Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

spiegel.de

Post reply on HN
Print view View original

91–100 of 295 posts

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#91

Post by nitrogen »

adventured wrote: post #75
Cakez0r wrote: post #54

Earlier quoted context omitted.

I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?

The obvious one: war with another nation. Along with threat deterrent. I can't think of any good argument for why the US military should have no offensive capabilities in the digital realm. It'd be the equivalent of staying out of the skies when flight became possible. In any war, the US is going to come under digital attack, and it should be fully capable of responding both defensively and offensively. Besides that,…

But by stockpiling vulnerabilities they are making civilians less safe. Offensive digital capabilities should never come at the expense of fixing software.

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#92

Post by hengheng »

fidotron wrote: post #16

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as pre…

So I happen to be German, and obviously I don't have a say in what commands you guys give to your own secret services. But since this appeared in a German magazine, allow me to say this: given the track record of how you treat your alleged "allies", I don't feel comfortable seeing these developments. And I wouldn't ever trust anybody with these powers, least the nsa or even the US government. These people are still trying to create a US World Empire out of their own hybris, they just cannot leave the world in peace.

Surprisingly, it turns out that this is an easy way to make enemies, as last week's action in Paris have shown. It has been shown since 2005 that the islamists that massacred twelve people were, in fact, radicalized by what they learned about the prison of Abu Ghraib.

Job well done, thank you very much guys.

Lastly, the way our own government is supporting the nsa makes me feel nauseated at some times, furious at other times. We have plenty of work to do locally, that's why usually I don't complain about foreign services. Simply allowing the nsa to gain world domination like that though, just because "that is their job", really is hard to accept for me, and it really rubs me the wrong way.

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#93

Post by jallmann »

throwaway349823 wrote: post #48
jallmann wrote: post #41

Earlier quoted context omitted.

Having offensive capabilities and actually utilizing such capabilities are two different things. You can acknowledge the need for the former alongside the dangers of the latter, just as you would with any standing military.

I don't really see how that fits into this scenario. Computer Security is more like chemical warfare. Were you can either do research or try to make everyone more secure by international treaties. Here you can either undermine encryption, infiltrate networks, keep exploits to yourself or you can make everyone secure by patches, standards and encryption that works.

> Computer Security is more like chemical warfare

Ignoring this nonsensical analogy...

> undermine encryption, infiltrate networks, keep exploits to yourself

This is really the MO of any intelligence agency; that is their job.

> you can make everyone secure by patches, standards and encryption that works

Interesting statement, because it shows some things. Firstly, there is a difference in incentives -- why publish a vulnerability when it could be used to further your mandate? For the specific case of NSA though, that also ignores their broader role in securing federal communications (eg, vetting SHA, AES, FIPS, etc). Of course, there are always exceptions (DES, Dual-EC-DRBG, etc) -- but in a way, that precisely illustrates why we have intelligence agencies in the first place: trust no one.

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#94

Post by jsprogrammer »

Cakez0r wrote: post #54
fidotron wrote: post #16

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as pre…

I don't understand why there are so many comments saying that the NSA needs offensive digital capabilities. What valid reasons does the NSA have to ever be committing a cyber attack?

Well, the comment you responded to said they need offensive capabilities because they have/need defensive capabilities.

It seems like a bit of a self-fulfilling prophecy to me, which can be a very dangerous thing.

Vulnerabilities should be searched for, but when discovered they need to be disclosed and fixed, not used to create real world damage.

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#95

Post by EpicEng »

moe wrote: post #67
EpicEng wrote: post #37

Earlier quoted context omitted.

The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. And yes, this is their job, and there's nothing wrong with it. Domestic spying is something that needs to be reigned in and tightly controlled, but to think that everyone should know everything is just naive and shows little understanding of how the real worl…

The obvious answer is that it becomes much harder for the NSA (and related entities) to do their job when their tactics and capabilities are known to the world. Harder as in how? That handwavy excuse gets thrown around a lot, I have yet to hear someone back it up with anything tangible. Domestic spying is something that needs to be reigned in and tightly controlled Well, we tried with blind faith for a while. Turns o…

"Well, we tried with blind faith for a while. Turns out that didn't work all too well.

