Slashdot Mirror
British Intelligence Responds To Slashdot About Man-in-Middle Attack
Nerval's Lobster writes "The GCHQ agency, Britain's equivalent of the National Security Agency, reportedly used fake LinkedIn and Slashdot pages to load malware onto computers at Belgian telecommunications firm Belgacom. In an emailed statement to Slashdot, the GCHQ's Press and Media Affairs Office wrote: 'We have no comment to make on this particular story.' It added: 'All GCHQ's work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Intelligence and Security Committee.' Meanwhile, LinkedIn's representatives suggested they had no knowledge of the reported hack. 'We have read the same stories, and we want to clarify that we have never cooperated with any government agency,' a spokesperson from the social network wrote in an email to Slashdot, 'nor do we have any knowledge, with regard to these actions, and to date, we have not detected any of the spoofing activity that is being reported.' An IT security expert with extensive knowledge of government intelligence operations, but no direct insight into the GCHQ, hypothesized to Slashdot that carrying out a man-in-the-middle attack was well within the capabilities of British intelligence agencies, but that such a 'retail' operation also seemed somewhat out of character. 'Based on what we know they've done, they are doing industrialized, large scale traffic sweeping and net hacking,' he said. 'They operate a wholesale, with statistical techniques. By "statistical" I mean that they send something that may or may not work.' With that in mind, he added, it's plausible that the GCHQ has software that operates in a similar manner to the NSA's EGOTISTICAL GIRAFFE, and used it to redirect Belgacom employees to a fake download. 'However, the story has been slightly garbaged into it being fake [LinkedIn and Slashdot] accounts, as opposed to network spoofing.'" Update: You can read the official statement from Slashdot's parent company, Dice Holdings, here on our blog.
First Spoof.
Though this is no laughing matter.
What changed under Obama? Nothing Good
That would make MIM attacks much more difficult
All GCHQ's work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight
The Stasi said the same thing in East Germany. But that's circular logic: We're authorized to do this because we authorized it.
#fuckbeta #iamslashdot #dicemustdie
So, when is Slashdot going to turn on https and stop the attack vector?
I have a hard time believing that someone convinced them this site was worthwhile. Was this just some kind of training exercise for them, to make sure that they could handle the traffic volume from a dying site before they go and try to intercept traffic from one that is relevant?
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I have a hard time believing that someone convinced them this site was worthwhile.
That's because you're letting your ego get in the way. This isn't about you. This is about one or more specific targets that they believed or suspected were slashdot users.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
No, the target were Belgium Telco workers.
GCHQ needed a way to insert malicous scripts on the workers PC in order to gain a foothold on the Belgium Telcoms networks. The way they did that was to run a man-in-the-middle attack on the sites that those workers were going to visit.
These comments are my personal opinions and do not necessarily reflect the opinions of the other voices in my head.
Assuming this isn't a hoax, feathers successfully ruffled.
How often does GCHQ make an official statement in response to some random guys on the Internet claiming that they overstepped their bounds? It's surely not setting a precedent, so why has it respnded to this one?
["no comment"]
[junior PR flunky boilerplate sounding like it's from a FTSE 100 corp.]
If we can't see what they do I have no trust in them.
If you can see what they do then so can the people they are trying to spy on. That is self-defeating.
Wrong, simply wrong. 20 years ago a warrant was required. We did not need to know the target name, but could see the judges name that signed the warrant and the agency or office name associated with the wiretap. Most importantly we could see and scrutinize the compelling arguments for the warrant. Without giving up agent names, this allowed oversight. Judge A approving every warrant would have been questionable, and probably removed from the bench. Judge B that had approvals and denials would still not be off the hook, but we could see what was being done without the detail that would have jeopardized officers.
Today, there is no oversight. Looking at a nearly rubber stamp approval without knowing judges names, or having power to remove them from the bench, what can the public do? Nothing, obviously. The only thing we have is overall request and approval numbers. Maybe every single request submitted is valid, maybe not. We don't see the compelling arguments for warrants, we just know that 99.99% of them are approved. Knowing the numbers of approved does not allow oversight.
If they are capable of what we "know", they are capable of attempting to silence critics.
"Capable of" and "intend to" are completely different questions, as well as matters of legal interest.
Nice word twisting, let me rephrase more carefully. "We know some of the illegal activities that the Government has been involved in, acting in secrecy. There is no reason to assume that they are not acting in other illegal ways. The only way to clear them is to open everything up."
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
... All GCHQ's work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight ...
Maybe in strict legal terms, what GCHQ has done, including the man-in-the-middle attack spoofing Slashdot's webpages to inject malwares to the intended (and/or unintended) victims, is Kosher, the official reply from GCHQ is but another confirmation that Morality Is Dead, for the regime holding power over many of those so-called "Democratic Nations"
I am no sociologist, so I do not know where the failure lies - it could be democracy itself, it could be society, it could be education, it could even be "trendy" - but...
... at the end of the day, when Morality dies, anything goes
What is more shocking is that, if the government is immoral, how long do you expect their subjects (the people, that is) to remain upright morally ?
Government (and/or regimes) are like parents.
If the parents are crooked, don't expect the children to be straight.
Muchas Gracias, Señor Edward Snowden !