10 ms·

Sysadmins see evidence that they have been hacked by GCHQ [video]

325 points by sauere 12y ago

sauere 12y ago
Stellar PCS is a german ISP company that is specialized in bringing internet access to inaccessible regions via satellite. Clients include research stations or oil rigs. In this video you can see a SPIEGEL journalist showing them evidence that the NSA has hacked their network for the first time.
- hadoukenio 12y ago
  Clearly it's for counter terrorism, and not corporate espionage /s
  - zz1 12y ago
    Yes, clearly, yes. Because USA do not have ANY economic interest in Africa and Middle East, and whatever these countries have as a government it doesn't change a thing for them. I mean, it's not like they have oil to sell and can alter the world's economy with a simple statement.
    - deleted 12y ago
      [deleted]
    - drzaiusapelord 12y ago
      This, as much as the domestic spying stuff bothers me, this uber-left uber-pacifist view of things is asinine. China, Russia, Iran, etc aren't stopping their SIGINT or cyberwarfare programs and neither should we. I also don't care if Germans are our "allies." 9 months ago Russia and Ukraine were best friends, now Russian soldiers are blowing away Ukranian civilians with total impunity. Shit changes. Shit gets real quick. Being at a information disadvantage can lead to serious consquences. I think we live in a time too used to peace and as we can see from recent events, that time is now over. The far left's obsession with pacifism and the far right's obsession with isolationism are just impractical. This just causes conflicts that need to happen to be put away and ignored which leads to larger conflicts later. For example, the US and Iraq should have worked together when ISIS took Fallujah MONTHS AGO. The US should not have caved into pressure from the EU and Russia to not take out Assad. Instead, we chose the path of politics and sticking our head in the sand and an entire region just became destabilized. On top of it, petty dictators like Putin see our weakness and use it against us by invading his neighbors, knowing he'll only receive a slap on the wrist. Downvote away, but we need SIGINT, now more than ever.
- zz1 12y ago
  Article: http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html http://www.spiegel.de/international/world/snowden-documents-... Documents: http://spiegel.de/media/media-34756.pdf http://spiegel.de/media/media-34756.pdf http://spiegel.de/media/media-34757.pdf http://spiegel.de/media/media-34757.pdf http://spiegel.de/media/media-34758.pdf http://spiegel.de/media/media-34758.pdf Sadly Der Spiegel is not providing https, even if we now know that this means putting your readers security at stake. This is The Intercept article on this (https, yay!): https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/
notastartup 12y ago
This is the most intense video I ever seen since the Snowden revelations. I could almost feel Ali's feeling of complete violation. This is absolutely chilling material.
- thegerman 12y ago
  To see a fellow german talk in my native tongue about learning that he himself was targeted made this so much more real. We europeans really can't trust the US anymore. It's so sad. I really liked the idea of that place, but who hacks their friends?
rdtsc 12y ago
This is the right way to do it. Great job Spiegel (or whoever worked on this piece). Putting real people on screen, real faces. Showing emotion, showing them swallowing knots when they see their names on the screen of "tasked" engineers. I think here on HN and other tech and privacy forums we understand what is happening. Unless there is a reporting like this, it will be a bit harder to engage a wide audience. Telling the proverbial grandma about "PRISM" or "they are listening to everyone" is not going to quite work. What works is to do this -- showing one particular grandma with a name, address, life story and showing how maybe her recipe for baking cookies is now logged in Utah's NSA's headquarters in room 5B, on storage node 18Z and so on.
- zz1 12y ago
  Produced by Laura Poitras. (just watch it until the end and you'll get the other names)
  - final 12y ago
    Yeah, I'd bet in a few years the breaks in her car will malfunction or she'll get the wrong drug or murdered some other way.
  - Ygg2 12y ago
    Ten bucks she is "tasked".
    - deleted 12y ago
      [deleted]
    - srslack 12y ago
      Poitras is actually the shadow of this whole story. She was the journalist Snowden reached out to when Greenwald was unresponsive, was there and filmed the first Snowden interviews, was responsible for the Bill Binney story in the NYT a few years back[1] and has been on the US Government shit list for quite a few years[2]. [1] http://www.nytimes.com/2012/08/23/opinion/the-national-security-agencys-domestic-spying-program.html?_r=0 http://www.nytimes.com/2012/08/23/opinion/the-national-secur... [2] https://en.wikipedia.org/wiki/Laura_Poitras#Government_surveillance https://en.wikipedia.org/wiki/Laura_Poitras#Government_surve...
johnchristopher 12y ago
How come Stellar PCS didn't check out the NSA documents that were made public (I assume the documents the journalist is showing them in the video are those public PRISM/snowden/TreasureMap docs) for any hints their operations were compromised ? Just found this https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ which includes more narrative and GCHQ's involvement.
- zz1 12y ago
  How come so many people are just ignoring all the Snowden files altogether? How come so little people use encryption, after more than a year that we have been told "the good news is, encryption works". Please advocate for change, actively, with the people you interact. GPG, OTR, TextSecure, Redphone, Signal, decentralized services… If they are complicated, set them up yourself. And please, urge your representatives to act!
  - pdkl95 12y ago
    Unfortunately, some people still don't believe the scope or that the "good guys" would violate the constitution like this ("Just-World Hypothesis"). Others are still using various permutations of the "If you're not doing anything wrong..." nonsense. And at least a few... are collaborators. As PHK cautioned, the NSA/GCHQ/etc can submit patches or comment in development discussions just like everybody else, and at least some of the suggestions against using proper crypto are intended to keep the internet in plaintext.
