[freshhawk]

This would definitely be the level of security that falls under this statement from Snowden:

Q: Is it possible to put security in place to protect against state surveillance?

A: "You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place."

(from http://www.guardian.co.uk/world/2013/jun/09/nsa-whistleblowe...)

[205guy]

Further thinking along this line: most people in the world today are dependent on their phones and internet for information and communication. A lot of people suspected total listening capabilities and now we mostly know that's the case. But what if the NSA had total interference capabilities, as Snowden's quote implies? I suspect it does.

I've been finding HN to be a hub for all the facets, ideas, and fallout from this news. And the snowball of issues (privacy, gov't, business, foreign relations, internationl trade, future of the internet) is worrying to me. But what if it were suddenly gone?

And just as I had that thought, I started getting errors reloading this thread and the main page. Maybe HN is straining at the traffic, but what if some of that traffic came from somewhere else or some server was remotely hobbled? What if your ISP had "disruptions" of traffic to _your_ IP addres, or your 3G/4G became spotty?

Imagine if someone with total knowledge could track the spread of keywords through networks (physical and social) and then enable "slow-downs" to keep the level of spreading below a critical threshhold? If I didn't see all the articles subitted to HN or didn't have time to read them all because the servers crashed, then I might not be so alarmed at the situation.

We in the US and other European nations go on happily enjoying freedom to access all this information, unlike many countries, but would we know if or when we couldn't anymore?

Coincidence or not: when I tried to submit this, I got a message saying "Oops, our bad. If you see this a lot, shoot us an email at [e-mail]. Be sure to tell us your IP. Sorry, news.ycombinator.com is currently unavailable. Please try again soon." Maybe I need to take some keywords out of the text...

[akiselev]

When I told my grandparents (who now live in Russia/former Eastern Bloc) about what's happening in the US, they brought up this exact issue (with a less tech-oriented example).

My grandmother said that this was the most terrifying part of living in the Soviet Union. Since most of my grandparents were high up military (doctors, not soldiers), aerospace research, and medicine in the Soviet Union, they saw the reality of the USSR with a lot less propaganda. When they went back home or visited family in other parts of the country, they would immediately enter into a surreal world where the reality described by propaganda was starkly different from the reality they had experienced.

What's even more terrifying is that by nature of their isolation from international news sources and dependence on TV, most of America already lives in roughly this reality. The world as they see it is shaped by television.

[flyinRyan]

After living outside the US for a decade, this is how I feel when I go back and watch the news.

[blaenk]

Today was the first day of WWDC 2013 which announced iOS 7, Mac Pro, OS X Mavericks, and iTunes Radio. Strenuous traffic load is expected this time of year.

[205guy]

Yeah, not sure what I should think about HN when NSA surveillance threads had more points, but Apple announcement thread (MacPro) had more comments (and typical fanboy and haters comments).

[conradfr]

Well can they do that in Richard Stallman's laptop ? If so we are doomed :)

[tlrobinson]

Possibly, if they had say, a backdoor in all Intel/AMD processors.

The question is what he meant by "We can plant bugs in machines."

[SilasX]

Not even then. I remember reading about how he uses the freest (as in freedomest) setup he can get:

http://stallman.org/stallman-computing.html

He mentions its a Lemote machine which doesn't look like it uses an AMD/Intel processor, as it uses Longsoon:

http://en.wikipedia.org/wiki/Loongson

"Unlike processors from Intel, Advanced Micro Devices or VIA Technologies, Loongson does not support the x86 instruction set. The processor's main operating system is Linux, while in theory any OS with MIPS support should also work."

[BCM43]

Actually, iirc the Chinese made that processor because they were afraid of the US putting backdoors in Intel and AMD chips

[drdaeman]

So they put theirs.

Just kidding, obviously. But one can't be sure their hardware's all right, unless they go way beyond what we'd consider reasonable.

[xefer]

"We can plant bugs in machines" to me sounds more like a clue that this guy really doesn't know what the hell he's talking about.

[phuff]

I think he meant bug as in: http://en.wikipedia.org/wiki/Covert_listening_device

whereas you might be understanding bug as in: http://en.wikipedia.org/wiki/Software_bug

[cpleppert]

Weird phrasing for starters. I mean that isn't how one would describe malware or a rootkit. I can't imagine hardware would be worth the effort if you can just as easily compromise the OS with physical access.

