Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Source Code Similarities Between NSA Malware and 'Regin' Trojan

spiegel.de

Post reply on HN
Print view View original

121–130 of 200 posts

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#121

Post by peterwwillis »

Many espionage tools are designed by organizations that then sell or license their tools to 3rd parties. Just because the NSA used it doesn't mean they wrote it.

'Some reporters were surprised to learn that the University of Maryland had a "covert" NSA facility operating somewhere on or near the school grounds. [..] "Which facility and exactly where it was Snowden worked is unknown, but the NSA has connections to several university facilities, including the Laboratory for Physical Sciences, the Office of Technology Commercialization and the Lab for Telecommunication Science."'

http://www.motherjones.com/mojo/2013/06/university-maryland-...

Oh, and the University's college hacking team got 1st at the Major League Hacking Championship in 2013, winning over MIT, Carnegie Mellon and Rutgers. https://www.umdrightnow.umd.edu/news/umd-students-win-major-...

There are probably hundreds of other organizations which work 'in partnership' with the intelligence community to develop programs which are essentially used to better their espionage and analysis capabilities. Almost all the Virginia/DC/Maryland area's tech companies are employed in one way or another by the federal government, usually for the military or an intelligence agency.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#122

Post by xswcde »

GrinningFool wrote: post #98
bjackman wrote: post #44

Earlier quoted context omitted.

Also "source code"... This is clearly not source code.

I'd argue that it's source code at the lowest possible level...

I know you are wrong. logfromblammo explains it well.

But let's hear your arguments, I'm curious.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#123

Post by bayesianhorse »

john_b wrote: post #63
bayesianhorse wrote: post #42

Earlier quoted context omitted.

Again, you seem to not understand how I discriminate between means and their use. Spying on European officials is a problem with oversight, not with capabilities. Arguably, European officials are a lot softer targets than a crime cartel or terrorists in this regard.

> "Spying on European officials is a problem with oversight, not with capabilities." Snowden has showed this to be absolutely false. "Oversight" has been the nominal preventative for spying on our allies for decades, and it has always failed because these are spy agencies we are talking about. Their nature (and job description) is to do things in secret . You cannot oversee what you cannot see. The NSA has a fundamen…

Snowden and others have also shown that other countries' intelligence agencies will happily take over from the NSA and spy on you. For example the Chinese and Russians.

Hacking tools are not mass surveillance technology. Trojans just don't work for that.

And if you can't control how these agencies use their abilities, how do you propose to take these away from them? Adequate oversight is easier to achieve.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#124

Post by jimbokun »

vidarh wrote: post #52
raverbashing wrote: post #34

Earlier quoted context omitted.

I wonder if Chomsky would have that liberty of critique in any other country...

He certainly would in quite a lot of countries. Chomsky is a lot less controversial in a lot of countries outside the US than he is in the US. I'm sure there are countries where he'd be unable to say what he wants, but there are also a lot of countries (e.g. in Europe) where his political views are reasonably close to mainstream, to the extent where he's no more controversial than the average left wing politician and…

Reagan joke:

"Two men, an American and a Russian were arguing. One said, in my country I can go to the white house walk to the president's office and pound the desk and say "Mr president! I don't like how you're running things in this country!" The Russian said "I can do that too!"

"Really?"

"Yes! I can go to the Kremlin, walk into the general secretary's office and pound the desk and say, Mr. secretary, I don't like how Reagan is running his country!"

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#125

Post by spacemanmatt »

bayesianhorse wrote: post #22
kgarten wrote: post #18

Earlier quoted context omitted.

I don't get it. The NSA is not a democratic government ... It's not elected by the people. The US people have no control over the NSA. There are also good reasons to argue that the US is not democratic: http://www.bbc.com/news/blogs-echochambers-27074746

The U.S. government, for all its weaknesses, is providing their citizens with freedom and liberties as good or better than most other countries. The NSA does have democratic oversight. It is controlled by the executive, legislative and judicative branches of the system. That this control is inadequate in our view, doesn't matter for the question whether or not the NSA is part of a democratic system.

