Source Code Similarities Between NSA Malware and 'Regin' Trojan | Hacker News Reader

Source Code Similarities Between NSA Malware and 'Regin' Trojan

spiegel.de

489 pointsLibertatea191 comments

It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack. In the latter many security analysts question NK attribution based on the similarity of code argument given by the US -- pointing out that the code base was in the wild for a long time, could be purchased on black market or reverse/reengineered after picking up the malware from a vulnerable machine.

Shouldn't we also assume that this malware, having been in the wild for "10 years", could have simply been modified and thrown into the NSA tool chest? When applying the same level of scepticism from the Sony hack, nothing in this article represents real proof to counter relevant arguments against US attribution.

Regardless, the Spiegel assumptions or slant is worthy if for nothing else than to teach everyone the issues with attribution, whether applied to greater or lesser evils.

I stopped reading the article when I got to this point:

"In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth."

In the immortal words of John McEnroe, "YOU CANNOT BE SERIOUS!?"

>> "It is worthwhile to apply the same scepticism for placement of attribution as was applied with the Sony hack."

Just playing devils advocate here.

The alternative is to do as the USG did and immediately jump to conclusions based on not that great evidence. If they don't give others the benefit of the doubt why should we give it to them?

If your goal is to understand who is doing what, then you want to be smart about how you draw conclusions.

If, on the other hand, your goal is to flame people who have done bad stuff when the opportunity arises, then yeah, go for it.

Because 1) the USG isn't one single guy and 2) the truth might be more important to some than conclusion-jumping.

Displaying a lack of intellectual rigor in response does not garner any respect from people that can think. The quickest way to get people smart to tune out is to engage in a political mudslinging contest lacking real content.

I agree and this is what I was hinting at with the last point. I think in the end there is no way to update our understanding to a world filled with acts of conflict that are difficult to attribute. We've lived in an attribution luxury until now. So this Hippocratic of attribution will probably continue. I do think in the end the public will just learn to take attribution with a grain of salt.

This is why I think cyberwarfare represents one of the most fascinating areas of exploration for political science students. In addition to the collective psychological affect from attribution complexity (further discussion if interested https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...) there is also the breaking down of the 2 state/coalition actor assumption. The actor could be from a known state enemy, an unclear enemy just disturbed by your trade/sanctions policies, some activists with a cause or a bunch of people from b/chan doing it for the lulz. The absurdity of the US response and attempt to protect some lousy hollywood comedy only illustrates this change of environment all too clearly.

Spiegel might have done better to call it a GCHQ tool used by the NSA.

You are suggesting that a tool that has been around for 10 years was picked up and used by NSA/GHCQ. Even if we grant that, the sophistication level is a bit more than "simply modified". When is a fork no longer a fork because the code base has been modified/improved?

With your argument, one could go back as far as they wished - NSA takes an idea from academia and implements it, then we just say 'oh well, it was the univeristy who came up with it, not NSA as they only used it'

My question was concerning attribution. Though debatable lets assume still the original was not theirs and they remixed it. Even if they made massive changes turning into their own beast allowing us to call the Snowden version significant we are still left with the question of: Are all the attacks over the past 10 years attributed to this general varietal, their attacks? Without full knowledge attribution is like a blind taste testing of different vintages of wine.

Also I think the remixed and implemented idea from academia applies less. It would be more like taking the paper from one journal, changing a few paragraphs and publishing it in another. And assuming these journals had a policy of publishing without names, how can we know who the author is in all prior journals when we eventually find a way to attribute one author to one journal?

Basically what cyphunk is saying is: how do we know that this was used by the NSA? More precisely: how does Spiegel know to say "clear proof that Regin is in fact the cyber-attack platform belonging to the Five Eyes alliance"?

We have something out in the wild (Regin) which contains a component (QWERTY) which was leaked in the Snowden documents, however it is quite possible that both descend from a common non-NSA source (Putative) such that:

        P (non-NSA)
       / \
      Q   R (non-NSA)
    (NSA)

Furthermore it is possible that in fact P = R, and that Q was derived from Regin rather than the other way around. Lots of possibilities are out there. We don't really have proof that P = Q and that therefore R also belongs to the NSA.

The issue is that we can attribute malicious attacks to R, and the article seems to be suggesting that therefore we should attribute these to the NSA. The reply by cyphunk is saying that this is a dangerous logical leap.

There are also additional clues pointing to Regin being a Five Eyes tool: In the QWERTY code, there are numerous references to cricket, a sport that enjoys extreme popularity in the Commonwealth.

Given the relative popularity of cricket in the US vs. the rest of the world, it's more likely that this was written outside the NSA.

I don't think it's the sport. I think it's cricket = bug = spy tool.

A spy tool that chirps every few seconds to announce its presence? There are better insects to reference.

maybe because it jumps as malware usually does

It is the sport. The references they are referring to in the article include things like LEGSPIN.

Just as likely to be a tounge in cheek play on the stereotypically British line for something unfair:

"It's just not cricket"

Or they had an Indian programmer in their team.

Or India was the first target.

In the PDF (who's ever shipped binary as text in a pdf btw?) [1] they argue that it might be related to Australia; who knows...

[1] http://www.spiegel.de/media/media-35668.pdf

Also "source code"...

This is clearly not source code.

It's probably just reverse engineers being snobs.

Or journalists being journalists.

Or both.

I'd argue that it's source code at the lowest possible level...

And I'd argue that it is a disassembly of a binary compiled from source code.

Source code has the word "source" in it. Unless the original human wrote it directly in assembly without comments or macros (from his padded cell at the asylum, naturally), it is obviously not source code.

"Source code" is generally code you can put into a compiler and get out object code. The term "source" refers to the fact that it is used as input. This is why, for example, the GPL specifies that you must release the original source code in the preferred format for editing — so that people wouldn't release source code generated by disassembly or a source-to-source transformer.

I suppose it all depends on how you define "source code". For me, source code implies that it was authored by a human or automatically generated to mimic human authorship. Any automated translation step that does not result in executable "object code" or "machine language" is "intermediate code".

It may be usable in the same way as source code, but since it was produced as the output of a program that had an input closer to the source, it cannot be the source.

