I Hunt Sys Admins

https://firstlook.org/theintercept/document/2014/03/20/hunt-sys-admins/

by _bfhp • 12 years ago

228 113 12 years ago

TL;DR: Never use Telnet for anything.

skue2• 12 years ago

If you're going to provide a TL;DR for others, it's best to read to the end first... telnet was used as an early example, but the writer went on to explain how to target ssh too.

Pitarou3• 12 years ago

TL;DR Never use anything for anything.

These guys make the "professional" hacker gangs look like a bunch of clueless amateurs.

trolleyed• 12 years ago

They have resources, though every technique in this paper is very simple. There are some incredibly talented people out there, and not all of them work for the NSA.

8_hours_ago• 12 years ago

Wow.

I am completely torn between really wanting to work for the NSA because they have the ability to do really awesome analysis like that with huge amounts of data, and being deathly terrified. Nothing in that article should be a surprise to me, or anyone else who can half-guess the NSA's capabilities, but it is still shocking to read. For some reason, knowing that the NSA has information on literally everyone stored in some database isn't that frightening to me, but seeing specific details that they could have (and probably do have) is very scary.

midas0075• 12 years ago

No brainer: join to move the needle in a sensible direction.

garrettgrimsley2• 12 years ago

That isn't how bureaucracies work. The parent can't join the NSA and hope to advance if they (openly) hold views fundamentally contrary to those of their superiors.

I believe there is a notable and recent case of how this actually plays out. What was it? Towden? Mowden?

dsuth• 12 years ago

"He who fights with monsters should look to it that he himself does not become a monster. And when you gaze long into an abyss the abyss also gazes into you."

-Nietzsche

Tobu2• 12 years ago

Power at the NSA would be concentrated towards the most shameless bastards. It's not really within the power of random employees/contractors/grunts to fix. Snowden would be the example to follow here, but you really have to work outside the box.

chippy5• 12 years ago

sensible

Sensible in that place means catching terrorists.

It's easier to justify injustices if you can rationalise it by saying you are saving lives.

dredmorbius• 12 years ago

http://fixyt.com/watch?v=UrOZllbNarw

chippy5• 12 years ago

really wanting to work for the NSA because they have the ability to do really awesome analysis like that with huge amounts of data

How about wanting to help your country? I thought that's the main motivation behind for most people who join the NSA.

Cakez0r• 12 years ago

That worked out pretty well for Snowden...

JabavuAdams5• 12 years ago

Yup. Unfortunately, I'm one of those foreign alien nobodies, so I can't. Also, most US-ians are totally cool with the NSA spying on me, just not on them. shrug

MrZongle2• 12 years ago

Playing Devil's Advocate: how do you feel about your country's intelligence services spying on Americans?

morganherlocker• 12 years ago

The scene[1] in Good Will Hunting where Matt Damon tells the NSA to beat it is probably in line with how a lot of us feel. Interesting work, but the end result is too much to live with.

[1] http://www.youtube.com/watch?v=UrOZllbNarw

skue2• 12 years ago

So the NSA targets the personal online accounts and personal computers of sysadmins who just happen to work at major network providers. These are people who have done absolutely nothing wrong, other than being in the way of an out of control agency.

I am so sickened, angry, and ashamed.

jauer3• 12 years ago

And this is different from spies seducing and/or blackmailing clerks how?

It may be distasteful to you but it is the traditional work of spies in service to their country.

angersock• 12 years ago

I am genuinely curious how often seduction is used to compromise admins.

Clearly I work on the wrong systems. :(

nodata2• 12 years ago

"Oh it's not different to something else, so that makes it okay".

sentenza2• 12 years ago

What kind of question is that even? If you'd told me before the Snowden/NSA scandal that the NSA or GCHQ were _blackmailing_ clerks, I'd have called it spy fiction.

To my knowledge, it was only publically proven that the Russians use these tactics, but the US?

And now you are telling me that the NSA compromising the informational integrity of thousands of sysadmins is not surprising since they already used unethical TV-drama bullshit in the past?

