Legacy of Ashes does a pretty good job to that end...

https://www.amazon.com/Legacy-Ashes-History-Tim-Weiner/dp/03...

SELECT * FROM EMBASSY_EMPLOYEES WHERE CIA

ftfy

Care to guess what you've said about yourself with this critical comment? :^)

This is actually (almost) legal in teradata sql, which doesn't enforce clause order, but it doesn't accept an identifier as a predicate.

My understanding is that official cover is more a matter of politeness than secrecy. An embassy employee is obviously a foreign agent in some capacity. The real game is preventing the host country from discovering links between official-cover and non-official-cover agents, since the latter group’s affiliation is actually secret.

So, they were basically relying on metadata to inspect an organization. If anything, this shows the power of metadata.

China is much less pluralistic than Russia. It's more important to send a message to locals than it is to poison the information.

Different, certainly. What about it?

Do you mean that the people who were careless with one group would be careful with the other? That the people who issued one car model to the real cultural attachés and another model to the CIA agents would be very careful about the agents who risk their lives?

Wow. Thanks for posting this. It's a better read than anything currently on the front page of HN.

Also possible corrupt, Aldrich Ames was living way beyond his means for a decade before he got caught. And the CIA knew it. My assumption has been the CIA turns a blind eye when it's high level agents pass information to 'friendly' governments and corporations, and so were gobsmacked when they found Ames was selling critical information to the Soviets. Which is itself deranged and stupid.

There were rumored to be "explosive bolts" on the ARPA/MILNET gateways (whether they were metaphorical or not, I don't know).

Here's something interesting that Milo Medin wrote about dual homed sites like NSA and NASA, that were on both the ARPANET and MILNET:

    To: fair@ucbarpa.berkeley.edu (Erik E. Fair)
    Cc: Hackers_Guild@ucbvax.berkeley.edu, ucdavis!ccohesh@ucbvax.berkeley.edu
    Subject: Re: a question of definition
    Date: Thu, 29 Jan 87 15:33:35 PST
    From: Milo S. Medin (NASA ARC Code ED) <medin@orion.arpa>

    Right, the core has many gateways on it now, maybe 20-30.  All the LSI's will
    be stubbed off the core however, and only buttergates will be left after
    the mailbridges and EGP peers are all converted.  Actually, I think DARPA is
    paying for it all...

    Ames is *not* getting a mailbridge.  You are right of course, that we could
    use 2 gateways, not just 1 (actually, there will be a prime and backup anyways),
    and then push routing info appropriately.  But that's anything but simple.
    Firstly, the hosts have to know which gateway to send a packet to a given
    network, and thus have to pick between the 2.  That's a bad idea.
    It also means that I have to pass all EGP learned info around on the
    local cable, and if I do that, then I can't have routing info from
    the local cable pass out via EGP.  At least not without violating
    the current EGP spec.   Think about it.  It'd be really simple to
    create a loop that way.  Thus, in order to maximize the use of both
    PSN's, you really need one gateway wired to both PSN's, and just
    have it advertise a default route inside.  Or use a reasonble IGP,
    of which RIP (aka /etc/routed stuff) is not.  I'm hoping to get
    an RFC out of BBN at this IETF meeting which may go a long way in
    reducing the use of RIP as an IGP.

    BTW, NSA is an example of a site on both MILNET and ARPANET but without
    a mailbridge...

    There is no restriction that a network can only be on ARPANET or MILNET.
    That goes against the Internet model of doing things.  Our local
    NASA gatewayed nets will be advertised on both sides.  The restriction
    on BARRNet is that the constituent elements of BARRNet do not all
    have access to MILNET.  NSF has an understanding with DARPA and
    DCA that NSFnet'd sites can use ARPANET.  That does not extend to
    the MILNET.  Thus, Davis can use UCB's or Stanford's, our even NASA's
    ARPANET gateways, with the approval of the site of course, but
    not MILNET, even though NASA has MILNET coverage.  Thus we are required
    to restrict BARRNet routing through our MILNET PSN.  If we were willing
    to sponsor UCB's MILNET access, for some requirement which NASA
    had to implement, then we would turn that on.  But BARRNet itself will
    but cutoff to MILNET (and probably ARPANET too) at Ames, but not
    cut off to other NASA centers or sites that NASA connects.  There is
    no technical reason that prevents this, in fact, we have to take
    special measures to prevent it.  But those are the rules.  Anyways,
    mailbridge performance should improve after the conversion, so
    UCB should be in better shape.  And you'll certainly be able to
    talk to us via BARRNnet...  I have noticed recently that MILNET<->
    ARPANET performance has been particularly poor...  Sigh.

