Slashdot Mirror
Confessions of a Cyber Warrior
snydeq writes "InfoWorld's Roger Grimes interviews a longtime friend and cyber warrior under contract with the U.S. government, offering a fascinating glimpse of the front lines in the ever-escalating and completely clandestine cyber war. From the interview: 'They didn't seem to care that I had hacked our own government years ago or that I smoked pot. I wasn't sure I was going to take the job, but then they showed me the work environment and introduced me to a few future co-workers. I was impressed. ... We have tens of thousands of ready-to-use bugs in single applications, single operating systems. ... It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'"
Does this sound like boasting to anyone else? It's like a more modern version of having the press watch an explosion of their latest bomb.
PS: I don't reply to ACs.
Poor Infoworld.... getting left behind in the Snowdon fiasco so has to do a bit of "Me Me Me.. We're still relevant" crap
Literally, if you can name the software or the controller, we have ways to exploit it.
Pacman?? Didnt think so.
I basically believe the information presented here, but the source could be anyone. It could be a complete work of fiction, and even if that is the case, it may still all be accurate. If someone asked me to come up with a laundry list of things that in all likelihood the feds have, I'd have easily come up with everything listed here.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Oh please. At least half of them are in Java!
"Here Lies Philip J. Fry, named for his uncle, to carry on his spirit"
In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'
For some reason I doubt that private government workers, let alone government contractors, have discovered (let alone classified and organized) more bugs than the armies of security researchers out there to qualify as "barely scratching the surface". More likely the government is paying private security researchers for bugs and the promise of non-disclosure. Even then with how altruistic many researchers are, it's likely that kind of exchange would be exposed.
first the knowledge of the bugs is classified. better to know something that the enemy doesn't
and most of the government's data isn't classified so its not that big a deal
The NSA is under the Department of Defense, which makes it close enough.
So, if what's being claimed is true (I'm doubtful), by not making these flaws public and giving vendors the chance to fix the issues, they are jeopardizing the domestic infrastructure they are ostensibly tasked to protect?
There's something profoundly inconsistent in this story, or profoundly hypocritical if it is true.
And he plays in a "hardcore rap/EDM band"? Either this person is an idiot for revealing something so specifically identifiable (even among "5000 people on my team", how many others of them are into it that much?), or they're spinning a yarn (misdirection or the whole story is nonsense).
If a hacker could hack into a megabank, airline, hotel chain, etc, how could you possibly pay them enough to ensure that not one of them makes a nice life for themselves?
well... by keeping them in a surveillance hell I suppose. he could still do it but he couldn't use any of it.
but the article smells like bullshit. tens of thousands of exploits ready to go to any controller(I suppose that means industrial controllers and such, fucking vcr's etc) and cracking any sw ever anywhere. fuck, there's some sw's that don't have enough of an attack vector at all. practically the only way it could be remotely true would be if they counted exploits they didn't even try and they counted platform exploits as exploits for sw on the platform(so, say java applet sandboxing has a hole in it = thousand exploits even if they're all the same). he's even claiming that no patched exploit used by malware authors affected their exploits in any way.
of course, it's infoworld - the bullshit heaven. the weakest defence the magazine had was the journalist. the fucking article starts with 15 year old as head of IT, then 16-17 year old having 100k worth of equipment for "hacking the airwaves" and just leaving it in a shed, it then downgrades to "I was writing buffer overflows and doing fuzzing" and watercooled computers in trucks.
Mr Grimes, go fuck yourself. either the facts are fabricated or the guy outed himself by the few details(15y head of it at federal hospital, spent time abroad with his mom) and the rest are just.. bullshit you could have made up. so where the fuck is the story?
world was created 5 seconds before this post as it is.
...If they have access to such awesome vulnerability detection software, why don't they run it on all the government's servers and applications?
Sounds like shit.
because they WANT the chinese to have blueprints to their billion dollar jets. you know, that's only way to bankrupt them. also, why don't they hack iran's banking that provides funding for their nuclear program?
world was created 5 seconds before this post as it is.
You talk as if the "government" was a monolithic entity. Its left hand very often doesn't even know its right hand even EXISTS, much less care what it does. Even worse, it may very well be that they don't want other government employees to patch those systems so they can spy on them, too!
If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
Literally, if you can name the software or the controller, we have ways to exploit it.
Voting machines?
Yeah, a lot of it sounds far-fetched to me as well.
" Most of the software written in the world has a bug every three to five lines of code. " Sure, buddy.
"It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface." Oookaaay, that sounds legit.
"My loft was up near the rafters, so I scooted over into the next storage area, climbed down" No lock-up facility I've been in has access through the roof space to the roof space into other units. Would you keep "$100,000 worth of computers, radio equipment, and oscilloscopes" in such a facility?
This reeks strongly of male bovine excrement.
It gripped her hand gently. 'Regret is for humans,' it said.
Oh please. At least half of them are Java!
FTFY
Some blend of three options here:
1) He's full of shit
2) I'm delusional in thinking I write code way better than that
3) Most of the world really is barely held together by bubble gum and duck tape
What bothers me is to what extent is #3 actually the answer.