Slashdot Mirror
Yahoo's Government Email Scanner Was Not A Modified Spam Filter, But a Secret Hacking Tool: Motherboard (vice.com)
The spy tool that the US government ordered Yahoo to install on its systems last year at the behest of the NSA or the FBI was a "poorly designed" and "buggy" piece of malware, according to two sources closely familiar with the matter, reports Motherboard. From the article: Last year, the US government served Yahoo with a secret order, asking the company to search within its users' emails for some targeted information, as first reported by Reuters this week. It's still unclear what was the information sought, but The New York Times, citing an anonymous official source, later reported that the government was looking for a specific digital "signature" of a "communications method used by a state-sponsored, foreign terrorist organization." Anonymous sources told The Times that the tool was nothing more than a modified version of Yahoo's existing scanning system, which searches all email for malware, spam and images of child pornography. But two sources familiar with the matter told Motherboard that this description is wrong, and that the tool was actually more like a "rootkit," a powerful type of malware that lives deep inside an infected system and gives hackers essentially unfettered access.
Are we going to continue to move away from the definition of this word? If they designed a program to sift through all of the email they host then that is not hacking. Using non-prescriptive methods is hacking. If a group of software engineers professionally designed this, that is not hacking.
This is GREP, he snoops for the NSA.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Seriously Yahoo, just die already.
You are like a zombie that refuses to go down even after being shot in the chest 10 times.
Nobody likes you. Nobody wants you.
Don't make me get my shotgun...
I wonder what the timeline is between when the NSA-instructed "buggy rootkit" scanner was installed vs when the 500m - 1b accounts were hacked.
As I have always maintained, what is most troubling is not the government's surveillance itself, but the complete lack of accountability and oversight with respect to such policy, and that this deliberate opacity is used to hide government malfeasance under the pretense of protecting national security.
In a recent NPR interview I listened to on the radio, this is how the conversation played out: the interviewer kept focusing on drawing comparisons to situations where companies that collect and relay personal data might filter or flag such data for legitimate purposes (e.g., child pornography), and the interviewee did a remarkably poor job of addressing the real issue as I have mentioned above. So long as we focus on the legality of the surveillance itself, such discussions are a losing battle for advocates of privacy and personal liberty, because there are always persuasive moral, legal, and ethical arguments to be made in favor of some kind of broad but algorithmic surveillance without explicit human intervention or judgment. The real point of attack, then, is to bring attention to the fact that the government does their spying on the general public in a way that so totally removes any liability on their part that in the vast majority of cases, we either (1) do not know or cannot confirm the existence of such surveillance in the first place; (2) private corporations are coerced to cooperate and are prevented from divulging the methods used by the government to spy on users; (3) individuals who are subjects of surveillance are unable to defend themselves in a court of law because they aren't granted access to evidence; (4) there is no oversight of such surveillance programs to ensure no abuses take place or that it even operates as is claimed; (5) no results are ever shown that demonstrate the utility or effectiveness of such programs.
In short, if the government wants to throw our constitutional protections out the window in the name of keeping us safe, they could at least do it in a way that makes it clear that it's happening. But since they don't, the only logical conclusion is that they are entirely aware that their programs are illegal, hence the need to lie and hide. And this, I argue, is the root of the problem.
The problem is you have people who call themselves hackers, unfamiliar with the underlying code and why it was built that way, trying to use a hammer as a pry bar.
If you need a pry bar, make a pry bar. Make it from a cold pressed cylindrical bar, not from a piece of metal modifed from a spade.
We made the hammer, and the underlying code, for a different reason.
They need to realize if you intend to sup from the well of souls, that you must first be able to drink deeply and without ceasing. And that the act of doing so has impacts.
And, yes, they do care about you. FBI and NSA searches of specific people who are NOT supposed to be on the lists is a major problem, probably 90 percent of the actual individual searches. Happens in other spy systems as well. People are curious beasts, and they have their own motives which are contrary to the goals of the nation. They even justify violating our own Constitution by failing to understand WHY it says "Don't do this. Ever."
-- Tigger warning: This post may contain tiggers! --
And then, once it's in place and the bad men are caught, then sure. The agent can snoop on his ex-girlfriend's emails, for fun.
Because why the hell not?
Given that the feds can ask anything, using pressure that would be called extortion if I did it, then I guess they did snoop, pilfer and such.
