11 ms·

Shopping for Spy Gear: Catalog Advertises N.S.A. Toolbox

fabian2k 13y ago
The NSA must have an enormous pile of unkown exploits to facilitate all that. I wonder how they prevent other US agencies and government networks to be vulnerable to the exploits the NSA uses itself, or if they even bother trying to do that. Leaving pretty much the entire IT infrastructure vulnerable seems like a very dangerous strategy.
- salient 13y ago
  > Leaving pretty much the entire IT infrastructure vulnerable seems like a very dangerous strategy. From NSA's perspective? I'm not so sure. A severe attack on US infrastructure would probably mean just more money and more legal power thrown at NSA to "fix it". Then NSA will continue to do what they've done so far - put most of that "security" money, into offensive capabilities. So the cycle will continue, as the systems remain vulnerable.
- louwrentius 13y ago
  It is fascinating that if they just would inform vendors on their security vulnerabilities and have them patched, that this would probably make us more secure than the eavesdropping they can do with the exploits.
  - danielweber 13y ago
    It depends on the resources involved. A big assumption that lots of bug-hunters make, that "this is one of the last bugs, and once fixed, the product will be much more secure." But there are always more bugs. If you assume that are more exploitable bugs beyond the one you are fixing now, it means that the vendors and customers have to spend time and money patching things, and won't really be any more secure afterwards. Also "if I found it, so can The Bad Guys" is something that applies to individuals and small research teams. It's not necessarily the case that when the NSA finds something that other people are going to find it, too. Also, unlike most security researchers, the NSA has the resources to monitor if other people are exploiting the vulnerabilities they found. I'm not saying that the country wouldn't be safer if the NSA disclosed these vulnerabilities to vendors. I'm only saying that many of the common heuristics that researchers assume as true may not be, and especially not when applied to the NSA.
    - louwrentius 13y ago
      We don't know what we are missing. The Iranian NSA may miss what we found. But it still is a dangerous game that is being played. Leaving the doors open and watch them closely. Or they just don't care for most organisations being compromised.
    - jessaustin 13y ago
      ...there are always more bugs. True but trivial. It's much more instructive to pay attention to the rate at which vulnerabilities are discovered. For e.g. qmail that rate is very close to zero per decade. For less secure products the rate varies over time; some researchers have noted a sort of "honeymoon" period that protects new code. Packages that don't in some sense eventually "settle down" after that period ends might ought to be replaced. Or perhaps they are important or unimportant enough to mitigate their vulnerabilities through other means.
- ProAm 13y ago
  This allows them to also spy on the US government, which can provide them with valuable information as well. They cannot advertise that the hardware is insecure without giving up their position and capabilities.
- ihsw 13y ago
  That's the idea -- it's OK to pour hundreds of millions of dollars into offensive operations, but defensive operations? Nope, we can't be too quick to put up the walls otherwise our enemies will learn of our 'defensive' techniques and do the same. Furthermore it's an inevitability that our adversaries learn of these offensive techniques, so attempting to keep them a secret is simply a race against time -- and I don't think that's a race we can win. At this point we're arrogantly exercising recklessness and negligence on the hope that we can stay ahead of the wave.
adamors 13y ago
How did this get submitted when the exact same link was posted 2 hours ago? https://news.ycombinator.com/item?id=6979240 https://news.ycombinator.com/item?id=6979240
- bencoder 13y ago
  www subdomain on the original
- sgift 13y ago
  It seems spiegel.de vs www.spiegel.de wasn't caught by HNs duplicate URL detection.
- deleted 13y ago
  [deleted]
w1ntermute 13y ago
After all these years of free software proponents advocating for open source BIOSes and getting mocked for their supposed impracticality, we see the truth.
- danielweber 13y ago
  Why? From the article, they seem to have broken into equipment the same way that "security researchers" would do. They just keep the information for themselves instead of selling it to the vendor, a security company, or the black market. Any pen-testing company has a big list of tools that it keeps internally for breaking into things. Did anyone think that the NSA wouldn't have as big a list of its own?
  - w1ntermute 13y ago
    The NSA has a lot more resources than independent security researchers, and it takes a lot more resources to find vulnerabilities when the software is closed source. If it had been open source, those vulnerabilities would have been much more likely to have been found by independent security researchers as well, and then patched.
    - danielweber 13y ago
      Assuming that the "independent security researchers" were being paid to do it by someone with wholly good intentions, sure. But lots of open-source software have giant vulnerabilities sitting around for years because no one skilled in the art has done the drudge work of going through the code looking for bugs. High-status projects like OpenSSL or qmail will always have a sufficiently large community of researchers constantly combing over them, but the assumption of "well, it's open-source, so someone must have looked through it for security holes" self-fails because everyone assumes someone else did the hard work and often no one does. And if "people looking through the code for exploits" is the measure of a secure code-base, then Windows is the most secure platform ever. Vast numbers of very very qualified (read: expensive) people have looked through that source code specifically to find security holes.
danso 13y ago