- scintill76 12y ago
  It does appear they have already been publicized as a target at the end of March this year: "The 26-page document explicitly names three of the German companies targeted for surveillance: Stellar, Cetel and IABG." ... "In the case of Stellar, the top secret GCHQ paper includes the names and email addresses of 16 employees, including CEO Christian Steffen. In addition, it also provides a list of the most-important customers and partners. Contacted by SPIEGEL, Stellar CEO Steffen said he had not been aware of any attempts by intelligence services to infiltrate or hack his company. 'I am shocked,' he said." [0] As far as I can tell, the actual documents were just publicly released today. I suppose the point of the video, as noted by other comments here, is to show real human beings finding their name and email address in a top-secret document directing they be found and "tasked". Most of the filming may have been done back in March, and it seems they were made aware back then, and have hopefully taken steps to re-secure things since then. I'd be interested in evidence that they should have specifically known about this earlier, though. [0] http://www.spiegel.de/international/germany/gchq-and-nsa-targeted-private-german-companies-a-961444.html http://www.spiegel.de/international/germany/gchq-and-nsa-tar...
malandrew 12y ago
I'm shocked that they are securing such important routers with a username/password combination like horizon/h0riz0n. Such a system should be protected by public and private keys.
- hadoukenio 12y ago
  Hopefully they changed the passwords before the video went online
  - zz1 12y ago
    The company is no longer a Stellar's customer (since before the video).
    - deleted 12y ago
      [deleted]
- zz1 12y ago
  The password is the user's.
- chmod775 12y ago
  Also they said you'd need to already have access to their network in order to even login with that. So it's apparently only a (albeit weak) second line of defense.
- junto 12y ago
  I assumed that this 'customer' was a trojan horse, put there by the NSA. Well, that's what I'd do anyway. It goes like this - Stellar gets offered a big hosting contract that they aren't going to turn away. They don't do any due diligence on this new customer, and if they did, they probably hit a couple of USG Cayman Islands dead-ends anyway. They install this company's servers inside their own network. Boom... headshot.
  - sentenza 12y ago
    You are doing something very important here. Many people forget that the guys running the show at the NSA are, in all probability, at least as savvy as any one of us. For this reason, it is always a good starting point to ask oneself "What would I do if I was in their shoes?". A prime example of how this thinking can be applied is the TrueCrypt fiasco. Ask yourself: If you were the group leader at the NSA tasked with TrueCrypt, would you have your undelings doxx the authors? Would you then try to lean on the authors? If I was a group leader at the NSA, I certainly would.
nether 12y ago
There's this great line in Dataclysm (written by the guy who wrote the OkCupid blog) about how the NSA recruited from the best math students at Harvard. "The people spying on us are extremely, extremely smart."
- theoh 12y ago
  Don't we generally assume that the NSA hires math guys for math purposes, not surveillance purposes?
  - peterkelly 12y ago
    What do you think they use the math for?
    - theoh 12y ago
      My point is that mathematicians are not necessarily or even probably a good fit for intelligence analysis ("spying"). I wouldn't describe the stuff NSA mathematicians ostensibly get up to as spying. See this for example: https://www.nsa.gov/careers/career_fields/mathematics.shtml https://www.nsa.gov/careers/career_fields/mathematics.shtml
  - serf 12y ago
    well, the scary part is that those maths purposes are being deployed for surveillance reasons. William Binney comes to mind
zz1 12y ago
Impressive. However I regret that we don't see when they commented with "Fuck". Not for the word, clearly, but because the face that went with it should have been really powerful. I hope that now sysadmins from all over the world know that they are subject to NSA surveillance. If you are a sysadmin, please read: https://firstlook.org/theintercept/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/2014/03/20/inside-nsa-sec... You could easily be a target for TAO: http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns... https://news.ycombinator.com/item?id=6979457 https://news.ycombinator.com/item?id=6979457 If you are a sysadmin, they are after YOU.
- spyder 12y ago
  I think we can see that "Fuck" on their face, just look at the big swallows of the guy and he even says "Oh my god" in the video.
andy_ppp 12y ago
I'd be really interested to know what they did to get the access. Did this guy have malware installed on his machine? Do we all have Malware installed on our machines? Is there any way to protect yourself from an adversary as powerful and competent as the NSA?
- scintill76 12y ago
  The only real proof of "access" I saw, was a single customer's username and password. That could have been obtained through guessing, or compromising that customer. So it seems like cautious and competent engineers aren't necessarily all compromised. I'm open to more evidence though. The other things seemed to be network topology, IP addresses, and engineer lists, which are fairly public.
  - andy_ppp 12y ago
    His name is on NSA slides, right? He's either working for them or they have his private key. Really how difficult would it be for the NSA to get that if they wanted it? I have no idea but I'm able to believe easily.
    - zz1 12y ago
      Not just his, but the names of all the company's engineers are on the slides and marked as targeted persons.
    - scintill76 12y ago
      Like some others here, I wondered if "task" could mean to recruit. I basically agree NSA could pwn anybody they want, but there are probably other considerations such as how obvious they want to be, whether the target is valuable enough to reveal zero-days nobody else has seen yet, etc. Maybe it's wishful thinking, but I'd like to believe if you don't do things like open unsolicited email attachments, you're still pretty safe. But, perhaps as the lead engineer of an ISP "interesting" people use, nothing is off the table and he has been pwned repeatedly.
