Shopping for Spy Gear: Catalog Advertises N.S.A. Toolbox
spiegel.de
spiegel.de
I hope the companies listed -- Dell, Cisco, Juniper, IBM, Western Digital, Seagate, Maxtor, et al -- are happy with themselves. The government's mantra has historically been similar to that of Microsoft's: embrace, extend, extinguish. The US Government is no different and they'll happily throw every company under the bus for the smallest advantage over their adversaries.
America's rivalry with China is continually climbing higher and higher, and we're getting dragged along whether we like it or not. The unshakable intertwining of private and public industries, the scorched-earth economic policies where private industry is consumed for the benefit of the public, the unlimited spying powers -- all to stay ahead of China.
The real kicker is that this kind of spying power compounds on itself -- as soon as we get Juniper gear exploited then we can move onto infiltrating Seagate's intranets, and then we can use Seagate exploits to more easily dig into hard-drives accessible by us/in custody by us. We may never be able to make a distinction between which tech companies have been exploited and which are wilfully/maliciously passing vulnerability information to the US Government.
I'm not going to say that these companies are fantastic. I'm just not, but I will say that perhaps this isn't really their fault.
Let's say that BIND has a critical vulnerability that allows people to snoop on the requests made. Does that make the ISC guilty of giving the NSA access to every BIND DNS server on the internet?
No, it doesn't.
If the Snowden revelations are to be believed, at least some of the exploits were the result of giving into NSA pressure.
But the problem with this is that it breaks the chain of trust that a company has with it's customers. Once you know the NSA is applying pressure secretly to force some vulnerabilities to remain open, how can you know they aren't doing that with any given vulnerability.
I'm sure that different groups approach their data acquisition activities with multiple channels, if for no reason other than to prevent other NSA people from knowing about to what they are doing.
This is probably the most damning information I've seen of NSA activities. This is anti-American activity since it clearly harms US economic interests. This coupled with the policy that spying on foreigners is fair-game is enough reason to give any foreign government or company enough reason never to purchase equipment from US tech companies.
As an engineer in the US, this makes my blood boil. I really hope that this new information generates more interest in open-source network software and hardware.
You should assume that the US intelligence community is already doing this to foreign tech corporations and has been forever.
With hardware companies, I doubt there's much of a difference. Getting a mole placed in a foreign company is totally achievable, just a different set of motivators for the mole. Actually, you don't need to compromise an OEM computer or network manufacturer. Just pay off a contractor in the supply chain who manufactures key parts.
Even in the case of services/cloud, I doubt it matters. If the NSA hacked the chancellor of Germany's personal phone, what makes you think that they haven't compromised German cloud providers as well?
Any pen-testing company has a big list of tools that it keeps internally for breaking into things. Did anyone think that the NSA wouldn't have as big a list of its own?
But lots of open-source software have giant vulnerabilities sitting around for years because no one skilled in the art has done the drudge work of going through the code looking for bugs. High-status projects like OpenSSL or qmail will always have a sufficiently large community of researchers constantly combing over them, but the assumption of "well, it's open-source, so someone must have looked through it for security holes" self-fails because everyone assumes someone else did the hard work and often no one does.
And if "people looking through the code for exploits" is the measure of a secure code-base, then Windows is the most secure platform ever. Vast numbers of very very qualified (read: expensive) people have looked through that source code specifically to find security holes.
Hogwash.
There is no guarantee that just because something is closed-source, its going to be 'safer' or necessarily 'more secure'.
Billion-dollar security industries have risen because Microsoft won't/can't fix its bugs.
However, I am pointing out that the argument of "open-source is more secure because lots of security researchers worked hard to find all the bugs" necessarily leads to the conclusion that Windows is the most secure thing ever. Armies of people have looked at that, both internally and externally.
I also said nothing whatsoever about "guarantees." But the idea that the very expensive labor needed to look through a code-base for vulnerabilities somehow shows up for free merely because a project is open-source is deeply flawed.
Second of all, far more eyeballs have looked at the Linux Kernel than the Windows kernel. Far, far more. A factor of 100x more, I would imagine.
Yes, lots of people have looked at the Linux kernel. Looking at something doesn't make it more secure. In fact, Linus has to spend some of his time dealing with assholes who decide the best way to submit pull requests is by making petitions on change.org to get Linux to change its RNG.
