Hacker News Reader

Comment by eatbitseveryday | Hacker News Reader

I wish articles like this would divulge some details of the technical side of hacking, rather than keep it a mystical field of study.

What did they hack and how did they “get in”?

Contrary to the title, there is little “how” and mostly “what”.

View on HN

Funny, I had the exact opposite reaction. Part of me wishes we divulged less about our tactics.

Our? Were you involved in the operation?

"Our", as in, "our government" or "our military". Is that not obvious?

Assuming you're an American, you eventually have a civic duty to find out what they did so you can evaluate them. You can't wait forever, because once everyone involved has moved on far enough with their careers (or retired) it won't be possible for your evaluation to have any impact. Declassification has to happen at a reasonable speed in order for our system to work.

Although I don't know, I think this story was released for exactly that purpose, to improve public support for the NSA and Cyber Command. With Snowden being in the news lately I'm sure they're looking for opportunities to run cool war stories to balance out their image.

At the same time, if you're smart you'll notice the propaganda pieces circulated by AP on-behalf of USA.

One of them is Twitter. "identified accounts" but they aren't shut down or shunted. Why's that?

Simple - once you identify a target and they're vocalizing their thoughts, why do you want to limit and censor them? allow them to post, collect metadata and help it tie together other pieces of the puzzle.Browser ident, time, date, time of access, ip address, etc.

Meanwhile you'll see in the article a different reason as to inaction.

They basically summed it up "Hack the human first".

Though the article does not outright say it, read between the lines when you see this:

> They even had file sharing through them. "If we could take those over," Neal said, grinning, "we were going to win everything."

Then see some public CVE's around that time, such as:

> CVE-2015-5474: BitTorrent and uTorrent allow remote attackers to inject command line parameters and execute arbitrary commands via a crafted URL using the (1) bittorrent or (2) magnet protocol.

> Project Zero 2018: Simply put, those JSON-RPC issues create a vulnerability in the desktop and web-based uTorrent clients, which both use a web interface to display website content. An attacker behind a rogue website, Ormandy said, can exploit this client-side flaw by hiding commands inside web pages that interact with uTorrent’s RPC servers. Those commands range from downloading malware into the targeted PC’s startup folder or gaining access to user’s download activity information.

And the remote code execution via media files / video virus (Hollywood movies, porn) https://www.cvedetails.com/vulnerability-list/vendor_id-5842... .

So you have file sharing going on, and can remote code execute, if: you get the target to visit a website you (partly) control, you get the target to click a (.torrent) link you crafted, you get the target to download a manipulated video file, compromised (Adobe) software, or cracked game with the payload. These if's are for a military that can easily DNS hijack, spoof (update) certs, ask help from allies who control 25% of all internet advertisements, set up convincing websites targeted to the region, or reroute internet traffic.

While I share your same streak of curiosity, unfortunately this is an area of life that opening up details of your own operations is probably most likely always a net negative.

Get a TS/SCI and go work for CyberCommand if you want to be in the know.

That is a valid argument, but can be applied to any hush hush effort. But such "limited visibility" organizations often push to limit public control, after which their mission or methods may morph to support internal goals that may not be shared by the general public they were created to serve.

It would be naive to require that all government information is shared with the public, but we should maintain robust oversight on all clandestine activities and give that oversight teeth to correct problems when such activities to too far. My 2c.

US citizens would be better served by having more oversight and transparency into the lobbying efforts of the NRA and health insurance companies, among others. The civil servants at the NSA have far more in common with 'the public' than any executive at a company that can afford to lobby Congress.

Totally agree. Follow the money will never be un-true.

That information will probably not be revealed. What would be the incentive for the US to do so? Zero. But the incentive of spinning the narrative and keeping the details murky provides a much higher payoff.

> I wish articles like this would divulge some details of the technical side of hacking, rather than keep it a mystical field of study.

Why would you publicly inform your enemy of a vulnerability?

I listened to the report on this article on my way to work. I had the exact same thought as you. I was annoyed that they kept it so general, but it makes sense from the perspective of keeping the target in the dark on the methods used.

I will add, I've undergone various security-focused corporate trainings over the years, once our trainer was a retired Airman, formerly attached to the NSA.

Had had one and exactly one story he was allowed to share with us, and that was incredibly vague like the article. "We infected the target's mother's PC, when the target was fixing the machine we had an asset fake a crisis prompting the target to (stupidly) access a target machine from the mother's infected PC." As he explained, this was all he was authorized to share. The reality is there is very little they can share without prior clearance from the agency, and this is a non-trivial process.

Is that not a double edged sword though? When you reveal sources and methods, you tell ISIS what to do differently. These sorts of things tend to be some of the most closely guarded secrets in the US.

Disclaimer: I had a security clearance when I was in the Army.

I was under the impression that a large portion of it was just google mobilizing their mass manipulation machine for what they decided was the greater good.

It’s not a “mystical field of study”, it’s called cybersecurity and you learn it the way you learn anything else, take books or take a course. Learn about networking, learn about malware, learn about social engineering, do you even know what a reverse shell is? Just learn.

Reply on news.ycombinator.com