Slashdot Mirror
GCHQ Created Spoofed LinkedIn and Slashdot Sites To Serve Malware
An anonymous reader writes "Ars Technica reports how a Snowden leak shows British spy agency GCHQ spoofed LinkedIn and Slashdot so as to serve malware to targeted employees. From the article: 'Der Spiegel suggests that the Government Communications Headquarters (GCHQ), the British sister agency to the NSA, used spoofed versions of LinkedIn and Slashdot pages to serve malware to targets. This type of attack was also used to target “nine salaried employees” of the Organization of Petroleum Exporting Countries (OPEC), the global oil cartel.'"
when the quality of the comments section significantly improved.
I know you're reading this.
You're smart. Smart enough to be able to work out who I am, probably without much trouble.
Why don't you do something productive?
Don't worry, this is the real Slashdot right here. I promise.
If I or any /. reader were to do the same, a pretty harsh sentence would await us.
I've got better things to do tonight than die.
There were no dupes, and all TFS's had perfect spelling and grammar.
I am Slashdot. Are you Slashdot as well?
I wonder if it would have been as easy for GCHQ to get away with it if HTTPS on Slashdot weren't a subscriber-only perk. Facebook and Twitter have gone all HTTPS all the time; why can't Slashdot? If ads are the problem, Google recently opened AdSense to HTTPS sites.
I suppose using HTTPS would have helped even a little, if Slashdot ever bothered to do so. The victims might have noticed that the certificates changed, even if they did check out, most especially if they used HTTPS Everywhere. They couldn't just foist off an SSL cert for Slashdot signed by some other CA (or even the same CA) then: the SSL Observatory would have noticed the change in the certificate the way SSH notices that public keys to servers you connect to change. Unless of course Slashdot gave its (non-existent) private keys to GCHQ, in which case all bets are now off. Why browser SSL doesn't automatically cache certs the way SSH does and warn if there's a change that doesn't involve certificate expiry or revocation is something that isn't quite clear to me.
Qu'on me donne six lignes écrites de la main du plus honnête homme, j'y trouverai de quoi le faire pendre.
so they wouldn't HAVE to be productive. All they have to do is listen and let the money roll in.
That's a pretty sophisticated hack. Looks like they've gone as far as setting up an entire site that looks superficially like Slashdot, but is full of grotesquely dull stories apparently designed to warp the minds of unsuspecting IT professionals - obviously some sort of psyop strategy, but to what purpose?:
http://slashdot.org/topic/bi/
They are frauds. The NSA perpetrated a fraud with these actions. This helps to clarify that these acts are illegal. Fraud is illegal.
Thanks,
Sent from my ENIAC
The term "Rogue" is used to denote "dishonest and/or unprincipled".
They used to put USSR, China, North Korea under the "Rogue Government" category.
Both the governments of the United States of American and that of Great Britain have proven to be DISHONEST _and_ UNPRINCIPLED !
IMHO, it's time we should include the government of the United States and that of United Kingdom under the "Rogue Government" category.
And btw, if you see the performance of John McCain, especially how he tried to blame Edward Snowden, you would understand how ludicrously pathetic American politicians have become ...
As an American, I am beyond furious ...
Muchas Gracias, Señor Edward Snowden !
And if you just enjoy playing god, well, go into the City, or start up your own business. If you're that good, then you can perform in plain sight, can't you?
Speaking from experience here ... it's not that simple
I started to plan for my escape from China way back in the late 1960's because of the social madness created by Mao back then.
Thongs of mindless assholes with red armband parading on the street, waving that little red book and plunged the Chinese society into total darkness.
Those of us with brains knew that the things coming from Mao were bullshit, but those without brains who embraced Mao's bullshit outnumbered us 1000 to 1.
So we ran, and ran, and finally I got to Hongkong.
From Hongkong I ended up in the United States, and at that time, the U. S. of A. was a paradise, a place where brainy people get to do whatever they want to do without having fear of official repression.
Some 40 odd years have passed, and the United States is turning into just like Mao's China ...
Everything coming from Washington D.C. is pure bullshit, and the things I have noticed right now is that the mindless fucktards who bought into Washington D.C.'s bullshit are outnumbering those who know better.
While the society in the United States of American haven't plunged into darkness yet, there is no certainty that it won't.
When the controlling regime got desperate ~ (Mao's reign at that time was in danger of collapsing from within, motivating Mao in his encouragements to the mindless assholes with red armbands creating social havoc), ~ they will do anything to remain in charge.
And if (and when) the regime which is reigning over Washington D.C. (democrats _ and_ republicans) is in danger of collapsing, there is NO TELLING what they would do.
To make the matter worse ... they have a lot of very powerful tools Mao couldn't even begin to dream of 50 years ago.
I am an American now, and I am looking at my adopted country, the United States of America, with the same dismay as Mao's China, back in the 1960's.
Muchas Gracias, Señor Edward Snowden !
I thought Who was on first, Torchwood was on second, and The Sarah Jane Adventures was on third.
Time to start from scratch, and start a large-scale redesign of the Internet and its protocols, to try and better secure users from surveillance/attacks?
In my view the most dire issue facing the network right now is handful of content companies owning majority of network traffic. People have to run their own servers and get involved with the network again. There is no meaningful technological solution for aggregation of power in the hands of a few media companies caused by laziness and lack of engagement. Those with the skills need to work to make it more accessible to those without the time or inclination to learn.