No accountability. No control. No search warrant.
So why does it feel like the corporations should be on the phone to their congresscritters?
Why does it feel like the state AGs should be investigating ths heinous travesty of privacy and the citizens rights to be secure in their papers, conversations, etc. ?
This is why the US gov. has no trust by us. Don't let them play without supervison anymore.
NO soup for YOU!
Every time I read a post like this, I mentally disregard it quickly. Who are you to say who someone else cares about or not, and just because you make up some cnerios as to one might not like it, that means anything else doesn't exist/the ones YOU presumed on 0 basis are true? Mayhap you, and people like you, would push support for stronger security and the like if you didn't argue like you had the reasoning skills of a potato.
There is no such thing as bulletproof security on the internet. The Feds love the net because it's easier to police. Just think about what information can be gleaned from Facebook alone.
Dsniff Mailsnarf has been around for a long time. Add some additional code to that and it's real easy to grep for keywords.
as I said .. everything posted should be considered Public Domain. Encrypted or not.
If you can't live with that don't post it on the internet.
Also.. TOR networks were designed by the NSA so if you really think they don't have a back door in you are mistaking.
"does not"? How about denying that it ever existed on their systems? Or perhaps there is some element of the description that isn't quite right (hence the "described in the article")?
The real "Libtards" are the Libertarians!
If you Install it it is not Hacking.
If you gave it root it is not a root Kit.
If it is Buggy then what does that mean? it crashed?
You are allowed to install malware
I recall reading an article where they described daesh methods of communicating with potential recruits. The recruiters would create a new email account on yahoo then create a draft email with instructions on where to go, who to meet, etc. They would never actually send the message, nor use the account for emailing. They would then only give the username/password to the recruits for the account, the recruit would log in, and then just read the message in the drafts folder. So the 'rootkit' probably only looked for 1. New accounts created and were only logged into 1 or 2 times 2. Look at the origin IP of the new account. 3. Look for login access of an account who's origin is wildly different than where it came from when created. Just a theory...
Namaste
Mod ^ up - this, seriously. You don't care about your rights, that's fine. I care about mine. Don't fuck it up for me.
I had a friend once...anti-abortion....her logic: "I would never want to get an abortion, so it should be illegal."
Nothing like forgetting your sharing this planet with 7 billion other people that *might* have a different perspective.
The problem is that a gigantic percentage of the population hears "privacy", "NSA" or just reads the title and they immediately are outraged that somebody can read their E-mails. In reality, where some of us live, this doesn't mean a god damn thing. It means they will see the super secret recipe that your grandmother passed down, or see that you are getting scammed by 14 different companies. Tell me why you would not want the government looking at your E-mail. And be specific.
Re "no harm in this."
The United States Constitution is clear on what needs to be done to get a search warrant for domestic access.
Once that color of law sets in to set aside constitutional protections from mil and gov tasking over generations, all other protections are lost.
AC with sharing this goes to a city and state level. State task forces push requests up, other agencies push data down to the city and state level.
A lot of local eyes are now getting to see, requesting or getting the product of such domestic tasking.
Domestic spying is now "Benign Information Gathering"
as I said .. everything posted should be considered Public Domain.
Everything *posted* should be, yes. When I post a comment here on Slashdot the whole intent is for it to be viewed by the public. The same goes for what I post on Hackernews or Stack Overflow. It's a public forum.
Two parties conducting a private conversation via email are not intending it to be viewed by the public. They should have an expectation of (and a right to) privacy. We shouldn't have to assume every keystroke is available to the government. That's a shitty world to live in, and anyone who helps make it happen is anti-American.
I cant find a difference.
That would make a great news headline, eh Yahoo?
Yahoo also sends your Yahoo comments to the government for analysis. Sure, comments are publically posted, but they also send identifying information that is hidden, so you are instantly de-anonymized whenever you post a comment.
You are absolutely right. No concentration of power in the hands of a few individuals has ever been abused. Certainly there's no history of NSA operatives abusing their agency's capabilities to spy on individuals for personal reasons. There's also no history of the FBI creating files to blackmail members of the government and influence policy. Nothing to see, move along.
I am TheRaven on Soylent News
How does Yahoo know the government asked them for the access? Maybe it was the hackers that they seemed oblivious to for years? Do they really know? I don't trust Yahoo (less even than the government), as they sound incompetent.