Notifications for targeted attacks(facebook.com)
facebook.com
Notifications for targeted attacks
https://www.facebook.com/notes/facebook-security/notifications-for-targeted-attacks/10153092994615766
83 comments
This question obviously is unlikely to have an answer, but someone has to ask: does "nation-state" include the Western countries, namely the US/EU and friends?
I once received this alert from google, a few months later had a run in with the FBI.
I don't see why any non-Western countries would be interested in me, so yeah.
I don't see why any non-Western countries would be interested in me, so yeah.
> I once received this alert from google, a few months later had a run in with the FBI.
Sounds like quite a story; any details you can share?
Sounds like quite a story; any details you can share?
I received the alert around Dec 2012, big red bar at the top of my screen (which interestingly enough caused a reflected XSS vulnerability in gmail) just randomly popped up as I was eating dinner a few days before christmas.
Didn't really think much of it, account logs showed no access from outside of my own IP addresses and analysing all the emails I had received in the past few months found nothing out of place. Leads me to believe (Well, hope.) that the attack was detected and blocked by google.
About 8 months (had to double check that, since it sure felt like less) later I flew over to defcon and the FBI searched my hotel room, seizing my throwaway phone and laptop. On my way out of the country I was again stopped at JFK by a bunch of agents holding a grand jury subpoena.
Ended up being asked a bunch of rather silly questions regarding some ORNL hack(and others) that I couldn't really answer.
Wasn't arrested, got to spend an extra day in the states and flew out.
Didn't really think much of it, account logs showed no access from outside of my own IP addresses and analysing all the emails I had received in the past few months found nothing out of place. Leads me to believe (Well, hope.) that the attack was detected and blocked by google.
About 8 months (had to double check that, since it sure felt like less) later I flew over to defcon and the FBI searched my hotel room, seizing my throwaway phone and laptop. On my way out of the country I was again stopped at JFK by a bunch of agents holding a grand jury subpoena.
Ended up being asked a bunch of rather silly questions regarding some ORNL hack(and others) that I couldn't really answer.
Wasn't arrested, got to spend an extra day in the states and flew out.
Your email address in your profile would lead me to believe you're Russian, but you speak very fluent and informal American English. Don't suppose you'd admit to being a Fin and having a name of Julius, would you?
Curiosity, that's all.
Curiosity, that's all.
Yep.
Using russian email server is smart: out of subpoena powers of all of the Western nations... and FSB, even if they were to spy on you, doesn't really give a damn unless you’re trying to undermine Russian Federation.
And contacting yandex customer support is significantly easier than trying to get in touch with someone at google capable of unlocking my account.
Followed you briefly (news-wise). Fun fact: I once received a call about some credit card information being leaked, and was brought on to figure it out. I'm pretty sure you had something to do with it.
Small, fun little world we live in. I was amazed to learn that you were so young. Hope you stay out of trouble and put your curious brain to good use. :) Don't forget your SOCKS.
Small, fun little world we live in. I was amazed to learn that you were so young. Hope you stay out of trouble and put your curious brain to good use. :) Don't forget your SOCKS.
[deleted]
Can you elaborate on what the big red bar said? At least I'm assuming it had some message.
https://4.bp.blogspot.com/-kaEkDHuMR-8/T85THToQyYI/AAAAAAAAC...
Looks like that, although I remembered it being more red.
Looks like that, although I remembered it being more red.
[deleted]
I think you should share your story. The more the people know, the better.
At Google when we have done these alerts we have not discriminated by country. The alerts only cover what we see with phishing and malware targeting by what we believe is nation state activity and has nothing to do with law enforcement requests or other legal processes.
I wish I could find the reference, but I recall someone once saying that sites like Google or Yahoo will provide a really subtle "canary" to indicate that your account details may have been requested, through just requiring you to re-accept the terms of service agreement.
Alex Stamos (Facebook CSO) is a vocal critic of the NSA [1]. Obviously they have to work within the law, so I don't expect we will see them illegally notifying people about NSLs, but I do expect to see Facebook pushing as much as possible against both western and other state-sponsored attacks on privacy.
[1] http://www.bbc.com/news/technology-31604503
[1] http://www.bbc.com/news/technology-31604503
I would guess not, since Facebook is likely required to abide by laws in the US\EU which allow transparent access to information (through warrants or otherwise), as we have already seen.
Of course not. The only states that do bad things are China, Iran, N.Korea, right?
No need to downvote this reply. The sarcasm was an effective and appropriate way to communicate a serious point.
Sincerity does a better job than sarcasm in communicating, usually.
Tedious HN thought police. Not everyone, not every culture, shares the aesthetics of communication implied by recent HN directives. I think we should consider the possibility that they are, though well-intentioned, overly prescriptive and ultimately oppressive.
