Computer Science Professor Mocks The NSA's Buggy Code (softpedia.com)

After performing hours of analysis, a computer science professor says he's "not impressed" by the quality of the recently-leaked code that's supposedly from an NSA hacking tool. An anonymous Slashdot reader writes: The professor, who teaches Software Vulnerability Analysis and Advanced Computer Security at the University of Illinois, Chicago, gripes about the cryptography operations employed in the code of an exploit called BANANAGLEE, used against Fortinet firewalls. Some of his criticism include the words "ridiculous", "very bad", "crazy" and "boring memory leaks".

"I would expect relatively bug-free code. And I would expect minimal cryptographic competence. None of those were true of the code I examined which was quite surprising," the professor told Softpedia in an email.
If these were cyberweapons, "I'm pretty underwhelmed by their quality," professor Checkoway writes on his blog, adding that he found "sloppy and buggy code," no authentication of the encrypted communication channel, 128-bit keys generated using 64 bits of entropy, and cypher initialization vectors that leaked bits of the hash of the plain text...

Comments

NSA is part of "big government" after all

[Anonymous Coward]

and big government is failure, as we all know it. We should privatize our security, and make the NSA as well as the military a publicly traded corporation. Trump will run the USA like a business, that's why he has my vote, although he hasn't announced privatisation of vast parts of the government yet, which I would really like.

Re:NSA is part of "big government" after all

[Anonymous Coward]

" Trump will run the USA like a business"

You missed a few words. Should be changed to: "Trump will run the USA INTO THE GROUND like a business", since he has bankrupted quite a few over his years of being a businessman. And he wouldn't have even had a business period if it wasn't for daddy's money and connections.

****Gary Johnson 2016****

Re:NSA is part of "big government" after all

[Archtech]

We should privatize our security, and make the NSA as well as the military a publicly traded corporation.

I know! Let's outsource it all to Microsoft!!

Re:NSA is part of "big government" after all

[Sique]

Trump will run the USA like a business, that's why he has my vote, although he hasn't announced privatisation of vast parts of the government yet, which I would really like.

And that is good because on average, every second business goes bankrupt after two years, right? Donald Trump has extensive experience in running businesses going bankrupt.

Re: NSA is part of "big government" after all

[stinkyjak]

Isn't most of this coding already privately contracted to companies like Northrop Grumman and Raytheon?

Re: NSA is part of "big government" after all

[Anonymous Coward]

Microsoft sued the government to protect its users. Google had a revolving door to the whitehouse installed. You are barking up the wrong tree.

Re:NSA is part of "big government" after all

[KingBozo]

Yep and the government if it was a business would have been bankrupt long ago.

Re:NSA is part of "big government" after all

[Anonymous Coward]

Already done. Who do you thinks writes it for them?

Re:NSA is part of "big government" after all

[hey!]

Just like we should privatize our prisons, eh? And how has that worked out?

One thing decades as a developer has taught me is to avoid hubris about bugs. Even good programmers make bad mistakes. Software development on a large scale is a social process, and the less transparent that process is the greater opportunity bad decisions have to escape scrutiny.

It doesn't surprise me at all that secretly developed software has obvious mistakes in it -- obvious to outsiders that is.

Re: NSA is part of "big government" after all

[buck-yar]

Riiiight.

"Hot line to the NSA

It's gotten to the point where no vendor hip to the NSA's power will even start building products without checking in with Fort Meade first. This includes even that supposed ruler of the software universe, Microsoft Corp. "It's inevitable that you design products with specific [encryption] algorithms and key lengths in mind," said Ira Rubenstein, Microsoft attorney and a top lieutenant to Bill Gates. By his own account, Rubenstein acts as a "filter" between the NSA and Microsoft's design teams in Redmond, Wash. "Any time that you're developing a new product, you will be working closely with the NSA," he noted. "

http://www.cnn.com/TECH/comput...

Re:NSA is part of "big government" after all

[breagerey]

I hate this trope
Govt *isn't* a business in the traditional sense of the word and we shouldn't expect it to be

Re:NSA is part of "big government" after all

[GodelEscherBlecch]

Seriously.

...in Order to form a more perfect Union, establish Justice, insure domestic Tranquility, provide for the common defense, promote the general Welfare, and secure the Blessings of Liberty to ourselves and our Posterity...

Not exactly the best charter statement for a profitable business.

Re:NSA is part of "big government" after all

[Anonymous Coward]

and big government is failure, as we all know it. We should privatize our security, and make the NSA as well as the military a publicly traded corporation. Trump will run the USA like a business, that's why he has my vote, although he hasn't announced privatisation of vast parts of the government yet, which I would really like.

What the fuck makes you think those tools weren't built by contractors?

They probably weren't even lowest bidder contractors either, just managed by some jackass GS-14 who didn't know shit about software but instead just follows the process and isn't even capable of doing a proper code or even review. Just checks off the requirements vs unit-tests and called done when everything was green.

Re:NSA is part of "big government" after all

[GodelEscherBlecch]

Trump will run the USA like a business, that's why he has my vote, although he hasn't announced privatisation of vast parts of the government yet, which I would really like.

Ah yes, Trump the living Rorschach test. Apparently while we are meant to be ignoring all the insane things he says as sarcasm or nonsensical jokes, we are also supposed to be inserting all of our greatest policy desires between the lines. I guess I've been holding my Trump wrong this whole time. Let me just flip this around and...oh! Now it's a pretty butterfly! Go Trump!

Re:NSA is part of "big government" after all

[Anonymous Coward]

and big government is failure, as we all know it. We should privatize our security, and make the NSA as well as the military a publicly traded corporation. Trump will run the USA like a business, that's why he has my vote, although he hasn't announced privatisation of vast parts of the government yet, which I would really like.

What the fuck makes you think those tools weren't built by contractors?

They probably weren't even lowest bidder contractors either, just managed by some jackass GS-14 who didn't know shit about software but instead just follows the process and isn't even capable of doing a proper code or even review. Just checks off the requirements vs unit-tests and called done when everything was green.

Indeed. I would assume that the code to hack the Juniper equipment was written by a Juniper employee for someone in the NSA.

 

Re:NSA is part of "big government" after all

[Psion]

Crap. I have to burn this because I accidentally moderated you as insightful. You're right that big government is a failure. But Trump isn't going to do a blessed thing to downsize anything. That man's as much a totalitarian as Hillary and neither should have gotten as far as they have already. Twenty years ago, the scandals and missteps by both of them would have ruined their campaigns. Hell, Howard Dean torpedoed his run with a single howl only 12 years ago!

Re:NSA is part of "big government" after all

[blindseer]

Privatize security? You mean like dismantle the TSA and have airport security run by the airlines? As in having the government issue letters of marque and reprisal? Where privateers/mercenaries/whatever fight our wars for profit?

Tell me something, how are these people supposed to arm themselves? Would this not require people to be able to buy the same weapons as those available to the standing army? If not then what are people supposed to fight with, VP Biden approved double barrel shotguns?

The ability for people to fight the battles that our government gets us into was the reason for the Second Amendment. Minutemen were people of the unorganized militia that came to battle with their own weapons. That's why they were called "minutemen", because they were ready to fight on a minute's notice.

One big problem I have with your proposition is the privatization of all military. The reason the Second Amendment is there is to allow the people to protect themselves from the government. What concerns me is with no government funded military there is nothing to protect the government from the people. The mutual respect of the authority of the people and the authority of the government is supposed to keep both in check, if that fails the natural instinct to not get killed in a battle between the two was supposed to keep them in check. Disarming one or the other is dangerous, disarming both is impossible.

Trump may be supportive of our right to keep and bear arms, and he may see some value in handling many aspects of the government like a business, what I don't see him doing is privatizing the military. I believe he has enough respect of the people in uniform to believe they will do the right thing when called upon.

I did laugh at loud at your proposal, if only because it reminded me of a scene from Iron Man 2 where an irreverent billionaire told a bunch of stuffy government officials to fuck off because he just privatized national defense. In some way I see that coming. Technology is enabling people with even a few thousand dollars to spare to produce weapons on par with anything the government has. An M-16 is almost trivial to produce now in a basement shop. I believe it won't be long before larger and more complicated weapons, like a passable battle tank, can be mass produced in an amateur machinist garage.

Re:NSA is part of "big government" after all

[dbIII]

Privatize security? You mean like dismantle the TSA and have airport security run by the airlines?

At this point that would be an incredibly good idea.
The airlines have different priorities so would run it as security and not a massive welfare program for a massive number of poorly trained staff and money funnel to political connections.
Walmart "greeters" take the security part of their job far more seriously than the TSA up to the highest level.

As for everything else, you've got some good points.

is the privatization of all military

Blackwater etc partially happening and a horror story in general. Mercenaries employed to do what professional soldiers consider unprofessional or outright war crimes.

I believe he has enough respect of the people in uniform

He has shown utter contempt on several occasions.

I believe it won't be long before larger and more complicated weapons, like a passable battle tank, can be mass produced in an amateur machinist garage.

A very interesting idea but it doesn't seem to be playing out that way anywhere.

