NSA Propaganda: They "Foiled Plot To Destroy Our Economy"

Last night, the "news" magazine, 60 Minutes, jumped firmly into the camp of "State Media" by airing a white wash of the NSA: NSA speaks out on Snowden, spying

This morning, other news organizations and tech-savvy media are shredding the 60 Minutes report: The Verge: Don't be fooled by the 60 Minutes report on the NSA

One of the more unbelievable statements made by Debora Plunkett, director of cyber defense for the NSA, is that, by working with computer manufacturers, they closed a vulnerability to a supposed cyber attack planned by China to "brick" most computers in the US. The attack, as the NSA claims, would have targeted the BIOS on computers through a fake/malware software update request. I call BS, here's why:

1) Modern computers can easily and quickly "reflash" the BIOS (firmware that runs as you boot the computer) if it becomes corrupt or inoperable.

2) If the NSA worked with "computer manufacturers" to close the malware vulnerability, this would only protect new computers after the fix -- but all computers need to be open to updates to the BIOS.

3) The possibility exists (on some PC's) to reconfigure the BIOS to disable hard drives and/or increase component voltage… thereby potentially causing permanent damage… however, see #4

4) If China released such an attack into the wild, it would reach all computers, not just US-based computers… creating the possibility of an unpredictable catastrophe.

5) If "someone" were to release, or have the potential to release, a BIOS attack into the wild with catastrophic potential, the most efficient and effective prevention vector is through malware and anti-virus software, not computer manufacturers.


60 Minutes is complicit in aiding the NSA to spread FUD (fear, uncertainty, and doubt) in an effort to justify the multi-billion dollar budget and unchecked intrusion in the privacy of US citizens and US allies, over a simple malware prevention.

Pathetic.

reply to post by SkepticOverlord

Gen. Alexander agreed to talk to us because he believes, the NSA has not told its story well.

Gen. Keith Alexander: We're defending this country from future terrorist attacks and we're defending our civil liberties and privacy.

Well, I'll give him a 1 out of 3 for this.

I'm pretty sure he's right about not telling the NSA story very well (or truthfully.)

reply to post by SkepticOverlord


I thought Snowden said the NSA didn't get any cyber attacks from China, the whole allocation was completely unfounded, if you remember there was a group that came out in his support in China when he made a stop there after this came out in the news.

A virus designed to attack the BIOS would have very limited effect. The firmware for every BIOS would be different, it's not like attacking a specific operating system.

If the Chinese wanted to introduce malware into the BIOS, the easiest way would be to do it at the manufacturing plant. They produce the motherboards, install the virus there.

If the NSA really wants to foil a plot to destroy the US economy, start with the Federal Reserve.

reply to post by SkepticOverlord


Well de-bunked, I wish more people could see this since I can already feel the breeze of American flags waving again...

VictorVonDoom
A virus designed to attack the BIOS would have very limited effect. The firmware for every BIOS would be different, it's not like attacking a specific operating system.

If the Chinese wanted to introduce malware into the BIOS, the easiest way would be to do it at the manufacturing plant. They produce the motherboards, install the virus there.

If the NSA really wants to foil a plot to destroy the US economy, start with the Federal Reserve.

This is somewhat true, but not completely. It depends on what the virus author is trying to accomplish. Remember the CIH (Chernobyl) Virus? It first appeared in 1998 and infected something like 60 million computers. This was a small virus, 1k in size, that infected Win95/98/ME machines. If the goal is simply to corrupt the BIOS by writing a bunch of junk, this is a much easier attack to pull off.

This virus was spread through warez but also:

In September 1998, Yamaha shipped a firmware update to their CD-R400 drives that was infected with the virus. In October 1998, a demo version of the Activision game SiN was infected by one of its mirror sites.[4] In March 1999, several thousand IBM Aptivas shipped with the CIH virus,[5] just one month before the virus would trigger.

source

and I seem to remember a Wing Commander update that was infected.

More recently (late 2011?) there was the trojan, Mebromi, which infected AwardBIOS BIOSes and then there's BadBIOS, which if real, actually infects (as opposed to simply corrupting) a number of different BIOSes according to Dragos Ruiu.

Not that the NSA isn't full of crap, but a BIOS infecting (or at least corrupting) virus isn't a new or non-existent threat.

I'm stunned.. Flummoxed. I read the whole 60 minutes piece, top to bottom and I'm just....stunned. Oh, geeze.. where to even start?

First, I agree with the OP on all points. Nothing measurable TO disagree with. This "plot" by a nation-state of any kind, but most of all China, is absurd to the point of laughable. Now..could they set up an attack meant to target a small group of machines in a small area like this? I think so... Stuxnet with a twist. That's the problem tho..Even if they solved all the technical issues for how to distribute it, not have it blow back on them too, and achieve what this is said to have been capable of? They'd have to figure out a way to have a measurable % of machines in our nation all run it, pretty much at the same time.

