If they could install a virus on Iran's air-gapped uranium centrifuge industrial control systems, I'm pretty sure they could get one on your computer.

Bribing people in generally corrupt and poor countries to smuggle a USB stick is kind a different than just breaking into random persons home in a country with relatively low corruption. Latter might actually be more difficult. Obviously depends on what your end goal is

Passing an infected USB stick to operators in poorer countries (as you say) is hardly the most impressive part of the deployment procedure.

but literally the most important when you need to attack air gapped machine

No, it's not the most important.

The most important was clearly obtaining the PLC zero days to infect the physical machines. It's unclear to me why you choose to be so explicitly obtuse but in any case, for your own personal edification, feel free to read some details on how it went down -

[0] https://www.wikiwand.com/en/Stuxnet

[1] https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

[1] https://www.hsdl.org/?view&did=792239

Zero day is worth nothing if you don't have someone to plug it in, but sure, be pissy about it.

This was a complicated operation that had many difficult steps. If any of these steps would not have worked, the entire project would have failed. Just pointing at one of these step as the most important does not show much appreciation of the other steps.

Sorry but Hum-int/ops is still the most important factor...especially with systems who has an air-gap.

That was the strategy for that situation. They can use national security letters and gag orders to force multinationals to silently turn over root certificates, they can intercept hardware you buy in the mail, they can MITM your connection with the full cooperation of your ISP. Anyone who thinks they’re going to defend themselves against a targeted attack by the most sophisticated and well funded state-level attacker in the world is dreaming.

Ever heard of a bump key? It's easy to break into a home in a country with relatively low corruption. One might even say easier. It just comes down to whether you have one person corrupt enough to use it. A locked door is nothing more than a social contract. Door is locked means do not come in. Tell that to the person with a bump key.

It's best not to assume a physical presence is required. Who is to say that the people at Let's Encrypt, NoScript, any of the firmwares' authors, or many other places weren't compromised years ago? It's sometimes worthwhile to reflect on where trust is placed.

I don’t know. Seeing how extensively these key signing ceremonies (Let’s Encrypt included) are designed against tampering and collusion, I’d be shocked and impressed if they were infiltrated.

We’ve found instead that the NSA can just take over your unpatched computer easily instead of putting in the effort of hacking Let’s Encrypt.

Unfortunately, a child can take over an unpatched computer using public exploits.

Please explain your comment about how key signing ceremonies stop people from being bribed. The creation of those keys creates a root of trust but doesn't stop leaf certs from being generated.

Sure it doesn’t stop certs for certain domains but again it feels handwavy to say someone can just as easily do these things. Theoretically yeah. But to be a publicly trusted CA, the kind of processes you need to have a pretty extensive.

Still, there are hundreds of publicly trusted CAs so the chance for exploitation is higher.

It would be hell of a trick to inflitrate air gapped machine without physical presence.

We were talking about the NSA getting an exploit onto an individual's computer, not an air gapped machine.

There is no evidence that the victims were bribed in that attack

Actually hacking systems is easier than (some) individuals. It's pretty obvious if you think about it. ICS are operated by group of people, they have well defined accessibility and availability requirements, some sort of documentation exists, internal processes have large inertia.

On the other hand individual security professionals might have wildly different ideas about risk tolerance and convenience, which they also have privilege to change on the whim.

I doubt it. I have the latest version of Arch Linux.

yeah but I just finished doing a security update /s

I’m quite sure they could, but mostly just because they could simply walk into your house and tamper with the hardware. You don’t need a fancy zero day when you’re the government.

Funny thing about lockdown/wfh4l... they're really gonna wait a while to get in

Turn up with a bunch of fire engines, and a gas company van. Knock on your door, and 3-4 neighbors on each side, for good measure. Tell there's been a report of a gas leak, and you need everyone to leave their houses/apartments immediately for the inspection. 15-20 mins later - you can come back in, all's safe. Thank you for your cooperation.

>although I don't think the NSA can just install anything on my computer

If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.

I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities.

Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device.

And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about industrial espionage.

You don't even exist to them. The NSA wants to infiltrate nations. They do stuff like hire a friendly foreign nation to quietly buy a security company their target depends on and then exploit that vulnerability from a host in a fourth nation.

The NSA is an agency with a yearly budget of approximately 10 billion dollars. There are not many companies that can match that.

>From operations that went public

Are you talking about Snowden's powerpoint slides or the Shadow Brokers arsenal?

What’s with the doomer mentality. NSA isn’t some magical unicorn that can just walk through everything

They kind of are though. If you have a LOT of money, time, and personnel -- and they do -- you can find a lot of vulnerabilities.

Yes and we've seen their shit get leaked over the years. From that we can see clear patterns in what they view as valuable and where they spend their significant, but still limited focus.

Can you proof that it is a leak, and not a stunt by the NSA itself?

You have be wearing multiple tinfoil hats if you think NSA released DeepBlue as some sort of black flag OP

>NSA released DeepBlue as some sort of black flag OP

EternalBlue...and it was a part of the shadow broker package, but that was just one occasion, Snowden is one of the other.

