Hacker News Reader

Comment by natch | Hacker News Reader

One thing that is not talked about enough with NSA is that if they are capable of leaking some of their most sensitive and powerful tools, then they are also capable of leaking the most sensitive and private information they collect on people. Perhaps this has not yet happened, or perhaps it has (someone will no doubt point out any known incidents here if there are any) but the idea is unnerving.

Maybe my wording is not perfect "they are capable of leaking" well you could argue that NSA didn't leak, it was possibly hacked by an outside actor. I don't think the distinction matters much though in this case. The main point is that they can no longer say "trust us" with a straight face.

View on HN

Yes, and the corollary to that any foreign power that wants to spy on Americans need only focus on a single point of failure... our own security apparatus. It would be much more difficult to develop the data collection, storage, and management of that data on their own. We have paid to do it to our selves.

Now maybe there are counter espionage methods developed... but the idea that our geopolitical competitors don't have a single other mole as a contractor with Snowden's level of access is no longer (and frankly never was) credible. You could probably make a similar argument about our advertising apparatus.

Never develop a tool/weapon you can't afford to be used against you, because in the long term it will.

I'm surprised this isn't used in privacy arguments more often. Every time governments and politicians suggest tracking everything we do for our safety with the assurance our data is safe, surely it's prudent to point out that if (arguably) the most secret and advanced cyber command in the world can't keep their weapons and secrets safe, what chance do you have?

"Don't worry. We are taking all precautions. It is 100% safe. Only a very few, select personell will have access to the data."

They will just give the same bullshit answer as always. Sometimes throw in a new phrase ("24/7 guarded datacenter") to pretend they are not vulnerable to obvious risks.

You also forgot the part about how they always say, "Your data is safe, we can't get it without a court/judges approval." Which means from a FISA court. A closed, secret court no one hears about and no one is there to act as your advocate.

This was covered in a recent kaspersky paper[1], which I found in [2], where it is termed "fourth-party collection". The pdf gives a more complete description on page 2 (I found the increasing level of separation between collector and reciever to be almost comical)

[1] https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu...

[2] https://news.ycombinator.com/item?id=15663985

It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization.

We (US, Soviet Union, etc) had this figured out in the 60s when we were primarily using human intel. [1] Except the danger that now, instead of walking out with rolls of film covering a few thousand pages, someone can take everything they have access to in < 24 hours.

My only explanation is all those long-won counter-intelligence lessons were thrown out when the Young Turks showed up with their "we can do it all and more via software" ways. Because they delivered (and you've probably seen this in your org) they were excluded from having all the pain-in-the-ass rules applied to them.

It seems our intelligence agencies now look exactly like our commercial software -- more featureful, more agile, less secure, less stable.

[1] https://en.m.wikipedia.org/wiki/T._A._Robertson https://www.cia.gov/library/center-for-the-study-of-intellig... https://www.salon.com/2015/09/26/how_to_explain_the_kgbs_ama...

To be fair, we were also executing people on the suspicion of treason in the 50s.

I can assure you that 'taking' data off these systems is non-trivial -- Snowden was one of the few people with physical access and admin access. Attempting to access a large amount of info in 24H would also set off alarms. There is also no end to the pain-in-the-ass rules.

But the gist of what you are saying is correct, a lot more interconnection, a lot more software, using standard (albeit locked down) desktop operating systems. I think there was a realisation that the ultra-compartmented sharing-via-paper approach was killing effectiveness.

What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source. All the powerpoints could all be individual data spills, collected over time. All the TAO tooling could be stuff that sat on the dev system behind some bastion host, ready to be pushed to staging servers. Personally, I would only let binaries get that far out, but operational exigencies occur, high side operators can be phished, etc.

Yeah but Snowden had that level of access simply because he applied for the job, with the full intention of using it to do leaking.

That he was selected for this job is a fault of Congress, for imposing caps on government employee numbers (and salaries), but not contractors, during the greatest period of SIGINT expansion in history (also authorised by Congress), and then outsource their vetting to the cheapest bidder. Oh, and have a President that creates a secret law for side stepping the Constitution.

Of course, given a defective Congress, what should the IC have done? Limit their use of computers? Stop sharing information? Encrypt everything on servers and decrypt client side via special hardware? Have someone watch the admins as if they are all wannabe traitors? Disperse honeypot systems and canary docs everywhere? Tripwire the heck out of every system? Fit explosive collars on systems administrators?

Well, all those things and more have now been contemplated. Everything except 'stop collecting'.

He had that access as he had been working for first the CIA, then the NSA, for five years before he decided to become a whistleblower.

If you go read his story in detail you'll see that he held various jobs, but he applied for a transfer to become a sysadmin specifically (a job downgrade) because he was collecting info to leak by that point, and knew he could access more if he had admin privs.q

I have read his story in detail, he hadn't been a systems admin for a few years when he decided to began copying documents. There wasn't a demotion, he had the same title at two departments. And his decision to become a whistleblower came from what he saw at the new department.

> What I haven't seen in any of the SB leaks is evidence of access to core NSA systems via implants or a very trusted source.

I doubt the SB are going to willfully release anything so sensitive in a dump.

Don't expose your methods and procedures, compartmentalize your assets and change your behaviour...

The Q Group will probably be more successful using old-school methodologies.

"It seems like those kinds of more removed scenarios point to a strategic void in compartmentalization."