codemac 12y ago
Any non-flash version of this video?
- zz1 12y ago
  You can get it in H246 from Vimeo: http://vimeo.com/106026217 http://vimeo.com/106026217
  - codemac 12y ago
    Awesome, thank you!
- miduil 12y ago
  I didn't check the comments first, here's what I found: http://video2.spiegel.de/flash/03/31/1521330_iphone.mp4 http://video2.spiegel.de/flash/03/31/1521330_iphone.mp4
- hnha 12y ago
  youtube-dl can handle spiegel.de
rdl 12y ago
Satellite communications providers, especially those offering L-band (mobile) services, are really the low hanging fruit of the SIGINT world. They're pretty much only used by "interesting" people due to cost, in areas which are inaccessible otherwise (non-permissive to HUMINT, etc.) That they tend to be run by technically incompetent people, using expensive black box hardware they don't understand, and with multiple levels of indirection between end user and the Internet (transponders, ground stations, facilities, virtual network operators, ...) makes it all much more vulnerable. Combine that with price sensitivity (so subsidized government stuff can be cheaper, and legal expenses unacceptable), and a highly regulated environment (ITAR + various spectrum licensing and launch regimes), and it's a perfect storm. The only more interesting target would be "satellite comms network dedicated to high value international payments". (Disclaimer: I started/ran a satellite communications and wireless provider, and worked for or with a bunch of others.)
- zz1 12y ago
  > (Disclaimer: I started/ran a satellite communications and wireless provider, and worked for or with a bunch of others.) Which means you are under active and targeted surveillance. Great to see you put encryption contact info in your profile.
  - schoen 12y ago
    rdl has a few other fun reasons to have attracted the Eye of Sauron. Like that one time when he was the only inhabitant of an entire country.
    - zz1 12y ago
      You can't just stop after telling that… Only inhabitant of an entire country? How can it be?
      - schoen 12y ago
        One account is in http://works.bepress.com/cgi/viewcontent.cgi?article=1035&context=james_grimmelmann http://works.bepress.com/cgi/viewcontent.cgi?article=1035&co... You might notice some discussion there of what counts as a country.
staunch 12y ago
The reporter said "Develop and task key engineers" means surveillance but I don't think that's right. Task can be used multiple ways but I think that line is talking about recruiting key engineers as agents, probably using bribery. I could be wrong but I thought Ali had an extremely guilty reaction. As if he was waiting for the reporter to accuse him of being an NSA asset. Which he very well may be.
- rdl 12y ago
  Yeah, that's usually what "develop" means in an intel context. It's "recruit". Although you'd probably start by developing a list of targets, then learning (open source, government records, etc.) as much as possible, then maybe task someone with observing or recruiting.
  - zz1 12y ago
    Actively perusing their XKeyscore record wouldn't it be to "taks" them? And using TAO?
    - colinbartlett 12y ago
      Imagine how much information they could get on these engineers, who, as foreign nationals, are free game to warrantless surveillance. Facebook photos, emails, Android phone location history, MasterCard records. It would be easy to find something incriminating such as "You were at a hotel room for 4 hours in the middle of the day, how about you help us or we'll tell your wife?" or "You've got $25,000 in credit card debt and we can make that disappear if you change a few config files." This isn't crazy movie stuff, this is exactly how people are recruited.
      - zz1 12y ago
        Why just "Android phone location history"? Every phone location history. And pictures from that phone, and audio recordings too.
WestCoastJustin 12y ago
Is it really possible to protect yourself and your network from these types of attacks? Any company with sysadmins or internal security teams is extremely out gunned against someone like the NSA (it is almost comical) [1]. From the perspective of a sysadmin, who has worked in startups, small companies, a university, and several government departments, I can firmly tell you that, we are not in the same league! Sure we take the yearly security courses, use best practices, harden machines and infrastructure, but after reading these articles.. we are sitting ducks. If the NSA is in bed with US based network gear providers, they can simply own the network and telecom infrastructure (via build in backdoors), and you do not even know they are there, because they side step the normal exploit channels [2]. Probably the best way to describe this, is to compare security and pro sports teams. From what I have read, the NSA is a top tear team winning championships across the globe, with billions in research and development, and thousands of highly trained athletes, living and breathing this day in and day out. Yet, they are matched up against a local beer league who likes to play casually Thursday nights. Who do you think is going to win? Go read the "A Look at Targeted Attacks Through the Lense of an NGO" [3] paper, then put yourself in their shoes. Think about the IT resources a small NGO with 30-50 employees has. Maybe they have a sysadmin and a helpdesk guy. They are dead meat. The threats are so vast, spear phishing, target malware via MITM attacks, etc. It almost seems hopeless. But it is not just the NSA at the top of the heap, you have lots of foreign governments, which have direct access to your playing field via the internet. Think about the resources that Google, Facebook, and Apple throw at security, then you see something like Operation Aurora [4, 5]. What chance does an ISP or small business have? None. Personally, it just seems like the entire model is broken. Yet, nothing seems to change, in that we are all just waiting for the next zero day to drop, and the cycle continues. All it takes is one targeted zero day addressed to a normal employee, the attackers gain access to the network, then move laterally [6, 7]. The odds are further stacked, in that you have a top tear team against a targeted employee, who doesn't even know the game. ps. sorry for the tone of this [1] https://firstlook.org/theintercept/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/2014/03/20/inside-nsa-sec... [2] http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syria-internet-outage-civil-war http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syr... [3] http://www.mpi-sws.org/~stevens/pubs/sec14.pdf http://www.mpi-sws.org/~stevens/pubs/sec14.pdf [4] http://www.wired.com/2010/01/google-hack-attack/ http://www.wired.com/2010/01/google-hack-attack/ [5] http://en.wikipedia.org/wiki/Operation_Aurora http://en.wikipedia.org/wiki/Operation_Aurora [6] http://g0s.org/wp-content/uploads/2013/downloads/Inside_Report_by_Infosec_Consortium.pdf http://g0s.org/wp-content/uploads/2013/downloads/Inside_Repo... [7] http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf
jostmey 12y ago
If I were caught hacking into a private network of computers without authorization even if I had a "good" reason to do so I would be breaking the law and throne in jail. So why is the NSA allowed to do the same?
- sauere 12y ago
  b-but m-muh terrorism
- zz1 12y ago
  What would happen to you if you were caught collecting e-mails of the whole world? What would happen of you if you were caught stealing documents from your representatives computer? Nothing is happening because the NSA and most representatives are PARTNERS in this crime. You must contact your representative and let him know that you are ready to do anything in order for him not to be reelected if he won't actively ask for justice.
- dredmorbius 12y ago
  Within the US, the NSA operates with legal impunity. It is beyond the reach of the law. At least so long as it's acting under official mandate -- rogue agents are apparently sanctioned if pursuing information for personal reasons. If caught. Outside the US, NSA operates with the diplomatic and military support of the US. It's not a matter of an individual hacker, but "an international incident" should something arise. There's some risk that an agent or operative (non-agency employee acting on behalf of the NSA) could be caught, but that would vary by field of operations and relations between that country and the US.
  - PeterisP 12y ago
    And for such cases as in NSA, where the actions, though technically illegal, were clearly intended by the leadership - "sanction" can easily mean an official written reprimand stating "this is not acceptable", followed by a cash bonus and a promotion.
- dj-wonk 12y ago
  I am not a lawyer, but https://www.nsa.gov/about/faqs/oversight.shtml https://www.nsa.gov/about/faqs/oversight.shtml mentions Executive Order 12333 and other legal mechanisms.
kelas 12y ago
Enjoyable. A rare opportunity to witness an expression of someone who got p0wned well beyond his level of comprehension. Look how he strokes his pen in disbelief, that poor German dude. "I know those switches", Mein Gott. As of today, there are two kinds of people in the world: those who believe we're still stuck in post-9/11, and those who realised we are now in post-Snowden. There is a third kind who have Facebook accounts, but those are just the nature's way of saying that Darwin got it right.
- asdfologist 12y ago
  > There is a third kind who still have Facebook accounts, but those are just the nature's way of saying that Darwin got it right. Wow, you just trash talked over 1 billion people in one sentence.
  - kelas 12y ago
    Trillions of flies can't be wrong - elephant dung is awesome.
    - ossreality 12y ago
      You made a good point and then trashed it with a knee jerk reaction. If you think Facebook is one of the bad guys here, you don't really get what's going on.
    - TeMPOraL 12y ago
      For flies it is, but that doesn't generalize to other species. It's an incredibly stupid adage.
      - deleted 12y ago
        [deleted]
- moe 12y ago
  There is a third kind who still have Facebook accounts, but those are just the nature's way of saying that Darwin got it right. That's a non sequitur. Having a facebook account or not is an almost negligible factor in the grand scheme of things. The kind of information commonly exposed on facebook can be more conclusively inferred from other information sources. Do you use a smartphone? Skype? Any search engine? Does your home internet come out of a plastic router? Do you click on the little lock icon every time you go to a SSL site, to verify the certificate hasn't changed? Do you know the fingerprint of the legitimate facebook SSL certificate? Think about what any one of the above devices "knows" about you in comparison to what facebook knows about you.
Keyframe 12y ago
They must've known?
ck2 12y ago
Reminds me of the Google engineer response: https://plus.google.com/+BrandonDowney/posts/SfYy8xbDWGG https://plus.google.com/+BrandonDowney/posts/SfYy8xbDWGG
kbar13 12y ago
that feel when ~5:15 and the username/password to an account with "deep access to the network" is horizon/h0r1z0n
- scintill76 12y ago
  I think it was deep access to one customer's network, and probably their own fault for choosing lame credentials.
naner 12y ago
This also illustrates the weakness of using just a password for authentication to anything of value.
dredmorbius 12y ago
Is there an alternate source for the video? I cannot get it to play at all under Linux / Chrome.
- sentenza 12y ago
  Here it is on Vimeo: http://vimeo.com/106026217 http://vimeo.com/106026217 Worked fine for me in FF on linux. Might be worth a try in Chrome.
  - dredmorbius 12y ago
    Vimeo does work for me generally. I can also download it with youtube-dl.
dmix 12y ago
Requires Flash to watch :\
- zz1 12y ago
  Can be done with H264: https://news.ycombinator.com/item?id=8316396 https://news.ycombinator.com/item?id=8316396
coalbee 12y ago
What about 2048 RSA public key cryptography performed on the application level? Didn't the Snowden leak say the NSA still can't crack 2048?
zby 12y ago
This crashes my shockwave flash plugin - should I start to be paranoid?
pinaceae 12y ago
If you're a radical, islamist, leftist, etc. then maybe you're a target for NSA, GCHQ. if you're a sysadmin at a telco or infrastructure provider your definitely a target for the NSA, GCHQ. let that sink in. infrastructure these days also means AWS, facebook, youtube, twitter. every piece, site, offer that might be used by ISIS, for example.

