Wasn't their plan with stuxnet "spread this as far as we can and eventually it'll hit what we want?"

Ignoring how frequently they will accidentally target the wrong people, that seems like intentionally creating something where there will be accidental victims.

>The worm initially spreads indiscriminately...

And most of the rest of the article. They made a worm that was only supposed to activate in incredibly specific circumstances, but spread indiscriminately to find that specific circumstance.

edit oh, and let's not forget those extremely specific circumstances still seemed to have hit a thousand other targets accidentally, which is the exact thing you said isn't ever going to happen.

There is an element of you are going after a very specific system or set of systems but they are all air gapped and you need to find a way to get your malware onto those systems somehow.

This part is actually how you describe it more or less. The plan was basically: spread everywhere you can but only do so if you are confident for some reason that you’re on a system belonging to the target country (I.e Iran) and if anyone ever sticks in a USB key to one of those systems you should take that as an opportunity to cross the air gap because people are sloppy and mistakes happen.

So in that sense, yeah it is somewhat true, that’s literally the strategy they used to get where they needed to go. However, the controls they had around it I think were also reasonable. I fully expect the NSA and Mossad (who would later somewhat fuck up the operation) to be doing exactly that and I think it’s consistent with their job.

The second part is the “actually malicious” payload. That had an entirely different set of checks and balances in place to make sure it wasn’t fucking up unreleated systems along the way but just using them as a launch point.

That full context I think still firmly fits my original definition that unless you’re actively on a target list for some reason you have no reason to view NSA malware as something you should have on your threat model. Not sure if you agree or not?

And that's forgetting that no matter how specific the NSA supposedly was, after launching their malware other groups will copy it, so an AV provider will need to view NSA malware as a threat model.

Plus, your original definition assumes the NSA either doesn't make mistakes, or an AV company shouldn't try to clean up their mistakes, both of which are nonsense

1000s of computers did indeed have malware on them. That’s true.

The malware was intentionally designed to do nothing other than trying to cross the airgap to where it was actively trying to go.

This is the entire reason I just explained why when you say “stuxnet infected thousands of machines” that you’re actually talking about a couple of different things here as though they were one.

The nuance in this particular debate matters quite a lot and I don’t think ignoring it for the sake of convenience is helpful.

If it only damaged the one system it was supposed to be targeting, why would we ever have heard of it?

I.e here is an example of what we consider to be legitimate use to compare and contrast with say North Korea’s Sony hack.

But also it lost a lot of its value as a secret once it was already done.

[1] - https://time.com/3010649/nsa-sexually-explicit-photographs-s...

[2] - https://slate.com/technology/2013/09/loveint-how-nsa-spies-s...

“The letter sent to Grassley reveals that there have been at least 12 recorded cases of spies abusing their powers since 2003”.

So, no, the NSA is not out there abusing their powers to go after illegitimate targets. It’s also worth keeping the context that this was in a pre-Snowden era.

In 2024 you can’t access a single thing without their being a log of who you are and why you are looking at it and under what legal statute that is allowed precisely to prevent something like that ever happening again.

What you are implying simply isn’t true.

We are talking about if the NSA abuses its power to go after illegitimate targets.

You quoted the same single source twice but written by different people which when we got down to the heart of the claim showed that there was actual evidence of approximately 1 incident per year over more than a decade time frame.

I also explained precisely how and why things had changed in the past decade since that quote was relevant so that it wasn’t possible for people to do that any longer without tripping all kinds of alarms.

If you have other evidence then please share it but what you have so far doesn’t support your claim at all.

And the auditing systems at the NSA were obviously very poor, and there's no reason to think that has meaningfully changed. Of the very few cases they were able to "catch", a sizable chunk were from self reporting in polygraph exams or even more absurd things like a girlfriend reporting a guy who she suspected was spying on him - and he was, as well as 9 other women. In no cases were there any meaningful penalties, with the worst case being resignation. And similarly, it seems people engaging in the harvesting of sexually explicit material Snowden described were never caught, which is likely why he referred to it as something like a "fringe benefit".

Listen when I talk about single source. I’m talking about “Edward Snowden made a claim”. It doesn’t magically become two sources because he gave two examples.

Moving on from the technicalities though because it’s a dumb argument to get stuck in and into the heart of it.

We are still stuck with the problem however that there wasn’t ever any evidence of this happening that anyone could point to even after an in depth investigation into the topic beyond the dozen incidents over more than a decade time period.

