US Navy Soliciting Zero Days
threatpost.com
threatpost.com
So what do we do? Is it time to just start running open-bsd? Should I just assume my systems won't be a casualty because it won't get that hot? Air gap the important part?
The real reason is that we need a new boogieman to justify the level of surveillance. The public, as deluded and propagandised as they are, is starting to get tired of the same ol terrorism argument, so this is the new communism/terrorism, etc.
The point is that it's never about what they say it's about. It's about control. Inverted totalitarianism.
That fiat cash will get tucked away by some established families and companies, revolving doors aplenty, and then a new threat will be invented/created when this one wears out. The Fed, or the people behind it, will sit back with their hands crossed on their fat, corrupt bellies and say, well, at least we'll enjoy the planet while we live. Screw the rest.
I think we're seeing a gross abuse of it, esp. from the leaders of the US and the people pulling the strings. But, I'd like to think we improve over time, despite this kind of evil. And there is no doubt in my mind its an evil, perhaps not biblical, but a vast and greedy, sickening selfishness.
Pity we won't be around to see it if and when it turns right, but time is a great healer. I don't think the level of greed we're seeing now can be turned around in a generation.
Crazy idea though. Can't have anything compete with those beautiful oil, fracking, banking, warring people though - they mean well! I mean, its just short term, we'll just cut down all the forests, ruin all the topsoil, drill all the oil, frack all the rocks and lpg, and ... well, we don't care, go fuck yourselves, we made money, and we don't care about children or grandchildren. Cya.
We're ruled by very greedy, short-sighted people, that don't care what you think, or care what they are doing.
I think we all know what is selfish, and what is greedy. Some will choose to ignore it though, and/or justify it.
The system we have at the moment is geared towards a few, extremely wealthy individuals and companies, and they basically created the system and need to see it continue. And its from the US it came and gets enforced.
There is absolutely no need to have a system we have in the US where the corporations basically call the shots, via campaign funding and revolving door bribery, or for the warmongering. Its like someone holding a gun to your face complaining that the other person "just won't see sense, they refuse to put their gun down". Small wonder, when they're being threatened.
What would make sense for me is for a few people in powerful positions to grow a backbone and start to demand changes; but I think the apparatus is so strong now, that those that do, meet an untimely fate, and the remaining few have courage in the face of certain death/social destruction.
I think we've been had, basically, in a really large way, and I don't see a way out of it. Its a successful, long game play that has won out. Nice if you're part of it, sucks if you're not.
I don't know whether it's optimism or naiveté–or likely some mixture of the two–but the western public tends to ignore how large changes in technology and society can (and usually does) tilt the balance of power towards the establishment.
Said suppression only happens when you can reliably tie identities online to identities offline. Hence parallel construction, etc.
Power consolidation right now is a mixed bag. Those who want power for their own purposes find a good partner with those who consolidate power for noble purposes find a good partner with those who brace for the future, etc.
You can only pick voices from the cacophony if you train your ear in one direction. They are all there and it takes every singer in the chorus to work.
This has been happening since the 90s.
It is true that it has gotten consistently warmer on the internet. There is a term called "hybrid warfare" now that is being traded in the US defense sector.
Hybrid warfare means assymetric capabilities in tandem with ground forces: IO (intelligence operations) with kinetic operations.
IO itself is a broad category consisting of Military Deception (MILDEC), PSYOPS or Strategic Communication (propaganda operations), Electronic Warfare (to disrupt communication, coordination and execution), and Signals Collection for espionage (SIGINT).
The US now considers hybrid warfare the norm and deploys IO operations with every kinetic force. In Syria this meant hacking their air force and grounding their planes - in Ukraine it means winning the 'idea war' in neutral territories and providing morale and information support to civilians and the military alike.
Cyberwar continues to change, as does all war, with the advancement of technology, the capabilities of the parties, the state of the art, and the scale of conflicts. But we've had it now for a couple decades in one stage of evolution or another.
Some control is necessary of any government.
Some control is perceived to be, but is not actually, necessary.
Some control is self-interested and self-concerned.
Some control is conspired by those who seek to wield it for their own benefit.
When it comes to the US government, there's a big mix of the above and its never enough to establish one grand motive behind everything.
This of course doesn't take away your point - it is about power. It's just that the angle on this power has to be negotiated circumstantially and available alternatives. (If there's an simple, cheap and effective way to solve a problem but a power consolidating method is chosen instead the mask has slipped).
I think you're greatly, GREATLY underestimating the amount of collusion that can and does occur.
I don't disagree that there is collusion - I disagree that it is as effective as we give it credit for. Namely, that there is a systematic 'them' which is against 'us'. That the NSA can tap communication is to me an example of very small collusion. It's the level alluded to here that confuses me:
>... a new boogieman to justify the level of surveillance... the point is that it's never about what they say it's about. It's about control. Inverted totalitarianism.
Is there really this kind of 'collusion' going on? Is there a backroom where people say this with a straight face? I'm completely prepared to hear this is the case but I'm trying to find a reasonable explanation. It seems to me these people go home to their wives and kids at the end of the day just like the rest of us.