> The U.S. government, for all its weaknesses, is providing their citizens with freedom and liberties as good or better than most other countries.

[citation needed]

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#126

Post by sudioStudio64 »

The NSA is tasked with doing signals intelligence so I get why they would develop some hacking abilities but you have to wonder where the break over point is with the money they are spending...at some point they are spending enough money that they could actually make a difference in improving our software and infrastructure. I mean, one of the reasons they say that they need these capabilities is because we are so vulnerable...how about actually helping out?

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#127

Post by hueving »

k-mcgrady wrote: post #111
cyphunk wrote: post #46

It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK attribution based on the similarity of code argument given by the US -- pointing out that the code base was in the wild for a long time, could be purchased on black market or reverse/reengineered after picking up the malware from a vulnerable machine. Shouldn't…

>> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack." Just playing devils advocate here. The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?

Displaying a lack of intellectual rigor in response does not garner any respect from people that can think. The quickest way to get people smart to tune out is to engage in a political mudslinging contest lacking real content.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#128

Post by bayesianhorse »

teamhappy wrote: post #48
bayesianhorse wrote: post #10

My current opinion on government hacking is, that I actually want democratic government to be the biggest meanest hackers of them all. The alternative, unfortunately, is that either organized crime or non-democratic governments (or a combination of both) would be the biggest meanest hackers. And hacking doesn't really scale. Mass surveillance just through attacking individuals with malware isn't possible, because of…

Not sure why people vote you down for sharing your opinion. Having said that, your logic is fundamentally flawed. Governments have to either focus on attacking or defending. Focusing on attacking means keeping a lid on vulnerabilities, which weakens the security of citizens and corporations inside their own country. Focusing on defending means disclosing those vulnerabilities in order to protect everybody, which also…

Not disclosing vulnerabilities is not a question of attacking or defending, it's just stupid to keep vulnerabilities open.

I also didn't propose to uncompromisingly favor attack capabilities. I still don't think effective cyber defense is possible on a national level without leading the edge on offensive abilities as well.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#129

Post by ingler »

bayesianhorse wrote: post #118
ingler wrote: post #76

Earlier quoted context omitted.

The NSA has little to no oversight: ---- "Congressional oversight of the NSA is a joke. I should know, I'm in Congress" by Alan Grayson http://www.theguardian.com/commentisfree/2013/oct/25/nsa-no-... ---- A minor quibble, but governments don't provide freedoms and liberties. They restrict them. Hence the word "govern" and its etymology.

Try to enjoy your liberty, for example the right to property, when there is no government to stop your neighbor from just taking your stuff. Looking back at history, I vastly prefer the balance of liberty afforded by strong governments in the western world to the lack of such control.

The right to property implies the right to also defend that property. I'm what stops my neighbor from taking my stuff, not the government.

Looking back at history, strong governments have been THE source of oppression and limitations of freedoms.

Re: Source Code Similarities Between NSA Malware and 'Regin' Trojan

#130

Post by teamhappy »

PeterisP wrote: post #107
teamhappy wrote: post #39

Earlier quoted context omitted.

Class action might be a solution for US citizens. The problem with malware though is that you end up infecting a whole lot of innocent civilians all over the place, which the people in Den Haag have slightly mixed feelings about. To be honest, I'm a bit disappointed that these cases never end up in international courts. The rules we have in place seem pretty clear to me.

What rules do we have in place? AFAIK there are no widely accepted international conventions that would forbid, say, USA goverment to install malware (intentionally or unintentionally) on a german user's computer; if you can name as specific one then that would make this discussion much more interesting. International law is not particularly restrictive to the rights of governments to attack each other or their citiz…

Given that you've used Germany as an example, I'd recommend this german podcast to you which explains the legal surroundings in great detail: http://alternativlos.org/25/
Post reply on HN