325 points by sauere 12y ago

Stellar PCS is a german ISP company that is specialized in bringing internet access to inaccessible regions via satellite. Clients include research stations or oil rigs. In this video you can see a SPIEGEL journalist showing them evidence that the NSA has hacked their network for the first time.

hadoukenio 12y ago
Clearly it's for counter terrorism, and not corporate espionage /s
- zz1 12y ago
  Yes, clearly, yes. Because USA do not have ANY economic interest in Africa and Middle East, and whatever these countries have as a government it doesn't change a thing for them. I mean, it's not like they have oil to sell and can alter the world's economy with a simple statement.
  - deleted 12y ago
    [deleted]
  - drzaiusapelord 12y ago
    This, as much as the domestic spying stuff bothers me, this uber-left uber-pacifist view of things is asinine. China, Russia, Iran, etc aren't stopping their SIGINT or cyberwarfare programs and neither should we. I also don't care if Germans are our "allies." 9 months ago Russia and Ukraine were best friends, now Russian soldiers are blowing away Ukranian civilians with total impunity. Shit changes. Shit gets real quick. Being at a information disadvantage can lead to serious consquences. I think we live in a time too used to peace and as we can see from recent events, that time is now over. The far left's obsession with pacifism and the far right's obsession with isolationism are just impractical. This just causes conflicts that need to happen to be put away and ignored which leads to larger conflicts later. For example, the US and Iraq should have worked together when ISIS took Fallujah MONTHS AGO. The US should not have caved into pressure from the EU and Russia to not take out Assad. Instead, we chose the path of politics and sticking our head in the sand and an entire region just became destabilized. On top of it, petty dictators like Putin see our weakness and use it against us by invading his neighbors, knowing he'll only receive a slap on the wrist. Downvote away, but we need SIGINT, now more than ever.
zz1 12y ago
Article: http://www.spiegel.de/international/world/snowden-documents-indicate-nsa-has-breached-deutsche-telekom-a-991503.html http://www.spiegel.de/international/world/snowden-documents-... Documents: http://spiegel.de/media/media-34756.pdf http://spiegel.de/media/media-34756.pdf http://spiegel.de/media/media-34757.pdf http://spiegel.de/media/media-34757.pdf http://spiegel.de/media/media-34758.pdf http://spiegel.de/media/media-34758.pdf Sadly Der Spiegel is not providing https, even if we now know that this means putting your readers security at stake. This is The Intercept article on this (https, yay!): https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/

notastartup 12y ago

This is the most intense video I ever seen since the Snowden revelations. I could almost feel Ali's feeling of complete violation. This is absolutely chilling material.

thegerman 12y ago
To see a fellow german talk in my native tongue about learning that he himself was targeted made this so much more real. We europeans really can't trust the US anymore. It's so sad. I really liked the idea of that place, but who hacks their friends?

rdtsc 12y ago

This is the right way to do it. Great job Spiegel (or whoever worked on this piece). Putting real people on screen, real faces. Showing emotion, showing them swallowing knots when they see their names on the screen of "tasked" engineers. I think here on HN and other tech and privacy forums we understand what is happening. Unless there is a reporting like this, it will be a bit harder to engage a wide audience. Telling the proverbial grandma about "PRISM" or "they are listening to everyone" is not going to quite work. What works is to do this -- showing one particular grandma with a name, address, life story and showing how maybe her recipe for baking cookies is now logged in Utah's NSA's headquarters in room 5B, on storage node 18Z and so on.

zz1 12y ago
Produced by Laura Poitras. (just watch it until the end and you'll get the other names)
- final 12y ago
  Yeah, I'd bet in a few years the breaks in her car will malfunction or she'll get the wrong drug or murdered some other way.
- Ygg2 12y ago
  Ten bucks she is "tasked".
  - deleted 12y ago
    [deleted]
  - srslack 12y ago
    Poitras is actually the shadow of this whole story. She was the journalist Snowden reached out to when Greenwald was unresponsive, was there and filmed the first Snowden interviews, was responsible for the Bill Binney story in the NYT a few years back[1] and has been on the US Government shit list for quite a few years[2]. [1] http://www.nytimes.com/2012/08/23/opinion/the-national-security-agencys-domestic-spying-program.html?_r=0 http://www.nytimes.com/2012/08/23/opinion/the-national-secur... [2] https://en.wikipedia.org/wiki/Laura_Poitras#Government_surveillance https://en.wikipedia.org/wiki/Laura_Poitras#Government_surve...

johnchristopher 12y ago

How come Stellar PCS didn't check out the NSA documents that were made public (I assume the documents the journalist is showing them in the video are those public PRISM/snowden/TreasureMap docs) for any hints their operations were compromised ? Just found this https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ https://firstlook.org/theintercept/2014/09/14/nsa-stellar/ which includes more narrative and GCHQ's involvement.