It's on purpose. After 9/11, the intelligence agencies were lambasted for not sharing information. They were told the next one (a) couldn't happen and (b) would be their fault if it did. Lots of other motivations for the expansion in power, too. One side effect of this was compartmentalization was weakened a lot across the board. Over time, the security strength of things such as cross-domain solutions and endpoints had been dropping. The rush to get everything in that could benefit the mission increased that further.

Yeah, they're probably more vulnerable now than they ever were with more information to take with less chance of detection. Government and private sector. Their people like Roger Schell and Brian Snow warned them for a long time. Private contractors warned them. Those such as Aesec, BAE, and Green Hills even built and paid for evaluations of the kind of tech they said they wanted. They just used it less and less with stuff easy to hack being used more and more. In Snowden's case, the level of security was worse than a lot of enterprises with far less money.

Under what basis do you assert that intelligence in the 60s was done primarily using human intelligence?

The full history of intelligence collection during the Cold War has not yet been fully declassified.

The main point is that they can no longer say "trust us" with a straight face.

If the politics of the last few decades has tried to teach us anything, it's that this is not true. No amount of shaming or obvious shortcomings will ever allow some people to bridge the reality/ideology-gaps in question. You don't see less lying as people are confronted with their lies, you're met with a hurricane of new lies, a Gish Gallop of misinformation, over and over. If all goes truly wrong, then people in power embrace the genuinely Orwellian and start talking about freedom in chains, or peace in war.

Nothing shakes them out of it, and nothing really changes how some people view it. Or at least, nothing so minor as what the future might hold; most people seem to struggle with what's actually happening today, under their noses.

Exfiltration is a problem. It's more difficult to exfil terabytes of individual citizen dossiers than ~2GB of malware, implants, tools, scripts, etc from classified and possibly even SCIF environments.

Or it could be more prosaic than that: Money. The market value of NSA tooling is likely far far higher than the threat assessments of Joe Blow Smith in Hoboken, NJ.

I don't think the concern is Joe Smith. The concern is high level people who can easily be blackmailed. Or even just someone who works in a classified setting. The value of blackmailing a few political elites is extremely powerful and profitable. Or even people in big companies like FAANG.

I don't think any blackmail would be effective at this point. When a man gets accused of molesting a teenager then gets elected to the Senate, I think the potential for blackmail has passed.

Agree, though the only thing that gives me any comfort (and it is the same with google, gmail, facebook, etc) is that the amount of data they collect is nearly impossible to ex filtrate because of its sheer size.

Once upon a time movies were too big to download, and now look.

When was that, 1999? That's nearly 20 years ago.

Bandwidth has been increasing very slowly. And I think we will be stuck at 1gbit for a long time (and in many areas: if we ever reach it), just because there are no consumer use for higher bandwidth. Already 4k video resolution is a stretch, most people wouldn’t notice the difference to 1080p on a TV from they couch.

So there will be a need to upgrade wholesale bandwidth just because the internet keeps growing, people are already talking about next gen game consoles to be cloud based (ie the rendering to be made remotely) which will add more traffic. But not 5 orders of magnitude. The amount of data stored by the gmails and facebooks of this world are mind blowing.

Who says attackers must use home or small office connections? Why can't the data be exfiltrated to a top tier data center with excellent peering?

But consumer/corporate demand for bandwidth is what should ultimately drive increase in data center bandwidth.

Another point is defeating monitoring. I am sure the NSA (or Google/Facebook) could not notice 1GB of upload, but I like to think that uploading 1PB of data would make all sorts of red lights flash in they network security control room.

I'm with you that copying all of Google's data is unlikely. It's a serious project for Google itself to significantly move around its own data internally. My point is that very extensive, damaging information could amount to a mere 100TB subset of it and it's not implausible that could be copied in a day at 10 gig/s. To obvious? How about 100 hosts each pulling 100 meg/s? That's feasible right now. When you really get down to it the datasets I fear being leaked the most are a lot smaller than that.

Most bandwidth is used sending many copies of the same content. Attackers aren't going to be interested in downloading the popular video 100 million times, they're just going to grab the logs which are nowhere near that size, and although large it's not implausible that even the best security teams wouldn't notice until it's too late.

There is no hard rule that the leaks need to come from the same central database either. That is unlikely considering the fact that large scale services are already, and necessarily, distributed. Imagine thousands of attacker hosts receiving from thousands of compromised hosts.

For now!

When storage and network bandwidth increase sufficiently, when we start measuring storage costs in terabytes rather than gigabytes, the sheer size of the data set is no longer going to be a preventative measure against ex filtrating it.

What are the chances that either corporations or 3 letter agencies are going to voluntarily delete their data on you before we reach that point?

And if it can happen to them, how much more likely will it happen to everyone else who has heaps of data about you?

Maybe, maybe not.

NSA hacking tools can't necessarily be kept privately within their network, because they have to be used to attack targets across the Internet -- they have to be deployed.

By comparison, the data that the NSA collects can presumably be sucked into their airgapped network, where data has a way in but no way out.

Data has to be accessable to be of any use.

Has Snowden or any whistleblower given any indication as to whether such networks are air-gapped, accessible from the internet, etc?

It doesnt even have to be leaked when they are sharing raw data with the Israelis, a country just as active in espionage against the US as China or Russia.

Reply on news.ycombinator.com