Look at Google, Apple or Facebook. There is just sooooo much different attack space. Thousand of servers, thousand of employees that could be bribed, hundreds of third-party people they rely on (Content Delivery, ISPs, Colocations/Datacenters, Hardware suppliers....). A single NSA-controlled computer in your network is a starting point to take over the rest of the network.
/edit: Even if they straight up tell them they have a "bug" in their network, how the hell would they ever find it? I could be a switch, it could be a VoIP phone, it might have been a software-package that was injected with malicious code _while_ downloading, it could be a RaspberryPi camouflaged as some other device, it could be a employees computer, it could be a network-printer, it could be a hijaked VPN account. It could be anything. I just don't see how there is any way to protect yourself against this, even with a dedicated security team and a big budget.
A great point but I would argue that there might be enough "n" at a company with only, say, 500 employees.
On a different note, I'm not sure the best angle of attack is to bribe anyone. After all someone bribed is also someone who can disclose info. Or could even get hacked themselves whereby someone else would discover that they are cooperating and release or expose that fact. For many reasons. Could be a roommate, an angry spouse or girlfriend etc. And after all a bribe is also money so there is a money trail if large enough and/or not paid in cash. And some people just like to talk and brag.
Secrecy wise, the less people that they were to involve the less chance of a leak. At least one reason that top secret programs have limited people that even know they are going on, right?
The NSA/FBI/DEA can and have used tactics like extortion (e.g. for planted drugs, money laundering charges etc.) to make people cooperate. It's like a bribe just without the risk of exposing.
Would you cite sources for that?
If any of the three-letter agencies (or, for that matter, any big govt agency) uses these kinds of tactic, then there is no reason at all to believe other branches of govt refrain from doing the same shit.
Once, a long time ago, that last sentence would make me a tinfoil-hat-wearer... sad that this is not the case anymore.
They can easily plant their own agents inside the company as employees.
("undercover agent" getting a job at the company like a regular person)
I'd be very very surprised if they already haven't done it.
1., They are willing to sell you intel for money.
2., You can now blackmail them as they accepted a bribe.
Point 2 is the reason you should never accept bribes when doing business, especially abroad and everyone tells you "it's normal". they're just waiting for a foreigner to get exposed, take your passport and have fun with you. see Russia, etc.
No need to be Macchiavelli.
> is to find something they are really really embarrassed about
I don't think NSA needs to employ high school level tactics.
If they want to pin something, they will. True or not.
That's not a bribe.
Learn the difference between strong-arm tactics such as blackmail and bribes. Two completely different approaches.
Patronising dickhead.
Link me to a case where NSA/CIA/FBI blackmailed AND worked with / gave money to an individual at the same time.
The CIA typically recruit through a combination of carrot and stick - i.e. bribery and blackmail.
"Hey dude, let me tell you about this sweet slightly dodgy thing I can get you in on."
... ...
"Oh by the way, I hope you like all that money you made. I work for the CIA. Work with us or go to jail, your call."
More commonly than not it's not about self-preservation, rather protection of loved ones - read up on Operation Mockingbird, which was driven pretty much entirely on this basis - luring journalists in with a subtle bribe hook, then using it to blackmail them.
Did you read anything I posted? In what instance was somebody bribed AND blackmailed at the same time during the Mockingbird?
Please go back to Wikipedia and try again.
Some might dispute that, but I think you're exactly right in a "big picture" view.
E.g. lets pick on Microsoft because it's such an easy target. Bill Gates announced his company wide security effort in 2002. Yes, twelve years ago. And while security at Microsoft has gotten better, I think Microsoft still has plenty to be ashamed of.
It's the same everywhere else. There's a forest fire raging and people are walking around with super soakers trying to put out spot fires.
Our approach is therefore totally flawed. We need some big picture rethinking of how we are implementing security.
It's just a whole different world.
EDIT: thanks Mr krapp.
The real threat is pranksters, disgruntled employees and most importantly criminal enterprises who need to weigh their targets. The relative security of our credit cards in a digital world speaks to the measured success of small time security.
