Hacker News Reader

Hacker News

Comment by codezero | Hacker News Reader

Full thread

codezero

While I wouldn't put it past the NSA – why would we assume the NSA had infiltrated Hacking Team?

View on HN

I think it's a fairly safe bet that they did, and I'll explain why I believe this.

1. The NSA has access to more info on both good crypto and broken crypto

2. Hacking Team's software & infrastructure were clearly vulnerable, otherwise they wouldn't have been hacked

3. Leaked docs show that NSA hacks everyone they possibly can, to get as much information as they possibly can.

It's really not a big leap to assume that NSA infiltrated Hacking Team's infrastructure, if anything I would think it's harder to believe they wouldn't have.

So if some Joe Schmoe broke into Hacking Team's system, I think it's pretty reasonable to assume that NSA did as well

But just so I can understand what you're saying, why do you think it's a big assumption?

Edit: Formating.

Thanks for this, I agree it makes sense that they would have, I was just a bit disappointed that Bruce didn't enumerate any of this in his post. In fairness, all of this stuff is probably "duh" to him, and his normal audience, but it's not so obvious to everyone.

Here's another thought: what if the NSA hacked Hacking Team, and they were also the ones to release all the data publicly.

Re: #3 – do you have any links to that info? (I'm not challenging you to prove what you said, I'm just curious, if you don't have anything readily available, I'll Google search like a good Internet commenter :))

I think it would be hard to go through everything, but off the top of my head:

https://snowdenarchive.cjfe.org/greenstone/collect/snowden1/...

Quote:

       For the past decade, NSA has lead an
       aggressive, multi-pronged effort to break widely
       used Internet encryption technologies

Their Motto:

      "We penetrate targets' defences."

Thanks a bunch.

"We penetrate targets' defences."

That would more likely be a GCHQ or MI5 or MI6 motto than an NSA motto.

A quick bit of Googling finds that the "PTD" in the slides refers to GCHQ's Penetration Targeting Defences unit. So it's their motto. Which explains the spelling.

It is a bit odd that Schneier was stating it as an obvious fact despite no evidence. Of course, the NSA had and has great incentive to compromise them, as well as the ability to do so, but it's still an empty claim (even if it's probably a true one).

Keep in mind also that I think he has access to more documents than we have. He made this statement a while back[1]:

      I am reviewing some of the documents Snowden has
      provided to the Guardian. Because of the delicate
      nature of this, I cannot comment on what I have seen.

[1]http://www.technologyreview.com/news/519336/bruce-schneier-n...

For whatever it's worth: I do not believe --- and this is an opinion I think is shared by lots of people in my field --- that Scheier has any special insight into the software and network exploitation capabilities of NSA. Schneier is a writer first, then a policy guy next, then an academic/standards-group cryptographer. Information security is a huge field with lots of subfields, and nobody specializes in all of them.

My take on this post on his blog is that it's probably a stretch for him to be analyzing the Hacking Team story in any depth.

Didn't Schneier have access to the Snowden docs, though?

It's an assumption to me, simply because there were no facts or evidence presented. This is purely speculation based on what Bruce thinks the NSA might have done. I wouldn't be surprised if it turns out the NSA had breached them prior to this, though.

For probably more than 95% of the Fortune 500, vulnerability intelligence that is years out of date is more than sufficient to own up those firms' entire enterprise networks. The half-life of most software vulnerabilities is long. Simple IT problems like inventory remain unsolved in the real world.

So the same logic suggests that NSA has owned up every company of any real size in the world.

Could NSA do that? Absolutely yes. Did they? I doubt it. I do not see how NSA secures a single extra headcount by illicitly hacking every US and/or European company, and securing additional headcount is literally the core mission of NSA.

I think this discussion could get convoluted really quickly, because I bet 100% of the companies in the Fortune 500 have a different definition of what their "enterprise" network consists of, and how it's organized.

I can say that I used to work for one, and our departments' network was literally air gapped (not joking). Internal systems could not reach out, and no one could reach in. It was impossible for us to work remotely, because even a VPN wasn't set up. There was no physical connectivity.

But there's a difference between Hacking Team and every company on the Fortune 500: Hacking Team was in the Exploit business, they literally made money selling weaponized exploits to US enemies, and possibly allies.