This raises so many questions. Do you have examples of the NSA blackmailing a clerk?

e12e4• 12 years ago

Unless you have a seriously depressing sex-life, it's hard for a single agent to seduce 100s or 1000s (or more) clerks based on recorded behaviour of the entire connected part of the human race for the past few years in a few minutes.

So it's worse in one way because of scale.

In general spies break laws, that's what's make them special. It's why it's "ok" to torture spies, or kill them, or hold them in a hole -- they're not considered soldiers, when (if) they're caught, they are treated as scum (or as we say these days, as terrorists).

I don't think anyone's saying: "Oh, we're mighty miffed you've stolen all our data. We'd be ok with you just coming over on foot, seducing a few, killing a few, and stealing our military and industrial secrets."

No-one's ok with that either. As for the American People, they are (rightfully) miffed because their so-called foreign intelligence services, that are supposed to break laws only abroad, are violating privacy on a scale that makes the Stasi look like child's play.

If a US agent seduced me and installed a back door on my computer to access the networks I have access to -- and I found out -- I'd be mighty upset about that, too. And I'd try to help counter intelligence get hold of the perpetrator. But that's not bloody likely to happen, is it?

Now, we pretty much know that any value target (network, and by extension admin) is reachable in a few keystrokes. The effort needed is minimal, to quote Sarah Connor: "No one is ever safe."

roel_v• 12 years ago

At least the seduced clerks get something out of it :)

wreegab• 12 years ago

in service to their country

So common for wrongdoers to resort to such rationalization to justify their wrongdoings.

To help in snapping out of the cultic mindset, replace "country" with "organization". For instance, Scientologists had the same mindset with their Snow White Operation.

6a68• 12 years ago

Well, fuck you very much. This is unbelievable.

rblatz• 12 years ago

This site is completely unusable on mobile. Does anyone have a second source?

intslack• 12 years ago

https://firstlook.org/theintercept/article/2014/03/20/inside...

https://s3.amazonaws.com/s3.documentcloud.org/documents/1094...

midas0075• 12 years ago

Oh thanks :)

Stwerp• 12 years ago

Thank you for posting the PDF link. For the life of me, I have NO IDEA why sites still try to push hacked together PDF viewers on us when there are tools already on my system. I really thought this site was just broken.

midas0075• 12 years ago

Try zooming in and tapping the zoom slider.

FLUX-YOU• 12 years ago

Good to know the NSA is a fan of Allie Brosh.

bdb• 12 years ago

So, uh, does this mean that NSA has an internal LiveJournal instance?

ben1040• 12 years ago

I was wondering the same thing. It certainly looks that way, the comments/"mood"/timestamp display on the posts is a dead giveaway.

crashandburn44• 12 years ago

Did anyone else notice:

current mood: juche-licious

The only juche I know of is the north korean one[1], guessing this is just a random joke, just wanted to ask in case there's an alternate meaning I'm missing?

[1] http://en.wikipedia.org/wiki/Juche

drewcrawford• 12 years ago

This is kind of off-topic, but I don't know where else to ask.

Have we seriously entertained using "OSS" licenses that would prevent NSA & co. from using them?

I know Douglas Crockford has his "don't be evil" JSON license that got everybody's knickers in a twist. And I know OSI has a nice page on why field of use restrictions are bad.

However... I wonder if these pre-Snowden viewpoints credibly consider an organization that uses the software community's tools to conduct targeted attacks on that community. I mean, these documents suggest a much scarier attack on software developers than, say, putting the Linux kernel in a TiVo or whatever they changed in the GPLv3.

On the other hand, maybe FOU restrictions are still bad on principle. What do you all think?

sjtgraham• 12 years ago

Wouldn't it be futile since the federal government has sovereign immunity? It's not as if you could sue for unlicensed use.

mildtrepidation• 12 years ago

This is an amusing suggestion... do you really think the people who are bugging just about every line of communication in existence and subverting every possible method of secure communication and storage give two shits about the terms of software licenses?

