Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Knock Knock Who's There? – An NSA VM

reverse.put.as

Post reply on HN
Print view View original

41–46 of 46 posts

Re: Knock Knock Who's There? – An NSA VM

#41

Post by hnthrowaway0315 »

aborsy wrote: post #2

It seems most vulnerabilities published by shadow brokers are on Windows. What percentage of vulnerabilities are focused on Linux or macOS? What can ordinary users do to protect themselves other than patching?

I don't really think ordinary people (and rich people TBF) can completely defend themselves against any state player.

Anonymous guides I read mostly recommend Tor, anonymous sim card and purchasing electronics with cash. But I don't think it's going to render any state player's work impossible. I mean if they are really onto you.

On the other side, three char agencies cannot waste resources on every individual, so the best way is to stay out of the radar.

Re: Knock Knock Who's There? – An NSA VM

#42

Post by hnthrowaway0315 »

aborsy wrote: post #21
beermonster wrote: post #9

Earlier quoted context omitted.

From the article: “.. a port knocking backdoor with multiple targets such as Solaris, Linux, FreeBSD, HP-UX, JunOS, OS X” So this was far more reaching than Windows. To answer what ordinary users can do: Against a well funded adversary hell bent on getting access to your systems/data - probably not a lot! In the case of NSO group even a fully patched iPhone wasn’t going to help you. However, on reading this article m…

The NSO could get root on anyone’s device knowing only the phone number. If NSO does it, so could the intelligence agencies of dozens of countries. Looks like a hopeless situation, where a small percentage of population have access to anyone’s data (but not conversely). This is posing a threat to the democratic society. There ought to be a way to make a secure device.

I think one way to add the difficulty is to conduct everything offline. Since they don't have a full profile for you online, they have to mobilize field teams which are scarce and expensive. On the other hand, if they can sniff you online, it's going to be automated and almost free.

But again, maintaining an offline life could be very tricky given that the society as a whole is moving everything online. For example, if you earn salaries like me, there is no way to avoid a bank account and a mobile number.

Re: Knock Knock Who's There? – An NSA VM

#43

Post by genewitch »

3np wrote: post #17
CaptainJustin wrote: post #4

Earlier quoted context omitted.

In this spirit I've been playing with spun up Firefox instances in a Google Cloud Run. The container is stateless and goes away after I close the page that connects to video stream of the other container in my browser.

Do you find the performance satisfactory enough for daily browsing?

Way back in 2009 I helped design and implement basically "Firefox on AWS EC2" - I had YouTube audio and "video" working, in the subwindow, not Fullscreen. It was roughly 5-10FPS, about what you'd get with VNC, with perfect audio.

I had an idea that thin clients were going to be big - and I stupidly pitched ideas for cloud based software to Adobe, Newtek, and Autodesk.

Never gunna do that again.

Re: Knock Knock Who's There? – An NSA VM

#44

Post by _8j50 »

7647538jddh wrote: post #37
_8j50 wrote: post #10

Earlier quoted context omitted.

Live implants, means if they published you or I can access the implants and therefore the victims' systems.

But the victims have already been compromised by one of the most malicious organizations on the planet. Being further compromised would probably be more likely to help than hurt, as it would make it more likely that whatever the NSA is doing is discovered or disrupted.

So you notify the victims so they can do something about it. I mean you yourself just said how sophisticated the threat was, shouldn't they know an implant accessed sensitive data and may have tampered with the integrity if data as well? Cutting off access is just containment, not eradication. Any operator worth his salt would have multiple ways back in for when the primary implant is burned. A proper incident response involves the consent and participation if the victim,the implant/malware is not the problem, what was and might be done using it is.

Re: Knock Knock Who's There? – An NSA VM

#45

Post by justin66 »

anamax wrote: post #39
taway9001 wrote: post #38

Earlier quoted context omitted.

The nature of "anyone finds out" is relative to departmental corruption, yes. But that doesn't change the actual rules. And it should be noted that most people's understanding of law enforcement procedure comes from tv fiction or the news. The unreliability of the former should be obvious, and the latter.. well the only things that make the news are things that are newsworthy and out of the ordinary. Which is probabl…

The point of mentioning the court case is that case and statutory law are NOT a slam dunk for "LEOs are required to act." in even cases where "the rest of us" would expect. The last I heard, the LEOs in that case were prevailing....

The case of NYPD cops hiding from a guy on a slashing spree [0] kind of comes to mind.

[0] https://en.wikipedia.org/wiki/Maksim_Gelman_stabbing_spree

Re: Knock Knock Who's There? – An NSA VM

#46

Post by bobbob1921 »

aeyes wrote: post #7
aborsy wrote: post #2

It seems most vulnerabilities published by shadow brokers are on Windows. What percentage of vulnerabilities are focused on Linux or macOS? What can ordinary users do to protect themselves other than patching?

Most ordinary users will connect to the internet using a router provided by their ISP so port knocking does not work. Unless they plant the malicious code on the router - that would be even harder to detect.

This is correct, almost all user side traffic is nat’d (masquerade/Src-nat) thus port knocking nor any ports externally being open, does not apply.

(NAT , in general, = how the multiple devices at your home all share a single public IP address from your ISP)

This article mainly addresses servers / public facing services (which do not make use of nat)

Post reply on HN