Mostly OT: besides the technical details, I'm interested in seeing the actual descriptive text for these items. In my mind, the tone would be something similar to this parody http://www.teamfortress.com/sniper_vs_spy/day04_english.htm http://www.teamfortress.com/sniper_vs_spy/day04_english.htm
K0nserv 13y ago
Anyone have a copy of the suposed catalog? I didn't find a source in the article.
- f_salmon 13y ago
  If WikiLeaks had gotten a copy from Snowden, you would have had this catalog now.
  - K0nserv 13y ago
    It is pretty ridiculous that the press is somewhat exempt from providing sources for their statements. Wikileaks would have been much better.
  - deleted 13y ago
    [deleted]
- slashdotaccount 13y ago
  Just some scans for now: http://cryptome.org/2013/12/nsa-tao-ant.pdf http://cryptome.org/2013/12/nsa-tao-ant.pdf
  - NamTaf 13y ago
    I do love how even in the most secretive of government organisations, there's still some guy who sits around on company time badly photoshopping the intel inside logo to mockingly promote their goals.
f_salmon 13y ago
This is it. Literally everything is infected. Again, either the NSA goes (and you know that won't happen) or information technology goes or democracy as we know it goes. Everyone, take your pick now.
- balozi 13y ago
  процесс деморализации завершена
- colinplamondon 13y ago
  This is effectively a weapons system, and any country with budget can build the same system or better. To stop the NSA would be unilateral disarmament, without reason to expect others to cut back on their infowar programs.
  - malandrew 13y ago
    Or you know maybe we can demand that this unit actively try to help these companies improve the security of everything in the catalog so that we are all secure. Knowingly allowing vulnerabilities to persist in equipment that a US citizen or US corporation purchases from companies like Juniper Networks or Cisco is akin to leaving them unprotected and defenseless against malicious adversaries. We're not asking for disarmament. We're asking for de-weaponization by retasking the TAO and the unit that produces these products to work on defensive activities instead of offensive activities. For a long time many, except those considered tin-foil hatters, viewed the NSA as fundamentally providing a useful service to protect Americans and American companies. Now it's clear the tin-foil hatters were right and that the NSA is essentially an offensive organization and that even American citizens and companies are victims of those offensive capabilities.
blhack 13y ago
How on earth could this possibly be verified? If I was the NSA right now, I would be "leaking" tons of fake, and fantastic, stories about myself in order to discredit any legitimate concerns. I can imagine the talking heads now "well what else were these conspiracy theorists wrong about? Personally I'm glad somebody is out the protecting our freedom." etc.
- 1457389 13y ago
  From the reporting, it looks like they had official documents with an actual price list for various exploits, along with details about what they entailed ("rigged monitor cable", "USB nubs"). What exactly do you consider to be 'verified'? Alexander or Clapper standing up and owning up to it? Good luck with that...
  - sneak 13y ago
    There is little Jake Appelbaum (one of the listed authors of this piece) won't do or say for media attention and public credibility. Documents would be plausible. "Trust us, we've read them" from someone widely known to lie and steal is another matter entirely. Entirely unsubstantiated rumors on the internets suggest that Jake got a talk pulled this week from the CCC hacker conference presently underway in Hamburg (which he keynoted last year) that was due to explore his motives and relationship with the US government, as he is the only US citizen publicly affiliated with Wikileaks and has not yet been charged, arrested, or imprisoned (and Wikileaks has not really done anything damaging to the US government since CM/Cablegate). Don't believe everything you read.
    - 1457389 13y ago
      He hasn't been charged or arrested per se, but he quite regularly talks about other forms of intimidation he undergoes. Laptops confiscated, apartment broken into, phone calls, border detainments. Also, there were two other reporters who filed that story, and it is showing up in a reputable journalistic source - Der Spiegel. I am inclined to believe it, given the very specific details they have highlighted about TAO and ANT.
1457389 13y ago
With a proper oversight regime and individualized warrants, I can see this being an acceptable use of NSA power. With the absurd degree of intrusive latitude the NSA possesses now, it just makes it easier for them to violate civil liberties on a massive scale. Very few people can avoid being compromised by backdoors in these devices and companies, the same way very few people can avoid the physical threat of government aggression. The difference is that the latter has a far more robust system of controls to ensure it is used judiciously and ethically. Until the former has the same, we need to do everything we can to limit or invalidate the NSA's power.
ihsw 13y ago
Somehow I doubt Al Qaeda is using Juniper, but our allies (read: economic adversaries) are. I hope the companies listed -- Dell, Cisco, Juniper, IBM, Western Digital, Seagate, Maxtor, et al -- are happy with themselves. The government's mantra has historically been similar to that of Microsoft's: embrace, extend, extinguish. The US Government is no different and they'll happily throw every company under the bus for the smallest advantage over their adversaries. America's rivalry with China is continually climbing higher and higher, and we're getting dragged along whether we like it or not. The unshakable intertwining of private and public industries, the scorched-earth economic policies where private industry is consumed for the benefit of the public, the unlimited spying powers -- all to stay ahead of China. The real kicker is that this kind of spying power compounds on itself -- as soon as we get Juniper gear exploited then we can move onto infiltrating Seagate's intranets, and then we can use Seagate exploits to more easily dig into hard-drives accessible by us/in custody by us. We may never be able to make a distinction between which tech companies have been exploited and which are wilfully/maliciously passing vulnerability information to the US Government.
