Confessions of a Cyber Warrior

snydeq writes "InfoWorld's Roger Grimes interviews a longtime friend and cyber warrior under contract with the U.S. government, offering a fascinating glimpse of the front lines in the ever-escalating and completely clandestine cyber war. From the interview: 'They didn't seem to care that I had hacked our own government years ago or that I smoked pot. I wasn't sure I was going to take the job, but then they showed me the work environment and introduced me to a few future co-workers. I was impressed. ... We have tens of thousands of ready-to-use bugs in single applications, single operating systems. ... It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface.'"

Comments

saber rallying

[ThorGod]

Does this sound like boasting to anyone else? It's like a more modern version of having the press watch an explosion of their latest bomb.

Re:saber rallying

[Crudely_Indecent]

Makes sense to me. Software/hardware vulnerabilities are worthless once patched. If this group is tasked with having a way into any system, their main focus is going to be to not-only find exploits, but also to protect those exploits for future use. I have no doubt that such a group exists, and that their collection of exploits is extensive.

Hopefully those exploits are used against our enemies and not against us, but that's probably just a silly hope.

Re:saber rallying

[Dan East]

If it's used against "us" then the likelihood of it being detected and disclosed is too high. They can't utilize these exploits carte blanche, but would have to save them only for specific targets, and still they face the risk of compromising an exploit every time it's used. Any evidence collected in this manner is not usable in court either, so it's really only useful for the spy game against high value foreign targets.

Re:saber rallying

[jc42]

Hopefully those exploits are used against our enemies and not against us, but that's probably just a silly hope.

What enemy? China? Don't make me laugh.

Nah; anyone who has been following security-related news stories for at least a few years understands that the primary enemy of any government is its own citizens. They're nearby, where they can vote against you, take you to court, or shoot at you. None of these threats are easily available to people in other countries.

Just dig into the histories of the related US agencies (e.g., HUAC or the FBI or even the CIA) in the 1950s, 60s and 70s. How many external "enemies" -- or domestic "subversives" -- did they ever catch and prosecute? Pretty close to none at all. How many citizens did they attack and serious injure (either their reputation, finances, or physical well-being)? Lots and lots of them.

This story is only news to someone who isn't familiar with the long, documented history of such activities. Fact is, your government considers you more of a threat than pretty much anyone outside its borders. This is especially true if you're involved in any activity that threatens the income (especially under-the-counter income) of anyone in your government.

Re:saber rallying

[jeffmeden]

I call BS on that guy. He claims there are 5000 people working there. At $100k/year salaries (and it's probably more), that puts this program up to at least $1 billion dollars per year for payroll and equipment. I would assume there is some accounting for that kind of spending.

The US spends upwards of $500B on "Defense" each year... Do you really think a missing $1B would get noticed here and there?

Re:saber rallying

[cold fjord]

Once again we have Anachragnome posting his crackpot conspiracy theories about me. If you bothered reading his post above and find it persuasive, then you should read this post of his, and note this line:

This is East Germany, all over again--the NSA literally has us spying on each other, inadvertently or not.

Anachragnome seems to think that everyone is spying for the NSA. Who is it doing all this mutual spying? If you stop and think for even a moment you realize that the idea is nonsense. But it does play into his fear inducing agenda, including attempts to make people suspicious and fear me. He is engaging in the very same sort of behavior he is complaining about. By spreading fear he hopes to control people, to stamp out opinions he finds disagreeable, and control discussions. Ask yourself - are you living in fear? I don't. And yet he seems to want you to. Why?

Anachragnome seems to find great significance, even to the point of it being evidence that I am a government agent, that I have a different viewpoint, a minority viewpoint among the population of posters on Slashdot. For some reason he can't accept that different viewpoints don't constitute a conspiracy. What is the purpose of having civil rights if we all have to believe the same thing? I thought that was what fascism was about.

Further evidence that his claims are nonsense is the fact that he thinks that I am both an NSA plant and that I have multiple accounts named with a common theme, no doubt including the recently created troll accounts that have been trying to harass me of late (coid fjord, and co1d fjord). That would seem to be pretty pathetic tradecraft if that were the case. His view is just another sad example of a crank seeing a pattern in the noise that doesn't really exist, and thinking it significant. Go ahead and read from the two troll accounts. I don't think you'll find much evidence to support Anachragnome's nonsense view. (If you think you have, read more of the thread and check UIDs.)

Apparently the only people that disagree with him are spies. Bow to his power, or you may be branded a "shill" and "forum breaker." Submit to his fear. He expects you to inform on each other. Obey him, or you may be branded a traitor too.

Or maybe he is just a crank full of suspicion and fear that should be ignored. Take your pick.