zz1 12y ago
How come so many people are just ignoring all the Snowden files altogether? How come so little people use encryption, after more than a year that we have been told "the good news is, encryption works". Please advocate for change, actively, with the people you interact. GPG, OTR, TextSecure, Redphone, Signal, decentralized services… If they are complicated, set them up yourself. And please, urge your representatives to act!
- pdkl95 12y ago
  Unfortunately, some people still don't believe the scope or that the "good guys" would violate the constitution like this ("Just-World Hypothesis"). Others are still using various permutations of the "If you're not doing anything wrong..." nonsense. And at least a few... are collaborators. As PHK cautioned, the NSA/GCHQ/etc can submit patches or comment in development discussions just like everybody else, and at least some of the suggestions against using proper crypto are intended to keep the internet in plaintext.
scintill76 12y ago
It does appear they have already been publicized as a target at the end of March this year: "The 26-page document explicitly names three of the German companies targeted for surveillance: Stellar, Cetel and IABG." ... "In the case of Stellar, the top secret GCHQ paper includes the names and email addresses of 16 employees, including CEO Christian Steffen. In addition, it also provides a list of the most-important customers and partners. Contacted by SPIEGEL, Stellar CEO Steffen said he had not been aware of any attempts by intelligence services to infiltrate or hack his company. 'I am shocked,' he said." [0] As far as I can tell, the actual documents were just publicly released today. I suppose the point of the video, as noted by other comments here, is to show real human beings finding their name and email address in a top-secret document directing they be found and "tasked". Most of the filming may have been done back in March, and it seems they were made aware back then, and have hopefully taken steps to re-secure things since then. I'd be interested in evidence that they should have specifically known about this earlier, though. [0] http://www.spiegel.de/international/germany/gchq-and-nsa-targeted-private-german-companies-a-961444.html http://www.spiegel.de/international/germany/gchq-and-nsa-tar...

malandrew 12y ago

I'm shocked that they are securing such important routers with a username/password combination like horizon/h0riz0n. Such a system should be protected by public and private keys.

hadoukenio 12y ago
Hopefully they changed the passwords before the video went online
- zz1 12y ago
  The company is no longer a Stellar's customer (since before the video).
  - deleted 12y ago
    [deleted]
zz1 12y ago
The password is the user's.
chmod775 12y ago
Also they said you'd need to already have access to their network in order to even login with that. So it's apparently only a (albeit weak) second line of defense.
junto 12y ago
I assumed that this 'customer' was a trojan horse, put there by the NSA. Well, that's what I'd do anyway. It goes like this - Stellar gets offered a big hosting contract that they aren't going to turn away. They don't do any due diligence on this new customer, and if they did, they probably hit a couple of USG Cayman Islands dead-ends anyway. They install this company's servers inside their own network. Boom... headshot.
- sentenza 12y ago
  You are doing something very important here. Many people forget that the guys running the show at the NSA are, in all probability, at least as savvy as any one of us. For this reason, it is always a good starting point to ask oneself "What would I do if I was in their shoes?". A prime example of how this thinking can be applied is the TrueCrypt fiasco. Ask yourself: If you were the group leader at the NSA tasked with TrueCrypt, would you have your undelings doxx the authors? Would you then try to lean on the authors? If I was a group leader at the NSA, I certainly would.

nether 12y ago

There's this great line in Dataclysm (written by the guy who wrote the OkCupid blog) about how the NSA recruited from the best math students at Harvard. "The people spying on us are extremely, extremely smart."

theoh 12y ago
Don't we generally assume that the NSA hires math guys for math purposes, not surveillance purposes?
- peterkelly 12y ago
  What do you think they use the math for?
  - theoh 12y ago
    My point is that mathematicians are not necessarily or even probably a good fit for intelligence analysis ("spying"). I wouldn't describe the stuff NSA mathematicians ostensibly get up to as spying. See this for example: https://www.nsa.gov/careers/career_fields/mathematics.shtml https://www.nsa.gov/careers/career_fields/mathematics.shtml
- serf 12y ago
  well, the scary part is that those maths purposes are being deployed for surveillance reasons. William Binney comes to mind

zz1 12y ago

Impressive. However I regret that we don't see when they commented with "Fuck". Not for the word, clearly, but because the face that went with it should have been really powerful. I hope that now sysadmins from all over the world know that they are subject to NSA surveillance. If you are a sysadmin, please read: https://firstlook.org/theintercept/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/2014/03/20/inside-nsa-sec... You could easily be a target for TAO: http://www.spiegel.de/international/world/catalog-reveals-nsa-has-back-doors-for-numerous-devices-a-940994.html http://www.spiegel.de/international/world/catalog-reveals-ns... https://news.ycombinator.com/item?id=6979457 https://news.ycombinator.com/item?id=6979457 If you are a sysadmin, they are after YOU.

spyder 12y ago
I think we can see that "Fuck" on their face, just look at the big swallows of the guy and he even says "Oh my god" in the video.

andy_ppp 12y ago

I'd be really interested to know what they did to get the access. Did this guy have malware installed on his machine? Do we all have Malware installed on our machines? Is there any way to protect yourself from an adversary as powerful and competent as the NSA?

scintill76 12y ago
The only real proof of "access" I saw, was a single customer's username and password. That could have been obtained through guessing, or compromising that customer. So it seems like cautious and competent engineers aren't necessarily all compromised. I'm open to more evidence though. The other things seemed to be network topology, IP addresses, and engineer lists, which are fairly public.
- andy_ppp 12y ago
  His name is on NSA slides, right? He's either working for them or they have his private key. Really how difficult would it be for the NSA to get that if they wanted it? I have no idea but I'm able to believe easily.
  - zz1 12y ago
    Not just his, but the names of all the company's engineers are on the slides and marked as targeted persons.
  - scintill76 12y ago
    Like some others here, I wondered if "task" could mean to recruit. I basically agree NSA could pwn anybody they want, but there are probably other considerations such as how obvious they want to be, whether the target is valuable enough to reveal zero-days nobody else has seen yet, etc. Maybe it's wishful thinking, but I'd like to believe if you don't do things like open unsolicited email attachments, you're still pretty safe. But, perhaps as the lead engineer of an ISP "interesting" people use, nothing is off the table and he has been pwned repeatedly.