Snowden (and now you) made the claim that in fact it was much higher but you simply can not prove it which is awfully convenient but does leave the question open of how could he possibly have known this?

Are you meaning to tell me that the biggest leaker of classified information in the US’s history for some reason chose to hold back on what he knew about that topic? He must have known of specific people and incidents and could have cross referenced what was in the investigation with what he knew.

He couldn’t have dreamed up a more perfect gotcha moment if that was the case to come out and say what about incidents X, Y and Z.

That never happened and you should naturally wonder why that might be.

He either didn’t actually know of any or he chose not to reveal it for undisclosed reasons beyond a vague insinuation.

I also want to put it to you that perhaps Edward Snowden was not exactly an honest broker in the way he claims to be. I know it’s somewhat blasphemous here but as I mentioned in another thread this week there is actually a rather compelling theory in the IC that he might have been part of an malicious insider campaign from the very start. In part because of things like this ironically.

Beyond this Snowden's revelations were not about abuse within the domestic surveillance apparatuses, but about the existence of those apparatuses themselves. Prior to Snowden the idea that the government was engaging in widespread surveillance, of essentially everything, was still just a "conspiracy theory." The entire system itself is likely illegal, as it pisses all over the 4th amendment, but cannot be legally challenged because of a simple problem - for one to prove standing, to enable them to sue, they need to not only prove they were spied on, but also harmed by spying. Each time this is tried, the NSA simply claims national security and refuses to cooperate. So we have a likely illegal surveillance system with no legal means of challenging it.

So people trading sex pics, spying on lovers, or whatever - these are all instances of abuse within a system that should not even exist.

There are only a couple of possible scenarios here that I can think of:

1. Snowden is making a claim here that he suspects but doesn’t have proof of (I.e speculation).

2. He does have proof but isn’t willing to share it. Not with the public, not with investigators and for some reason he chose to never mention it internally beforehand.

3. He is intentionally making outlandish claims he knows are wrong.

I can’t see any universe where option 2 is likely. He is every possible motivation to do so if you go with his public story about why he did what he did.

I’m entirely open to options 1 and 3 however.

Also nobody is claiming that those incidents were anything other than abuse of the system. We are all in agreement on that. The question of is this more common than other threats they face from insiders such as spies for example is what we disagree on and so far I’ve not seen a single piece of compelling evidence to suggest it is.

Furthermore, I’ve explained how there are now new controls in place to prevent that from happening again and you don’t even have to ascribe any kind of altruistic motivation for it about protecting people’s privacy. You can entirely put it at the feet of they want to make sure they never have another Snowden incident again. This is why I’m saying that this just isn’t a realistic threat that people should be worrying about in 2024.

How could you claim that without (a) having insider knowledge of the secret activities of the FISA court and (b) violating some sort of legal restriction on publicising your knowledge of said court? One of the major complaints about the US surveillance program (indeed any surveillance program) is almost nobody is allowed to know who the targets are or why.

> I think the most controversial thing on that front from memory was Angela Merkel and other EU heads of state

And I think the most controversial target to date was actually Trump.

The fact he happened to suddenly become a politician doesn’t mean he is suddenly in the untouchable category only that the level of scrutiny goes way up.

That story is still in the process of being written but Trump absolutely deserves some level of investigation in a way that’s entirely consistent with US laws.

I’m still continuing to claim that there is no publicly available evidence to suggest the NSA is abusing its powers to go after illegitimate targets. If you have some please share it.

So when you say "legitimate targets" does that include all US politicians? Or only ones that you think are a threat to your interests? Perhaps we can speed up the argument and you outline what you think the illegitimate targets would be. Because that case sounded like clear cut abuse of the spying apparatus to me. Bearing in mind that people involved in obtaining the warrant ended up being charged with related crimes of falsifying documents.

He had multiple people go down around him that were actively working as Russian agents and then he had Kushner working to set up a secret communications channel out of the Russian embassy that was actively designed so that it couldn’t be intercepted by US intelligence.

When you do that kind of thing, no matter if you’re a politician or not, in fact ESPECIALLY if you’re a politician you should absolutely expect people to start asking questions and opening investigations.

We don’t need to pretend he was some normal candidate who had a couple of whacky ideas.

