Powerful NSA Hacking Tools Have Been Revealed Online

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
So let me see if I got this right. The NSA is smart enough to make a bunch of sophisticated hacking tools but dumb enough to let them end up on the internet? Seems like something the NSA would do. Thanks to Skripka for the link.

A cache of hacking tools with code names such as Epicbanana, Buzzdirection and Egregiousblunder appeared mysteriously online over the weekend, setting the security world abuzz with speculation over whether the material was legitimate. The file appeared to be real, according to former NSA personnel who worked in the agency’s hacking division, known as Tailored Access Operations (TAO). “Without a doubt, they’re the keys to the kingdom,” said one former TAO employee.
 
I rallied against this kind of exploit collection behavior more than a year ago for this exact same scenario. Now do you think NSA is going to man up and admit they f'd up and the whole idea of trying to hide exploits is bad?

Nope. Because that would mean someone would be held accountable. And we can't have that in government now can we? Pride and arrogance is their hubris.

The only thing they can do now is do the right thing and help companies fix these exploits ASAP.
 
For those who haven't been following - Russia admitted to hacking the NSA, shutting down their site the other day, etc - first time a country admitted they did it.

Why? Because Russia has been denying they hacked the DNC, but MSM and the DNC keeps insisting it was them. So this was essentially a "if we were gonna hack you, you'd know it." response. Basically high stakes techno-diplomacy to get the media and DNC to stop blaming everything on Russia.
 
It'd be interesting to play with these tools at home. I wonder if home network vulnerabilities are included? Google wasn't much help, neither were the torrent search engines.
 
alxlwson said:
It'd be interesting to play with these tools at home. I wonder if home network vulnerabilities are included? Google wasn't much help, neither were the torrent search engines.
Click to expand...
They are up for sale. Only snippets were exposed to prove what they have, from what I understand. And if you are looking for these tools, I can guarantee you someone else will soon be looking at you. That is one hot potato I would not touch.
 
DigitalGriffin said:
They are up for sale. Only snippets were exposed to prove what they have, from what I understand. And if you are looking for these tools, I can guarantee you someone else will soon be looking at you. That is one hot potato I would not touch.
Click to expand...

Correct, some tools were posted, but not the whole kit.
They can look at me all I want. Unless these secret tools have been copyrighted(which they aren't), and they can prove they were used in an illegal fashion(which they wouldn't be) then there is nothing for them to do. Well, except when they show up on your front porch and wanna have a chat and try to scare you. Cool thing is, the tools don't technically exist, because the NSA hasn't taken ownership. In the hands of the gubernment, they are espionage tools, so they can't ever ever claim ownership, or that they even had knowledge about their existence.
Either way though, not worried.
 
DigitalGriffin said:
I rallied against this kind of exploit collection behavior more than a year ago for this exact same scenario. Now do you think NSA is going to man up and admit they f'd up and the whole idea of trying to hide exploits is bad?

Nope. Because that would mean someone would be held accountable. And we can't have that in government now can we? Pride and arrogance is their hubris.

The only thing they can do now is do the right thing and help companies fix these exploits ASAP.
Click to expand...

What are you willing to give up for the Government to give those exploits up? Your privacy? Backdoors to your security products? Higher taxes to pay for MORE hackers to find more exploits now that the ones you already found get fixed?

Suggesting that the government shouldn't have back doors and should use technology to crack security (with court orders of course) AND then tell them they should basically break (report exploits and fixes) all the work they did to get them in the first place seems counter productive.
 
dandirk said:
What are you willing to give up for the Government to give those exploits up? Your privacy? Backdoors to your security products? Higher taxes to pay for MORE hackers to find more exploits now that the ones you already found get fixed?

Suggesting that the government shouldn't have back doors and should use technology to crack security (with court orders of course) AND then tell them they should basically break (report exploits and fixes) all the work they did to get them in the first place seems counter productive.
Click to expand...


Or they could do it the old fashioned way, and use operatives. The government shouldn't have these things because these exploits should not exist in the first place. If the government has them, so do other people. This is a prime example of that.
 
dandirk said:
What are you willing to give up for the Government to give those exploits up? Your privacy? Backdoors to your security products? Higher taxes to pay for MORE hackers to find more exploits now that the ones you already found get fixed?

Suggesting that the government shouldn't have back doors and should use technology to crack security (with court orders of course) AND then tell them they should basically break (report exploits and fixes) all the work they did to get them in the first place seems counter productive.
Click to expand...