I just don't know what to make of this guys story. He has no high school diploma, started out as a security guard and was then given a diplomat cover as a system administrator?

He further claims that his job as a systems administrator gave him access to NSA analyst intercept software which I find difficult to believe. I can't imagine use of the software isn't physically locked to a machine in a secure environment. You wouldn't expect a systems administrator to have access to everything, which he claims he had, everything is compartmentalized.

[adamnemecek]

But unlike a rootkit, some HW listening device is resistant to OS reinstalls which I can imagine are pretty common with people that the NSA would target. And I can also imagine that it might be more 'cross-platform'.

[rdtsc]

Any experts firmware / low level OS hackers can chime in? I imagine this would be Windows focused, then I guess all bets are off. MS would surely cooperate.

Now what about an Open Source OS. NSA and DoD loves them some RHEL (Redhat Enterprise Linux). Would they pay RHEL enough to produce binaries that have backdoors in them? Yeah, CentOS compiles the sources and that's cool. But most organizations buy RHEL for support.

Well I would say they would be very stupid to do that as if it ever comes out it will immediately destroy their product.

Now, just like PRISM will most likely damage US companies using or offering cloud services, any revelation of an exploit that _could_ have been developed with cooperation form manufacturer would destroy that company's business.

[sitkack]

The hardware would have the backdoor, independent of the software. Think magicpacket http://en.wikipedia.org/wiki/Wake-on-LAN but with a hypervisor rootkit. At least that is what I would do.

[arthulia]

He doesn't use an Intel or AMD processor, he uses some kind of MIPS64 processor called Longsoon.

[cowkingdeluxe]

Why did he not give even a small technical overview on what they are capable of? He should've been able to given he has a lot of technical expertise and it would've helped his evidence a lot.

Did they figure out how to tap complicated SSL? Is it hardware based? He gave no hints but could have easily.

Instead it's this blanket statement that's supposed to imply that all encryption is pointless.

[ryanmolden]

This is not my area, so excuse the ignorance, but this statement:

A: "The NSA has built an infrastructure that allows it to intercept almost everything. With this capability, the vast majority of human communications are automatically ingested without targeting. If I wanted to see your emails or your wife's phone, all I have to do is use intercepts. I can get your emails, passwords, phone records, credit cards."

Specifically the part about 'all I have to do is use intercepts. I can get your emails, passwords, phone records, credit cards'. Does that not imply they have found a weakness in TLS/SSL? Once the information is transmitted (say my Facebook password) to an https endpoint it is already encrypted, no? So them 'sniffing'/intercepting the packets would do no good, unless they could decrypt them.

[jessedhillon]

He was a sysadmin and he didn't finish high school, let alone receive an actual technical education -- he's said a lot of very difficult to believe technical things. I don't mean to imply that only educated people know anything important, but unless he just had an amazing aptitude for learning this stuff on his own, I find it plausible that he had only a slight idea of how consumer encryption works and he actually didn't know what he was looking at when he saw whatever made him leak. Who knows without his documents -- I could be all wrong.

At some point I think he claimed that he could've copied the list of all US intelligence assets, even those undercover. Well, given that the NSA developed selinux to compartmentalize filesystem access in such a way as to make such a breach difficult, I am not sure how to reconcile his statements. I also find it beyond belief that a contractor could actually access what he claims he could've.

[gkop]

Intercept could also mean man-in-the-middle.

[XorNot]

Which would be trivial if they had agreements with the various mostly US providers to quickly get man-in-the-middle signed keys from their CA's.

Although this seems like it would be quick to spot since if you were watching certificate fingerprints change then you'd see the switchover and switchback.

[Amadou]

I use the Cert Patrol plugin ( http://patrol.psyced.org/ ) and I've noticed periods of a few days to a week where SSL certs on major sites like google have changed rapidly. Usually they were all from the same authority so I didn't think much of it. But now I am even more paranoid. Thanks man.

[toyg]

Me too, I stopped using that plugin because Facebook and Google would constantly change their certificates, so I'd end up just clicking OKOKOKOK, never looking at the certificate, defeating the whole point.