Re:I have to ask...

[alen]

first the knowledge of the bugs is classified. better to know something that the enemy doesn't
and most of the government's data isn't classified so its not that big a deal

Re:fud

[h4rr4r]

Or they would take the money and disclose the vulnerability. Enforcing an NDA in this case would give away that these exchanges are on going.

If true, a profound disservice

[Anonymous Coward]

So, if what's being claimed is true (I'm doubtful), by not making these flaws public and giving vendors the chance to fix the issues, they are jeopardizing the domestic infrastructure they are ostensibly tasked to protect?

There's something profoundly inconsistent in this story, or profoundly hypocritical if it is true.

And he plays in a "hardcore rap/EDM band"? Either this person is an idiot for revealing something so specifically identifiable (even among "5000 people on my team", how many others of them are into it that much?), or they're spinning a yarn (misdirection or the whole story is nonsense).

Re:Rings of bullshit.

[gl4ss]

If a hacker could hack into a megabank, airline, hotel chain, etc, how could you possibly pay them enough to ensure that not one of them makes a nice life for themselves?

well... by keeping them in a surveillance hell I suppose. he could still do it but he couldn't use any of it.

but the article smells like bullshit. tens of thousands of exploits ready to go to any controller(I suppose that means industrial controllers and such, fucking vcr's etc) and cracking any sw ever anywhere. fuck, there's some sw's that don't have enough of an attack vector at all. practically the only way it could be remotely true would be if they counted exploits they didn't even try and they counted platform exploits as exploits for sw on the platform(so, say java applet sandboxing has a hole in it = thousand exploits even if they're all the same). he's even claiming that no patched exploit used by malware authors affected their exploits in any way.

of course, it's infoworld - the bullshit heaven. the weakest defence the magazine had was the journalist. the fucking article starts with 15 year old as head of IT, then 16-17 year old having 100k worth of equipment for "hacking the airwaves" and just leaving it in a shed, it then downgrades to "I was writing buffer overflows and doing fuzzing" and watercooled computers in trucks.

Mr Grimes, go fuck yourself. either the facts are fabricated or the guy outed himself by the few details(15y head of it at federal hospital, spent time abroad with his mom) and the rest are just.. bullshit you could have made up. so where the fuck is the story?

Re:Scary thought

[meta-monkey]

Voting machines?

Dude could save the country and be a national hero. I can see CNN on election night 2016 now...

Wolf Blitzer: "In a shocking turn of events, not a single Republican or Democrat, or anyone on the ballot for that matter, won a single national election today. The entirety of the Senate is now made up of 20 random engineers, 15 doctors, 10 accountants, 10 school teachers, 10 construction workers, 5 disabled veterans, the 5 honest cops, and the rest are mexican day laborers. There's not a single lawyer or millionaire among them, and the new President is comedian Doug Stanhope."

Re:Sounds like complete bullshit...

[Flere Imsaho]

Yeah, a lot of it sounds far-fetched to me as well.

" Most of the software written in the world has a bug every three to five lines of code. " Sure, buddy.

"It's all zero-days. Literally, if you can name the software or the controller, we have ways to exploit it. There is no software that isn't easily crackable. In the last few years, every publicly known and patched bug makes almost no impact on us. They aren't scratching the surface." Oookaaay, that sounds legit.

"My loft was up near the rafters, so I scooted over into the next storage area, climbed down" No lock-up facility I've been in has access through the roof space to the roof space into other units. Would you keep "$100,000 worth of computers, radio equipment, and oscilloscopes" in such a facility?

This reeks strongly of male bovine excrement.

Re:fud

[Kjella]

There's a lot of boasting yes, but as I understand it a lot of security bugs are discovered because they're being exploited. If you do all your hacking in a test lab and only use it sparingly and targeting specific computers it might take a long time before it ends up in any security researcher's lab. For example, take this recent bug from Microsoft, it affects every IE version back to IE6 - possibly older since they don't test further. Assuming it was in the original IE6 code base that's a bug the cyberwar division might have been sitting on for 12 years. Multiply that with lots and lots of top notch people and a system that don't disclose and (mostly) don't exploit, just hoard for a rainy day and I have no problem believing they have a pretty solid stash.

However that is also their biggest limitation, if you start using them they'll also become exposed so they're more like deep undercover agents. They're not going to "waste" them trying to catch the odd criminal, even if it's for serious crimes. They're military assets stockpiled for a cyberwar, like being able to crack the Enigma code during WWII. Some of it for espionage but I'm guessing most for being able to strike both physically and electronically at the same time, paralyze or even mislead their systems while you move in.

Re:Poor Infoworld....

[Synerg1y]

Exploit = pipe wrench.