If right now a thousand PHP developers decided to look at qmail's source to look for bugs, djb would just think "oh shit, now I have to deal with that today." You need people highly skilled in the art. The most high profile open-source projects can muster that for free, but by definition most open source projects cannot be the most high profile.
The fallacy that closed source projects have fewer security flaws is not strictly true.
I didn't say that closed-source was more secure. I did, however, point out the problems with the statement open-source is more secure because it's more audited. Those problems are 1: if "auditing" is the measure of security, then Windows wins everything, hands down, game over, everyone else go home; and 2: you are assuming that the expensive labor is showing up for free. They will for some projects, but not for most.
(Also, lots of security bugs aren't because there have been insufficient eyeballs looking at a problem, but because the eyeballs looking at the problem are insufficiently skilled.)
There is no reason to think that the eyeballs looking at the Windows source code (i.e. Microsoft employees) are any more skilled than those in the open source community looking over Linux source code. There are probably many parts of the Windows codebase that was written by junior engineers, given the OK by a senior engineer if the code worked and didn't look obviously broken. Much of that code probably hasn't been combed over since because it would only be combed over by the few people that have access to it and the fewer still number of people who have both access and a reason to comb over it because it's part of a task they are currently assigned to work on.
Not once has there ever been a single organization that writes software where the product automatically becomes more secure by virtue of it being 'closed source'.
Quite frankly I've seen far more of the opposite. When the software WAS closed source, more often than not we see this being used as an expressway to cut corners! Things like "Nobody will ever do X", or, this is safe because "Who will try that!"
And then there's my personal favorite: Where you get a company where all of the programmers are too stuck up in their own world to even realize that their product is completely dangerous and bug-ridden with issues because their code is NEVER scrutinized in the public eye!
There's a much bigger reason why code is way better off as open source in the long run:
Public Ridicule, Public Oversight, and Community Integration.
You'll still get the odd-ball where one guy from the NSA might find one exploit -- but I think that the cost of that issue alone definitely does not outweigh the earlier gains from open sourcing code.
"Some of the equipment available is quite inexpensive. A rigged monitor cable that allows "TAO personnel to see what is displayed on the targeted monitor," for example, is available for just $30. But an "active GSM base station" -- a tool that makes it possible to mimic a mobile phone tower and thus monitor cell phones -- costs a full $40,000. Computer bugging devices disguised as normal USB plugs, capable of sending and receiving data via radio undetected, are available in packs of 50 for over $1 million."
Apple's software update process allows for remote targeting of individual machines by MAC address, for example.
Those security features are genuinely only useful for stopping people from installing Linux and open BIOSes. They can only protect computers from their users, not from the NSA.
Remember one simple fact: with all such schemes, the end user is the one party involved who isn't trusted.
For reasons that fall far short of evading intelligence agencies, the user should be able to flash her own BIOS whenever she wants.
Better and more choices in open source BIOS solutions might help in this regard.
In my opinion, it is precisely the notion that the user need never control her BIOS that was used to try to maintain IBM's monopoly on the PC, and later to maintain Microsoft's monopoly on the PC OS. Whatever the motivation might be, I would welcome a renewed focus on making the BIOS open and something that a user can choose, just as she chooses her own bootloader and OS.
Leaving pretty much the entire IT infrastructure vulnerable seems like a very dangerous strategy.
From NSA's perspective? I'm not so sure. A severe attack on US infrastructure would probably mean just more money and more legal power thrown at NSA to "fix it". Then NSA will continue to do what they've done so far - put most of that "security" money, into offensive capabilities. So the cycle will continue, as the systems remain vulnerable.
A big assumption that lots of bug-hunters make, that "this is one of the last bugs, and once fixed, the product will be much more secure." But there are always more bugs. If you assume that are more exploitable bugs beyond the one you are fixing now, it means that the vendors and customers have to spend time and money patching things, and won't really be any more secure afterwards.
Also "if I found it, so can The Bad Guys" is something that applies to individuals and small research teams. It's not necessarily the case that when the NSA finds something that other people are going to find it, too.
Also, unlike most security researchers, the NSA has the resources to monitor if other people are exploiting the vulnerabilities they found.
I'm not saying that the country wouldn't be safer if the NSA disclosed these vulnerabilities to vendors. I'm only saying that many of the common heuristics that researchers assume as true may not be, and especially not when applied to the NSA.
