Botched CIA Communications System Helped Blow Cover of Chinese Agents • Hacker News Board

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#121

Post by jessaustin » Thu, Aug 16, 2018, 1:57 PM UTC

brown9-2 wrote: post #82

yborg wrote: post #13

It took 8 years for the CIA to figure out what happened?? This certainly explains why China and Russia continue to conduct cyber operations basically at the same level of intensity they have been for years - US intelligence, despite its enormous, unaccountable budget is unable to stop them or even know where they are compromised. If there is an actual hot conflict between the US and either of these nations, I shudder…

Note that just because we are reading about it eight years later does not mean it took that long for the CIA to figure out what happened.

A decade from now, perhaps we'll learn about the CYA failure that resulted in news of this disaster being released to the public... I reckon that just like everything else about the unsupervised services, this is just the tip of the awful iceberg. Probably there are ten failures like this for every one we learn of.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#122

Post by st26 » Thu, Aug 16, 2018, 1:57 PM UTC

solatic wrote: post #11

>But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to i…

To me, preventing this seems like exactly the sort of thing the NSA ought to be for.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#123

Post by [deleted] » Thu, Aug 16, 2018, 1:58 PM UTC

nerdponx wrote: post #72

baybal2 wrote: post #12

Earlier quoted context omitted.

How stupid it is to spend so much effort on compartmentalising their intel net in the country, but have all spies report by dialing in into the same website in a country employing few brigades worth of people reading tcpdumps 24/7? Compare that to one way coded messages over hf radio: a place for pick up of a dead drop in n days is broadcasted, then it is picked up by a man who reads it, destroys it, and gtfos from t…

My guess is that this is actually relatively new system that was implemented after the criticisms in the week of the September 11 attacks. One of the stories you keep hearing is that the plot was not discovered in time because agencies were not sharing enough information.

[deleted]

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#124

Post by hackinthebochs » Thu, Aug 16, 2018, 1:59 PM UTC

solatic wrote: post #11

>But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to i…

> and the security of the system relied upon the firewall between the different front-ends

I really don't think there's anything to conclude from the "firewall" comment. This term has become a layman way of describing any kind of intended separation between computer systems. People know what firewalls are and so it becomes an overused analogy. It's like how passwords are described as being "encrypted" in layman media.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#125

Post by pertymcpert » Thu, Aug 16, 2018, 2:03 PM UTC

evntllyCnsistnt wrote: post #74

Knowing how absurdly insecure any civilian consumer system is (laptop, smart phone, home assistant, self driving car), with zero day fire-and-not-a-drill-at-all advisories, pretty much every month, I don’t get how this sort of thing happens. I also fail to see how a decision like this could be made: The CIA had imported the system from its Middle East operations... To China? The degree of technical differences betwee…

How could one time pads be broken?

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#126

Post by jandrese » Thu, Aug 16, 2018, 2:06 PM UTC

sandworm101 wrote: post #115

solatic wrote: post #11

>But the CIA’s interim system contained a technical error: It connected back architecturally to the CIA’s main covert communications platform. When the compromise was suspected, the FBI and NSA both ran “penetration tests” to determine the security of the interim system. They found that cyber experts with access to the interim system could also access the broader covert communications system the agency was using to i…

Between the lines: it was Tor. Deploys on computers. Web-based. Detectable through decryption or pattern analysis. Firewalls. It was a pair of Tor hidden services. The mistake was probably that they ran both on the same machine with only a firewall separating them, rather than physically different servers.

And on the hidden website there was a link back to cia.gov somewhere.

On the other hand I'm surprised tor works in China at all. I would expect the Great Firewall to shut down all entrance/exit nodes going into or out of the country, except maybe for a few controlled by the government.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#127

Post by jandrese » Thu, Aug 16, 2018, 2:11 PM UTC

omni wrote: post #118

mikec3010 wrote: post #99

Earlier quoted context omitted.

What about the Rosenbergs?

Quick Google suggests they were convicted for espionage (under the Espionage Act), not treason. Though it's really unclear to me why espionage against your own country and for another would not qualify as treason. edit: Sibling commenter had a view on it: "Technically, this wouldn't be treason according to the US definition, because treason is only possible in the context of a declared enemy of the USA (i.e., war)."

So part of the reason is that since the end of WWII we have not technically been "at war" because that requires Congressional approval and politics gets involved.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#128

Post by pc86 » Thu, Aug 16, 2018, 2:12 PM UTC

cascom wrote: post #104

Gustomaximus wrote: post #37

Earlier quoted context omitted.

I wonder if this is due to the ever increasing scale of the US intelligence services. From my working life perspective smaller teams of talented people are often more impactful than significantly larger teams. E.g. Large teams create bureaucracy. And 'weak links' become harder to spot and typically allowed to remain. I know nothing about this area so take my comment as curiosity only, but I wonder what USA gets/achie…

From my brief view into a federal agency: Employee breakdown is as follows: 1/6 extremely capable and dedicated high performers 1/6 extremely capable and dedicated but go home at 5pm 1/3 average (not going to screw things up massively, but also never going to make a large contribution) 1/3 shocking (as in where do you even find people this useless and disagreeable - if you’re lucky their managers put them in an offic…

So 1/3 high performers, 1/3 average, and 1/3 low performers? Not a particularly amazing revelation.

And why the differentiation between folks who leave after 8 hours of work and those that don't?

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#129

Post by pc86 » Thu, Aug 16, 2018, 2:13 PM UTC

mikec3010 wrote: post #103

qaq wrote: post #101

Earlier quoted context omitted.

How is that relevant ?

Shows a contradiction/hypocrisy. They have the money, but just choose to spend it on corporations and not humans.

No, it shows that unfortunately you don't know what you're talking about. Federal employee salaries are set by legislation and may not be changed. They can't get bonuses or anything else. Contracts are bid and are paid out of completely different budgets.

Re: Botched CIA Communications System Helped Blow Cover of Chinese Agents

#130

Post by secfirstmd » Thu, Aug 16, 2018, 2:13 PM UTC

evntllyCnsistnt wrote: post #74

Knowing how absurdly insecure any civilian consumer system is (laptop, smart phone, home assistant, self driving car), with zero day fire-and-not-a-drill-at-all advisories, pretty much every month, I don’t get how this sort of thing happens. I also fail to see how a decision like this could be made: The CIA had imported the system from its Middle East operations... To China? The degree of technical differences betwee…

What direct cryptographic attack do you know that works on a one time pad? (Aslong as the randomness used to build it is real, it is implemented properly and not re-used etc)