Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 106 posts

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#21

Post by LinuxBender »

Aaronstotle wrote: post #16

I find it ironic that the CIA didn't bother to have it's systems secured/verified by the NSA. I'm sure the CIA thought that they were good enough, coming from an organization that was infiltrated from its inception, their hubris isn't surprising.

My limited understanding is that these orgs compete with each other for budget allocation and would never allow access into each others systems, but I could be wrong.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#22

Post by jokoon »

Unless you make engineers and entire companies focus on security through proper designs and standards, nothing will be secure. Most software is unsecure because geopolitically, the countries who make software are also the one who are able to penetrate those systems better than the rest of the world.

No government will push to improve door locks unless that government isn't the most capable of defeating those locks. It's a cost/benefit function.

Right now, improving software security is a net loss for the US. So it won't happen when the US is controlling the computer and software industry.

So I'm not surprised to see even the best experts being beaten so easily.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#24

Post by cybervasi »

Guarding information and guarding physical assets have one thing in common. It is largely a passive exercise in waiting for something to happen. For this reason it is very boring and unreliable. The only way to improve the situation is to have active and random drills when someone attempts to steal the assets. This would make the work of the Blue team a lot more rewarding rather than just be relegated to mindless blocking access to anything and everything.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#25

Post by mindslight »

olivierduval wrote: post #7
AnHonestComment wrote: post #5

Earlier quoted context omitted.

What would be a less gimmicky setup?

Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the…

It's inherent to the field. A successful blue team is a distributed win - every line of code did what it was supposed to do. A successful red team is a concentrated win, for the people who found the few lines of code that did something else. The job of a red team is to make things interesting. The job of a blue team is to keep things boring.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#26

Post by birdyrooster »

DaiPlusPlus wrote: post #13
willcipriano wrote: post #9

Earlier quoted context omitted.

That's good. Perhaps something like if they can attribute the attack to a particular machine the red team gets "arrested".

Do the feds still attend DC? >:}

No and they don’t come because hackers asked them not to. >:/

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#27

Post by count »

olivierduval wrote: post #15
LinuxBender wrote: post #10

Earlier quoted context omitted.

Let the non-red teams use pre-existing scripts, code, etc, to harden things. This of course would make the competition a level playing field and would make it much less fun for the red team. Attendance would drop off quickly and companies would no longer sponsor these events, as the primary purpose is to recruit people out of college.

Actually, this could be made like "CS:GO" competition: - RT is the terro - BT is the AT The RT has to "plant" an exploit. The BT can either block/track the RT or "diffuse" (find/disable) the exploit. The "maps" would be the kind of system: - an AD behind a firewall - a WebServer with datas to extract from a backend DB - and so... The sponsors could sell either the skills of their pen-testers to hire, or their solutio…

I can't tell if you're being facetious, but you just invented 'capture the flag' competitions.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#28

Post by saagarjha »

dijit wrote: post #18

Words can't describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless. Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn't be updated!) Exploit development is a gla…

> Exploit tools are require local systems to be super open in order to be frictionless.

Yes, but your "local system" that receives traffic or whatever doesn't need to be the one having access to all your data…

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#29

Post by close04 »

olivierduval wrote: post #7
AnHonestComment wrote: post #5

Earlier quoted context omitted.

What would be a less gimmicky setup?

Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the…

That's true but only because it mimics real life. The defenders are always at a disadvantage here, they have the boring job but one where one mistake is one too many. And they have to achieve that perfect score while operating within the rules.

On the other side the attackers have the more exciting job and only need one success which they can achieve by using whatever means they see fit.

You'll see this outside of IT just as well, like in sports. Goalkeepers (defenders) vs. strikers come to mind but at least there they all operate within the same set of rules.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#30

Post by dijit »

saagarjha wrote: post #28
dijit wrote: post #18

Words can't describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless. Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn't be updated!) Exploit development is a gla…

> Exploit tools are require local systems to be super open in order to be frictionless. Yes, but your "local system" that receives traffic or whatever doesn't need to be the one having access to all your data…

That means that your software can never actually be deployed anywhere.

Once deployed your self-produced tools which have very little security protection themselves can be pilfered. Bonus points for tapping into the software deployment platform and downloading everything.

Post reply on HN