Forgot your password?
typodupeerror
Security United Kingdom

British Intelligence Responds To Slashdot About Man-in-Middle Attack 256

Posted by samzenpus
from the what-do-you-have-to-say dept.
Nerval's Lobster writes "The GCHQ agency, Britain's equivalent of the National Security Agency, reportedly used fake LinkedIn and Slashdot pages to load malware onto computers at Belgian telecommunications firm Belgacom. In an emailed statement to Slashdot, the GCHQ's Press and Media Affairs Office wrote: 'We have no comment to make on this particular story.' It added: 'All GCHQ's work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the Secretary of State, the Interception and Intelligence Services Commissioners and the Intelligence and Security Committee.' Meanwhile, LinkedIn's representatives suggested they had no knowledge of the reported hack. 'We have read the same stories, and we want to clarify that we have never cooperated with any government agency,' a spokesperson from the social network wrote in an email to Slashdot, 'nor do we have any knowledge, with regard to these actions, and to date, we have not detected any of the spoofing activity that is being reported.' An IT security expert with extensive knowledge of government intelligence operations, but no direct insight into the GCHQ, hypothesized to Slashdot that carrying out a man-in-the-middle attack was well within the capabilities of British intelligence agencies, but that such a 'retail' operation also seemed somewhat out of character. 'Based on what we know they've done, they are doing industrialized, large scale traffic sweeping and net hacking,' he said. 'They operate a wholesale, with statistical techniques. By "statistical" I mean that they send something that may or may not work.' With that in mind, he added, it's plausible that the GCHQ has software that operates in a similar manner to the NSA's EGOTISTICAL GIRAFFE, and used it to redirect Belgacom employees to a fake download. 'However, the story has been slightly garbaged into it being fake [LinkedIn and Slashdot] accounts, as opposed to network spoofing.'" Update: You can read the official statement from Slashdot's parent company, Dice Holdings, here on our blog.
This discussion has been archived. No new comments can be posted.

British Intelligence Responds To Slashdot About Man-in-Middle Attack

Comments Filter:
  • First Spoof (Score:4, Funny)

    by anagama (611277) <obamaisaneocon@nothingchanged.org> on Monday November 11, 2013 @11:28AM (#45391293) Homepage

    First Spoof.

    Though this is no laughing matter.

  • by Anonymous Coward on Monday November 11, 2013 @11:28AM (#45391295)

    That would make MIM attacks much more difficult

    • by Antony T Curtis (89990) on Monday November 11, 2013 @11:38AM (#45391389) Homepage Journal

      Using HTTPS is not the solution when the only thing people see is that some trusted certificate was used. If a trusted Certificate Authority was compromised or issued `fake' certificates for government spy agencies, the target wouldn't know that a MITM attack has occurred because the little green icon is showing just fine.

      However, if we had something like a GPG content encoding, if the site hasn't already been trusted by the user, red flags will immediately be showing.

      Like as like not, with the proliferation of CAs which exist, MITM attacks are easier than ever because people have been conditioned to trust HTTPS.

      • by heypete (60671) <pete@heypete.com> on Monday November 11, 2013 @11:50AM (#45391493) Homepage

        True, but it would prevent the insertion of malicious packets (the "Quantum Insert" technique they describe in the various articles). Invalid SSL/TLS packets would simply be discarded and it would not be possible to insert malicious packets into the encrypted, MACed datastream.

        Yes, MITM would be possible but Slashdot could implement certificate pinning (either through having browsers like Chrome have the cert details baked-in [imperialviolet.org], or having users use something like Cert Patrol for Firefox) to make this harder. It's not foolproof, but it would certainly make this type of attack considerably more difficult and easier to detect.

        • by IamTheRealMike (537420) <mike@plan99.net> on Monday November 11, 2013 @08:26PM (#45396167) Homepage

          Yes, indeed. This meme that SSL is broken or useless is very damaging and needs to end.

          The fact is that despite all the handwaving and noise, nobody has yet presented proof that a CA has been subverted by intelligence agencies, let alone knowingly. It's certainly possible that this has happened and one may think it is even likely, but in the absence of any proof it's hard to credibly argue the entire system is hosed.

          The difficulty of course is finding such a proof. If a CA was found to have been routinely issuing certificates to intelligence agencies, it's very very likely that browser makers would revoke that CA and destroy the business. Their written policies are quite clear on this point and do not make governments special, that's why GoDaddy revoked LavaBit's SSL cert after learning the private key had been disclosed to the FBI. So far we don't have any evidence that the NSA or GCHQ were willing to risk destruction of a civilian business in order to reach one of their targets - though I guess there are still plenty of Snowden disclosures to come.

          But even if there have been such certs issued, SSL is not useless. Firstly, it raises the complexity a lot. And secondly, there are initiatives underway to prevent subversion even by multi-billion-dollar intelligence agencies. For example the certificate transparency initiative [certificat...arency.org] is intending to upgrade the certificate format to contain a proof of inclusion in a public log. Browsers will start requiring the presence of these proofs in future, and thus it will no longer be possible to issue secret SSL certs that nobody can see except the victim. This is a large, complex upgrade of a massive infrastructure so it will take years, but eventually this system will raise the bar for SSL attackers to the point where they will either have to give up, or actually pass new laws that formally subvert SSL to the will of governments (at which point of course it does not matter if they are detected and there is no need to compromise CA's).

