Re: The CIA mentions us

[joel jaeggli <[e-mail]>]

On 3/10/17 6:02 PM, Stephen Farrell wrote:
> 
> Hi Ted, Bob,
> 
> On 10/03/17 22:53, Bob Hinden wrote:
>> Ted,
>>
>>> On Mar 10, 2017, at 1:46 PM, Ted Lemon <[e-mail]> wrote:
>>>
>>> The one thing I wish you'd mentioned in this blog, but did not, is
>>> a point someone made earlier on this thread: that the fact that the
>>> CIA needs to hack individual devices to bypass end-to-end
>>> encryption means that what we are doing in promoting encryption is
>>> effective and worth doing: rather than everybody's communications
>>> being vulnerable, individuals must now be targeted.
>>
>> I think that’s a good point.
>>
>> To expand what you said, these tools are for targeted attacks, not
>> mass surveillance. 
> 
> I don't think your optimistic conclusion here follows, for two
> reasons. Firstly, we've seen that the adversary here is not
> driven by economic concerns and will attack not just a weakest
> link, but all possible targets they can afford given their very
> very large budgets. That I think means that these kinds of attacker
> will attempt both pervasive and targeted attacks, and the fact
> that they attempt the latter does not mean that the don't try
> both. 

Indiscriminately targeted attacks are clearly a persistent threat.
Attack tools that can leverage automation and large economies of scale
are part of the the basic oeuvre.  If your organization is large and
diffuse, the difference between indiscriminate attacks and targeted ones
may have no practical distinction .

> Secondly, it may be that different kinds of attacker have
> different kinds of targets/goals and that some attackers here
> (such as the claimed source of these materials) are generally
> more interested in individuals and not in populations. So again,
> without further information, the interest in targeted attacks
> does not imply a technical or practical inability to mount
> pervasive monitoring attacks.

low hanging fruit being what they are, if your goal is actually to
undermine the faith that efforts security focused tooling is actually
serving a useful purpose; then you seed leaks of your attack tooling or
someone else's because they're already  and sit back while your
adversaries have to ratchet up their own efforts.

> And while I do think that the actions that many people in the
> Internet community and in the IETF have taken have probably
> made pervasive monitoring harder and/or more costly, I do not
> think that's really that relevant to this particular leak. In
> this case, I think the much more interesting thing is that
> this is yet another demonstration that attack code that is
> intended to be used for attacks (as opposed to demonstration)
> is in the end hugely counter-productive. (And immoral too IMO,
> but I'd not claim that we all need to agree with that last;-)
> 
>> Encryption continues to be a strong protection
>> against mass surveillance.
> 
> I totally agree encryption is a major tool in our armoury.
> But that's kind of orthogonal to issues arising from this
> incident I think.
> 
> Cheers,
> S.
> 
>>
>> Bob
>>
>>
>