Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Thousands of computers now compromised with leaked NSA tools, researchers say

cyberscoop.com

Post reply on HN
Print view View original

61–70 of 173 posts

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#61

Post by losteric »

macspoofing wrote: post #45
losteric wrote: post #40

Earlier quoted context omitted.

The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?

Isn't that partly the mission statement of the NSA and CIA and FBI?

The CIA and NSA are externally oriented.

Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution.

We need an organization focused on preemptively securing our infrastructure.

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#62

Post by cairo_x »

willstrafach wrote: post #57
arca_vorago wrote: post #2

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massive…

> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea. However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day ex…

Many of those exploits will be used to knock through a backdoor. I wonder if they use different keys for each one? Fingers crossed they do.

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#63

Post by daveguy »

kakarot wrote: post #54
daveguy wrote: post #11

Earlier quoted context omitted.

You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info. Unless you've got conspiracies on other topics, then maybe. I think it's fairly common for even someone with a cursory knowledge of security to know that backdoors are a bad idea. The triple letters don't get their power from poor products. Those are going to be around no matter what. I'd rather this just drive a push toward more…

It was before Snowden. We have had hard facts since the 90's that mass wiretapping and exploitation has been going on thru vehicles like AT&T and Verizon. And we knew about PRISM for a good two years before its public disclosure. Sudden black square over a remote area in Utah in satellite imagery. Pictures of a massive contruct. Coupled with the fact that we knew they needed a place to centralize all of this collecte…

> It was before Snowden.

I wasn't saying that's when it started. I was saying that's when people stopped viewing "government is listening to everyone" as conspiracy.

> No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them...

It didn't have anything to do with Snowden's "celebrity". Do you think he was a celebrity before he produced physical evidence? Turns out, no one wanted to friggin listen, until someone had proof.

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#64

Post by cryptarch »

noir_lord wrote: post #35
sillysaurus3 wrote: post #31

Earlier quoted context omitted.

We probably need the NSA. It's their job to exploit computers the same way it's the job of the military to apply force. It's difficult to say that we can do without the NSA any more than we can do without a military. In that light, the context is to reduce the impact of the NSA's necessary goals. Higher up in the thread, it was claimed that one of the most feared branches of the intelligence arm of the most powerful…

> It's their job to exploit computers the same way it's the job of the military to apply force. That's one half of their job, the other half is to secure government infrastructure from exactly the type of attacks they use on other countries. The problem there is that it sets up an incredible tension since how do you get the message out about a 0-day in windows to protect your 'own' side without your opponents getting…

> how do you get the message out about a 0-day in windows

Force-push a Windows 10 update? That seems like one of the few legitimate usecases of Win10 being a corporate botnet.

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#65

Post by knowaveragejoe »

losteric wrote: post #61
macspoofing wrote: post #45

Earlier quoted context omitted.

Isn't that partly the mission statement of the NSA and CIA and FBI?

The CIA and NSA are externally oriented. Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution. We need an organization focused on preemptively securing our infrastructur…

The NSA is actually tasked with that mission:

> NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare.

https://en.wikipedia.org/wiki/National_Security_Agency

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#66

Post by cmurf »

arca_vorago wrote: post #2

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massive…

No, the people who know how hard good security is, how easy it is for this material to spread around when a huge chunk of your intelligence services are private for-profit contractors, and had completely sane ideas about how weaponized the government's tools were likely to be - were not crazy or cuckoo or conspiracy oriented.

Conspiracy theorists are where 3 million illegal voters, thousands of Arabs dancing on buildings, and the last president being a Kenyan with a falsified birth certificate, all come from.

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#67

Post by jimnotgym »

losteric wrote: post #40
macspoofing wrote: post #34

Earlier quoted context omitted.

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your se…

The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?

Before this runs the risk of becoming a universally acknowledged truth, is it fine? Actually wasn't "Gentlemen don't open each other mail", also a perfectly reasonable position? In the cyberwar the US already seems to be fighting against its own weapons! Would it actually be much better for a nation like the US to use its knowledge defensively and keep their citizens safe from foreign interference?

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#68

Post by knowaveragejoe »

kakarot wrote: post #54
daveguy wrote: post #11

Earlier quoted context omitted.

You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info. Unless you've got conspiracies on other topics, then maybe. I think it's fairly common for even someone with a cursory knowledge of security to know that backdoors are a bad idea. The triple letters don't get their power from poor products. Those are going to be around no matter what. I'd rather this just drive a push toward more…

It was before Snowden. We have had hard facts since the 90's that mass wiretapping and exploitation has been going on thru vehicles like AT&T and Verizon. And we knew about PRISM for a good two years before its public disclosure. Sudden black square over a remote area in Utah in satellite imagery. Pictures of a massive contruct. Coupled with the fact that we knew they needed a place to centralize all of this collecte…

I don't think anyone worth a damn as far as this subject is concerned would have labeled you a conspiracy theorist. Anyone with an even passing knowledge of security assumed something of this nature was going on. It just logically follows, given the explosion of computers in every aspect of life, that the NSA would be doing this.

Side note, what black image in a remote area of Utah? If you're talking about the Bluffdale data center, it's been visible on Google maps this entire time IIRC. You can even see historical images of it being built in Google Earth:

https://www.google.com/maps/@40.43085,-111.9278303,2900m/dat...

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#69

Post by abecedarius »

macspoofing wrote: post #34
arca_vorago wrote: post #2

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massive…

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your se…

> literally why they were created to do

The NSA is supposed to do both defense and offense. The defense came up, for example, when they improved DES to resist differential cryptanalysis (which the public crypto world hadn't discovered yet) before DES was standardized.

But that was a long time ago; at least since 9/11 the offense side seems to have pretty much eaten the defense, as far as we can tell. (See: https://en.wikipedia.org/wiki/Dual_EC_DRBG) I believe this newer strategy is badly misplaced from the standpoint of the security of the American people (and good for the power of security-state insiders).

Re: Thousands of computers now compromised with leaked NSA tools, researchers say

#70

Post by ganoushoreilly »

losteric wrote: post #60
willstrafach wrote: post #57

Earlier quoted context omitted.

> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea. However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day ex…

That's the exact process I'd like to see, but what really happens is more like: 1. Discover 0-day exploits relevant to mission 2. Build modular tools to utilize the 0-day 3. Do nothing 4. Lose control of 0days, or allow other actors to discover them. It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone w…

"It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open"

I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.

Post reply on HN