Snowden Spoofed Top Officials' Identity To Mine NSA Secrets 743
schnell writes "As government investigators continue to try to figure out just how much data whistleblower Edward Snowden had access to, MSNBC is reporting that Snowden used his sysadmin privileges to assume the user profiles of top NSA officials in order to gain access to the most sensitive files. His sysadmin privileges also enabled him to do something other NSA users can't — download classified files from NSAnet onto a thumb drive. 'Every day, they are learning how brilliant [Snowden] was,' said a former U.S. official with knowledge of the case. 'This is why you don't hire brilliant people for jobs like this. You hire smart people. Brilliant people get you in trouble.'"
Amended quote (Score:5, Insightful)
"Brilliant people get you in trouble.'"
More like "Brilliant people expose the trouble you're currently in".
The security-state here keeps saying "if you don't have anything to hide, then you don't need privacy"
Well, if the NSA weren't doing shit that warranted whistleblowers, they wouldn't have the problems they currently do.
Comment removed (Score:5, Insightful)
Ahh, that explains it. (Score:3, Insightful)
That explains why they really, really, really wanted to get their claws into him.
Forget the extreme negligence of morality of what they were doing, forget the fact that he leaked those secrets to international press.
It's just 100% pride. And I bet those top officials are the ones gunning for him.
Until they realize that what they were doing was unacceptable, this will continue.
And I expect it will continue for a very long time..
Re:so he did in fact break the law (Score:4, Insightful)
"Brilliant"? Hardly (Score:5, Insightful)
"This is why you don't hire brilliant people for jobs like this. You hire smart people. Brilliant people get you in trouble." -- a former U.S. official with knowledge of the case.
Um... no. What is described in TFA is not "brilliant" at all, but a necessary part of being a sysadmin: you have control over user profiles.
The fact that the "former official" does not seem to realize this does not lead us to conclude that Snowden was brilliant... but rather that the mentioned official was anything but.
"Former U.S. official" (Score:4, Insightful)
Re:Integrity (Score:5, Insightful)
People with integrity are not going to be working for the NSA. Kinda runs counter to what they do.
Seriously?!? (Score:5, Insightful)
This isn't brilliance, this is just poor security. This is systems that had a vulnerable audit trail, or didn't bother auditing enough, or created records no one ever looked at. Surely user snowden su-ing to some top official throws a red flag somewhere, right? If not, why not?
It will happen again (hopefully) (Score:5, Insightful)
Inside the NSA is probably an amusing place to bea fly on the wall at the moment. All sorts of new procedures to try to stop someone else doing the same thing. However: it won't work, any defences that a man can put in place can be circumvented by another man, especially one working on the inside. They can make it hard, but not impossible - at least if they want their systems to remain useful. They have, at some level, to trust people to be able to operate.
The only way that the NSA can stop future embarassing revelations is for it to behave in a reasonable and moral way. That means a complete change of culture.
I did not say ''behave in a legal way'' since corrupt laws can easily be written.
So everything was true ... (Score:5, Insightful)
It sounds like despite the initial protestations of how he'd exaggerated his abilities, and those of the surveillance program ... it's all proving to be true.
That his sysadmin privileges let him access stuff which was much more classified doesn't change that the system is capable of doing this, and likely is on a large scale.
So we've got a wide-reaching, in cases probably illegal system which can and does tap into everything -- and apparently the amount of oversight and controls they have on this is very limited.
Re:so he did in fact break the law (Score:4, Insightful)
Explain how any whistleblower is supposed to expose something if they are not allowed to make information public that the public does not already have access to?
Re:Brilliant? (Score:5, Insightful)
According to 99.99999% of the population. Yes.
Which of course makes most of us here freaking geniuses.
Unofficial statements from NSA (Score:5, Insightful)
All these people "with knowledge of the case" better watch-out they don't go off-message or they could find themselves hunted as whistle-blowers too, but they'll be OK as long as they keep talking about Snowden and not crimes he exposed.
Re:Brilliant? (Score:5, Insightful)
Well, which sounds better as a defense?
