Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#81

Post by sgift »

culturestate wrote: post #67
jcims wrote: post #56

Earlier quoted context omitted.

I've been in infosec since the 90's. A lot of times I think this is on us. As much as I respect the technical acumen and creativity of my colleagues in the industry, I don't think we broadly understand risk that well and as a consequence we do a pretty bad job of communicating it. We tend to peg the panic meter with multiplied likelihoods and catastrophized impacts of possible scenarios while directly causing revenue…

> As much as I respect the technical acumen and creativity of my colleagues in the industry...we do a pretty bad job of communicating it. This is the root of so many problems for technical teams in ostensibly non-technical businesses. More developers and engineers really need to embrace the reality that your work doesn't always speak for itself - sometimes you have to speak convincingly on its behalf.

Or you wait until it explodes and then get the money either way. Plus, you don't have to bother with people who do not want to understand, which is the second problem commonly faced by technical teams. I've seen more than enough technical people doing anything they could to make people understand, but at the end of the day Sinclairs adage about people not understanding something if their income depends on not understanding it holds true.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#82

Post by [deleted] »

olivierduval wrote: post #7
AnHonestComment wrote: post #5

Earlier quoted context omitted.

What would be a less gimmicky setup?

Allowing Blue Team to fight back maybe? Or to be able to actively track the red team instead, using an active defense, instead of only passive defense? Moreover, the outcomes are different for both teams: - RedTeam success => they are seen as "real" hackers/heros and the BlueTeam are the poor incompetent - RedTeam fail => the BlueTeam did "only" its job, the investments in cybersec for the company paid off... so the…

[deleted]

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#83

Post by culturestate »

sgift wrote: post #81
culturestate wrote: post #67

Earlier quoted context omitted.

> As much as I respect the technical acumen and creativity of my colleagues in the industry...we do a pretty bad job of communicating it. This is the root of so many problems for technical teams in ostensibly non-technical businesses. More developers and engineers really need to embrace the reality that your work doesn't always speak for itself - sometimes you have to speak convincingly on its behalf.

Or you wait until it explodes and then get the money either way. Plus, you don't have to bother with people who do not want to understand, which is the second problem commonly faced by technical teams. I've seen more than enough technical people doing anything they could to make people understand, but at the end of the day Sinclairs adage about people not understanding something if their income depends on not underst…

It's not always about understanding, sometimes it's just about making them believe you. The relationship between business and tech doesn't have to be adversarial - learning how to get yourself a seat at the table and what to say once you get there can be a quality of life improvement across the board.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#84

Post by dijit »

FDSGSG wrote: post #52
dijit wrote: post #20

Earlier quoted context omitted.

I'm trying to find a citation here, but it's difficult because "Backtrack 2 ssh exploit defcon" is going to produce a lot of content which is unrelated. Anyway I can give you the skinny of the situation: 1) Backtrack 2 did not have an installer, it was a live-CD. But that doesn't stop you installing it by just copying the live environment to a disk (with some mount-binding and grub install, you're all good!) There we…

>4) someone at defcon unveilled an sshd exploit, a pretty nasty one, they had disclosed responsibly and everyone had been patched for at least 6 months, except the people who went against recommendations and installed backtrack2. They all got rooted. Yeah, I don't think this happened. Nobody has publicly exploited an opensshd rce for ages.

It may have been the kernel; frankly I'm fuzzy on the details I just remember the staunch warnings and feeling vindicated.

This was like 2007-8.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#85

Post by OliverJones »

OliverJones wrote: post #35

How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed? To misquote Dr. Strangelove, "ze whole point of ze secret hack is lost if you don't keep it a secret." https://youtu.be/2yfXgu37iyI?t=205 Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online. Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe. A…

You'd think at least some of these inept cyberspooks would have read Neal Stephenson's Cryptonomicon. Or Brian Krebs. Or Bruce Schneier.

