Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
NSA Looking to Exploit Internet of Things, Including Biomedical Devices (theintercept.com)
122 points by uptown on June 10, 2016 | hide | past | favorite | 39 comments


It is ridiculously amazing they can go to such an extent to literally say that it is their job to "penetrate other people's networks", and it feels so "good". (Actual quotes of the spokesperson)

Some parts from the text reads like a prank article from The Onion. They openly say that they are invading (sorry, "penetrating") the privacy of everyone in the world, and still manage to get away with it. How? Misuse and abuse of the concept of "terror".

It is high time for American public to realize that this "terror" rhetoric is just an abusive device to legitimatize the violation of very fundamental human rights. The NSA can just do whatever they want, because it is "terrors that made them do it", right?

Violating the privacy rights of potentially everyone in the world? No problem, just drop "terrors", "terrorists" here and there, then everyone will shut up and not care.

We do not need to be political scientists or experts in discourse analysis to spot the difference: just subtract the b.s. about "terror" and see the actual picture.


The charter of the NSA is international signals intelligence. It is exactly their job to penetrate/eavesdrop on other people's networks.

Every other first world country has a similar agency/bureau. Perhaps not as capable.


Obviously the point is not about questioning whether it is the job of a spy agency to spy on other people.

Following the same reasoning, it would similarly be exactly military's job to kill people, with every other world country having a similar military with various capabilities... This is just semantics.

It is about questioning the very legitimacy of the exact jobs of those institutions, along with their very existence. What makes their activities so normal that we even respond, "it is their job, everybody knows that", based on definitions?

So my answer to this question of legitimacy was that, "they just legitimize it themselves, with their rhetoric on 'terrors'".


> So my answer to this question of legitimacy was that, "they just legitimize it themselves, with their rhetoric on 'terrors'".

That answer would work if NSA was created after 9/11 or as part of the PATRIOT act or whatever. What was the NSA doing before? And don't you think NSA would still be doing that? My point is that NSA doesn't need terrorism to legitimize their operations. The reasons NSA came in to existence in the first place is still relevant and enough to legitimize itself.


Obviously they're doing similar stuff, the scope got considerably wider, the purse got deeper, and memory/cpu has scaled to make it all feasible. They're penetrating BC they can, but it also helps things scale if everyone has a default reason to agree that they should.


> questioning the very legitimacy of the exact jobs

This argument has been dispatched so thoroughly, for so many centuries that what you really did there was establish that you haven't been doing your reading. But rather than just refer you to Plato, let me address your exact situation, and we'll do it with a nice particular-general-particular teaching strategy.

The US military could lay down its arms. Likely we would need all of the peoples of the earth to lay down their arms. I assure you, no one wants peace more than a professional soldier. Lets assume it happens. But there will still be people able to rally the masses with nationalistic messages. Even if we burned every book on the making of guns, arrows, missiles, guidance systems, deleted all the information from the collective conciousness, we would still have these bad actors. And their followers would be incentivized to develop means of carrying out their nationalistic ambitions. And then there will be war. Even if it's with stones, they will make spears, arrows, crossbows, grenades, muskets, rifles, rockets, guided missiles and drones.

This generally comes down to simple engineering at a world scale: a prestressed sysem is more predictable than an unstressed system and often requires fewer resources to maintain. The threat of violence is more persuasive than violence itself.

So, onto the closing particular: the NSA. Someone will collect signals intelligence. Are you seriously asserting your government alone should abstain? Do you assert that the Germans, French, Chinese, or Pakistanis, Indians, Russians, Brazilians, or Laotians aren't clever enough to do sigint or don't have the incentives to engage in it, given the insane gradients of wealth and power across national borders?

So, yes, regulation is key. And the social outcry sends a strong signal itself. The regulations are merely an attempt to condense the social consensus to paper. The people who work at the NSA read the headlines. They read blogs. They read a lot. right? They're in sigint. They read a lot. I'm fairly certain there's are many very active debates within the NSA, at every level, about just exactly what is it that they should be doing.

Does that mean society should give them a pass? No, of course not. Holler loud. But next time, before you holler, maybe read up on Plato or Epicurus or Kant or Bertrand Russell, or somebody. And holler something new.


I must have to admit that I have been disturbed by your patronizing attitude about claiming to "teach" something regarding Plato, Kant, etc. You did not connect your "arguments" with the ideas of those philosophers either. This kind of attitude is not very productive, and not welcome in a community like HN.

