NSA Owns Everything (2015)

You are talking about Coreboot, not Libreboot. The latter has no blobs whatsoever.

Not really many relevant comments in this thread. Everyone seems to have read the first sentence (if even), interpreted it as 'why did no one think the NSA was hacking?', and responded. It's a shame, this is a great piece, I think.

The question is, with all of these companies performing IR, why didn't they see mass exfiltration and C2?

I think the article lays out largely correct claims.

I personally would imagine (2) and (5) to be the most significant.

Regarding (2), it is so hard during an incident to know exactly what is attacker behavior and what isn't, to know that it's all the same attacker, etc. It isn't so uncommon to go digging into an incident only to find some unrelated malware - and in fact many companies find out they're owned from their pentesters.

With regards to (5), defenders have frankly been to slow to evolve. The people investigating these attacks likely only have a rudimentary understanding of TCP/IP, have virtually no ability to read or write code, and mostly are trained to build and enforce policy. The idea that they can catch even basic attackers in realtime is a joke, that they are to also be tasked with catching the NSA is just a depressing, hard to swallow reality.

Attackers are out here building up toolchains from scratch - anyone who isn't doing that is called a script kiddy. And yet defenders who can't build a single thing, who can only throw tools at a problem, are the standard. Attackers are flat out better than defenders - they work smarter, they have better capabilities, and defenders don't even seen to care en masse.

As Alex Stamos said (paraphrasing), most companies aren't even "playing the game", and it's a select few that even know what game to play - not even that they're playing well, but at least they showed up to the right ballpark (I'm butchering his statement). The vast majority of companies employee outdated models of security and incident response is probably the least mature, with devops pushing more and more infrastructure and product security engineers over IT admins.

No doubt that NSA's scale allowing novel forms of exfil like passive collection also played a major part.

What a sad state.

Having taken VC money to try to improve the situation I do always laugh when thinkst talks about that :) but much respect!

From my reading of the history of these kind of organisations, I think what’s happening is twofold - firstly, that they’re often looking at the wrong people/groups, and secondly, just so much intelligence they have just ends up being wrong or misleading.

Their mission has become “collect it all”, but I think they (and a lot of commentators and even everyday people) can’t really imagine what a large percentage of intelligence is useless noise, deliberately wrong (such as counterintelligence but they don’t realise), just plain wrong (like most intel gathered from torture - people will say literally anything they think you want to hear), correct but misinterpreted, etc.. And it’s extremely hard to meaningfully sort through that much information. I expect they do expend a lot of effort trying to combat this, but historically I don’t believe they’re very good at it, and I’m sceptical machine learning and things like that is really going to help that much.

And then just watching the wrong people. Take the Boston bombing, for instance. There are reports that the key focus of groups like the DHS at the time in that area were the Occupy Boston protests, so the bombing happened even though the FBI had been tipped off about one of the bombers from Russian intelligence services. Then things like the NZ mosque attack, where this far-right wing white supremacist came from Australia and murdered a bunch of people. At the time, the media where I am in Australia was reporting FUD campaigns from Australian security agencies about ISIS and Islamic terrorism, radicalisation etc., so I imagine that’s where the focus was and he slipped through.

This goes way back throughout history. Just think of the massive amount of wasted resources surveilling suspected “communists and homosexuals” back in the day. Here they had agents actually infiltrating university communist groups. The groups got up to extremely dangerous things like going to protests - great use of millions of dollars of surveillance...

> If the NSA was owning everything in sight (and by all accounts they have) then how is it that nobody ever spotted them

I think this should rather say "nobody ever came forward". I'm sure there always were enough pieces of evidence even if scattered and nobody had the whole picture. But the ones who were close enough to put together some of it and get an idea had no incentive to open their mouths.

Coming forward with enough evidence was likely close to impossible until a decade or two ago. The ones who have such comprehensive evidence also have some "incentive" to keep quiet. Up to the proverbial "terminated with extreme prejudice" option, which I'm sure must have been employed given the sensitivity of the topic. Or perhaps risking being labelled a terrorist which would likely lead to even worse outcomes. When the efforts were escalated after 9/11 so were the security measures and the "incentives".

And coming forward with just shreds of evidence of something like this will only get you labelled a nut, enemy of the state, shill, etc.

Snowden and a few others did it at great personal cost and I'm sure they now serve as an example for others to not do it. Look around even today, people see the world in black and white and if you're not with them, you're against them, and they will treat you as such.

Then, if you explain that there is reason to believe the term conspiracy theories was created and popularized specifically to indoctrinate them into responding exactly the way they are responding (like programmable robots).. then they just call ``conspiracyTheories(yourTheory)`` again to "validate" it and you lose 20% of your remaining credibility.

I just go with a bit of ridicule. Something like: It is not that sophisticated, educated, wealthy and influential people in power could get together and have some kind of plan. If they did it couldn't possibly escape your attention but if it did it wouldn't be interesting enough for you to talk about.

Or maybe it isn't that. Maybe the quality of government depends entirely on the citizens? If you think drag net spying is a good idea is a yes/no question. If you don't care means yes which in turn means they should be doing it. Same goes for enriching themselves at your expense. I mean if you approve of it?? Or is not caring and approving not the same thing?