True but trivial. It's much more instructive to pay attention to the rate at which vulnerabilities are discovered. For e.g. qmail that rate is very close to zero per decade. For less secure products the rate varies over time; some researchers have noted a sort of "honeymoon" period that protects new code. Packages that don't in some sense eventually "settle down" after that period ends might ought to be replaced. Or perhaps they are important or unimportant enough to mitigate their vulnerabilities through other means.
Furthermore it's an inevitability that our adversaries learn of these offensive techniques, so attempting to keep them a secret is simply a race against time -- and I don't think that's a race we can win. At this point we're arrogantly exercising recklessness and negligence on the hope that we can stay ahead of the wave.
Not using US equipment probably does little. The solution is to make secure equipment that is harder to exploit. Moreover, the argument can be made that if the NSA can find these issues, so can others that the US government considers a threat to national security.
Literally everything is infected.
Again, either the NSA goes (and you know that won't happen) or information technology goes or democracy as we know it goes.
Everyone, take your pick now.
We're not asking for disarmament. We're asking for de-weaponization by retasking the TAO and the unit that produces these products to work on defensive activities instead of offensive activities. For a long time many, except those considered tin-foil hatters, viewed the NSA as fundamentally providing a useful service to protect Americans and American companies. Now it's clear the tin-foil hatters were right and that the NSA is essentially an offensive organization and that even American citizens and companies are victims of those offensive capabilities.
It's not surprising that NSA would develop and maintain a strong repertoire of exploits for popular infrastructure. What else did you think an organization tasked "to produce foreign signals intelligence information" was doing with all those computer security experts on staff?
Is there evidence that NSA was planting backdoors or that US tech firms were cooperating? Isn't it more likely that NSA was simply discovering (and possibly purchasing) 0-days just like everyone else?
They can do that with foreign equipment just as easily. Switching to non-US hardware is just irrational.
Trust nothing. Everything is a lie.
Wikileaks would have been much better.
If I was the NSA right now, I would be "leaking" tons of fake, and fantastic, stories about myself in order to discredit any legitimate concerns.
I can imagine the talking heads now "well what else were these conspiracy theorists wrong about? Personally I'm glad somebody is out the protecting our freedom."
etc.
Documents would be plausible. "Trust us, we've read them" from someone widely known to lie and steal is another matter entirely.
Entirely unsubstantiated rumors on the internets suggest that Jake got a talk pulled this week from the CCC hacker conference presently underway in Hamburg (which he keynoted last year) that was due to explore his motives and relationship with the US government, as he is the only US citizen publicly affiliated with Wikileaks and has not yet been charged, arrested, or imprisoned (and Wikileaks has not really done anything damaging to the US government since CM/Cablegate).
Don't believe everything you read.
Also, there were two other reporters who filed that story, and it is showing up in a reputable journalistic source - Der Spiegel. I am inclined to believe it, given the very specific details they have highlighted about TAO and ANT.
Care to provide sources, or does the person asking me not to believe everything I read expect me to take his claims on faith and "entirely unsubstantiated rumor"?
He's only well respected outside of the security research community. Those inside know him better than that.
> This generally is a sign that someone is acting in bad faith.
Indeed, this is why many people directly affected by his harassment, backstabbing, and general underhanded techniques employed in his pursuit of fame and glory choose to ignore him rather than directly and publicly address his treachery.
Unfortunately, that means his past goes unreported.
I hold lay opinions of my reputation in little regard, so I (unlike many friends of mine) have no issue saying what I know.
It's all hearsay by the time it gets to you, though, as I'm the first hop away with many of these reports. I'm not interested in opening myself up to a libel suit.
For a general impression of his behavior, please go review his own posts on the noisebridge mailing list archives. Don't take my word for it.
Entirely unsubstantiated rumors suggest lots of things about sneak too. See how easy it is? :-)
I have direct accounts of his treachery and deceit.
By the time I tell you, the second hop, now they're rumor. See the problem?
This article appears to derive its facts entirely from the mystery catalogue. If, hypothetically, the catalogue was drawn up by a bored NSA intern as an April Fool's joke, this article doesn't provide any solid proof to dispute that notion.
All I want is to do is keep clients safe and out of all this cross-fire.
If the NSA has infact backdoored all of those products, kudos for keeping it quiet for this long!
if however these products have vulnerabilities in them, like all software does, and the NSA have access to these vulnerabilities (like numerous other people do), it's not quite as devious.
In that case they didn't have a super-secret backdoor installed with no-one noticing, but in fact discovered that the window wasn't locked, and kept that a secret.