codemac 12y ago

Any non-flash version of this video?

zz1 12y ago
You can get it in H246 from Vimeo: http://vimeo.com/106026217 http://vimeo.com/106026217
- codemac 12y ago
  Awesome, thank you!
miduil 12y ago
I didn't check the comments first, here's what I found: http://video2.spiegel.de/flash/03/31/1521330_iphone.mp4 http://video2.spiegel.de/flash/03/31/1521330_iphone.mp4
hnha 12y ago
youtube-dl can handle spiegel.de

rdl 12y ago

Satellite communications providers, especially those offering L-band (mobile) services, are really the low hanging fruit of the SIGINT world. They're pretty much only used by "interesting" people due to cost, in areas which are inaccessible otherwise (non-permissive to HUMINT, etc.) That they tend to be run by technically incompetent people, using expensive black box hardware they don't understand, and with multiple levels of indirection between end user and the Internet (transponders, ground stations, facilities, virtual network operators, ...) makes it all much more vulnerable. Combine that with price sensitivity (so subsidized government stuff can be cheaper, and legal expenses unacceptable), and a highly regulated environment (ITAR + various spectrum licensing and launch regimes), and it's a perfect storm. The only more interesting target would be "satellite comms network dedicated to high value international payments". (Disclaimer: I started/ran a satellite communications and wireless provider, and worked for or with a bunch of others.)

zz1 12y ago
> (Disclaimer: I started/ran a satellite communications and wireless provider, and worked for or with a bunch of others.) Which means you are under active and targeted surveillance. Great to see you put encryption contact info in your profile.
- schoen 12y ago
  rdl has a few other fun reasons to have attracted the Eye of Sauron. Like that one time when he was the only inhabitant of an entire country.
  - zz1 12y ago
    You can't just stop after telling that… Only inhabitant of an entire country? How can it be?
    - schoen 12y ago
      One account is in http://works.bepress.com/cgi/viewcontent.cgi?article=1035&context=james_grimmelmann http://works.bepress.com/cgi/viewcontent.cgi?article=1035&co... You might notice some discussion there of what counts as a country.

staunch 12y ago

The reporter said "Develop and task key engineers" means surveillance but I don't think that's right. Task can be used multiple ways but I think that line is talking about recruiting key engineers as agents, probably using bribery. I could be wrong but I thought Ali had an extremely guilty reaction. As if he was waiting for the reporter to accuse him of being an NSA asset. Which he very well may be.

rdl 12y ago
Yeah, that's usually what "develop" means in an intel context. It's "recruit". Although you'd probably start by developing a list of targets, then learning (open source, government records, etc.) as much as possible, then maybe task someone with observing or recruiting.
- zz1 12y ago
  Actively perusing their XKeyscore record wouldn't it be to "taks" them? And using TAO?
  - colinbartlett 12y ago
    Imagine how much information they could get on these engineers, who, as foreign nationals, are free game to warrantless surveillance. Facebook photos, emails, Android phone location history, MasterCard records. It would be easy to find something incriminating such as "You were at a hotel room for 4 hours in the middle of the day, how about you help us or we'll tell your wife?" or "You've got $25,000 in credit card debt and we can make that disappear if you change a few config files." This isn't crazy movie stuff, this is exactly how people are recruited.
    - zz1 12y ago
      Why just "Android phone location history"? Every phone location history. And pictures from that phone, and audio recordings too.

WestCoastJustin 12y ago

Is it really possible to protect yourself and your network from these types of attacks? Any company with sysadmins or internal security teams is extremely out gunned against someone like the NSA (it is almost comical) [1]. From the perspective of a sysadmin, who has worked in startups, small companies, a university, and several government departments, I can firmly tell you that, we are not in the same league! Sure we take the yearly security courses, use best practices, harden machines and infrastructure, but after reading these articles.. we are sitting ducks. If the NSA is in bed with US based network gear providers, they can simply own the network and telecom infrastructure (via build in backdoors), and you do not even know they are there, because they side step the normal exploit channels [2]. Probably the best way to describe this, is to compare security and pro sports teams. From what I have read, the NSA is a top tear team winning championships across the globe, with billions in research and development, and thousands of highly trained athletes, living and breathing this day in and day out. Yet, they are matched up against a local beer league who likes to play casually Thursday nights. Who do you think is going to win? Go read the "A Look at Targeted Attacks Through the Lense of an NGO" [3] paper, then put yourself in their shoes. Think about the IT resources a small NGO with 30-50 employees has. Maybe they have a sysadmin and a helpdesk guy. They are dead meat. The threats are so vast, spear phishing, target malware via MITM attacks, etc. It almost seems hopeless. But it is not just the NSA at the top of the heap, you have lots of foreign governments, which have direct access to your playing field via the internet. Think about the resources that Google, Facebook, and Apple throw at security, then you see something like Operation Aurora [4, 5]. What chance does an ISP or small business have? None. Personally, it just seems like the entire model is broken. Yet, nothing seems to change, in that we are all just waiting for the next zero day to drop, and the cycle continues. All it takes is one targeted zero day addressed to a normal employee, the attackers gain access to the network, then move laterally [6, 7]. The odds are further stacked, in that you have a top tear team against a targeted employee, who doesn't even know the game. ps. sorry for the tone of this [1] https://firstlook.org/theintercept/2014/03/20/inside-nsa-secret-efforts-hunt-hack-system-administrators/ https://firstlook.org/theintercept/2014/03/20/inside-nsa-sec... [2] http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syria-internet-outage-civil-war http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syr... [3] http://www.mpi-sws.org/~stevens/pubs/sec14.pdf http://www.mpi-sws.org/~stevens/pubs/sec14.pdf [4] http://www.wired.com/2010/01/google-hack-attack/ http://www.wired.com/2010/01/google-hack-attack/ [5] http://en.wikipedia.org/wiki/Operation_Aurora http://en.wikipedia.org/wiki/Operation_Aurora [6] http://g0s.org/wp-content/uploads/2013/downloads/Inside_Report_by_Infosec_Consortium.pdf http://g0s.org/wp-content/uploads/2013/downloads/Inside_Repo... [7] http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf

jostmey 12y ago

If I were caught hacking into a private network of computers without authorization even if I had a "good" reason to do so I would be breaking the law and throne in jail. So why is the NSA allowed to do the same?

