> After that, the momentum started to build. One team would take screenshots to gather intelligence for later; another would lock ISIS videographers out of their own accounts.
> "Reset Successful" one screen would say.
> "Folder directory deleted," said another.
Folder directory??? Did they also delete the "file document"?
> The screens they were seeing on the Ops floor on the NSA campus were the same ones someone in Syria might have been looking at in real time, until someone in Syria hit refresh. Once he did that, he would see: 404 error: Destination unreadable.
404 error: Destination unreadable??? At least, use "unreachable"...
> "Target 5 is done," someone would yell.
> Someone else would walk across the room and cross the number off the big target sheet on the wall. "We're crossing names off the list. We're crossing accounts off the list. We're crossing IPs off the list," said Neil. And every time a number went down they would yell one word: "Jackpot!"
[0] TV Tropes: Hollywood Hacking is when some sort of convoluted metaphor is used not only to describe hacking, but actually to put it into practice. Characters will come up with rubbish like, "Extinguish the firewall!" and "I'll use the Millennium Bug to launch an Overclocking Attack on the whole Internet!" https://tvtropes.org/pmwiki/pmwiki.php/Main/HollywoodHacking
Very likely something happened, but it almost certainly wasn't like this.
"On August 24, 2015, a 21-year-old British hacker named TriCk stepped out of an Internet cafe in Raqqa, Syria, and climbed into his car. He didn't know it, but he'd been under surveillance for days. He pulled into a gas station, and just as he started filling the tank, a single Hellfire missile came down on him like a meteor from the sky. He was killed instantly."
And it seems to be longer too.
https://www.npr.org/transcripts/763545811
They also later identify the "British hacker's" name: Junaid Hussain.
A report from Britain, 2015, claims it wasn't an operation done by the U.S. alone:
https://www.birminghammail.co.uk/news/midlands-news/isis-ter...
I obviously don't know how accurate this piece is but a "folder directory" is, or at least used to be, a legit way to describe a folder full of folders.
You'll see outdated/unorthodox terminology like this all the time in old systems, and even some newer ones that were built or maintained by people who aren't native English speakers. Daily WTF used to be filled with this kind of stuff.
Thanks, that's interesting.
"So, X has been infiltrating <company> for the past few days."
"Really? <company>? <famous company>?"
"Yep. We're keeping them looped in on everything, and they told us to try to get as far as possible. Apparently they were running <outdated version> of <software> on one of their boxes, and <scanner> picked it up."
"That actually happens?"
"He's <highly surprising claim> right now. You'd be surprised how far you can get, jumping from one box to another."
I can't give much more detail than that, for obvious reasons, but the reality is that it's very methodical, very "boring" work. It's basically a giant matrix of probabilities: there are hundreds of thousands of attack vectors, and your job is to tap as many as possible, sorted by probability of effectiveness, until something sticks. Then use your head to get further, adapting to the situation on the fly.
And ... writing reports. Jesus, if someone had told me that 70% of your day would be spent writing reports, I probably wouldn't have joined. But the 30% of other stuff made up for it.
That feeling you get when you break into somewhere you're not supposed to be, and that you were paid to do it, is amazing. The rules change from engagement to engagement, but usually it's "do whatever you want, but don't modify any data, i.e. no destructive actions, and all info you've collected will be deleted at the end of the engagement."
Must be interesting to be a spook in the NSA doing that kind of stuff offensively.
Also, it might seem absurd that I'm comparing this story to the most elite hackers in the developed world. And maybe it is. But if you knew which <company> it was, and exactly what <highly surprising claim> was, you'd be shocked that one or two smart developers poking at internals were able to compromise the entire corporate network of <famous company>, to the point of being able to... well. Let's just say, I wish I could say. It's a weird feeling, seeing it with my own eyes, knowing it's true, and never being able to talk fully about it. :)
So I imagine the NSA spooks are doing similarlly-methodical work, with some cheat codes like "we intercepted their computer before delivery and installed a backdoor that only activates when we send a specially malformed packet that would normally be dropped and is therefore invisible, which grants us access as needed."
as far as I understand error correcting codes can and are used at different levels of communication protocols (hardware each link, hardware at endpoints, software at end points, ...)
