Daily Archives: January 20, 2015

The United States National Security Agency knew in advance that North Korea was about to hack into Sony's systems, according to The New York Times.

The NSA apparently penetrated North Korea's network through several vectors, including Chinese networks used to connect with the rest of the world and hacker connections in Malaysia. The NSA was able to burrow in using the networks of South Korea and other allies.

Leveraging the South Korean network was referenced in this now-unclassified NSA document published by Der Spiegel.

The evidence gathered by the NSA reportedly spurred President Obama's accusation that North Korea was behind last year's cyberattacks on Sony.

The report triggered a media storm and drew a wide gamut of responses from readers.

"I wonder if perhaps the NSA did get wind of the planned attack but deliberately withheld that info from Sony because it, the NSA, feared that Sony might react by tightening its security, thereby tipping off NK that the NSA knew what it was up to," mused archer717. "I'll bet Sony's execs are asking themselves just that question as they read this article."

Several expressed support for the NSA's monitoring North Korea's systems.

For example, "I'm very glad the U.S. has the capability to monitor these rogue actors," Tim wrote, pointing out that the NSA's stated mission is collecting foreign signals intelligence to prevent strategic surprises.

On the other hand, many, like Phil Green, argued that the U.S.' own hands are not clean.

"You always figure that, when the U.S. accuses another nation of bad behavior, that the U.S. has done the very act complained of," Green suggested. "We hacked Iran's and Brazil's oil companies and invaded the privacy of everyone on Earth long before we were caught, but not before we had accused others of doing what we do best and more of than anyone else."

See more here:
Warning Sony of Coming Storm Wasn't NSA's Department

The NSA quietly commandeered a botnet targeting US Defence agencies to attack other victims including Chinese and Vietnamese dissidents, Snowden documents reveal.

The allegation is among the latest in a cache of revelations dropped by Der Spiegel that revealed more about the spy agency.

The "Boxingrumble" botnet was detected targeting the Defence Department's Nonsecure Internet Protocol Router Network prompting NSA bods to redirect the attack to a server operated by the Tailored Access Operations unit.

A DNS spoofing attack tricked the botnet into treating the spies as trusted command and control agents. The NSA then used the bot's hooks into other victims to foist its own custom malware.

Much of the bot-hijacking attacks dubbed "Quantumbot" by the NSA was conducted under its operation DEFIANT WARRIOR which utilised XKeyscore and infrastructure of Five Eyes allies including Australia, New Zealand, the UK and Canada to identify foreign bots ripe for attack.

The work granted broader network exploitation, attack and vantage points, NSA Power Point slides revealed (pdf).

It was part of what appeared to be the NSA's dream of having "a botnet upon which the sun never sets", a goal noted under the slide title "if wishes were ponies".

Bots found in the US would be referred to the FBI for cleansing, but infected victims in other countries were considered collateral.

The documents also revealed the NSA's Tutelage program (pdf), a sister to Turmoil and part of the Turbulence family of surveillance and exploitation kit, was used to block distributed denial of service (DoS) attacks by the Anonymous collective.

Tutelage was successful in identifying and blocking internet protocol addresses linked to the Low Orbit Ion Cannon DDoS software when US Defence agencies were attacked.

More:
NSA: We're in YOUR BOTNET