8 ms·

NSA infected 50,000 computer networks with malicious software

155 points by cyberviewer 13y ago

javert 13y ago
As an American, I feel like my country is actually putting me in long-term danger. The government is making America and Americans enemies of the entire world. If and when I ultimately have to feel the country, will I even be accepted into anywhere else? What if they are suspicious that I work for the NSA? Or what if they just decide to treat Americans the way the US treats would-be immigrants to the US now--no, you can't come in?
- smtddr 13y ago
  >> As an American, I feel like my country is actually putting me in long-term danger. The government is making America and Americans enemies of the entire world. That has been happening since forever; it's just that the NSA stuff has made that fact visible to people who didn't see America's hypocrisy before. I mean, there are people who actually believe this ---> https://www.youtube.com/watch?v=p6HOcLWP-Ls https://www.youtube.com/watch?v=p6HOcLWP-Ls
  - javert 13y ago
    I don't want to take the time to watch that video, but I actually do think that 99% of hatred of America historically has been due to the moral inferiority of the haters. For example, fundamentalist Islamists, and all those who wish to sympathize with them, are "right" to hate America. Socialists are right to hate America--the American constitution fundamentally stands for the opposite moral code, and American prosperity is evidence that the American morality is the right one. That said, the GOP is opposed to that very morality, and the Democrat party even more-so, so the country is being rapidly destroyed from the inside (and has been on that path for almost 100 years, just accelerating or decelerating occasionally).
    - marcosdumay 13y ago
      Nope. The reason some people hate the US is because the country interferes (up to the point of overthrowing governments) with the entire world. Yeah, it can be argued that there is some kind of problem with people more prone to hating than to actually dealing with the problem. But there is no excuse to think the reason that they target the US any other than them destroying their country.
- Zigurd 13y ago
  > The government is making America and Americans enemies of the entire world. Has made. It's water under the bridge now. All there is left to do is watch how it plays out: Which US companies will lose their overseas customers because they cannot assure their customers regarding back doors in their products and services? We have already seen IBM and Cisco take significant financial hits. Which nations are sufficiently independent, or have people sufficiently restive, to take an official position against pervasive surveillance and actually purge their intelligence services of foreign liaisons and cooperation in surveillance? Conversely, we will see which governments agree with and accept pervasive surveillance. Where will new centers of expertise in cryptography develop? How much of this will flow back into other areas of diplomacy? Will nations be generally more wary of intelligence and military liasons with the US?
- epo 13y ago
  The danger is two-fold: firstly the USA is losing friends abroad, 'allies' are realising that at best they were slightly favoured underlings but never equals. At least this is explicit from the outset with China. Secondly, America's power and influence is fading, slowly admittedly, but fading nonetheless. Like here in the UK your turn will come when you realise what it is like to be yesterday's bully boy. Ours came with the break up of Empire, yours may come when the world calls in your debts or builds walls to isolate your corrupt financial structures. America was once admired and respected. Now it is increasingly like some blundering fat tourist in a brothel, people pretend to be nice to you because they want your money. But really, nobody is your friend.
tptacek 13y ago
We don't need the Snowden disclosures to know this; it has for 15 years been the worst kept secret in computer security. People from the various groups in NSA that do this work talk about having done it on Twitter. Some of the smartest people in vulnerability research came from stints in NSA. Be outraged that we're spying on your country if that makes you feel better, I guess. I'd rather nobody spied on each other either. But it is intellectually dishonest to pretend that people are just now discovering that NSA was breaking into computers around the world. That is literally the charter of the NSA. It's why they exist at all. There isn't even a pretense of a different purpose for the organization.
- arkitaip 13y ago
  I guess that makes it ok then.
  - tptacek 13y ago