- EFruit 13y ago
  >I hope the companies listed -- Dell, Cisco, Juniper, IBM, Western Digital, Seagate, Maxtor, et al -- are happy with themselves. I'm not going to say that these companies are fantastic. I'm just not, but I will say that perhaps this isn't really their fault. Let's say that BIND has a critical vulnerability that allows people to snoop on the requests made. Does that make the ISC guilty of giving the NSA access to every BIND DNS server on the internet? No, it doesn't.
  - joe_the_user 13y ago
    The question is whether these exploits are accidents or the result of companies giving in to pressure from the NSA. If the Snowden revelations are to be believed, at least some of the exploits were the result of giving into NSA pressure. But the problem with this is that it breaks the chain of trust that a company has with it's customers. Once you know the NSA is applying pressure secretly to force some vulnerabilities to remain open, how can you know they aren't doing that with any given vulnerability.
Zaephyr 13y ago
This sorts news makes me shake my head. The scammers are trying to get in, the NSA is in, and now every other state security organisation will feel if they don't try to get in they will be falling behind. All I want is to do is keep clients safe and out of all this cross-fire.
mmaunder 13y ago
The damage that this does to US software and hardware manufacturers and service providers like hosting companies is incalculable. The NSA is providing a strong ongoing incentive to buy your hardware offshore and host your servers offshore. As an American entrepreneur I'm horrified by the long term implications of this. It seems for all the mathematicians they employ they're unable to see that the long term cost of these programs far outweighs the short term benefits.
- deleted 13y ago
  [deleted]
- anologwintermut 13y ago
  The NSA also got Huawei's stuff too. I highly doubt a Chinese company was cooperating with the NSA. Really,it seems like the NSA just went after market leaders and developed exploits against those systems. As far as this article suggests, they had no internal help in doing so. Not using US equipment probably does little. The solution is to make secure equipment that is harder to exploit. Moreover, the argument can be made that if the NSA can find these issues, so can others that the US government considers a threat to national security.
- anigbrowl 13y ago
  You don't think similar conditions apply to overseas manufacturers? That equipment made by companies in, say, France is considered sacrosanct by the French government?
- brown9-2 13y ago
  If you host your stuff offshore, the NSA actually has an easier time as far as bureaucracy goes in attempting to hack into it.
jawerty 13y ago
Can't wait to get Google Glass...
- CamperBob2 13y ago
  To which the NSA's answer will be, "Yo, dawg, we heard you like spying..."
malandrew 13y ago
This new information puts American companies at even more risk of lost sales since given two companies, American Company and Foreign Company, the NSA is always going to have a massive advantage in penetrating the American company to get as much information they want to produce these backdoors. Whenever they fail to remotely access the company networks containing the IP for all the equipment they want to target, they have many more options available to physically access the network of these companies, possibly going as far as having a mole working at the companies, exfiltrating the IP they need to produce the tools in the catalog or even deliberately putting in backdoors. This is probably the most damning information I've seen of NSA activities. This is anti-American activity since it clearly harms US economic interests. This coupled with the policy that spying on foreigners is fair-game is enough reason to give any foreign government or company enough reason never to purchase equipment from US tech companies. As an engineer in the US, this makes my blood boil. I really hope that this new information generates more interest in open-source network software and hardware.
- casca 13y ago
  Juniper were making good inroads into the corporate firewall market at the expense of Checkpoint. It'll be interesting to see whether this sees a move back to Checkpoint as the firewall product of choice.
  - malandrew 13y ago
    More info on Checkpoint? What about an open-source alternative to both?
  - Spooky23 13y ago
    As an Israeli company, I'm sure that they won't be making inroads in the middle eastern markets.
  - midas007 13y ago
    Another reason to consider pfSense (which could use a crowdfunded secaudit like TrueCrypt).
- 13y ago
superuser2 13y ago
So essentially an internal, military-grade Metasploit. It's not surprising that NSA would develop and maintain a strong repertoire of exploits for popular infrastructure. What else did you think an organization tasked "to produce foreign signals intelligence information" was doing with all those computer security experts on staff? Is there evidence that NSA was planting backdoors or that US tech firms were cooperating? Isn't it more likely that NSA was simply discovering (and possibly purchasing) 0-days just like everyone else? They can do that with foreign equipment just as easily. Switching to non-US hardware is just irrational.
wepple 13y ago
This article feels like it may be somewhat misleading around the use of the term "back door". If the NSA has infact backdoored all of those products, kudos for keeping it quiet for this long! if however these products have vulnerabilities in them, like all software does, and the NSA have access to these vulnerabilities (like numerous other people do), it's not quite as devious. In that case they didn't have a super-secret backdoor installed with no-one noticing, but in fact discovered that the window wasn't locked, and kept that a secret.
deleted 13y ago
[deleted]
confluence 13y ago
Stallman was right. Again. http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html Trust nothing. Everything is a lie.
ducksaused 13y ago
So much LULZ