1) We got hacked by methods any average or better than average sysadmin could use. Thus our entire architecture is at risk at this can happen multiple more times. We have no adequate defense against this, and are thoroughly screwed.
or
2) We got hacked by a BRILLIANT HACKER! No one could have foreseen the ninja-like moves he used against us! Now that we've closed the obscure loophole that he used, the only flaw in our otherwise perfect system, our files are safe for eternity! Yay us!
It seems like they're going with #2.
Re:so he did in fact break the law (Score:5, Insightful)
Manning stole and leaked operational information that potentially put lives at risk by exposing agents in the field and/or operational plans in the field.
Except that in the Manning leak, the military or intelligence agencies have yet to point to a single agent or operation in the field that was stopped due to the leak. They've just repeatedly asserted this point without proof, and that means significant numbers of Americans believe them.
Re:Amended quote (Score:5, Insightful)
I'm more worried that they're saying he was "brilliant." Those actions are trivial. I'm disappointed that's all he had to do to get that info.
Agree with his actions or not, anyone who declared him anything more than "some sysadmin who took some liberties with his access" shouldn't be in charge of gathering, investigating or protecting anyone's sensitive data.
Re:so he did in fact break the law (Score:5, Insightful)
Technically they are not supposed to go immediately to the public. Military, Government, and DOD people are supposed to use the chain of command first. Unfortunately, this does not work in most cases since the chain of command in a corrupt organization is also corrupt. Numerous court cases and stories are to be found regarding how internal whistle blowers are treated (sometimes killed with their whole family, etc...)
What Snowden did in this case is correct. Not going public mind you, but going to journalists who are supposed to be working for the public's interests.
What I, and many others, find so interesting is that our media has become so corrupt that we have to have alternative news sources which hold the original 'credo of journalism' in mind when working. I'm sure if he turned the data over to the NY Post, he would have been in jail and the public would still have no knowledge.
Lengthy chain to get to the point, but the point is that he did not go "public". He went to journalists, and did so correctly in my never so humble opinion. Part of the journalism credo is to determine what to release to the public in order to present the story while protecting the Government.
Snowden was never a "Whistleblower" (Score:2, Insightful)
So much wrong with all of this...
We can see why in this quotation from TFA which you mentioned:
This is irrational and IMHO just plain ignorant.
How could you reach such a non-sensical conclusion? It requires a misunderstanding of both the technical difficulty of the tasks Snowden accomplished *and* an Asperger-level understanding of what motivates humans to perform.
The error: Interpreting Snowden's behavior as something 'difficult'...
What Snowden did was, on a technical level, something most people at or above his paygrade in IT could do. It is something **some** of us here on /. could do with little effort.
Snowden isn't some code-cracking wizard. Most people on /. could spoof users (or just steal login info) with some work.
Hopping a fence to get to a private pool is not 'innovative' or 'brilliant' thinking...that's all Snowden did.
It's not like he's DVD John....
Second, Snowden's info was *not new information*
We all knew since the PATRIOT ACT that the govt could do this...Bush renewed a domestic spying order to the NSA every 45 days after 9/11.
"NSA has massive database of American's phone calls"is the headline
So, Snowden is either *a full on spy for Russia/global Oligarchs* or *being duped into releasing info by the same*
He's not a hero, he's not a whistleblower, he's a misguided dupe that got taken advantage of, at best...
I've written this before, with links just like now...if you want to disagree, if you want to claim Snowden *did* release valuable information and not just technical details for things we already knew existed...you have to show evidence.
Snowden's info was of no use...and we didn't need any of this to have a "national conversation about privacy"
hundreds of thousands of Americans vehemently do activism to guard our privacy...these are every day people...we've been active since 9/11 and the Patriot Act and before...
Re:so he did in fact break the law (Score:5, Insightful)
It sounds like he abused his privileges to confirm his suspicions, and then took a course of action. Which is the right approach, depending on the suspicions.
Re:We're fucked (Score:5, Insightful)
This isn't about competence or incompetence. It's about putting as negative a spin as possible on Snowden.
