Slashdot Mirror
A Look at the NSA's Most Powerful Internet Attack Tool
realized writes in with a closer look at the NSA's QUANTUM system. "Today QUANTUM packs a suite of attack tools, including both DNS injection (upgrading the man-on-the-side to a man-in-the-middle, allowing bogus certificates and similar routines to break SSL) and HTTP injection. That reasonable enough. But it also includes gadgets like a plug-in to inject into MySQL connections, allowing the NSA to quietly mess with the contents of a third-party's database. (This also surprisingly suggests that unencrypted MySQL on the internet is common enough to attract NSA attention.) And it allows the NSA to hijack both IRC and HTTP-based criminal botnets, and also includes routines which use packet-injection to create phantom servers, and even attempting (poorly) to use this for defense."
all these software engineers that work for nsa/gov , do they have any fucking morals? do they really believe they are securing the world from the evil guys? are they kept at gunpoint? are they just plain stupid? Fail to realize that us, the makers , have all the power is the worst mistake. Plant secret backdoors, failure modes, weaknesses. Be in charge. You don't owe anything to these black suits. Wake fucking up.
I wonder what this tool will think about my encrypted archive of the proceedings of Congress that I've renamed "The_anarchists_cookbook.zip".
the Borg have won.
Now if they would just use it to actually stop botnets.
I'm American and I fully support this. This is exactly what intelligence agencies are for. Nothing in any of these leaks in the linked article suggests these capabilities are being abused. I want my government to be able to pursue foreign intelligence targets with capabilities like these and--in a time where people complain relentlessly about government agencies being ineffective--I'm glad they are able to do this.
Posting anonymously because I've lost too much karma expressing a contrarian opinion on all these Snowden articles. Frankly, I'm more scared of moderators than our government...
I don't know how much is known vs speculation here. If the NSA has some MySQL manipulation tools, it might not actually be intended for use on the actual internet. It is possible that they infiltrate networks and use these tools on the inside.
It came out that they're tapping dedicated lines, and those are often unencrypted. However, I'd expect most competent mysql use to stay confined to a LAN, even with encryption. Latency tends to cause problems if you separate the database from the application layer. But, I'm sure that not everybody the NSA targets is competent...
If you have been on your computer, cell phone or car with EZpass or OnStar: they know a lot about you. Even if you have 7 degrees of separation from the bad guys.
You have to applaud the thoroughness. Misguided patriots, the lot.
Pay no attention to the man behind the curtain with all your metadata.
Recent revelations about spying on an Indonesian clove cigarette company for the benefit of US "customers" is one example.
So that's for the private sector. How the customers in the private sector commission the work and pay for it would make an interesting story. Perhaps they pay via political campaign finance? Let's open that can of worms.
10 BILLION DOLLAR BUDGET, and they have a bag of Tommy 10 year old script kiddy tools to show for it...
If the NSA can bring down botnets, why don't they? Are spammers making political contributions?
My guess, as a security professional who could have been recruited for a three-letter agency, is that many of them are boiled frogs. There are technical challenges that smart geeks love, plus the whole hacker mystique, but you don't want to be criminal, so you go white-hat, hacking bin Ladin. That adds the whole "international spy" thing into it and maybe you help catch some really bad guys. That would be awesome, spying on al Qaeda. Hmm, if you expanded that technique you could catch a lot of bad guys. So you expand it to log calls to and from Iraq, Afghanistan, and Syria. After a few years, you end up in a place you never would have knowingly sought to go.
This only happens if you're an idiot, like the average libertarian that infests this site.
No. it happens when the law primarily serves the interests of those in power (or their benefactors) instead of individual liberty.
Smart socialists know how to always remain in power.
quite true. The soviet union and north korea are great examples.
The worst people in the world are those that don't know how to socialize with other members of society, and socialization is formally structured in society through a government.
That depends on your definition of 'socialize'. The word's been defined and redefined so many times for so much self serving arrogance, I'm not sure it has a valid objective meaning anymore. These days it's newspeak that really means "compliant with the norms of the group", or "team player", someone who never rocks the boat, even when it's necessary to tell the uncomfortable truth and cause someone to have to save face.
When you people state "I fear and mistrust government", what the rest of us hear is "I fear and mistrust other members of society".