The NSA must have an enormous pile of unkown exploits to facilitate all that. I wonder how they prevent other US agencies and government networks to be vulnerable to the exploits the NSA uses itself, or if they even bother trying to do that. Leaving pretty much the entire IT infrastructure vulnerable seems like a very dangerous strategy.

salient 13y ago
> Leaving pretty much the entire IT infrastructure vulnerable seems like a very dangerous strategy. From NSA's perspective? I'm not so sure. A severe attack on US infrastructure would probably mean just more money and more legal power thrown at NSA to "fix it". Then NSA will continue to do what they've done so far - put most of that "security" money, into offensive capabilities. So the cycle will continue, as the systems remain vulnerable.
louwrentius 13y ago
It is fascinating that if they just would inform vendors on their security vulnerabilities and have them patched, that this would probably make us more secure than the eavesdropping they can do with the exploits.
- danielweber 13y ago
  It depends on the resources involved. A big assumption that lots of bug-hunters make, that "this is one of the last bugs, and once fixed, the product will be much more secure." But there are always more bugs. If you assume that are more exploitable bugs beyond the one you are fixing now, it means that the vendors and customers have to spend time and money patching things, and won't really be any more secure afterwards. Also "if I found it, so can The Bad Guys" is something that applies to individuals and small research teams. It's not necessarily the case that when the NSA finds something that other people are going to find it, too. Also, unlike most security researchers, the NSA has the resources to monitor if other people are exploiting the vulnerabilities they found. I'm not saying that the country wouldn't be safer if the NSA disclosed these vulnerabilities to vendors. I'm only saying that many of the common heuristics that researchers assume as true may not be, and especially not when applied to the NSA.
  - louwrentius 13y ago
    We don't know what we are missing. The Iranian NSA may miss what we found. But it still is a dangerous game that is being played. Leaving the doors open and watch them closely. Or they just don't care for most organisations being compromised.
  - jessaustin 13y ago
    ...there are always more bugs. True but trivial. It's much more instructive to pay attention to the rate at which vulnerabilities are discovered. For e.g. qmail that rate is very close to zero per decade. For less secure products the rate varies over time; some researchers have noted a sort of "honeymoon" period that protects new code. Packages that don't in some sense eventually "settle down" after that period ends might ought to be replaced. Or perhaps they are important or unimportant enough to mitigate their vulnerabilities through other means.
ProAm 13y ago
This allows them to also spy on the US government, which can provide them with valuable information as well. They cannot advertise that the hardware is insecure without giving up their position and capabilities.
ihsw 13y ago
That's the idea -- it's OK to pour hundreds of millions of dollars into offensive operations, but defensive operations? Nope, we can't be too quick to put up the walls otherwise our enemies will learn of our 'defensive' techniques and do the same. Furthermore it's an inevitability that our adversaries learn of these offensive techniques, so attempting to keep them a secret is simply a race against time -- and I don't think that's a race we can win. At this point we're arrogantly exercising recklessness and negligence on the hope that we can stay ahead of the wave.

