Comment by nickpsecurity | Hacker News Reader

Comment by nickpsecurity | Hacker News Reader

Parent Full thread

Definitely. They could, targets were using it, they were known to tap backhaul microwaves/satellites, their own guideance in high-assurance side was using link encryptors between sites, its in their commercial recommendations (NIPSOM Industrial Security Manual), and so on. Everything in the world to make you think somebody was tapping your line and that they might.

So, some groups that were wise went ahead and deployed link encryptors. Black programs, follow NIPSOM and SAP supplements, sure as hell used link encryptors so good [1] we can't buy them because... national security. I sure as hell used end-to-end crypto and VPN's for anything significant. Google and Facebook... treasure troves of PII and I.P.... didn't for reasons I can't imagine. Result was they got intercepted in bulk by something that's been a known risk for 20+ years. Take NSA out of picture and they should've still thought the lines might get tapped by crooks or foreign spooks.

So, yes, Snowden leaks mostly just taught us what we already knew in greater detail. People ignored it then, some ignore it now, and yeah problems happened.

[1] http://www.raytheon.com/capabilities/products/high_speed_net...

Google's datacenter-to-datacenter links probably weren't going over the public internet, so they didn't feel the need to protect against man-in-the-middle attacks on physical lines that they owned. If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case?

I'm sure that's what they thought. It's so common it's in textbooks. As in, any point-to-point line running outside two buildings through public land and a third party network owned by sneaky, Tier 1 types could never result in eavesdropping by anyone with physical or logical access. It was ridiculous claim when I read it and wasnt doing INFOSEC at the time. Horrendously stupid. There were already link encryptors on market for those exact lines for a reason. A good one in this case.

Far as your contrived example, yes I did recommend Layer 2 or 3 encryption, authentication, and monitoring between all nodes for a variety of benefits. It was also in Red Book (Orange Book for networking) as a high-assurance security requirement due to malicious hosts or tapped lines. All the times I eavesdropped on and screwed with Intranets fully justified it. Moreover, reading the Security Monkey later showed he handled a situation where an intruder did a physical splice of the line into a nearby building for his attacks. Just more evidence.

So, yes, security must be applied to every layer inside of and around endpoints, networks, and more. The risk you mentioned, minus crossover part, resulted in numerous hacks in the real world that my methods and 80's era methods would've stopped. In a PCI form factor, too, as DiamondTEK secure LAN did exactly that.

> If you connected two computers to each other with a cross-over cable, would you feel the need to encrypt all communications between them, just in case?

If I cared about privacy and I couldn't control physical access to the cable? Yes, of course.

The core infrastructure security people at Google didn't know it, from what I understand. Maybe they're all incompetent; maybe they were lying; or maybe the knowledge (not rumour or suspicion) wasn't as pervasive as you say it was.

I addressed it here:

https://news.ycombinator.com/item?id=11553070

Reply on news.ycombinator.com