Hacker News Reader

Comment by burrows | Hacker News Reader

Only works if the 411 call was MiTMd.

edit

I was confused and my reply is confusing. I was trying to say that a third party could have stolen the source code by MiTMing the 411 call.

View on HN

Why? OP got instructions on how to get to Dave's house and there were several steps involved. Somewhere in Bethesta base there may be an NSA staff member sitting there who receives the call from OP and routes it accordingly. No hacking of any kind is required, just a functioning chain of command.

I meant perhaps NSA agents are trained in social engineering too. Or it may not have been the NSA, but FBI or CIA or even Military Intelligence too, pretending to be NSA.

Are you being naive on purpose, friend?

Looks like I missed something ... ? What's the context in which you think so?

If we are to trust anything on the web, then social engineering is a basic part of NSA education.

Well, you are saying so on the web - so it must be true! ;)

You think the NSA impersonated themselves?

I meant it may have been a real NSA agent, acting on actual orders, but that he may have lied to get access to source code. If so he wouldn't need to do any MitM attack.

The NSA agent's goal was to get the source code, but he lied about why he wanted it. Fair enough.

Or if someone who worked for 411 or a hacker changed the number for the naval base to be one they controlled. Dave could be the CEO of 411 for all I know.

> Or if someone who worked for 411 or a hacker changed the number for the naval base to be one they controlled. Dave could be the CEO of 411 for all I know.

Agreed. A couple of ideas for better authenticating the NSA boogeyman.

1. Verify the number in a phone book.

2. Call a friend and ask them to follow the 411 protocol.

3. Drive to a hotel in a different state then follow the 411 protocol.

4. Overnight a cell phone to the NSA headquarters and wait for Dave to call you from it.

5. Call the FBI and ask them for the NSA number.

6. It's Connecticut not Montana, an FBI agent should be available to confirm in person this is a real request.

Also wonder if the correct number to dial would have been 301-555-1212 as that's directory assistance in Bethesda rather than local directory assistance.

it doesn't need to be a MITM.

He was called in a land line. The caller could just have pretended to hangout and faked tones when the author called back.

I'm not saying that is what happened, but it's way easier than a real 411 MITM.

This doesn't explain getting a fake NSA number from 411.

Reply on news.ycombinator.com