The reason for HN's guidelines is not that we're uptight finger-waggers. It's that we understand the dynamics of a large anonymous internet forum. The alternative isn't HN-as-it-is, spiced up with more sarcastic or aggressive comments. The alternative is internet sludge.
The way to preserve what HN has that is good (and I'm not saying it's great, only that it's better than it might be) is to have a clear set of principles and communicate them. If you know a better set of principles, where the fitness function is high-quality discussion at scale, I'd love to hear what they are. Otherwise I'm going to suspect you of magical thinking, in which HN's current level is assumed to just happen for free, and for some reason meddlesome thought police keep intruding on it.
The way to preserve what HN has that is good (and I'm not saying it's great, only that it's better than it might be) is to have a clear set of principles and communicate them. If you know a better set of principles, where the fitness function is high-quality discussion at scale, I'd love to hear what they are. Otherwise I'm going to suspect you of magical thinking, in which HN's current level is assumed to just happen for free, and for some reason meddlesome thought police keep intruding on it.
Thanks dang, your posts on this topic are always very thoughtful and reasoned.
I guess I would draw a clear distinction between aggression and sarcasm. I do believe you that it's a difficult task to make things function healthily at scale and I'm sure those involved in issuing recent guidelines were correct to do so. And of course I agree that we shouldn't be aggressive (though waveform apparently needs a reminder of this). But I'm pretty uncomfortable with eliminating sarcasm. That's really a very common mode of communication in some cultures. It feels very sterile/corporate to not be allowed to simply be sarcastic. Especially when the target of sarcasm is basically western hegemony, as it was here!
I guess I would draw a clear distinction between aggression and sarcasm. I do believe you that it's a difficult task to make things function healthily at scale and I'm sure those involved in issuing recent guidelines were correct to do so. And of course I agree that we shouldn't be aggressive (though waveform apparently needs a reminder of this). But I'm pretty uncomfortable with eliminating sarcasm. That's really a very common mode of communication in some cultures. It feels very sterile/corporate to not be allowed to simply be sarcastic. Especially when the target of sarcasm is basically western hegemony, as it was here!
Oh, I see. I think I took your concern at slightly the wrong angle.
The guidelines don't rule out sarcasm. They ask for comments to be civil and substantive. The Venn diagram of those things may not have a lot of common area but there's definitely some. Just don't ask me to specify what it is—that's probably too hard.
The guidelines don't rule out sarcasm. They ask for comments to be civil and substantive. The Venn diagram of those things may not have a lot of common area but there's definitely some. Just don't ask me to specify what it is—that's probably too hard.
We could also consider that HN has a particular culture. No one foces anyone to live here. It's a community you can freely join and leave, which makes it only more important to protect the culture that makes it good.
This is my personal opinion that I've posted you smarmy git.
Sincerity does a better job than sarcasm but offensiveness and insults are best of all? I even made sure in my response that personal pronouns like "you" were not present so that it was a criticism of HN rather than you.
Insults are effective in communicating some things!
"we strongly encourage affected people to take the actions necessary to secure all of their online accounts."
This is an important aspect. The affected individual might be using several other services that don't have the sophistication of Facebook's security team. Facebook might have been able to thwart the attack but his/her other online accounts might have been compromised.
This is an important aspect. The affected individual might be using several other services that don't have the sophistication of Facebook's security team. Facebook might have been able to thwart the attack but his/her other online accounts might have been compromised.
Why state-sponsored hacking specifically, as opposed to any (likely) unauthorized access?
it's quite obvious, really. Regular unauthorized access means: batten down the hatches, man battle stations, i.e. change password
State-sponsored hacking means: delete social media profile, move residence, change phones, start praying, etc
;-)
James Mickens' "Mossad/not-Mossad" threat model comes to mind: https://www.usenix.org/system/files/1401_08-12_mickens.pdf
Thanks for that, it had honestly never occurred to me that murder for the purpose of buying someone's stuff at an estate sale might be a thing. I have updated my will accordingly.
Seriously? I got through the first page and a half of smarmy pop-culture references and couldn't figure out what the heck the author was talking about, so I just stopped reading. More power to you if you understood it!
I think it's because of the context it was linked in. Mickens is a pretty smart guy and is known for the series of articles like this one; it's something you read to reflect on in between crying out of laughter.
That is an incredible essay. Thanks for posting
I think they do, they're just being extra helpful here and specifying that they think whoever owned you was a state actor.
They already notify you about likely unauthorized access. This is just additional notification for state-sponsored attacks.
If they have the information, the heads-up could save a life/personal freedom?
There are many non-state actors who can threaten life/personal-freedom.
Yes, but the majority of hacking attempts against Facebook accounts are probably just trying to post ads for knock-off Ray-Bans.
Not in the same way a state actor can. Especially if it's your own state. An FBI agent won't go to jail for ending your life/personal freedom; he can act in the open.