I agree with you, though, that the real threat is not the NSA for most of us. But many of us do have users, and do actually value the privacy of our users (and for those of us in EU countries, we have a legal obligation to safeguard the personally identifiable data we store) and so it is still of interest to learn about what we can do.
For many of us it is also a matter of principle and/or political viewpoints that this surveillance needs to be countered and stopped. If the public is prepared to remain complicit by not voting out the people who continue to deny the existence of these programs and/or continue to refuse to stop them, then we need to seek other alternatives. (Note that I explicitly avoided singling out the US in this part, because I live in the UK: GCHQ is as large and a problem as the NSA, yet the British public appears to not care at all)
Being in a different country didn't help Kimdotcom.
GCHQ is a different problem to the NSA - they appear to try to obey the law but have weak oversight and scrutiny. There are at least some politicians who don't want to give GCHQ more power and who think they need better regulation.
Most of us are not in lines of business that are so easy to cook up excuses for raids about, nor have a past that makes it so easy to try to make us come out looking like Bond villains.
I'm not saying there are not plenty of cases where "just taking the servers" is a viable option. But that does not mean there aren't a lot of us for whom protecting against NSA to the extent feasible is an option that is not ever likely to result in someone raiding our servers.
> GCHQ is a different problem to the NSA - they appear to try to obey the law but have weak oversight and scrutiny
Arguably the NSA tries to come down on the right side of the law too. It's just that they do so by creatively exploiting every available loophole and making use of every possible discretion of their lawyers and lax oversight as well.
I'm not so sure GCHQ wouldn't do the same if their oversight wasn't such a joke that they were found to boast about how weak it is in one of the NSA documents.
Unless they want to use your hardware to attack someone else or building a wide dragnet or want to steal corporate secrets or ...
This is infeasible for a lot of organizations, unfortunately. And it also becomes much more difficult if your adversary has full control of your DNS servers or can perform a man-in-the-middle due to their backbone Internet access. Something like an Evilgrade (https://github.com/infobyte/evilgrade) attack conducted via an ISP MitM is very hard to detect and prevent, and I suspect NSA uses Evilgrade-like tactics frequently. And if you live in the US it's game over by default, since they can legally send people onsite to compromise you.
If ^^that^^ is true, then I'd argue your first sentence is not. There is simply no way to truly protect yourself if the gear manufacturers are complicit.
Edit: oh, you'd have to import the Chinese one yourself into the US to make sure it doesn't get its firmware "updated" somewhere in the suppliers chain.
Remember the pictures of Cisco gear allegedly intercepted by the NSA on its way out to customers? Unless you carry that router with you on a flight, you have little guarantee other than hoping you're too insignificant for them to pay attention.
The big problem with this is that even though nobody knows your private key, they don't know your public key either, they have to rely on knowing the CA's public key and accept whatever public key they get when they connect so long as the CA says that the key is kosher. So let's say the NSA wants to track what you're doing on yourdomain.com, they just send a secret court order to VeriSign saying that they must turn over their private key that they use to sign certificates because computer security is a terrorist threat. Now they just use their own public key and send you a cert signed by VeriSign saying that the NSA key is the correct key to use. Because the NSA has more or less priviledged network access they can intercept traffic going to the IP address for yourdomain.com and just do a standard MITM but replacing the good SSL cert with their bad one.
What complicates things further is that there are tons and tons of CAs out there that are trusted by default and there's no isolation (AFAIK) such as "only these 10 CAs can sign certs for .com" so when the Iranian government wants to dish out some Orwellian justice on it's citizens they now have that huge mountain of targets to choose from because getting into one CA in the world (like DigiNotar) means that they can essentially break vanilla SSL until that CA's public key is blacklisted and all of the clients are aware of the revocation.
Just as a disclaimer, this was rather simplified but I feel like that's close enough to get the point across.
That is why the CA-system is a joke, you only need to compromise any of the CA's that are trusted by default to fool all certificate users.