I often wonder if recoverable errors at the endpoints are ever used to exfiltrate data? the higher levels of the stack would see the corrected overt message, while underlying levels (hardware or software) that perform the error correction has access to the covert information encoded in the error.
This may be testable by FPGA and sorting connections by protocol, origin, destination, ... to identify connections with suspiciously high amount of ECC recoverable errors as compared to the rest.
This may be very hard to test if MitM'ed (by ISP, network card manufacturer, ...) such that benign packets get recoverable errors introduced as well (to hide the malicious ones in the noise), which would increase the complexity since now the malicious hardware or software at the endpoints needs to discriminate artificial errors from covert messages over the error channel. There would be many ways of going about this.
>And what they contained weren't glowing lines of code: Instead, Neil could see login screens.
maybe they're dealing with the kind of people who name their folders "directory"
It's all fun and games until someone melts down a reactor.
The journalist is probably playing with Cunningham's Law, but I distinctly recall the doomsday gap scene ( https://news.ycombinator.com/item?id=24481298 ) as having been closer to the middle of Dr. Strangelove. The end came after the referent of https://www.youtube.com/watch?v=K10pdj5YOy0 .
Bonus clip (note the lack of any source attribution problem in these cases): https://www.youtube.com/watch?v=nZ8oA9-OQrg
I suspect shutting down their media probably stopped having an effect through novelty wearing off, all the best recruits being recruited and the world moving on to (inadvertently or not) selling some other reactionary rebellion - and the group being militarily defeated in Syria.
(I trust Linebarger more than Bernays because the former also catalogues not only his failures, but sotto voce, even touches upon those of his mid-twentieth century society.)
Bonus clip: https://www.youtube.com/watch?v=mLNAkPsjAEk (what's the hip hop equivalent?)
why does china care so much about the dalai lama?
I'd guess because:
https://en.wikipedia.org/wiki/CIA_Tibetan_program
"a nearly two decades long anti-Chinese covert operation focused on Tibet which consisted of "political action, propaganda, paramilitary and intelligence operations""
"Although it was formally assigned to the CIA, it was nevertheless closely coordinated with several other U.S. government agencies such as the Department of State and the Department of Defense."
Dalai Lama is where he is now as the result of this.
https://theintercept.com/2018/01/29/isis-iraq-war-islamic-st...
https://www.abc.net.au/news/2019-12-18/inside-the-islamic-st...
"Doc of the Day: NSA, DHS Trade Players for Net Defense"
https://www.wired.com/2010/10/doc-of-the-day-nsa-dhs-trade-p...
The fatigues are common in the pictures:
https://www.cyberscoop.com/us-cyber-command-nsa-government-h...
Edit: Really not sure why I got downvoted, as I provided accurate info?
Yeah.. probably not how it happened.
There was 80 persons inside one of the most powerful room of the world so they just use his first name to protect his identity.
That article was painfully too long.
Think about Enigma and Lorenz, or any cold war double agent - you've got this fountain of knowledge but if you start burning assets left right and centre they'll realize something's wrong (Or in the case of MI6 they'll get embarrassed and allow the double agent to slip away as long as they shut up)
Inspired by a low-tech single-ply version: https://en.wikipedia.org/wiki/Operation_Scherhorn
and Linebarger's suggestion for how to drive enemy intelligence mad: http://www.gutenberg.org/files/48612/48612-h/48612-h.htm#Pag...
> "If you feel like showing off, average everything into everything else and call it the Gross Index of Total Enemy Morale. This won't fool anyone who knows the propaganda business, and you won't be able to do anything with or about it, but you can hang it on a month-by-month chart in the front office, where visitors can be impressed at getting in on a military secret. (Incidentally, if some smart enemy agent sees it and reports it back, enemy intelligence experts will go mad trying to figure out just how you got that figure. It's like the old joke that the average American is ten-elevenths White, 52% female, and always slightly pregnant.)"