Also, how will sending a new password to your cell phone help? If you are dealing with state sponsored actors, why not assume they can see all text and email?
A two-factor authentication token to sent via text, not the actual password.
That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.
That said, I find SMS-based 2FA to be pretty dodgy as well. Cloudflare was hacked once by somebody who managed gain access to an admin's mobile phone by social engineering their telco. If a site does not offer TOTP based 2FA I usually don't bother using it.
I didn't say the actual password. The page wasn't very forthcoming on all the details, but a 2FAT is typically just a very short, temporary password.
If the actor is not sponsored by a state that would have easy access to your telecom (e.g. you live in the US but the attack is from a hacker sponsored by China) this is still very helpful.
Will it disregard National Security Letters to notify users?
I doubt it.
This is just propaganda by Facebook showing everyone that it cares about your privacy. Unfortunately, I believe government all around the world are going to have a talk with Facebook about what is acceptable levels of privacy.
This is just propaganda by Facebook showing everyone that it cares about your privacy. Unfortunately, I believe government all around the world are going to have a talk with Facebook about what is acceptable levels of privacy.
The focus seems to be on "state-sponsored actors", not the states themselves. My guess is this is targeted at completely illegal and disavowed actors, not those that have the luxury of being able to issue a NSL.
I don't think you have to comply with NSL before you get it. If Facebook is able to detect pre-NSL surveillance (I doubt government just sends batch NSLs as a prelude to investigating potential targets), they can alert you before an official gag order tells them to shut up.
I've been getting regular emails from Facebook saying "sorry you've been having trouble logging in to your account". I haven't been trying to login to my account, I deactivated it years ago. Don't think there is anything I can do about it.
You can delete your account. https://en-gb.facebook.com/help/125338004213029
This is a good move by facebook and does have the potential to save lives, but the fact that they don't provide any details about the attack or the supposed attacker definitely makes it significantly harder for potential victims to act on this information.
Imagine getting a message like this out of the blue, not even knowing who's after you. What are you going to do?
It's hard to fight a faceless enemy, especially when you can't even be sure if they really exist.
Imagine getting a message like this out of the blue, not even knowing who's after you. What are you going to do?
It's hard to fight a faceless enemy, especially when you can't even be sure if they really exist.
I wrote a long response to this but decided to simply ask, what can a person do to act on the information, if it were provided?
Protestors in Syria or China could probably already guess what such a message means, so I'm curious as to the amount of information needed for a person to be able to act on it?
Protestors in Syria or China could probably already guess what such a message means, so I'm curious as to the amount of information needed for a person to be able to act on it?
Protestors in Syria or China aren't the only people getting these.
As Snowden demonstrated there's no lack of westerners being spied on just because they happen to work at a telecom company.
The fact that there's no more information provided makes it far too easy for those people to just ignore these warnings as mistakes and go on with their lives.
As Snowden demonstrated there's no lack of westerners being spied on just because they happen to work at a telecom company.
The fact that there's no more information provided makes it far too easy for those people to just ignore these warnings as mistakes and go on with their lives.
That's true, but I suppose its a lot easier for Facebook to show warnings when actors like Syria or China are the culprits since they have no requirement to abide by their law. Where as, as Snowden has shown, the US and EU can stipulate whatever policy they want and require that Facebook can not disclose anything about it. I'm just skeptical anyone in the US or EU will see this warning.
I've, as a white EU citizen, received similar warnings from google.
I don't know if Facebook is going to be showing this to any western people, but when google showed me their version of the warning there was very little I could do with it since looking through my logs and emails showed no signs of any attempted attacks.
I don't know if Facebook is going to be showing this to any western people, but when google showed me their version of the warning there was very little I could do with it since looking through my logs and emails showed no signs of any attempted attacks.
Except the USA, of course. :)
Yeah, I suspect this wouldn't show up if Facebook received an NSL...
I think this alert is sent when they can sense you're being surveilled before they themselves get a NSL. "Targeted by state actor" != "obeyed lawful request for data".
Oh? I was hoping that that was one intended use for this. Would such an alert violate the typical terms of an "NSL"?
From Wikipedia:
NSLs typically contain a nondisclosure requirement, frequently called a ''gag order,'' preventing the recipient of an NSL from disclosing that the FBI had requested the information.
...however:
The nondisclosure order must be authorized by the Director of the FBI, and only after he or she certifies "that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person.
So it seems this is regulated to some degree, though it is unclear what counts as "interference with a criminal, counterterrorism, or counterintelligence investigation".
NSLs typically contain a nondisclosure requirement, frequently called a ''gag order,'' preventing the recipient of an NSL from disclosing that the FBI had requested the information.
...however:
The nondisclosure order must be authorized by the Director of the FBI, and only after he or she certifies "that otherwise there may result a danger to the national security of the United States, interference with a criminal, counterterrorism, or counterintelligence investigation, interference with diplomatic relations, or danger to the life or physical safety of any person.
