Hacker News Reader

Comment by mdhb | Hacker News Reader

Worth noting that you aren’t ever going to be on the receiving end of NSA malware by accident.

Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.

Also worth noting that if you do happen to find yourself on a targeting list, no one brand of anti virus is going to make even the smallest bit of difference as to what the outcome of that decision was.

This angle you seem to be insinuating that this decision to ban them is somehow because “they are mad” is a child like understanding of the situation and is actively wrong.

View on HN

>Worth noting that you aren’t ever going to be on the receiving end of NSA malware by accident.

Wasn't their plan with stuxnet "spread this as far as we can and eventually it'll hit what we want?"

Ignoring how frequently they will accidentally target the wrong people, that seems like intentionally creating something where there will be accidental victims.

I’ve never once heard this claim before. Where did you get that from? Seems entirely inconsistent with what Stuxnet was which is perhaps the most targeted hack I’m aware of in history. You don’t do that by loudly spraying and praying. Not how any of that works at all.

https://en.wikipedia.org/wiki/Stuxnet

>The worm initially spreads indiscriminately...

And most of the rest of the article. They made a worm that was only supposed to activate in incredibly specific circumstances, but spread indiscriminately to find that specific circumstance.

edit oh, and let's not forget those extremely specific circumstances still seemed to have hit a thousand other targets accidentally, which is the exact thing you said isn't ever going to happen.

I think we are mixing two different things here and it’s worth pulling them apart to make things clearer.

There is an element of you are going after a very specific system or set of systems but they are all air gapped and you need to find a way to get your malware onto those systems somehow.

This part is actually how you describe it more or less. The plan was basically: spread everywhere you can but only do so if you are confident for some reason that you’re on a system belonging to the target country (I.e Iran) and if anyone ever sticks in a USB key to one of those systems you should take that as an opportunity to cross the air gap because people are sloppy and mistakes happen.

So in that sense, yeah it is somewhat true, that’s literally the strategy they used to get where they needed to go. However, the controls they had around it I think were also reasonable. I fully expect the NSA and Mossad (who would later somewhat fuck up the operation) to be doing exactly that and I think it’s consistent with their job.

The second part is the “actually malicious” payload. That had an entirely different set of checks and balances in place to make sure it wasn’t fucking up unreleated systems along the way but just using them as a launch point.

That full context I think still firmly fits my original definition that unless you’re actively on a target list for some reason you have no reason to view NSA malware as something you should have on your threat model. Not sure if you agree or not?

You're ignoring the 1000 systems damaged by stuxnet that had nothing to do with the Iran nuclear program? All of those people would view stuxnet as malware, and would want there AV to target it.

And that's forgetting that no matter how specific the NSA supposedly was, after launching their malware other groups will copy it, so an AV provider will need to view NSA malware as a threat model.

Plus, your original definition assumes the NSA either doesn't make mistakes, or an AV company shouldn't try to clean up their mistakes, both of which are nonsense

I think we are hung up on the term “damaged” here maybe.

1000s of computers did indeed have malware on them. That’s true.

The malware was intentionally designed to do nothing other than trying to cross the airgap to where it was actively trying to go.

This is the entire reason I just explained why when you say “stuxnet infected thousands of machines” that you’re actually talking about a couple of different things here as though they were one.

The nuance in this particular debate matters quite a lot and I don’t think ignoring it for the sake of convenience is helpful.

The Wikipedia article I linked mentions far more computers getting infected, and approximately 1000 systems being damaged. That's in line with what I've read about the program over the past decade, though my thirty seconds of research can't find more evidence.

If it only damaged the one system it was supposed to be targeting, why would we ever have heard of it?

There’s a few reasons but a General from STRATCOM leaked it from memory being a major one and I generally think there was probably a bit of a messaging component going on there where the US wanted to flex both in terms of their capabilities but also as to what they considered to be “norms” in the cyber context.

I.e here is an example of what we consider to be legitimate use to compare and contrast with say North Korea’s Sony hack.

But also it lost a lot of its value as a secret once it was already done.

Although the other points you raise are true - IE if the state sets their sights on you, there's little you can do about it - the idea that you have nothing to fear from rogue malware is shockingly naive.

These rogue pieces of software do occasionally escape their intended target and do measurable damage to infrastructure. Many such cases.

The idea that "I don't need quality antivirus, because I have nothing to fear from such threats" has similar energy to "I don't care about my privacy, I have nothing to hide."

You’ve made a pretty significant change to my argument here.

Malware is a real thing that people need to worry about.

Being targeted by the NSA doesn’t happen by mistake.

As some others have pointed out, there was an incident a few years ago where NSA lost a whole bunch of their malware thanks to I believe again it was a leaker in that case (Joshua Schulte if I remember correctly).

That did in turn end up getting used in a North Korean operation shortly thereafter which by contrast didn’t seem to have good controls in place and absolutely spread like wild fire.

But as far as I know it happened once, was an anomaly and just isn’t a thing that is likely to ever impact you which is why I’m making the argument that what the OP was saying that Kaspersky is the best anti virus just isn’t a good argument and people shouldn’t feel like they are missing out on anything in this instance.

I misunderstood. My mistake.

Let me make another point.

Having access to multiple computer security firms is good, and the services Kaspersky provides do not end with their antivirus software. Security firms regularly publish their work and work with each other.

