Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

Why the US was so sure North Korea hacked Sony: it had a front-row seat by Lisa Vaas.

From the post:

We may finally know why the US was so confident about identifying North Korea’s hand in the Sony attack: it turns out the NSA had front-row seats to the cyber carnage, having infiltrated computers and networks of the country’s hackers years ago.

According to the New York Times, a recently released top-secret document traces the NSA’s infiltration back to 2010, when it piggybacked on South Korean “implants” on North Korea’s networks and “sucked back the data”.

The NSA didn’t find North Korea all that interesting, but that attitude changed as time went on, in part because the agency managed to intercept and repurpose a 0-day exploit – a “big win,” according to the document.

Stories like this one make me wonder if anyone follows hyperlinks embedded in posts?

The document, http://www.spiegel.de/media/media-35679.pdf is composed of war stories, one of which was to answer the question:

Is there “fifth party” collection?

“Fourth party collection” refers to passively or actively obtaining data from some other actor’s CNE activity against a target. Has there ever been an instance of NSA obtaining information from Actor One exploiting Actor Two’s CNE activity against a target that NSA, Actor One, and Actor Two all care about?

The response:

Yes. There was a project that I was working last year with regard to the South Korean CNE program. While we weren’t super interested in SK (things changed a bit when they started targeting us a bit more), we were interested in North Korea and SK puts a lot of resources against them. At that point, our access to NK was next to nothing but we were able to make some inroads into the SK CNE program. We found a few instances where there were NK officials with SK implants in their boxes, so we got on the exfil points, and sucked back the data. Thats forth party. (TS//SI//REL) However, some of the individuals that SK was targeting were also part of the NK CNE program. So I guess that would be the fifth party collect you were talking about. But once that started happening, we ramped up efforts to target NK ourselves (as you don’t want to rely on an untrusted actor to do your work for you.) But some of the work that was done there was to help us gain access. (TS//SI//REL) I know of another instance (I will be more vague because I believe there are more compartments involved and parts are probably NF) where there was an actor we were going against. We realized another actor was also going against them and having great success because of a 0 day they wrote. We got the 0 day out of passive and were able to re-purpose it. Big win. (TS//SI//REL) But they were all still referred to as a fourth party.

Origin: The document appears on the Free Snowden site under the title: ‘4th Party Collection’: Taking Advantage of Non-Parter Computer Network Exploitation Activity

Analysis:

There are a couple of claims in Lisa’s account that are easy to dismiss on the basis of the document itself:

Lisa says:

The NSA didn’t find North Korea all that interesting, but that attitude changed as time went on, in part because the agency managed to intercept and repurpose a 0-day exploit – a “big win,” according to the document.

Assuming that SK = South Korea and NK = North Korea, the document reports:

While we weren’t super interested in SK (things changed a bit when they started targeting us a bit more), we were interested in North Korea and SK puts a lot of resources against them. (Emphasis added)

I read that to say we weren’t “super interested” in South Korea until South Korea started targeting us more. Does anyone have an English reading of that to a different conclusion?

Lisa also says that:

The NSA didn’t find North Korea all that interesting, but that attitude changed as time went on, in part because the agency managed to intercept and repurpose a 0-day exploit – a “big win,” according to the document.

The war story in question has concluded the South Korea and North Korea account and then says:

I know of another instance (I will be more vague because I believe there are more compartments involved and parts are probably NF) where there was an actor we were going against. We realized another actor was also going against them and having great success because of a 0 day they wrote. We got the 0 day out of passive and were able to re-purpose it. Big win. (TS//SI//REL) But they were all still referred to as a fourth party. (emphasis added)

The “I know of another instance” signals to most readers a change in the narrative to start a different account from the one just concluded. In the second instance, only “actor” is used and there is no intimation that North Korea is one of those actors. Could certainly be but there is no apparent connection between the two accounts.

Moreover there is nothing in the war story to indicate that a permanent monitoring presence was established in any network, capable of the sort of monitoring that Lisa characterizes as having “a front seat.”

Summary:

The leaking of this document is an attempt to exploit uncertainty about government claims concerning the Sony hack.

The document does not establish recovery of data from the North Korean network but only “…NK officials with SK implants in their boxes, so we got on the exfil points, and sucked back the data.”

Moreover, the document establishes that South Korea attempts to conduct CNE operations against the United States and is considered “…an untrusted actor….”

The zero day exploit may have been against North Korea, anything is possible but this document gives no basis for concluding it was against North Korea.

Finally, this document does not establish any basis for concluding that the United States had achieved a network monitoring capability on North Korean CNE networks or operations.

It is bad enough the United States government keeps inventing specious claims about the Sony hack. Let’s not assist it by manufacturing even less likely accounts.

Hackers for hire? Hacker’s List – for those with no ethics or espionage skills by Lisa Vaas.

From the post:

Need to break the law, but lack the technology chops to do it yourself?

Now, as they say, there’s an app for that.

More precisely, there’s a market for it, launched in November, called Hacker’s List.

As of Monday morning, the site was down, either because it was mobbed by every tech journalist on the planet, or because a whole lot of people really, really want to do things like break into their lovers’ Facebook and Gmail accounts to sniff out cheaters.
…

Lisa confirms that the site is real and gives some of the listed jobs (far more job offers than job takers) and then concludes:

…
It’s just plain dismaying that spying on others, ruining their credibility, gaining unfair competitive advantage and even cracking a bank’s database could be so casually listed, as if any one of them were postings for a lost cat or a request for help in cleaning out the basement.

This is one of the few times when I’ve wished for a news story to turn out to be a prank.

Unfortunately, given even the briefest scan of Naked Security headlines concerning spyware or data breaches, it very likely is quite real.

My first thought when I read Lisa’s account was the arrest of a Georgia resident for hiring a “hit man” to kill his wife. Turns out the “hit man” was an uncover police officer. At least in Georgia, most of the “hit men” you hear about on the news are uncover police officers. So, caution is advised when undertaking work from an anonymous source. Assuming reasonable site security, they are in far less danger than you are. Yes?

My second thought was that I don’t share Lisa’s dismay over:

spying on others, ruining their credibility, gaining unfair competitive advantage and even cracking a bank’s database….

Not that I am advocating you should do any of those things, but the United States government and other governments around the world do that sort of thing every day.

Do you effectively oppose those things by having “ethics?”

I would be real careful before putting the “ethics” card into play. It may very well be played to your disadvantage.

Do terrorists use spam to shroud their secrets? by Paul Ducklin.

Paul reviews a paper by Michael Wertheimer (NSA) about subversion of the random number generator Dual_EC_DRBG that mentions as an aside, terrorists using spam subject lines to escape scrutiny of their email. Paul makes the point that discarding spam may lead to discarding of the intelligence you are seeking. Good read.

Spam filtering seems like a low-lying fruit way to avoid scrutiny.

One assumption for new security thinking should be: All your communications are being intercepted.

The intercept assumption is necessary in light of highly probable interception of all digital traffic by the NSA. That assumption also prevents solutions based on optimism concerning the data available to the NSA and others.

How would you use spam to keep private things private?