JabavuAdams5• 12 years ago

Right, so the Constitution didn't stop them, but a FOSS licence will?

jlgaddis3• 12 years ago

Suppose you wrote MediaWiki, by yourself, and thus had the authority to change its license. Further suppose you did so, adding in restrictions like you mentioned that forbid the NSA from using it.

Now, assume you found out, via a leak of some of these classified documents, that they were using it -- in violation of your license -- and you decided to sue.

Having seen some of the excuses they've come up with before (and assuming that you have as well, which seems like a reasonable assumption), why wouldn't they simply argue that the software applications they use internally are classified, that disclosure of such would be detrimental to national security, and, because of that, your case should be thrown out (like they have argued so many other times)?

GBond2• 12 years ago

From the context of this, it sounds like this QUANTUM system has impacted way more than the reported 100,000 computers around the world.

lunixbochs• 12 years ago

The post said "queue them up for QUANTUM", which implies there are still actions to be done before it's usable.

nls• 12 years ago

In my opinion, it implies that QUANTUM has a queuing system.

midas0075• 12 years ago

Would really like to see the unredacted cookbook for hacking routers. :)

josephlord• 12 years ago

The redaction was of the bit about passively detecting which routers have been hacked by other parties (primarily concerned with the Chinese).

Anthony-G• 12 years ago

At first reading, I thought the redacted part was about how to tell if _your_ router was compromised but on closer reading, it looks like it covers routers owned by others that the NSA have cracked but they want to know if the Chinese or anyone else has done the same.

midas0075• 12 years ago

So probably not Diodes then.

It's interesting how this is boils down to existing malware strategies but with a how to. They're probably not going to type this stuff up in a wiki anymore going forward, shift to in-person training and word-of-mouth.

TrainedMonkey• 12 years ago

Fact that they casually speak of logging significant amount of connections is alarming. SSH targeting methodology would only work if you have ability to monitor significant portion of electronic communications.

Since majority of traffic logging capabilities of no such agency is coming from US itself and few close allies we collaborate on intelligence with* you can estimate that Sys Admin SSH technique is most useful in US itself and aforementioned close allies. Thus I would expect this to disproportionally affect Google as opposed to let's say Baidu.

* I am making an assumption here, please let me know if it is unwarranted.

jauer3• 12 years ago

My assumption would be that most of the intercept capabilities are in Africa, Middle East, and Southeast Asia. A lot of Africa uses (or used to use) satellite links for internet which you'd expect to be tapped and there's undersea cables around there that had a rash of weird breakage over the past few years.

Incidentally, those are areas where China has a strong economic development interest so you have another well funded government as a adversary that's known to target routers and such.

So far as admin SSH, once you reach a certain size you generally stop letting admins ssh in from random places and require VPNs (often with crypto tokens), if only because it gives you a easy chokepoint to disable access when you fire people. From what I've seen those most likely to use direct SSH or telnet are small companies (including regional/emerging telcos) that have a handful of people actually running things.

acqq2• 12 years ago

Google "Boundless Informant" and "Room 641A." Most of abilites are in the U.S. and more is collected there than in most of the countries. Why? "Becase we can."

throwaway7767• 12 years ago

So far as admin SSH, once you reach a certain size you generally stop letting admins ssh in from random places and require VPNs (often with crypto tokens), if only because it gives you a easy chokepoint to disable access when you fire people. From what I've seen those most likely to use direct SSH or telnet are small companies (including regional/emerging telcos) that have a handful of people actually running things.

And, as we know, the NSA is actively collecting IPSec handshakes and has (at least in some cases, I'd love to see more info on this) the capability to crack session keys: https://firstlook.org/theintercept/document/2014/03/12/vpn-v...

e12e4• 12 years ago

Well, we don't really know enough about collaboration between tier1/2 and intelligence services, but I think it's reasonable to assume that any large network provider that has close financial ties to the US or NATO countries provides intel to the "NSA machine". I'm not sure about Russia and China (along with China-friendly neighbours). I would guess getting data is a high priority, and that NSA would go to great lengths to get taps in -- but what or how they do it I wouldn't know. Bribery and/or running a telco or two sounds reasonable given the (large) budgets, and mission statement(s).