At the time, I assumed it was just a snag with the umpteen layers of caching and content-distribution networks that they must be using. Now it looks quite a bit more sinister.

[sitkack]

Could you make a showhn or maybe just reply with a pastebin of security/privacy tools you would recommend?

[ryanmolden]

Yeah, I know nothing about this area (so this is just speculation, ignore it as such if you wish), but it seems getting a firehose feed of all traffic would be easier and less exposure prone, than getting every ISP to allow a MITM and having absolutely no one in the computer security industry notice. Don't get me wrong, I would prefer a MITM, at least then you know they haven't broken crypto that is widely believed secure, the alternative is a bit scarier :)

[antihero]

"Does that not imply they have found a weakness in TLS/SSL?"

Would it not be simpler to get access to a root CA?

[shardling]

Perhaps he thinks that revealing technical details would actually hurt national security? (And I could easily see that.)

His goal wasn't to tear down the NSA, but to reveal what they've been up to domestically.

[steveklabnik]

Glenn Greenwald said on Twitter that he was given the technical details and isn't releasing them.

[gnaritas]

Glenn Greenwald is a partisan hack, his opinion is worth basically nothing.

[waterphone]

In what way is he a partisan? He has condemned as equally bad both the Bush and Obama administrations. When Bush was President, Democrats loved him because he regularly wrote scathing criticisms of Bush's overreaching actions, and now that Obama has carried on Bush's programs (and made them worse, apparently) and Greenwald's criticized him with the same level of intensity, Obama's supporters now seem to loathe him. Reading the things people send him on Twitter, it's disturbing how many people have an absolute hatred of him. It's such a coordinated attack against him, all repeating the same talking points, it brings this to mind:

http://www.guardian.co.uk/technology/2011/mar/17/us-spy-oper...

[gnaritas]

Partisan means predjiduce in favor of a cause, one can criticize Bush and Obama and still be partisan.

[icelancer]

Partisan towards... what? He is a very strong civil libertarian.

[patrickaljord]

Here's Glenn either being intellectually dishonest or intellectually incompetent.

http://www.samharris.org/blog/item/dear-fellow-liberal2

[Amadou]

When I read that I see Sam Harris attributing things like "honor killings" to the doctrine of Islam as if Islam is a monolithic entity. He's equating the extremists with the mainstream and that is exactly what the islamaphobes do - insist that the crazies are the ones who have the true interpretation of islam and that the vast majority of regular muslims don't count because they aren't crazy. It is kind of like saying that all christians should be judged by the actions of the Westboro Baptists. The crazies get the headlines but they only define the fringe, not the mainstream.

FWIW, the one thing I can agree with Sam Harris on is that European integration of muslims (and other minorities) is slow compared to the US because they have less of a commitment to freedom of speech. For all of our racial problems, the US does a better job of integrating immigrant communities because we have a culture of airing our dirty laundry, of hashing out our feelings - bigotry and all - and thus working through the differences rather than sheltering people from possibly being offended. Its ugly and frequently unpleasant but in the long run I think we reach a level of accommodation a lot sooner.

FWIW, I'm an atheist who married a woman from an immigrant muslim family although I've probably been in more mosques than she has.

[Myrmornis]

Greenwald has written many things, most extremely valuable. I also am critical of his exchange with Sam Harris but that's one discussion in hundreds or thousands.

[jongraehl]

Thanks for bringing that up. I'd have to agree that Glenn Greenwald is an intellectual rotten apple. You don't accuse intelligent atheists of "racist islamophobia" if you're a good actor.

That said, he might just have an irrational us vs. them "liberals vs. racists" complex and be able to speak sensibly on other matters.

[gnaritas]

Which makes him a partisan. Perhaps you should lookup the word, it doesn't mean what you seem to think it means.

[grey-area]

I took that to mean that they have exploits they can run once they which will let them take over your machine and install keyloggers etc. to report back any further activity. It wouldn't take much for them to purchase or develop a suite of vulnerabilities for all the major operating systems/browsers which they keep current, and once they have that any encryption is pointless as they can see what you see/type/hear. He mentioned it right after talking about seeing your machine on the network and mentioned hardware bugs separately.

