CYBER WAR - NSA Code Breach

"Analyzing the NSA code breach in the context of recent cybersecurity events" PBS NewsHour 8/17/2016

Excerpt

SUMMARY:  On Saturday, programming code for National Security Agency hacking tools was shared online.  The content appears to be legitimate, but it is not clear if it was intentionally hacked or accidentally leaked.  Hari Sreenivasan speaks with The Washington Post's Ellen Nakashima and Paul Vixie of Farsight Security about where this development fits in the context of other recent cybersecurity breaches.

HARI SREENIVASAN (NewsHour):  The National Security Agency's primary mission is to spy on the electronic communications of countries and people overseas.

Over the weekend, though, sophisticated code the NSA developed to penetrate computer security systems was posted online.  This serious breach comes amid the ongoing revelations of the hacking of the Democratic National Committee and other organizations, allegedly by groups linked to Russian intelligence.

For more on this, we turn to The Washington Post national security correspondent Ellen Nakashima, and Paul Vixie.  He designed and built some of the software that is the backbone of the Internet today.  He is now chairman and CEO of Farsight Security, a computer security firm.

Ellen Nakashima, what happened this weekend?  What got released?

ELLEN NAKASHIMA, The Washington Post:  Over the weekend, apparently on Saturday, mysteriously, a cache of NSA hacking tools was released online through file-sharing sites such as BitTorrent and Dropbox.

It really wasn't noticed until about Monday, when the computer security community started commenting on it and questions arose as to whether or not the NSA had been hacked.

HARI SREENIVASAN:  So, Paul Vixie, if these lock picks, these digital tools to try break into different systems out are out in the open now, these are the tools that the American government was using, what is the consequence, if it is in the public sphere?

PAUL VIXIE, Farsight Security:  Well, I think, every day, everybody is trying to hack everybody.  So, this is not huge news.

What's big news about it is that these tools were built by the U.S. government.  Some of the lock picks, as you call them, are now obsolete.  They are relying on vulnerabilities that have since been closed, because the files are about 3 years old.

But at least one of them is active against a very current piece of equipment from Cisco.  And it is going to lead to a lot of break-ins while the patches are prepared and shipped and then applied.