I imagine the compilation process like a stream. The source is the origin of the flow. All changes made there propagate downstream. Some streams are short, like those with M4-processed assembly. Others are longer, with MSIL or JVM intermediate code. Linked libraries are like tributaries; they have their own sources. The end product is a single river, which fans out into a delta for each supported processor architecture as it nears the sea of end users.

I know you are wrong. logfromblammo explains it well.

But let's hear your arguments, I'm curious.

"This is clearly not source code."

that's assembler

By saying they've released "source code" they're claiming to have somehow got hold of extra information (i.e. done some old-fashioned journalism and got hold of C code or whatever, containing comments and symbols and human information about intent). In fact they've just downloaded a publicly available binary and disassembled it.

I am baffled by the people who decided to disagree with you here. Calling this source code is incredibly dishonest. It's the equivalent of saying "we've published the source code of photoshop" when you've base64-encoded photoshop.exe.

I would love to see the actual source code of regin. What they've actually published is useless to me.

I know GCHQ contractors (BAE Detica, funded as a part of the "Mastering The Internet" tender) had a hand in at least some of it; it's not unreasonable to guess it might've been that module, as that does link it? (Although of course, that's just a guess, and doesn't really tell us anything particularly new or useful.)

Not that I think nation-state malware is, you know, strictly cricket. (Quite the opposite, I've always said it was an irresponsible and reckless path, all the way back to the 1998 era.)

Update: It seems Australia's DSD was likely a better guess in this particular instance - more to come from the authors soon. (Which leaves that Detica module currently unaccounted for. I don't know what that could be yet.) Of course, they're all Five Eyes, and at least US and UK have both used it, so I wouldn't be too surprised to see CAN/AUS/NZ too.

Leaves us back with the "How do we fix this?" problem. And "how do we find what replaced STRAITBIZARRE"?

Given that a NSA dev team was well aware that the spyware would be discovered and disassembled at some point in time, it was reasonable to intentionally leave behind evidence that points to countries other than the US. I'm not saying that's what happened, but I'd not take the cricket references too serious either.

Using that logic, what would constitute evidence? That's like the senator in favor of the Japanese interment camps saying that the fact that no Japanese Americans had committed a crime was just even more evidence they were planning something.

Edit: More clearly written than my comment: http://lesswrong.com/lw/ih/absence_of_evidence_is_evidence_o...

But basically, people have already come to a conclusion. If the comments said "go <Virginia sports team>", that'd be considered evidence of made in the USA. And if the comments say " go English sports team " then that's evidence of have in the USA, because obviously comments are misleading.

Why not go recursive? They wrote about cricket because they wanted to frame the Americans, who always write misleading comments to frame the Brits.

So I can clearly not choose the drink that is in front of you!

That's what I get for fighting a land war in Asia.

They both did it yo

I think disinformation is one of the pillars in their line of work. For all we care, they could have written references to whatever is popular in North Korea.

How smart would you have to be to insert references to different cultural aspects other than your own to make it look as if it's from another entity? I think it would take at least the smartness of two average people..

Seeing that this is a keylogger, how complex would it be to enable a sort of SSL protocol between the keyboard and a specific application? The computational overhead should be manageable, the connector (USB) wouldn't need to change and there should be a fallback for any applications which doesn't support it. But if crucial applications like mail and the browser programs could use it, it might deliver another blow to security companies.

The way I would implement it is that the keyboard has a switch to enable this SSL type communication. Then the keyboard can perform a Diffie–Hellman key exchange with the current process. As a result any other interaction with the OS would become impossible until that process is terminated - basically disabling all OS related shortcuts etc. This would allow true end to end encryption - even on compromised systems (as long as the kernel code isn't modified to allow accessing the memory of other processes).

If the operating system is compromised, your application stands no chance hiding its data (including keystrokes) from it. The keystrokes could simply be intercepted after decryption, or even before - if you keyboard controller is that capable, it probably has more than enough space for malware of its own.

If the OS is compromised, then you can't work around that to secure a program inside the OS. You can run the program somewhere else, like on the keyboard itself. Some secure crypto devices have displays, so you can see what you're signing.

The only similar thing I've heard of is the "Secure Attention Sequence" in Windows. That is, pressing CtrlAltDel before entering credentials lets you be sure an application is not mimicking the logon prompt. But of course if the OS is compromised (like by loading a driver that intercepts such keystrokes, like VMware Enhanced Keyboard) all bets are off.

Think about it, the OS is executing all the code for the app, and storing all the memory.

This is also why there is a push for trusted computing. Being able to have your processor, OS, etc be able to verify they are running a trusted configuration is a powerful thing. It makes the owner of the computer in control. (The downside is when the user is not the owner, but would like to be, then they get upset at restrictions.)

"Trusted computing" puts the controller of the trusted infrastructure in control - the owner of the computer should expect that any NSA-approved malware will be considered properly trusted, and being in control of a secure OS doesn't help against attacks coming from the hardware (malware or backdoors on firmware) with direct memory access.

I LOVE how you come with trusted computing on a topic about a malware allegedly created/modified by the NSA.

You MUST be a security professional! Only those have such a distorted view of reality!!!!

as long as the kernel code isn't modified to allow accessing the memory of other processes

This is kind of what the kernel is for, though: if you can't modify the memory of other processes you can't handle IO for them. Hiding data in plaintext from the OS is basically impossible. Nearest you can get is heavy obfuscation (Skype) or communication to a secure hardware bastion (TPMs for DRM or otherwise, ARM TrustZone).

What might be more interesting and useful is secure communication between a remote website and a non-PC device. Kind of like PIN pads, but more user friendly.

Actually I may have been too quick to reply. This might be accomplishable with remote attestation (Intel TXT). I think Intel chips can setup trusted execution areas and provide a hash of the code running. Now, input and output are gonna be tough. You could do encryption to and from the device but then you're essentially running another computer.

It might be easier on a simple DOS like OS, where IO is m can be straightforward and handled by the hardware pretty much.

"Regin Malware Unmasked as NSA Tool" or NSA Tool found to contain part of Regin malware?

Published it where? The only link I can find is http://www.spiegel.de/media/media-35668.pdf, and calling that source code is a bit generous to say the least.

