Maybe it's just my lack of knowledge of some regionalism, but doesn't it seem very odd that a technical person would use "in the open source", to refer not to code, but to a PR article on some news website?
That’s cool and neat for guerrilla warfare, but I would assume the NSA and DoD are already aware of that possibility? I wouldn’t even be surprised if they saw the DDoS happening on network monitoring tools. Why clandestine meetings for that?
I get why the media is interested, it’s an awesome story.
Then they should have caught this when he came forward to multiple agencies, and was told that no one cared.
Please see my related comment as to why I submitted his AMA to HN. It's to bring to light this egregious lapse in US gov procedures:
https://news.ycombinator.com/item?id=40733355
Disclaimer: I do see the possible benefits for citizen liberty, where all agencies do not share every interaction with citizens. However, when a US citizen volunteers something actionable, there should be a special cross-agency path.
There is no lapse, egregious or otherwise. This kid is playing in a game he doesn't fully understand, and likely just annoying people who have been playing the game a lot longer and at a deeper level than he is.
He thinks being able to DDoS chokepoint routers with $5000 worth of VMs to spam traffic is an amazing discovery. It isn't. That's why no one cares.
The first is that it was already obvious to anyone who has worked with large-scale networks even before firing up traceroute. It was already widely known that North Korea has bad peering, because nobody but China wants to peer with them. The US is where most of the major cloud companies are headquartered (i.e. resources can be commandeered), and the defense budget would support an _enormous_ DDoS attack without even flinching.
Secondly, denial of service attacks are worth much less to governments. They have the capability to physically break infrastructure either obviously with bombs or clandestinely via who knows what. They don't _need_ a DDoS to deny service, and it's certainly not their most effective way to cut off communications.
--
[0] - https://irp.fas.org/congress/2005_hr/062105jardines.pdf
back in the day it was just "reading the newspapers and talking to the local cab drivers", but on 2024 you're scanning forums and social media, on top of news sites.
go to a military-related subreddit and start asking questions about stuff, and you'll eventually get an expert to chime in. Make wrong & stupid claims and then have them slap you down and spill some details -- that's how they got dudes to release classified tank info in Warthunder.
dudes in Palestine and in Ukraine are getting killed because they post selfies and tweets that have GPS coordinates in the metadata. Not hidden behind any top secret firewall, easy to find if you're checking VK or Instagram, but very real implications for dropping bombs.
OSINT is also absolutely a thing in Cyber, where you can get a lot of details about a target by reading their press releases -- "Corp X signs big new deal with Oracle" -- which can give you a new attack surface. Phishing, on a long, broad timeline, has a very high success rate, so go onto Linkedin and start connecting to people. Figure out their tech stack, create a Sales Guy account, and start reaching out to Architects and Managers, and then map out the teams that might have elevated access...
First time I see "cyber" used as a noun. Is that short for "cyberspace", i.e. the internet, or is it something else?
To summarize, there are many people in government who are interested in open source intelligence.
Traditional sources of intelligence are gathered with secret means and therefore must be restricted in distribution to prevent burning the source. This means you can have the best possible intelligence but be unable to a) act on it or b) distribute it to people who can.
The value proposition of using open-source intelligence is that you can distribute it very widely to decisionmakers since it's already "out in the open". Intelligence isn't about hoarding secrets for the sake of such; it's about getting information to people who can use it.
The political issue is that people assume that "secret = higher quality" when there's no inherent value to secrecy. So, spy agencies overinvest in secret-gathering, get a ton of info, and are unable to do anything with it.
Meanwhile, if someone posts a tank manual on the WarThunder gaming forums you can give that to every soldier that might encounter that tank.
This is doubly important in tech because many big tech companies play a significant role in national security but cannot get intelligence that would help protect them, and by extension, American interests.
It is a scam. Especially attribution of hacks to states that are on the Washington shit list. There is just no way to know.