    The DCA folks feel that in case of an emergency they may be
    forced to use an unsecure network to pass certain info around.  The
    DDN brochure mentions SIOP related data for example.  Who knows,
    if the balloon goes up, the launch order might pass through Evans
    Hall on its way out to SAC...  :-)


                        Milo

I dug up an "explosive bolts" reference -- fortunately that brilliant plan didn't get far.

(Milo Medin knows this stuff first hand: https://innovation.defense.gov/Media/Biographies/Bio-Display... )

    To: fair@ucbarpa.berkeley.edu (Erik E. Fair)
    Cc: ucdavis!ccohesh@ucbvax.berkeley.edu, Hackers_Guild@ucbvax.berkeley.edu
    Subject: Re: a question of definition
    Date: Thu, 29 Jan 87 12:29:36 PST
    From: Milo S. Medin (NASA ARC Code ED) <medin@orion.arpa>

    Actually its:

    SCINET -- Secret Compartmented Information Net  (if you don't know what
    compartmented means, you don't need to ask)
    DODIIS -- DoD Intelligence Information Net

    The other stuff I think is right, at least without me looking things
    up.  I probably shouldn't have brought this subject of the secure part
    of the DDN up.  People like being low key about such things...

    Erik, all the BBN gateways on MILNET and ARPANET currently comprise
    the core, not just mailbridges.  Some are used as site gateways, others
    as EGP neighbors, etc...  And just because you are dual homed doesn't mean
    you get a mailbridge.  And the IETF doesn't deal with low level stuff
    like that; DCA does all that.  In fact, the reason we are getting an
    ARPANET PSN is because when DCA came out to do a site survey, they
    liked our site so much they asked if they could put one here!  It's
    amazing how many sites have tried to get ARPANET PSN's the right
    way and have had to wait much longer than us...  BTW, since we are
    dual homed (probably a gateway with 2 1822 interfaces in it), we
    are taking steps to be sure that people on ARPANET or MILNET can't
    use our gateway to bypass the mailbridges.  The code will be hacked
    to drop all packets that aren't going to a locally reachable network.
    BARRNet, even though its locally reachable, will be excluded
    from this however, since the current procedural limitations call for
    not allowing any BARRNet traffic to flow out of BARRNet to MILNET
    and the reverse.  NASA traffic of course can traffic through BARRNet,
    and even use ARPANET that way (though that's not a big deal when
    we get our own ARPANET PSN).  That's because only NASA is authorized
    to directly connect to MILNET, not UCB or Stanford, etc...

    DCA must have the ability to partition the ARPANET and MILNET in
    case of an "emergency", and having non-DCA controlled paths between
    the nets prevents that.  There was talk some time ago about putting
    explosive bolts in the mailbridges that would be triggered by
    destruct packets...  That idea didn't get far though...

    The DDN only includes MILNET,ARPANET,SCINET,etc...  Not the attached
    networks.  If it did, you'd need to file a TSR to add a PC to your
    local cable.  A TSR is a monstrous piece of paperwork that needs to
    be done anytime anything is changed on the DDN...  Rick knows all
    about them don't you Rick?

    The whole network game is filled with acronyms!  I gave up trying
    to write documents with full explainations in terms long ago...
    I have yet to see a short and concise (and correct) way of describing
    DDN X.25 Standard Service for example...  That's probably one of the
    harder things about getting into networking these days.  We won't
    even talk about Etherbunnies and Martians and other Millspeak...

                        Milo '1822' Medin

I found this handy how-to tutorial guide for "Talking to the Milnet NOC" and resetting the LH/DH, which was useful for guiding the NSA employee on the other end of the phone through fixing their end of the problem. What it doesn't mention is that the key box with the chase key was extremely easy to pick with a paperclip.

Who would answer the Milnet NOC's 24-hour phone was hit or miss: Some were more helpful and knowledgeable than others, others were quite uptight.