[rdtsc]

Some major military contractors (Raytheon I think is one, BAH another maybe) were looking to hire security experts to find vulnerabilities. There is a robust black market for 0days and I can't imagine the govt. isn't interested in playing. Especially after the cyber-terror war drum has been beating for a while and Chinese hackers scaring everyone's grandmas (most likely articles seeded by PR agencies in preparation for a major contract award to a military industrial contractor).

[asdftmp]

I thought it was common knowledge that governments actively buy and use 0days? They certainly do, just look at Stuxnet's astounding and ham handed usage of 4 0days (in the first version) for an easy example all the way back in 2010.

[drzaiusapelord]

Interesting that he used the word "machines." I wonder if we're talking firmware hacks or even code in firmware that very few people are aware of. Could Intel say no to a NSL without breaking the law?

[jiggy2011]

He says "plant bugs in machines" , so that would seem to imply malware of some variety.

[_bfhp]

The FBI already plants or at least attempts to plant malware on targets (recently: http://www.slate.com/blogs/future_tense/2013/04/25/texas_jud... and regularly: http://www.wired.com/threatlevel/2009/04/fbi-spyware-pro/ )

Also, judges can now order people to decrypt whatever ( http://www.wired.com/threatlevel/2013/05/decryption-order/ )

[wavesounds]

Technical details are in the remaining 37 slides he gave to reporters which they are refusing to release

[davidjgraph]

This doesn't make sense to me. There are two main stages to having your data analysed by such an organisation.

In the first stage everybody's data is run through, let's call it, pattern matching, to narrow down a very specific number of cases that have the highest likelihood of doing, having done or planning "something".

In the second stage, you might apply more resources to gather more data from your suspects, for example, by planting bugs.

But if you avoid triggering suspicion in the first stage, you don't have to worry about their capabilities, you're just not on their radar.

You might then argue that anyone encrypting their chats would then raise suspicion. Ultimately, such organisations have a finite limit of human resources to apply, certainly not enough to deal with any wide-spread usage.

If this were to happen, think from those organisations point of view. They need to stop it and can't scale to deal with every single case. You'll then find that encrypting your chat becomes against Google's T&C, because someone lent on them. And round it all goes.

[6d0debc071]

I was wondering the opposite: How do you get as many people as possible to trigger the match so that it becomes a losing proposition to do this sort of traffic monitoring.

[Myrmornis]

Getting them all to make online friends in foreign countries would do it. Iran, Yemen, Gaza, lots of places would trigger I would think.

[XorNot]

I don't know how many known terrorist organizations would you like to correspond with on a regular basis?

[6d0debc071]

You wont catch me that easily Mr CIA Man ;)

#

I don't know, I mean that is is a concern: If not enough people fake the attributes you'll get shit-listed. My answer is really that it would depend on the terms of the activity.

I've thought of a couple of ways of doing it.

One is that:

You need to be part of something, I think, that's in general use and automatically sends junk data that can't be read (i.e. encrypted nonsense) between its nodes such that being part of a network isn't distinguishable from the junk connections that the program makes on its own.

The other way I can think of is that:

you have all communications public but encrypted and posted in one (or several depending on the throughput of the service) online bins. Since many people access the same bin and download the same data but can only read their own the meaning of the message becomes dramatically more worthwhile than the traffic-a stuff.

....

The second one might actually - kinda - be being done already in some form or another now I think of it. Encrypt your message, steg it into a meme-pic, stick it on a popular forum. Since the forum is accessed by thousands of people the knowledge of who it's downloaded by doesn't get you very much :/

[mattstreet]

What about the stage where they just process the hell out of all the data they have about you and keep a profile?

[downandout]

> We can plant bugs in machines.

I've long thought that NSA and CIA would be buyers of access to botnets with backdoor access to people's machines in the US and abroad. You can buy surreptitious installs of your own malware from other malware providers very cheaply - usually under $1. $300 million and you have the whole US covered. It wouldn't surprise me a bit if there is a budget for this, with agents actively interacting on forums, buying (and supporting) certain areas of the cybercrime economy.

[XorNot]

Or you know, he's referring to actually physically bugging the machine with a hardware keylogger. Which, for someone you're interested in, is way more reliable then simply hoping they're still using unpatched Windows.

