogue" analysts are probably very occasionally doing it to minors for personal gain. EDIT: It seems like the NSA would be a HIPPA violation by its very nature.
- confluence 13y agoI love how utterly useless our intelligence agencies have become in the face of even the most basic encryption. Encrypt things at rest and on the fly with mutating keys and you defeat them. It's actually quite reassuring.
- eriksank 13y agoThat is how they end up stealing your bitcoins too. All of these QUANTUM INSERT computers have now been targeted at getting hold of your wallet keys. Your money will be gone. Staying in the banking system will not help either. The sum of the balances of your holdings in the banking system forms a bounty on your head. They know who you are. They know where you live. And they damn well know how much money there is to be made in dying you. You will not die. You will be died. Do not hold any monetary values anywhere without them knowing where it is, because that amounts to money laundering, you criminal terrorist!
- nknighthb 13y agoYour comment history before today appears at a glance to be unremarkable. What exactly happened 11 hours ago to turn you into a raving lunatic?
- tedunangst 13y agoWrote a check that bounced? Loan application turned down?
- rdl 13y agoSeems like there is an opportunity for as art and honorable network device (cpe like a router, maybe also doing normal router/firewall, but maybe a standalone IDS) which, in combination with network services, can detect and optionally report this kind of molestation of packets to the user and maybe the community. DNS is the vector for many of these, and that is easy.
- Amadou 13y agoI think it is safe to say that, like the vast majority of known browser exploits, the injection mechanisms here also relied on javascript as a necessary component. Thus this is another example of the potential risks to your users when designing websites that are noscript-unfriendly. FYI, NoScript is the 4th most popular add-on for firefox. https://addons.mozilla.org/en-US/firefox/extensions/?sort=users https://addons.mozilla.org/en-US/firefox/extensions/?sort=us...
- user24 13y agoOh wow, they're targeting specific (innocent) employees and serving malware infected versions of LinkedIn and /.?!?!?!??! wow.
- frank_boyd 13y agoTo sum it up: This allows these people: - to take over computers without leaving any trace - to control public opinion by falsifying any information served (i.e. news) - to conduct mass surveillance by a) tracking any use of the computer, b) by activating integrated cameras, c) by activating integrated microphones Very, very nice work indeed, if you aim to destroy democracy and thereby society.
- Eye_of_Mordor 13y agoSnowden has basically exposed the UK/US contempt for basic human rights and the systems that support them. How can we be free while these monsters are operational? They must shut down immediately and taken away for trial in every country whose laws they have violated...
- nuII 13y agonot surprising
- bro666 13y agoI'm more interested in the inserted malware code package itself -- and how widespread it is among LinkedIn accounts -- than a routine MITM by GCHQ known to be sitting with permission on the internet backbones of BT (REMEDY Remedy), Verizon Business (DACRON), and Vodafone Cable (GERONTIC), Global Crossing (PINNAGE), Level 3 (LITTLE), Viatel (VITREOUS) and Interoute (STREETCAR). Der Spiegel says they have located a Mach engineer in India on the receiving end of QI. Hopefully he had the sense to unplug from the internet before the malware could get wiped. I wonder if GCHQ re-used some code from Flame. Might be some work here for Kapersky Labs.