By the way, what do you second amendment types do at 45? Do you get rid of all your guns since the second amendment doesn't apply to you after that? Perhaps you should consider that your right to be armed comes from it not being taken away from you in the first place and has nothing at all to do with the second amendment.

Re:NSA is part of "big government" after all

[blindseer]

He has shown utter contempt on several occasions.

As someone that once wore the uniform of an American warrior I am quite aware of Trump saying some disparaging remarks about our military. Even so I've seen him say many good things. Hilary Clinton on the other hand allowed people under her care to die at the hands of our enemies only because by sending in our warriors might make things look worse for her. Trump isn't perfect and I'll admit that. Clinton on the other hand is far worse.

A very interesting idea but it doesn't seem to be playing out that way anywhere.

I can see both sides here, for and against.

First, in agreement with you. You are correct that people aren't mass producing machine guns in their basements or battle tanks in their garages. Even though there is a lot of suckage to go around we here in the USA still have it pretty good. People have access to a wide variety of weapons off the shelf and if one wants to go through the paperwork they can own real deal military hardware. Now people cannot own modern weapons like F-22 planes but people can get a vintage fighter plane, a belt fed machine gun, a medium battle tank, or just about anything except perhaps land mines. Because things are good and people generally have access to some really nice hardware we don't see people arming up with home made weaponry. If things become not so good then we get to my second point.

Second, I did not claim that people were making such things now, only that the capability exists or will exist very soon. Every once in a while we will even see it happen. People will have a broken rifle and it goes full auto on them, it happens. It's trivial to clean that up and make it do that intentionally and safely. We've seen people flip their lid and turn a bulldozer, earth mover, or some other piece of heavy machinery into a mobile gun platform. Not quite a battle tank but if you look for videos on the internet you'll see a few cases of some quite successful attempts at getting close. Again if this is cleaned up a bit, and done with some sane planning instead of an act of suicide by cop then we could see something quite battle worthy. A lot of people know how to make this stuff but lack the motivation to do so. With a few emerging technologies to help this along, like 3D printing, the number of people with this capability increases as does the rate at which such weapons could be produced.

By the way, what do you second amendment types do at 45? Do you get rid of all your guns since the second amendment doesn't apply to you after that? Perhaps you should consider that your right to be armed comes from it not being taken away from you in the first place and has nothing at all to do with the second amendment.

It appears you are of the mind that the Second Amendment is there to protect the state's right to create a militia. This is a false interpretation, to demonstrate how this is wrong I can show the writings of the authors of the Constitution and opinions from SCOTUS that the right to keep and bear arms exists outside of the militia. The Second Amendment protects the right of self defense by the individual and by the states. The right does not begin and end at the age of conscription.

You are correct that the right of self defense exists outside of the Second Amendment which is why I am confused that you some how came to the conclusion that I believe that the Second Amendment places limits on my rights. The Second Amendment does not define my rights, limit my rights, or create my rights. What it says is that my rights exist, that they are inherent to my person, and says that the government has no authority to deny that right to me. All of that is not said in the Second Amendment alone, but comes from the preamble to the Bill of Rights and the Constitution as a whole.

Re:NSA is part of "big government" after all

[Anonymous Coward]

That's even funnier than it might appear to be at first glance, given that they already outsourced it to l0pht.

Re:NSA is part of "big government" after all

[Anonymous Coward]

>> We should privatize our security, and make the NSA as well as the military a publicly traded corporation.

I know! Let's outsource it all to Microsoft!!

Erm, that's already happened . . .

Re:NSA is part of "big government" after all

[Coren22]

If your first sentence is accurate, than Trump is a very successful businessman since I have only heard about 2 or 3 of his companies going bankrupt, and he has had 100s.

Re:NSA is part of "big government" after all

[dbIII]

We've seen people flip their lid and turn a bulldozer, earth mover, or some other piece of heavy machinery into a mobile gun platform. Not quite a battle tank

As seen in Syria vs Israel some years ago the German tanks that were very effective in WW2 did not stand a chance against a later American tank - there is a looong way down from those old tanks to what you describe. Those home built platforms are one roadside bomb or RPG away from scrap metal.

to demonstrate how this is wrong I can show the writings of the authors of the Constitution and opinions from SCOTUS that the right to keep and bear arms exists outside of the militia

That's not in the amendment is it? That's kind of reinforcing my point that the right comes from elsewhere.

With a few emerging technologies to help this along, like 3D printing

Real (but small) machine tools at the bottom end with controllers that could make them as easy to use as 3D printers are already as cheap. Why make a piece of shit ABS plastic gun when you can make a real one out of cheap steel after cutting and pasting a bit of code? Personally I think the 3D guns thing is from attention seekers that don't care if they ruin stuff for everyone - a lot of types of wood are stronger than ABS plastic.

It is a tool to hack, you idiot

[hsmith]

The real issue is what was exploited that one should be concerned about the quality of the code. "Oh man your shell scripts suck!"

Re:It is a tool to hack, you idiot

[saps1e]

Agreed. Considering this in the context of "cyberweapon", many weapons have been poorly designed and/or rushed into service, so this may be par for the course. I haven't looked at the code myself, but I would imagine that having a small footprint, both in terms of size and resources, is key to running undetected. Cutting corners, minimal encryption... those could be considered advantages here.

Re:It is a tool to hack, you idiot

[Spazmania]

"Oh man your shell scripts suck!"

Yeah, that was my thought as well. Red team code is supposed to be quick and dirty. It's the attacker, not the defender. It doesn't have to be pretty or work well, it just has to breach the target system.

Re:It is a tool to hack, you idiot

[Sique]

Apparently, the bad code has been known to some secret services for some time. And that means that other secret services had the time to exploit the bad code and use it as an attack vector back against the NSA. I would be very wary to know that my opponent knows how shoddy my own code is. If for instance you can hijack encrypted communications, you can feed the communication any desinformation you want, and the original attacker believes it to be the real thing.

Re:It is a tool to hack, you idiot

[ubrgeek]

> many weapons have been poorly designed and/or rushed into service

Yup. Just ask the Gorn.

Re:It is a tool to hack, you idiot

[drinkypoo]

Yeah, that was my thought as well. Red team code is supposed to be quick and dirty.

I think that's a somewhat strong statement. You want your code to work when you deploy it. It's supposed to work. If it works, then it's a working weapon. If it has bugs that impede its function, then it isn't. If the tool can be used against the initiator, because the back channel isn't protected, then it's not just a weapon — it's a hazard.

Re:It is a tool to hack, you idiot

[Anonymous Coward]

Red team code is supposed to be quick and dirty. It's the attacker, not the defender.

Somebody should tell the makers of Hacking tools popular on carder forums and other black market venues. The Zeus botnet code was like a fine Swiss watch compared to this crap put out by our NSA. When you're producing a hacking toolkit and selling it to others with support, quality and sophistication matters. Once again the government fails where the private market and competition succeed.

Re:It is a tool to hack, you idiot

[PolygamousRanchKid]

"Oh man your shell scripts suck!"

I'm thinking that this could pave the way to a new geeky genre of the "Yo Mama" jokes.

"Yo NSA code is so bad, __________".

Re:It is a tool to hack, you idiot

[Aighearach]

Not only that, but what sort of idiot is this guy? Does he realize that he's clowning himself when he says, "I would expect relatively bug-free code." Why? Because it is the magic Goobermint, or because unreleased internal tools usually get a large number of extra QA cycles looking for unreported bugs?

The danger to this code of bugs is actually regular OS and network service bugs that let users crack the machine and get access to this code. The danger isn't that a user who already is on the same machine might access the memory and shit. They already have the jewels at that point, there is no need for multiuser security here. It doesn't get installed on the target system, it gets installed on a staging server.

It is like complaining that an ammo dump isn't armor plated. That might not be a mistake.

Re: It is a tool to hack, you idiot

[Type44Q]

clowning himself...

May I suggest ceasing your [unsuccessful] attempts to use words "creatively?" It makes you sound like a clown.

Re:It is a tool to hack, you idiot

[Spazmania]

I'm pretty sure the NSA never intended to sell the code to anybody.

Re:It is a tool to hack, you idiot

[Anonymous Coward]

The world seems so simple when you solve all your problems with alcohol huh?

Re:It is a tool to hack, you idiot

[Anonymous Coward]

Ungha bungha, caveman beat your head in with rock, you dead now.

Hoo-rah! USMC deploys and pumps you full of lead, you dead now.

I think the caveman is a better red teamer tho

Re:It is a tool to hack, you idiot

[Anonymous Coward]

But when idiots steal the code and start using it to hack us, we can use the 'deliberate' bugs to hack their versions of the tools. See? The bugs are features.

Re: It is a tool to hack, you idiot

[Anonymous Coward]

He has a 5 digit user ID as well, so the guy is like 40. What a fucking weirdo.

Re:It is a tool to hack, you idiot

[Anonymous Coward]

You don't think they just made it sloppy because they were at work do you. It shows that their employees are slobs. Maybe you're a programmer, can you write some slop and really let it out without making it correct? I bet not, it'd drive me nuts.

