Hacker News Reader

Comment by asveikau | Hacker News Reader

More of this Hollywood movie plot version of network security:

> The analyst can then decide what he wants to do - the computer of the target person does not belong to them anymore, it then more or less belongs to the U.S. government.

This is kind of like when he said:

> You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine.

Software types reading this stuff know that this is not how computer networks generally work. Maybe it is a dumbed-down reference to some sort of government malware. If so I would like to see more technical precision from Snowden before I can say that he has any chance of knowing what he's talking about.

View on HN

>Maybe it is a dumbed-down reference to some sort of government malware.

That's what I took it as. With government-level resources you can pretty easily throw a team at all the common web browsers and find exploitable 0-days and then MITM the next connection the target makes to any website to exploit it, and then find a local privilege escalation vulnerability if necessary. Once you have root (or equivalent) on any given machine you pretty much own it.

That sort of thing isn't necessarily in reach of your typical J. Random Hacker against a patched machine (may not have access to 0-day, can't easily MITM target's internet connection, etc.) but it's really not a stretch to imagine that the NSA can do it if they have no regard for the law.

> not a stretch to imagine that the NSA can do it

In what kind of numbers, though? I mean, from what I remember reading Stuxnet had this kind of crazy stuff in it (multiple zero-days if I recall), but also a clear target in Iran. Would they have the resources to do this to everybody? Is there any evidence of that? Certainly if there were it would be really fascinating to know more, but all we have is this movie plot scenario.

With what Snowden says it makes it sound like they do it to anyone out of sheer boredom. I think to understand the scope of this claim we need more details.

I didn't think it sounded like they did it 'out of sheer boredom', they do it to people they've targetted for investigation. In what numbers, whether targetting computers inside the US or not, etc. -- we do not know, Snowden has not yet released documents so far as I know.

The software to take over someone's computer like that exists, and can be used by script kiddies that don't even know what they're doing, to take over and 'own' many people's computers, complete control. Presumably the NSA knows about even more exploits than the easily available hacker-distributed software does.

http://en.wikipedia.org/wiki/Remote_administration_software

http://arstechnica.com/tech-policy/2013/03/rat-breeders-meet...

It's possible and somewhat easy to pwn a system's bios and have it phone home unpon boot. This was demonstrated at Defcon 20.

Even this vague comment is more specific than what Snowden is offering. I'd imagine it also involves a non-zero amount of hurdles (physical access? kernel mode privileges so you can flash BIOS?) which can be mitigated against.

That's the weird thing about Snowden's claim. It makes them sound all-powerful. If it were really something concrete, there'd be more knowledge of scope, mitigations, etc. It's also hard to believe they are doing this on everyone, by default.

So this was just a pre-interview not originally meant for publication; I assume we will be getting evidence and details on these things with documents yet to be released. This is just like a summary preview.

But I didn't see any implication in this interview that they were doing it on everyone, universally, by default. Rather, Snowden specifically says this is what happens to a targetted person, he some of the ways you become targetted are "because of a Facebook profile or because of your emails", presumably certain keywords or profile or whatever. Then he says the 'monitoring' which completely takes over your computer is done to 'targetted' people.

I too am very curious to learn: How many such targetted people with malware-monitored computers there are, how often this is done; is it done to computers in the US and/or to US citizens; what sorts of suspicion lead to this targetting; what warrants or court orders or other judicial oversight there are on individual monitoring cases; among other things.

I am now eagerly awaiting release of documentation or evidence on these issues.

I'm guessing it's more along the lines of collaboration with major tech vendors to plant backdoors within commercial hardware and software, probably under the guise of "just once in a while, to catch the really bad guys".

I more or less suspect there are backdoors all over our machines these days. The printer or scanner you buy, the OS... "Secret Admin Backdoor Accounts Found in Samsung Printers" http://news.softpedia.com/news/Secret-Admin-Backdoor-Account...

This is a common issue with many hardware peripheral devices, but if your desktop computer contained some sort of hardware-level or OS-level backdoor, there would be a massive uproar.

I think either Snowden is incorrect in what he's talking about, or the NSA is doing something rather devious like hijacking the Windows update process or some other automated task to install malware, which they could only do with heavy cooperation from Microsoft. This would be rather risky though as it could certainly be detected.

Reply on news.ycombinator.com