To build this a little further. I toy with the idea that we ourselves are creating these mythical boogymen and THAT is what hurts our ability to change anything. I don't know :\
I understand your view, and generally agree with your primary point that it's not a single overarching group in total control. The world of Machiavellian Realpolitik is much more nuanced and complex than that, and I mostly chalk it up to our tendency as humans seek to simplify things.
First, I would like to point out that I consider Hanlon's razor a logical fallacy that should be relegated to the dustbin of debate. It is far too often used in the discussion of this matter.
Now to your original question of who "they" is. In short, my conclusion is that it is primarily but not restricted to the supranational aristocratic elite, in particular the ones who desire global governance (at least on the surface). The most obvious example of this is the kinds of people who are C-level or board level who have positions across the world. A good primary jumping point for this would be the analysis of control networks in this very good paper: http://arxiv.org/pdf/1107.5728.pdf
All that paper does though is show the level of interconnectedness, but what it doesn't show is intent. That wasn't your question though and is best left for another discussion.
The bottom line to me is that "they" is the uber-wealthy, and that class-warfare and return of a type of neo-feudalism is right around the corner if not already here.
If you want to know where the collusion happens, look to the round table groups; eg. the council on foreign relations, the bilderberg group, the trilateral commision, and various think-tanks, superpacs, and tax-exempt foundations, and yes, even secret societies. The main mistake though is to think they are all in on it or even understand it. That's not how control at a high level works.
Imagine how control of a secretive org such as the CIA/NSA works. It's so wrapped up in compartmentalization that it's easy to take people who mean well and task them with something they don't understand the bigger picture implications of, and combine many of them to accomplish a big thing that none of them understand but a few key people at the top.
I propose that the majority of "the key people at the top" are comprimised in some form or fashion, so even they are pawns in a game they don't fully understand... many simply want to make money or protect their reputations, though some are most definitely being blackmailed or threatened with much, much worse.
First - I am saddened that a line of questioning could be deemed dangerous. So much for our 'progress'.
> The main mistake though is to think they are all in on it or even understand it.
I hope I have not misunderstood but what you've said really confirms to me that what we see is roughly emergent from individual actors (consider a group an actor as well) seeking out their own interests. Of course it makes obvious sense that people of like status/wealth know closely other people of similar status/wealth. This can only lead to collusion the same way my close friends and I could be seen to collude in relation to our, admittedly, far smaller sphere of influence.
In general I agree with what you've said about Hanlon's razor but I also feel it is a useful approach simply as an exercise. Brute force remains a useful way to find the truth.
Thanks again for your response! I truly appreciate being able to discuss a topic like this without it devolving ala. most reddit boards etc.
I would slightly adjust this and say that the emergent actors are guided and coaxed from a distance, but yes, I agree, at base it is the self-interests that drive it among individual actors. That being said, there were supposed to be mechanisms in place to help prevent such power to accumulate, and it is the deliberate undermining of these separations, and balances and checks, that indicates to me intent beyond simple local non-state actor self-interest.
I also greatly appreciate the fact that HN is one of the few places I feel comfortable enough conversations will maintain a certain level. Honest and open discussion is too far and few between these days, especially on such subjects as this.
Security is all about striking a balance between how hard you make it for the adversary vs how hard you make it for yourself.
Even committing only to memory and never writing it down is not going to stop a committed enough adversary kidnapping and torture do exist after all. The only question is where do you want to draw the line.
Does that mean we need a Second Amendment for encryption?
“What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” wrote Nate Cardozo and Andrew Crocker of the Electronic Frontier Foundation. “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”
But the way the entities operate that are actually seeking these, is by thinking of themselves as outside of the regular set of rules and even reality. They are seeking 0Day exploits with an assumption that the individual or individuals that provide them will not sell them to someone else or even use them for themselves.
I can guarantee that these "cyber wars" are going to result in some sort of cluster-fuck-up at some point because humans have a tendency to entrust the least responsible people with the most devastating technologies even remotely before we fully understand the ramifications.
On a side note; please take note of the fact that many of the current issues regarding anonymity and security on the internet and in technology in general is a direct fractal result of prior decisions by researchers and developers to not focus on anonymity and security as a primary requirement. The internet is a security nightmare, precisely because some researchers decided to ignore security requirements early on.
And who should be responsible for this mission? Are you saying that the offensive and defensive cyber capabilities should be split between different agencies?
> “What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,”
The article mentions that the government itself acknowledges that there is a delicate balance between disclosure and maintaining the ability to accomplish other missions [1]. That dilemma never going away, no matter how the responsibilities are organized.
> “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”
Haven't read the EFF paper yet (and I hold the EFF in high regard), but in the context of zero-days, that quote is a bit of a strawman. You don't burn zero-days by indiscriminately propagating exploits (eg, for mass surveillance), it would be found out pretty quickly. You tap cables and get NSLs for mass surveillance. Payloads attached to a zero-day would be used for more specific purposes, rather than slurping up data en masse.
[1] https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders...
In theory, they already are. The Navy, Air Force, Army, and NSA all maintain somewhat separate cyber capabilities.
Wish I didn't see it now either. What a mess. Long live the petrodollar and killing other humans for a fiat currency.
Still, a gov't agency would surely pay plenty, even for nothing at all, so what's the going rate for “no time at all” these days?
A zero-day (also known as zero-hour or 0-day)