Re:It is a tool to hack, you idiot

[Fnord666]

It doesn't have to be pretty or work well, it just has to breach the target system.

Sure, if you're using the "blast down the front door and storm through shooting" approach. On the other hand if you want to be a bit more subtle then your code needs to be tight and unobtrusive. The best attack is one that the defender never even knows about until it's far too late.

Re: It is a tool to hack, you idiot

[Aighearach]

clowning himself...

May I suggest ceasing your [unsuccessful] attempts to use words "creatively?" It makes you sound like a clown.

You'd almost think it was a standard phrase in my day. Oh, it was! Oh, it still is!

Trust me, there is no "creativity" required to use a common phrase in the common way. Upgrade your vocabulary, derpus.

Re: It is a tool to hack, you idiot

[Anonymous Coward]

I'm probably older (mid-50s) than you are, am an educated native English speaker, and have been working as a writer and editor in that language for over two decades. Yet I've *never* seen or heard "[to] clown oneself" until today--not in the US (where I'm from originally), not in Australia (where I lived for some years), and not in Canada, New Zealand, or the UK (each of which I've visited numerous times).

The dictionary confirms my recollection that "clown" as a verb is *intransitive* (cannot take an object), and the usual idiom is "clown around". So you're either wrong, or just making shit up. Please feel free to let us know which one it is.

Re:It is a tool to hack, you idiot

[Anonymous Coward]

> Cutting corners, minimal encryption... those could be considered advantages here.

How?

> 128-bit keys generated using 64 bits of entropy

Man, that doesn't sound like and advantage.

Re: It is a tool to hack, you idiot

[Aighearach]

Right, your ignorance of words do not do anything to change the words.

You actually think that dick-waving over how many places you visited has some sort of protective power that causes you to be less ignorant while not knowing about shit?

You don't know about a common term, and yet you claim to have had every opportunity to learn conversational English, well guess what? Maybe you're just not very good at vocabulary. Did you think of that, Sherlock? Fuck an A, talk about clowning yourself.

http://www.urbandictionary.com...

http://idioms.thefreedictionar...

http://www.thefreedictionary.c...

Figure it out, Charlie Brown. Being ignorant in multiple countries does not grant mystical knowledge of anything.

Well duh, it's government work

[Anonymous Coward]

They pay less, so naturally they will get the subpar programmers.

In other news

[Crashmarik]

Photos of the professor with under age children have been appearing all over the internet.

People have been puzzled why the material was on otherwise innocuous sites.

Re: In other news

[Type44Q]

Or the exact opposite: they send him a fat check, as per their agreement (the NSA funtions more effectively when it's being underestimated).

TTL

[Anonymous Coward]

I'm guessing that time to live is more important than having everything looking pretty with your i's dotted and t's crossed. These tools are for exploits that may not be around for ever. Getting the code live and useful is more important than anything else.

Re:TTL

[Megane]

It doesn't matter how pretty you make a bomb, in the end all it has to do is go "boom".

Then again, it does help if it doesn't fall apart before it hits the target.

Re:TTL

[Alwin Henseler]

I'm guessing that time to live is more important than having everything looking pretty with your i's dotted and t's crossed.

Absolutely. If TTL is set too low, data packets won't make it back to NSA's servers. But for NSA peeps reading this: do make sure to avoid TTL in the electronics! It's lethal for your spying device battery life.

Okay, professor.

[Anonymous Coward]

"I would expect relatively bug-free code."

And you say you are some kind of academic?

Those who can, do!

[Anonymous Coward]

Those who can't, teach!

Those in the middle, read comments here!

God is great! Ayaaayyyaayyya!

Front Door Access

[Anonymous Coward]

Remember, these are the people who want "Front Door" access to your computer. Without a warrant, without oversight.

You can trust them, they are the most skilled cyber-warriors on the planet!

Give them the keys to your front door, both physical and virtual! They are super competent and trustworthy.

Re:Front Door Access

[Aighearach]

We have no idea what they want, don't be such an ignoramus. Republicans in Congress want government to have "front door" access to your computer. Nobody knows what the NSA wants, because they don't even talk to the public about what they want, and they don't ask for anything but money, ever. And don't bother asking what they spent it on, they're not going to engage in a conversation with you where they tell you "no."

Re:Front Door Access

[Anonymous Coward]

They want to be able to plant child porn on your computer. Any other reason doesn't matter.

Re: Front Door Access

[Type44Q]

Front butt onry!

Re:Front Door Access

[Anonymous Coward]

That would be the FBI. The NSA doesn't give a damn about your fetishes. They do not need "probable cause" to harass you. The NSA is not a law enforcement agency.

Re:Front Door Access

[Darinbob]

They may be experts, but they probably still have interns who write code and then accidentally let someone steal it.

Re:Front Door Access

[dbIII]

don't be such an ignoramus ... because they don't even talk to the public about what they want

They talk to the press and some of us "ignoramus" types read it.
A bit of an amusing backfiring insult there Aighearach. The NSA don't get their government cash without saying in very broad terms what their aims are. We get to hear that stuff too if we pay attention instead of ignoring it.

Re:Front Door Access

[Aighearach]

They talk to the press and some of us "ignoramus" types read it.

Right and you have no way to tell if they're lying to you, or to the other guy, or if all of 12 different public theories were presented by them.

The Air Force hiding experimental craft by saying "it was a weather balloon" is beginner stuff, but these are professionals. There is no way you can receive information purported to be from them and have any idea if it is true or which parts are lies and why. There is a long history of the government hiding secrets by encouraging and even inventing conspiracy theories.

And then other countries are inventing conspiracy theories too, sometimes just to make us look bad. There are even NGOs from around the world with various agendas spreading propaganda and edited videos to make countries look bad. There are so many lairs involved, there is no basis to even consider what to believe; you can't believe anything in that environment, and it is probably that way by design.

You don't have to like it, but you still won't be able to make a credible claim to knowledge of the subject. Same as everybody else.

Re:Front Door Access

[dbIII]

Right and you have no way to tell if they're lying to you

Frequently they are but they still have to beg for money in public.

but these are professionals

The star trek set thing, what Snowden could get hold of and an increasingly long list of other things (outsourcing - WTF?) indicate otherwise. They are toy soldiers IMHO best replaced by the real thing.

credible claim to knowledge of the subject

You are the one calling us ignorant yet saying they never say stuff in public. Quite funny really and a bit of an own goal on your part. I don't have to be an expert to point out a really obvious fuckup do I?

Re:Front Door Access

[Perky_Goth]

They want the same thing Hoover wanted... And even if somehow they don't want it right now, it's terrible idea to allow them the capability.

Re:Front Door Access

[Aighearach]

Right and you have no way to tell if they're lying to you

Frequently they are but they still have to beg for money in public.

I can hear hamsterdance playing when you say that.

No, actually, they don't have to beg in public. You obviously don't follow politics well enough to already know the details, so you should have looked it up instead of just guessing that it might be the same as with non-secret agencies. But it was an awful guess, not even all members of Congress to get to the see how much money they're giving the NSA! They certainly don't come begging. We're not talking about NASA here.

Blathering about Star Trek doesn't cause a mind meld where suddenly knowledge about government funding enters your brain. You have to actually look it up in order to know about how it works.

You are the one calling us ignorant yet saying they never say stuff in public. Quite funny really and a bit of an own goal on your part. I don't have to be an expert to point out a really obvious fuckup do I?

You're not just ignorant, so fucking ignorant that you think I said "they never say stuff in public." You not only couldn't comprehend what I said, you can't even remember it, and didn't check before responding. You're responding in ignorance to things that where just said in front of you. There is no excuse for that sort of ignorance.

I didn't say They don't say anything in public. I said they say lots of things in public. Notice the small difference between those? What I said was that them saying things in public doesn't tell you shit, because they're actively trying to mislead you (that's part of the their job!) and you're led by the nose very easily. You have no way to differentiate "things they said that are true" and "things they said that are not true." And they have no obligation to even say anything, but they do have an obligation to obscure secrets. There is no way to weigh or measure any purported information about these sorts of secret government activities. Every party who purports to have a version of the truth has an agenda, and every single one of those sources could also have additional unknown agendas. Every party who purports to have information they weren't supposed to have, might have been tricked into believing stuff that isn't true, by the people they're accusing of doing whatever the thing is, simply to mislead them and everybody.

Anybody claiming to actually know anything conspiratorial is a credulous ignoramus. In this case, anybody claiming to know details about what information is or isn't true, is already a credulous ignoramus.

Re:Front Door Access

[dbIII]

Conspiracy theories can be comforting when you assume the conspirators are all powerful and nothing can be done about them, so you can just ignore them and move on.

Meanwhile back in reality the NSA is leaking like a sieve and we know far more about them than we would ever want to.

I must say your denial of what you wrote in your first post and the insults calling me stupid for taking your first post at face value are very amusing. Do you do balloon animals too Pogo?

Re:Front Door Access

[Aighearach]

That's a pretty lame approach, but very ignorant.