[downandout]

That seems like a lot of work and far more targeted than would be consistent with their recently revealed MO (although I am certain they do this in limited instances where "necessary"). These programs seem to have a primary aim of maximum efficiency and mass surveillance. Deploying hardware doesn't seem to fit that description.

[unreal37]

I think he's referring to how the CIA was able to get the Stuxnet/Flame worm to disrupt the Iran nuclear centrifuges.[1] If the CIA or NSA want to put a virus on your machine, they can. Easily.

They can literally plant a worm or virus anywhere they want, because humans make mistakes. Heck, imagine they have hacked into the Windows auto-updater somehow and your own computer downloads and installs software on the first Tuesday every month without you even doing anything.

[1] http://www.news.com.au/technology/cia-suspected-for-super-we...

[tptacek]

In other words, NSA is approximately as capable as your typical plugged-in "black hat" hacker.

[dustingetz]

it seems they would have to specially target you though, basic encryption can evade the passive dragnets. Which is most of the problem - we don't want our free speech of 2013 coming back to haunt us in 2023.

[rubikscube]

This talk about "bugs" in machines makes one wonder if that is related to why Intel was one of the companies mentioned in a recent article. Intel stands apart from the rest of the companies. Google, Apple, Facebook don't specialize in hardware.

[youngerdryas]

Apple obviously does specialize in hardware and if you use iMessage it is already encrypted.

[fintler]

Why bother with bugs when they can just use van eck phreaking? I think it's safe to say that most cots hardware isn't tempest shielded.

[simgidacav]

How would you implement a decent backdoor in your hardware? Would it be supported by software? How do you force the TCP/IP stack of someone's FOSS operating system to send unwanted data?

IMHO he was referring to some backdoor in software. How about a nice ubiquitous piece of software? Windows? JVM?

[tlrobinson]

While it's a bit tinfoil hat, it's not impossible that there could be hardware backdoors in processors or other hardware triggered by a very specific sequences of packets.

[mattstreet]

What would be hard is also making sure that packet sniffers in the middle wouldn't be able to detect it. Specially with all the varieties of router hardware. Are we going to have a backdoor in all of them that prevents passing on that data?

[XorNot]

And you know, given the tens of thousands of people involved in chip design, are we to think that absolutely no one, anywhere, would've leaked that there was some anomalous circuitry in the chip designs which they were told not to worry about it?

[cyrus_]

It would probably be added pre-fabrication, not right in the chip design.

[nitrogen]

It could also be added in the firmware, either during manufacture, or via zero-day exploits in the firmware. The largest entries in /lib/firmware are all for network cards. Since the NIC has DMA access and can interrupt the CPU, the NIC firmware could be used to attack the OS.

There's still the question of packet sniffing by an intermediate device. The attacker would need to control (the network interfaces of) every device in the chain, use the ability very rarely to avoid detection, or hide data in packet metadata that is later decoded by interception equipment. This third option is probably fairly straightforward on any NIC with TCP checksum offloading.

[rorrr2]

"We can plant bugs in machines" doesn't mean that they can do it remotely. That would actually be a serious serious backdoor and would put all kinds of businesses in mortal danger - banking, credit card, online shopping, etc.

Imagine what one rogue NSA employee can do with that kind of backdoor access.

So ENCRYPT EVERYTHING, and don't believe this propaganda. If your hardware has a backdoor, you're fucked no matter what, but businesses are fucked much much more.

[sneak]

> So ENCRYPT EVERYTHING, and don't believe this propaganda.

One of the best things you can do to improve your OPSEC is to stop believing in meaningless panaceas like "ENCRYPT EVERYTHING". There are many weak points in cryptosystems beyond the algorithms (key generation, management, and distribution famously come to mind), and many weak points in data security systems beyond cryptography.

Spouting meaningless catchphrases doesn't help anyone.

[JJAbhrams2244]

I see no reason that this couldn't be true. There are probably many checkpoints to access the backdoors. The reason they don't use it is because once they admit it, there would be a huge backlash

[rorrr2]

Assuming all hardware has backdoors (an unlikely scenario) and giving up basic encryption that can protect you in case when there are no hardware backdoors (a likely scenario) is counterproductive.

I see no reason that Zeus shouldn't exist. Should I be worried that he would strike me with a lightning? Not until I see evidence of Zeus existing.