So it seems this is regulated to some degree, though it is unclear what counts as "interference with a criminal, counterterrorism, or counterintelligence investigation".
It is a welcome move if facebook wants to be a true social platform, and increase its acceptance within me than rejection. But this particular change must come with a degree of transparency, which is required IMO to address your humorous but serious comment, and address larger value of this move.
- How would facebook detect nation-state attacks?
- How do we make the policy around it participative and open?
- Etc.> - How would facebook detect nation-state attacks?
"We do this by a combination of traffic monitoring, incident tracking and utilizing cellular network infrastructure to notify the engineers responsible for sending the warning in time between the NSL reaching front desk and CEO becoming aware of its content."
> - How do we make the policy around it participative and open?
"Everyone is free to receive a warning about being targeted by a state or state-sponsored actor, regardless of race, religion, gender, income and sexual preferences of said actor."
"We do this by a combination of traffic monitoring, incident tracking and utilizing cellular network infrastructure to notify the engineers responsible for sending the warning in time between the NSL reaching front desk and CEO becoming aware of its content."
> - How do we make the policy around it participative and open?
"Everyone is free to receive a warning about being targeted by a state or state-sponsored actor, regardless of race, religion, gender, income and sexual preferences of said actor."
Imagine if this alert system were too liberal at labeling things "nation-state" and a significant proportion of users saw this notice: I imagine the general populous would be much more concerned about internet security than they are now.
Rather than stealing your password so they can log in to your Facebook account, won't these state sponsored hackers just steal the authentication cookie that your browser sends to show that it's been authorized by MFA?
Why so many naysayers? I can't see this having any detrimental effects, regardless of how effective it is in practice.
People are biased about Facebook for various reasons, including $privacy-issue-of-the-day; no matter what they do they get to be the villan.
That is, unless we're talking about their newest PHP optimizer or ad toolkit.
That is, unless we're talking about their newest PHP optimizer or ad toolkit.
> People are biased about Facebook for various reasons, including $privacy-issue-of-the-day"
While FB as a company certainly is not altruistic, they employ quite a few privacy-minded engineers. Data leaks to the outside of their walled garden are very likely treated as company-wide problems, but as the LGBT doxes showed, there are wide implications even within their walls. [0]
As they try to capture ever larger parts of the online population, they will* keep colliding with non-Western, non-SV norms. The privacy issues may be nothing but a canary in the goldmine, because they are mostly an expression of non-SV values. For example, I have my doubts about how long images of traditional Hindu artwork would be allowed to stay up...
0: http://www.huffingtonpost.com/2015/03/27/facebook-authentic-...
While FB as a company certainly is not altruistic, they employ quite a few privacy-minded engineers. Data leaks to the outside of their walled garden are very likely treated as company-wide problems, but as the LGBT doxes showed, there are wide implications even within their walls. [0]
As they try to capture ever larger parts of the online population, they will* keep colliding with non-Western, non-SV norms. The privacy issues may be nothing but a canary in the goldmine, because they are mostly an expression of non-SV values. For example, I have my doubts about how long images of traditional Hindu artwork would be allowed to stay up...
0: http://www.huffingtonpost.com/2015/03/27/facebook-authentic-...
I haven't naysaid yet, but I'm always wary of big companies that take actions that clearly fit into some geo-political agenda. E.g. in this case, I suspect that the aim might be to embarrass and critique nation states such as Russia, China, and whatever country the US wants to replace the leadership of (Syria right now). These countries tend to use fairly obvious and naive attacks, as opposed to the US that might be able to demand information by an NSL.
> I haven't naysaid yet, but I'm always wary of big companies that take actions that clearly fit into some geo-political agenda.
Personally, I'm beginning to feel Google and Facebook are getting more and more open about US politics going against their interests.
> These countries tend to use fairly obvious and naive attacks, as opposed to the US that might be able to demand information by an NSL.
I don't think I agree with that point. Isn't the exact opposite the case? Russia, China, et al. have to actually do the work and hack the US citizen, while the US GOV can just send the NSL and have the data delivered on silver platter by US companies, who are bound by law to comply?
Personally, I'm beginning to feel Google and Facebook are getting more and more open about US politics going against their interests.
> These countries tend to use fairly obvious and naive attacks, as opposed to the US that might be able to demand information by an NSL.
I don't think I agree with that point. Isn't the exact opposite the case? Russia, China, et al. have to actually do the work and hack the US citizen, while the US GOV can just send the NSL and have the data delivered on silver platter by US companies, who are bound by law to comply?
One possible argument would be that having a false sense of security is worse than no security at all.
The comments (on Facebook) are surreal.
This is so stupid since they can be forced to give information with no hacking involved...