I'm not supporting a "conspiracy theory," don't be a blatant tool. I'm saying YOU can't KNOW which conspiracy theory to BELIEVE because you can't CHOOSE between then because the government IS KNOWN (in a non-conspiratorial, "this is their job" way) that spy agencies intentionally mislead you, AND other country's spy agencies mislead too while making it look like somebody else, and PRIVATE PARTIES also offer their own additional lies and propaganda for whatever reasons.

Yes, it is indeed stupid to claim that you actually know what it is going on. But what is even more stupid is your nonsense about assuming "conspirators are all powerful and nothing can be done about them." No, I'm saying you can't even know WTF is going on. No, that should not be "comforting," that is fucking idiotic. Humans are not comforted by confusion. The psychological reaction that is based on comfort is the one where you pretend you know what is going on. (regardless of if you're complaining or not)

You didn't "take what [I] wrote... at face value" at all. You still haven't comprehended it. You grabbed the nearest cliche that you had heard before, and took that at face value. Can you even read?

Re:Front Door Access

[dbIII]

"conspirators are all powerful and nothing can be done about them."

That is the approach you are using by insisting that they are an unknowable force dealing with the unknown.
Meanwhile in reality they appear to be toy soldiers best replaced by real military intelligence. Your vote could do something about that some day, they are not the Stasi and this is not East Germany.
Please wake up to what is going on instead of railing against people who dare to challenge your comfort zone.

Re:Front Door Access

[Aighearach]

No, I didn't say they're an "unknowable force dealing with the unknown." I said it is known that they deal in misinformation, have formal permission for lots of secret activities, have a large budget the details of which are secret, and it is their job to hide or obscure all the details of all that. It isn't unknown what their job is; it is known exactly where they are working when and in what way, etc, etc.

If you can't tell the difference between known unknowns and known knowns, you might as well not even bother. A known force with known formal powers and known jurisdiction, whose specific activities are both secret, and protected. That is pretty fucking far from an "unknowable force dealing with the unknown." And yet, you can never say anything particularly definitive or specific about them.

And then you talk about "wake up to what is going on," oh, what exactly "is going on?" You don't have any way to measure what anybody claims about that. And guess what! I don't have any way to weigh or measure what you say, either. You're just a guy waving his hands, insisting that their is a conspiracy of some sort, and that you know about it, and apparently you even think you have power to stop it, or else who cares if I "wake up?" The only way you can influence what the NSA does is by being in the Senate and being on the Intelligence Committee. And that committee isn't going to even want to change any of the things you may or may not actually be complaining about.

The only way I would have any reason to want to "wake up" and pretend I know what they are doing is if I was working for them. Because otherwise, there is really no utility in pretending to know shit that trained intelligence professionals with nearly unlimited resources have gone out of their way to obscure.

Conspiracy theorists are so credulous, they even believe stuff where the only evidence that it even exists are anonymous statements by professional liars [spies] purportedly made to journalists.

It is so impossible to believe anybody that you can't even be sure: A) That Snowden isn't still working for the NSA, with all the leaks being to distract from the real programs, or B) That Snowden was actually working for the Russians all along, and that they made up everything he pretended to leak, or C) That Snowden did work for the NSA, but most of what he leaked were lies that are planted in the systems in order to distract from or hide the real programs in case of a leak/theft. None of those scenarios are different than the type of things that are known from the history of espionage, nor are any of those actually stranger than the claims! There is no way to know at all, every potential party that would have access to actual information is a tainted party with clear potential motivations to lie, training in different ways to mislead you, and resources to carry it out on multiple tracks.

Re:Front Door Access

[dbIII]

No, I didn't say they're an "unknowable force dealing with the unknown.

That is exactly what you suggested and you then went as far as calling those of us that have been paying attention "ignorant".
Pathetic really. Especially your conspiracy theories A, B and C - you really are damaged.

If you had more contact with government and military you would be laughing at those ideas instead of trying to spread them.
Some of the five eyes stuff like spying on an Indonesian tobacco company shows how hopelessly mundane and mismanaged this stuff is. There is no Superman and he is not working for the NSA.

Re:Front Door Access

[Aighearach]

Right, things I didn't say, that you somehow thought were "suggested," that you have been told were neither said nor meant, OK, at that point you've established completely and without question that you misread it. And you're still defending your misreading of what I said.
Pathetic. Really.

Re:Front Door Access

[dbIII]

And you're still defending your misreading of what I said

If you didn't mean what you wrote then I suggest writing what you do mean instead. That will avoid a bit of confusion.
It looks very much like you are slamming anyone that pays attention to publicly available information on the NSA as "ignorant". Did you really mean something other than that?

By Design

[Anonymous Coward]

Clearly the NSA leaked these tools with built-in weaknesses so they could get others to install them, then they get to use them.

Re:By Design

[Aighearach]

Yep, that's what it says on the tin; "This conspiracy can never be proven or disproven, and you'll never have any way to know what is really going on or which lie is from which of a dozen "sides" are competing to lie to you.

This is why mindless flailing doesn't help the situation. There isn't an obvious direction to flail in.

Re:By Design

[clovis]

Clearly the NSA leaked these tools with built-in weaknesses so they could get others to install them, then they get to use them.

Or, perhaps they were copied directly from some guys computer from a folder titled "dev".

If you look on my computer, you'll see a folder named "scripts" with many megabytes of scripts in there. It's all historical stuff as I worked on various things or attempted to try something different. Dead ends and so on. Almost none of these were actually used. The things I actually used are elsewhere. I don't know why we would assume that these were examples of programs actually in use.

Sure, pal

[paiute]

You think this "leaked" code is the real thing?

Re:Sure, pal

[svanheulen]

It's been confirmed to be real: https://yro.slashdot.org/story...

Re:Sure, pal

[Anonymous Coward]

If you read tfa you'll realize this is not true. The headline is very misleading.

Re:Sure, pal

[Anonymous Coward]

No, I expect these are bought /licensed 'proof of concept' mock ups or verification's of what they paid - before they got to town refining the finished product. Remember the other st*net code was tight and compact
The prof is correct - but the real question is why string handling is STILL not checked and sanitized in commercial products. For what people pay - this should be professional negligence - but software has no actionable quality standard. It looks like CERT has a sock up its mouth, and not being let in on vulnerabilities. tut tut.

Re:Sure, pal

[dbIII]

We've seen what the NSA is now.
It's horse judges doing a "heck of a job" all the way down.
If it's utter crap that fits bullet points but is not fit for the actual task then it's the real thing.

The real issue

[Anonymous Coward]

You fool. The real issue is that they are doing this illegal spying on Americans in the first place. And it's bound to get worse with Hillary and Dems seemingly going to dominate this coming election.

Re: The real issue

[Anonymous Coward]

Cute that you think its a partisan issue

Re: The real issue

[footNipple]

It's not cute that you don't think it is.

And it's not the quality of the tools used against the people, it's the willingness to use them that is something that must be considered in choosing leftist leadership.

Re: The real issue

[Anonymous Coward]

Cute that you think its a partisan issue

I think it would be a disaster if Trump won, and that is not entirely because of what trump would do. Simply put if you can regularly get elected on a stack of blatent lies this bad, then democracy is in trouble.

That being said, I see no evidence this is a remotely partisan issue. Bernie might have done something, maybe. Neither Hillary or Trump is likely to do anything.

Re: The real issue

[Anonymous Coward]

Rather rich given the two presidents with the biggest domestic spying operations were Nixon and Bush Jr.

Re: The real issue

[Anonymous Coward]

NSA has been around for more than 60 years and no party has stopped them during this time.

What is your excuse for the other party?

The problem is clearly people who are willing to defend one of the two major parties.
They are lower than cucks, they love getting screed as much as they enjoy watching everyone else getting screwed.

Re: The real issue

[Anonymous Coward]

The ignorant masses have exaggerated the powers a President has. This exaggeration also applies to the powers and capabilities of the intelligence agencies. The President can neither magically make things dramatically better or worse. If Trump was to win the Presidency he would have to work with a legislative branch that absolutely hates him and will work to stifle any Presidential initiatives he tries to create. In fact they would spend all their time looking for any impeachable offenses he may commit.

The current US government is in dire need of change. Both the democrats and republicans need a time out and reality check. The high dollar supporters of both parties need to experience losing vast sums of money and ending up with nothing to show for their donations. The media has stepped out of the closet and turned into the National Enquirer where headlines attract readership but the actual content doesn't come close to justifying the sensationalist headlines. In the past the big media players could be more subtle in their support for one party over another. If Trump wins the media empire will see nothing but scorn and ridicule while at the same time losing their behind the scenes access to the office of the President.

And it is the time for a US President who brings to light just how worthless most of the US foreign allies are. The foreign allies are scared to death that they might actually have to become responsible for their own security instead of expecting the US to do it for them. If some country wants US military protection they should expect an invoice with at least 50% due up front.

All those people advocating a third party candidate who can win the Presidency have one staring them in the face. And make no mistake Trump is a 3rd party candidate who attacks the Republican party more than Democrats.