adamors 13y ago

How did this get submitted when the exact same link was posted 2 hours ago? https://news.ycombinator.com/item?id=6979240 https://news.ycombinator.com/item?id=6979240

bencoder 13y ago
www subdomain on the original
sgift 13y ago
It seems spiegel.de vs www.spiegel.de wasn't caught by HNs duplicate URL detection.
deleted 13y ago
[deleted]

w1ntermute 13y ago

After all these years of free software proponents advocating for open source BIOSes and getting mocked for their supposed impracticality, we see the truth.

danielweber 13y ago
Why? From the article, they seem to have broken into equipment the same way that "security researchers" would do. They just keep the information for themselves instead of selling it to the vendor, a security company, or the black market. Any pen-testing company has a big list of tools that it keeps internally for breaking into things. Did anyone think that the NSA wouldn't have as big a list of its own?
- w1ntermute 13y ago
  The NSA has a lot more resources than independent security researchers, and it takes a lot more resources to find vulnerabilities when the software is closed source. If it had been open source, those vulnerabilities would have been much more likely to have been found by independent security researchers as well, and then patched.
  - danielweber 13y ago
    Assuming that the "independent security researchers" were being paid to do it by someone with wholly good intentions, sure. But lots of open-source software have giant vulnerabilities sitting around for years because no one skilled in the art has done the drudge work of going through the code looking for bugs. High-status projects like OpenSSL or qmail will always have a sufficiently large community of researchers constantly combing over them, but the assumption of "well, it's open-source, so someone must have looked through it for security holes" self-fails because everyone assumes someone else did the hard work and often no one does. And if "people looking through the code for exploits" is the measure of a secure code-base, then Windows is the most secure platform ever. Vast numbers of very very qualified (read: expensive) people have looked through that source code specifically to find security holes.

danso 13y ago

Mostly OT: besides the technical details, I'm interested in seeing the actual descriptive text for these items. In my mind, the tone would be something similar to this parody http://www.teamfortress.com/sniper_vs_spy/day04_english.htm http://www.teamfortress.com/sniper_vs_spy/day04_english.htm

K0nserv 13y ago

Anyone have a copy of the suposed catalog? I didn't find a source in the article.

f_salmon 13y ago
If WikiLeaks had gotten a copy from Snowden, you would have had this catalog now.
- K0nserv 13y ago
  It is pretty ridiculous that the press is somewhat exempt from providing sources for their statements. Wikileaks would have been much better.
- deleted 13y ago
  [deleted]
slashdotaccount 13y ago
Just some scans for now: http://cryptome.org/2013/12/nsa-tao-ant.pdf http://cryptome.org/2013/12/nsa-tao-ant.pdf
- NamTaf 13y ago
  I do love how even in the most secretive of government organisations, there's still some guy who sits around on company time badly photoshopping the intel inside logo to mockingly promote their goals.

f_salmon 13y ago

This is it. Literally everything is infected. Again, either the NSA goes (and you know that won't happen) or information technology goes or democracy as we know it goes. Everyone, take your pick now.