Bringing up names of some classical, old-fashioned philosophers as if they represent some kind of absolute "truth" never works to support an argument (see: appeal to authority). Plus, we are talking about Plato who confused actual reality with abstractions, and Kant whose ideas had have led to "instrumentation" of reason; both of whose outmoded ideas have been criticized thoroughly in recent social thought.

I would similarly suggest that you "haven't been doing your reading" on Foucault, Baudrillard, Adorno, Horkheimer, Deleuze, etc., but I am not going to do that. Still I hope that you would emphatize with my situation imagining the case that I did.

Textbooks aside, let's look at the real situation at hand with some clear, simple, direct language.

> The US military could lay down its arms.

They don't.

> I assure you, no one wants peace more than a professional soldier.

I, for one, don't believe that they do. And nobody can quite assure anyone whether they do want it or not.

> Someone will collect signals intelligence.

Why is this even necessary?

> The people who work at the NSA read the headlines.

If they really do, this makes the situation even worse because they are either too uninformed (or even stupid) to understand the ethical implications of their work, or reading the wrong headlines.

> I'm fairly certain there's are many very active debates within the NSA

But about what? To find out, just refer to Snowden documents to see what exactly they have been having debates about. By the way, how could you be so "certain" of everything?

One might or might not further counteract to my points, or comment that I am overreacting. But it doesn't really matter. The more we talk, the more get away from the actual reality of what is happening.

What is happening is, SURVEILLANCE.

Those who defend power of surveillance fear nothing more than "privacy", which they call "conspiracy".

I wish we could spend more time participating in meaningful action instead of getting lost in rhetorics.


I wish there were a clear separation between passive surveillance and active.

I'd be happier if the NSA merely analyzed signals coming from foreign nations, rather than trying to penetrate the networks of said nations - even if it's North Korea.

If I were someone working for the NSA, I would not feel like a "good guy". Maybe I'm just a naive young person who hasn't lived through the brutality of a world war to know why this penetration is necessary.

I equate this to invading a foreign country. I don't feel good -- as a citizen -- waking up in this country knowing this goes on.


>Every other first world country has a similar agency/bureau.

It is funny how Hungary is setting up a similar agency (TIBEK) currently and uses this exact same argument to get privileges other governments already enjoy.

edit: T refers to (counter)Terrorism


I am willing to bet a lot of money that we will see the first software-based assassination in the next 5-10 years. Someone will have their pacemaker disabled or their car commandeered and driven off of a bridge remotely.


I'd be extremely surprised if it hasn't happened already, honestly.



Assuming it was foul play, it wouldn't qualify as you couldn't accomplish it via purely software hacking.

What brobinson is suggesting is that a hypothetical hacker, thousands of miles away in front of a console, could accomplish a murder with no other physical agents involved. i.e. no drones, hitmen, etc. just remotely commandeering existing systems already in everyday use.


Is there any difference between a pacemaker being disabled and your car driving into a brick wall? Genuinely curious how these things are different.


If it were e.g. a Tesla, no there would be no difference. But a Mercedes C250 Coupé? How would you hack that remotely? How would you program it to accelerate uncontrollably? Does it even have computer controlled acceleration? I would have to assume that physical tampering of some sort was involved, possibly even the introduction of a physical device such as one that remotely physically activates the throttle.


Today you're one of the lucky 10,000! https://blog.kaspersky.com/blackhat-jeep-cherokee-hack-expla...

short version: you hop onto an outward-facing wireless channel (in this case either wifi or cell), and then find the weak point where the industrial control system (ICS) and user network are very close to one another. Once you're on the ICS, systems are often low on verification/authentication, so there's a decent chance that you can do things like accelerating into a brick wall.


I was already aware of that hack, which was made possible because of two conditions:

* Outward-facing wireless channel

* Computer controlled acceleration accessible in some way from the same network the outward-facing wireless channel is on

If the Mercedes C250 Coupé meets those criteria then there is the possibility that (if it is indeed foul play) the assassination occurred via software hacking.


Ahh, my misunderstanding then. I don't know about the C250 in particular, but my inclination is to suspect that it is susceptible to the same type of attack. I believe this because outward-facing wireless has applications that would be appealing features in a luxury car, and because it seems to me that luxury car makers are the ones most likely to abstract away aspects of controlling the car so that they can offer more finely-tuned driving performance. It's possible that Mercedes implemented security, but from my experience it's unlikely that they would have done so, when it's expensive and directly at odds with implementing features.