Seriously. Did nobody else here actually come because they were interested in seeing Regin's source code? I feel like I'm in crazy land.

As a lazy person and Devil's advocate, why does anyone not think that the various intelligence agencies copied the malware? Surely they would have access to some of the best in all their various honeypots be it that they are attacked by everyone and everything. "Good artists copy, great artists steal."-PP

US spying on allies, what else is new? Wasn't most of this already known? From wikipedia https://en.wikipedia.org/wiki/Regin_(malware)#Known_attacks_... :

`Der Spiegel reported in November 2014.......`

`Fox IT found Regin on the computers of one of its customers, and according to their analysis parts of Regin are mentioned in the NSA ANT catalog under the names "Straitbizarre" and "Unitedrake".`

Has Speigel reported on the ubiquitous US spy stations peppered throughout Europe? Have they speculated on why Europe does not close them?

Because the US shares intelligence with those governments. In some EU countries it is illegal for the government to spy on its citizens (also see the US pre-9/11), so the US spies on those countries and then relays the info back.

Pre-9/11 this is also how the US worked. The UK spied on the US and the US spied on the UK, thus both subverting national laws, they then shared intelligence with one another (which is legal) and thus the loophole was born.

This is actually the system the US is going back to, it is becoming politically unpopular for the NSA to spy on American Citizens, so GCHQ will likely take over the majority again, the reasons they couldn't after 9/11 was that the workload increase too much in too short a period, and the systems didn't yet exist.

In my mind that's conspiracy-theory level claims. Got sources?

This goes all the way back to ECHELON and Five Eyes. If you look up the ECHELON program, you will find documented evidence of exactly that occurring. There is evidence this and similar programs/agreements has been going on since at least WWII.

Even now, it's well-documented and well-understood that all the first-world allied nations have varying degrees of intelligence-sharing relationships with their SIGINT programs. For example, with the NSA, you have the Five Eyes countries, and also Tier 2 countries like Germany.

I tihnk what also holds them back a little is also the fact it's amazingly hypocritical for them to complain too much, because every industrialized country is spying on every other industrialized country, allied or not. Of course, some are bigger targets than others. The US is obviously the biggest target, but there's smaller scale stuff going on too, as between France and Germany. According to Germany, France is the "evil empire" of industrial espionage perpetrated in part through their SIGINT programs.

The focus on the USA, and the NSA, is misleading. The NSA's role is probably comparable to the US government at large's role in world politics, (biggest, most influential) but all other nations are complicit. I don't intend to sound mean, but I feel like the attitude that so many people had in the wake of the Snowden revelations, that spying on allies was unheard of, unexpected, evil, is breathtakingly naive and historically and contextually unaware, and almost like some kind of twisted expression of the stereotypical American arrogance, that only Americans could commit so great an evil. This is an old, old, old game that has always evolved with technology.

I guess I rambled on a bit there. Sorry.

Google "Five Eyes". The Wikipedia article has a bunch of sources to this particular issue in recent times.

Also, IIRC this has been talked about for a long time... I'm pretty sure I read about this practice initially in the 80s/90s, probably in reference to Libyan sponsored terrorism in Europe.

There's nothing conspiratorial about that one. Look up the echelon network and the UKUSA Agreement (both on Wikipedia). It has also been talked about in several books on the topic and discussed openly in the press. It is almost an "open secret" at this point.

Heck you can almost read the above claims verbatim here:

https://en.wikipedia.org/wiki/UKUSA_Agreement#Controversy

> During the 2013 NSA leaks Internet spying scandal, the surveillance agencies of the "Five Eyes" have been accused of intentionally spying on one another's citizens and willingly sharing the collected information with each other, allegedly circumventing laws preventing each agency from spying on its own citizens

What would you call it when governments conspire against their populations to subvert constitutional limits? It's literally conspiratorial.

Maybe, but I'm 99.99% sure that wasn't the person above's implication by suggesting it was "just" a conspiracy theory. If it had have been their entire point would be redundant, instead it is likely they were trying to suggest it was a fiction or born out of paranoia.

I wouldn't go so far as to call it a "fact" but based on several leaks, books, and news sources it is likely more fact than fiction.

By the way, my understanding is that it was never as simple as two countries colluding to share raw data with each other; there had to be essentially a "laundering" of the data by turning it into analyzed intelligence, so that an NSA analyst couldn't just explicitly task a selector on a US-resident AMCIT via another FVEY partner.

If you think about it from the lawyers' perspective, it goes something like this:

I(a)) A can gather data on BCITs.

I(b)) A cannot gather data or cause data to be gathered on ACITs.

II(a)) B can gather data on ACITs.

II(b)) B cannot gather data or cause data to be gathered on BCITs.

III) Data gathered via (I(a)) or (II(a)) is lawfully collected.

IV) Lawfully-collected data may be turned into intelligence.

V) A and B can share intelligence that is gathered by lawful means.

Therefore, A can receive intelligence on ACITs and B can receive intelligence on BCITs, so long as they do not derive that intelligence by gathering data or causing data to be gathered on their own citizens.

Now, this was pre-9/11; after that, who knows what gloves came off?

Yes, it has, see [0], [1]. But there are fairly simple reasons why Europe does not close those stations, namely because European nations (including Germany) are doing similar things on their own [2],[3],[4] and also together with the Americans [5], and they generally think it's good that way.

Another point is that enforcing closure of such stations is rather difficult. You can limit these activities by making noise in the public and declaring diplomats persona non grata, but such things come with a diplomatic price.

BTW, your question reminds me of the activities of Интернет исследовательское агентство. According to reports, they like to raise this kind of points, though sometimes more more aggressively (hence the name "troll army").

[0] http://www.spiegel.de/international/germany/cover-story-how-...

[1] http://www.spiegel.de/international/germany/german-helicopte...

[2] http://www.france24.com/en/20131024-nsa-france-spying-squarc...

[3] http://www.matthewaid.com/post/88066878726/bnd-admits-six-fa...

[4] http://articles.baltimoresun.com/1994-12-21/news/1994355023_... (1994!)

[5] http://www.spiegel.de/international/germany/the-german-bnd-a...

