Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

firstlook.org

Post reply on HN
Print view View original

151–160 of 200 posts

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#151

Post by uptown »

mirimir wrote: post #145
mike_hearn wrote: post #137

Earlier quoted context omitted.

The smartest people on the planet are not working at the NSA. Most of what they're doing is just plain old data aggregation and analysis, with a side helping of large scale but ordinary hacking. The type that lots of teenagers have done. From a technical perspective, the sort of research going on at Google (deep neural nets, etc) is in a whole other intellectual league.

Conspiracy theories aside, couldn't the NSA just draft Google?

I'd be stunned if they didn't have employees embedded at Google and other major technology firms.

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#152

Post by merrua »

pests wrote: post #96

One notable line: "GCHQ operatives identified key individuals and their positions within Gemalto and then dug into their emails. In one instance, GCHQ zeroed in on a Gemalto employee in Thailand who they observed sending PGP-encrypted files, noting that if GCHQ wanted to expand its Gemalto operations, “he would certainly be a good place to start.”"

Does that suggest they have an exploit in PGP?

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#154

Post by beagle3 »

bigiain wrote: post #85
socceroos wrote: post #73

Earlier quoted context omitted.

When you hold the Poisoned Chalice of Power you get to decide who is legally justified and who isn't. "Morals" doesn't even factor into things....unfortunately.

Only in a limited way though, the NSA can decide (or at least exert considerable influence over) what's legal in the US - but criminal actions in, say, The Netherlands or any other (non five eyes) country, cannot be "justified" or "excused" legally by another except those countries. I guess a _lot_ of what goes in in state sponsored espionage happens outside the civilian legal system - at least in "major" countries -…

But if you've been following the Firstlook disclosures, and the response to it from different governments, you'll notice that they don't really want to hold anyone accountable - likely, they are all on it some way or another.

Ireland rushed to retroactively OK british spying. Germany ignored it (with some theatrical "I'm insulted" remarks from Merkel, but no real action).

The assumption that any government out there actually wants to enforce its laws with respect to mass spying against its people is not supported by facts.

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#155

Post by beagle3 »

lawnchair_larry wrote: post #76

"TOP-SECRET GCHQ documents reveal that the intelligence agencies accessed the email and Facebook accounts of engineers and other employees of major telecom corporations and SIM card manufacturers in an effort to secretly obtain information that could give them access to millions of encryption keys. They did this by utilizing the NSA’s X-KEYSCORE program, which allowed them access to private emails hosted by the SIM c…

> Then, it came for the Dutch, Belgian, and German engineers, and I did not speak out, because I was not a Dutch, Belgian, or German engineer.

You should assume that the Dutch, Belgian and German agencies already came for you though. Perhaps they are less competent than the NSA, and maybe one of those countries actually acts morally - but there are over a hundred countries out there. At least one of them has a competent intelligence service and no morals.

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#156

Post by beagle3 »

uptown wrote: post #151
mirimir wrote: post #145

Earlier quoted context omitted.

Conspiracy theories aside, couldn't the NSA just draft Google?

I'd be stunned if they didn't have employees embedded at Google and other major technology firms.

It has been my assumption that Facebook's and Google's core network and security teams are each a large crowd of embedded spies working for various intelligence agencies.

Think about it: You're a NSA/Mossad/MI5 NetOps operative. You can have access to a lot of information without risking your life, get paid by your agency AND google/facebook. What's not to like?

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#157

Post by frandroid »

knodi123 wrote: post #78

How is snowden still producing high-level stuff like this? Did he really steal info on that many headline-worthy stories all in one go, or does he have fresh sources? Sometimes this feels like another instance of what I call the "weird al phenomenon", where any person who hears a silly parody of a pop song attributes it to weird al, because "wait, you're telling me there are other song parody writers?"

This is all part of the initial haul. They're checking all the documents one by one to make sure they don't reveal information that would make intelligence agents and others at risk. They've partnered with quite a few media organizations to spread the workload. Amusingly enough, you could say that Greenwald et al. are doing the OpSec the NSA should have been doing in the first place. :)

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#158

Post by strictnein »

beagle3 wrote: post #154
bigiain wrote: post #85

Earlier quoted context omitted.

Only in a limited way though, the NSA can decide (or at least exert considerable influence over) what's legal in the US - but criminal actions in, say, The Netherlands or any other (non five eyes) country, cannot be "justified" or "excused" legally by another except those countries. I guess a _lot_ of what goes in in state sponsored espionage happens outside the civilian legal system - at least in "major" countries -…

But if you've been following the Firstlook disclosures, and the response to it from different governments, you'll notice that they don't really want to hold anyone accountable - likely, they are all on it some way or another. Ireland rushed to retroactively OK british spying. Germany ignored it (with some theatrical "I'm insulted" remarks from Merkel, but no real action). The assumption that any government out there…

Germany's investigation found that it likely didn't happen and that the documents saying it did were possibly forgeries.

http://mobile.reuters.com/article/idUSKBN0JP1QG20141211?irpc...

> "the document presented in public as proof of an actual tapping of the mobile phone is not an authentic surveillance order by the NSA. It does not come from the NSA database.

> "There is no proof at the moment which could lead to charges that Chancellor Merkel's phone connection data was collected or her calls tapped."

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#159

Post by dTal »

junto wrote: post #135

Since the US and British governments operate on the premise of invading the privacy of all citizens without warrant in order to prevent a handful of bad apples, should other countries consider a temporary blanket ban on all US citizens from visiting to their countries in order to make a point? I know that only 4% of US citizens have passports, and most countries rely on US trade, but still it would certainly send a m…

>I know that only 4% of US citizens have passports

You're off by an order of magnitude. It's actually about 38% [0]. Bear in mind Americans even need a passport to travel to Canada or Mexico now.

I also do not think that preventing Americans from travelling abroad will improve their global perspective.

[0] http://travel.state.gov/content/passports/english/passports/...

Re: The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle

#160

Post by mike_hearn »

beagle3 wrote: post #156
uptown wrote: post #151

Earlier quoted context omitted.

I'd be stunned if they didn't have employees embedded at Google and other major technology firms.

It has been my assumption that Facebook's and Google's core network and security teams are each a large crowd of embedded spies working for various intelligence agencies. Think about it: You're a NSA/Mossad/MI5 NetOps operative. You can have access to a lot of information without risking your life, get paid by your agency AND google/facebook. What's not to like?

Wouldn't work well. Way too many of these companies key employees are not US citizens and many aren't in the USA at all.

Google, for example, has a large security team in Switzerland, with quite a few German and British employees. The NSA sees itself as a military organisation, it is bound by military rules.

Post reply on HN