Trumps election would reduce the power of the behind the scenes establishment crowd for at least 4 years. If he accomplished nothing else it would be worth it to see both the Republicans and Democrats sit in the corner pouting about having no presidential power or support. All the harshest critics of Trump will be further diminished if Trump wins. They have bet everything on Clinton winning so their statements and actions will not hurt them. If Trump wins they are truly fucked because Trump doesn't strike me as the kind of person who lets personal attacks just slide by.

Trump has no government experience which could be a plus but it doesn't really matter that much. The US government is big and operates mainly on the inertia created over the years. It's a big ship that takes a long time to turn either way. Trump would not have the power to radically change anything or cause any real harm.
So why not let him slap the existing parties and their supporters in the face?

Re: The real issue

[Anonymous Coward]

Just pointing out the obvious here but:

If our choices are either Trump or Hillary, *Democracy is far beyond " in trouble ".

We the people will lose either way this goes.

Besides, if you think either candidate is doing this for the good of the people . . . .

bwahahahahaha

Re: The real issue

[Darinbob]

It's not cute anymore.

Re: The real issue

[Zontar The Mindless]

And it is the time for a US President who brings to light just how worthless most of the US foreign allies are. The foreign allies are scared to death that they might actually have to become responsible for their own security instead of expecting the US to do it for them. If some country wants US military protection they should expect an invoice with at least 50% due up front.

So you think it's really in the best interests of the US to let Putin reconstruct the USSR/Warsaw Pact as he seems intent on doing? And have you noticed all the Russian activity in the Middle East of late...? Guess not.

As soon as Trump started the spewing the utter horseshit which you parrot above, it became obvious he was either working for Putin, or might as well be.

Trump/Putin in 2016! It even rhymes, hey...

Re: The real issue

[Anonymous Coward]

wtf? "And have you noticed all the Russian activity in the Middle East of late."

hello pot, this is kettle calling...you're black!
So the Russians are involved in Syria, via Syrian airbases and Iranian airbases, both of which they received permission to use from the host country.

The USA on the other hand... is illegally operating with non-boots-on-the-ground boots in Syria.
We invaded Iraq.
We destroyed Libya.
We have bases in Kuwait, UAE, Saudi Arabia, Iraq, Syria, Yemen, Afghanistan, Egypt, Libya.

But look over there, those damn Russians!

Re: The real issue

[Anonymous Coward]

Trump supporters have done the rest of us a massive favor.

They've given us a heads up on just how much of a failure our particular style of "Democracy" is.

It is clear, it is indisputable, and it is very upsetting.

Now what are we gonna do ?

Re: The real issue

[Coren22]

Except for Obama who expanded Bush's domestic spying.

Scary

[Anonymous Coward]

You don't like someone? All you have to do is place child porn pictures on their computer, alert the authorities, and even if they've never seen the pics, they are going to the hole for a long time. And it's quite easy to get the pics there too. USB, web link, email attachments, all so easy, and once the evidence is there, you're screwed, even if you deleted it, short of reinstalling windows, (and even that might not work) or replacing new harddrive.

The police and society at whole have no sympathy for "child molestors", despite the fact that VIEWING A PICTURE IS AN INNONCENT CRIME. But people just believe the hysteria, for the children nonsense, etc. and run with it. Or some are just on power trip and love to see others locked away for 10+ years for an activity that didn't harmed anyone.

I'm honestly surprised a lot more people don't try it, seeing how easy it is to frame someone with it. Welcome to 1984.

Re:Scary

[Anonymous Coward]

Actually the FBI has already been caught putting pictures ONTO peoples' computers in order to gain warrants. They don't do it directly, they do it by proxy through hacker groups they hire "for investigations", but it's been revealed that the hackers will put the material onto the computer, alert the FBI that this has been successful, go back and retrieve the pictures while the FBI watches, and thus giving the FBI what they need to breach the location. It's all pretty damn shady if you ask me. Does our FBI even do anything that's not semi-criminal, any more?

Re:Scary

[GodelEscherBlecch]

The police and society at whole have no sympathy for "child molestors", despite the fact that VIEWING A PICTURE IS AN INNONCENT CRIME...for an activity that didn't harmed anyone.

I've seen you seed this unsubtle agenda into other comments before (or, God help us there are more than one of you out there trying to rationalize child porn to yourselves). It is clearly something in which you have a personal stake. Get help.

Re: Scary

[Anonymous Coward]

Are you able to respond to a rational argument with a rational counterargument or is ad hominem and threats the only way you know?

Re: Scary

[Anonymous Coward]

Are you able to respond to a rational argument with a rational counterargument or is ad hominem and threats the only way you know?

Different AC here.
When the question at hand is the character and activities of a person (the apologist for viewing child porn), then ad hominem attacks are logically correct.

Re: Scary

[bytesex]

Does someone really need to make the rational argument that demand creates supply?

Re:Scary

[Anonymous Coward]

when it was discovered that the italian guys from the hacking team had a pluggin with the name pedovideo, and pedopicture to upload that kind of material to computers and that software was bought by not only north korea style evil regimes but by regular countries, that was INSANE, seeing police in a democratic country buy a software with a module designed to upload pedo stuff to some activist computer is fucking sad, those police forces and countries are tainted forever

Re:Scary

[dbIII]

There have been people convicted for viewing cartoons so it is a bit of a point that things have gone a bit far off track from preventing child exploitation.
We keep on letting the child rapists like Roman Polanski go free while using pictures as an excuse for paramilitary raids on suspects.

Re: Scary

[Zontar The Mindless]

If he'd stopped at "viewing a picture is innocent", you (and he) might have a point. But when he went on with, "for an activity that didn't harmed [sic] anyone" he revealed an agenda that most folks who aren't paedos would take issue with.

Re:Scary

[Anonymous Coward]

In 1977, after a photo shoot in Los Angeles, Polanski was arrested for the rape of 13-year-old Samantha Geimer and pleaded guilty to the charge of statutory rape. He was released from prison after serving 42 days and was told that the prosecutors had agreed to ask for him to be put on probation. When he learned that the judge planned to reject the plea bargain, he fled to Paris before sentencing. He publicly offered his apology to Geimer, telling her he regretted the episode. In September 2009, he was arrested by Swiss police and later released after Swiss authorities denied a U.S. request for his extradition. In October 2015, after another request for extradition, a judge in Poland refused the request. Geimer supported the Polish decision, adding, "He said he did it, he pled guilty, he went to jail. I don't know what people want from him."

Re:Scary

[dbIII]

Yes, probation for raping a kid and serious jail for looking at pictures of imaginary people. Pretty fucked up isn't it?
I'm not defending the people looking a pictures of real kids just pointing out that maybe we should be going after the ones actually taking the pictures or raping the kids a bit more than the current lazy policing.

Re:Scary

[peawormsworth]

You are responding to "Anonymous". So how exactly do you assign multiple conversations to one person?

There may be others who agree with these types of ideas and comment independently. And probably more who don't say anything at all because there is a bit of a witch hunt when it comes to everything related to this. If you are ever accused of anything like this, I expect you will find that logic and fact will go right out the door, and you will suffer regardless of the outcome.

IMO, what you see does not define who you are, what you think or how you feel.

Re:Scary

[GodelEscherBlecch]

You are responding to "Anonymous". So how exactly do you assign multiple conversations to one person?

Because writing styles and personal agendas are distinctive. But who cares about that, because now here you are with an actual user account repeating the same disgusting agenda.

And probably more who don't say anything at all because there is a bit of a witch hunt when it comes to everything related to this. If you are ever accused of anything like this, I expect you will find that logic and fact will go right out the door, and you will suffer regardless of the outcome.

Bull. Fucking. Shit. Read this again:

despite the fact that VIEWING A PICTURE IS AN INNONCENT CRIME...for an activity that didn't harmed anyone.

This is not a statement about false accusation, having pictures planted or innocently stumbling on something. This is a rationalization for why such an action should be acceptable. It isn't. 'Viewing' and 'activity' are not passive words. And stop calling it 'this'. It's 'actively viewing child pornography'. Insert that in your comment instead of 'this' and re-post it if you feel so strongly about it - your shitty attempts at semantically softening the issue are not convincing anybody, and clearly illustrate that you yourself know you are wrong and need to obfuscate with vague language.

IMO, what you see does not define who you are, what you think or how you feel.

Nice try again using the passive 'see' not 'view'. You have obviously spent a lot of time convincing yourself that 'this' is not a crime and that people who do 'this' are not in need of serious help. Nobody else is falling for it.

Not Surprised

[organgtool]

Security vulnerabilities are discovered and patched all of the time. It doesn't make sense to spend a lot of time writing extremely meticulous code for an exploit that could be patched by the time you're done writing the exploit code. Combine that with the fact that there's probably a ton of vulnerabilities in a lot of different applications, drivers, and firmware and it probably makes more sense to focus on quantity of exploits rather than quality.

Re:Not Surprised

[Anonymous Coward]

well, it doesn't make sense unless you want the code to work and you are a competent programmer in the first place. The obvious errors show they have little idea how to do it properly.

Re:Not Surprised

[Anonymous Coward]

Your statement doesn't match the article.

The code in question is payload code -- something you install *after* a vulnerability has seen used to gain access. It is not throw-away code, but code you should expect to use over and over again for years.

Re:Not Surprised

[Anonymous Coward]

Code generated by genetic algorithm would look pretty funky. I could imagine something genetically optimized to break a certain kind of program could have all kinds of strange vestigal parts.

Re:Not Surprised

[Anonymous Coward]

A big part of writing quality code is separating the parts that change from the parts that don't. The same is true with hacking code and exploit code. There should be a high quality framework or harness which can accept custom build modules for the individual exploits and any custom one-off exploitation code that's required. In fact, this is precisely how many of the high quality botnet and hacking tools maintained by the Russian criminal gangs work. Maybe our government could learn a thing or two from the bad guys for next time.

Re:Not Surprised

[janoc]

Are you really so naive as to believe that the sloppy crypto code is not reused elsewhere?

He isn't talking about the exploit code but some parts of the payload - crypto and some packet handling stuff.

Re:Not Surprised

[Anonymous Coward]

Meticulous?
There was a massive chain of IFs using the same prefixed string of data plus one minor changing facet, a version number.
That could have easily been done using a looped array check in a TENTH of the lines.

I mean, damn, they have some impressive hacking going on there in the NSAs, but for crying out loud, compact your checks please!
Pretty sure all the hardware in that list have CPUs with branch prediction.

What did you expect?

[PPH]

Our best guy is on vacation in Moscow.

Re:What did you expect?

[campuscodi]

From what I've read. Snowden was actually mediocre.

Re:What did you expect?

[Anonymous Coward]

That doesn't mean that he wasn't the top guy at NSA.

I would expect relatively bug-free code....

[Anonymous Coward]

There will always be bugs in software it's how you mitigate / react to them that counts in this day and age. I wonder if this guy has ever written anything other than research papers?

Outsourced, bitch!

[Anonymous Coward]

Yeah, the pakis and Chinese can't code for shit.

not surprising

[Anonymous Coward]

it would be written very fast; the goal being to get it functional as fast as possible, not to make it bullet proof nor do more than what it is supposed to do. So i'm not surprised how shit it is.

those scripts are not bad

[Anonymous Coward]

they are just niggerlicious

quality

[Anonymous Coward]

Irony: Some of the kids who wrote that code took classes from the professor in college.

Dump-a-drumpf 2016/Forever

TL:DR; NSA SUCKS.

[Anonymous Coward]

ok so like the NSA got pwnt because they asshat-miscrypto-cleartexted the shit out of trillions of dollars worth of strategic vital interest defensive and offensive cyberweapons while exposing us to digital armageddon by revealing a global infrastructure of intentionally, illegally, and poorly back-doored hardware while being recorded for 3 years by our enemies engaging in top secret god knows what the fuck in an information age geopolitical information warfare climate of 2013-2016? did i get this correct guys? oh and never mind the global financial race between thousands of entities to to buy 1/28th of the bitcoin market which doesnt have enough liquidity and a low cap that will crash the world finacial economy and make the shadow brokers owners of about 1/30th of the global electronic currency system (assuming they only sell it once, which they wont). the jfk assassination is starting to look like a day in the life of the kardashians. #makeamericagreatagain #blacklivesmatter #pewdiepie

Re: TL:DR; NSA SUCKS.

[Anonymous Coward]

Got my vote for the 'comment of the year' award.

Re: TL:DR; NSA SUCKS.

[Anonymous Coward]

Got my vote for the 'comment of the year' award.

"comment of the year written by a 18 yr old"

It does the job, move onto the next thing

[HalAtWork]

.....is what they're thinking I'm sure. They probably destroy the VM after using the tool anyway.

1 or 0

[Anonymous Coward]

Consider the possibility that the leaked code may be disinformation.

Re:1 or 0

[Anonymous Coward]

Good point -- compared to the Stuxnet code (which was supposed to have been extremely well written), this code may have been intentionally badly written and left out to be found. Maybe this is the new way the the NSA obeys the law that requires them to reveal vulnerabilities that they discover :-) Of course, Occam's Razor would claim that the Equation Group is just a bunch of poor programmers writing for the NSA...

Everything is easy.

[RyanFenton]

In retrospect.

Suddenly those spent costs no longer seem like they should have cost as much.

And those lessons learned? We should have just known those!

It's why industry refuses to spend anything on basic research anymore. SOO inefficient, and with priorities that make no sense to some random consultant or investor.

[sarcasm]
Pff - NASA, I could do better than that! Here - I'll just make up an ideal, say, random number generation that I just happen to have a library of code on, and WOW - I do SO MUCH BETTER than them. Not impressed, NASA, not impressed.

I don't even have to bother understanding the ideals that their code was actually built towards!
[end sarcasm]

Ryan Fenton

Re:Everything is easy.

[RyanFenton]

D'oh - NSA, not NASA. Nevermind - Feel like an old SNL sketch there.

Ryan Fenton

Meh

[Greyfox]

I've yet to see a computer science professor with particularly excellent code, either. I run across assignments and example code from courses on a regular basis that fall into the "Never, ever do that" category of programming. Case in point, a relative of mine recently had some questions about a CS programming assignment. Part of the assignment description talked about design patterns and predictably went straight for the Singleton as an example. I'm pretty sure that's the only pattern that about 90% of programmers ever actually learn when reading about design patterns and it's so abused in the industry right now that you can basically never get one past a design review board.

Anywhoo, back in the '90's I worked for a company that was getting a B2 Certification for its operating system. My job basically consisted of reading the entire AT&T C standard library code, finding potential security flaws, writing tests for those flaws and then writing a report with the tests which would be delivered to the NSA. I found the remote buffer overflow in the AT&T telnet daemon a couple years before the same overflow was discovered in the Linux telnet daemon. So the NSA basically outsourced the hard work of finding all those exploits to the companies that were trying to get security certifications. It took three or four guys just a few months to go through all the stuff we had to look at. I'm sure we missed a bit, but I was much more confident in the security of their OS at the end of all that. Too bad they eventually went out of business, were acquired by IBM and their products were killed. You know, progress!

Re:Meh

[jittles]

I've yet to see a computer science professor with particularly excellent code, either. I run across assignments and example code from courses on a regular basis that fall into the "Never, ever do that" category of programming. Case in point, a relative of mine recently had some questions about a CS programming assignment. Part of the assignment description talked about design patterns and predictably went straight for the Singleton as an example. I'm pretty sure that's the only pattern that about 90% of programmers ever actually learn when reading about design patterns and it's so abused in the industry right now that you can basically never get one past a design review board.

Anywhoo, back in the '90's I worked for a company that was getting a B2 Certification for its operating system. My job basically consisted of reading the entire AT&T C standard library code, finding potential security flaws, writing tests for those flaws and then writing a report with the tests which would be delivered to the NSA. I found the remote buffer overflow in the AT&T telnet daemon a couple years before the same overflow was discovered in the Linux telnet daemon. So the NSA basically outsourced the hard work of finding all those exploits to the companies that were trying to get security certifications. It took three or four guys just a few months to go through all the stuff we had to look at. I'm sure we missed a bit, but I was much more confident in the security of their OS at the end of all that. Too bad they eventually went out of business, were acquired by IBM and their products were killed. You know, progress!

I use singletons at work ALL the time. But only for hardware resources that I don't want someone to try and create more than one instance to. I can only have input and output stream on my device and, sure, I could make that static, but if I make the whole object obviously a singleton to the person using it, they get the idea that there is a limit on the hardware. Now, granted, if I was in the business of providing access to multiple instances of the same type of hardware, that would not be acceptable.

Re:Meh

[Greyfox]

Is there every any particular need to limit them, though? A couple decades ago it was uncommon to have more than one sound device on a machine. Now it's unusual not to have two or three. Designs and requirements change over time, and having to factor out singleton behavior that was never really necessary in the first place is kind of a pain in the ass. You could easily just create those things with thing factories when the program starts up, and pass them around to objects that need them. No artificial limits, and you don't have to factor out singleton behavior when you decide you want two things where you used to only have one.

I've found that design review boards are becoming increasingly hostile toward singletons, too. There was a narrow window where they'd at least consider one, back when people started talking about design patterns. These days it's next to impossible to get one approved, even if there's pretty good justification for it. You can always design around the need for a singleton, and usually the system design will be better without them.

Re:Meh

[jittles]

Is there every any particular need to limit them, though? A couple decades ago it was uncommon to have more than one sound device on a machine. Now it's unusual not to have two or three. Designs and requirements change over time, and having to factor out singleton behavior that was never really necessary in the first place is kind of a pain in the ass. You could easily just create those things with thing factories when the program starts up, and pass them around to objects that need them. No artificial limits, and you don't have to factor out singleton behavior when you decide you want two things where you used to only have one.

I've found that design review boards are becoming increasingly hostile toward singletons, too. There was a narrow window where they'd at least consider one, back when people started talking about design patterns. These days it's next to impossible to get one approved, even if there's pretty good justification for it. You can always design around the need for a singleton, and usually the system design will be better without them.