They bought this system in notionally to fight terrorists. It has in short order turned out that "terrorists" include someone who can be described as a relatively popular (!) Republican candidate. Are you contending that this is legitimate use of the foreign intelligence apparatus?

Most US presidents have dealings with foreign countries. The Biden family are famously involved in Ukraine (& others), Trump was all over the place including Russia. Obama was probably just domestic but the Bush family have a lot of interest in oil which is going to involve foreign contact and the Clintons are closely involved in US foreign policy. There'd be a case for spying on almost every president in the last 30 years!

Being popular has nothing to do with it, being a politician has nothing to do with it, what others may or may not have done has nothing to do with it.

There were a whole range of specific actions that occurred that resulted in an investigation as it should.

One of the FBI lawyers involved plead guilty to a felony false statement charge. They were literally making up pretexts to spy on the Trump campaign. I think the issue here is when you talk about "legitimate" you mean that you are happy enough to see the FISA system used as an internal political club. There is no way that it is being used legitimately, we're in the opening stages of a process where every single incoming US president is going to have their communications examined by the incumbent's administration. Or at least when the party in power changes.

There isn't anything special about Trump here. He turned out not to be doing anything suspicious, or they'd be going after him for it (or have gone after people in his campaign). Ergo, any clean candidate is probably suspicious enough to warrant surveillance.

Can you share it?

Please explain to me what you think should be different.

The thread went like this:

- Someone: Kaspersky is arguably the best at the job, was the only one capable of detecting NSA malware at one point.

- You: NSA never targets anyone they don’t want to target, and antivirus is useless if you are a target.

- Someone: NSA malware also gets leaked into the wild and end up infecting millions.

- You: A single example?

- Me: A single example (that was arguably digital security story of the year at the time).

- You, two comments later: what should NSA do?

They don’t need to do shit. Antivirus companies should up their game. In practice though, word on the street (probably backed up by leaked documents too but I’m not sure) is they — including the targeted software vendors, notably Google and Microsoft — often just greenlight their allies’ operations, and issue a low profile patch when it’s really bad.

To me the only conversation to be had here is were there reasonable protections in place at the time and what is being done to prevent it happening in the future but just due to the fact that this is the NSA those conversations are not going to be public for obvious reasons.

What exactly do you want to see happen here?

> Unless you have a reason to believe that somewhere the NSA is having a meeting where your name is getting mentioned this isn’t actually something you need to worry about.

... unless the exploits leak (after use), which they do.

The CIA once proposed to commit terrorist attacks on American soil to create a justification for war a against Cuba. JFK turned them down but was anybody in the CIA ever punished for it? Hell no, and there is reason enough to think they may have even murdered him for that rejection. Even if you don't believe that, none of them have ever been punished for their abuses and there has never been reform.

These rogue pieces of software do occasionally escape their intended target and do measurable damage to infrastructure. Many such cases.

The idea that "I don't need quality antivirus, because I have nothing to fear from such threats" has similar energy to "I don't care about my privacy, I have nothing to hide."

Malware is a real thing that people need to worry about.

Being targeted by the NSA doesn’t happen by mistake.

As some others have pointed out, there was an incident a few years ago where NSA lost a whole bunch of their malware thanks to I believe again it was a leaker in that case (Joshua Schulte if I remember correctly).

That did in turn end up getting used in a North Korean operation shortly thereafter which by contrast didn’t seem to have good controls in place and absolutely spread like wild fire.

But as far as I know it happened once, was an anomaly and just isn’t a thing that is likely to ever impact you which is why I’m making the argument that what the OP was saying that Kaspersky is the best anti virus just isn’t a good argument and people shouldn’t feel like they are missing out on anything in this instance.

Let me make another point.

Having access to multiple computer security firms is good, and the services Kaspersky provides do not end with their antivirus software. Security firms regularly publish their work and work with each other.

Perhaps I'm wrong here, but if memory serves, Kaspersky was one of the first firms to detect stuxnet and publish it's structure (I could be wrong here, trust but verify). Using this data, Symantec was able to begin studying the virus as well.

Walling off security research will lead to more parallel research, rather than international collaboration in computer security. Whether or not this is a good or a bad thing is arguable - but I believe international efforts are a net good while the Internet is an international affair.

Who knows, siloing of development might allow creativity and novel solutions in computer security like what happened with the USA/antibiotics and the USSR/phage theory - but I might be coping here.

Of course not. Only the criminals are punished. /s