Writing tools to exploit the weakness is useless. But finding the weakness is not. There are tons of companies that look for exploits: Security companies, virus companies, etc....These are the same exploits black hats and state actors are looking for. Not looking for them doesn't make the security hole go away. The more people you have looking for holes in security, the better. So it isn't a waste if it protects large amounts of people from potential dangers by others.
 
Wait, so an agency that hacks/exploits into others people's devices and data traffic with complete disregard for due process doesn't like it when it happens to them? Say it ain't so Tommy!!
 
EGREGIOUSBLUNDER... Well they certainly named that one spot on, didn't they, almost like they knew this was going to happen. :)

This kinda shit happened to HackingTeam last year, iirc, hasn't really hurt them in the long run and it won't bother the NSA either.
 
Kaspersky thinks this is legit BTW insofar as where the code came from and if they work...they've been looking at the posted exploits.

There's a thread in Soapbox with more details and links already.
 
Steve said:
So let me see if I got this right. The NSA is smart enough to make a bunch of sophisticated hacking tools but dumb enough to let them end up on the internet? Seems like something the NSA would do. Thanks to Skripka for the link.

A cache of hacking tools with code names such as Epicbanana, Buzzdirection and Egregiousblunder appeared mysteriously online over the weekend, setting the security world abuzz with speculation over whether the material was legitimate. The file appeared to be real, according to former NSA personnel who worked in the agency’s hacking division, known as Tailored Access Operations (TAO). “Without a doubt, they’re the keys to the kingdom,” said one former TAO employee.
Click to expand...


Well, in all fairness, the NSA may keep all it's juicy secrets on isolated classified networks, but they sorta have to go to the internet to use those tools on that part of the world that is on the internet.
 
Zion Halcyon said:
For those who haven't been following - Russia admitted to hacking the NSA, shutting down their site the other day, etc - first time a country admitted they did it.

Why? Because Russia has been denying they hacked the DNC, but MSM and the DNC keeps insisting it was them. So this was essentially a "if we were gonna hack you, you'd know it." response. Basically high stakes techno-diplomacy to get the media and DNC to stop blaming everything on Russia.
Click to expand...

Russia has not hacked the NSA, not NSANET at least.
 
alxlwson said:
Correct, some tools were posted, but not the whole kit.
They can look at me all I want. Unless these secret tools have been copyrighted(which they aren't), and they can prove they were used in an illegal fashion(which they wouldn't be) then there is nothing for them to do. Well, except when they show up on your front porch and wanna have a chat and try to scare you. Cool thing is, the tools don't technically exist, because the NSA hasn't taken ownership. In the hands of the gubernment, they are espionage tools, so they can't ever ever claim ownership, or that they even had knowledge about their existence.
Either way though, not worried.
Click to expand...

You meant Intelligence Collection tools right? or perhaps you require the definition of espionage ?
 
/usr/sbin said:
Wait, so an agency that hacks/exploits into others people's devices and data traffic with complete disregard for due process doesn't like it when it happens to them? Say it ain't so Tommy!!
Click to expand...

Due process is something that is related to Law Enforcement. National intelligence Agencies are not concerned with due process because they aren't supposed to be doing things against US citizens for the most part. Their targets are foreign and not governed by our laws.
 
NSA.gov is an unclassified internet address, it's the public face so to speak. No actual NSA business get's done on the internet.

Classified networks don't have extensions like .gov

It's almost the same with larger companies, they will have their regular public website like starbucks.com, but that domain isn't where their internal business is conducted, it's just where they interface with the pleebs. They'll sell us coffee mugs and beans, but their employees don't go to that domain to update their resumes and do their performance reviews or company training documents. They have an entirely separate portal for their internal business.

So Army.gov is not where the Army does it's business. Even their unclassified business is done elsewhere. I sign in to places like us.army.mil and www.dmdc.osd.mil and ia.signal.army.mil and for most of these you need two-factor authentication via smart card certificates to get in. But these are unclassified websites. The classified ones you can't even touch from the internet cause they don't even share the same communications infrastructure, there is no physical connection between them.

So sure, the Russians can hack NSA.gov but it's nothing more than a public facing billboard, not the front door of a secret facility if you get my meaning.
 
lcpiper said:
NSA.gov is an unclassified internet address, it's the public face so to speak. No actual NSA business get's done on the internet.

Classified networks don't have extensions like .gov

It's almost the same with larger companies, they will have their regular public website like starbucks.com, but that domain isn't where their internal business is conducted, it's just where they interface with the pleebs. They'll sell us coffee mugs and beans, but their employees don't go to that domain to update their resumes and do their performance reviews or company training documents. They have an entirely separate portal for their internal business.