In this case, most of the time, yes. There are exceptions, I am about to start a new project where the limit on the number of devices would be an issue. But I write drivers for credit card terminals on mobile devices. So unless the project specifically requires multiple credit card terminals (not common and the project I am referring to that will require it is due to the fact that one terminal may be hard configured for one currency and the other the USD), we intentionally limit the mobile device to one terminal. Since you have a single merchant performing a single transaction flow with a single customer at any given moment, there is rarely any demand for any other behavior. We try to make it as easy as possible for the mobile developer unless they specifically need different capabilities.

Re:Meh

[jittles]

And let me be more clear, I wrote the software in layers. One layer speaks the native protocol of the device and the other is an abstraction layer that hides details of the specific device and makes it a more generic credit card terminal interface. The enforcement of a singleton happens at the publicly exposed layer and can be more easily removed.

Re:Meh

[dgatwood]

Singletons are a good default design pattern to use if you need something that should typically be shared across lots of pieces of code (e.g. a cache). With that said, my general policy is that you generally shouldn't design classes that are limited to use as a singleton. You should always provide the ability to allocate additional instances unless it is impossible to safely have more than one instance for some reason (and you must justify why this is the case).

Good Enough For Government Work

[Anonymous Coward]

It's widely known that the best and brightest Americans rarely work for the government. The bureaucracy is slow, filled with low intelligence and rules oriented persons, and is generally allergic to actually getting anything useful done. Oh, and the pay sucks too. What's not to like if you're a young, intelligent and entrepreneurial techie? As it turns out, quite a bit. It should surprise nobody then that the best techies work in the private sector and government gets whatever is left to write poor quality code with very short shelf life.

Whos naked?

[pabloesgalhardo]

He can mock their code but thats how they got all his emails, internet browsing history, phone calls, text messages and gps coordinates for the last 10 years or more...

Work done by H1B visa holders

[Anonymous Coward]

Well, whaddaya expect? The gubment put the task out to bid. The lowest bidder got the contract with a lowball bid. in order to make money, they hired H1B visa holders to do the coding, and gave them impossible deadlines. But, hey, the code was good enough for government work.

Random Numbers

[raftpeople]

Is it possible the NSA knows something about existing pseudo-random number implementations and is purposefully working around that issue in this code? The professor seems to ignore this possibility.

Re:Random Numbers

[Anonymous Coward]

Is it possible the NSA knows something about existing pseudo-random number implementations and is purposefully working around that issue in this code? The professor seems to ignore this possibility.

Intel's RDRAND is solid afaik. I don't know why you would use anything else, if the instruction was available, and you were the NSA. Does anyone have any reason to think it isn't? Still if you want to be paranoid generate the key random numbers multiple different independent ways and xor them together. Certainly you would not want to rely on only a pseudo random source if you could avoid it.

Re:Random Numbers

[raftpeople]

Snowden revealed a few years ago that the NSA was able to decrypt most of encrypted traffic and stated there is a high probability that things like RDRAND are compromised.

Re:Random Numbers

[david_bonn]

That's possible, true.

But it is hard to see that someone would "fix" that problem using the approach given in the code sample. Basically their "fix" only produced 64 bits of entropy for a 128 bit key, which is a 101-level cryptography mistake. It also took more time and was much more complex than a straightforward implementation, which kind of kills the argument about the authors having to work quickly. This is one of those screwups that required thought and effort. I'm left with two possibilities:

(1) The NSA is hiring complete amateurs to write their exploit tools, and they aren't giving any adult supervision (or code reviews) to the products of those amateurs.

(2) The NSA/Equation Group didn't write this code at all.

Re:Random Numbers

[Anonymous Coward]

Or, they were told to make it easy to break in case it fell into the wrong hands at some point.

Re:Random Numbers

[Aighearach]

In the old days we presumed that everything was compromised, and everything done online recorded multiple times.

Re:Random Numbers

[Anonymous Coward]

I would go for [2].
It was written by Ankit Fadia, the legendary Indian "hacker"

Re:Random Numbers

[Anonymous Coward]

Who's "we"?

Re:Random Numbers

[Anonymous Coward]

or (3) The NSA purposefully leaked this, hoping others would use it and the NSA would be able to eavesdrop etc.

Professor's logic is one dimensional

[Anonymous Coward]

Did he consider that perhaps NSA is smart enough to not leave their fingerprint i.e. NSA-like code all over the exploits? There are more layers of security to consider than the code itself and plausible deniability ought to be right up there should the code ever get leaked. They also have been known to buy exploits on the black market, which would also have the added benefit of concealing the true source of the hacks.

Re: Professor's logic is one dimensional

[Anonymous Coward]

Ah right, they didn't want to leave any traces. That's why the docs instruct to leave a specific string on infected machines to prevent reinfection.

magic

[Anonymous Coward]

0xDECAFBAD Indeed.

what if we're being lied to?

[eyenot]

What if the shadow brokers didn't hack and steal NSA code, but simply had some part in writing the code to begin with and perhaps what they're selling is unrefined prototypes?

Frankly I have no reason to believe that the shadow brokers and the equation group are even separate entities. If equation group are as good as they are supposed to be, then it makes more sense that for some reason equation group are playing a game with the public. (I highly doubt they'd try and play a game with the NSA.)

I have also seen that the NSA has been trying to make itself somewhat more transparent and useful to the public in the last eight years. Not exactly taking strides but there have definitely been gestures. Perhaps this is the only way they know how to release tools to the public while avoiding accountability under a government that doesn't comprehend the benefits of transparency or educating the masses in cyber security. It would also explain how federally held bitcoins have been trickling into the shadow brokers' wallet.

Just sayin'.

Bomb researcher not impressed with IED

[Overzeetop]

Expert: I mean, look at it - it's a bunch of nails and duct tape around a low explosive core which doesn't have nearly the proper confinement for even 50% of the maximum shock wave capable, much less the ability to transition to detonation. And this wiring - that's just disgraceful - the solder didn't even flow properly here, and this is entirely unsheilded - anything could set this off accidentally, even a cell phone. If you were in my training program, you're fail miserably.

Terrorist: We used one of these yesterday to kill 25 people and injure another 70 in a market in Aleppo.

Expert:...

Re:Bomb researcher not impressed with IED

[raftpeople]

I know. The professor admits he's not a cryptographer and then criticizes the way NSA forms a random number, which is a critical piece of crypto. Maybe they know something about crypto that he doesn't.

Re:Bomb researcher not impressed with IED

[Anonymous Coward]

Amateur means 'for the love of something'. He doesn't have to be a professional to recognize quality verses crap.

Re:Bomb researcher not impressed with IED

[Anonymous Coward]

A professor isn't going to call him or herself a 'cryptographer' unless that's what their PhD / research has focused on.

Re:Bomb researcher not impressed with IED

[lars_stefan_axelsson]

Expert: I mean, look at it - it's a bunch of nails and duct tape around a low explosive core which doesn't have nearly the proper confinement for even 50% of the maximum shock wave capable, much less the ability to transition to detonation. And this wiring - that's just disgraceful - the solder didn't even flow properly here, and this is entirely unsheilded - anything could set this off accidentally, even a cell phone. If you were in my training program, you're fail miserably.

You'd be right they'd fail the course and be booted out! And for good reason. I can assure you that you have special operations soldiers in the US who can and do use IEDs (for black flag, or deniable operations if nothing else) and you can be likewise sure that they will look like cobbled together crap (in case they're detected before they go off) but will not actually be crap. They'll go boom every time, because there's nothing worse than having a meticulously, planned and executed operation, months in the making, go south at the very last moment because the bloody bomb doesn't go off when it should! When that happens heads will roll. Even literally.

If there is e.g. soldering to be done, you can bet your sweet arse that it'll be done by someone who knows how to do that, or has been properly trained. Why do you think that it cost the US millions to train such as soldier, while AlQueda or ISIS makes changes out the $100 or so they spend? Sure large bureaucracies are inefficient at times, but they're not that bad. That money goes into things like this.

So. It's the bloody NSA we're talking about here. The most highly funded intelligence organisation in the world. The people behind stuxnet etc. I expect nothing short of perfection from them, and meticulous attention to the details that matter. Born from long experience of what not to do, and analysis of how to do it better, faster, cheaper. The same way I don't expect the USAF to fly aircraft with bits falling off them mid flight. For the same reasons.

That the NSA doesn't have their shit together is quite noteworthy, given what you'd expect. What it means is another question altogether, and not that easy to speculate on.

almost nobody knows what they are talking about

[Anonymous Coward]

https://www.youtube.com/watch?v=LdZFmeMWrtk&feature=youtu.be&t=112
(c) John Cleese

great watch btw

and now ... finally

[Anonymous Coward]

now what has been leaked looks to have lost credibility, and looks like it is bait-ware.

I would bet it is crappy - the actual tools are built by committee and non-technical folks make technical decisions and assert things like "get that done today or else". I bet there is some crappy in the actual code. I don't know how much.

I'm betting that the ones who got robbed are the incompetent boobs of the bunch. I bet also that the highly competent folks figured out the boobs might get hacked and left some "breadcrumbs" in the system.