    Sovereign countries interact in the state of nature. Your country has a problem with the NSA? Pick up a SAT solver and build yourself some ROP shellcode and hit us back. Oh wait: your country's already doing that. Do I like it? No. We don't work with the USG, and that's one of many reasons why.
    - cpach 13y ago
      I’m not sure what intrusions you’re referring to. Would you care to elaborate?
    - Luc 13y ago
      My country? Are you kidding, they couldn't hack their way out of a paper bag. Any expertise and equipment they have is provided by the NSA, and they're a bunch of B-players with no budget. The whole situation is uncomfortably asymmetric. Economies of scale I guess. Winner takes it all.
      - tptacek 13y ago
        Cheer up. We're also protecting the world's shipping lanes.
belorn 13y ago
What would happen if NSA mistakenly targets a nuclear reactor, and a bug in the malicious software caused a meltdown. Is that a declaration of war, similar to a US launching a nuke? Would US be liable, and under what jurisdiction? Could the US President be put under Interpool arrest warrant, charged as an terrorist? Sabotage, especially when the target can not be fully verified, is a dangerous game. IP addresses are easily mistakenly taken as identity, even if proxying is the number one method to evade detection.
- betterunix 13y ago
  "What would happen if NSA mistakenly targets a nuclear reactor, and a bug in the malicious software caused a meltdown." What would happen if the NSA introduced a weakness in a cryptosystem that was used to secure major utilities in the USA? The NSA does not care about such external effects.
- tptacek 13y ago
  Yes, that seems pretty simple: if NSA hacking caused a nuclear disaster, that would be an act of war. And?
  - looser 13y ago
    No, that would not simply be an act of war. If that was the case, it would actually be a war crime, according to the international humanitarian law.
    - tptacek 13y ago
      "International law" is a lie we tell ourselves to make us feel safer. And, I'm on the "all wars are crimes" side of this issue as well.
  - belorn 13y ago
    > And? Like during the cold war, the world was a button press from global collapse. It is not a good thing that random act of sabotage against targets which the attacker can't and won't verify is happening with such indifference to consequences. As citizens, we should react with more than "And?".
dragonbonheur 13y ago
Don't people usually get to spend decades in prison for that? Shouldn't justice be the same for the NSA as it was for Kevin Mitnick?
- smtddr 13y ago
  As much as I really don't like what the NSA is doing, this argument isn't valid. Law enforcement privileges cannot be directly compared to those of regular citizens. If you want to argue they've abused their privileges... then I'm with you 1,337%
  - salient 13y ago
    Is NSA "law enforcement" though? They are spies. It is (or should be) also quite illegal for them to be doing that to its own citizens, so if they do that, they should be in prison. Too bad we live in a time where the president of US and Congress, prefer to protect these guys no matter what (whether it's spying or torture), instead of punishing them according to the law.
    - malandrew 13y ago
      I really don't consider the NSA to be law enforcement. What, if any, US laws are they responsible for enforcing? The FBI, Secret Service, Highway Patrol, city, state and country police departments, sheriffs, etc. are all in charge of enforcing laws. The NSA and the CIA as far as I can tell are not. Additionally neither are really tasked with domestic operations of any kind. National domestic law enforcement issues fall under the jurisdiction of the FBI.
  - AJ007 13y ago
    I don't think the NSA is a law enforcer. They are an intelligence collector which may utilized by either the military, law enforcement, or executive branch. Law enforcement still has to behave within the confines of the law. Unfortunately what we've had in the US is a revolving door of individuals who neither respect nor enforce the law. The Obama administration's attacks on whistle blowers is the equivalent to an organized criminal syndicate attempted to intimidate and snuff out informants. Law enforcement has been turned upon itself, rather than going after the individuals breaking the law, they are going after those who are providing evidence of the crime. For the record, and I've stated this before, there are two very separate issues here -- what the NSA does to the US & what the NSA does to everyone else. I am only referring to what is occurring in the US against US citizens (and US corporations.) There is very little disagreement that what has been done in the past and what likely is continuing does not fall within the confines of US law. The complicit and conspiratorial behavior among the highest levels of law enforcement & military mean there is no investigation, no prosecution, no tribunal for what is undoubtedly illegal behavior. What the US's allies think about blanket surveillance and espionage is another matter, which should be debated between citizens of those democracies.