Frankly, you don't have a chance if you're in a business that is valuable to a three letter agency. Even if you do the right things, you have to assume your colleagues are compromised. Look at those Sysadmins in that video -- chances are one or more of them is not only under surveillance, but actively collaborating with NSA or some NSA front.
It's NOT the system administrator's work to secure the network. The ISP/minor IT company should have a security engineer to overview the network, although some sys-admins are extremely skilled when it comes to security.
There are so many security layers that can be implemented on a Linux/BSD server that makes the machine virtually un-hackable and IF anyone enters, all bells and whistles could start cheering.
Examples: GRsecurity[1], IPTables[2], Snort[3], chroots (or jails), VPNs, malware scanners (clamav, spamassassin), encryption and what-not.
To me securing linux desktops, especially simple ones (e.g. window manager + basic programs... almost like thin clients) is easy. Securing Windows XP/7/8/etc is extremely tricky BUT can be done.
Once you do all that, I'm 100% that you're going to be one hell of a target for anyone. And you really don't trust your team you can always hire people to test your network's security and improve it.
The most important thing though is having a strict general user policy: What users can and can not do must be crystal clear with no exception. When a 'tiger team' finds a secure network, they usually target the people not the infrastructure.
[1] GRsecurity: https://grsecurity.net/
I know easier said than done. Writing firewall rules/ confug reporting tools for every computer in the internal part of a network is hard too, that's why almost no one does it.
I was talking on a keyboard-only level, but even that can be largely mitigate with proper policies IMHO.
That said, an insider is an achilles heel for every security scheme out there (e.g. Snowden).
>security layers that protect Infrastructure from all but the most sophisticated attackers (aka state/country funded).
I think the OP was specifically talking about defending against highly targeted government sponsored / APT attacks.
If you try to make your network absolutely NSA proof, you'll become broke trying. But maybe you can make reasonably sure that they will have to sneak in the custom router firmware, or have to bribe two or more engineers, instead of learning the secret passwords through an injected-Facebook-drive-by-download they can pit into their systems for free.
What do you mean precisely when you say that "sysadmins have tons of stuff going on"?
Probably the best way to describe this, is to compare security and pro sports teams. From what I have read, the NSA is a top tear team winning championships across the globe, with billions in research and development, and thousands of highly trained athletes, living and breathing this day in and day out. Yet, they are matched up against a local beer league who likes to play casually Thursday nights. Who do you think is going to win?
Go read the "A Look at Targeted Attacks Through the Lense of an NGO" [3] paper, then put yourself in their shoes. Think about the IT resources a small NGO with 30-50 employees has. Maybe they have a sysadmin and a helpdesk guy. They are dead meat. The threats are so vast, spear phishing, target malware via MITM attacks, etc. It almost seems hopeless. But it is not just the NSA at the top of the heap, you have lots of foreign governments, which have direct access to your playing field via the internet.
Think about the resources that Google, Facebook, and Apple throw at security, then you see something like Operation Aurora [4, 5]. What chance does an ISP or small business have? None. Personally, it just seems like the entire model is broken. Yet, nothing seems to change, in that we are all just waiting for the next zero day to drop, and the cycle continues. All it takes is one targeted zero day addressed to a normal employee, the attackers gain access to the network, then move laterally [6, 7]. The odds are further stacked, in that you have a top tear team against a targeted employee, who doesn't even know the game.
ps. sorry for the tone of this
[1] https://firstlook.org/theintercept/2014/03/20/inside-nsa-sec...
[2] http://www.theguardian.com/world/2014/aug/13/snowden-nsa-syr...
[3] http://www.mpi-sws.org/~stevens/pubs/sec14.pdf
[4] http://www.wired.com/2010/01/google-hack-attack/
[5] http://en.wikipedia.org/wiki/Operation_Aurora
[6] http://g0s.org/wp-content/uploads/2013/downloads/Inside_Repo...
[7] http://intelreport.mandiant.com/Mandiant_APT1_Report.pdf