Perhaps I'm wrong here, but if memory serves, Kaspersky was one of the first firms to detect stuxnet and publish it's structure (I could be wrong here, trust but verify). Using this data, Symantec was able to begin studying the virus as well.

Walling off security research will lead to more parallel research, rather than international collaboration in computer security. Whether or not this is a good or a bad thing is arguable - but I believe international efforts are a net good while the Internet is an international affair.

Who knows, siloing of development might allow creativity and novel solutions in computer security like what happened with the USA/antibiotics and the USSR/phage theory - but I might be coping here.

I hear what you’re saying, I even share a lot of the sentiment but the geopolitical situation had changed significantly in the past decade. I don’t think there is any reversing of this trend anytime soon unfortunately. There is going to be a lot more of this not less in the coming years.

aren’t the NSA documents snowden leaked a complete rebuttal of your comment?

Not at all. I think those docs showed that they have much better capabilities and collection, targeting and delivery platforms than what people had assumed at the time but there was zero evidence that I’m aware of where they were misusing that to go after illegitimate targets. I think the most controversial thing on that front from memory was Angela Merkel and other EU heads of state which inside of an intelligence agency isn’t particularly controversial at all, that’s just doing your job.

I don't think you actually read them.

Well go on… enlighten me.

> but there was zero evidence that I’m aware of where they were misusing that to go after illegitimate targets

How could you claim that without (a) having insider knowledge of the secret activities of the FISA court and (b) violating some sort of legal restriction on publicising your knowledge of said court? One of the major complaints about the US surveillance program (indeed any surveillance program) is almost nobody is allowed to know who the targets are or why.

> I think the most controversial thing on that front from memory was Angela Merkel and other EU heads of state

And I think the most controversial target to date was actually Trump.

Why the hell should the American people trust the TLAs when they regularly lie to congress with impunity? I may be a boring nobody who will never rise to their attention, but what about the next big civil rights leaders and activists? OWS organizers, or anti-war politicians? What of American politicians who dare to go against the grain of neo[conservative/liberals] or even defy the zionist lobby? How can you guarantee none of them will be targeted? You can't, you're full of shit.

I have very different feeling a about the FBI compared to everyone else precisely because their track record has given me reasons to suggest that they have way less oversight than others but the picture is actually pretty nuanced and you’re just throwing out random shit here that there’s nothing really to have a conversation about other than I think you should actively look into the checks and balances in place within the IC because even though HN likes to pretend that it’s totally unaccountable and they will go after anyone that just isn’t true at all.

They all lie to congress with impunity. The courts don't hold them accountable. They think themselves above the executive. They are completely out of control but you seem to think they're all squeaky clean except for the FBI? There is literally zero rational reason to believe that, because there are no effective mechanisms for making them honest.

The CIA once proposed to commit terrorist attacks on American soil to create a justification for war a against Cuba. JFK turned them down but was anybody in the CIA ever punished for it? Hell no, and there is reason enough to think they may have even murdered him for that rejection. Even if you don't believe that, none of them have ever been punished for their abuses and there has never been reform.

First they came for my drug dealer…and I said nothing

Could you please make whatever argument you are trying to make directly because I have no idea what this fortune cookie nonsense is supposed to be saying.

... but when the NSA malware gets out in the wild you might very well be targeted along with millions of others.

Is there a single example of this ever happening that you could point to?

https://en.wikipedia.org/wiki/EternalBlue

Stuxnet alone had several...

WannaCry is famously based on EternalBlue leaked from the NSA. If you don’t follow the highest profile news in this space, you probably shouldn’t make very confident statements on this topic.

I think it’s actually you who is missing context here. We are talking about a single example Of the NSA hitting innocent people on mass and you gave me an example of North Korea in response and are trying to say that because they used an exploit that was originally developed by the NSA that it’s somehow the same thing. It’s not, it’s not even close.

That is not the context at all. I said when an NSA exploit gets out in the wild. Not that NSA would actively target randoms.

What would you have them do in this situation exactly? Do you want them to write a readme guide for North Koreans? Should they never write malware again? Should they send out signatures to AV companies.

Please explain to me what you think should be different.

One final comment from me on this topic to set the record straight, won’t respond further since I don’t sense a good faith discussion here. It rarely is when someone posts like a dozen comments on a single topic.

The thread went like this:

- Someone: Kaspersky is arguably the best at the job, was the only one capable of detecting NSA malware at one point.

- You: NSA never targets anyone they don’t want to target, and antivirus is useless if you are a target.

- Someone: NSA malware also gets leaked into the wild and end up infecting millions.

- You: A single example?

- Me: A single example (that was arguably digital security story of the year at the time).

- You, two comments later: what should NSA do?

They don’t need to do shit. Antivirus companies should up their game. In practice though, word on the street (probably backed up by leaked documents too but I’m not sure) is they — including the targeted software vendors, notably Google and Microsoft — often just greenlight their allies’ operations, and issue a low profile patch when it’s really bad.

But we are just back at the argument of what if I own a gun and keep it locked up but someone breaks my lock and uses it to shoot someone.

To me the only conversation to be had here is were there reasonable protections in place at the time and what is being done to prevent it happening in the future but just due to the fact that this is the NSA those conversations are not going to be public for obvious reasons.

What exactly do you want to see happen here?

I only commented:

> Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.

... unless the exploits leak (after use), which they do.

> Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.

Of course not. Only the criminals are punished. /s

Reply on news.ycombinator.com