imd23 13y ago
Is it me or with NSA entities power we do not live in democracy anymore? They can manipulate everything, from google results, voice, emails to the actuals votes.
malandrew 13y ago
It's stories like this that make me wish we had the term "national security" as narrowly defined as the term "treason". I wouldn't be surprised if many of America's largest corporations most often present their corporate interests as national security interests when they are lobbying our politicians. Looking at that map, we need to be asking questions about where so many of those "implants" are located. I'm not surprised by all the little yellow dots covering China and Russia, But what are they doing littered all over Latin America (except Venezuela and Cuba). I would like to here the justification for considering Brazil a national security threat. Same for the red dots in places like Spain, Portugal and France. The only national security threat in Brazil AFAIK is the Comando Vermelho[0], which operates out of Rio de Janeiro. And even then, only a few of the criminal organization leaders in Brazil tenuously relevant to US national security interests, such as Fernandinho Beira Mar[1]. The only way to justify the extent of such offensive implants is if we are using a definition of "national security" that is overly broad. The only conclusion I can come to is that we've effectively waging a war against the rest of the World without an act of Congress declaring such a war. [0] http://en.wikipedia.org/wiki/Comando_Vermelho http://en.wikipedia.org/wiki/Comando_Vermelho [1] IIRC, FBM is responsible for supplying a lot of the advanced Russian-made arms to the FARC. Even then the FARC is only a national security interest of the US because of our completely failed war on drugs.
- consonants 13y ago
  Given the US's covert and not so covert operations in Latin America, this comes as no surprise. Just because our goons are aren't over there making sure our economic interests are enforced doesn't mean we gave up on our stronghold.
- tracker1 13y ago
  Not to excuse the actions, which I find deplorable. Isn't Brazil one of our major agricultural trading partners? Making the internal security interests of Brazil our security interests? If our food supply was cut by 1/3 during half the year, that could be a big issue.
  - dmix 13y ago
bediger4000 13y ago
So, the 250 lb gorilla in the room: Linux, or Windows or ...? Seriously, I'd like to know. I mean it's probably Windows for all the usual reasons (incomparable installed base, lots of attack surface, active exploit community, MSFT gives exploits to NSA before publishing), but what if it isn't? What if all this is done by Cisco IOS?
- tracker1 13y ago
  Given the amount of closed source routing hardware built by U.S. companies, it would surprise me more if they weren't complicit in similar activities to Microsoft on this topic. I've never been big on conspiracy theories, but this isn't really so much a conspiracy as what would be an obvious point of being able to distribute information from global sources. When Iran buys computer hardware via third parties, odds are the software may well be a generation or two older... Having knowledge of internal exploit vectors would be invaluable to a state actor (like the NSA). In my career I've been contacted (usually by recruiter) to consider projects by the RIAA, MPAA and the NSA... None of these were cracking projects or otherwise covert that I am aware of. Just the same, I don't think I could work for an organization that works directly against ideologies that I believe in.. those being liberty, privacy and the greater public good. On the last point some may well believe that these organizations work towards that, I disagree.
balabaster 13y ago
what pisses me off most about this is that if you, Joe Public does it, it's illegal and if you get caught, you're arrested and charged for computer fraud, espionage or whatever else they can pin on you. But it's fine for them to do the same thing. The hypocrisy is disgraceful.
- cypherpunks01 13y ago
  Steal a little and they throw you in jail, steal a lot and they make you King.
  - balabaster 13y ago
    Ain't that the truth
d0ugie 13y ago
On one hand I can see how this looks bad (along with all the other revelations), but you've got to admit, for the taxes we've been paying, it's impressive how, albeit arguably misguided, talented and prolific our intelligence agencies are.
imahboob 13y ago
By treating allies like enemies US is creating new enemies.

