TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

CIA hacking unit failed to protect its systems, allowing Vault 7 disclosure

215 点作者 sunils34将近 5 年前

13 条评论

LinuxBender将近 5 年前
This happens in many corporations as well. It&#x27;s fun and exciting to be on the red-team (doing the penetration testing, writing exploits, etc) but the blue team (infrastructure teams and developer teams hardening things) is not only boring to most, but it&#x27;s also the team that gets the most grief from developers for inducing friction. If your company has a red team, ask how big the blue team is and if they have the same freedom to develop and implement mitigating controls as the red team has to exploit things.<p>Hacker competitions mirror this. Red teams are allowed to bring in any exploits and do just about anything (as criminals would be expected to do) and the blue team are stifled by bureaucracy and not allowed to bring in anything.
评论 #23545060 未加载
评论 #23539919 未加载
评论 #23544716 未加载
dijit将近 5 年前
Words can&#x27;t describe how normal that is. Exploit tools are require local systems to be super open in order to be frictionless.<p>Even in the consumer industry; anyone remember all those very silly people who installed backtrack2 (precursor to kali, based on slackware not debian) to their main drive and then went to defcon and got rekt because their OS was insecure (and couldn&#x27;t be updated!)<p>Exploit development is a glass cannon, remove all friction to modify the system and craft packets, invoke monitoring modes for hardware and frictionless tracing... that&#x27;s going to have a security cost.<p>This echo&#x27;s a wider issue in the industry &quot;Development&quot; vs &quot;Sysadmin&quot; mindsets, where sysadmins are stifling and developers are all about removing barriers to progress faster and iterate more.
评论 #23541293 未加载
评论 #23543960 未加载
Veserv将近 5 年前
The article tries to make it sound like the failure is a lack of prioritization and if they just focused correctly the problem could have been avoided, but I do not see why anybody would assume they would be able to protect their systems even if they tried.<p>How well protected do you think cyber-weapons designed to surveil countries, disable infrastructure, and destabilize governments should be? How capable and well-funded should the attacker need to be before gaining access to cyber-weapons designed to kill economies and people? $1B, $10B? A team of 1,000, 10,000?<p>Does anyone know of any system or organization in existence that would even be willing to claim they can stop a team of 1000 dedicated hackers working full-time for 10 years funded with $1B let alone put it in writing? What is the highest you have heard? Is it even in the general ballpark?<p>It is absurd to assume that the failure to solve the problem is just a lack of prioritization if no one even claims to be able to solve it and it is meaningless to propose that they should adopt policies that do not even claim to be able to protect against the actual threat model let alone have evidence of such protection. They either need to find someone who will make the extraordinary claim that they can provide an actual defense and have the extraordinary evidence to back up that extraordinary claim or they MUST NOT deploy such systems since they can not be protected.
评论 #23548010 未加载
OliverJones将近 5 年前
How does somebody exfiltrate 34 TERABYTES from a secure facility without getting noticed?<p>To misquote Dr. Strangelove, &quot;ze whole point of ze secret hack is lost if you don&#x27;t keep it a secret.&quot; <a href="https:&#x2F;&#x2F;youtu.be&#x2F;2yfXgu37iyI?t=205" rel="nofollow">https:&#x2F;&#x2F;youtu.be&#x2F;2yfXgu37iyI?t=205</a><p>Oh, maybe they have a firewall built on a RaspberryPi somebody ordered online.<p>Seriously, WTF? This is as insecure as having contract sysadmins with root privilege spread all over the globe.<p>And when will these state actors with unlimited funding figure out that NOBODY can keep secrets forever, not even them?
评论 #23545189 未加载
评论 #23545128 未加载
评论 #23549844 未加载
评论 #23546813 未加载
评论 #23545790 未加载
mtgp1000将近 5 年前
I saw a screenshot of a CNN article which said that that the CIA frequently used tactics to make hacks appear as though they were from Russia. Which is something I always suspected was relatively easy to do...change some logs, some timestamps, use some existing code...I&#x27;m not a hacker per se, but most of us write code here and deal with these kinds of things...<p>So does anything in this vault possibly call certain recent allegations of Russian interference into question?
评论 #23546319 未加载
评论 #23555746 未加载
评论 #23546466 未加载
rollulus将近 5 年前
<a href="https:&#x2F;&#x2F;outline.com&#x2F;6pySsH" rel="nofollow">https:&#x2F;&#x2F;outline.com&#x2F;6pySsH</a>
tru3_power将近 5 年前
Reminds me of any “security” product. Next time you get the chance, I suggest you tear into any industry standard security tool and you’ll be surprised at what you find.
Aaronstotle将近 5 年前
I find it ironic that the CIA didn&#x27;t bother to have it&#x27;s systems secured&#x2F;verified by the NSA. I&#x27;m sure the CIA thought that they were good enough, coming from an organization that was infiltrated from its inception, their hubris isn&#x27;t surprising.
评论 #23541638 未加载
评论 #23546830 未加载
cybervasi将近 5 年前
Guarding information and guarding physical assets have one thing in common. It is largely a passive exercise in waiting for something to happen. For this reason it is very boring and unreliable. The only way to improve the situation is to have active and random drills when someone attempts to steal the assets. This would make the work of the Blue team a lot more rewarding rather than just be relegated to mindless blocking access to anything and everything.
评论 #23544926 未加载
catsdanxe将近 5 年前
&gt;34 terabytes of information, or about 2.2 billion pages.<p>That&#x27;s insane that they could leave so much data available to be stolen.
评论 #23545605 未加载
wideawake将近 5 年前
Guess it&#x27;s good to know that even big gov orgs are disfunctional
评论 #23555822 未加载
jokoon将近 5 年前
Unless you make engineers and entire companies focus on security through proper designs and standards, nothing will be secure. Most software is unsecure because geopolitically, the countries who make software are also the one who are able to penetrate those systems better than the rest of the world.<p>No government will push to improve door locks unless that government isn&#x27;t the most capable of defeating those locks. It&#x27;s a cost&#x2F;benefit function.<p>Right now, improving software security is a net loss for the US. So it won&#x27;t happen when the US is controlling the computer and software industry.<p>So I&#x27;m not surprised to see even the best experts being beaten so easily.
badrabbit将近 5 年前
A hacking unit is offensive. It&#x27;s like saying, &quot;america&#x27;s elite nuclear force failed to stop an ICBM&quot;. Blowing up things (attack) is a different ballgame than defenfing things. Think of it this way if you are a hacker devoting 40hrs a week carefully studying and planning to infiltrate a network, you will succeed. APT actors have entire groups of teams dedicated to infiltrating one target at a time. Getting in is feasible, persisting,lateral movement and exfiltration without getting caught is very difficult but even commercial tools like cobaltstrike are built to allow different teams to focus on different stages of a hack.
评论 #23545275 未加载
评论 #23545138 未加载