Slashdot Mirror
Leaked Files Show How the NSA Tracks Other Countries' Hackers (theintercept.com)
An analysis of leaked tools believed to have been developed by the U.S. National Security Agency (NSA) gives us a glimpse into the methods used by the organization to detect the presence of other state-sponsored actors on hacked devices, and it could also help the cybersecurity community discover previously unknown threats. The Intercept: When the mysterious entity known as the "Shadow Brokers" released a tranche of stolen NSA hacking tools to the internet a year ago, most experts who studied the material honed in on the most potent tools, so-called zero-day exploits that could be used to install malware and take over machines. But a group of Hungarian security researchers spotted something else in the data, a collection of scripts and scanning tools the National Security Agency uses to detect other nation-state hackers on the machines it infects. It turns out those scripts and tools are just as interesting as the exploits. They show that in 2013 -- the year the NSA tools were believed to have been stolen by the Shadow Brokers -- the agency was tracking at least 45 different nation-state operations, known in the security community as Advanced Persistent Threats, or APTs. Some of these appear to be operations known by the broader security community -- but some may be threat actors and operations currently unknown to researchers.
The scripts and scanning tools dumped by Shadow Brokers and studied by the Hungarians were created by an NSA team known as Territorial Dispute, or TeDi. Intelligence sources told The Intercept the NSA established the team after hackers, believed to be from China, stole designs for the military's Joint Strike Fighter plane, along with other sensitive data, from U.S. defense contractors in 2007; the team was supposed to detect and counter sophisticated nation-state attackers more quickly, when they first began to emerge online. "As opposed to the U.S. only finding out in five years that everything was stolen, their goal was to try to figure out when it was being stolen in real time," one intelligence source told The Intercept. But their mission evolved to also provide situational awareness for NSA hackers to help them know when other nation-state actors are in machines they're trying to hack.
The scripts and scanning tools dumped by Shadow Brokers and studied by the Hungarians were created by an NSA team known as Territorial Dispute, or TeDi. Intelligence sources told The Intercept the NSA established the team after hackers, believed to be from China, stole designs for the military's Joint Strike Fighter plane, along with other sensitive data, from U.S. defense contractors in 2007; the team was supposed to detect and counter sophisticated nation-state attackers more quickly, when they first began to emerge online. "As opposed to the U.S. only finding out in five years that everything was stolen, their goal was to try to figure out when it was being stolen in real time," one intelligence source told The Intercept. But their mission evolved to also provide situational awareness for NSA hackers to help them know when other nation-state actors are in machines they're trying to hack.
that one of NSA's designated missions since the rapid growth of the internet became a fact in the mid-90's has been to breach and acquire foreign research and technology that was to be kept secret.
It's always hypocrisy of the highest order when America accuses others of IP theft.
governments can't be trusted with encryption backdoors
It's a trap!
AOL cd's
Suppose, for example, an infected machine appeared malicious. It may be prudent, for example to protect the privacy of everyone involved, to hack that machine to search for evidence of remote operation. I donâ(TM)t know, seems like a good thing to be able to detect to me.
Given that North Korea is a high profile hacking target by just about every other government, is it any wonder that their computer networks are separated from the rest of the world? "Repressive" regimes tend to do this to control dissent, but reducing exposure to worldwide networks could be another reason for running a national intranet.
I also wondered why the heck New Zealand is in the Five Eyes. The wikipedia article is probably not surprising to many people but interesting nonetheless.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
"If you can't trust the governments of the world, who can you trust?" - Young Einstien
Poor Russian haxors, afraid to go abroad on vacation in case the Feds grab you. No more Turkey, Egypt, UK or Cyprus, looks like it's Chechnya for you this year.
Nitpick for clarity: While nation-state operations generally employ the use APTs, APTs are not limited to nation-state operations.
The NSA should NOT be allowed to interfere with hackers! Guys I think our government is out of control /s
P.S. I'm a raging moron spreading anti-government BS where it doesn't belong in the slightest.
Occupy, Anonymous, Wikileaks, and even the Tea Party by the way.
And the methods involved injecting moles to cause them to infight, and act as agents provocateurs, to create destuction and violence, so it will be easy to discredit and destroy them officially.
In most cases, the original group (or mindset, as Anonymous was NOT a group until they created one in that name) was perfectly peaceful and sensible, and the evil acts were entirely the actions of "our" oh-so-good "law enforcement".
Yes, I did read the original presentations back then.
Nice try Ivan
Can you please release some hacking tools or exploits used by the Russians, Chinese, and North Koreans? Releasing NSA tricks only makes them less effective while the other guys continue to steal my data and influence our elections. Thanks.
Some hints to the availability of that script, for self-cleaning purposes?
The butthurt is strong in this one...
Vote Hillary in 2020 for MOAR WAR!!!!1!!1!!!