155 points by cyberviewer 13y ago

As an American, I feel like my country is actually putting me in long-term danger. The government is making America and Americans enemies of the entire world. If and when I ultimately have to feel the country, will I even be accepted into anywhere else? What if they are suspicious that I work for the NSA? Or what if they just decide to treat Americans the way the US treats would-be immigrants to the US now--no, you can't come in?

smtddr 13y ago
>> As an American, I feel like my country is actually putting me in long-term danger. The government is making America and Americans enemies of the entire world. That has been happening since forever; it's just that the NSA stuff has made that fact visible to people who didn't see America's hypocrisy before. I mean, there are people who actually believe this ---> https://www.youtube.com/watch?v=p6HOcLWP-Ls https://www.youtube.com/watch?v=p6HOcLWP-Ls
- javert 13y ago
  I don't want to take the time to watch that video, but I actually do think that 99% of hatred of America historically has been due to the moral inferiority of the haters. For example, fundamentalist Islamists, and all those who wish to sympathize with them, are "right" to hate America. Socialists are right to hate America--the American constitution fundamentally stands for the opposite moral code, and American prosperity is evidence that the American morality is the right one. That said, the GOP is opposed to that very morality, and the Democrat party even more-so, so the country is being rapidly destroyed from the inside (and has been on that path for almost 100 years, just accelerating or decelerating occasionally).
  - marcosdumay 13y ago
    Nope. The reason some people hate the US is because the country interferes (up to the point of overthrowing governments) with the entire world. Yeah, it can be argued that there is some kind of problem with people more prone to hating than to actually dealing with the problem. But there is no excuse to think the reason that they target the US any other than them destroying their country.
Zigurd 13y ago
> The government is making America and Americans enemies of the entire world. Has made. It's water under the bridge now. All there is left to do is watch how it plays out: Which US companies will lose their overseas customers because they cannot assure their customers regarding back doors in their products and services? We have already seen IBM and Cisco take significant financial hits. Which nations are sufficiently independent, or have people sufficiently restive, to take an official position against pervasive surveillance and actually purge their intelligence services of foreign liaisons and cooperation in surveillance? Conversely, we will see which governments agree with and accept pervasive surveillance. Where will new centers of expertise in cryptography develop? How much of this will flow back into other areas of diplomacy? Will nations be generally more wary of intelligence and military liasons with the US?
epo 13y ago
The danger is two-fold: firstly the USA is losing friends abroad, 'allies' are realising that at best they were slightly favoured underlings but never equals. At least this is explicit from the outset with China. Secondly, America's power and influence is fading, slowly admittedly, but fading nonetheless. Like here in the UK your turn will come when you realise what it is like to be yesterday's bully boy. Ours came with the break up of Empire, yours may come when the world calls in your debts or builds walls to isolate your corrupt financial structures. America was once admired and respected. Now it is increasingly like some blundering fat tourist in a brothel, people pretend to be nice to you because they want your money. But really, nobody is your friend.

tptacek 13y ago

We don't need the Snowden disclosures to know this; it has for 15 years been the worst kept secret in computer security. People from the various groups in NSA that do this work talk about having done it on Twitter. Some of the smartest people in vulnerability research came from stints in NSA. Be outraged that we're spying on your country if that makes you feel better, I guess. I'd rather nobody spied on each other either. But it is intellectually dishonest to pretend that people are just now discovering that NSA was breaking into computers around the world. That is literally the charter of the NSA. It's why they exist at all. There isn't even a pretense of a different purpose for the organization.