Once I told the guy who answered, "Hi, this is the University of Maryland. Our connection to the NSA IMP seems to be down." He barked back: "You can't say that on the telephone! Are you calling on a blue phone?" (I can't remember the exact color, except that it wasn't red: that I would have remembered). I said, "You can't say NSA??! This is a green phone, but there's a black phone in the other room that I could call you back on, but then I couldn't see the hardware." And he said "No, I mean a voice secure line!" I replied, "You do know that this is a university, don't you? We only have black and green phones."

    Date: Thu, 11 Sep 86 13:53:45 EDT
    From: Steve D. Miller <steve@brillig.umd.edu>
    To: staff@mimsy.umd.edu
    Subject: Talking to the Milnet NOC

       This message is intended to be a brief tutorial/compendium of
    information you probably want to know if you need to see about
    getting the LH/DH thingy (and us) talking to the world.

       First, you need the following numbers:
        (1)  Our IMP number (57),
        (2)  Mimsy's milnet host address (26.2.0.57),
        (3)  The circuit number for our link to the NSA
            (DSEP07500-057)
        (4)  The NOC number itself (692-5726).

       Second, you need to know something about the hardware.  There
    are three pieces of hardware that make up our side of the link:
    the LH/DH itself, the ECU, and the modem.  The LH/DH and the
    ECU are the things in the vax lab by brillig; the ECU is the
    thing on top (with the switches), and the LH/DH is the thing
    on the bottom.  The normal state is to have the four red LEDs
    on the ECU on and the Host Master Ready, HRY, Imp Master Ready,
    and IRY lights on at the LH/DH.  If these lights are not on,
    something is wrong.  If mimsy is down, then we'll only have some
    of the lights on, but that should fix itself when mimsy comes up.
    Some interesting buttons or switches on the ECU are:
        reset - resets something or another
        stop - stops something or another
        start - restarts something or another
        local loopback -- two switches and two leds; you may need
            to throw one or the other of these if the NOC asks
            you to.  These loopback switches should be distinguished
            from those on the modem itself.
        remote loopback -- like local loopback, but does something else.

       The modem is in the phone room beside the terminal room (rm.
    4322, if memory serves).  It can be opened with the chase key from
    the key box...but if someone official and outside of staff asks
    you that, you probably shouldn't admit to it.  It has a switch on
    it, too; it seems that switch normally rests in the middle, and
    there's a "LL" setting to the left which I assume puts the modem in
    local loopback mode.

       Now that you have some idea of where things are, call the NOC.
    Identify yourself as from the University of Maryland, and say that
    we're not talking to the outside world.  They will probably ask for
    our Milnet address or the number of the IMP we're connected to,
    and will then poke about and see what's happening.  They will ask
    you to do various things; ask if you're not sure what they mean,
    but the background info above should help in puzzling it out.

       Hopefully, this will make it easier to find people to fix
    our net problems in the future; it's still hard to do 'cause
    we have so little info (no hardware manual, for example),
    but this should give us a fighting chance.

        -Steve

In the book “The Cuckoos Egg”, the author describes how the hacker penetrating his networks was using it to access military networks. That was in the 80’s as well I believe.

Totally true. That Fogle guy was standing out like a white crow among the rest of the "geriatric ward" that US embassy in Russia was.

Moreover, to a Russia person, it would be totally unbelievable that such pipsqueak could get to the position of a "third secretary" of anything in his short, only 5 years long career.

Software projects that can keep the implementation details (and bugs) of their security secret, can make themselves seem much more secure than other, similarly large projects.

There's a book already, https://isbn.nu/0374536279. It's dreadful. Well, the book is good, even great. What's dreadful is the mistakes one can commit when the consequences are secret.

The CIA would send a 35-year-old spy out with a cover job that only accepted applicants up to the age of 28, and then send a polite letter to the Russians informing them of his arrival. Meanwhile there was a giant search for the mole at CIA HQ, because there had to be one, how else would the Russians unmask so many agents so quickly?

Right, it should just have either NAND or NOR. Much simpler.

Sadly, not even supported anymore.

Totally agree. While they do get a few wins, I wonder what's the ROI when you take all the failures and waste of resources into account.

Very far into positive territory, I'd imagine. Most day-to-day intelligence work probably doesn't have much effect, but every once in awhile they probably get a big win that's so massive that it justifies all the effort.

