Hacker News Reader

Comment by dan1234 | Hacker News Reader

Maybe the higher quality work just hasn't been leaked (yet)?

It's government work. It's probably a lot more fun to work in the private sector, which surely results in some skill discrepancy. It takes a lot of effort to get secret clearances, too. So I'm not sure there is higher quality work, at least in the CIA. All the talented hackers with inclinations to become a blackhat probably want to work for the NSA.

There are aspects of information security that I think the government is behind the private sector on, but there are others where they are way ahead. There are whole classes of technology that are fun to work on for which there is basically no private sector market, because very few companies need those sorts of things, but for which there is a thriving government market.

Certainly. I just meant that the CIA seems less likely to have that than the NSA or the FBI. But admittedly it's an uneducated guess.

Could you expand on why you feel the CIA in particular would have high-quality remote exploitation capabilities? Assume a talented hacker wants to join the government. Why would they choose to work for the CIA and not the NSA or the FBI?

I'm not saying the CIA does second-rate work in general, but perhaps their remote access work is second-rate in comparison to the NSA/FBI and to the very talented echelons of the private sector.

Or the CIA is intentionally leaking obsolete techniques to deflect attention from the good stuff...

Or maybe they really are incompetent. The whole dump reads like a group of sysadmins trying to wrap their head around the basics. Their targets probably don't need anything on the cutting edge either so anything good they can just hold onto until they need to blow it on an Iranian nuclear reactor.

> The whole dump reads like a group of sysadmins trying to wrap their head around the basics.

That was exactly the vibe I got from the leak as well. I don't know why people are going crazy over this, thinking Notepad++ or all Samsung SmartTVs are backdoored.

Who knows, maybe LD_PRELOAD is also an amazing method to hack programs?

There is a case to be made that you only need to be good enough to get in. I myself am not nearly at the level where I could write a hypervisor exploit even though I have been in the industry for a while. However I feel pretty confident in my ability to break into almost any company if I set my mind to it. Fancy exploits are just things that take time to create and if your super great payload gets flagged by fireeye down the line you might have just wasted a ton of time for no other reason than showing off if powershell would suffice. So I guess I am torn on this because I don't want to flame the sysadmin's turned security people for not being a top speaker at blackhat or CCC because I myself come from that background, but on the other hand I think I should expect more quality work out of the CIA than what comes out of infosecinstitute. If this is the average of the CIA I really think NCC group might have more capability than the intelligence agency of the US government which is kind of crazy to think about. I am sure they have some really great zero days that they save for very important projects, but I doubt we will get to see the same level of capability that we saw out of the NSA leaks.

Or leaking the ones they know other nations are using.

Exactly, they could be doing some kind of hacking tools rotation by burning all the ones which are most likely to get patch shortly because they have been reported and thrown in with a mix of obsolete tools which have been already been replaced by more efficient attack vectors and at the same time burning a big bag of tricks for all the other nations already using these vectors or in the process of developping such techniques/tools.

This is a very real possibility. The CIA has admitted to Congress that they have operatives in US magazines, and refused to answer if they have operatives in TV:

https://youtu.be/U1Qt6a-vaNM?t=2h30m35s

That's my point.

apparently, the first leak represents less then one percent of what they have... so they probably didn't leak the most damaging stuff in the first leak.

Reply on news.ycombinator.com