4 ms·

None of this looks particularly new or shocking to me. Seems like automation of standard techniques, which I would be more surprised to find out they weren't us

None of this looks particularly new or shocking to me. Seems like automation of standard techniques, which I would be more surprised to find out they weren't using. And hacking foreign networks... isn't that exactly their job as signals intelligence?

opendais 12y ago
The problem is they do things like take out the internet in all of Syria. http://www.theverge.com/2014/8/13/5998237/nsa-responsible-for-2012-syrian-internet-outage-snowden-says http://www.theverge.com/2014/8/13/5998237/nsa-responsible-fo... They are targeting civilian networks, not military ones. That is a huge problem. Its one thing if they were trying to break into foreign, legitimate targets of interest [military, defense industry, foreign intelligence, foreign governments]. That isn't what they are doing. They are just trying to get access to everything they can get their hands on. Civilian and military alike.
- tptacek 12y ago
  The problem with your comment is that it has nothing to do with this story. It involves a different intelligence agency, doesn't involve routers, doesn't involve attacks of any sort, and could not have brought down the Internet in Asmara Eritrea, let alone Syria.
  - opendais 12y ago
    What do you think "take control of as many machines as possible" means? Asking them nicely to hand over their SSH keys? "The covert infrastructure includes so-called Operational Relay Boxes (ORBs), which are used to hide the location of the attacker when the Five Eyes launch exploits against targets or steal data (Figure 18). Several times a year, the spy club tries to take control of as many machines as possible, as long as they are abroad. For example, in February 2010 twentyfour spies located over 3000 potential ORBs in a single work day (Figure 19). However, going over the port scan results provided by HACIENDA was considered too laborous (Figure 20), so they programmed their OLYMPIA system to automate the process (Figure 21). As a result, the spies brag that they can now locate vulnerable devices in a subnet in less than five minutes (Figure 22)."
    - tptacek 12y ago
      If you literally believe that GCHQ has owned up every machine it is technically and feasibly capable of owning up, there's not a lot of reasonable conversation that can happen between the two of us.
      - opendais 12y ago
        Pretty much. You blatantly ignore the repeated statements that the vulnerability scan is a prelude to actively attacking machines for some reason. I'm not sure why. I'm not saying they are attacking any machine they can. They are, however, attacking some machines. You don't develop the capability to build target lists, to attack targets, and state you do attack targets...unless y'know, you actually do. You might use it on a limited scale at specific targets but you do use it. The problem is, I don't have faith they actually engage in selective targeting.
makomk 12y ago
Yes, but they don't want the hacking to be traced back to them. So they're hacking random servers online and using them as their bounce boxes to attack their actual intended targets from.

opendais 12y ago

The problem is they do things like take out the internet in all of Syria. http://www.theverge.com/2014/8/13/5998237/nsa-responsible-for-2012-syrian-internet-outage-snowden-says http://www.theverge.com/2014/8/13/5998237/nsa-responsible-fo... They are targeting civilian networks, not military ones. That is a huge problem. Its one thing if they were trying to break into foreign, legitimate targets of interest [military, defense industry, foreign intelligence, foreign governments]. That isn't what they are doing. They are just trying to get access to everything they can get their hands on. Civilian and military alike.

tptacek 12y ago
The problem with your comment is that it has nothing to do with this story. It involves a different intelligence agency, doesn't involve routers, doesn't involve attacks of any sort, and could not have brought down the Internet in Asmara Eritrea, let alone Syria.
- opendais 12y ago
  What do you think "take control of as many machines as possible" means? Asking them nicely to hand over their SSH keys? "The covert infrastructure includes so-called Operational Relay Boxes (ORBs), which are used to hide the location of the attacker when the Five Eyes launch exploits against targets or steal data (Figure 18). Several times a year, the spy club tries to take control of as many machines as possible, as long as they are abroad. For example, in February 2010 twentyfour spies located over 3000 potential ORBs in a single work day (Figure 19). However, going over the port scan results provided by HACIENDA was considered too laborous (Figure 20), so they programmed their OLYMPIA system to automate the process (Figure 21). As a result, the spies brag that they can now locate vulnerable devices in a subnet in less than five minutes (Figure 22)."
  - tptacek 12y ago
    If you literally believe that GCHQ has owned up every machine it is technically and feasibly capable of owning up, there's not a lot of reasonable conversation that can happen between the two of us.
    - opendais 12y ago
      Pretty much. You blatantly ignore the repeated statements that the vulnerability scan is a prelude to actively attacking machines for some reason. I'm not sure why. I'm not saying they are attacking any machine they can. They are, however, attacking some machines. You don't develop the capability to build target lists, to attack targets, and state you do attack targets...unless y'know, you actually do. You might use it on a limited scale at specific targets but you do use it. The problem is, I don't have faith they actually engage in selective targeting.

makomk 12y ago

Yes, but they don't want the hacking to be traced back to them. So they're hacking random servers online and using them as their bounce boxes to attack their actual intended targets from.