No. Government is its own entity, just like any other group of people. They form hierarchies within hierarchies, complete with their own groupthink and 'mission statements.' Really, they're just the adult versions of highschool cliques, except the stakes are much higher. They share all the same low level hazing, peer-pressure, and passive aggressive politics of their adolescent counterparts. Like students who are or are not a part of these cliques, the bureaucrats of government are a distinctly separate class from everyone else. After awhile, many of them truly believe that they are a cut above everyone else by default. This is a big part of what we're facing today.
Can you explain how you benefit us? Do you think you produce more tax revenue than we pay for you? Do you think the road we paved for you all the way out to your private secluded hideout so you can avoid the rest of society came for free?
Hey, I didn't ask for anyone to spend money on my behalf. You sound like that guy who washes my windshield at a stop light when it doesn't need washing, and then gets upset when I refuse to give him $5. What a citizen typically faces in socialist nations in final stages of collapse goes like this: How do you benefit 'us', citizen? I'm sure it's insufficient compared to what The People have done for you. Report to reeducation camp #119 for 'processing'! I don't think it's that bad yet, but obviously, you are already there. Now that is sad.
Publicly funded roads are a far cry from overt surveillance and psychological manipulation (ie terrorist fear mongering) which are the precursors to extremely large powergrabs. Oh, and I never said I disagreed with public roads. You need to put down the NYT liberal talking points guide.
Is that what you want us to hear from you libertarians? That you're a precious snowflake and that you don't want to do what government tells you to do, because you're a precious snowflake?
No. The precious snowflakes are the ones who think they're owed something from taxpayers because they believe their race, gender, orientation, or some other arbitrary difference, makes them think they are perpetual victims of some paranoid conspiracy they probably picked up from public schooling or the media. The sad part is, many of them probably are victims of this brainwashing. They do make reliable voters, don't they? Gotta love identity politics. If you knew anything about them, you'd know libertarians believe in rule of law, not in identity politics. That means everyone is equal before it; no favoritism. However, they also believe that the laws that are on the books should be rational instead of based on heat of the moment politicking. They understand that when humans are packed into groups, they're pr
idk about morals (I dont want to define or discuss defining it b/c it brings out trolls something fierce)
They feel like cogs. From my short time as a DC congressional staffer & people I know in those fields, they feel like a **cog in a big machine** Their job is so abstracted that they dont really know the context of the work **or** they are doing the front line work & never see any analysis just an action order.
the intelligence community has been practicing "compartmentalization" in administering worker tasks since the Manhattan Project in the late 40s at least
one hand doesn't know what the other is doing **by design** across the whole org
it's interesting to note the paralells between:
Compartmentalization (information security): http://en.wikipedia.org/wiki/C...
The basis for compartmentalization was the idea that, if fewer people know the details of a mission or task, the risk or likelihood that such information could be compromised or fall into the hands of the opposition is decreased....(and later, re: Manhattan Project "Most did not know what, exactly, they were doing. Those that did know, did not know why they were doing it. Parts of the weapon were separately designed by teams who did not know how the parts interacted."
Compartmentalization (psychology): http://en.wikipedia.org/wiki/C...
an unconscious psychological defense mechanism used to avoid cognitive dissonance, or the mental discomfort and anxiety caused by a person's having conflicting values, cognitions, emotions, beliefs, etc. within themselves.
Compartmentalization allows these conflicting ideas to co-exist by inhibiting direct or explicit acknowledgement and interaction between separate compartmentalized self states.
Compartmentalization in orgs **can** increase security, but it **also** can be used by bad actors to **cover up bad actions**
Compartmentalization, from a cybernetic perspective, is viewed as a feedback management technique.
In any system, be it one human mind or an organization of thousands of them over decades...compartmentaliztion can be used to hide all manner of immorality
Thank you Dave Raggett
But it also includes gadgets like a plug-in to inject into MySQL connections, allowing the NSA to quietly mess with the contents of a third-party's database. (This also surprisingly suggests that unencrypted MySQL on the internet is common enough to attract NSA attention.)
When the author wrote that part of the story, he or she seemed to be unaware of what he or she had just written:
allowing bogus certificates and similar routines to break SSL
By breaking SSL, the NSA has access to SQL queries whether or not they're encrypted.
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Grow the fuck up and learn some respect for a different perspective / belief.
I believe that god is seventeen giant, 65 foot long orange lizards, all who are named 'Ralph'. They have mile long, glittering prehensile cocks that drag behind them. Ralph^17 will sail invisibly across the sky once per hour, where all humans on the planet must turn to the South, and bow while chanting, 'Rubber Button' for one minute in order to avoid Ralph's divine and righteous wrath. His son is a stop sign three miles south of Yuma, and all who are able must journey to see him once in their life, lest they be dammed to spend Christmas vacation in New Jersey for all eternity. I demand the same respect that these goofy christian mono-godders get, up to and including wording on American money acknowledging Ralph^17's almighty farts. BOW, HEATHENS!
I mock you sir, for failing to respect that some people's perspective and beliefs are that 'invisible shit isn't real, and that you should call out the Emperor as naked when he is'.
HA! I just wasted some of your bandwidth with a frivolous sig!
What I have noticed is that there is a story in the media every damn day about the over reach of NSA and arghh..people are outraged. Oh it's horrible, etc etc. Amazingly enough, no one seems to want to do anything about it. Where are those stories? Where is the demand for congressional oversight? We get the NSA we deserve because we the people are doing nothing to reign them in.
Well said. I would mod you up if I had mod points.
-kgj
In no particular order:
1. Cognitive Dissonance: throw enough money/benefits at someone, and even otherwise tightly-held morals can become fluid.
2. Sociopaths: they'll do stuff simply because they can (and want to), despite the harm it could create for others.
3. Challenge: some will do things because they enjoy the challenge of seeing if it can be done, as well as the "empowerment" they feel it gives them. Note that this can be mixed in with either of the 2 points above.
4. Ignorance: for whatever reason, the people in question have no real understanding of the broader harm their actions may cause (probably a least-case scenario, since it would probably require someone who is very socially stunted, like some kind of autism and what-have-you, while still being very capable technically).
5. Coercion: out-and-out threat of bodily harm to self or loved ones, etc, if refuse to perform. Bears some similarities to #1 above, but obviously is based self-preservation/care-for-others rather than greed.
6. Apathy: they really just don't care, for whatever reason.
7. Misplaced Loyalty: failure to question the motivations and/or repercussions of orders given to them by higher-ups because questioning orders equals disloyalty.
I'm sure there may be more...
I wanted to work for one, but had too much black hat in a way that freaked out the moralists over absolutely innapropriate things. Not things like loyalty, or unauthorized access, or openly gay... but "wow, that's equivalent to stealing millions of dollars..." over a bit of high end software cracking.
As someone who knows and has done other defense and weapons work... let me put it very very clearly:
Some of us believe there are "bad guys", and while the US is not "the good guys" -- we're better than the others out there. Not morally better. Better positioned to accomplish things that need to be done.
I wanted to work NSA instead of FBI because the NSA's signals intelligence was supposedly exclusively foreign. I wanted to work the NSA over CIA -- because the NSA's mission scope includes comsec -- which should be improving things. And because the CIA ... well... they start wars and render people.
By contrast, non-cloak-and-dagger intelligence...does not bother me in the slightest. I expect routine espionage.
I don't mind making weapons platforms for our soldiers. Yes, some of them are child raping, family slaughtering motherfuckers that should be tried, taken out behind a shed, and then summarily executed by firing squad. But most of them aren't. And they need good tools.
These weapons and platforms, in the hands of the right people... are not a bad thing.
Like any and all tools, they are potentially dangerous. Like all tools that fall into the class known as "weapons", they are designed and intended to be dangerous to life and property even (and especially) when functioning correctly.
They are definitely dangerous in the wrong hands. But that is why I want my friends and allies armed with them first.
It isn't scope creep -- it's scope designation. Some of us don't mind that type of work as long as the barrel isn't pointed at our own countrymen.
Yes, what goes around comes around. I do not have the skillset, but I think I would have severe reservations about nuclears or biologicals. But basic tools for soldiers? That's how we help our country.
And the NSA...having taken those network tools, and pointed them inward and domestically... should be tried, convicted, and summarily executed -- just like any soldier that followed an unlawful order to point his rifle at not just civilians... but...his own citizens.
I don't think I'm better than a canadian, a brit, or an Iraqi, christian, muslim, jew... whatever.
I just understand which side I'm on when the thin line is drawn in the sand. The loyalty is national and to national interests -- and supporting platforms and intelligence systems that do not harm my nation is a good way to serve.
Now...about you assholes that turned those tools inward... it's time for a trip to the gallows...
Then again you didn't even read the 1974 patent by Robert Malech that makes it all possible, built into all NSA and DOD radar and satellite systems since 1976.
Patents and Dr. Robert Duncan's whistleblowing disclosures are all over the obamasweapon.com site. He worked for the DOD, CIA, US DOJ: http://www.oregonstatehospital...
You had the opportunity to read all this so I guess you're clueless troll shit.