One must probably wear a Tar-hat to think that this is impossible.

I guess we just have to agree to disagree. There was no benefit for them releasing the zero day.

>NSA isn’t some magical unicorn

With unlimited money and the given job to crack encryption, hack into systems and secure the networks of the wealthiest nation and only superpower on earth atm. It IS pretty much a unicorn, and i am pretty sure they are +20 years in the future technology-wise, and with that:

>>Arthur C. Clarke — 'Magic's just science that we don't understand yet.'

So yes Magic Unicorn describes the NSA pretty well.

Yeah, that's bullshit. For NSA-proof personal tech stack you'd rely more on tamper-evident blocks that's all. Also, security in depth and security through obscurity are much more applicable if you're a person and not an organization. Finally, +20 years head start does not mean much if you distrohop and FOMO into bleeding edge stuff like a tech podcaster.

Not sure if you know what your talking about, you sound a bit like a bot #NSA-proof #distrohop

In case you're genuinely curious, 'NSA-proof' is a portmanteau from NSA and 'idiot-proof'. Distrohopping is when people change (usually GNU/Linux) distributions once a month or so (which is an allusion at tongue-in-cheek conjecture that one can change distributions faster than NSA can break them). Have a good day, fellow human.

>one can change distributions faster than NSA can break them

Oh man i don't know what to say. Does one distrohop the ssd/efi/net/wireless/keyboard/etc-firmware too?

One distrohoped for 15 years and that vuln existed all the time..but hey it would be just that one...it's an exception right? ;)

https://securityaffairs.co/wordpress/115565/security/linux-k...

How many completely different browsers exist? And how many local exploitable user to root exploits exist in the Apple/Linux/BSD world's? If your a valued target and you are connected to a network you WILL be hacked.

Buddy, I'm not gonna follow this thread anymore because you seem to be baiting me to read you a lecture on OPSEC, security in depth and compartmentalization.

Buddy, your distro hopping advice is advice so bad, that the most charitable interpretation is you have no idea what you’re talking about.

Seriously? Distro hop? My brain hurts, I need coffee.

Lol, this is so fucking funny. Distro a day, NSA stays away! Amazing.

Yeah this is bullshit. There is no demonstrated NSA proof setup. If they haven’t broken in to something, they aren’t telling us about it.

Assuming that time travel is impossible, NSA can't break into something that does not exist anymore. Hence the idea when facing such adversary is to provide them a constantly moving target. Although NSA might be able to break any full disc encryption given enough time, they aren't able to decrypt something that no longer exists.

This principle isn't scalable to every computer system out there and will definitely go against other requirements in most organizations, but if you are an individual, it's not hard to pull it off.

This ignores the obvious. What parts are not changing with a distro hop?

Are those parts vulnerable to the NSA?

I believe due to what was made public, that they do have that capability.

I would suggest more research. If you are actually changing distros every month, that seems like a very manual process, with many points to use an insecure config. I think your time could be better spent hardening a current system.

And yes the NSA could own your box every month (and would) if it suited them.

Check out this link, this stuff is fascinating.

> In some cases, the NSA has modified the firmware of computers and network hardware—including systems shipped by Cisco, Dell, Hewlett-Packard, Huawei, and Juniper Networks—to give its operators both eyes and ears inside the offices the agency has targeted. In others, the NSA has crafted custom BIOS exploits that can survive even the reinstallation of operating systems. And in still others, the NSA has built and deployed its own USB cables at target locations—complete with spy hardware and radio transceiver packed inside.

https://arstechnica.com/information-technology/2013/12/insid...

You pose the questions but do not answer them. Assuming distros are selected purposefully you do get quite a lot of variability. Recompiling the kernel with different hardening options alone makes many exploits impractical.

The threat modeling that you see in this thread is laughable. Nobody has infinite resources, not even NSA. They can't throw all their capability at you alone. In fact they are not even interested in any one individual. They might be interested in some groups of people like "terrorist leadership" but even in that case they don't have the need to hack all people matching that group. So at every step of the decision making process there is a cost benefit analysis. And in the end NSA will only hack some terrorist leaders, the ones deemed sufficiently significant but not any more risky then is necessary.

The amount of meetings and paperwork required for carrying out offensive action is significant and everyone involved is very risk averse. Getting superiors to sign up for an operation against an individual capable of detecting attack and thus risking attribution would only be possible if the proposed techniques can be shown to be extraordinarily stealthy. That requires replicating the system in the lab and rigorously testing methodology beforehand.

Yeah, it is hard to protect organizations from nation states. Because all sufficiently complex systems have bugs and given long enough time persistent attackers will find & exploit these bugs. But that's because organizations have other real-world priorities besides fighting NSA. These organizations can't change protocols overnight and replace core systems just for fun of it.

Individuals actually have an advantage here because they can rotate systems at will and have much higher control over their personal lives than any CEO/CTO/CISO has over their organization. As a result, yes you can raise the cost of an attack against you high enough that NSA won't bother hacking you - either because there are other people who are less protected but hacking them would fulfill the same objective or because your ass gets handed to another agency which is able to present more cost-effective solution.