balozi 13y ago
процесс деморализации завершена
colinplamondon 13y ago
This is effectively a weapons system, and any country with budget can build the same system or better. To stop the NSA would be unilateral disarmament, without reason to expect others to cut back on their infowar programs.
- malandrew 13y ago
  Or you know maybe we can demand that this unit actively try to help these companies improve the security of everything in the catalog so that we are all secure. Knowingly allowing vulnerabilities to persist in equipment that a US citizen or US corporation purchases from companies like Juniper Networks or Cisco is akin to leaving them unprotected and defenseless against malicious adversaries. We're not asking for disarmament. We're asking for de-weaponization by retasking the TAO and the unit that produces these products to work on defensive activities instead of offensive activities. For a long time many, except those considered tin-foil hatters, viewed the NSA as fundamentally providing a useful service to protect Americans and American companies. Now it's clear the tin-foil hatters were right and that the NSA is essentially an offensive organization and that even American citizens and companies are victims of those offensive capabilities.

blhack 13y ago

How on earth could this possibly be verified? If I was the NSA right now, I would be "leaking" tons of fake, and fantastic, stories about myself in order to discredit any legitimate concerns. I can imagine the talking heads now "well what else were these conspiracy theorists wrong about? Personally I'm glad somebody is out the protecting our freedom." etc.

1457389 13y ago
From the reporting, it looks like they had official documents with an actual price list for various exploits, along with details about what they entailed ("rigged monitor cable", "USB nubs"). What exactly do you consider to be 'verified'? Alexander or Clapper standing up and owning up to it? Good luck with that...
- sneak 13y ago
  There is little Jake Appelbaum (one of the listed authors of this piece) won't do or say for media attention and public credibility. Documents would be plausible. "Trust us, we've read them" from someone widely known to lie and steal is another matter entirely. Entirely unsubstantiated rumors on the internets suggest that Jake got a talk pulled this week from the CCC hacker conference presently underway in Hamburg (which he keynoted last year) that was due to explore his motives and relationship with the US government, as he is the only US citizen publicly affiliated with Wikileaks and has not yet been charged, arrested, or imprisoned (and Wikileaks has not really done anything damaging to the US government since CM/Cablegate). Don't believe everything you read.
  - 1457389 13y ago
    He hasn't been charged or arrested per se, but he quite regularly talks about other forms of intimidation he undergoes. Laptops confiscated, apartment broken into, phone calls, border detainments. Also, there were two other reporters who filed that story, and it is showing up in a reputable journalistic source - Der Spiegel. I am inclined to believe it, given the very specific details they have highlighted about TAO and ANT.

1457389 13y ago

With a proper oversight regime and individualized warrants, I can see this being an acceptable use of NSA power. With the absurd degree of intrusive latitude the NSA possesses now, it just makes it easier for them to violate civil liberties on a massive scale. Very few people can avoid being compromised by backdoors in these devices and companies, the same way very few people can avoid the physical threat of government aggression. The difference is that the latter has a far more robust system of controls to ensure it is used judiciously and ethically. Until the former has the same, we need to do everything we can to limit or invalidate the NSA's power.

ihsw 13y ago

Somehow I doubt Al Qaeda is using Juniper, but our allies (read: economic adversaries) are. I hope the companies listed -- Dell, Cisco, Juniper, IBM, Western Digital, Seagate, Maxtor, et al -- are happy with themselves. The government's mantra has historically been similar to that of Microsoft's: embrace, extend, extinguish. The US Government is no different and they'll happily throw every company under the bus for the smallest advantage over their adversaries. America's rivalry with China is continually climbing higher and higher, and we're getting dragged along whether we like it or not. The unshakable intertwining of private and public industries, the scorched-earth economic policies where private industry is consumed for the benefit of the public, the unlimited spying powers -- all to stay ahead of China. The real kicker is that this kind of spying power compounds on itself -- as soon as we get Juniper gear exploited then we can move onto infiltrating Seagate's intranets, and then we can use Seagate exploits to more easily dig into hard-drives accessible by us/in custody by us. We may never be able to make a distinction between which tech companies have been exploited and which are wilfully/maliciously passing vulnerability information to the US Government.

EFruit 13y ago
>I hope the companies listed -- Dell, Cisco, Juniper, IBM, Western Digital, Seagate, Maxtor, et al -- are happy with themselves. I'm not going to say that these companies are fantastic. I'm just not, but I will say that perhaps this isn't really their fault. Let's say that BIND has a critical vulnerability that allows people to snoop on the requests made. Does that make the ISC guilty of giving the NSA access to every BIND DNS server on the internet? No, it doesn't.
- joe_the_user 13y ago
  The question is whether these exploits are accidents or the result of companies giving in to pressure from the NSA. If the Snowden revelations are to be believed, at least some of the exploits were the result of giving into NSA pressure. But the problem with this is that it breaks the chain of trust that a company has with it's customers. Once you know the NSA is applying pressure secretly to force some vulnerabilities to remain open, how can you know they aren't doing that with any given vulnerability.

