Hacker News Reader

Comment by rrggrr | Hacker News Reader

The most likely leaker to Wikileaks? The CIA itself. Its tools already compromised, perhaps by Russia or by someone internal, the sensible thing to do is to leak the exploits in such a way that: (a) they can be patched and rendered largely harmless; (b) the oversight focus is primarily on Wikileaks and not the CIA for losing its jewels. Why would Russia (or any state actor) wikileak these compromises instead of using them against unpatched targets globally? No upside & makes no sense.

View on HN

Cool Tom Clancy premise but the CIA and NSA are looking pretty tarnished with their core data processes leaking publicly. This costs them a ton of political capital. They have channels to give the vendors the exploits in a controlled way - which they would do if they wanted to (and surely have if they think the exploit is too broadly known).

I agree. I say this somewhat regularly, so sorry to repeat it, but --- and I'm not especially well-informed here --- I think the best way to evaluate NSA and CIA motives, at least with respect to infosec, is that their #1 objective isn't geopolitical, but simply headcount. Whatever secures the most budget is going to be at the top of their stack of objectives.

Massive turnover, which is what events like this create, works directly against the goal of securing more headcount: it means they're spending a big chunk of their recruiting energy just retaining the headcount numbers they already have.

I disagree with your premise that headcount is the primary objective, but agree that career progression is the end goal of many, if not most, executives in the IC.

Headcount is one of many metrics that can constitute success and eventual promotion. I posit that giving flashy results to customers is the #1 best way for a particular executive to make a name for herself and advance. FBI is a great example of this, constantly attempting to make splashy headlines; it presses its advantage of being able to go to the press.

I've only seen headcount increase in response to what WH, ODNI, and Congressional intelligence committees view as crises. Headcount shuffles away for objectives that aren't considered sexy, e.g. Russian linguists and analysts in the late 1990s-2000s.

I understand what you're saying but I don't think we have two different interpretations of the same worldview, but that instead we simply disagree. I think budget and headcount are more important objectives to NSA than flashy results. If there's a tradeoff to be made between achieving a flashy objective and securing more budget, I think NSA is likely to pursue the latter, not the former.

To me and for the kind of work I do, this has important implications: it means that you shouldn't do things to make it harder for NSA to do their job (that's just feeding them, just like feeding in DOTA or LOL) --- you have to make things intractable for them.

I know you have worked with former IC cryptographers and developers at Matasano/NCC Group. I still assert that this world view is inaccurate. I respect where you're coming from.

Intelligence agencies are lead by people. Those people have motivations that inform their decision-making. Prestige, power, increased income, and (often, but not always) patriotism are, in my opinion, their primary motivators. This should for the most part be similar for any corporate executive.

Unless there are hard metrics tying headcount to performance reviews and promotion considerations, and simultaneously soft-power incentives for having more headcount, then other things will dominate. In the military, splashy achievements dominate. Or at the minimum, making your boss and your boss's boss like you is essential.

The current NSA chief didn't get his job because he was in charge of the largest Fleet. He got it by networking, seniority, luck, and having a reputation for excellence (I do not know if it is deserved). The same can be said about civilian executives in the IC, who are rated in a more arduous, more holistic manner.

Your bottom line is correct in the specific case. If a Latacora client is targeted by the NSA with high priority, you cannot protect it unless you make it intractable for them. For the rest of us, using boring commodity mitigations, such as TLS and MFA, and sound network architecture are fine. Intractable-for-all is a noble effort, but I don't think it's realistic.

Configured properly, boring TLS can be made effectively intractable. From a cryptographic perspective, I don't think intractable is at all unrealistic --- and I don't know many crypto engineers who think it is.

That's the least interesting part of my comment. Sure, TLS is great. What about the rest?

I don't know how incompatible the rest of it is with things I already said. I would just suggest that the NSA is less motivated by preventing terrorism than it is by protecting and expanding the careers of the NSA rank and file.

>Why would Russia (or any state actor) wikileak these compromises instead of using them against unpatched targets globally? No upside & makes no sense.

Huge flaw in this reasoning- the fuzzbunch stuff was patched before it was leaked. Russia leaking recently-burned tools makes a lot of sense.

It's most probable that Russia (or perhaps other adversarial state actors) would have given all the most sensationalist, newsworthy, and reputation-damaging material to Wikileaks, but kept the really juicy zero day exploits to itself.

If this is true, I expect the CIA and/or other agencies will have gone into defense mode and tipped off the relevant vendors, giving details of vulnerabilities they either know to be leaked or have observed to be used in active attacks.

In doing that, I can't really see the CIA revealing any more than is strictly necessary, and to a very limited set of people. Certainly not dumping a whole load of compromising material to Wikileaks.

Were there really any groundbreaking revelations out of the leak? I didn't think so.

Couldn't it be to their advantage to purposefully leak a bunch of outdated and not-so-special tools (i.e. Notepad++ dll hijack) to misdirect their adversaries as to their real capabilities?

I can't imagine anyone in the CIA authorizing leaking their own tools. It's too outlandish, too career limiting. It would seem to be treason by definition.

"Nobody got fired and jailed for leaking CIA tools." Except, probably, anyone who ever did.

https://en.wikipedia.org/wiki/Limited_hangout

Huh. There's even a term for it.

I would never make it in government.

Wow, this is a seriously interesting perspective. Thanks for your comment. I have often caught myself thinking that Snowden was US-sponsored, but I couldn't put my finger on why the US would do that.

They probably have plenty of the same zero-days and using them would be a waste: once someone knows you're using an exploit it'll get patched.

It makes perfect sense for an adversarial nation's intelligence agency to undermine the CIA and Americans' trust in their own government.

America is too far away from its rivals and enemies for a conventional war to be fought on its own shores. It makes more sense to use fear (9/11) and propaganda (your CIA is spying on you!!) to get Americans at each other's throats and distracted from the real threats to their wellbeing.

After all, our political parties have been doing that for my whole life, so the groundwork laid is practically an invitation.

On one hand, yes, our political divisions no doubt make that kind of information warfare campaign tempting.

On the other hand, it's already pissed us off something fierce, and I think the narrative in the mid-term future will ultimately be one where would-be adversaries decide they don't want to be the next poor soul to be made an example of.

It's been my experience that given the same binary, two researchers will probably find two different vulnerabilities. Given the complexity of these vulnerabilities, I see no reason why any other nation-state hacking service would lose their own, custom-developed exploits.

I agree with your comment in general, except for its confidence in U.S. military capability. Though it would be unlikely for a battle to be waged on U.S. soil, other theaters offer plenty of opportunity for a U.S. loss, especially those that diminish traditional U.S. advantages (such as air and information superiority).

Reply on news.ycombinator.com