Hacker News Reader

Comment by hosay123 | Hacker News Reader

As much as I love drama, the notion that the NSA would hardcode a registered IP address of their own into some malware and use that to attack some very publicized network affecting thousands of users.. well..

As another comment points out, why bother when you already coordinate a massive sniffing effort affecting large chunks of the globe?

View on HN

Your argument is "that would be obvious, so it must not be true"? Why are you letting a feeling outweigh actual evidence?

Why bother? Timing attacks on Tor are much harder (require sniffing & correlating large percentage of network) than direct de-anonymization (require injecting malware in some servers).

The post is not speculation, it's actually pointing to those IP addresses. SAIC also openly does this type of offensive exploitation work for the government. There are many reasons why sniffing may not be sufficient, not least of which is that it's over Tor.

But what is the alternative... someone has pwnd an NSA box and is using it as a CC server for malware that they've injected into all sites hosted by some guy who was just arrested?

Possible alternative is that a third party wrote the malware and decided to put an NSA/SAIC IP address in the code to scare people

And then deployed this exploit just before the Freedom Hosting founder, on whose servers the exploit was found, was arrested?

Just saying putting an IP address in some code doesn't mean the owner of that IP address is responsible for writing the code.

You're missing the point. The fact this exploit showed up just before the server owner was arrested strongly suggests the feds are involved.

I hear a "shooting star" was seen the night of the Tunguska event. The fact this shooting star showed up just prior to an enormously powerful explosion suggests the allies had nuclear weapons in 1908, and that they were supplied by aliens from another world.

For any given series of boring events, the most fantastical explanation that ties them all together must obviously be true.

It doesn't seem that fantastical. Anonymity unmasker shows up on the kiddie porn server the very day the police raid said kiddie porn server?

http://i.imgur.com/SVrbmtR.jpg

This is my preferred Tunguska conspiracy:

http://www.teslasociety.com/tunguska.htm

ps: I don't care if it is correct, it is still an interesting read.

Why don't you do a:

  GET /05cea4de-951d-4037-bf8f-f69055b279bb HTTP/1.1

Don't you think if it was another party they would just have encoded the IP and/or MAC into the URL to of a GET from some scary IP instead of using a cookie to a resource that is actually there on listening on the server.

Perhaps they wanted it to be noticed, to frighten people away from networks like Tor.

In this case it's a double-hit: compromise a large number of Tor users and discourage more people from using it.

It's PsyOps. In leaving such an obvious signal, they're trying to remind people that as a state level actor, they can get into Tor or anywhere else they please if they really want to.

Big Brother is watching.

So this anonymous malware author compromises an enormous number of Tor sites and funnels identifying information to an SAIC/NSA IP address ... just for laughs?

Because this is tor, it's likely harder to sniff. This wanted to collect IPs and MACs.

Reply on news.ycombinator.com