Your link demonstrates this dichotomy between options that NSA has available for hacking organizations vs individuals. Individuals rarely have well documented procurement processes available for third party auditing you know.

> You pose the questions but do not answer them.

I literally answer directly after the questions. Read for comprehension.

I can tell you with 100% certainty that your assumptions are 100% wrong. Interpret that statement as you may and update your threat model accordingly.

You sir have no clue what you talking about, a payload geter in your ssd-firmware survives your distro-hop and can adapt to every OS (if your information is worth the work). And an encrypted disk...on man i stop arguing, it's obvious that you really don't have a clue.

You just keep talking straight past my points without even trying to understand them. Why bother writing answers at all?

I'm not advocating for installing a fresh OS on an exploited hardware and calling it a day, no matter how hard you try to present my words this way.

The point is to keep any single environment around only for a short period of time so that adversaries don't have enough time for replicating your systems and crafting a targeted exploit chain.

It is not meant to be the only line of defense. You would still harden every system you own, putting particular focus on tamper & intrusion detection (including retrospective analysis).

Couple that with strong compartmentalization (e.g. using different hardware for different purposes, Qubes OS style virtualization approaches) and defense in depth (exploit mitigations, traffic anonymization).

Here, I have spelled it out for you. Feel free to outline how you would approach attacking such individual adversary, even with NSA level team at your disposal. Silent assumptions being that 1) if person's physical location is known, CIA is a cheaper option than NSA and 2) failed offensive operation leaving attributable evidence is considered by NSA worse than missed opportunity.

Please, stop low effort ad hominem attacks.

Wow you change your meaning pretty fast, yes if you trow your laptop away after 1 hour you are pretty safe...well if the laptop is from a secure source...like amazon ;)

> adversaries don't have enough time for replicating your systems and crafting a targeted exploit chain. Is this how you think it works?

I guarantee that whatever browser you use, they have 0day for it. Whatever ISP you use, they can inject traffic into it, and they have a much easier time about it if you aren't in the US.

If you're someone who uses the Internet, the NSA can take over whatever you use to browse with and have their way with it. If you don't, well that's what their interdiction program is for.

The thing is though, the economics of 0day indicate that the more you use it, the more likely it is that it'll get burnt, and supply is limited.

They can certainly hack anyone, but it doesn't scale, so they can't simply hack everyone. They can maybe use these techniques on a handful of targets per year, so they make it count, but most of their intelligence comes from the data we all give away for free every day.

Indeed the best protection against getting 0day'd is probably to be into computer security. I feel confident that the NSA is not throwing 0days at computer security professionals; whereas they could use them on the average person with little risk of detection.

I think a lot of people underestimate how hard it would be to build something like Ghidra not from a technical perspective, but from an avoiding big organisation bureaucracy perspective. Unlike a typical bureaucracy however, and amongst other problems[1], the barrier for entry for hiring is extremely high, everything happens within an echo chamber (closed community with little external influence) and paranoia and overbearing security process has a freezing effect on morale and the use of modern workplace practices and technology.

Whilst other companies and organisations hire staff quickly who can more freely experiment with the latest technology from a hip coffee shop or their home, someone at an organisation like the NSA after waiting a year to start the job and after having hiked 8km from their car to a windowless and soulless building in the middle of nowhere instead has to fill out dozens of forms and seek dozens of approvals just to consider the idea of experimenting with some new technology.

I am amazed something as useful as Ghidra could actually be built within such a large bureaucracy in modern times, and then even more amazed that someone managed to get it released as open source software to ensure it continues to be maintained and useful long after the next internal reorganisation and exodus of developers.

[1] https://news.ycombinator.com/item?id=16057449

There has been a lot of cyber crime in recent years, e.g. see the recent wave of ransomware attacks. These criminals are mostly amateurs that know some exploits and use them. The NSA is a huge organization that employs many professional experts. Spying is one of their main objectives so you can be pretty certain that they are pretty good at it. Computer systems contain a lot of vulnerabilities and you can be pretty certain that they know a lot of them.

The computers of most people are vulnerable even to normal cyber criminals, the NSA is a lot more powerful.

Most of their work probably doesn't even need to be technical. How many high-profile attacks have been based on social engineering?

Most people hear "social engineering" and think of someone playing journalist to get access to places. The NSA's idea of social engineering is having the CIA work with the BND to buy Crypto AG.

how many "former" government employees work at Google?

Social engineering can be highly effective. However, from what we know about the NSA, especially from the Snowden leaks, it appears to be mainly a technical agency. It seems likely that the NSA does not use social engineering on a large scale itself but hands it off to other agencies like the CIA or the FBI.

"There is a lot of bluffing when it comes to cyber security."

I wish this topic received more discussion.

Yes we can talk about that, let's start with the FSB an why they are always so stupid ;) to left the compilation time with the working-hours of moscow and the cyrillic keyboard in the compiled binary.

It’s almost as if it’s not the FSB… but somebody making it look like it was… (See the Vault7 leak attribution masking)

The Google Service Framework (which is installed on 99.999% of Android phones) gives a root access to Google on your device, and Google has the power to silently install/uninstall apps...