Or even the news story of how their old boss(!) John Brennan had his AOL(!) email account(!) cracked(!) by a teenager(!) guessing his password(!). The teenager exfiltrated something sensitive, a job application I believe, and was prosecuted for it. Meantimes, the former Director of Central Intelligence gets to keep his reputation.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#86

Post by alwayseasy »

0xy wrote: post #74
alwayseasy wrote: post #70

Earlier quoted context omitted.

There has been direct testimony from intelligence officials and thousands of pages of reports including very technical details. Do you want server logs, intercepts, confessions? All these provide nothing of value to the general public. When intelligence agencies share clear evidence a dictator gassed his own civilian population, no one cares or trolls ask for more evidence.

>When intelligence agencies share clear evidence a dictator gassed his own civilian population Funnily enough, there's no clear evidence of this. According to OPCW leaked documents there's a higher probability the gas was manually placed at the site. [1] Which of course, calls into question the Syrian government's involvement, especially given earlier intelligence showing ISIS had possession of such chemical weapons.…

You're asking for clear evidence but then using an op-ed from a known controversial journalist on Syria, sharing a Wikileaks leak after the GRU was caught hacking the OPCW ?

Clear evidence you can't fake: a rush of hundreds of people (including children) to the different hospitals near the Khan Sheikhoun site while all showing the same respiratory and neurological symptoms. How can one fool so many doctors?

Here's a breakdown of the exact, and single email/document used to "discredit" all chemical attacks perpetrated by Al-Assad on his population https://www.bellingcat.com/news/2019/11/25/emails-and-readin...

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#87

Post by OliverJones »

j88439h84 wrote: post #51
OliverJones wrote: post #35

How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed? To misquote Dr. Strangelove, "ze whole point of ze secret hack is lost if you don't keep it a secret." https://youtu.be/2yfXgu37iyI?t=205 Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online. Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe. A…

What are the tools to help orgs notice exfiltration?

Firewall alerts about large outbound data flows.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#88

Post by alwayseasy »

0xy wrote: post #72
alwayseasy wrote: post #70

Earlier quoted context omitted.

There has been direct testimony from intelligence officials and thousands of pages of reports including very technical details. Do you want server logs, intercepts, confessions? All these provide nothing of value to the general public. When intelligence agencies share clear evidence a dictator gassed his own civilian population, no one cares or trolls ask for more evidence.

All of that was based on the opinion of a private organization. No intelligence official ever had possession of the server or was involved at any time.

Russia did not limit it's election interference to hacking one single server. This is actually very straightforward.

Here are more details and evidence if you are sincere and want to dig deeper: https://www.intelligence.senate.gov/sites/default/files/docu...

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#89

Post by chiefalchemist »

boomboomsubban wrote: post #76
chiefalchemist wrote: post #40

Earlier quoted context omitted.

Absolutely. So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Put another way: perhaps it's not an accident? And perhaps some of what was leaked was a decoy? Yes, keeping secrets is difficult. All the more reason to take advantage of that.

>So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Like leaving data of their secret assets available on Google searches, leading to hundreds of deaths? And firing the employee who warned then of the problem seven years before it was exploited?

I would suggest you research a bit on how intelligent and counter-intelligence actually works; not the Hollywood version.

Re: CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

#90

Post by boomboomsubban »

chiefalchemist wrote: post #89
boomboomsubban wrote: post #76

Earlier quoted context omitted.

>So now let's consider the source, the role that three letter acronym fulfills, and the strategies and tactics it's know to use. Like leaving data of their secret assets available on Google searches, leading to hundreds of deaths? And firing the employee who warned then of the problem seven years before it was exploited?

I would suggest you research a bit on how intelligent and counter-intelligence actually works; not the Hollywood version.

I have, I was describing the CIA's recent history. Thinking CIA incompetence is some classic subterfuge is more of a Hollywood plot.

https://finance.yahoo.com/news/cias-communications-suffered-...

Post reply on HN