His family thinks it was an accident. According to his brother, he was extremely stressed and had been smoking a (natural) psychedelic drug. That particular drug is such a powerful experience, that combined with the unusual circumstances of his life and the likely threats, intimidation or paranoia could cause someone to drive erratically.


Source? The Guardian reports:

"Coroner's investigators said the drugs likely did not contribute to the June crash, which they classified as an accident. "

"Hastings had been using the hallucinogenic DMT recently, though the drug was not detected in a blood test after the crash." [1]

[1] https://www.theguardian.com/world/2013/aug/21/michael-hastin...


DMT? That only lasts 15-ish minutes. It's also notorious for being so intense that most people have a hard time moving; complex tasks like driving just aren't going to happen.

This sounds like a story made up by someone who doesn't know how DMT works.


Typical plausible deniability story.

Somewhere in my archive is a declassified doc from I believe the CIA about putting a dead man in a car and then (RC) crashing it. Just tried to find it... maybe someone else has the link. Either way, it's painfully obvious that was a hit. He emailed close confidants right before about needing to go off the radar because of a dangerous story.


  he was extremely stressed
  had been smoking a psychedelic drug
  that combined with the unusual 
  circumstances of his life 
  could cause someone to drive erratically
And this is what we call willful ignorance, in an effort to avoid further pain.

Those words sound hollow, and presumptive. This is the sort of closure a person will errect around circumstances that can only be made worse by thinking about or acting in favor of a deeper investigation.

If it feels like social calculus at work, it probably is.


Nobody suspects the fridge.


There is a juvenile murder mystery story involving someone hacking the climate controls in a house to alternately make a room hot and cold, inducing a heart attack in a sleeping elderly resident while making it look like natural causes.


Welcome to the world of Watch_Dogs!


2030: NSA: we need access to your brain chip and pacemaker. Don't worry, it's for the children. If you do worry, we will fix that.


Anyone remember this, from last year?

https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-34...

For some reason, I feel like the NSA is going to succeed.


So now the cardiothoracic surgeons don't just have to worry about device reps, they have to wonder if the device rep is an NSA vector. They're scrubbed in for the procedures, for pete's sake. How do defend against this!?

Trust. It's turtles all the way down.


Well, I'm shocked. Shocked, I tell you. No one could ever believe that the SIGINT org of the United States government would stoop to hacking biomedical devices for their aims.


If we just make all of the devices closed source and proprietary with drm it wont be an issue because of hackers, and what have you got to worry about if youve done nothing wrong?

/s


I recognize both your tone and your sarcasm tag, but having more closed source and proprietary technology actually would reduce the risk of government snooping, at least once there's enough of it. Paying smart, educated people to do this stuff is only feasible because it scales, and it only scales because there's so much standardization. It's the same concept as "Macs don't get viruses" (at least back in the early 2000s when their market share was much smaller.)


I couldn't find any reports saying that NSA employees aren't allowed cellphones. Does anyone have a link for more information on that?


When I worked there (2012-2014), we were certainly allowed cellphones, and friends that are still in the IC all still have such devices, so I don't think that's changed. We just (obviously) couldn't bring any electronic devices into the SCIF without specific approval.

Anything with an antenna would pretty much never be approved, but if you wanted to bring, say, a Discman or somesuch, you could check it in, it would be torn apart and checked for anything foreign in the device, and then would be tagged for use in the SCIF. Typically, if something goes in, it's never allowed to leave the building except shredded, mulched, and burned.


They are not allowed at GCHQ. I once visited CESG , and was told to leave laptop and phone in the car or at the desk. I spoke to one of the guys working there about 'how did he find it without having a mobile', and he replied that it was actually quite nice as they did not get disturbed too much. They do have pagers that allow them to be reached, to then find a desk phone and call back.


Ah, sorry, that's what I meant to imply. NSA has the same policy. I took the poster's meaning to be no phones at all. I always left any electronic devices at home.


Confirming what the other poster said with definitely-current info, NSA employees and other IC are certainly allowed cell phones, but they don't go very far into the buildings, if at all.


This is the plot of Homeland


Homeland is a good read IMO. So is Little Brother.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: