Hacker News Reader

Comment by coldcode | Hacker News Reader

Some at the NSA is having a bad day reading this.

The article says it was first deployed in 2011. Five years is a pretty good run. I wonder what they're deploying right now?

Now they are in the SMC and the secure enclave.

As to the secure enclave, the very nature of a target that's in SO MANY hands, means that's it's unlikely to ever remain secure from a motivated state. It's such a catch-22... buy into the mass production, or have something that might really be strongly encrypted, but stands out like a sore thumb by virtue of not being the mass production model?

>Five years is a pretty good run.

For a project this big & complex, and for something that cost hundreds of millions of dollars to develop, 5 years is paltry. Duqu remained hidden for 11+ years.

Probably to the Intel Management Engine/AMD Platform Security Processor. By the time your machine is booting it is too late to detect the infection. Reinstalls won't work.

If I wanted to own a machine and not be detected, that's where I'd live. It's also complex and closed source so you are basically guaranteed to have exploitable bugs that won't be fixed. It has access to network and system busses at a layer below the OS so ex-filtrating can be done at a layer below what the OS can see.

There's been sufficient evidence that they are involved in hacking/rewriting HDD firmware. See: https://www.wired.com/2015/02/nsa-firmware-hacking/

Bizarrely, the NSA and other US security agencies seem to have very little interest in defence, preferring surveillance and attack capabilities.

There's a visibility bias there: attack capabilities in user are more likely to result in news articles; defense capabilities less so.

If only the media was quick to blame them for cyberattacks that happen under their watch, too. Then they might finally start to care. But because corporate media has such a tight relationship with all the Washington insiders, that never really happens.

One good example from recent times of how well this type of "incentive" works is Google and Stagefright. The media went nuts over Stagefright affecting virtually all Android devices - and for good reason, too.

Since then Google seems to be taking Android security way more seriously, and there have been a lot of serious security improvements in Android (7.0) over the past year.

But these sort of actions seem to happen in slow motion, if at all, when there isn't a hacking/malware catastrophe for which the companies can get blamed in the press.

The NSA pushed hard for new surveillance laws such as CISA with the promise that it's what they need to keep us safe against cyberattacks. So why isn't every single media entity blaming the NSA over every major new data breach that happened since then?

Well, what do you expect them to do for you? Nationalize and manage your IT infrastructure? They and the DoD publish security guidelines for servers, desktops, etc that any business or government agency can follow. Also do you use SELinux? That's NSA as well.

If you want regulation, that's Congress and POTUS, not the NSA.

You have to research and implement new attacks to design its defense.

Not sure why that seems so bizarre; that's consistent with US posture since WWII, particularly strategic posture. Defense through force projection and construction of retaliatory capability. "The best defense is a good offense" is almost an underlying assumption of US doctrine. You don't defend yourself by building walls, you defend yourself by removing your adversaries' capabilities or willingness to use those capabilities.

It doesn't seem as though this has been especially effective with regards to information security, however. There are just too many adversaries, it's too hard to project force against them, and there's not much of an effective deterrent effect by sitting on a 'stockpile' of vulnerabilities yourself.

But IMO the disconnect is almost a fundamental one, because it's an area where what has worked fairly well for the US for 60+ years is suddenly falling flat.

That's a false statement. They work with NIST to develop the standards that are the basis of the infosed industry.

Might be a false statement, but it's effectively true. Defense is part of their charter, but American government and corporations are clearly very vulnerable and are compromised routinely.

At this point I'd argue Google's security bounties have done more to secure the industry.

For the most part, NIST really has no relevance in infosec. With a few exceptions, they're always way behind, and only focus on a few narrow domains.

Literally every compliance standard in the US references NIST 800-53.

In terms of the "narrow scope" assertion: http://csrc.nist.gov/publications/PubsSPs.html

The problem with NIST (and I believe they admitted this is a problem) is that NIST is required by law to use the relevant experts from government agencies[0], which normally is fine, and exactly what you want. However, the agency when it comes to security is NSA, and their in the business of undermining it. Thus the whole ECC backdoor debacle.[1]

NIST seems like a good agency trying to do the right things. It's just that they're forced to work with bad actors.

[0] https://www.accessnow.org/its-not-you-its-me-committee-of-cr...

[1] http://www.nist.gov/itl/csd/sp800-90-042114.cfm

Part of the military culture, there's no glory, no medals, no promotions in a successful defence

"Department of Defence" is so PC, things were much more honest back when it it was called the "Department of War"

Or they're saying, "Oh? That old thing?"

We honestly don't know. It might not even be the NSA.

Reply on news.ycombinator.com