NSA’s Hacker-in-Chief: We Don’t Need Zero-Days To Get Inside Your Network

February 1st, 2016

Awake Goy

NSA’s Hacker-in-Chief: We Don’t Need Zero-Days To Get Inside Your Network

January 31st, 2016

I’m posting this for people in network management and security rolls who have to deal with managers who don’t really get it. This talk isn’t for you IT people, because you already know all of this. It’s for the people who block you from trying to do your job effectively.

And this is just for non-state-sponsored threats.

If you are worried about NSA/GCHQ, you are going to have a very, very hard time defending against that. I’d start with an airgapped network inside a Faraday cage. Here’s a good example to follow. Forget any commercial operating systems, or hard drives.

Have a nice day.

Via: Vice:

The NSA has caught a lot of attention in recent years when it comes to the use of zero-day exploits, the precious security holes unknown to software vendors that hackers use to infect machines and penetrate networks.

The market for these unpatched vulnerabilities is massive, driven by a seemingly insatiable demand from global intelligence services, most notably the US government. But many security experts have suggested that the role of zero-days in government-sponsored hacking has perhaps been overstated.

Including, now, the head of the NSA’s most elite and secretive hacking unit.

In an unprecedented talk on Thursday at the USENIX Enigma security conference in San Francisco, Rob Joyce, chief of NSA’s Tailored Access Operations (TAO), downplayed the importance of zero-days and the degree to which nation-state hackers like those in his unit depend on them.

â€œI think a lot of people think the nation states are running on this engine of zero-days. You go out with your skeleton key and unlock the door and you’re in. It’s not that,â€� he said.

â€œI will tell you that persistence and focus will get you in, will achieve that exploitation without the zero-days,â€� he continued â€œThere’s so many more vectors that are easier, less risky and quite often more productive than going down that route.â€�

<!–