Hacker News Reader

Comment by kjackson2012 | Hacker News Reader

kjackson2012

It seems ridiculous that an "intelligence" organization would upload files to a server that identified themselves so blatantly like that. Could it be that it is some ruse of some sort? I don't doubt that someone broke in, but would it really be CSIS?

View on HN

An actual exploit like this designed to monitor the hacked computer would likely either talk to a small range of IPs in the infiltrating organization, or a widely scattered botnet.

Trying to contact a small variety of servers of various disparate government agencies seems more like an attempt to generate false evidence that the victim is actually a dangerous hacker.

Or at least that's what Stephenson, Doctorow, and Gibson have trained me to think.

CSIS aren't the most competent intelligence organization in the world.

For the limited scope of the work that they do (which is essentially limited to what the NSA does in the US. They don't really do what the CIA does), and with a relatively small $600 million dollar public budget, they're known to be quite competent.

This story sounds...weird. I doubt it is quite as he suspects it is.

>which is essentially limited to what the NSA does in the US.

The NSA doesn't do field intelligence work, AFAIK, unlike CSIS.

>This story sounds...weird. I doubt it is quite as he suspects it is.

It's weird, but I'm not sure who else other than CSIS would have the motivation to hack an activists computer so it sends data to CSIS-affiliated servers.

The author said "Hostnames that appear to belong to CSIS.". Reverse DNS should not be trusted. Saying that a hostname "appears to belong" to someone is a naive statement.

Indeed, spoofing reverse DNS is not hard -- and spoofing reverse DNS to appear like an intelligence agency is straight out of every 1990s IRC script kiddie's cookbook.

I think you've got it mixed up: CSIS [0] is the Canadian CIA, having been created in the wake of shutting down Department D of the RCMP after one too many scandals in the 1970s. The Canadian NSA is the CSE [1].

[0] http://en.wikipedia.org/wiki/Canadian_Security_Intelligence_...

[1] http://en.wikipedia.org/wiki/Communications_Security_Establi...

CSEC, now. I'm thinking of interning there in the summer.

You aren't now.

I happen to know that upon applying you are directly told not to tell anyone you applied, or even that you were thinking of applying.

No, only thinking of it.

Then you aren't anymore.

Which one is? I put the Mosad up there, but most are summed up by the statement: Reward for failure. Screw up, get given a bigger budget so it doesn't happen again.

Even high-profile organizations have a spectrum of competence within their offices.

Don't assume they act intelligently, just because they have "intelligence" in the name. Many people who make the decisions aren't IT experts at all.

I was thinking it was a false-flag scenario as well. Other than the network identifiers, there's nothing to say it was the Canadians behind it.

Reply on news.ycombinator.com