Schneier on Security

StarChild • July 18, 2014 6:15 PM

The story was reported extensively in 2011.

In 2013, the story of NASDAQ’s hack by four Russians and an Ukrainian broke big news. This attacked happened during the same time period. It was also the infamous Albert Gonzalez case.

According to this article, the secret service pushed the angle that these two hacks were related. They were early on veto’d out because of that.

This article notes the attack was initially found by the FBI. I would infer from the description and some details in the story that the FBI had a rule for this on some kind of border level mass IDS system, and this rule indicated it was a Russian FSB attack code. Apparently, the NSA had previously seen this code and felt they had positive identification of it being FSB.

This article seems to rely heavily on one disillusioned, anonymous, governmental source, though other sources are also included.

At times, it appears that there may be more then one disillusioned, anonymous, governmental source deeply tied to the case. Or it could be simply one source. Maybe they should have given him a name to help explain if this was one source or several?

The kill code angle is also argued against in the same article. It appears that the evidence it was kill code is under considerable question.

The article also argues that the same source has been used by what is believed to be Chinese cyberspies. (Was this found before or after the NSA rule sets the FBI deployed? Who knows.)

It is also noted that NASDAQ systems were a “swamp” of compromises, which made the investigation much more difficult.

The CIA was tasked heavily in this investigation, though it appears their conclusion was nebulous.

Maybe it was a “for profit” attack by someone at the FSB? Maybe by someone who had stolen the code?

The NSA (apparently) argued that the sourcing to the FSB is strong because:

-> It utilized two zero day vulnerabilities (Whether these vulnerabilities were ever seen before in the wild is left unsaid.)
-> Its’ programming was highly sophisticated.
-> They had sourced it before to the FSB. How? We do not know.

It does appear that this story was released for some ulterior agenda.

And is not the claims that “kill code” is never seen before contradictory to the claims that there have been a “few” reported instances? While one could resolve that contradiction by claiming the “few” reported instances (not sourced) never before involved “critical US systems”… I find that claim dubious.

After all, it is common practice for countries to set up “worst case scenario” weapon caches and sabotage points. Russia definitely did this heavily during the Cold War. And what else are all these nations doing hacking these critical infrastructure system? Just gathering data? Energy data? Refinery data? Financial data?

StarChild • July 20, 2014 2:50 PM

@65535, and on the general subject of the NASDAQ hack “disclosure” (in quotes, because there have been previous disclosures on this, a matter I did not initially recall)

My primary reasons for doubting the authenticity of the story is they cited an anonymous source multiple times without indicating he/she was a singular source, despite this they were able to find what appears to be multiple other sources who were very talkative about the matter, and the timing.

On timing
-> the story is not new, though I had to look it up to be reminded of this, there were multiple news breaks back in 2011… a number of the details are new

-> the US recently arrested a ‘son of a Russian politician’ on mass CC fraud, so defense of their possible view that there is some deeper connection between Russian and Eastern European criminal organizations and the SVR & FSB is likely a point needing to be made at this time

-> the Russia vs Ukraine situation is an extremely volatile situation, it appears very apparent that Russia is going for at least Eastern Ukraine, and possibly all of Ukraine while the European and American nations are in a deep bind. There is distinctive talk of the possibility of war “out there”.

-> in case of war or far deeper sanctions, it is very possible “asymmetric warfare”/electronic warfare/cyberwarfare may severely flare up. This means the feds have to start the information process going to corporations and “out of the loop” defensive organizations that there may be connections between Russian cybercriminal APT & Russian secret services. That there is at least some knowledge of the potential of destructive capability in Russian APT attacks.

Otherwise, their asses are bare if Russia starts to commence hitting the kill code buttons on their command and control APT projects spread wide and deep across corporations.

My “takeaway” is they are embroiled in groupthink, an insidious disease, and are deeply underestimating the Russian intentions on Ukraine. Putin’s groupthink across Russian natives and expatriates is extremely high. He has the political muscle built up to do as he pleases. Which is the very same thing as political stupidity. Perhaps it could be said groupthink collectively reduces their intelligence while strengthening their “muscle”.

Gronk, “Duuuh, I beat. I kill. I do as I please.”

On positives:

This is the kind of thing I do believe these agencies should be involved in. Protecting their country. As opposed to muckracking in the freedoms of their respective countries and leaning strongly towards the very authoritarianism they pretend to be opposing.

While the bloomberg article hyper sensationalized the topic, especially in the first page, the author did, at least, provide what probably was as many contradictory facts to that sensationalism through the rest of the article.

So, it is true, we can be rightly critical of the reporting, at the same time, they did, at least, provide us that very ammo to do so.

StarChild • July 20, 2014 4:01 PM

@xr34jhjb43brj3

I totally believe you. We just saw an enormous amount of illegal activity exposed in the 2008 financial collapse. Enron, MCI, and so many other downfalls have also highlighted not so distantly related severe problems of deep level corruption, and how it can become endemic to even “upstanding” corporations.

As many critics have also (rightly) pointed out, there was very little punishment or change for the 2008 collapse.

As a comp sec security guy who has contracted through out the industry, I have heard a lot of horror stories about hacking attacks and the very poor underlying infrastructure there. Most of these I have never seen go to press.

Pretty much across the board for financial institutions, it has been exposed that there was endemic corruption inside and the worst sorts of behavior.

If they did all that they did there without as much of a slap on the wrist, it is completely likely they are ridden with employees engaged in every manner of compromise against their own networks.