Maybe (much) spy work isn't quite the serious business the national security apparatus would have us believe?

Well,... the saying is "Allen Dulles was much of a clown first, politician second, and serviceman the third."

Regarding US foreign intel service: when something the size and budget of CIA does recon, something useful will come out of it regardless of how lame is their tradecraft.

I have an working theory that as an organization the CIA thinks it can 'win' via various cunning skulduggery. But the world doesn't really work that way.

Like this, France in 1700 wasn't powerful because it's king and ministers were geniuses, it's military competent. It was powerful because it's agriculture could support 20 million peasants.

I look at it more if you're smart enough to do either, which one pays way more, has better perks, doesn't require full lifestyle polygraph with a 10 year background investigation, or drug testing?

I valued your comment so wanted your input on an orthogonal question

I agree that each position may require different attitudes but I think it’s interesting to think how this situation might have been avoided if more people who were digitally Inclinded (fang applicants ) equally were applying to these positions

Very similar stories happen with Russians too, like 300 spies outed recently because of cars registered to gru headquarters.

Like in warmaking, success goes to whoever fails to make a dramatic mistake at a crucial moment.

That sounds like my entire command in Iraq.

There wasn't too much technology that allowed you to blow off your entire CIA agency leg that long ago. Someone's inevitably going to screw up if you put this much valuable intel into a single system where the users and even the operators don't fully understand it. Technology can definitely amplify the damage from incompetence.

phpbb ?

Yeah, that's the original article and has a lot more detail.

Mods, please change link to this source.

originally intended to only be a temporary communications channel

Some code never dies

Google Hacking (or Dorking): https://en.m.wikipedia.org/wiki/Google_hacking

The article actually cites 30 killed ... in China.

So in this case, no.

I assume Iran would be careful if they saw a variety of loyal and crucial players implicated.

It seems like these issues are rarely solely due to unilateral technical incompetence; there's often at least one person who sees the true risk, tries to communicate the risk, and gets completely ignored. The Challenger disaster had several Thiokol engineers express major concerns in vain; this disaster had John Reidy (supposedly):

A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up.

“It was a recipe for disaster,” Reidy said. “We had a catastrophic failure on our hands that would ensnare a great many of our sources.”

The person who could actually save the day and prevent the catastrophe gets ignored, marginalized, and/or fired. The people who were involved in the original disastrous decision keep moving up in the organization and usually keep their jobs after the catastrophe. So it's not like these organizations are lacking smart people: their institutional and bureaucratic incompetence just prevents those people from doing their job properly.

https://news.ycombinator.com/item?id=18370900

That would be a really brilliant move. I doubt, however, that's the move that was made here.

"Ali, this is James. See you at [Iranian landmark,] but 50 meters to the left of the place we met last time."

That would still be a pretty dumb move in itself - nobody would want to work with anyone who claims to have CIA connections not even for vast amounts of bribery.

I know that countries with less than stellar records of civil rights don't care too much about due process but the not a violent complete moron thing to do would be to ask questions before shooting - namely being sure that they actually are spies or traitors and investigate the claims. For one it could point out peripheral connections down the chain and you know make sure that you aren't getting 'spies lists' of anyone who is close to finding the actual spy.

Granted in that sector it seems that there isn't a scarcity of violent immoral morons even in the west given a love for torture among the CIA. Given the known effects pushing torture is really saying a few things: They want to be able to fool themselves by hearing exactly what they want to hear. They want their foes to fight to the death like a cornered rattlesnake - putting their last breaths in killing as many as possible in the face of insurmountable odds. Finally they want no mercy shown to them if captured.

There are no words for that except evil and stupid - their deaths will not be mourned no matter how horrific because they deserve it and the world will be better off with their passing. I guess that means that the CIA really may be that stupid which isn't a surprise given their real goal with Castro appears to have been to make him as assassination resistant as possible.

This makes sense.

Poor contingent hires couldn't even get basic auth, eh

So why did it last so long? What did it offer that the more official channels did not? What kept the agency from developing technology that might have allowed better protected communication channels that might have also been easy to use?

It hadn't been broken, so why bother? Sure one of our employees is telling us that it's dangerously insecure, but if its so bad why hasn't it been compromised?

