12 ms·
I Hunt Sys Admins
- Wyrmkill 13y agoWho else feels like they just read an excellent spy novel, but that maybe it was a little over the top in conspiracy zealotry. Only to find out at the end, it's all been real and the people with the tin foil hats aren't really that far off base.
- ForHackernews 13y agoTL;DR: Never use Telnet for anything.
- skue 13y agoIf you're going to provide a TL;DR for others, it's best to read to the end first... telnet was used as an early example, but the writer went on to explain how to target ssh too.
- Pitarou 13y agoTL;DR Never use anything for anything. These guys make the "professional" hacker gangs look like a bunch of clueless amateurs.
- trolleyed 13y agoThey have resources, though every technique in this paper is very simple. There are some incredibly talented people out there, and not all of them work for the NSA.
- Pitarou 13y agoI quite agree. Ultimately, it's all about the resources. Their budget is more than half that of NASA. The "simple" techniques are enabled by some very sophisticated backend stuff that is just taken for granted in these slides.
- 8_hours_ago 13y agoWow. I am completely torn between really wanting to work for the NSA because they have the ability to do really awesome analysis like that with huge amounts of data, and being deathly terrified. Nothing in that article should be a surprise to me, or anyone else who can half-guess the NSA's capabilities, but it is still shocking to read. For some reason, knowing that the NSA has information on literally everyone stored in some database isn't that frightening to me, but seeing specific details that they could have (and probably do have) is very scary.
- midas007 13y agoNo brainer: join to move the needle in a sensible direction.
- garrettgrimsley 13y agoThat isn't how bureaucracies work. The parent can't join the NSA and hope to advance if they (openly) hold views fundamentally contrary to those of their superiors. I believe there is a notable and recent case of how this actually plays out. What was it? Towden? Mowden?
- judk 13y agoMr Bowden was amazingly successful at the work he did, actually. See also Schindler's List for an example of how a contractor of the enemy can undermine it.
- garrettgrimsley 13y agoThe impact that Rowden has had on the NSA has come from his actions outside of the NSA, not his work within it. I have not seen Schindler's List, but he also acted against and outside of the organization, rather than "move the needle," yes?
- vacri 13y agoAs amazing as Schindler's actions were, they ultimately had little effect on the overall scene, such was the scale of it. He fought the monster and survived, not fought the monster and brought it low. Schindler saved a thousand people through some pretty ballsy actions. But for scale, the battles of Stalingrad, Leningrad, and Moscow each had total casualty rates for both sides of 1-2 million people apiece.
- skue 13y agoSo the NSA targets the personal online accounts and personal computers of sysadmins who just happen to work at major network providers. These are people who have done absolutely nothing wrong, other than being in the way of an out of control agency. I am so sickened, angry, and ashamed.
- jauer 13y agoAnd this is different from spies seducing and/or blackmailing clerks how? It may be distasteful to you but it is the traditional work of spies in service to their country.
- angersock 13y agoI am genuinely curious how often seduction is used to compromise admins. Clearly I work on the wrong systems. :(
- jlgaddis 13y agoObviously, I don't know the answer but I don't think it's too far-fetched to imagine that an agent of one government (e.g. a female KGB agent working in the U.S.) might attempt to seduce someone in a privileged position (in other words, "with access to specific desired information") in another country's government (e.g. a male physicist working at LLNL). And, immediately after having written the above, I suddenly recalled a few portions of the SF86[0] and, based upon their existence, I'm inclined to believe it happens much more than what I would initially have expected. [0]: https://www.opm.gov/forms/pdf_fill/sf86.pdf https://www.opm.gov/forms/pdf_fill/sf86.pdf (PDF)
- nodata 13y ago"Oh it's not different to something else, so that makes it okay".
- derefr 13y agoThat's never what these sorts of comparisons imply. It's more of an "it's not different to something else... so if you actually cared about the principle of the thing rather than harms to your specially-empathizable in-group, you would have been angry all along, rather than just starting now. Thus, your anger is not particularly selfless, and your battle-cry does not deserve to be rallied around."
- 6a68 13y agoWell, fuck you very much. This is unbelievable.
- rblatz 13y agoThis site is completely unusable on mobile. Does anyone have a second source?
- intslack 13y agohttps://firstlook.org/theintercept/article/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/article/2014/03/20/inside... https://s3.amazonaws.com/s3.documentcloud.org/documents/1094387/i-hunt-sys-admins.pdf https://s3.amazonaws.com/s3.documentcloud.org/documents/1094...
