[Cryptography] Equation Group Multiple Malware Program, NSA Implicated

Jerry Leichter leichter at lrw.com
Tue Feb 17 17:21:54 EST 2015


On Feb 17, 2015, at 11:46 AM, ianG <iang at iang.org> wrote:
> Snowden saying "encryption works."
Snowden may be wrong.  He may have been deliberately lead astray.  He may be a plant.

It's not that I think any of these is true, but presumably Snowden believes *the encryption he was given to use while at NSA* works.  But that's not the encryption any of us use, so it doesn't help.  His statement that encryption, *in general*, works is odd because some of the stuff he released implies that there may be breaks.  It's all ambiguous - you could interpret the same material to say that the encryption itself is fine but the eavesdroppers have all kinds of way to get hold of keys.  But in the end ... does it really matter?  If we knew that AES absolutely, positively could not be broken by NSA - but we had *no idea* what key distribution or generation methods had been broken - we would be absolutely nowhere.

> EquationGroup use of RC4-6, AES, SHAs.
But they also use simple XOR (see the slide set).  This is a situation where unbreakability isn't necessary.  They're more interested in hiding what they are doing - once someone *notices* an exfiltration or command stream, it doesn't matter all that much whether they can read exactly what it says; the game is up.  Even fairly weak encryption would be adequate to prevent simple recognition of such streams based on content.

> FBI complaining about going dark, we need backdoors - they only ever complain at that level as proxy for NSA, and same complaint is repeated in rapid succession in UK, DE.
The FBI complains all the time.  The NSA isn't about to share their advanced techniques with the FBI; they don't want them exposed, which, "parallel construction" or not, will inevitably leak out if used in support of criminal cases.

> Practically all the exploits so far disclosed are about hacking the software, hardware, nothing we've seen comes even close to hacking the ciphers.  Some of the interventions are about hacking the RNGs - which typically take the cryptanalysis to places where we can hack it.  Off-the-record comments I've heard. Analysis of released systems such as Skipjack.
> 
> It's all circumstantial.
And I still don't have an strong belief that the NSA can break AES or any other particular magic thing.  But my belief that they *can't* is much weaker today than it was the day before yesterday.

>> (To the point where they've apparently even neglected defense of their own internal systems:  What Snowden did was certainly something they *thought* they had a defense against.)
> No, I think that is unfair.
Unfair to whom?  Besides, they've as much as admitted (by the actions they've taken since) that they've come to see their pre-Snowden precautions as insufficient.

> What's the guess -- how many cyber warriors are there in employment in USA today?  100,000?
Depends on what you count, I suppose.  The military services have large numbers of people doing "cyber warfare", most of whom are doing defense.  Their jobs are not all that different from those of security managers (not developers) at commercial organizations - though since this is the military, the procedures are much more standardized, as are the systems being managed, and there are many more people there on a day by day basis.

If you mean people doing security development - defense or attack; or even those training to do attack with tools the bigwigs develop for them ... it's anyone's guess.  My gut says closer to 10,000 than 100,000, and that would be including a large number of people with basic training on how to attack low-level, ill-defended targets.

Remember how the Navy Seals who took out OBL grabbed all the computers and USB sticks and such?  They clearly had training on what to look for and how to seize it in a way that didn't destroy the data.  And there are undoubtedly rooms full of people who work on extracting data from such seized devices.  They are part of the "cyber warfare" community, by any reasonable definition of the term.
                                                        -- Jerry



More information about the cryptography mailing list