Snowden impersonated NSA officials, sources say • Hacker News Board

Re: Snowden impersonated NSA officials, sources say

#31

Post by cma » Thu, Aug 29, 2013, 6:25 PM UTC

AsymetricCom wrote: post #29

I know I'll get downvoted for this. Please be a contributing community member of HN and state why. Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? I have yet to see any serious abuse of the NSA's power. The fact that they know that low level employees were spying on potential love interests means that t…

>Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything?

Are the two mutually incompatible?

>The fact that they know that low level employees were spying on potential love interests means that they have a system in place to track such abuses.

The love interest thing wasn't part of a leak, was it? I thought they just voluntarily disclosed it, probably to distract from thoughts of domestic spying on e.g. politcal views, rather than petty tabloid personal stuff.

Re: Snowden impersonated NSA officials, sources say

#32

Post by rhizome » Thu, Aug 29, 2013, 6:26 PM UTC

stcredzero wrote: post #22

The use of the word "impersonated" stinks to high heaven. There is a big difference between an admin logging in as someone else and someone "impersonating" someone on TV or over the phone. That would be like having secret documents in a drawer marked "John Smith," then saying that someone who opened that drawer and took some documents was "impersonating" John Smith. Then there's the bit about "hiring brilliant people…

It's a case of the NSA's administrative incompetence: there should be auditing in place.

This has been a buried lede since the beginning: under the Common Criteria, what EAL was supposed to be in place for his role?

Re: Snowden impersonated NSA officials, sources say

#33

Post by yk » Thu, Aug 29, 2013, 6:26 PM UTC

john_b wrote: post #20

defen wrote: post #14

Wasn't the original story that he was a high school dropout, glorified keyboard jockey who was way overpaid for what his job entailed? These guys need to get the message straight.

No, we've always been at war with Eastasia.

Of course, but unfortunately the Minitrue sometimes confuses Eastasia with Oceania.

Re: Snowden impersonated NSA officials, sources say

#34

Post by rhizome » Thu, Aug 29, 2013, 6:27 PM UTC

jrs235 wrote: post #15

sczkid wrote: post #3

If the NSA didn't guard against him using accounts with more clearance to download documents he wasn't supposed to have access to, I don't think Snowden's intelligence is what we should be worried about.

Which I don't understand... they're claiming that we should trust them but they aren't (or shouldn't be [hiring]) the most brilliant people. So, how many other holes exist in their systems and oversight that are unknown because there aren't brilliant people finding them?

Not only that, but isn't the NSA required to have a sufficient level of auditing to detect (or at least record) those accesses before the systems are even fired up?

Re: Snowden impersonated NSA officials, sources say

#35

Post by [deleted] » Thu, Aug 29, 2013, 6:28 PM UTC

AsymetricCom wrote: post #29

I know I'll get downvoted for this. Please be a contributing community member of HN and state why. Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? I have yet to see any serious abuse of the NSA's power. The fact that they know that low level employees were spying on potential love interests means that t…

[deleted]

Re: Snowden impersonated NSA officials, sources say

#36

Post by sigzero » Thu, Aug 29, 2013, 6:29 PM UTC

pilom wrote: post #27

Ellipsis753 wrote: post #13

Why would you give someone the ability to impersonate people with higher clearance? That seems like poor design from the start.

I'm highly skeptical of the reporting. He may have impersonated other accounts to cover his tracks but if he had physical access to a system or the user database of a system then he was "authorized" to see all of the data on that system. Or they are doing IT security worse in that office than it is usually done.

No he wasn't. Security is a "need to know". Just because you have a TS clearance for example doesn't mean you have access to all TS information out there. If you step over that then you get slapped down.

Re: Snowden impersonated NSA officials, sources say

#37

Post by betterunix » Thu, Aug 29, 2013, 6:31 PM UTC

AsymetricCom wrote: post #30

stcredzero wrote: post #22

The use of the word "impersonated" stinks to high heaven. There is a big difference between an admin logging in as someone else and someone "impersonating" someone on TV or over the phone. That would be like having secret documents in a drawer marked "John Smith," then saying that someone who opened that drawer and took some documents was "impersonating" John Smith. Then there's the bit about "hiring brilliant people…

There is no "root access" implied in this article. Read about RBAC to understand this.

It looks like the NSA is using RBAC in some form, but with a big gaping hole that Snowden just walked right through. Log in as a user and you get "Hotel California" security -- you cannot escape your role. Log in as an administrator and you are not confined to any role and can just walk all over everything.

Another possibility is that Snowden had the ability to create login credentials and just gave himself the ability to log in as another user.

Re: Snowden impersonated NSA officials, sources say

#38

Post by walshemj » Thu, Aug 29, 2013, 6:36 PM UTC

rhizome wrote: post #26

jrs235 wrote: post #15

Earlier quoted context omitted.

Which I don't understand... they're claiming that we should trust them but they aren't (or shouldn't be [hiring]) the most brilliant people. So, how many other holes exist in their systems and oversight that are unknown because there aren't brilliant people finding them?

Speaking from experience, detailed auditing is covered by even the most basic Windows Server admin course. It's not a question of brilliance.

As is knowing what MAC and DAC are

Re: Snowden impersonated NSA officials, sources say

#39

Post by [deleted] » Thu, Aug 29, 2013, 6:36 PM UTC

AsymetricCom wrote: post #29

I know I'll get downvoted for this. Please be a contributing community member of HN and state why. Have any of the NSA leaks told us anything we don't know? Haven't the majority of the leaks told our foreign enemies how to avoid being tracked more than anything? I have yet to see any serious abuse of the NSA's power. The fact that they know that low level employees were spying on potential love interests means that t…

[deleted]

Re: Snowden impersonated NSA officials, sources say

#40

Post by ChikkaChiChi » Thu, Aug 29, 2013, 6:38 PM UTC

Aren't these stories sort of the very definition of spin propaganda?

At least Snowden hasn't been locked away in a hole for three years only to be brought out into the public to tell everyone he's really thinks his a woman.