Softpedia es soo woode (voice of jar jar)

[WaffleMonster]

Why does softpedia link to everything except the source?
https://www.cs.uic.edu/~s/musi...

It's too easy to pick things that make no sense to you apart. I don't understand x, y and z and therefore I conclude in typical know it all academic think "This is ridiculous". The following is just conjecturbation and is likely to be totally wrong.

If your deriving a symmetric encryption key you never actually transmit perhaps some nerfing is intentional so the intended receiver has a prayer of expending energy to derive it. There could be a calculation embedding asymmetric keys is an unnecessary (attribution?) risk leaving crap like this where anyone with sufficient resources could plausibly decrypt a more appealing option.

The consequence of not using random IVs is situation dependent and can range from the safe default of very detrimental to beneficial given certain operating constraints.

Authentication is a double edged sword. If your adversaries don't know what key or data they are looking for providing a known authentication mechanism is an unnecessary gift.

Purposefully so?

[Anonymous Coward]

Buggy code = hey some script kiddie put this crap on our system.

Gleaming perfect code = hey, this must be a nation state or some nationally backed entity.

64 bits

[religionofpeas]

128-bit keys generated using 64 bits of entropy

I'd like to see the professor brute forcing 64 bits to show exactly how weak that is.

A good use of taxpayer money?

[davidwr]

Which is a better use of taxpayer money for something that won't get re-used a lot and which might have a short shelf life?

1) Expensive, good, and late, possibly too-late-to-be-useful?

2) Slightly less expensive, crappy-but-functional, and on time

Sometimes the answer is #1, sometimes it is #2. Sometimes you just don't know and you (or your bean-counting managers) have to make a call that might be wrong.

Bottom line:

I'd much rather the hacking tools be crappy than the code that runs something that directly affects tens of millions of people, like, oh, I don't know, the software that makes sure Social Security checks go out on time and in the right amounts?

those that can't

[Anonymous Coward]

...teach.

Too Wong Fool

[Anonymous Coward]

When you rule with technology don't be surprised when someone else comes along and beats you at your own game. #Japanese2016

Code for buggies?

[mspohr]

Buggy code? Why is the NSA making code for buggies? I thought buggies and horse whips were "old tech"... do people still use them to get around?
Perhaps a buggy is the best way for terrorists to avoid detection. Then I could see putting some code in the buggy to track them... but where would you put it? Maybe in a horse or donkey?

Re:Code for buggies?

[Aighearach]

With all the drunk drivers on the road, every buggy should have a dash cam and automatic emergency services notification.

And it is probably worth considering a backup camera while you're doing the install.

These people at least have GPS:
http://thefw.com/horse-and-car...

This buggy has lots of electronics:
http://gajitz.com/literal-hors...

If I was the NSA, I wouldn't want all those data streams slipping through the cracks.

Evidence of NSA outsourcing?

[Anonymous Coward]

Perhaps NSA followed the lead of the Office of Personal Management and outsourced the code writing to the Chinese?

Have to ask ...

[PinkyGigglebrain]

Whats worse?

The buggy code that can hack a server

or

the buggy code running on the server that can be hacked?

Time to Market ...

[Anonymous Coward]

Let's assume this actually is NSA code. By definition, they're working against the clock. They're exploiting vulnerabilities that the vendor might patch tomorrow, next month, next year or never. They have to assume tomorrow and work against that.

You also have to factor in deployment windows. In the case of stuxnet, I seriously doubt Iran was dumb enough to hook up their uranium extractors to the internet. Yes, you can go spear-fishing and hope you catch the right fish or you can intercept a cisco router and replace the firmware... which again puts you in a time crunch.

Finally, how many people do you think they have working on this? I've done management on projects with the lowest level of Federal security clearance and we have a hard enough time finding cleared staff that know their ass from a hole in the ground. I'd be surprised if the development team was more than 10-20 people and I seriously doubt they have a formal QA team.

TLDR; It works. Mission accomplished. (Yes, I used that on purpose).

Not surprising, people who are usually excellent..

[Assmasher]

...at reverse engineering and cracking tend to be extremely 'pragmatic' in their approach to creating software.

People are constantly confusing programming with software engineering. Look at Google for example, look at the design decisions behind golang. Google has lots of very smart people no doubt, but golang was designed around their pervasive weakness - they do not tend to be good software engineers (experience will usually lead them there though.)

Yeah, US Govt Incompetent

[Anonymous Coward]

It's not a good sign when the supposed skilled parts of the US Govt show incompetence. Makes me doubt Aliens could be kept a secret by the US Govt.

Well, the Afghan government is incompetent. The Pentagon charges $1 million/solder year for Afghanistan. USAid isn't efficient. The VA still has big problems, in spite of the Senate subcommittee's promises of changes a few years ago. So, I guess if you hired Trump, and he hired Blackwater, Cintra, some former state governors, and Kaiser Permanente, and he appointed some people for oversight, things would be better.

Still, thousands of religious fanatics skilled in guerrilla warfare, in a nation with an indifferent populace is a very tough problem.

I bet you supported Ted Cruz.

Re: Yeah, US Govt Incompetent

[Anonymous Coward]

It's not a good sign when the supposed skilled parts of the US Govt show incompetence. Makes me doubt Aliens could be kept a secret by the US Govt.

That's what the Aliens want you to think.

Ummmm....

[Lisandro]

"The purpose of the keygen tool is to generate a 16-byte random number for use by the other tools. This simple task can be accomplished by reading 16 bytes from /dev/urandom."

No, not really - not if you want to maximize entropy. The procedure he describes afterwards seems awfully convoluted, but might be a good way of generating strong pseudorandom numbers in systems with a poor /dev/urandom implementation.

The NSA may not leave it's real tools laying out

[siriuskase]

Just saying, there is such a thing as disinformation

and it's not DJB

[Anonymous Coward]

As soon as I got as far as the mention of UIC, I assumed this would have been DJB.
https://en.wikipedia.org/wiki/Daniel_J._Bernstein

I had a teacher like this...

[Anonymous Coward]

The difference?

He *INTENTIONALLY* gave us buggy code. While there were a few 'written from scratch' assignments to do, he felt that 'reinventing the wheel' each new concept was a waste of time, and instead taught the proper way techniques were meant to be done, provided often extremely buggy sample code (from a hypothetical fellow developer at your company) and had you clean it up and fix any issues you found in the source code. He also always included a few obscure bugs which offered bonus points so an occasional bad day wouldn't ruin you if you were otherwise on-target. Interestingly enough his class success/failure rates still matched the course averages compared to other professors, despite this (The spread of ABCDF students was very similiar to less favorable classes, but one bad/missed test wouldn't ruin an A student, and even a D/F student early on could climb back to a C if they got serious by the middle of the semester. Most didn't.)

That said, many of the other professors I had did have sloppy code, and critique of it could result in punitive scoring against your own work.

Meaningless

[Anonymous Coward]

I would like to point out that everyone is assuming the leaked code is the version of the code that was used in actual operations. I would not be willing to rule out a purposeful "leak" with code that could be cleverly hiding a trojan horse (not the malware, the idea via the Greeks). Supposedly, in the 1980s the CIA learned of a leak of code that controlled pipeline valves etc, and instead of stopping the leak, the worked an attack into the code causing a large pipeline burst in Siberia. It is in a book "At the Abyss" and I admit it has some issues that make the truth not 100% certain.

Still, could the NSA have worked some clever way of tracking anyone that tries to exploit this leaked code and then leaked it themselves? My tin foil hat is firmly in place thank you.

Extracting RSA key from Cisco Pix

[manu0601]

The scenario of extracting RSA key from memory leaks on Cisco Pix reminds a lot about Heartbleed. Does Cisco Pix use OpenSSL?

Wrong target in the summary

[guardiangod]

an exploit called BANANAGLEE, used against Fortinet firewalls

If the submitter actually bothered to read the article, he would realize that BANANAGLEE targets Juniper, not Fortinet. Hoes does one make the mistake of mis-attributing to someone who was only mentioned once in the entire article?

Stuff that was released was written, just acquired

[Anonymous Coward]

And left unchanged to blend in with all the other script kiddies swimming the sewers with it. Best not to expose the good stuff until the initial poke has been done.

A better way to phrase it

[dbIII]

Your conspiracy theories A, B and C depict them as an unknowable force with perfect capability. That's a common factor with a lot of conspiracy theories where the exponents can feel comfort that there is somebody with infinite capability in control so they don't have to worry.
Reality is a series of fuckups some of which have got public attention. The theory that the fuckups are just there to lull us into a false sense of security instead of them being a bunch of toy soldiers that should be replaced with the real thing is especially pathetic. The amount of money being funneled through to private contractor that employed Snowden is staggering and proof enough that the NSA is a very long way from being perfect. The vast number of external bodies with hooks deep into the heart of the NSA would have made it very easy for foreign powers to get hold of everything Snowden had and more.
It's looking more and more that the NSA is more a machine to pump taxpayers money to people with good connections than anything to do with national security.