Float a lot of trial balloons, make sure negative things get out there via anonymous sources, even if rebutted the next day, then the "traitor" contingent can forever quote the negative and leave the detailed rebuttals to others, which no one will read.
To wit: in this thread, Manning is excoriated as a traitor for releasing all the documents unredacted, but Manning did not - that was accomplished when professional journalists from the Guardian published the passphrase for an encrypted file.
Dear NSA (Score:5, Insightful)
You need to hire some of these "brilliant" people so that you don't get snowed by a Snowden. By all accounts he accomplished what he did by having incompetent management above him. This was a management problem, and one that you knew better about, or should have known better about - if you had some of those brilliant people who knew what they were doing in management!
Comment removed (Score:4, Insightful)
What? (Score:5, Insightful)
" 'This is why you don't hire brilliant people for jobs like this. You hire smart people. Brilliant people get you in trouble.'"
No, what happens is when you do shit that shocks the conscience, someone, somewhere, is going to expose you for the douchebag that you are.
Stop being a douchebag.
--
BMO
Re:so he did in fact break the law (Score:5, Insightful)
Re:Amended quote (Score:5, Insightful)
I'm more worried that they're saying he was "brilliant."
Yeah, well, that's because they want to portrait him as a brilliant evil genuis who should be incarcerated for the rest of his life (as he's obviously so dangerous) rather than just a guy who downloaded stuff on his thumbdrive because their internal security was shit.
Re:Snowden was never a "Whistleblower" (Score:5, Insightful)
I've written this before, with links just like now...if you want to disagree, if you want to claim Snowden *did* release valuable information and not just technical details for things we already knew existed...you have to show evidence.
The evidence that Snowden's leak was valuable is on the front pages every day. Before Snowden, the NSA was in the news once or twice a year, buried in newspapers. After Snowden, the NSA is in the news almost every day. The disclosures may or may not be new, but the public attention is.
Man with keys to Ft Knox says anyone can get in (Score:4, Insightful)
So the whole "anybody could get access to this data at any time, even without a court order" is really more like "anyone with the appropriate privileges, which is limited to a select number of analysis, can access these records, which are protected by a court order. Except, of course, the sysadmin who breaks all of the rules, steals the credentials of authorized analysis, and then downloads whatever he wants.
Short of giving one key to a judge in a two key system and tying up an entire justice department staff to baby site every single access, there isn't a way around this particular scenario. It's baked into the whole clearance and trust model.
Re:so he did in fact break the law (Score:2, Insightful)
Doesn't change the facts, though, does it? Despicable scum or patriotic hero, he leaked proof of illegal surveillance programs. If you want to criticize someone, why are you picking snowden? He's just the messenger. Regardless what the law says, it's obvious whistleblowing sometimes requires one to get into things he isn't supposed to know about. That comes with the territory.
Consider the source (Score:4, Insightful)
Re:Amended quote (Score:5, Insightful)
br. By saying he was "brilliant," they deal with the second one. "What? No, this isn't a security lapse. This is a supervillain spy hacker genius! We've dealt with him, there's no one else out there who can penetrate our defenses. You're safe. Ask no more questions, there are no monsters under your bed, save for the ones you pay us to protect you from."
Re:Brilliant? (Score:5, Insightful)
So, having a way to change your identity to another users is brilliant?
All System Admins must be brilliant!
That is certainly the opinion of most sysadmins :-)
Read between the lines (Score:4, Insightful)
The greatest enemy of the NSA, et al is conscience.
Re:Brilliant? (Score:5, Insightful)
Re:sure (Score:5, Insightful)
Yeah, hire that incompetent idiot who will design the security precautions wrong in the first place. That'll work a lot better.
Can't do that, he left three years ago and is now working for something like northrop grumman or bechtel .... selling platforms to the NSA...
Re:Amended quote (Score:4, Insightful)
Any kind of honest person gets you in trouble, if you're doing something they don't consider honest. Ditty any kind of ethical person, moral person, etc. Of course, any of these can be wrong about whether or not you're doing something dishonest.