Tor and other fringe security protocols/networks won't cut it, and getting people to use very-user-unfriendly encryption tools won't happen - nothing short of a mammoth redesign
The structure of the current net at IP layer and below is architecturally about right as far as I'm concerned. 100% untrusted, 100% untrustworthy. All the network needs to do is forward packets with some degree of assurance they will be delivered.. the rest is up to us users.
far surpassing the resources/scale of the IPv6 changeover, is going to come anywhere close to repairing the damage.
I think if we're smart about it IPv6 becomes a huge part of the solution. Whatever the future of the net and accompanying protocol soup look like maintaining a network of peers where any one can talk to anyone else is the most powerful tool we have to avoid oppressive tendencies of various less than perfect governments.
There's no going back now - it's already too late to salvage what we have, because it has already been completely and irrecoverably 'owned' - the NSA broke the Internet.
If you were talking specifically SMTP or SSL CA's I would agree with you. More generally all is not lost and all does not need to be replaced.
... Snowden is no more principled than McCain or an investment banker. He released ALL of the intelligence information he gathered at the NSA ...
I am intrigued !
How do you know Edward Snowden has released _*ALL*_ the information he had gathered at the NSA ?
How do you know Edward Snowden does not keep some files to himself, files that pack even *MORE* fire power than what he has released so far ?
As a poker player, I never release my trump card early in the game.
I don't know if Edward Snowden plays poker or not, but judging from what he has done since his days as a security guard ... I suspect the guy has even more juicy things in the pipeline
Muchas Gracias, Señor Edward Snowden !
If there was ever indisputable proof that Slashdot needs to maintain javascript-free functionality in slashcode, this is it. If it were viable to use slashdot with javascript disabled, this sort of impersonation attack would be a lot harder to pull off because NoScipt would have protected from drive-by nsa-ware infections hoisted on the slashdot impersonator site.
Unfortunately, its been years since it was reasonable to use slashdot without javascript. Even if you still use the old style interface, there are too many corners where javascript has crept into the design in a mandatory way rather than just as an enhancement.
When information is power, privacy is freedom.
As a poker player, I never release my trump card early in the game.
Somehow, this reminds me of Zapp Brannigan.
I've read a similar post you made before. You have a powerful point to make, and you make it well.
It would be a service to the country you loved, and freedom in general, if you spent an hour or two to write that up "properly", to spend a few minutes editing it to say exactly what you want to say. I could see such an article being shared quite a bit via social networking, blogs etc.
Snowden stated that he's released all of the information he had The only thing that is restricting the release of information at this point is the journalists that he released it to. Those journalists have already said that they haven't even released the really juicy stuff yet. That's pretty impressive, if it's true, considering the significant revelations already made.
Are agnostics skeptical of unicorns too?
Due to some perfectly reasonable decisions by Microsoft that failed to predict the future, a reasonably a proficient private hacker could choose an appropriate Trojan to embed. The agencies involved in this sort of thing have libraries of them.
Those exploits are chained much like the normal boot process. The boot sector is 512 BYTES. It can't do much, but it can load the boot loader. The boot loader is quite limited, but it can load the 2MB kernel, which loads the rest of the OS.
Similarly, based on what even _I_ can do to a Windows machine that loads script of my choice, it's pretty clear the intelligence agencies could execute arbitrary code in the sandbox. That limited sandboxed code in turn loads a privilege escalation, which can load a rootkit. Three quick steps to own the machine. With control of the machine, they start looking at network shares and dropping payloads to infect coworkers, probe firewalls from the inside, etc.
Nope. I joined repeatedly, and earned positive karma repeatedly, with many accounts.
Bunch of deleted stuff... you can leave your past behind, if you are willing to leave your past behind. Most people aren't, and that's what everyone against you is counting on.
Kill your wife, or child, or countryman, or government, or celebrity, or friend? I count on you to be strong, while the perpetrator counts on you to be weak.
Everyone should be mentally reviewing their activity. and if it should be censored or stopped, then don't say it or do it. Breathe or don't, type or don't, speak or don't... live or don't. Decide your own fate, and decide your actions accordingly.
Are you searching the internet for something that supports your view? Then consider if you are wrong. Are you repeating something your parents told you, or something you learned ten years ago or more? Consider that society has learned some things since then.
Put on the foil if you must, but appreciate that your own mind can come up with facts, consequences, and conclusions, if you do not submit your mind to input from adversarial forces.
"The consumers machine"? The targets run major network exchanges. Owning their machines, and thereby the network exchanges they administer, is sort of like rooting the internet.
What's the risk? That the admin notices they have some malware? If they notice, they could either a) remove the malware just as admins everywhere do all the time or b) conjecture about a vast government conspiracy. Neither really does any damage - people have been babbling on about government conspiracies to get them approximately since the invention of government.
The risk, as it turned out, was that an insider would go rogue and make the information public _along_with_strong_documentation. I suppose in that business you just have to accept the fact that if one of your own turns against you, it's going to bad.
Really. I mean it. It is not that hard.
"As a poker player, I never release my trump card early in the game."
If you were a poker player, you'd know that there are no trumps in poker.