sauere 12y ago
b-but m-muh terrorism
zz1 12y ago
What would happen to you if you were caught collecting e-mails of the whole world? What would happen of you if you were caught stealing documents from your representatives computer? Nothing is happening because the NSA and most representatives are PARTNERS in this crime. You must contact your representative and let him know that you are ready to do anything in order for him not to be reelected if he won't actively ask for justice.
dredmorbius 12y ago
Within the US, the NSA operates with legal impunity. It is beyond the reach of the law. At least so long as it's acting under official mandate -- rogue agents are apparently sanctioned if pursuing information for personal reasons. If caught. Outside the US, NSA operates with the diplomatic and military support of the US. It's not a matter of an individual hacker, but "an international incident" should something arise. There's some risk that an agent or operative (non-agency employee acting on behalf of the NSA) could be caught, but that would vary by field of operations and relations between that country and the US.
- PeterisP 12y ago
  And for such cases as in NSA, where the actions, though technically illegal, were clearly intended by the leadership - "sanction" can easily mean an official written reprimand stating "this is not acceptable", followed by a cash bonus and a promotion.
dj-wonk 12y ago
I am not a lawyer, but https://www.nsa.gov/about/faqs/oversight.shtml https://www.nsa.gov/about/faqs/oversight.shtml mentions Executive Order 12333 and other legal mechanisms.

kelas 12y ago

Enjoyable. A rare opportunity to witness an expression of someone who got p0wned well beyond his level of comprehension. Look how he strokes his pen in disbelief, that poor German dude. "I know those switches", Mein Gott. As of today, there are two kinds of people in the world: those who believe we're still stuck in post-9/11, and those who realised we are now in post-Snowden. There is a third kind who have Facebook accounts, but those are just the nature's way of saying that Darwin got it right.

asdfologist 12y ago
> There is a third kind who still have Facebook accounts, but those are just the nature's way of saying that Darwin got it right. Wow, you just trash talked over 1 billion people in one sentence.
- kelas 12y ago
  Trillions of flies can't be wrong - elephant dung is awesome.
  - ossreality 12y ago
    You made a good point and then trashed it with a knee jerk reaction. If you think Facebook is one of the bad guys here, you don't really get what's going on.
  - TeMPOraL 12y ago
    For flies it is, but that doesn't generalize to other species. It's an incredibly stupid adage.
    - deleted 12y ago
      [deleted]
moe 12y ago
There is a third kind who still have Facebook accounts, but those are just the nature's way of saying that Darwin got it right. That's a non sequitur. Having a facebook account or not is an almost negligible factor in the grand scheme of things. The kind of information commonly exposed on facebook can be more conclusively inferred from other information sources. Do you use a smartphone? Skype? Any search engine? Does your home internet come out of a plastic router? Do you click on the little lock icon every time you go to a SSL site, to verify the certificate hasn't changed? Do you know the fingerprint of the legitimate facebook SSL certificate? Think about what any one of the above devices "knows" about you in comparison to what facebook knows about you.

Keyframe 12y ago

They must've known?

ck2 12y ago

Reminds me of the Google engineer response: https://plus.google.com/+BrandonDowney/posts/SfYy8xbDWGG https://plus.google.com/+BrandonDowney/posts/SfYy8xbDWGG

kbar13 12y ago

that feel when ~5:15 and the username/password to an account with "deep access to the network" is horizon/h0r1z0n

scintill76 12y ago
I think it was deep access to one customer's network, and probably their own fault for choosing lame credentials.

naner 12y ago

This also illustrates the weakness of using just a password for authentication to anything of value.

dredmorbius 12y ago

Is there an alternate source for the video? I cannot get it to play at all under Linux / Chrome.

sentenza 12y ago
Here it is on Vimeo: http://vimeo.com/106026217 http://vimeo.com/106026217 Worked fine for me in FF on linux. Might be worth a try in Chrome.
- dredmorbius 12y ago
  Vimeo does work for me generally. I can also download it with youtube-dl.

dmix 12y ago

Requires Flash to watch :\

zz1 12y ago
Can be done with H264: https://news.ycombinator.com/item?id=8316396 https://news.ycombinator.com/item?id=8316396

coalbee 12y ago

What about 2048 RSA public key cryptography performed on the application level? Didn't the Snowden leak say the NSA still can't crack 2048?

zby 12y ago

This crashes my shockwave flash plugin - should I start to be paranoid?

pinaceae 12y ago

If you're a radical, islamist, leftist, etc. then maybe you're a target for NSA, GCHQ. if you're a sysadmin at a telco or infrastructure provider your definitely a target for the NSA, GCHQ. let that sink in. infrastructure these days also means AWS, facebook, youtube, twitter. every piece, site, offer that might be used by ISIS, for example.