Conversely, any kind of dishonest (unethical, immoral, etc) person can get you in trouble if they do something dishonest, unethical, etc.
It doesn't matter who you're hiring, if what you do can be misused, at some point you'll need to discover, usually publicly, if it's being misused or not.
Cops are used to that: they often have people "watching the watchers". Spies aren't used to it, they're used to keeping stuff secret, so they have way more trouble with it (:-))
--dave
Re:so he did in fact break the law (Score:4, Insightful)
Re:so he did in fact break the law (Score:5, Insightful)
Re:Snowden was never a "Whistleblower" (Score:3, Insightful)
More importantly, he released information in a way that made it incontrovertible. It wasn't some retarded infowars release right after a video about weather control and right after another about reptilian humans.
Re:Amended quote (Score:5, Insightful)
And exactly when do you think this was different? When Walter Cronkite was alive? When Ogg told Grog what happened to Paris the other night?
Is this way, was this way, will always be this way.
Re:Amended quote (Score:3, Insightful)
Yeah, and we want to portray him as a brilliant benevolent genius who should be deified for all of time (as he's obviously so much a martyr) rather than sort of a douche who took this job just to search for something to make himself a hero before he got fired. It's all perspective.
Seriously, how long did he work for them before he found this out? Unless he's taking the fall for someone on the inside who told him this, he couldn't have had any knowledge of this beforehand. That, to me, screams "I want to become a hero, I just need to find some way to force it to happen", and regardless of how lucky he was that he found something like that and how important it was, that's setting one hell of a dangerous precedent.
What I'm saying is, the next wannabe Edward Snowden most likely won't be so lucky and might make a fool out of him/herself and the community of people who want to keep an eye on this sort of abuse.
It's because they confuse Snowden with Manning. Snowden took a job and while doing it, found evidence of abuse and exposed it. Manning had an axe to grind with US military policy towards GLBT people, so he joined up in order to gain access, then dumped everything he could get his hands on whether it showed wrongdoing or not.
Re:Amended quote (Score:5, Insightful)
How do you propose keeping a sysadmin that needs root access to do their job from being able to copy something to a thumb drive? You can ban thumb drives, but then they could just write the files to a different server that they can access from home. If someone needs root access for their job, there's no amount of security that can keep them from either copying secrets or breaking the system if they're so inclined. The only solution is hiring trustworthy admins.
Re:Amended quote (Score:5, Insightful)
Didn't the NSA contribute significantly to SELinux, the entire point of which was to enforce access controls so that root wouldn't be omniscient?
Either they weren't using it internally (which would be a bit odd, but not surprising), or they were using it improperly (which is extremely likely), or it was implemented correctly and Snowden was actually very clever (which is somewhat unlikely).
No, you don't have to have root access. (Score:5, Insightful)
A properly compartmented system doesn't have root.
A security manager (that doesn't have access to installation tools, network, operations or storage, but has lots of system activity logs)
A systems engineer (that doesn't have access to user files or security manager functions)
An operational staff (that doesn't have access to user files, security manager functions, OR installation tools)
A network engineer (that doesn't have access to any of the previous three).
And frequently, a storage engineer that doesn't have access to any of the previous 4).
Thus, separation of duty. Improper access always raises an alarm. A violation requires collusion between 3 or more people - MUCH easier to detect.
It is usually the security manager that authorizes new users. The operations staff may initiate the installation of those users - but it is still the security manager that enables them.
And yes, a storage engineer doesn't need access to user files - he may have his own files for testing/evaluation. But he can initiate load balancing that may cause user files to be relocated - but that does not give him access to the data.
Re:Amended quote (Score:5, Insightful)
Re:Amended quote (Score:5, Insightful)
Well, they'd have to, wouldn't they? I mean, come on...anyone who has worked IT has been laughing at the NSA's published accounts of Snowden's 'infiltration' and 'hacking' since day one; a jury of his peers would have trouble seeing him as using any special means to access the information contained therein.