If it wasn't near simultaneous? Well, the first tech at any level to confirm what did this ...after he recovered from the shock...would sound the alarm so loud, I'd literally expect Breaking News interupts for warnings. It wouldn't succeed and they'd know that. China is far from stupid....even if some in Government take them that way.

---

I do want to thank the NSA for something though. Like a crook with the cops in a dark interrogation room? They just don't know when to shut up. Our gain, their loss. For instance...

Rick Ledgett: So, all the machines that he had access to we removed from our classified network. All the machines in the unclassified network and including the actual cables that connect those machines, we removed as well.

Where is Rick's address? I ought to drop him a thank you note. I never would have believed cables themselves could be compromised so totally, the people who trained the man who would have done it...can't be sure of security afterward. After all, he went out of his way, special, to note the cabling itself had to be removed and trashed. Why, thanks... I had no idea of that hardware capability of the NSA.

reply to post by Wrabbit2000


Considering the size of electronic devices these days, I could see it being a reasonable precaution to remove the cables if one were concerned with security at that level. One (though... not me) could easily create a snooping device that fits inside a standard cable.

Of course, I don't disagree with anything else you said... just pointing out a... thing.

Wrabbit2000
I'm stunned.. Flummoxed. I read the whole 60 minutes piece, top to bottom and I'm just....stunned. Oh, geeze.. where to even start?

First, I agree with the OP on all points. Nothing measurable TO disagree with. This "plot" by a nation-state of any kind, but most of all China, is absurd to the point of laughable. Now..could they set up an attack meant to target a small group of machines in a small area like this? I think so... Stuxnet with a twist. That's the problem tho..Even if they solved all the technical issues for how to distribute it, not have it blow back on them too, and achieve what this is said to have been capable of? They'd have to figure out a way to have a measurable % of machines in our nation all run it, pretty much at the same time.

If it wasn't near simultaneous? Well, the first tech at any level to confirm what did this ...after he recovered from the shock...would sound the alarm so loud, I'd literally expect Breaking News interupts for warnings. It wouldn't succeed and they'd know that. China is far from stupid....even if some in Government take them that way.

---

I do want to thank the NSA for something though. Like a crook with the cops in a dark interrogation room? They just don't know when to shut up. Our gain, their loss. For instance...

Rick Ledgett: So, all the machines that he had access to we removed from our classified network. All the machines in the unclassified network and including the actual cables that connect those machines, we removed as well.

Where is Rick's address? I ought to drop him a thank you note. I never would have believed cables themselves could be compromised so totally, the people who trained the man who would have done it...can't be sure of security afterward. After all, he went out of his way, special, to note the cabling itself had to be removed and trashed. Why, thanks... I had no idea of that hardware capability of the NSA.

Hey, good catch Wrabbit.

Personally, I've never bothered to look at cabling itself as a potentially having an incorporated security threat device. I guess I started doing computer stuff waaaaay back when such a thing wasn't possible. Nowadays? I think I'll hang onto all the legacy hardware I have after all.

reply to post by CrikeyMagnet


Makes me wonder about all the vga cables i had shipped from china,a vga plug is definitely big enough to contain microelectronics,thankfully i got them for a surveillance system not online....good point even if my reply was a little tongue in cheek....i wonder if the os you use could impact such a virus as this,switched to linux because if security concerns...plus,on second thought,as was stated before i have mobo's from 4 different manufacturers,seems to me would be impossible to get them all with one infection....doesnt it have to be os specific.....peace ya'll

reply to post by SkepticOverlord

The NSA gives unprecedented access to the agency's HQ and, for the first time, explains what it does and what it says it doesn't do: spy on Americans

What the f are they talking about?

Unless I'm really out of it, isnt it common knowledge that the NSA is recording every electronic communication?

Or in their twisted minds do they differentiate between recording everything vs. "spying"?

"The fact is, we're not collecting everybody's email, we're not collecting everybody's phone things..."

I'm gonna call BS on this.

COSTELLO: You're not talking about voicemail, right? What are you talking about exactly?

CLEMENTE (former FBI counter terrorism): I'm talking about all digital communications are -- there's a way to look at digital communications in the past. I can't go into detail of how that's done or what's done. But I can tell you that no digital communication is secure. So these communications will be found out. The conversation will be known.

Snowden: ‘No Telephone In America Makes Call Without Leaving Record With NSA’

XKeyscore: NSA tool collects 'nearly everything a user does on the internet'.

Someone's lying.

Whom do you believe?

reply to post by SkepticOverlord


my solution to illegal NSA spying is simple - I repeatedly post that they are traitorous, freedom-hating, betraying pieces of human filth who hate their own citizens, and then I sit back and enjoy the fact that they will keep and store the fact that they are human waste forever. a nice lil nugget of poop in their ugly souls and tidy little storage facility...forever.

its as if they immortalized my direct statement of their character forever - thus granting it eternal validity and power over them.