Pitarou3• 12 years ago

TL;DR

Our target is using a network. We need access to that network. The sysadmin has the keys to the kingdom. The sysadmin uses Facebook. Through QUANTUM INSERT, we own anybody who uses Facebook. So we just need to figure out the IP address of the sysadmin.

If they use unencrypted telnet we just hack the account and grab the telnet server's IP address whitelist. With our resources and capabilities, this is so easy that someone should write a script to automate it and do it in bulk.

If they use SSH, we do it be listening to the connection. Even though we can't decrypt communications, we can figure out which IP addresses sysadmins are logging in from.

But it's not just us who are hacking routers. We can also hack the hackers ... and the rest is redacted. Shame. That would have been REALLY interesting.

greenyoda• 12 years ago

Here's a brief description of QUANTUM, for those who are unfamiliar with it:

https://en.wikipedia.org/wiki/Tailored_Access_Operations#QUA...

Tossrock• 12 years ago

Jesus. There's really no way to fight it other than going full RMS, is there? Who knows how many zero-days the NSA is sitting on for all major browsers. I wonder if they can attack sites that implement full end-to-end HTTPS.

crashandburn44• 12 years ago

Brilliant, just what I was looking for, all I could find was information on a scheme where they intercept computers and bug them with radio transimitters[1]. Can anyone tell me why the two codenames are so similar? It would seem that they're wildly different exploits.

[1] http://www.ibtimes.com/nsa-quantum-program-leaked-edward-sno...

noonespecial2• 12 years ago

"Dude! Map all the networks"?... lulz?...leet?...nouns pluralized with a z?

I have seen the enemy and he is a 14 year old boy who's found his father's (admittedly very large and scary) gun.

akira2501• 12 years ago

That kid? No, the enemy is the people who hired him, gave him no oversight, had no auditing or controls on internal information and encouraged him to continually exceed his authority.

Include the team of shameless government managers, many who swore an oath to uphold and defend the constitution, turning this operation and all these databases over to a third party and these kids.

claudius• 12 years ago

No – the enemy is the American people, collectively and individually responsible for the actions of their government. How you sort that out internally is not really my concern :)

chippy5• 12 years ago

"I have seen George Bush and he is a stupid Texan hillbilly."

"I have seen Ronald Reagan and he is a demented old man with no brain."

----

These "jokes" appear to belittle the people with real power, in the public's mind. It makes the people feel better. They make them appear harmless. It is a complete mistake to do this. It helps the powerful to spread these jokes, it does not help the people.

"oh he won't harm us, he's stupid. He wouldn't be evil, he has no brain. He wouldn't spy on the world, he's just a kid"

BgSpnnrs• 12 years ago

The Boris Johnson effect. :/

noonespecial2• 12 years ago

Its not the just stupid. Its the gun. They are anything but harmless. It would almost be better if they were evil.

tripzilch• 12 years ago

seems the NSA isn't above hiring script-kiddies as long as they get the job done. and apparently they do get the job done all right.

mixologic• 12 years ago

They're so gleeful about it all. Wow.

chippy5• 12 years ago

They are technies just like you reading this comment, and they believe that what they are doing is Right and Good.

_wp3r• 12 years ago

This is a beautiful troll. If only sipr and jwics comms was so hilarious, and on the same network.

grrowl• 12 years ago

If this is true, we can assume the computers of all but the very most careful and dutiful admins have been pwned. I'm flabbergasted even looking at my own laptop, the element of trust in any of my own hardware is gone.

peterbotond• 12 years ago

an alternate link from cryptome: http://cryptome.org/2014/03/nsa-hunt-sysadmins.pdf

codezero• 12 years ago

Is there any TCP implementation that will notice receiving multiple disparate replies (containing different data)?