arkitaip 13y ago
I guess that makes it ok then.
- tptacek 13y ago
  Sovereign countries interact in the state of nature. Your country has a problem with the NSA? Pick up a SAT solver and build yourself some ROP shellcode and hit us back. Oh wait: your country's already doing that. Do I like it? No. We don't work with the USG, and that's one of many reasons why.
  - cpach 13y ago
    I’m not sure what intrusions you’re referring to. Would you care to elaborate?
  - Luc 13y ago
    My country? Are you kidding, they couldn't hack their way out of a paper bag. Any expertise and equipment they have is provided by the NSA, and they're a bunch of B-players with no budget. The whole situation is uncomfortably asymmetric. Economies of scale I guess. Winner takes it all.
    - tptacek 13y ago
      Cheer up. We're also protecting the world's shipping lanes.

belorn 13y ago

What would happen if NSA mistakenly targets a nuclear reactor, and a bug in the malicious software caused a meltdown. Is that a declaration of war, similar to a US launching a nuke? Would US be liable, and under what jurisdiction? Could the US President be put under Interpool arrest warrant, charged as an terrorist? Sabotage, especially when the target can not be fully verified, is a dangerous game. IP addresses are easily mistakenly taken as identity, even if proxying is the number one method to evade detection.

betterunix 13y ago
"What would happen if NSA mistakenly targets a nuclear reactor, and a bug in the malicious software caused a meltdown." What would happen if the NSA introduced a weakness in a cryptosystem that was used to secure major utilities in the USA? The NSA does not care about such external effects.
tptacek 13y ago
Yes, that seems pretty simple: if NSA hacking caused a nuclear disaster, that would be an act of war. And?
- looser 13y ago
  No, that would not simply be an act of war. If that was the case, it would actually be a war crime, according to the international humanitarian law.
  - tptacek 13y ago
    "International law" is a lie we tell ourselves to make us feel safer. And, I'm on the "all wars are crimes" side of this issue as well.
- belorn 13y ago
  > And? Like during the cold war, the world was a button press from global collapse. It is not a good thing that random act of sabotage against targets which the attacker can't and won't verify is happening with such indifference to consequences. As citizens, we should react with more than "And?".

dragonbonheur 13y ago

Don't people usually get to spend decades in prison for that? Shouldn't justice be the same for the NSA as it was for Kevin Mitnick?

smtddr 13y ago
As much as I really don't like what the NSA is doing, this argument isn't valid. Law enforcement privileges cannot be directly compared to those of regular citizens. If you want to argue they've abused their privileges... then I'm with you 1,337%
- salient 13y ago
  Is NSA "law enforcement" though? They are spies. It is (or should be) also quite illegal for them to be doing that to its own citizens, so if they do that, they should be in prison. Too bad we live in a time where the president of US and Congress, prefer to protect these guys no matter what (whether it's spying or torture), instead of punishing them according to the law.
  - malandrew 13y ago
    I really don't consider the NSA to be law enforcement. What, if any, US laws are they responsible for enforcing? The FBI, Secret Service, Highway Patrol, city, state and country police departments, sheriffs, etc. are all in charge of enforcing laws. The NSA and the CIA as far as I can tell are not. Additionally neither are really tasked with domestic operations of any kind. National domestic law enforcement issues fall under the jurisdiction of the FBI.
- AJ007 13y ago
  I don't think the NSA is a law enforcer. They are an intelligence collector which may utilized by either the military, law enforcement, or executive branch. Law enforcement still has to behave within the confines of the law. Unfortunately what we've had in the US is a revolving door of individuals who neither respect nor enforce the law. The Obama administration's attacks on whistle blowers is the equivalent to an organized criminal syndicate attempted to intimidate and snuff out informants. Law enforcement has been turned upon itself, rather than going after the individuals breaking the law, they are going after those who are providing evidence of the crime. For the record, and I've stated this before, there are two very separate issues here -- what the NSA does to the US & what the NSA does to everyone else. I am only referring to what is occurring in the US against US citizens (and US corporations.) There is very little disagreement that what has been done in the past and what likely is continuing does not fall within the confines of US law. The complicit and conspiratorial behavior among the highest levels of law enforcement & military mean there is no investigation, no prosecution, no tribunal for what is undoubtedly illegal behavior. What the US's allies think about blanket surveillance and espionage is another matter, which should be debated between citizens of those democracies.

imd23 13y ago

Is it me or with NSA entities power we do not live in democracy anymore? They can manipulate everything, from google results, voice, emails to the actuals votes.

malandrew 13y ago

It's stories like this that make me wish we had the term "national security" as narrowly defined as the term "treason". I wouldn't be surprised if many of America's largest corporations most often present their corporate interests as national security interests when they are lobbying our politicians. Looking at that map, we need to be asking questions about where so many of those "implants" are located. I'm not surprised by all the little yellow dots covering China and Russia, But what are they doing littered all over Latin America (except Venezuela and Cuba). I would like to here the justification for considering Brazil a national security threat. Same for the red dots in places like Spain, Portugal and France. The only national security threat in Brazil AFAIK is the Comando Vermelho[0], which operates out of Rio de Janeiro. And even then, only a few of the criminal organization leaders in Brazil tenuously relevant to US national security interests, such as Fernandinho Beira Mar[1]. The only way to justify the extent of such offensive implants is if we are using a definition of "national security" that is overly broad. The only conclusion I can come to is that we've effectively waging a war against the rest of the World without an act of Congress declaring such a war. [0] http://en.wikipedia.org/wiki/Comando_Vermelho http://en.wikipedia.org/wiki/Comando_Vermelho [1] IIRC, FBM is responsible for supplying a lot of the advanced Russian-made arms to the FARC. Even then the FARC is only a national security interest of the US because of our completely failed war on drugs.

consonants 13y ago
Given the US's covert and not so covert operations in Latin America, this comes as no surprise. Just because our goons are aren't over there making sure our economic interests are enforced doesn't mean we gave up on our stronghold.
tracker1 13y ago
Not to excuse the actions, which I find deplorable. Isn't Brazil one of our major agricultural trading partners? Making the internal security interests of Brazil our security interests? If our food supply was cut by 1/3 during half the year, that could be a big issue.
- dmix 13y ago

bediger4000 13y ago

So, the 250 lb gorilla in the room: Linux, or Windows or ...? Seriously, I'd like to know. I mean it's probably Windows for all the usual reasons (incomparable installed base, lots of attack surface, active exploit community, MSFT gives exploits to NSA before publishing), but what if it isn't? What if all this is done by Cisco IOS?

tracker1 13y ago
Given the amount of closed source routing hardware built by U.S. companies, it would surprise me more if they weren't complicit in similar activities to Microsoft on this topic. I've never been big on conspiracy theories, but this isn't really so much a conspiracy as what would be an obvious point of being able to distribute information from global sources. When Iran buys computer hardware via third parties, odds are the software may well be a generation or two older... Having knowledge of internal exploit vectors would be invaluable to a state actor (like the NSA). In my career I've been contacted (usually by recruiter) to consider projects by the RIAA, MPAA and the NSA... None of these were cracking projects or otherwise covert that I am aware of. Just the same, I don't think I could work for an organization that works directly against ideologies that I believe in.. those being liberty, privacy and the greater public good. On the last point some may well believe that these organizations work towards that, I disagree.

balabaster 13y ago

what pisses me off most about this is that if you, Joe Public does it, it's illegal and if you get caught, you're arrested and charged for computer fraud, espionage or whatever else they can pin on you. But it's fine for them to do the same thing. The hypocrisy is disgraceful.

cypherpunks01 13y ago
Steal a little and they throw you in jail, steal a lot and they make you King.
- balabaster 13y ago
  Ain't that the truth

d0ugie 13y ago

On one hand I can see how this looks bad (along with all the other revelations), but you've got to admit, for the taxes we've been paying, it's impressive how, albeit arguably misguided, talented and prolific our intelligence agencies are.

imahboob 13y ago

By treating allies like enemies US is creating new enemies.