Many espionage tools are designed by organizations that then sell or license their tools to 3rd parties. Just because the NSA used it doesn't mean they wrote it.

'Some reporters were surprised to learn that the University of Maryland had a "covert" NSA facility operating somewhere on or near the school grounds. [..] "Which facility and exactly where it was Snowden worked is unknown, but the NSA has connections to several university facilities, including the Laboratory for Physical Sciences, the Office of Technology Commercialization and the Lab for Telecommunication Science."'

http://www.motherjones.com/mojo/2013/06/university-maryland-...

Oh, and the University's college hacking team got 1st at the Major League Hacking Championship in 2013, winning over MIT, Carnegie Mellon and Rutgers. https://www.umdrightnow.umd.edu/news/umd-students-win-major-...

There are probably hundreds of other organizations which work 'in partnership' with the intelligence community to develop programs which are essentially used to better their espionage and analysis capabilities. Almost all the Virginia/DC/Maryland area's tech companies are employed in one way or another by the federal government, usually for the military or an intelligence agency.

OK, if you believe that there is actually such a thing as "Cyberwar" then this means that the USA has attacked Belgium. Does this give Belgium the right to physically blow up some important American infrastructure? ... or is Cyberwar a type of cold war which would limit the response to some sort of hacking of important American infrastructure?

I don't know. We'll find out when the attacker will be Belgium and the victim the US.

They have the same right they would have if they were physically attacked by the US - the right to sit there and take it because they have no power.

Assuming all of this is true, and the TPP leaks are indeed what they seem to be - wouldn't the TPP let every corporation outside $COUNTRY sue the government of $COUNTRY for malware? (e.g. for $COUNTRY in Five Eyes)?

First upside to the TPP that I've seen, if true.

If you or I wrote it we'd go to jail for a very, very long time.

When a government writes it, nothing happens.

Really? Apart from France, do most countries prosecute the author of computer/hacking tools? I was under the impression that the use of the tools is what mattered. Just like BitTorrent itself has been fine, but any hints of using it for copyright infringement get fire.

After all, you could use this malware to spy on your child's use of your PC, which is legal, right?

See Dmitry Sklyarov, among others.

If you or I kill someone, we'd go to jail for a very, very long time.

When a government kills someone, nothing happens.

Nothing new.

Nothing like waking up to a story that makes you feel embarrassed by your citizenship. Good job Canada, you're making a Maple Leaf a dangerous symbol all around the world.

When I was a youngster, being Canadian meant that Incould travel anywhere and be fine. Granted, there was a > 50% probability that the other Canadians I would meet were really Americans, but that was nothing. My country had a solid international reputation. Now???

Just imagine being American and being full of false pride...

How about being an American that has lived in the States, Aussie, and New Zealand over the past five years - I can't escape the Five Eyes shame :(

Not related to this thread, but to your comment about the Maple Leaf: http://www.newsweek.com/why-rebel-groups-love-toyota-hilux-7...

Edit: Sorry, I didn't see it was paywalled (I'm not a subscriber of that site). I now see that it counts your visits and disable itself after a few times. "Private" browsing seems to solve the problem.

that link is mostly paywalled. do you have another source?

Search the title.

But from old memory: Hilux trucks are built amazingly and have awesome reliability. Real, authentic, Hilux trucks are thus valued by freedom fighters/terrorists in Afghanistan. Canada donated a bunch if real Hilux trucks to Afghanistan, and these vehicles had a Maple Leaf logo. People associated the Maple Leaf with the quality of Hilux, to the point of at least one person getting a Maple Leaf tattoo to signify his quality.

Would be great if HN auto-swapped links to paywalled sites with a link to query on search site instead.

My current opinion on government hacking is, that I actually want democratic government to be the biggest meanest hackers of them all.

The alternative, unfortunately, is that either organized crime or non-democratic governments (or a combination of both) would be the biggest meanest hackers.

And hacking doesn't really scale. Mass surveillance just through attacking individuals with malware isn't possible, because of limited "talent" and a fear for exposing the tools, like just happened.

Building backdoors into systems or encryption schemes, on the other hand, isn't exactly hacking but does scale well to undiscriminate spying on millions of people.

The main issue is that intelligence and law enforcement agencies in the western world aren't bound to judicial control as tightly as they should. It also seems that a majority of voters either consent to these powers, or don't care. When politicians want to appear "acting decisively" after terrorist attacks, or foreign hacking incidents, it's not just because they like to do so. They know that, if they don't, voters will disapprove.

Or, you know, they could concentrate on defense rather than offense

How can they provide adequate defenses without having the best offensive hackers? At the very least, penetration testing is an indispensable tool in cyber security.

Also, surveillance of criminal and terrorist organizations without offensive capabilities is impossible.

The NSA have been accused of discovering vulnerabilities in systems and software but keeping them undisclosed so that they can exploit them themselves. A defensive security agency could be actively trying to secure these systems protecting us not just from government surveillance but all types of nefarious hackers.

I have a hard time seeing how spying on European officials will help identify criminals and terrorists.

Again, you seem to not understand how I discriminate between means and their use. Spying on European officials is a problem with oversight, not with capabilities. Arguably, European officials are a lot softer targets than a crime cartel or terrorists in this regard.

> "Spying on European officials is a problem with oversight, not with capabilities."

Snowden has showed this to be absolutely false. "Oversight" has been the nominal preventative for spying on our allies for decades, and it has always failed because these are spy agencies we are talking about. Their nature (and job description) is to do things in secret. You cannot oversee what you cannot see. The NSA has a fundamental incentive to hide as much of its activities as possible, and American politicians have a fundamental incentive to look the other way lest they appear "soft on terrorism" or some such nonsense. What few laws constrain the behavior of the NSA, GCHQ, etc are routinely ignored or "interpreted" to their own favor.

You cannot let the technological genie out of the bottle and expect a close watch on the genie to keep it under control. Mass surveillance technology is a pandora's box that you can't control.

Snowden and others have also shown that other countries' intelligence agencies will happily take over from the NSA and spy on you. For example the Chinese and Russians.

Hacking tools are not mass surveillance technology. Trojans just don't work for that.

