Hacker News Reader

Comment by diogenes4 | Hacker News Reader

What evidence do they have?

For something like this - the NSA and FBI have been trying to gain industry trust by releasing these advisories. The NSA at least has publicly admitted to this being one of the big reasons they do so given they've not managed to regain trust post-Snowden.

They have no incentive to lie here.

But see this for what it is: An attempt at gaining trust so more people will voluntarily work with them and give them data.

I do not understand your position. "The trust they gain from making this unsourced claim is a clear benefit, so they have no incentive to lie about it." Wouldn't the gained trust be an incentive?

You could argue if they lied the incentive wouldn't be worth the risk, but proving they lied about this would be difficult and that's a seperate argument from the one you made.

I am arguing the incentive to lie isn't worth the risk in this case.

And they're not likely to give sources because of the whole "protecting sources and methods" bias they have to not reveal how they know what they know.

I'm making an argument about their motive here. The damage they'd face from lying is great (what if another leak comes out? What if a backdoor is found in the patch communicating with NSA infrastructure?) and the possible benefit relatively small.

These people lie professionally. It is their job to conceal and misrepresent their activities. They've lied to everyone already at some point. They certainly lie to people outside the US, they've lied to people in the US, they've lied to their oversight committees in Congress and they've lied to the president. It seems likely they're lying to each other for office politics reasons.

How are they supposed to take damage from lying? They have no credibility to lose. The NSA Wikipedia page takes a while to scroll through and is a saga of backdoors and skullduggery. "Spies lied, news at 11" will read the headline. I'm not saying this specific thing is true or not, what do I know. But if it turned out to be a lie, who could claim to be surprised? It has entered the public record that they developed tech to pretend to be foreigners like the PRC when conducting their cybercrime activities.

They are hurting for talent. Each instance of high-profile bad press makes it harder for them to replace their aging workforce and makes companies more reluctant to give them any data or research assistance. Beyond that, they've had a huge brain drain in recent years with their talent being hired away by the private sector. Which also means you should be wary about who gets hired at Amazon/Google/Microsoft/Apple/Hurricane Electric. Last I heard a supervisor from the NSA who was in charge of some team dedicated to breaking cryptography in the early 2000's had since been hired by Amazon to lead cryptographic implementation at AWS.

Could be fine. Could be beneficial for Amazon's cryptographic security. But I know I'd be worried on what her reaction would be if the NSA came to her privately and asked for her to make a change at AWS that makes it easier for the NSA to exploit.

As for them lying....you have to look at incentives. Spies lie for a reason. They twist words, they lie by omission, they attack peoples' character, they claim their push for changes in the name of public safety is more important than freedoms.

They don't lie just for the sake of lying. Lying is not its own reward.

NSA has both red and blue teams. Work from blue teams helps the public even if they are only known for their red team. Iirc we saw the blue team with S-Boxes in DES, but I may be misremembering things.

Their defensive side has, for many years, been very publicly and vocally sidelined in favor of offense. Defense being given the limelight is relatively new.

You are correct. Hardening the S-Box was the blue team (to protect against differential cryptanalysis). Weakening the key length from 64 to 56 bits by making the MSB of each key byte a checksum, that was the red team.

> NSA worked closely with IBM to strengthen the algorithm against all except brute-force attacks and to strengthen substitution tables, called S-boxes. Conversely, NSA tried to convince IBM to reduce the length of the key from 64 to 48 bits. Ultimately they compromised on a 56-bit key.[13][14]

From wikipedia. Major compromise tbh :unamused:

[13] Thomas R. Johnson (2009-12-18). "American Cryptology during the Cold War, 1945-1989.Book III: Retrenchment and Reform, 1972-1980, page 232" (PDF). National Security Agency. Archived (PDF) from the original on 2015-04-25. Retrieved 2015-07-16 – via National Security Archive FOIA request. This version is differently redacted than the version on the NSA website.

[14] Thomas R. Johnson (2009-12-18). "American Cryptology during the Cold War, 1945-1989.Book III: Retrenchment and Reform, 1972-1980, page 232" (PDF). National Security Agency. Archived (PDF) from the original on 2015-04-25. Retrieved 2015-07-16 – via National Security Archive FOIA request. This version is differently redacted than the version on the NSA website.

yeah post Snowden there are quite bit of big mistrust in NSA type of gov agency. However, what people ought to focus a bit more on are the tel-co companies (AT&T type of companies). They get all your data, call and location via cellular towel triangulation even with internet turned off. As long as you are using a mobile phone they have a lot personal data about you. and they are NOT subject to public scrutiny as NSA type of gov agency. As bad as government agency they are such as NSA, they are still (or need to make an appearance of) being scrutinized by the public. Yeah and as some said there are red/blue teams in the public agency as well, some are still good public servants.

And, MFA wise it is a disaster to rely on them to keep your credentials safe against social engineering.

Why draw a distinction especially given AT&T is practically joined at the hip with the NSA?

If you were actually interested in evidence you'd be able to find it, as I have, in a minute or two of following links. For example:

https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

https://attack.mitre.org/versions/v13/techniques/T1021/004/

> G0098 BlackTech BlackTech has used Putty for remote access.[2]

https://symantec-enterprise-blogs.security.com/blogs/threat-...

> The Threat Hunter Team at Symantec, a division of Broadcom (NASDAQ: AVGO), has uncovered a new espionage campaign carried out by the Palmerworm group (aka BlackTech) involving a brand new suite of custom malware, targeting organizations in Japan, Taiwan, the U.S., and China.

The link at the bottom of the article has a pretty good explanation of how it works and how to mitigate it. What part of it exactly do you need evidence for?

If you don’t believe them, you’re free to ignore the advisory.

Surely you see how evidence is necessary for something to be believed right

It's a warning, you don't even have to believe it to take action.

If someone told me a missile was going to hit my apartment I probably wouldn't believe them, but I might go grab coffee

Foota, a missile is going to hit your apartment.

Really! You can believe me! Unlike the NSA, I have no history of lying to you!

Hope there's a 24-hour Starbucks close by (but not too close).

I can tell you with full sincerity that no missile is going to hit the one of these two places (home and coffee shop) where you won't be at 8PM.

Now maybe I'm with the NSA and I know where you'll be. Maybe I'm just an informant and I know where the NSA thinks you'll be.

What will you do?

That depends on what is being asked of me as a consequence. Read the actual advisory: https://www.cisa.gov/news-events/cybersecurity-advisories/aa...

If I administered commercial routers, the request would seem reasonable to me.

One if by land, two if by sea.

Either way, let's wait for the video, I don't believe Paul that the Brits are here.

Not necessarily. That’s where trust and reputation comes in and in this case I’m willing to believe the agencies.

> Trust and Reputation

> 3 Letter Agencies

Pick one.

The world isn't black or white.

Depending on how we model a system, we don't necessarily need direct evidence in order for indirect events to influence our beliefs (see: abductive reasoning).

Reply on news.ycombinator.com