So Army.gov is not where the Army does it's business. Even their unclassified business is done elsewhere. I sign in to places like us.army.mil and www.dmdc.osd.mil and ia.signal.army.mil and for most of these you need two-factor authentication via smart card certificates to get in. But these are unclassified websites. The classified ones you can't even touch from the internet cause they don't even share the same communications infrastructure, there is no physical connection between them.

So sure, the Russians can hack NSA.gov but it's nothing more than a public facing billboard, not the front door of a secret facility if you get my meaning.
Click to expand...

Oh I completely get it. But I don't think you are. They didn't hack it for classified reasons. Like I said that the Russians admitted to hacking. They did it for political reasons. It's symbolism.
 
Zion Halcyon said:
Oh I completely get it. But I don't think you are. They didn't hack it for classified reasons. Like I said that the Russians admitted to hacking. They did it for political reasons. It's symbolism.
Click to expand...

I don't think you do get it....this kind of stuff is not kept on or near systems physically connected to the public-accessible internet. At least it should not be. Ever.

For the Russians to pull this off, they probably needed someone on the inside. You cannot "hack" a system that is not physically connected to anything...or at least for someone at the NSA to be monumentally stupid with a USB thumb drive.
 
Skripka said:
I don't think you do get it....this kind of stuff is not kept on or near systems physically connected to the public-accessible internet. At least it should not be. Ever.

For the Russians to pull this off, they probably needed someone on the inside. You cannot "hack" a system that is not physically connected to anything...or at least for someone at the NSA to be monumentally stupid with a USB thumb drive.
Click to expand...

I think you should do yourself a favor and get educated on it a little bit. Edward Snowden, who worked for the NSA actually explained everything on Twitter on how this could have happened and likely happened. It didn't necessarily involve an inside guy at all.
 
and now Cisco and Fortinet are scrambling to patch holes the NSA tools have had open for a long time. And there are others to follow.

Makes you feel good about security.
 
Monkey34 said:
and now Cisco and Fortinet are scrambling to patch holes the NSA tools have had open for a long time. And there are others to follow.

Makes you feel good about security.
Click to expand...

Exactly. I really do encourage everyone to read what Snowden wrote about this on Twitter. Even if you don't care for the guy or don't completely trust him, he did work for the agency and his analysis here seem to really devoid of bias. It was more of a clinical analysis of what he supposed happened. And keep in mind, he was someone who did the job at an extremely high level.
 
Monkey34 said:
and now Cisco and Fortinet are scrambling to patch holes the NSA tools have had open for a long time. And there are others to follow.

Makes you feel good about security.
Click to expand...

Yea, sysadmin's with their products in house are going to be busy beavers for a bit.
 
Skripka said:
I don't think you do get it....this kind of stuff is not kept on or near systems physically connected to the public-accessible internet. At least it should not be. Ever.

For the Russians to pull this off, they probably needed someone on the inside. You cannot "hack" a system that is not physically connected to anything...or at least for someone at the NSA to be monumentally stupid with a USB thumb drive.
Click to expand...

It would make sense that the computers at the NSA have a background service which monitors USB ports for storage. However even that could be avoided.
 
Zion Halcyon said:
For those who haven't been following - Russia admitted to hacking the NSA, shutting down their site the other day, etc - first time a country admitted they did it.

Why? Because Russia has been denying they hacked the DNC, but MSM and the DNC keeps insisting it was them. So this was essentially a "if we were gonna hack you, you'd know it." response. Basically high stakes techno-diplomacy to get the media and DNC to stop blaming everything on Russia.
Click to expand...


Well blaming a nation state is certainly easier then fielding questions about murder allegations.
 
Zion Halcyon said:
Oh I completely get it. But I don't think you are. They didn't hack it for classified reasons. Like I said that the Russians admitted to hacking. They did it for political reasons. It's symbolism.
Click to expand...

It may be, but to anyone that knows what's what, it's an empty gesture of impotence.
 
Zion Halcyon said:
I think you should do yourself a favor and get educated on it a little bit. Edward Snowden, who worked for the NSA actually explained everything on Twitter on how this could have happened and likely happened. It didn't necessarily involve an inside guy at all.
Click to expand...

Edward Snowden didn't work for the NSA. He worked for Dell, and he worked for Booz Allen Hamilton. That he worked for those companies on NSA contracts which required him to have access to NSA networks is a small distinction. But I am a man who believes the devil is in the details.
 
You must log in or register to reply here.
Back
Top