And if you can't control how these agencies use their abilities, how do you propose to take these away from them? Adequate oversight is easier to achieve.

How do gain oversight over something that's by definition secret?

"Sorry, would like to tell you but doing so would be against the interest of the state ..."

Snowden and others have also shown that other countries' intelligence agencies will happily take over from the NSA and spy on you.

How is that sentence anything other than a non sequitur?

We're talking about NSA overreach, and attributing Regin and/or Qwerty to the MSA or the 5 eyes. Why are you fudding up the Russians and the Chinese?

Having offensive hackers, and using them for penetration purposes - that is "white hats", is fine by me. Using them for "black hat" purposes is not. That makes them the bad guys.

They should be using their capabilities to increase the security protections they have in place. For example, if they discover a vulnerability, they should work to get it fixed, instead of leaving it there so everyone is vulnerable, just so they can use it to attack others.

I am confused in just about everything you said. So what do you endorse and what do you mean by "biggest meanest hackers"?

How would that fit in a democratic government?

It depends on just who you are attacking. Terrorist groups, criminal organizations or criminal individuals are legitimate targets of a cyber attack, just as they could and should be put under conventional surveillance.

If government agencies attack ordinary citizens or companies, without legitimate authorization, than it's not a problem of means or tools but rather a problem with democratic or judicial oversight on these organizations.

It can be argued that leaving systems vulnerable to attack as the NSA have been accused of doing actually facilitates more crime than it prevents.

Providing these backdoors isn't government hacking on legitimate targets, but rather a sort of lazy surveillance or intrusion on its citizens.

You comment here sort of answers my question above. So basically you don't agree with attacking or weakening crypto/security systems.

The thing is that without those "competitive advantages", I fail to see how they can have an advantage over the bad guys. Playing offense, when the need arises, won't cut it. You're gonna have to "lay the foundations" so to speak, for you to be a successful attacker.

So basically we reach the old, but not so tired, question of how much of your freedom you're willing to sacrifice, for your government to be the "meanest of them all"

Hacking is not the only way to spy on an enemy, especially terrorists or criminals. If such a group is sophisticated enough to evade all but the most sophisticated, ultra-secret bleeding edge attacks, maybe it's time to resort to conventional means. Luckily most such groups aren't. They just began using encryption.

The alternative to offensive hacking is to include backdoors in the encryption technology used by everyone. I think that this is causing more harm than good.

Ok, but you omit a crucial step, that I kinda need an answer to further understand.

In order to attack(successfully), they employeed various techniques; from weakening security systems and protocols, to actively endorse weak crypto schemes. What about these? And for the sake of the argument, let's say that they have the best of intentions and they don't plan to use those against law abiding citizens.

Do you agree with these actions?

I think if you replace 'hackers' with 'guys' you get the basic definition of government: at some point, a nation picks its 'biggest meanest' (i.e. most capable) guy(s) to protect it and maintain order. Democracy just tries to institutionalize this decision and allow a peaceful reëvaluation every so often.

So maybe GP means he wants a well-designed democracy with a strong military, including infosec. Yeah, good idea.

No.. Government is not about picking a better bully than your neighboring nation and beating them into submission.

What government provides is a practically viable method (kludge?) to reaching consensus on issues where other more reliable methods (like science) fail to do so.

Should "we" build up an army and enslave our neighbor nations or should we rather build up and industry and fabricate something all of them want to have (but can't produce themselves) and sell it to them for horrendous prices? Both alternatives have the same effect, but which one is "better"?

Science can't provide conclusive answers here .. so what do we do instead? In the past we'd ask some designated mastermind deriving his legitimacy from god or a certain bloodline and such. These days we tend to vote on who that mastermind should be or create institutions that allow for more direct control by the nations subjects.

But nothing of this has to do with picking a bigger bully. How big of a meanie you (as a nation) want to be is entirely orthogonal to being a government (or a democracy).

I don't get it. The NSA is not a democratic government ... It's not elected by the people. The US people have no control over the NSA.

There are also good reasons to argue that the US is not democratic: http://www.bbc.com/news/blogs-echochambers-27074746

The U.S. government, for all its weaknesses, is providing their citizens with freedom and liberties as good or better than most other countries.

The NSA does have democratic oversight. It is controlled by the executive, legislative and judicative branches of the system. That this control is inadequate in our view, doesn't matter for the question whether or not the NSA is part of a democratic system.

> "That this control is inadequate in our view, doesn't matter for ... a democratic system."

It absolutely matters. Without those controls you have a democracy in name only. You could quite happily rig elections, arrest opponents, suppress the population etc, while still claiming to be 'democratic'.

That omission of a few crucial words from my comment is almost malicious. I didn't say that the inadequacy doesn't matter for the democratic system, but rather that it doesn't matter for the question if the NSA is a part of such a system.

You may be technically and structurally correct, but I think most people care far more about how effective democratic checks and balances are being applied to the NSA (hint: not much) rather than classifying it as part of one type of system or the other.

> You could quite happily rig elections, arrest opponents, suppress the population etc, while still claiming to be 'democratic'.

There is nothing undemocratic about those thing as long as a majority of people agree to them - though with rigged elections, you might not be democratic for very much longer. "Democracy" is not synonymous with "respecting my values and human rights."

If enough Americans were sufficiently upset about the NSA, it would be gone. They aren't. It's not even a significant election issue.

> "... as long as a majority of people agree to them ..."

That requires that people are informed and able to comprehend the ramifications of their choices. Consider this: Is it still democratic if those who happen to be in charge are busy lying to and hoodwinking a poorly informed 'electorate'?

As for the rest of your comment, it is not democracy simply because a majority agree it is. http://en.wikipedia.org/wiki/Democracy

There's no reason to believe the US government has to make any real effort to make sure voters are misinformed. They seem to manage it just fine on their own.

You're glossing over a huge amount of stuff relating to who does the reporting and how the reporting on the government is done. There's plenty to suggest that the government actively works to keep journalists in line. The Sterling prosecution and James Risen's legal problems spring to mind. The heavy weight of the Espionage Act also comes to mind, as does the very heavy use of "anonymous" or "unnamed sources" these days.

In short, it really looks like some parts of the US government actively work to keep reporting very favorable or non-existent.

