Slashdot Mirror
Interview With An 'NSA Hacker' Published By The Intercept (theintercept.com)
The Intercept published a 4,000 word article based on a journalist's three-hour interview with an "NSA hacker" who recently left the agency for a career in cybersecurity. Offering a portrait of life within the U.S. intelligence agency, "Lamb" says he worked on "ridiculously cool projects that I'll never forget... Technically challenging things are just inherently interesting to me."
He's the author of some of the memos leaked by Edward Snowden about how the NSA tries to identify Tor users or break into sys-admin accounts. ("One of his memos outlined the ways the NSA reroutes (or "shapes") the internet traffic of entire countries, and another memo was titled "I Hunt Sysadmins.") "If you tell me, 'This can't be done,' I'm going to try and find a way to do it."
It's interesting that he ended one memo with "Current mood: devious" and wrote in another that Tor "generally makes for sad analysts". But in his interview, he warns that "There is no real safe, sacred ground on the internet. Whatever you do on the internet is an attack surface of some sort and is just something that you live with."
He's the author of some of the memos leaked by Edward Snowden about how the NSA tries to identify Tor users or break into sys-admin accounts. ("One of his memos outlined the ways the NSA reroutes (or "shapes") the internet traffic of entire countries, and another memo was titled "I Hunt Sysadmins.") "If you tell me, 'This can't be done,' I'm going to try and find a way to do it."
It's interesting that he ended one memo with "Current mood: devious" and wrote in another that Tor "generally makes for sad analysts". But in his interview, he warns that "There is no real safe, sacred ground on the internet. Whatever you do on the internet is an attack surface of some sort and is just something that you live with."
includes the NSA's lawn.
They can't hack for shit.
I'm guessing he didn't run his comments through prepub first... someone is going to be getting a call from security shortly.
https://yro.slashdot.org/comments.pl?sid=9329239&cid=52439297
Jesuit Vatican and Jesuit CIA scaring everybody at threat of harm to themselves/family into allowing a total surveillance country. Even global because the info goes multi-national thanks to many many many fucking FBI moles and even a few CIA moles.
So they take taxpayer money which really is literally not money but a debt instrument (-$20 (actual: 69.5) Trillion in your account how much money do you have? They use it to take your guns, set up camera world and spy and store all of your life details telling you it is to protect you from harm. Meanwhile they terrorize other countries and every time they blame it on somebody over in bumfucked Egypt they say they have to set up more cameras at home and your guns need fingerprint scanners on them and shit.
GTFO CIA. Do not say Barack Obama is just finding this out either.
https://yro.slashdot.org/comments.pl?sid=9329239&cid=52439311
The Jewish media monopoly and Israel are not unnoticed.
Nor is the Lizard Squad (NSA)
Nor is Anonymous (Israel state sponsored "hackers")
>"Current mood: devious"
I had no idea people were still using Livejournal.
I was looking forward to the story but when I saw things like smiley faces and the current mood=devious junk, I'm doubting this cat was really a spook. No way would someone put that kind of gibberish in a presentation unless, of course, it was presented to his office buddies who probably got a kick out of it. No way a 4-star would be looking at some hand-scribbled, 2nd grade inspired drawing.
NSA buys their exploits on the black market just like all the other criminal skiddies do.
They even point and click to deploy their attacks, like skiddies using babby's first pre-packaged metasploit-ready exploit vector.
"Devious" is buying exploits from real black hat hackers? Pretty much, yeah.
With everything having such shit security there's not much incentive to spend a lot of money on "really neat projects" aside from running a fuzzer on new software, or fingerprinting a sysadmin's systems then deploying the existing library of vulns against them. Why crack the safe combination when the bank vault door is standing wide open?
NSA is having problems with recruiting. TFA is propaganda. It's a smidge better than their prior attempts though.
The only story is that the journalist did a three hour interview with a NSA hacker. There's no content in there.
https://en.wikipedia.org/wiki/Second_Amendment_to_the_United_States_Constitution
(and zoology)
"If you tell me, 'This can't be done,' I'm going to try and find a way to do it."
How to be rich in 10 seconds:
1) say, "I can't have your bank account. This can't be done."
2)He's 'going to try and find a way to do it'
3)????
4)Profit
Oh for the old days when no one wondered why >50% of European Internet connections were routed through MAE East.
though it was already heavily hinted in the headline. And the summary. And the url.
"I hunt Sysadmins"
Careful. A lot of us Sysadmins enjoy our 4th amendment. We also enjoy the 2nd. Sounds like it's time to do a new kind of hunting. We fought wars and revolted against nations over less openly abusive bullshit.
NSA: Fire whomever is doing your PR before you're out of a job and applying to Gitmo as a broomstick cover.
This is a seriously shit article.
Being in the information security field myself, I've hung out with some federal government infosec people once or twice. My read is that the feds have a lot of money and other resources. They don't have superheroes on staff. "Garcia" from the TV show CSI doesn't work there. So they're good, but cerrainly not orders of magnitude better than those of of us in the private sector. We can't get billion dollar datacenters, though, to record information about every phone call in the country.
HOWEVER, most of the time it doesn't matter. Spear phishing isn't that difficult, and most people can be spear phished. (Note the qualifier SPEAR, not bulk phishing).
What about hacking high-value targets like major governments? Is it easy to hack the US state department? Well the head of the department, the secretary of state, DOES communicate in CLEAR TEXT via an unpatched server in her basement. It doesn't take genius hackers to read top secret informatiom that isn't encrypted and is sent in the clear over the public internet. The NSA doesn't NEED geniuses. They just need to be patient and persistent to exploit a particular target.
Of course they don't have to attack the primary target directly. Once they have access to the email account of Clinton's good friend Debbie Wasserman-Schultz, they can set a filter that intercepts emails she sends to HRC and add a trojan to an attached file. Then they have a foothold on HRC's computer and phone. None of this is that difficult, they just have to be patient if they want to get a value target.
he's turning in his back hat for a white one?
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Technically cool but immoral and un-ethical and probably outside the law..
Don't you just technocrats,smart,but with no smarts..
I assume CNE is Carrier Network Exploit? i.e. some router exploit.
I think at this point, its the same rules as normal, we fix bugs, we avoid buying 5 eyes shit network kit, and view TLS with suspicion given Blue Coat and other less well known Symantec related companies can fake any certificate they like with impunity.
I wonder how many European business secrets were exported to the US by these exploits, or how many European leaders were shaped by this data to be compliant to the mass surveillance regimen. All of the 5 eyes countries have now legalized mass surveillance of their own populations. With only the US even having token restraint.
I'm confident that NSA is stuffed full of talented geniuses. The problem is, NSA is *not a school*. It is a self-serving bureaucracy of biblical proportions. It is a cult of grim bondage and great misdeeds done in furious silence. It is where great ideas are snatched up and piled into classified vaults to be forgotten. Where good things receive the Lovecraftian kiss and are thus sent forth to infect the world on their own. It's staff aren't allowed to pursue any program for long if it does not serve the *political* demands of it's deranged leadership. Every one of those nerds has a leash around their neck. Their experiments must be weaponizable, or else they are put out to pasture.
I am sorry - this "lamb" guy and his memos sound much more like the janitor dreaming of wanting to be a cool haxxor dude. If he really represents the average specialist at the NSA our country is in trouble. Actually - I don't think the NSA would have a lot of capabilities without the help of American technology partners. It's easy to re-route traffic in a network, if a few well known companies cooperate.
OK. I've seen your presentation. Here's what can't be done: correct apostrophes, apparently. Go to it, tiger.
Garcia is on Criminal Minds, you insensitive clod!
What utility does this guy have to the civilian sector? The NSA has vector options available that the civilian sector has never dreamed of. I bet you a good deal of what he knows is not applicable to the civilian sector.
This whole interview sounds like a puff piece for a job interview. It's different to work in the real world vs a shadowy world where you probobly have a small army of operatives available to do hacks/exploits that would not be feasible without things like national security letters, boots on the ground, physical penetration into secure facilities, etc.
What I got from it was that Lamb wants to be a security consultant. You'd pay him to run Nessus against your network or whatever.
For one, he should be aware of proper security procedures.
Second, he'll know of very unlikely targets and methods to protect against previously unknown attack surfaces.
The fact that you donâ(TM)t see much value tells us how little value you are.