3 ms·

Through all of the news articles and the analyses I have read, I still don't understand how exactly all of this works. I understand the MITM concept, but the M

Through all of the news articles and the analyses I have read, I still don't understand how exactly all of this works. I understand the MITM concept, but the Man-On-The-Side parts boggle m: "When a target attempts to log in to the social media site, the NSA transmits malicious data packets that trick the target’s computer into thinking they are being sent from the real Facebook. By concealing its malware within what looks like an ordinary Facebook page, the NSA is able to hack into the targeted computer and covertly siphon out data from its hard drive." Where is the security hole? My network card? OS? Browser? But then there are so many layers in there. Is it a specially malformed ICMP packet? Or is it a vulnerability in the OS's RPC functions? It's one thing to exploit a vulnerability in Java or Flash, but just using "malicious packets"?

Consultant32452 13y ago
It seems to me that they are sending out packets identifying themselves as facebook. If you're not using SSL this is expected to be possible. If you are using SSL to communicate with FB then it's likely that the NSA has the private keys for FB's SSL certificates.
- ds9 13y ago
  Right, I think this is referring to a technique described in some of the earlier info releases, where the agency intercepts requests and send a fake response before the real one arrives, and ditching the real response. I'm not clear on the details - it may rely on spoofing the server's IP, falsifying DNS replies and/or manipulating data in transit. What interests me more, and what the above poster may be asking about is this part: "By concealing its malware within what looks like an ordinary Facebook page, the NSA is able to hack into the targeted computer". This implies a true drive-by exploit - one not requiring any user interaction. Most of the Windows malware is actually installed by the user - they're tricked into clicking something, thinking it's anti-virus, funny video, "accelerate your internet" or some other innocuous thing. The no-user-action exploits generally have been workable only for plugins, particularly Flash or Java, which the user has allowed to run without any filters.
  - snake_plissken 13y ago
    Yup, your second paragraph nails it. But even then, it boarders on XSS or some hybrid injection attack which would rely on a vulnerability somewhere else up the stack. The way I understood a lot of this article, I'm lead to believe that their able to monitor/intercept a target's requests, imitate the web server and send replies which are so meticulously malformed that they are able to infect the target system. Like I said in my post and which you echo in your third paragraph, it's one thing to trick users into downloading and running binaries or to exploit a plugin, but it's another thing to imagine malformed packets breaking the security of an entire system.

Consultant32452 13y ago

It seems to me that they are sending out packets identifying themselves as facebook. If you're not using SSL this is expected to be possible. If you are using SSL to communicate with FB then it's likely that the NSA has the private keys for FB's SSL certificates.

ds9 13y ago
Right, I think this is referring to a technique described in some of the earlier info releases, where the agency intercepts requests and send a fake response before the real one arrives, and ditching the real response. I'm not clear on the details - it may rely on spoofing the server's IP, falsifying DNS replies and/or manipulating data in transit. What interests me more, and what the above poster may be asking about is this part: "By concealing its malware within what looks like an ordinary Facebook page, the NSA is able to hack into the targeted computer". This implies a true drive-by exploit - one not requiring any user interaction. Most of the Windows malware is actually installed by the user - they're tricked into clicking something, thinking it's anti-virus, funny video, "accelerate your internet" or some other innocuous thing. The no-user-action exploits generally have been workable only for plugins, particularly Flash or Java, which the user has allowed to run without any filters.
- snake_plissken 13y ago
  Yup, your second paragraph nails it. But even then, it boarders on XSS or some hybrid injection attack which would rely on a vulnerability somewhere else up the stack. The way I understood a lot of this article, I'm lead to believe that their able to monitor/intercept a target's requests, imitate the web server and send replies which are so meticulously malformed that they are able to infect the target system. Like I said in my post and which you echo in your third paragraph, it's one thing to trick users into downloading and running binaries or to exploit a plugin, but it's another thing to imagine malformed packets breaking the security of an entire system.