- midas007 13y agoTry zooming in and tapping the zoom slider.
- FLUX-YOU 13y agoGood to know the NSA is a fan of Allie Brosh.
- bdb 13y agoSo, uh, does this mean that NSA has an internal LiveJournal instance?
- ben1040 13y agoI was wondering the same thing. It certainly looks that way, the comments/"mood"/timestamp display on the posts is a dead giveaway.
- crashandburn4 13y agoDid anyone else notice: current mood: juche-licious The only juche I know of is the north korean one[1], guessing this is just a random joke, just wanted to ask in case there's an alternate meaning I'm missing? [1] http://en.wikipedia.org/wiki/Juche http://en.wikipedia.org/wiki/Juche
- GBond 13y agoMust be spy-humor. Kinda like how some ex-gov't coworkers of Snowden assumed he wore an EFF t-shirt ironically.
- crashandburn4 13y agohahaha, I hadn't heard that. Sounds quite funny actually, definitely feels like an NSA worker wearing an EFF t-shirt would have to understand the irony of their situation.
- drewcrawford 13y agoThis is kind of off-topic, but I don't know where else to ask. Have we seriously entertained using "OSS" licenses that would prevent NSA & co. from using them? I know Douglas Crockford has his "don't be evil" JSON license that got everybody's knickers in a twist. And I know OSI has a nice page on why field of use restrictions are bad. However... I wonder if these pre-Snowden viewpoints credibly consider an organization that uses the software community's tools to conduct targeted attacks on that community. I mean, these documents suggest a much scarier attack on software developers than, say, putting the Linux kernel in a TiVo or whatever they changed in the GPLv3. On the other hand, maybe FOU restrictions are still bad on principle. What do you all think?
- GBond 13y agoFrom the context of this, it sounds like this QUANTUM system has impacted way more than the reported 100,000 computers around the world.
- lunixbochs 13y agoThe post said "queue them up for QUANTUM", which implies there are still actions to be done before it's usable.
- nls 13y agoIn my opinion, it implies that QUANTUM has a queuing system.
- midas007 13y agoWould really like to see the unredacted cookbook for hacking routers. :)
- josephlord 13y agoThe redaction was of the bit about passively detecting which routers have been hacked by other parties (primarily concerned with the Chinese).
- Anthony-G 13y agoAt first reading, I thought the redacted part was about how to tell if _your_ router was compromised but on closer reading, it looks like it covers routers owned by others that the NSA have cracked but they want to know if the Chinese or anyone else has done the same.
- midas007 13y agoSo probably not Diodes then. It's interesting how this is boils down to existing malware strategies but with a how to. They're probably not going to type this stuff up in a wiki anymore going forward, shift to in-person training and word-of-mouth.
- TrainedMonkey 13y agoFact that they casually speak of logging significant amount of connections is alarming. SSH targeting methodology would only work if you have ability to monitor significant portion of electronic communications. Since majority of traffic logging capabilities of no such agency is coming from US itself and few close allies we collaborate on intelligence with* you can estimate that Sys Admin SSH technique is most useful in US itself and aforementioned close allies. Thus I would expect this to disproportionally affect Google as opposed to let's say Baidu. * I am making an assumption here, please let me know if it is unwarranted.
- jauer 13y agoMy assumption would be that most of the intercept capabilities are in Africa, Middle East, and Southeast Asia. A lot of Africa uses (or used to use) satellite links for internet which you'd expect to be tapped and there's undersea cables around there that had a rash of weird breakage over the past few years. Incidentally, those are areas where China has a strong economic development interest so you have another well funded government as a adversary that's known to target routers and such. So far as admin SSH, once you reach a certain size you generally stop letting admins ssh in from random places and require VPNs (often with crypto tokens), if only because it gives you a easy chokepoint to disable access when you fire people. From what I've seen those most likely to use direct SSH or telnet are small companies (including regional/emerging telcos) that have a handful of people actually running things.
- acqq 13y agoGoogle "Boundless Informant" and "Room 641A." Most of abilites are in the U.S. and more is collected there than in most of the countries. Why? "Becase we can."
- jauer 13y agoRoom 641A (and associated points around the US) are a very minor part of the publicly known infrastructure operated by the NSA. This is a organization that has nuclear submarines (see also SSN-23) outfitted to tap cables and runs intercept stations (Pine Gap, Menwith Hill, etc) around the world positioned for satcom coverage. If you can get most of what you want from a handful of colo rooms in allied countries then why bother with submarines, satcom stations, and satellites that spy on other satellites? Clearly they feel that the value and scope of information gathered from intercepting communications that take place outside of (and not crossing) allied countries justifies the expense.