If anything, I think that's literally the NSA's directive in collecting foreign intelligence.

Meaning, I believe if there was one foreign business that the NSA would spy on (and lets face it, I don't know that many), I think Hacking Team would absolutely be at the top of their list, purely for logical reasons.

But.....I also completely admit that my statement was an assumption, a "bet". I'm not guaranteeing anything, and I really don't care. I'm just over here, arm-chair quarterbacking this shit, haha.

I've done in the life immediately previous to my current one a fair bit of enterprise netpen work, and I have never seen a large enterprise network that had anything effectively airgapped. Getting onto a single desktop, in my experience, is virtually a gameover guarantee for any reasonable definition of "gameover".

No data diodes or equipment like that?

> But just so I can understand what you're saying, why do you think it's a big assumption?

Are you serious? Because there's no proof or mention of it anywhere. You're making an assumption based on literally nothing more than "well obviously, based on what I've read on the Internet, they could have done it so they must have". You're bending facts to fit a worldview, something I'm sure you yourself detest elsewhere in life.

This is like Russell's Teapot but for the NSA. You're shifting the burden of proof to someone who now has to prove a negative.

There's no proof or mention that they didn't. There never will be, ever. Yet we have to make decisions, even in the absence of evidence pro or con. Given that they don't disclose "wittingly" what they do, given their mission, and given what appears to be their interpretation of their mission as revealed by Snowden and others, we have to assume the "worst" within the realm of possibility.

They did it, until they show me otherwise.

This is another point: the NSA really wants everyone to think they can, and have penetrated everything. It bolsters their image if people make these assumptions. This is one of the reasons I try not to assume the worst, especially when that's what they want you to do :)

Let's remove the hyperbole and call a spade a spade.

So, you want them to prove a negative? Just trying to be clear.

They haven't even denied breaking into the HT Network. Should they be accused, would they?

I bet a dime-to-a-dollar that should they be accused, they'd release a non-statement to the press:

"We cannot comment on...."

Facebook hadn't denied it either. Perhaps they are to blame.

is it facebook's mission statement to provide foreign intelligence to US agencies?

It's an assumption, but I'm asking why it's a big assumption.

We know that the NSA spied on Google, Yahoo, and Microsoft, and those are our own (US) companies.

Hacking Team produced weaponized exploits/crypto/stuffs and sold it to US enemies and allies.

Having read through the documents, I assert that it's a small/likely/reasonable assumption.

It's literally the NSAs mission statement to defend the US against foreign intelligence.....how is Hacking Team not a perfect example of an appropriate target for them?

Did the NSA spy on google or did they spy on information passing through googles network? How much "interesting" intelligence would likely be found on HT's network?

As for defense, they obviously didnt pass along what they found. If securing US networks was the reason for hacking, they completely failed to accomplish their goal.

I really think that's a distinction without a difference. For all intents and purposes, they spied on google. If you consider the fact that Google considers consumers to be more product than client, the distinction matters even less. But to your other point:

This is the NSA's mission statement:

      The National Security Agency/Central Security Service 
      (NSA/CSS) leads the U.S. Government in cryptology that 
      encompasses both Signals Intelligence (SIGINT) and 
      Information Assurance (IA) products and services, 
      and enables Computer Network Operations (CNO) in order 
      to gain a decision advantage for the Nation and our 
      allies under all circumstances.

And again, considering that HT sold weaponized crypto to non-allied countries, it's by definition "interesting" intelligence (in relation to the NSA).

Also, I'm quite sure that the language in that statement indicates more of an offensive role than defensive, since that's usually what "advantage" signifies.

Even if their purpose was defense, the way our Government is set up, it's defense of the government, not the governed, so you can't say with any confidence that they didn't patch internal systems that mattered to them.

That's an interesting point that the NSA may also be secretly bin patching government systems, but not a theory I've seen expounded much.

Agreed, this article is based on that huge assumption with no evidence provided.

I think a US asset could have been targeted by their software. Or Hacking Team sold to a country with a bad standing in Israel.

Then the software becomes a direct threat to their agents/allies overseas and it needed to be neutralized. That is the kind of competition you do not want as a state actor.

I also think Gamma International was the victim of a foreign intelligence agency. I don't believe the privacy-minded hacker Robin Hood stories anymore.

Reply on news.ycombinator.com