Basically, is there any way to know that you are being targeted?

e12e4• 12 years ago

You could presumably log some such packets in iptables -- but that assumes you actually receive duplicate packets. If NSA owns a router between you and the target for spoofing, there's no reason that router need to relay the "correct" packet. I know a lot of the text on these attacks states something along the lines of "replies before the legitimate packet arrives" -- I'm just not certain it's that simple in practice.

edit: This might be of interest:

http://ask.wireshark.org/questions/8490/tcp-retransmission-i...

edit2: Perhaps a logging dns resolver (to track "strange" ip changes) coupled with an iptables rule that uses contrack and logs INVALID packets is a start?

conover• 12 years ago

It occurs to me that judges, members of congress, law enforcement officials, etc. could be considered "sys admins" in a sense.

Wyrmkill• 12 years ago

Who else feels like they just read an excellent spy novel, but that maybe it was a little over the top in conspiracy zealotry.

Only to find out at the end, it's all been real and the people with the tin foil hats aren't really that far off base.

eps• 12 years ago

I call fan fiction.

This is too many words for inherently trivial ideas that are all based on the magic assumed already to be in place and readily available. But mostly it's the tone and triviality of what's being discussed. It's all a script-kiddie level.

chippy5• 12 years ago

I find your view interesting. it's one shared by many people. It's almost a misconception, a mistake which actully helps those with the real power.

These are the questions that this brings up, which I find interesting.

What makes us think that techies in government departments are different from techies in other places?

What makes us think that pictures of kittens and internet memes are only acceptable for open source freedom hackers, and not people working for the government and private companies?

What makes us think that the internal messaging systems of secret organisations should not be trivial, human and sharing humour?

What makes us think that if someone thinks they are helping and protecting their country in their mind that they are morally wrong and have a criminal personality (James Bond Villain) because they are systematically abusing the law?

Tobu2• 12 years ago

The Intercept article (which this is from) has a lot more links and context: https://firstlook.org/theintercept/article/2014/03/20/inside...

Intermernet2• 12 years ago

Is anyone else more disturbed at the 4chan-esque style of the author, than the actual ramifications of the "presentation"?

It sounds like international security is being run by 10 year old wannabe anonymous members.

Do the NSA employees really watch presentations such as this?

HillRat• 12 years ago

I feel like this is the geek version of some Michael Mann film, where the subtext is "COPS ARE JUST LIKE CRIMINALS." I'm already terrified that evidently any random GS-11 can grab SIGINT data at will; now I find out that they've got a red-black version of LiveJournal that reads like a Ritalin-addled script kiddie with SCI clearance. Fucking 'ell, no wonder we're fucked.

forgottenpass• 12 years ago

It sounds like international security is being run by 10 year old wannabe anonymous members.

Yep. Replace "wannabe anonymous members" with "wannabe hardass" or "war hawk" and you have the essence of the US approach to international relations.

So while childish language for childish actions bothers me, so does the act of trying to class-up childish behavior with the well worn flavor of political rhetoric that acts like whatever bullshit getting peddled is reasonable and responsible.

I can't decide which I like less.

badman_ting• 12 years ago

Is anyone else more disturbed at the 4chan-esque style of the author, than the actual ramifications of the "presentation"?

Probably, but that sounds like a bad idea to me.

GamboMama• 12 years ago

Are there really companies out there where sysadmins are allowed to use i-Diot or W-inDiot products on non-free hardware?

I like the NSA, because they show the world how stupid most computer users and especially the "geeks"are that do not see how ridicolous it is to show of a big apple logo on a speaker desk.

I-diots are always the problem.

anonbanker3• 12 years ago

> products on non-free hardware.

So how long have you been an exclusive Lemote Yeelong user?

josh-wrale• 12 years ago

As a sysadmin, I try to skip articles whose text is hidden because I have NoScript enabled. Cheers! :)

anonbanker3• 12 years ago

This is an excellent advertisement for:

* disabling telnet on your router

* creating 4096-bit ssh keys

* enabling ssh key-based authentication only.

* setting ssh to non-standard ports

* enabling port knocking

* using _only_ tor to check webmail

* deleting your facebook account

qzwxecrvtb• 12 years ago

can they find me if I don't have a job title? hm...perhaps this also explains why I was photoshopped out of the team photo...

I Hunt Sys Admins

Related Stories