So, how do you propose we control something that we are not allowed to know anything about?"

Agreed, with the first sentence at least. Let's be real though; no incarnation of oversight is going to have you and I involved directly, nor should it. You cannot expect the populous to be sufficiently educated on the intricacies of foreign policy and global threats.

So my proposal would be for the lawmakers to propose a better form of oversight which includes strict provisions for surveillance, especially the domestic variety. These provisions also cannot hamstring the NSA or the like; there has to be balance.

The parent comes off as a proponent of opening up the floodgates. That's ridiculous and it will never happen (nor should it). You cannot have a system which A) allows for full disclosure, and B) does not weaken our ability to defend ourselves.

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#96

Post by [deleted] »

krapp wrote: post #83
elwin wrote: post #77

Earlier quoted context omitted.

Try looking at the comments from a different angle. Instead of grouping them into "pro-NSA" and "anti-NSA" categories, try checking for technical ignorance. Look for ideas about cyberwarfare based on bad analogies with real warfare. Look for a mindset that puts winning an arms race first and never considers ethical implications. Look for vague statements about protecting or harming America that don't explain whether…

To be fair, I doubt many people (including myself) with an opinion either way actually know what they're talking about. The expert pool for knowledge about high-level classified government hacking is probably pretty small, even on Hacker News. It's politics, and politics hits people in the lizard brain and short-circuits their ability to think rationally.

[deleted]

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#98

Post by dmix »

Animats wrote: post #25

Everything at the lowest levels needs to be tightened up now. Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems. Mostly C and C++. Fortunately we have Go and Rust, plus all the semi-interpreted languages, now, and can do it. We need something that runs Docker-like containers and, all the way down the bare metal, has no unsafe code. We need dumber server…

> Buffer overflows in trusted code have to go. This means getting rid of the languages with buffer overflow problems.

In the meantime, since moving away from C will take years, we need to invest in better exploit-mitigation technology instead of relying on bug-hunting-driven-security. That means OS/kernel developers need to start taking security seriously and keeping up with attackers. This means adding proactive measures instead of slowly reacting only when a new CVE comes out. Which sadly far from the reality at the moment.

For example, OpenBSD made headlines for adding W^X to the whole kernel but hackers have already been bypassing W^X on iOS for years:

http://bsd.slashdot.org/comments.pl?sid=6723643&cid=48812833

>> These protections may guard against a (very small subset of) casual attackers, but they're just another minor hurdle for determined attackers.

In addition we need to move away from signature-based AV towards host-based intrusion detection systems (HIDS). It is not accident that all the feds who left government cybersecurity jobs in recent years moved to build private companies creating HIDS products and making millions selling them to big corps (FireEye, Crowdstrike, etc).

The only options available for consumers and the average sys admin are security tools easily bypassed by any semi-sophisticated adversary (for ex: Anti-virus/RKhunter/SELinux/most trusted computing code-integrity systems/etc).

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#99

Post by throwaway344 »

markvdb wrote: post #90
fidotron wrote: post #16

To be fair here, the NSA should very well be doing these things, for the purpose of attacking other states. The reason is very clear as the Russian attacks on Estonia ( https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia ) demonstrate a clear need for defensive capability in this area, and where you have defence you end up needing offence. This persistent confusion between legitimate NSA operations such as pre…

Are you a US citizen? How would you react if supposedly close US allies were bugging the White House, the US senate and AT&T? Repeatedly? Five Eyes, Echelon, Merkel, Belgacom, ...

The irony of course is that the CIA did hack into the US Senate's computers. http://www.nationaljournal.com/tech/cia-admits-it-improperly...

Re: New Snowden Docs Indicate Scope of NSA Preparations for Cyber Battle

#100

Post by jakeogh »

The premise that we need "beneolvient power" to "protect us" from "evil doers" is the oldest trick in the book. If there is no threat, one will be generated. Almost organically, it does not even take overt orginization. The players know cui bono.
Post reply on HN