Schneier on Security

Jim • April 21, 2016 3:28 PM

@r, @all

is that right?

I believe one person could have done it. You are also correct, they could have automatically hacked him back. He may not have been aware of that. He says nothing about testing his malware against their AV to ensure it would not be caught. Maybe they were using heuristics. Maybe they have other security systems which could have caught him. Likely, they just did not. He was lucky. These things never even occured to him.

Or, he was an insider and already was confident on what defensive systems they employ.

Any details he gives about his own background could include false clues. For instance, he may not be Spanish. He may work at one of those types of places he condemns.

He even mentions in the article that throwing out “false clues” is under his awareness as best practice.

He is very confident he will not be caught. But, this is because he is getting off on taunting behavior. Therefore, his confidence is misplaced.

The more he talks, the more clues he gives. And if his false clues are figured out, those give information about him.

If this was the work of one individual, he has put far more then a mere 100 hours into this, as getting to understand how to work your way around Windows networks clandestinely requires a lot of experience and knowledge.

Knowing how to find zero day vulnerabilities in major vendor products is a very time consuming education.

He was correct, targeting the router was his best chance to break it. So, he is an experienced security bug finder.

He was also correct on employment opportunities in the field. People outside this field do not understand that. He knows it. So, he has worked in that field, and maybe still does. He also knows people in that field. Because that is how he would define employment opportunities.

Hacking his way inside the router is not that much level of effort in terms of past experience. He clearly already had router hacking knowledge. That is how he knew that was the best choice.

It is rare for people to study that, but it is not such difficult material to study these days because of openwrt and play tools like the pineapple.

If he had the tools already ready, that would not count into his time estimate. That would take a lot of time to get ready. Even though he does not claim to have recon’d their security systems. Which could have been anything.

As for time in a day, security folks with those skills often have such time in the day. Many of their jobs available as effectively retainer jobs. They want you around for when they need your expertise. Because their client may need a certain type of vulnerability in the future.

The insider angle, he belies by hacking another group gamma. But, he may have been an insider at either group. Or they are just “like” a group he has worked with where he felt his skills were not appreciated.

It could be a nation state team.

But they would have little value for posting all of their information online. It would be more valuable to keep it and use it. As hacking group effectively targets a lot of countries.

Maybe some organization wanted to just shut them down. Mission accomplished.

That seems like a less likely motive, but it is possible.

Jim • April 22, 2016 11:53 AM

@r, @attribution

I would not throw any possibility away.

It is very possible this could have been a group effort.

It could be a setup of bona fides for someone, for instance. He puts there an email address to communicate with him on. He could go around hacker circles and use those bona fides to gain trust.

Usually when law enforcement does that, they fake the crimes they do. Or they are petty crimes they have some jurisdiction over in the first place. Hacking Team and Gamma are real groups. If they are not, then they were setup to dig into the market. Which would have value.

In most ways this would play out, no criminal case would come directly from such work. Instead, intelligence would be gathered and other people’s bona fides riding on his bona fides. Networks would be set up, and targets searched for, found, and focused on.

If you think every company out there, regardless of how authentic and “not government” it may appear is “for real”, you would be very mistaken. The same is true for individuals.

Usually, this is easiest done simply by piggybacking authentic companies, such as having one team or one division, that just happens to be undercover Someone Else.

Someone could say, “but they helped these bad actors”. You have to have legitimate traffic of some kind to sustain a cover.

If these companies did not help those bad actors, someone else would have.

Bona fides are difficult to get and are very powerful. That is what you have to do to get access to upper level folks. Lower level folks don’t have much of a bar for trust. You just have to agree with them on their beliefs.

You can become a friend with anyone just by figuring out what their preferences are and then reflecting them. They will believe whatever you say, if you know what they want to believe.

But to get more powerful people, you have to have those bona fides to really get into their confidence.

They know what they look like.

You can’t get close to a major drug supplier, and get them to see you as equals or superiors, unless you have those bona fides that you are as accomplished as they are.

For instance.

Lower level folks do not even know what bona fides really look like.

Higher level folks know all about it. It is a core part of their social language. Does not matter if they are a nuclear scientist or seasoned security researcher. If they are extremely wealthy or if they are very good at car mechanics. They know the language their experience and accomplishments have given them, and they use that to figure out if people are equals or superiors or less.

They use it to gauge how they should trust the person.

If this guy is an individual, then he is certainly an ex-security researcher. He certainly would have worked at an organization “like” gamma or hacking team. If he did not work directly there. He attacked what he was comfortable with. He attacked a strawman of his anger.

He is not so impatient to have just hacked anywhere. He is very up on security news and trends, and that at a high level. He was able to organize the trends into meaningful data points.

For instance, he could point out that phishing is the way in. He was able to assess he did not feel comfortable with phishing for this type of target. He was able to point out where most in the field with his level of expertise worked, and he did so very succinctly.

He was aware of the fact that the router vendor had not yet fixed the bug, and that it would be bad professional practice to release details prematurely.

He was willing to wait about a year before releasing details, which speaks to his likely age. He is older, probably in the 30-50 range.

He really did not gloat in many ways he could. He could have overplayed his own expertise and underplayed theirs. Usually more junior folks do that, being relatively noob, and not having much seasoned experience with the realities of the other side of security.

He carefully kept track of his hours. He wrote a very polished report.

All of that speaks of an advanced security researcher who worked for a consultancy.

Navigating the windows network, doing the recon, recompiling some attack binaries… none of that is what defines him. Those are relatively low bar achievements.

What defines him is he was able to find zero day in just about any application. His description of how he saw his limited choices and made his choice, that was describing his confidence. He knew he could break any of the choices before him, and made an assessment on which would have taken the least time. He was confident in his assessment and confident he could break any of the possible choices.

There really just are not all that many who can do that. That is a much more rarefied sector of computer security.

It is actually really difficult to be able to do that. That is equivalent to him not just being a doctor, but a heart surgeon.

He is narcissistic, however. He believes he can write a whole lot, and won’t give away any damning clues, or open any doors to his vulnerabilities. He even left an email open for people to contact him with.

This says he thinks he is really smart. And he is getting off on it.

He did not make a very persuasive case for “raising the troops”. He could have. I really do not find his “just cause” or “anti-‘The Man'” sentiments authentic or deep. He did not come off as if he was a True Believer.

Someone who is a True Believer would have gone on and on and on about the ‘how’s’ and ‘why’s’ of their belief system. Here he is, he has the stage, he would say something that “needs to be said”. And what he said was really light and generic. It could fit all sorts of belief systems.

Such sentiments probably are loosely held by him to tell himself he is not doing this merely because he is indirectly responding to people in his past.

Some group like gamma or hacking team probably made him feel bad, powerless. And this is his way of saying he is powerful and better then them.

Nobody is shedding a tear because either group was hacked. They certainly richly deserved to be. If those who do bad deserve to have that very same bad done back to them.

But being motivated enough to really do that is something else.

There a lot of evil in the world, so not like those groups stick out to anyone not intimate with that kind of group.

And normally, activists attempt to focus on lawful messages. That way they can make themselves accessible and continue to push the message. Nevermind that the whole problem is you do not fight fire with fire.