Wow, that Red Green show is hilarious. Plan to waste the rest of the morning on it.

Broken code gets fixed, bad code lasts forever

For the same reason POCs or unfinished software runs in production.

A Greek saying goes: Ουδέν μονιμότερον του προσωρινού. (There is nothing more permanent than the temporary)

I keep thinking about it when building out information system architectures, especially ones that interface with end users. Bad design is metastatic and unbelievably hard to get out of. Whatever the cost of reversing a bad design decision you have in mind, 10x it and you still might not be truly there.

They made websites for fake companies offering job and visa opportunities. People would reply and end up recruited. I'm not sure how exactly they used it for further communication though.

One of my favorite pastime activities: googling for certain unsecured automation systems and messing around with them. They can be found with zero false positive rate thanks to an obvious misspelling on the login page. There's no need to resort to inurl, intitle and similar modifiers that trigger the captcha almost every time.

And this is eight years after the largest HIPAA violation ever (at the time) at NY Presbyterian suffered because a physician programmer was allowed to take down a firewall and Google started indexing patient records. https://www.businessinsider.com/new-york-presbyterian-columb...

Web scraping is a two-edged sword

No, doing this is:

But the rest of the agency had become too reliant on the system, which was originally intended to only be a temporary communications channel, and had left the relatively insecure site up far longer than intended and used it to send information that should have been reserved for more secure channels.

So, security is intrinsically difficult for an organization to get right, because the learning landscape is not continuous. You don't have gradually increasing costs from going in a particular direction; you have apparently zero costs, maybe even rewards, from going in that direction until suddenly OMFG WE HAVE A PROBLEM! This is hard for any machine learning algorithm to deal with, and it is hard for individuals to deal with, and so no surprise that it is hard for organizations to deal with. Lax security, in most cases, yields zero apparent costs until suddenly it is very expensive.

All of which is outweighed by the fact that dealing with this kind of thing is the CIA's reason for existence as a separate intelligence agency, outside of the military (since Pearl Harbor). I am not at all convinced that we would be doing worse to fold intelligence back into the military as it was pre-WWII, because having a culture that understands this kind of problem is the CIA's whole purpose for being separate, and it doesn't seem to have worked.

Yes.

I've always thought that the CIA was completely incompetent, but I've never seen more conclusive evidence than this. I've never worked with anyone so flippant about security, but no one should ever expose secrets without proper auth. I won't even expose user address without cert or password auth. It just goes to show you that the old adage is true: if you are a completent programmer you don't end up in government.

This incident is now used to as part of a collective PR case for military action in Iran. Earlier articles [0] on this CIA failure points to China breaking the network. Which is odd now that it’s used to make the case against Iran.

[0] https://foreignpolicy.com/2018/08/15/botched-cia-communicati...

As an example. Having the internet searchable is useful, us convienent. But it reduces security because of its convienence.

This breach would not have happened without that convienence.

UX could have made it easier to remember to robots file. So could process, or review or other security practices. But no UX is gonna solve fact that internet is insecure due to its convienence.

The internet can never be secure. At best you can get lower levels of insecurity.

Is this the same breach? People are talking like this is separate from the one you linked to.

there are couple things come to mind in that context - that story of Iran MITM-ing HTTPS using a small CA they either hacked and/or acquired and Siemens spying software/hardware at Iran's telcos.

These deaths took place 5+ years ago, sharing information about a mutual border/former border seems more likely.

Weren't these just CIA informants i.e. not actual CIA officers? I think the word "spies" is a bit misleading.

A defense contractor for the CIA named John Reidy claims he warned the agency that it was using insecure communications systems in 2008, and again in 2010 when he started to suspect the channels had been cracked. A year later he was fired by the agency, a move he claims was retaliation for not shutting up.

strongbox.gov is needed to protect people with brains from being strong-armed by management without brains:

https://medium.com/@cyphunk/the-nature-of-conflict-is-changi...

The second you go after anyone using the communication channel it's fairly likely the entire channel will shut down or change so you're much better off moving quickly on everyone you identify than leaving them out where they might disappear. This is especially true since the information China used was provided by Iran - so was very likely to leak sooner or later. Once you've rounded up all the spies it's up to the government what to do, but either they can trade them, imprison them or kill them and I guess this time they decided it was best to just send a message.