Oh, sure, they might do it anyway, I'm just saying it's not needed.

Nearly all formulations of democracy are not just majority rule, they also explicitly include protections for the rights of minorities and consider it non-democratic for the majority to vote away the rights of the minority.

edit - This also makes sense from looking at the word. Democracy is rule by the 'demos', which means 'the people', which includes the minority. Rule by the majority is ochlocracy, from 'ochlos', meaning 'the mob'.

If enough Americans were sufficiently upset about the NSA, it would be gone. They aren't. It's not even a significant election issue.

Are we sure of that? Wisconsin Senator Russ Feingold lost his re-election bid. He was the only Senator to vote against the PATRIOT Act in 2001.

Colorado Senator Mark Udall lost his 2012 re-election campaign after being a total gadfly in the Senate Intelligence Oversight Committee.

It strikes me that the NSA is a significant election issue, just not to the voters.

Also, you're kind of arguing about a technicality in the definition of "democratic". Our elected reps often act un-democratically. I hope this is to prevent tyranny of the majority, but I fear that it's just legislative capture.

> It strikes me that the NSA is a significant election issue, just not to the voters.

You've just managed to explain quite succinctly why it isn't a significant election issue.

let me guess, you are american

Actually, no.

The NSA has little to no oversight:

----

"Congressional oversight of the NSA is a joke. I should know, I'm in Congress" by Alan Grayson

http://www.theguardian.com/commentisfree/2013/oct/25/nsa-no-...

----

A minor quibble, but governments don't provide freedoms and liberties. They restrict them. Hence the word "govern" and its etymology.

Try to enjoy your liberty, for example the right to property, when there is no government to stop your neighbor from just taking your stuff.

Looking back at history, I vastly prefer the balance of liberty afforded by strong governments in the western world to the lack of such control.

The right to property implies the right to also defend that property. I'm what stops my neighbor from taking my stuff, not the government.

Looking back at history, strong governments have been THE source of oppression and limitations of freedoms.

And if your neighbor is bigger and stronger than you? If 100 of your neighbors get together to take your stuff? If 100 of your neighbors independently want your stuff?

What if the government wants your stuff or 20-50% of it?

At the absolute barest minimum, even disregarding any context, it's better to have to one known entity demanding a share than an unlimited number of unknown ones doing the same.

If it makes no difference who is robbing or extorting you, I'd go with the ones I have a better chance of defending myself from: my neighbors.

Then you have a very limited view of history. Crime, theft and murder used to be extremely more common.

You may be able to defend yourself against your neighbor. What about women and children? What about against multiple aggressors, or ones with better weapons? Turns out, without an effective police force, liberties are distributed a lot less equally...

Steve Pinker explained in a TED talk that hunter/gatherer societies are a lot more violent than modern societies. For example these groups have to launch preemptive attacks against neighbors if only for fear of the other group striking first.

> Then you have a very limited view of history.

Pro tip: when disagreeing with someone on a philosophical point, it's good form to leave "you" statements out of the debate.

Good day, sir.

It's amazing I've never heard this pro-tip before, but it's phenomenal. Wow. Thanks for this tiny piece of advice in the middle of all this.

> The U.S. government, for all its weaknesses, is providing their citizens with freedom and liberties as good or better than most other countries.

[citation needed]

>citation needed

http://rsf.org/index2014/en-index2014.php

https://www.freedomhouse.org/report-types/freedom-world

The U.S. is not exactly at the top in all such comparisons, but certainly "as good or better than most other countries."

Define 'democratic government'. This term is a euphemism nowadays in the West. E.g.: http://www.salon.com/2013/08/17/chomsky_the_u_s_behaves_noth...

I wonder if Chomsky would have that liberty of critique in any other country...

What difference does freedom make if society is engineered accordingly so that anything but the party line will be lost in the noise? Other than for possible riots, bloodshed and long-term sustainability, is that in any way distinguisable from a "non-free" form of government?

Besides, freedom is only necessary for democracy, not sufficient. So his points all remain valid.

> I wonder if Chomsky would have that liberty of critique in any other country...

Yes, he would have. And in many, he would not need it.

What does it mean that someone does not "need" a liberty?

He certainly would in quite a lot of countries.

Chomsky is a lot less controversial in a lot of countries outside the US than he is in the US.

I'm sure there are countries where he'd be unable to say what he wants, but there are also a lot of countries (e.g. in Europe) where his political views are reasonably close to mainstream, to the extent where he's no more controversial than the average left wing politician and his main problem would be that he'd be one of many voices saying similar things.

It seems strange to address raver's comment about liberty of critique by saying Chomsky is less controversial in Europe and his views are close to the mainstream.

Th test of a country's liberty is better illustrated by the spectrum of allowed speech rather than whether or not an opinion corresponds with the mainstream. And in my opinion, the spectrum of allowed speech is narrower in the average European country than the US.

Reagan joke:

"Two men, an American and a Russian were arguing. One said, in my country I can go to the white house walk to the president's office and pound the desk and say "Mr president! I don't like how you're running things in this country!" The Russian said "I can do that too!"

"Really?"

"Yes! I can go to the Kremlin, walk into the general secretary's office and pound the desk and say, Mr. secretary, I don't like how Reagan is running his country!"

Are you serious?

I wonder what Barrett Brown would say about this topic, if he wouldn't sit in prison right now: http://boingboing.net/2015/01/22/barrettbrown.html

Are you aware that (h)activists from around the world do not travel to the USA because they fear the consequences, having their equipment seized or being imprisoned? Do you know why Laura Poitras is living in Berlin right now?

I am serious and I am aware of the issues you raised.

Meanwhile Turkey has to remove pages from FB because they're "offensive", not to mention other issues that happens in the ME.

I am certainly not saying the US has the better situation, and Europe looks good, unless you "offend" some groups of people...

And if you think censorship by DMCA is bad in the US you should know the German GEMA.

Please note that freedom from critique of a country usually is much stronger while being outside of that country.

"in any other country" reads a bit different than "turkey and some middle-east countries".

This is rather about free speech than about copyright issues which GEMA and the DMCA deal with.

Have a look at the Freedom of Press Index, where the USA are behind Botswana and El Salvador: https://en.wikipedia.org/wiki/Press_Freedom_Index

Canada, and most of the European countries, have successfully prosecuted ordinary people for "hate speech" for saying things that upset people of certain classes.

"where the USA are behind Botswana and El Salvador"

You mean, in position 46 of 180? Higher rated than Italy, Taiwan, South Korea, Chile and Japan?

Not the best position, surely, almost on the Top 4th

Nice attempt of data manipulation, btw, also implying that Botswana and El Salvador should not have good freedom of press "of course"

I don't see where your claim of data manipulation comes from, people have clearly answered the question you were wondering about.

The answer being yes, according to reputable sources, Chomsky would have that liberty of critique in many other countries and in several countries it would appear that he would have more.

Being a "journalist" is not, and shouldn't ever be, a magic get-out-of-jail-free card. In Brown's own court motions, he agreed that he had threatened the lives and families of FBI agents, and that he had hidden evidence during a warranted search.

I ought to face jail for doing those things. So should Brown.

What would have happened had he been a politician?

Unfortunately, that depends on how popular the politician is.

I hope this isn't some weird "because some politicians might get away with obstructing search warrants and issuing death threats, then journalists should be able to get away with it, too." You don't fix a carve-out with more carve-outs.

> Are you serious?

I'm sure he is, and I agree with him.

On the less serious side, it's like that old joke about American and Soviet journalists, who discuss freedoms and yelling "Down with the USA" at the Times Square and Red Square, respectively. You can do the same at both places without fear of consequences.

What are you agreeing with though? Raverbashing didn't make a statement, he proposed a question. One which has been pretty well answered.

As far as your joke goes however, have you tried standing in Times Square yelling "Down with the USA"? I wouldn't think it would be that safe an enterprise.

I wonder how much longer he'll have that liberty in the US.

Have a look at the Reporters Without Borders press freedom index.

http://en.wikipedia.org/wiki/Press_Freedom_Index

There are 45 countries that journalists rank as having better press freedom than the USA.

edit - For comparison, I just looked at the "Freedom of the Press" report by US NGO Freedom House. It has 21 countries with a better rating than the USA.

Not sure why people vote you down for sharing your opinion. Having said that, your logic is fundamentally flawed. Governments have to either focus on attacking or defending. Focusing on attacking means keeping a lid on vulnerabilities, which weakens the security of citizens and corporations inside their own country. Focusing on defending means disclosing those vulnerabilities in order to protect everybody, which also means those vulnerabilities can't be used in attacks anymore. You can't really have both.

The best defense is a good offense.

I just explained to you why that's not true. Let me try again:

Attacking a computer means finding a bug and keeping it secret until you use it to attack said computer. Defending a computer means finding a bug and disclosing/fixing it so that nobody can use it to attack said computer. I hope it's obvious to you that these two ideas contradict each other.

Please let me know if you have questions. This is very important and not intuitive at all. I'd love to help you understand it better.

Attacking someone who is attacking you is also a form of defense. Please let Sun Tzu know if you have questions. This is very important and not intuitive at all, though I don't particularly care about helping you to understand it better since it's considered common knowledge in the modern era.

I can do this all day: In order to be able to attack somebody who's attacking you, you need exploits available to you. If you have exploits available to you, you're making yourself attackable. Do you really not see the problem here?

I see the problem is in your statement

>If you have exploits available to you, you're making yourself attackable.

Do you?

Not disclosing vulnerabilities is not a question of attacking or defending, it's just stupid to keep vulnerabilities open.

I also didn't propose to uncompromisingly favor attack capabilities. I still don't think effective cyber defense is possible on a national level without leading the edge on offensive abilities as well.

I really don't want to explain it a third time, so let me just ask you a question instead: How do you lead the edge on offensive abilities without keeping vulnerabilities/bugs secret? Let me rephrase that: How do you lead the edge on offensive abilities without weakening the security of the people who are paying your salary; the very same people you swore an oath to protect? Please explain to me how that is possible on a technical level. If you can't, or you still don't really understand what I'm talking about, that's fine. Just ask.

---

I'm gonna explain it a third time. (Looks like you don't want to talk to me.)

Having offensive abilities means having one or more remote exploits ready to use. Having remote exploits ready to use means sitting on undisclosed vulnerabilities. Sitting on undisclosed vulnerabilities means weakening the security of the people you're supposed to protect.

It's quite simple, really. You can't remotely attack a computer without remote exploits. I only count remote attacks as "cyber warfare".

Remote exploits work surprisingly well on unpatched systems, stupid users, malconfigured hardware/software and if that doesn't work, maybe it's time for a bit of oldfashioned humint.

Right on the GCHQ website it states: "In addition, we are also pleased to announce that GCHQ and MI5 are working with their US partners to further strengthen UK-US collaboration on cyber security ..."

I think it is fair to say they all use the same tools!

What's the feeling on the morality aspect of this? In a way it seems like the same situation as if US designed and manufactured weaponry were used against a US friendly power by some third party - is it analogous though?

If so, can the people and companies that were affected file a class action?

Class action might be a solution for US citizens. The problem with malware though is that you end up infecting a whole lot of innocent civilians all over the place, which the people in Den Haag have slightly mixed feelings about. To be honest, I'm a bit disappointed that these cases never end up in international courts. The rules we have in place seem pretty clear to me.

Unlikely, you can't sue the Federal Government without its permission. In any case the NSA would simply say "national security" and boom you are done.

Then sue Alexander and Clapper for their roles, and lay the case that their actions were not in the scope of the office they held.

Then the government says nothing, and bad people get prosecuted.

For some malwares that may be true, but I doubt Regin was that sloppy.

Why not? Stuxnet got into the wild and I wouldn't consider it sloppy at all.

There's a big difference between "got into the wild" and "caused harm to innocent users".

What rules do we have in place?

AFAIK there are no widely accepted international conventions that would forbid, say, USA goverment to install malware (intentionally or unintentionally) on a german user's computer; if you can name as specific one then that would make this discussion much more interesting. International law is not particularly restrictive to the rights of governments to attack each other or their citizens if they desire so; the citizens don't have much recourse in international courts if a foreign government accidentally killed them, much less damaged their computer.

Given that you've used Germany as an example, I'd recommend this german podcast to you which explains the legal surroundings in great detail: http://alternativlos.org/25/

The NSA is tasked with doing signals intelligence so I get why they would develop some hacking abilities but you have to wonder where the break over point is with the money they are spending...at some point they are spending enough money that they could actually make a difference in improving our software and infrastructure. I mean, one of the reasons they say that they need these capabilities is because we are so vulnerable...how about actually helping out?

They do. They have lots of documents and guidance on best practice for security. As for code, they started the SELinux project. http://en.m.wikipedia.org/wiki/Security-Enhanced_Linux

down voting on HN has become absurd. Also noticing this on other comments in this thread.

I think the problem is the consensus is the NSA/GCHQ use the tool. Your disagreement is whether the NSA/GCHQ originated it. Your comment reads as if you disagree with there being proof of any use, based on the evidence in the article.

There's very little doubt the NSA/GCHQ use the tool.

Here's some background reading:

https://news.ycombinator.com/item?id=8649402

https://news.ycombinator.com/item?id=8653454

https://firstlook.org/theintercept/2014/12/13/belgacom-hack-...

Whether they originated it, though, is the crux of the issue. Nobody doubts that government agencies undertake cyberwarfare. But the idea that they might have created something that is now being used by nongovernmental parties is the scary thing - it's like saying that the Army lost a cache of weapons now being used by ISIS. (Which itself is true [1], but that's another story.)

[1]: http://www.businessinsider.com/isis-captured-a-key-syrian-ai...

> But the idea that they might have created something that is now being used by nongovernmental parties is the scary thing

Who has that idea? I don't see anyone saying that.

also: http://www.nytimes.com/2012/06/21/world/middleeast/cia-said-...

Ignore initial downvotes.

People usually supply corrective upvotes if the downvote is unfair.

fare enough. but wondering what the value down voting brings at all, or if current model of blessing according to activity gives better results than blessing random users or randomly blessing users with N down votes per time or other quantifier. One of the later two would certainly be less cast based. Whereby the cast system of HN is according to "activity" not expertise.

I've been tracking the new downvoting trend for the last week or so. Seems there's a lot of accounts downvoting everything that doesn't coincide with Western Government sensibilities. The recent North Korea and LSD threads (not just my replies, but you can get to the threads from my comment history) are really interesting examples to trudge through and see how many valid replies are sitting at -1 or worse.

Would you care to post/link to how you're tracking the voting trends? I didn't realize that data was available.

I've experienced a couple of really bad downvotes as well lately, and they had definitely no intention of editorial feedback, but it was quite obviously mindless prejudice, almost on the level of /r/politics or /r/worldnews. I wished HN would replace downvotes with a system for short and private annotations, so that people could receive concrete feedback, not something that is vaguely implied by a number. That would also remove the problem that people mindlessly jump on the downvote bandwagon.

And/or, make up and downvotes public. A link from a comment to the list of uppers and downers.

Or make it semi-private, and only the commenter can see the list. But that would just encourage useless activity as commenters selectively out their up and downvotes.

Even better would be to turn on an option for a user to show/hide political posts from the site all together

That would be nice, but in practice, there's no commonly accepted clear criteria for what is "political" and what is not, and any attempts to enforce some such criteria would likely bring arbitrary and unfair results.

which recent LSD threads are you talking about?

> I've been tracking the new downvoting trend for the last week or so. Seems there's a lot of accounts downvoting everything that doesn't coincide with Western Government sensibilities.

I'm not sure what new downvoting trend you're referring to, but I'm pretty sure there is no new anti-anti-Western-government trend on HN.

There's a strong cognitive bias toward seeing one's own views as being treated more unfairly. But as far as we can tell, there's nothing so systematic in voting behavior on the site.

The comment you're complaining about downvotes looks to be at +33 right now. The downvote situation is always in flux, which is one reason why the HN guidelines ask you not to post comments complaining about being downvoted.

I'm going to detach this subthread and mark it off topic now.

your guidance always welcome. i think posting about the community despite requests not to happens because there isn't a thread or forum to discuss administrivia. when people feel something strange or new is happening on the administrative side they are more likely to ask peers what is up rather than email site administrators.

I think that's spot on, but also that having a thread or forum to "discuss administrivia" would be worse than the status quo.

Spoken like a true Stalinist, and so true. It would be complete debauchery. Unless the comments auto-delete after N minutes. This would create a very interesting metric giving insights into psychology at the same time. That is, it would be interesting to explore the relationship between N minutes on downvote thread and number of down vote comments in other threads. With conclusions like "1.2 minutes is just enough downvote-thread time for the individual to feel they released their angst enough while also having a R powered reduction on complaints overall in other threads"

I don't know why HN doesn't do these types of crazy experiments in social/political science. I'd have a heigh day.

Uh, wasn't Regin apparently used in the Sony hack?

No?

No, you're right, belgacom - it was all just reported at about the same time.

There is more than a year difference between the two

Agreed - more than a year between the two. Here is the full rundown if you're interested:

Regin details: http://en.wikipedia.org/wiki/Regin_(malware)

Sony hack details: http://en.wikipedia.org/wiki/Sony_Pictures_Entertainment_hac...

Tinfoil hat: Hypothetically, if the Russian government were angry with the US government and wanted to give them a black eye, wouldn't having a Russian security firm announce to the world that the NSA was responsible for Reign be a good tactic?

Not saying NSA wasn't involved as I don't really trust my government, but when I read the article and saw Kaspersky mentioned, that was the first thing that popped into my head.

I see your point.

In this specific case Fox-IT (Netherlands) said the same thing. They based the claim not on the "source code" but on the fact that Regin was part of programs/processes of the NSA department ANT and mentioned in some leaked presentation slide of them (Source: http://www.spiegel.de/netzwelt/netzpolitik/trojaner-regin-is... (German)).

Thinking about infosec companies that publish impactful findings from time to time there is F-Secure from Finland, Fox-IT from the Netherlands, Symantec from the US and Kaspersky from Russia. Does anyone know about important Chinese/Japanese information security companies?

Reply on news.ycombinator.com