Zaephyr 13y ago

This sorts news makes me shake my head. The scammers are trying to get in, the NSA is in, and now every other state security organisation will feel if they don't try to get in they will be falling behind. All I want is to do is keep clients safe and out of all this cross-fire.

mmaunder 13y ago

The damage that this does to US software and hardware manufacturers and service providers like hosting companies is incalculable. The NSA is providing a strong ongoing incentive to buy your hardware offshore and host your servers offshore. As an American entrepreneur I'm horrified by the long term implications of this. It seems for all the mathematicians they employ they're unable to see that the long term cost of these programs far outweighs the short term benefits.

deleted 13y ago
[deleted]
anologwintermut 13y ago
The NSA also got Huawei's stuff too. I highly doubt a Chinese company was cooperating with the NSA. Really,it seems like the NSA just went after market leaders and developed exploits against those systems. As far as this article suggests, they had no internal help in doing so. Not using US equipment probably does little. The solution is to make secure equipment that is harder to exploit. Moreover, the argument can be made that if the NSA can find these issues, so can others that the US government considers a threat to national security.
anigbrowl 13y ago
You don't think similar conditions apply to overseas manufacturers? That equipment made by companies in, say, France is considered sacrosanct by the French government?
brown9-2 13y ago
If you host your stuff offshore, the NSA actually has an easier time as far as bureaucracy goes in attempting to hack into it.

jawerty 13y ago

Can't wait to get Google Glass...

CamperBob2 13y ago
To which the NSA's answer will be, "Yo, dawg, we heard you like spying..."

malandrew 13y ago

This new information puts American companies at even more risk of lost sales since given two companies, American Company and Foreign Company, the NSA is always going to have a massive advantage in penetrating the American company to get as much information they want to produce these backdoors. Whenever they fail to remotely access the company networks containing the IP for all the equipment they want to target, they have many more options available to physically access the network of these companies, possibly going as far as having a mole working at the companies, exfiltrating the IP they need to produce the tools in the catalog or even deliberately putting in backdoors. This is probably the most damning information I've seen of NSA activities. This is anti-American activity since it clearly harms US economic interests. This coupled with the policy that spying on foreigners is fair-game is enough reason to give any foreign government or company enough reason never to purchase equipment from US tech companies. As an engineer in the US, this makes my blood boil. I really hope that this new information generates more interest in open-source network software and hardware.

casca 13y ago
Juniper were making good inroads into the corporate firewall market at the expense of Checkpoint. It'll be interesting to see whether this sees a move back to Checkpoint as the firewall product of choice.
- malandrew 13y ago
  More info on Checkpoint? What about an open-source alternative to both?
- Spooky23 13y ago
  As an Israeli company, I'm sure that they won't be making inroads in the middle eastern markets.
- midas007 13y ago
  Another reason to consider pfSense (which could use a crowdfunded secaudit like TrueCrypt).
13y ago

superuser2 13y ago

So essentially an internal, military-grade Metasploit. It's not surprising that NSA would develop and maintain a strong repertoire of exploits for popular infrastructure. What else did you think an organization tasked "to produce foreign signals intelligence information" was doing with all those computer security experts on staff? Is there evidence that NSA was planting backdoors or that US tech firms were cooperating? Isn't it more likely that NSA was simply discovering (and possibly purchasing) 0-days just like everyone else? They can do that with foreign equipment just as easily. Switching to non-US hardware is just irrational.

wepple 13y ago

This article feels like it may be somewhat misleading around the use of the term "back door". If the NSA has infact backdoored all of those products, kudos for keeping it quiet for this long! if however these products have vulnerabilities in them, like all software does, and the NSA have access to these vulnerabilities (like numerous other people do), it's not quite as devious. In that case they didn't have a super-secret backdoor installed with no-one noticing, but in fact discovered that the window wasn't locked, and kept that a secret.

deleted 13y ago

[deleted]

confluence 13y ago

Stallman was right. Again. http://stallman.org/stallman-computing.html http://stallman.org/stallman-computing.html Trust nothing. Everything is a lie.

ducksaused 13y ago

So much LULZ