- Pitarou 13y agoTL;DR Our target is using a network. We need access to that network. The sysadmin has the keys to the kingdom. The sysadmin uses Facebook. Through QUANTUM INSERT, we own anybody who uses Facebook. So we just need to figure out the IP address of the sysadmin. If they use unencrypted telnet we just hack the account and grab the telnet server's IP address whitelist. With our resources and capabilities, this is so easy that someone should write a script to automate it and do it in bulk. If they use SSH, we do it be listening to the connection. Even though we can't decrypt communications, we can figure out which IP addresses sysadmins are logging in from. But it's not just us who are hacking routers. We can also hack the hackers ... and the rest is redacted. Shame. That would have been REALLY interesting.
- greenyoda 13y agoHere's a brief description of QUANTUM, for those who are unfamiliar with it: https://en.wikipedia.org/wiki/Tailored_Access_Operations#QUANTUM_attacks https://en.wikipedia.org/wiki/Tailored_Access_Operations#QUA...
- Tossrock 13y agoJesus. There's really no way to fight it other than going full RMS, is there? Who knows how many zero-days the NSA is sitting on for all major browsers. I wonder if they can attack sites that implement full end-to-end HTTPS.
- e12e 13y agoWell, just watch your latency. If the rate of kozy kitten images increase, you're being hacked! ;-)
- mavhc 13y agoYou went full RMS, man. Never go full RMS.
- anonbanker 13y agoI personally consider SSL little more than a placebo at this point. Moxie Marlinspike showed at Defcon 19[1] that SSL is easily compromiseable using upstream certificate authorities. He created Convergence[2] as a potential solution to it. But nobody's using it. I went full RMS in 2007. Uncomfortable at first, but it's really the only way to stay unmonitored. Consider avoiding the gross anti-social bits of his personality, but don't throw the baby out with the bathwater. 1. https://www.youtube.com/watch?v=pDmj_xe7EIQ https://www.youtube.com/watch?v=pDmj_xe7EIQ 2. http://convergence.io/ http://convergence.io/
- noonespecial 13y ago"Dude! Map all the networks"?... lulz?...leet?...nouns pluralized with a z? I have seen the enemy and he is a 14 year old boy who's found his father's (admittedly very large and scary) gun.
- akira2501 13y agoThat kid? No, the enemy is the people who hired him, gave him no oversight, had no auditing or controls on internal information and encouraged him to continually exceed his authority. Include the team of shameless government managers, many who swore an oath to uphold and defend the constitution, turning this operation and all these databases over to a third party and these kids.
- claudius 13y agoNo – the enemy is the American people, collectively and individually responsible for the actions of their government. How you sort that out internally is not really my concern :)
- pigDisgusting 13y agoNo, the enemy is institutionalized secrecy. A form of institutionalized secrecy concealed and locked away behind a highly-trained, tightly-regimented, hierarchical, ideological organization of indoctrinated, unquestioning personnel (recruited directly from high school, with the incentive of financing an over-priced education that would otherwise be out of reach, which would serve as a catalyst for a career of employment in jobs that will not hire anyone without practical experience), all bristling with automatic weapons, mechanized artillery, naval artillery, supersonic airplanes, 500 lb laser-guided bombs, self-guiding nuclear weapons and a vast logistics infrastructure to keep it all running. An organization that doesn't obey laws. Indeed, an organization designed with the express purpose of overriding the laws of every other country on earth. But yes, let's act within the boundaries of civilian law to ask for permission to make this complex ask for permission before not asking for permission. Oh wait, this thing without a name is funded by a civilian political system filled with politicians that lie to me and don't listen to me, who are bribed by large, faceless, private, for-profit corporations that don't pay taxes, and make all their money providing logistics and equipment to the personnel that guard the institutionalized secrecy which disinforms me of its own existence, and it's all paid for by my taxes, which I get thrown in jail for refusing to pay. ...BUT I SURRRE ASKED FOR IT!!! I GET WHAT I DESERRRVE! WHEEEEEEEEEEEEEE!!!
- mixologic 13y agoThey're so gleeful about it all. Wow.
- chippy 13y agoThey are technies just like you reading this comment, and they believe that what they are doing is Right and Good.
- frankydp 13y agoThis is a beautiful troll. If only sipr and jwics comms was so hilarious, and on the same network.