TIL CthulhuPunk is a thing.
Anyone familiar enough with the Cthulhu-mythos to tell me if there are any impediments in canon to the following retcon: what if Great Old Ones are Scissor Entities, and appear to xenophobes as horrific monsters of vaguely anthropoid outline, with octopus-like heads and prodigious claws, but to xenophiles as animated pegasus unicorns, and, as part of their eternal struggle against the Blue Meanies, drive the former to gibbering madness but invite the latter over for tea?
https://i.pinimg.com/originals/e9/a4/fa/e9a4fae35f467f77b98b...
ISIS was actually there, founded by Zarqawi like any other group, but its main differentiator was its swift rise to power and popularity after 2011 benefiting from the unbearable oppression of Sunnis in Iraq by Iran and its proxy, which made them align with whoever could be their savior and get rid of the Iranian influence. You can see this clearly when ISIS stormed the prisons where thousands of Sunnis were sentenced to death, and made them into the second wave of recruits.
US did enable ISIS, Zarqawi and co created it, Iran gave people a reason to join it in mass, and international agenda, most importantly the US object to get its enemies (Iran and ISIS) bleed each other, and the Kurdish leftists to ask for its help to the degree to become its proxies, left a space for it to be the monster it was.
Can't also ignore the Turkish and Kurdistani indifference (before ISIS started attacking them, there were ISIS/Kurdistani checkpoints side by side drinking tea together), and the Syrian allowance of fighters flood to Iraq through its the eastern borders since the invasion.
Blaming only the US (although it's the initial culprit) doesn't address the complexity of this problem.
He got to manage a country that just got invaded, that used to have a huge military and where the occupiers are still fighting the remnants of rebel forces in some part of the country.
In that context, he decided that the former officers from Saddam Hussein's regime would be barred from the new Iraq military and that they should not receive pension either.
He, put yourself in their shoes: when your job is to organize a military, that the only lawful employer refused your services and denies your pension, are you going to go homeless and beg in the streets or are you going to join a rebellious startup?
The ISIS of the origin was organized just like the Baath army was, because that's the framework the officers knew. There were some documents captured (that involved less "hacking" than physical invasion of command structures but of course we never know the amount of covert ops going on) and what they revealed was that one budget line was the biggest of the whole organization: pensions. Suicide bombing is not the career path everybody chose there.
ISIS is not a US creation: that would imply GWB's administration capacity to plan such a thing. But it came from crucial mistakes the US did despite being warned about these years prior.
The apocalyptic aspect (literally), for instance, is essential to understand ISIS, and it's early split from Al-Qaeda, for example.
The US turned a blind eye because ISIS was fighting a regime they wanted to change. They could have pressured Turkey and Qatar to stop; and they would oblige. But everything has a cost I guess.
Stopping the help provided by outside countries may have weakened the movement, but not prevented it.
The US finances many terrorist groups ourselves, so I'm not sure what your point is—nations are happy to take advantage of new powers regardless of how it conflicts with their propaganda. I don't know how you could look at the invasion of Iraq and come away with the conclusion that ISIS is either surprising or could have formed without our help.
(for a different blue-on-blue scenario: what might the cyber equivalent of leaving a grenade pin on an officer's pillow be?)
The invasion wasn't the hamfisted part - the problem was being reckless after the invasion and not really thinking properly about how to manage the country.
Note how the USSR dissolved without intervention.
Dropping bombs is like taking antibiotics, sometimes necessary but always creates resistance.
And who supplied those weapons of mass destruction to saddam? I wonder...
I won't go so far as to say that the whole fiasco could have been avoided with a functioning economy and some new civil service/protection branch to absorb the officers, but the US's strategy was one of the biggest contributors to ISIS's growth.
[0] one example: https://www.theguardian.com/guardian-observer-style-guide-a
Headers will be sent over the wire in the clear before any redirection can occur.
A localhost-bound proxy can fix this before the request leaves network interface.
I guess the "modern" browser fixes this for everyone else not using a ("modern") proxy.
Only if the site owner wants it so https://hstspreload.org/