The only people who would find this surprising are people who are JUST NOW being introduced to how computer security works, or why network admins used to be paid extremely well. It's like pointing out to the President of a large corporation that their chief shark (head legal counsel) knows exactly what evil they've been doing for the last several years, and that they've been cutting his wages relentlessly for years...if this is news to them, they need to be fired; they're obviously not qualified to run a hamburger stand, let alone a large entity.
What more, their extreme stupidity, in the form of 'doubling down' when confronted with a threat is somehow a perfect epitaph to their lifestyle. Years of treating the servants poorly, now facing paranoia, they turn to violence to instil a sense of loyalty in their 'troops.'
Fundamental Problem: Fear of Intelligence (Score:2, Insightful)
This is a fundamental problem in almost every employer I have been connected with in the last 15 years. I have been employed 30+ years.
There is a great fear of intelligent emplyees so marginal managers hire even more-marginal employees for fear of being eclipsed. If should an intelligent employee manages to get in by understating their abilities but are detected later tend to be targeted and pushed out. There is a great fear by managers as being discovered as being incompetent. Add in sociopaths being promoted to managers just re-enforces this behaviour.
The result is I have witnessed companies squander abilities to quadruple their business in 1-2 years by poor management decisions, burying technical disasters that were easily detected & correctable at an early stage but then baloon into major disasters that cost them business. It is always the guy who predicted the disaster that gets targeted instead of the idiots that covered up the disaster in the making.
In engineering and software industries, I have seen a move to hire less educated, less experienced staff who will keep a low profile and not rock the boat. The result is in underperforming technology firms who rely more on marketing & sales than developing break-through technology and making it reliable.
The statement quoted is just a symptom of a deeper problem in today's high technology industries and even government bureaucracies.
Re:Amended quote (Score:5, Insightful)
..."However, our research shows that anyone with a passing interest in computers and especially systems administration could have done the same thing with ease"...
Why do you think the NSA is trying to get rid of all their sysadmins?
Re:Amended quote (Score:5, Insightful)
The good news is, it's ALWAYS happened, so it's not like civilization is crumbing. Journalism has pretty much always been this shitty, so we're not heading into a dark age. At least, not because of that. Also with the internet, that's something that actually can change journalism and is. So it's not getting worse, and it could get better.
I'm very optimistic, and I think I have good reason for that. For example, before the internet this story [cnn.com] would have stood on its own. Rumsfeld making a blatantly hypocritical statement, without the "journalist" bothering to note Rumsfelds hypocrisy, would have been just out there for people to read without any crosstalk. The comments on it point out that problem, and perhaps the article will get updated or corrected. Not likely, but more likely than it would have been 20 years ago.
Re:Amended quote (Score:5, Insightful)
Each journalist gets to do that exactly once, after which he will never be granted an interview with the same agency again. I'm not saying it is right ... I'm just saying. There aren't many real journalists left in the US, unfortunately.
Re:Amended quote (Score:5, Insightful)
No. You have that bass-ackwards. The whole problem is that they hired a trustworthy admin. They should have hired one who was willing to be complicit in their crimes.
Web of trust (Score:5, Insightful)
Re:Amended quote (Score:5, Insightful)
The only problem is, if you're doing things which are unconscionable, your only choice is to hire someone without a conscience. And there goes your trustability.
Re:Amended quote (Score:4, Insightful)
You start with an OS that has proper separation of duties so that there is no 'root access'. For instance, the person responsible for maintaining the software on the system should not be able to access any data other than the software he is maintaining. The person 'operating' the system (startup, shutdown, network control, etc) also does not need access to user data. The person doing security admin should not be allowed to alter his own authority, and does not need access to user data. Etc. Relying on 'trustworthy admins' is just stupid.
Re:Snowden was never a "Whistleblower" (Score:5, Insightful)
I really liked the pace of the disclosures. First he discloses a few things, the officials come out and start spinning and making up lies for the public about what is really happening, then the next disclosure comes out, exposing exactly what they just lied and said wasn't happening.
That was just....masterful.
I can understand wanting to keep secrets, but there is no excuse for telling lies to the people. Its ridiculous that I or anyone can be charged for telling lies to the FBI, but, the politicians can't be charged with telling lies to us.
