Comment by meowface | Hacker News Reader

Comment by meowface | Hacker News Reader

Parent Full thread

The tooling, while sometimes containing extremely valuable weapons (see: ETERNALBLUE and Shadow Brokers), generally isn't as as much of a public risk as you might think. With the very important exception of leaked zero-days, the leaks of what are probably a significant portion of NSA's and CIA's secret toolkits weren't really a big deal for anyone besides NSA and CIA.

Zero-days and backdoor access points are like turn-key WMDs and the rest are analogous to small pistols and oddly shaped special-purpose wrenches. As long as the zero-days and backdoors stay private, I think there isn't that much concern.

If they don't stay private, then, yeah, it's a severe risk to the world. But those aren't exactly tools; more like privileged knowledge.

You're unlikely to find some super secret intelligence agency hash cracker or DDoS tool that's 100x better than all existing free and paid tools, or something like that. And I think you're probably not going to find a leak that gives you access to a gargantuan government botnet, as you suggest. Even if they're incompetent enough to somehow have that become exposed and accessible by some random internet person, they'd almost certainly shut it down within minutes. Also, odds are such a person could rent a larger botnet through a number of much simple means, anyway.

I don't know how you can cite an example of Eternalblue and in the same sentence dismiss the risk.

https://en.wikipedia.org/wiki/EternalBlue "On May 12, 2017, the worldwide WannaCry ransomware used this exploit to attack unpatched computers.[6][8][9][10][11][12]:1 On June 27, 2017, the exploit was again used to help carry out the 2017 NotPetya cyberattack on more unpatched computers."

In all of my posts I made it very clear that ETERNALBLUE and other leaked zero-days are an extremely serious risk. In each post, I variously described them as "turn-key WMDs", "magic powers bestowed onto ordinary people", and "huge risks", and included zero-days as an important caveat for everything I was trying to say.

I don't at all mean to downplay the severity of the risk of leaked zero-days in the slightest. It's massive. ETERNALBLUE leaking was an unprecedented fuckup, not unlike a government bioweapons facility accidentally leaking a supervirus that causes a pandemic. (Not trying to say anything about COVID, here; just an apt analogy, I think.)

However, I'd also say that zero-days aren't tools or part of tooling. They're discovered vulnerabilities - privileged knowledge, basically. Intelligence agencies possess a lot of privileged information which could be very damaging if leaked.

If a software tool contains an exploit for a zero-day, thus leaking the zero-day, then, yes, the tools themselves are a huge threat.

But I'm thinking more about the typical hacking and engineering tools you'd see, which generally aren't very weaponizable by the general public and not that interesting besides the purpose of potentially detecting their past usage and discovering things an intelligence agency might have done. That's why I said "as long as the zero-days and backdoors stay private, I think there isn't that much concern".

I interpreted the poster as being concerned about the more ordinary things (they mentioned password cracking and botnets, for example), though I think I misunderstood them.

Ok, I am not firm with any actual hacker tool. But I do know about software design in general.

So I can imagine, that a very well designed, modular hacker weapon by the NSA is something they value and want to keep for themself.

0-days come and go. This is a seperate issue.

But having the whole world know how your tools run? Sounds like a nightmare. Because that allows for detection.

PLus the fact, script kiddies eventually will get their hands on it.

100%. That's what I alluded to with:

>weren't really a big deal for anyone besides NSA and CIA.

It's an absolute nightmare if you're NSA or CIA. You're going to have to remake everything from scratch, pretty much. It'll be very tedious and will probably result in a lot of downtime and delays of other projects.

It's like when that stealth Black Hawk crash-landed on Osama bin Laden's compound. (Though that was probably a lot more annoying and difficult to re-engineer than software.)

I was just thinking about it in terms of a common media scaremonger narrative of them possessing tools that if leaked can in some way bestow magic powers or other unnatural abilities onto ordinary people. And that kind of is the case for major zero-days like ETERNALBLUE, but for general software tools, it's a total red herring.

I don't think this addresses my question, which whether there's anything that inherently makes "state actors" effective hackers than criminals or amateurs.

Maybe I misunderstood your original post. I thought you were asking about the risks of regular people being able to gain NSA-like abilities if NSA tools manage to fall into their hands. I think that's not a huge risk, beyond zero-days.

However, yes, a very dedicated, very smart group of blackhat hackers could probably achieve somewhat similar things as an intelligence agency's hacking division. You don't necessarily have to be a government to be an APT.

There are still other advantages, though. For one, at NSA, you can do anything you want with legal impunity, while a blackhat might be imprisoned for doing the exact same thing. Also, you have access to a huge organization and various things they've already embedded themselves into, like backdoors and internet traffic taps.

So, they do have an inherent advantage, even if the people involved aren't necessarily inherently better hackers. (Though they may be, if they're better at hiring than you are at recruiting for your private organization.) Given enough time and effort, a private group could maybe also embed themselves in a lot of places, but they're all at the mercy of their governments and allied governments, and may constantly risk arrest.

In terms of this particular incident, I believe it absolutely could be either a government or a private whitehat/greyhat/blackhat individual or group.

The closest we got to an answer about who perpetrated these hacks was a quote in the article:

> Only intelligence services or people who know where the servers are located can pull off things like that.

I don't really know how the quotee would arrive at that conclusion, but I do agree the seemingly systemic nature of these hacks, e.g. "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding.

That said, groups of people do seemingly weird things all the time, so I dunno if it's anything other than a gentle nudge in a direction. Hardly a smoking gun.

Additionally, I've always heard the sophistication levels of hacking groups go (from least to most): activists -> criminals -> state groups. I don't know if that's changed in some recent years, but that's how I learned it.

> "Let's hit the popular dark web forums." isn't usually how criminals operate, based on my limited understanding.

Indeed. Most cybercrime, like most crime in general, is primarily interested in just making money as effectively, efficiently, and safely as possible. No point stirring up a bunch of big hornet's nests when you don't need to.

Whatever it is, it's definitely not ordinary activity. Non-exhaustive list of some possibilities I'd imagine:

- Blackhats who are part of that sphere with a chip on their shoulder

- Blackhats trying to start, promote, or perhaps (false-flag style) direct suspicion towards a competing forum or other platform

- Whitehats / greyhats who just don't like fraudsters and thieves and want to fuck with them and give them a taste of their own medicine

- Intelligence agencies / law enforcement

Reply on news.ycombinator.com