Hunting for Hackers, N.S.A. Secretly Expands Internet Spying at U.S. Border
nytimes.com
nytimes.com
Now, I realize that, as an intelligence agency, NSA's core mission is to spy. But I take issue with the intentional weakening of our infrastructure, e.g., Dual EC DRBG. You don't see DOT going around sabotaging asphalt production.
Funnily enough, the NSA has a dual mission: spy on their communications, protect ours. Now that everyone uses the same tech, one of those missions has overshadowed the other. Makes their weakening even harder to stomach, eh?
Heh, you might want to read up on Dual_EC_DRBG.
Technically you're right, and I think that people who claim that these missions are fundamentally at odds have not fully games out what options the NSA have; where they see fixing bugs as the only way to increase security, but despite their responsibility being technically only to the government, there has been quite a push for the NSA to help defend civilian networks too since they're being routinely targeted by nation state actors too, and the economic damage there is arguably worse.
Even more funny, if the NSA succeeds one part of their mission, they fail the other.
Therefore it's an impossible mission... so they've just seemingly resorted to only the spying part...
It seemed like pre-9/11 the NSA was doing both of their roles (spy and strengthen) but since 9/11 all they do is spy and ignore the other role.
Maybe that role should be moved out of the NSA completely, and they can just concentrate on spying and let someone else concentrate on improving digital security. It is fair to say that those two roles are somewhat contradictory.
Privilege escalation on stock Linux systems has never been a major challenge, attackers can then simply turn off SELinux or modify the rules once they get root - as plenty of public exploit PoCs have demonstrated. Which is more of a indication of the state of Linux kernel security rather than MAC software.
Sysadmins seem to talk highly of SELinux, but its rare to find people in offensive infosec who do.
Not to mention attackers can use SELinux toolsets to gain root: http://seclists.org/oss-sec/2015/q1/1011
SELinux is very much geared in mind to the often baroque security protocols of government agencies, defense companies and certain enterprises. It may be cryptic for many other use cases.
https://securityblog.redhat.com/2015/05/13/venom-dont-get-bi...
I could easily find a dozen plus 0day attacks which SELinux mitigated in Fedora/CentOS/RHEL, but there is no point in responding to a troll with much more than the minimum necessary.
Sections 214 and 217 of the Patriot Act arguably authorize this surveillance. Or maybe FISA 702. But journalists have zero imagination or critical thinking skills and need powerpoint slides directly illustrating things. And they'll immediately forget even what the slides show when Congress promises that a new bill outlaws that.
http://www.nytimes.com/2015/06/03/us/politics/senate-surveil...
Lot of journalists have been pointing this out about NYT for a long time. (This is not to say NYT only trumpets what us officials say, just maybe, they don't always provide enough context an skepticism.)
Also worth noting that NYT is hardly the only place that does this.
In a recent Frontline episode[1], they do a good job of speaking to some primary sources about an interesting specific instance of story killing related to domestic surveillance, and how that fed into Edward Snowden's decision regarding publication venue for his whistle-blowing leaks. In my eyes, they've fallen a long way since the days of the pentagon papers.
[1] United States secrets, part one.
In a world where hacking has left teenage basements and has become weaponized and used by governments around the world - collecting information about foreign hackers is a legitimate use of surveillance powers for Military self defense.
> "hacking has left teenage basements and has become weaponized and used by governments around the world"
Source? Particularly with respect to "weaponized". The worst I saw was North Korea alledgedly being responsible for pirating a crappy movie, and a 10 minute shutdown of github a few months ago.
> "Military self defense."
Who and what are you afraid of? And how does this policy help with that? No truly dangerous information would ever come close to US borders. This, just like massive traffic collection, can only be said to be an invasion of privacy for the average man. The people we'd like to catch were never at risk at all.
I just don't buy into the fear, and I see the consequences as huge.
Terrorism is modern day McCarthyism.
> Source? Particularly with respect to "weaponized".
The best known examples are Flame/Stuxnet. [0]
[0] http://www.washingtonpost.com/world/national-security/us-isr...
> Source? Particularly with respect to "weaponized". The worst I saw was North Korea alledgedly being responsible for pirating a crappy movie, and a 10 minute shutdown of github a few months ago.
Arguably it has been "weaponized" by the NSA and their allies. See, stuxnet and related threats. There is good reason to believe other nation state actors also have "weaponized" threats. For instance the recent "man-on-the-side" DDOS attack via the great firewall on github. There is also a healthy business for buying and selling vulnerabilities and exploits and the .gov organizations are known buyers.
So yes, I think it is fair to say that "hacking has left teenage basements". That part of the statement the gp's statement it obviously true when you look at say sophisticated carder rings.
Yes, sure. But it's modern day McCarthyism viewed through the lens of loss of profits from the collapse of the Soviet Union. That is, without a Russian Bear to scare people with, the US intelligence community can't get money at will. Once Osama bin Laden was shot to pieces, Al Queda lost a lot of its terrorizing power, so now it's "ISIS" or "ISIL" or "Islamic State". There's Al Shabab and Iran and probably some others to have always been at war with waiting in the wings.
Way to trivialize it. That attack lasted 6 days.
http://www.techrepublic.com/article/chinese-government-linke...
Soon I'm sure they will find another moral hazard to use to justification whatever overreaching powers they want this week.
The answer for how long is easy...so long as the Gov is willing to fund the hunt there will always be a boogie-man.
That's my takeaway. The US executive branch is letting the NSA and FBI, spy on its own citizens, but doesn't do anything that would practically reduce real problems.
Monitoring a relatively docile citizenry to ensure it doesn't create a threat to those in power is much easier, especially if you can scare them into it with the terrorism boogeyman.
I'm sure there are individuals and even small groups within the NSA and FBI doing legitimate work to track down and neutralize real threats to the United States. I suspect, however, that they and their budgets are greatly overshadowed by the Keith Alexander types who see their organizations as an authoritarian playground and a stage for creating further personal private-sector opportunities.
There was a time when working in such agencies, if acknowledged, was a badge of honor. Now, it should be a mark of shame.
The FTC seems powerless to stop Cardholder Services, or perhaps is actually in cahoots with them. None of the phone companies care, they're still getting their monthly payments for your cell phone, so they'd almost rather have "Anne" robocall you. It's up to someone outside of the telecom system, and it's captive regulatory apparatus, to stop Cardholder Services. Who better than the NSA and their domestic tools, the FBI? They can find the hacked PBXs, track the boiler rooms, and send in SWAT teams to make sure the boiler rooms are shut down, and salt is plowed into the ground there. That would be a real problem they could deal with, and not even reveal their Sekrit Teknolgie!
The FCC just needs to start handing out fines, tracing the liability up. So if little VoipCo signs up some guy from XX and lets him set any calling number without verification or lets him make a high rate of calls, bam, fine VoipCo.
It's easy and the FCC could clean it up in a couple of months. They choose not to.
You get what you allocate your resources toward having. For now, security is a sideline, a hobby.
I'm not sure how we can change the government's (executive mostly) mind on this. Right now it thinks more offensive capabilities + more surveillance = cybersecurity. Just like with the War on Terror, they're using "cyber terror" to give themselves even more power, instead of actually solving the problem.
Thanks to the Iraq war, the USA set in action what led to the creation of ISIS, and with its war on strong security and encryption, it's making all of us less secure, and therefore more open to cyber attacks.
So it's worse than "not having a real solution" to these problems. They are actually exponentially making the situation worse with their "solutions".
Plus it is hard to get a visa.