Re:Amended quote (Score:5, Insightful)
From the first three paragraphs of the second TFA:
When Edward Snowden stole the crown jewels of the National Security Agency, he didn’t need to use any sophisticated devices or software or go around any computer firewall.
All he needed, said multiple intelligence community sources, was a few thumb drives and the willingness to exploit a gaping hole in an antiquated security system to rummage at will through the NSA’s servers and take 20,000 documents without leaving a trace.
“It’s 2013 and the NSA is stuck in 2003 technology,” said an intelligence official.
Doesn't look like he is portrayed as 'brilliant'. Just a bad quote taken from the article to 'made you look!'
Re:Amended quote (Score:5, Insightful)
There are, but unfortunately they are on The Daily Show and Colbert Report and they mask their journalism as satire/comedy. It's sad when the comedians make better journalists than the journalists do!
Re:Amended quote (Score:5, Insightful)
For the same reason that the Air Force is trying to get rid of all of their jet mechanics -> they're obviously in a position to promote sabotage, and should not be let anywhere near a plane, even to do their jobs, because of what they might do; instead, they need to be watched by people who have zero understanding of what it is they are attempting to accomplish, and who will question them every step of the way, until that aggravation forces them into acting out some 'aggression.'
A corollary (Score:5, Insightful)
The best way to stop whistleblowers is to stop giving people a reason to want to blow the whistle.
You're wrong about Cronkite (Score:5, Insightful)
And exactly when do you think this was different? When Walter Cronkite was alive? When Ogg told Grog what happened to Paris the other night?
Is this way, was this way, will always be this way.
I’m sorry, no. Things most definitely were NOT always like this. When Walter Cronkite told you “that’s the way it is,” you could believe that he was reporting as accurately as he could, using material gathered by some of the best investigative journalists in the business, and most importantly, with little or no thought to whether the news he was reporting would negatively affect or offend the corporate bosses at CBS. There was a reason he was called “the most trusted man in America,” because he literally was just that, continually ranked in polls for trustworthiness above presidents, clergymen, fellow pundits, you name it. You don’t get that kind of reputation unearned.
Hard to imagine today, but back then the networks genuinely competed against each other for viewers, and news departments quickly became the most prestigious part of that struggle. There was very little editorializing, and almost none that wasn’t clearly labeled as such. The networks simply didn’t try to spin things a certain way as we see now. I suspect enforcement of the Fairness Doctrine had a lot to do with that, certainly it seems like the long decline of the American media began soon after the FCC decided to do away with the FD, along with many other existing useful regulations, such as the ones preventing industry consolidation into exactly the kind of huge media conglomerates we have today. Those long forgotten regulations were perhaps a big part of why the media in those days was so much more trustworthy than what we have now, although I can‘t prove this.
The end result is that today when I access any of the big American news organizations, I no longer believe I am getting the best information possible. Everything has to be taken with a grain of salt and a dollop of serious consideration regarding the parent company’s corporate stance on a given issue. More and more I find myself having to look at overseas sources (BBC, etc) to get any real feel for how things truly stand. It’s a sad state of affairs, and one that is very hard to convey to those born and raised in post-Reagan America. The news media in those days was far from perfect, but for trustworthiness, believability, accuracy, and absence of pervasive editorial slant, it was in general far superior to anything existing today.
Re:No time for joking! U.S. government corruption. (Score:5, Insightful)
The U.S. government is extremely corrupt, in many ways. It amazes me how often U.S. citizens joke about that, or change the subject, showing that they don't care.
They care. They change the subject because they feel powerless to change the corruption. Everyone they ever voted for turned out to have a hand in the cookie jar. And now the politicians no longer have a guilty look when caught. Instead, they demand to know why we didn't refill the cookie jar.
Re:Amended quote (Score:4, Insightful)
... and you are only spewing ridiculous shit on Slashdot because you agree with the NSA's crimes. If I have a choice between a guy who rapes the constitution, and the guy who lies to expose the rapist, I'll choose the latter every time. Your mileage clearly varies.