Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/13/2013
12:42 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

How Did Snowden Do It?

Experts piece together clues to paint possible scenarios for how the NSA contractor accessed, downloaded, and leaked secret agency documents on its spying operations

Venafi, meanwhile, outlined in its report what we know about Snowden's work responsibilities and role: As a contractor, he would have a CAC card with its own crypto keys and digital certificates that authenticated him and provided him access to information he was allowed to reach. And as a systems admin, he would use SSH keys to authenticate to and manage systems he oversaw.

"Prior to working for the NSA, Snowden is known to have tested the limits of his administrator privileges to gain unauthorized access to classified information while at his CIA post in Geneva, Switzerland," Venafi said in its report. And Snowden was known to have thin-client, not full client, access to NSA's network.

Snowden likely used his own access to see what was out there and got into areas he wasn't authorized via other admin SSH keys, Venafi believes. "Using usernames and passwords from colleagues could afford him more opportunities to take keys or insert his own as trusted. Having 'root' or equivalent administrative status gave Snowden total access to all data," the report says. He downloaded the files via encrypted sessions that were authenticated with self-signed certificates, Venafi surmises.

"We know he had privileges because he was able to hide his tracks and edit the activity logs," Hudson says.

[The NSA leaks by a systems administrator have forced enterprises to rethink their risks of an insider leak and their privileged users' access. See 5 Steps To Stop A Snowden Scenario.]

"As a leading organization responsible for contributing to U.S. national and global cyberdefense, the NSA has a responsibility to disclose the truth behind the breach," Hudson says.

But it's unlikely the NSA will ever pony up publicly with the details on how Snowden was able to execute the embarrassing and massive insider attack.

"I don't think we'll ever get the truth out of the NSA, or an accurate portrayal from Snowden, either," DLP Experts' Thorkelson says. "I have to believe he has publishers just pounding on his door ... He's going to [eventually] have a financial motive."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

 

Recommended Reading:

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Don Gray
50%
50%
Don Gray,
User Rank: Apprentice
11/13/2013 | 9:09:52 PM
re: How Did Snowden Do It?
And that boys and girls is why we advocate 24x7 log / alert monitoring using contextual enrichment!

The NSA obviously didn't:

- Perform monitoring on anything approaching a real-time basis
- Didn't have the ability to tie user context into the security policies and controls
- Didn't have Intranet "normal usage" thresholds in place

Detecting technically authorized yet out-of-defined-role access is nearly impossible without these capabilities available and the people and process to execute.
rjones2818
50%
50%
rjones2818,
User Rank: Strategist
11/14/2013 | 7:55:48 PM
re: How Did Snowden Do It?
Hire the man! :)
CharlieW848
50%
50%
CharlieW848,
User Rank: Apprentice
11/14/2013 | 7:55:53 PM
re: How Did Snowden Do It?
Whoever fed you this information is full of crap. But I guess if I was to point the finger at someone, I would come up something very technical so everyone would believe it.

So, why would someone with root level access, need other credentials with user level access to get to data? And....since when does govt systems (even at the lowest level) trust self-signed certificates? Ah..they don't because if they did, there would be a major hole in the security of gov't networks.
Kevin Bocek
50%
50%
Kevin Bocek,
User Rank: Apprentice
11/18/2013 | 8:43:54 AM
re: How Did Snowden Do It?
Self-signed certs are being used to exfiltrate data even when paper organization policy does not allow it. Security bulletin from Cisco provides example background http://tools.cisco.com/securit...
marioa315
50%
50%
marioa315,
User Rank: Apprentice
11/14/2013 | 8:51:02 PM
re: How Did Snowden Do It?
Have to agree with Charlie on this one. I was asking myself all the same questions. Why would the NSA of all people allow self signed certs? Why would he need others credentials if he had root? And just because you can sign on as someone else does not mean that you suddenly have in your possesion their cert for later use. If implemented properly, it should only be available for use while logged into that account. But then again, the NSA could have been set up poorly to begin with. I am just assuming that they had better sense than that.
Kevin Bocek
50%
50%
Kevin Bocek,
User Rank: Apprentice
11/18/2013 | 8:40:08 AM
re: How Did Snowden Do It?
Snowden's root access would have been limited to the systems he had access to. The 10,000+ pages of docs and other reports indicate he gained access to many more systems than he had admin privileges. SSH provides both the means for elevated privileged and also encryption to evade detection. Attackers have been known to take SSH keys or insert their own as trusted and gain access thereafter. Self-signed certs here are about exfiltrating data not accessing. Mandiant, Cisco, and others have reported on increased used of self-signed certs. Admins (or attackers) can generate self-signed certs at will even if paper policy doesn't allow for it.
math scandals
50%
50%
math scandals,
User Rank: Apprentice
12/11/2013 | 2:49:40 AM
re: How Did Snowden Do It?
Watching hearings between NSA and congress, saw Director of NSA either lie 3 times or was reciting a script. Reportedly, when first appointed told NSA "I
don't know math, u figure it out". Heard congress parrot stuff i.e. -have been doing
"metadata long time". If u asked "what do u mean by metadata? What is it like ?/
functions vs say 'metadata in a word doc?" Clueless.

If I asked congress or NSA director if agency using DPI, what is that, what info does
it reveal?, doubt either could answer in intelligible fashion. They need to pay competent security consultant for hearings. Consultant would ask right questions,
know if NSA hedging, lying etc. Security could explain program in english.

Those phd 'pure mathematicians' that code crack are so out there. Few know that
math. Totally not math used by engineers, cpas etc.Mad at how math taught in school, some try to write books to make it kool for us.Typically they lose one after symmetry of pine cones and fibinachi numbers. LOL

Those code crackers get blamed for much global mischief. Has led to some strange
"conspiracy notions" among supposed allies. Guess congress needs to know bout
them too.

Get EZ-some in NSA that don't like snooping. Went thru channels. 2 rumors early
1) they loaded drive for him, 2)cia tip or both. Al quada changed phone, email codes before al alaki got droned., not after snowdon as director said. Some reg folks changed behavior tho.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13660
PUBLISHED: 2020-05-28
CMS Made Simple through 2.2.14 allows XSS via a crafted File Picker profile name.
CVE-2020-11079
PUBLISHED: 2020-05-28
node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.
CVE-2020-13245
PUBLISHED: 2020-05-28
Certain NETGEAR devices are affected by Missing SSL Certificate Validation. This affects R7000 1.0.9.6_1.2.19 through 1.0.11.100_10.2.10, and possibly R6120, R7800, R6220, R8000, R6350, R9000, R6400, RAX120, R6400v2, RBR20, R6800, XR300, R6850, XR500, and R7000P.
CVE-2020-4248
PUBLISHED: 2020-05-28
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 175484.
CVE-2020-8329
PUBLISHED: 2020-05-28
A denial of service vulnerability was reported in the firmware prior to version 1.01 used in Lenovo Printer LJ4010DN that could be triggered by a remote user sending a crafted packet to the device, causing an error to be displayed and preventing printer from functioning until the printer is rebooted...