- grrowl 13y agoIf this is true, we can assume the computers of all but the very most careful and dutiful admins have been pwned. I'm flabbergasted even looking at my own laptop, the element of trust in any of my own hardware is gone.
- peterbotond 13y agoan alternate link from cryptome: http://cryptome.org/2014/03/nsa-hunt-sysadmins.pdf http://cryptome.org/2014/03/nsa-hunt-sysadmins.pdf
- codezero 13y agoIs there any TCP implementation that will notice receiving multiple disparate replies (containing different data)? Basically, is there any way to know that you are being targeted?
- e12e 13y agoYou could presumably log some such packets in iptables -- but that assumes you actually receive duplicate packets. If NSA owns a router between you and the target for spoofing, there's no reason that router need to relay the "correct" packet. I know a lot of the text on these attacks states something along the lines of "replies before the legitimate packet arrives" -- I'm just not certain it's that simple in practice. edit: This might be of interest: http://ask.wireshark.org/questions/8490/tcp-retransmission-is-detected-instead-of-a-duplicate-ip-packet http://ask.wireshark.org/questions/8490/tcp-retransmission-i... edit2: Perhaps a logging dns resolver (to track "strange" ip changes) coupled with an iptables rule that uses contrack and logs INVALID packets is a start?
- conover 13y agoIt occurs to me that judges, members of congress, law enforcement officials, etc. could be considered "sys admins" in a sense.
- eps 13y agoI call fan fiction. This is too many words for inherently trivial ideas that are all based on the magic assumed already to be in place and readily available. But mostly it's the tone and triviality of what's being discussed. It's all a script-kiddie level.
- chippy 13y agoI find your view interesting. it's one shared by many people. It's almost a misconception, a mistake which actully helps those with the real power. These are the questions that this brings up, which I find interesting. What makes us think that techies in government departments are different from techies in other places? What makes us think that pictures of kittens and internet memes are only acceptable for open source freedom hackers, and not people working for the government and private companies? What makes us think that the internal messaging systems of secret organisations should not be trivial, human and sharing humour? What makes us think that if someone thinks they are helping and protecting their country in their mind that they are morally wrong and have a criminal personality (James Bond Villain) because they are systematically abusing the law?
- Tobu 13y agoThe Intercept article (which this is from) has a lot more links and context: https://firstlook.org/theintercept/article/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/article/2014/03/20/inside...
- Intermernet 13y agoIs anyone else more disturbed at the 4chan-esque style of the author, than the actual ramifications of the "presentation"? It sounds like international security is being run by 10 year old wannabe anonymous members. Do the NSA employees really watch presentations such as this?
- HillRat 13y agoI feel like this is the geek version of some Michael Mann film, where the subtext is "COPS ARE JUST LIKE CRIMINALS." I'm already terrified that evidently any random GS-11 can grab SIGINT data at will; now I find out that they've got a red-black version of LiveJournal that reads like a Ritalin-addled script kiddie with SCI clearance. Fucking 'ell, no wonder we're fucked.
- forgottenpass 13y agoIt sounds like international security is being run by 10 year old wannabe anonymous members. Yep. Replace "wannabe anonymous members" with "wannabe hardass" or "war hawk" and you have the essence of the US approach to international relations. So while childish language for childish actions bothers me, so does the act of trying to class-up childish behavior with the well worn flavor of political rhetoric that acts like whatever bullshit getting peddled is reasonable and responsible. I can't decide which I like less.
- badman_ting 13y ago> Is anyone else more disturbed at the 4chan-esque style of the author, than the actual ramifications of the "presentation"? Probably, but that sounds like a bad idea to me.
- GamboMama 13y agoAre there really companies out there where sysadmins are allowed to use i-Diot or W-inDiot products on non-free hardware? I like the NSA, because they show the world how stupid most computer users and especially the "geeks"are that do not see how ridicolous it is to show of a big apple logo on a speaker desk. I-diots are always the problem.
- anonbanker 13y ago>> products on non-free hardware. So how long have you been an exclusive Lemote Yeelong user?
- josh-wrale 13y agoAs a sysadmin, I try to skip articles whose text is hidden because I have NoScript enabled. Cheers! :)
- anonbanker 13y agoThis is an excellent advertisement for: * disabling telnet on your router * creating 4096-bit ssh keys * enabling ssh key-based authentication only. * setting ssh to non-standard ports * enabling port knocking * using _only_ tor to check webmail * deleting your facebook account
- qzwxecrvtb 13y agocan they find me if I don't have a job title? hm...perhaps this also explains why I was photoshopped out of the team photo...