          Which will happen is an open question at this point. However, Slashdot should get its ass into gear and switch on SSL and HSTS by default. Saying it's an option for logged in users just isn't good enough, especially when that option is so well buried I can't actually find it! SSL all the time should be the default, these days, there's just no reason not to anymore.

      • by smash (1351)
        out-of-band, self signed certs for the win!
      • Using HTTPS is not the solution when the only thing people see is that some trusted certificate was used. If a trusted Certificate Authority was compromised or issued `fake' certificates for government spy agencies, the target wouldn't know that a MITM attack has occurred because the little green icon is showing just fine.

        However, if we had something like a GPG content encoding, if the site hasn't already been trusted by the user, red flags will immediately be showing.

        Like as like not, with the proliferation of CAs which exist, MITM attacks are easier than ever because people have been conditioned to trust HTTPS.

        Although I like where your head is, wouldn't the CPU power required to do on-the-fly GPG decoding of content be prohibitive? Or am I misunderstanding the proposed solution?

        • by Antony T Curtis (89990) on Monday November 11, 2013 @12:08PM (#45391677) Homepage Journal

          Although I like where your head is, wouldn't the CPU power required to do on-the-fly GPG decoding of content be prohibitive? Or am I misunderstanding the proposed solution?

          A large amount of the content on the internet is static. The static assets can be stored on the disk, already signed. This has the added advantage that HTTPS cannot provide: The static assets are cacheable and they are tamper-proof, should the server be compromised.

          When it comes to dynamic content, one can 'cheat' a little by reusing the same session key for the same connection. The startup cost is not much different than existing HTTPS which uses DH for key exchange.

          It's not going to be much slower than what we have today with HTTPS for interactive sites, where humans are the slow link in the chain.

      • by yakatz (1176317) on Monday November 11, 2013 @12:35PM (#45391959) Homepage Journal
        Google Chrome supports certificate pinning so you can't go to a site if the certificate used does not match the known one on the list compiled into the browser, which sort-of solves the wrongly issued certificate problem.
        RFC 6844 [ietf.org] has a proposed DNS type for verifying the proper certificate was served (requires DNSSEC to make sure the DNS was not tampered with).
        • by yakatz (1176317)
          Woops, wrong one. That RFC says not to use it for validation, only for a certificate authority to see if they should issue a cert. I will try to find the correct one.
        • by dgatwood (11270) on Monday November 11, 2013 @01:26PM (#45392465) Journal

          The problem is that certificates change regularly. What you really want is public key pinning, where you are warned if the public key changes, without regard to what CA signed it—not just the key fingerprint, either—the entire key. After all, you have the server's public key. Why would you ever start trusting a different public key for the same server?

          AFAICT, there are only two valid to reasons rekey a server: if the key gets compromised (which, being a serious security problem, should be publicly disclosed on your server in some way) or because you're upgrading to a larger key. In the latter case, you should ideally sign the new key with the old key so that it is verifiable, and the browser should ignore that the old key is not trusted for key signing when it is only being used as a secondary signature for verifying a key change.

      • by Andy Dodd (701) <atd7@corne[ ]edu ['ll.' in gap]> on Monday November 11, 2013 @02:21PM (#45393047) Homepage

        In addition to this, if you recall some of the recent Lavabit disclosures, we know that large Internet companies have been forced to provide their private SSL certs via secret court orders.

        If the NSA/GCHQ have a site's private certs, they can MITM you without you knowing.

  • Heh. (Score:5, Insightful)

    by girlintraining (1395911) on Monday November 11, 2013 @11:31AM (#45391327)

    All GCHQ's work is carried out in accordance with a strict legal and policy framework which ensure that our activities are authorised, necessary and proportionate, and that there is rigorous oversight

    The Stasi said the same thing in East Germany. But that's circular logic: We're authorized to do this because we authorized it.

    • Re:Heh. (Score:5, Insightful)

      by s.petry (762400) on Monday November 11, 2013 @11:40AM (#45391405)

      The Stasi said the same thing in East Germany. But that's circular logic: We're authorized to do this because we authorized it.

      Exactly! They claim that they use laws to control what they snoop, and have oversight. When the laws are "secret", the courts are "secret", and the oversight is internal how much should we trust them? None at all!

      • Re: (Score:3, Interesting)

        Exactly! They claim that they use laws to control what they snoop, and have oversight. When the laws are "secret", the courts are "secret", and the oversight is internal how much should we trust them? None at all!

        Not necessarily. Some things need to be secret. When we put spies on trial, we shouldn't showcase all the classified documents they stole for public inspection. It's evidence, but it's secret evidence -- and the sensitive nature of the documents is sufficient justification for doing so. The problem is not secrecy, anymore than keeping your password secret is a security vulnerability. The problem is when secrecy exceeds its mandate; when it crosses a line from matters of true national security to matters tha

        • Re:Heh. (Score:5, Insightful)

          by s.petry (762400) on Monday November 11, 2013 @12:26PM (#45391841)

          I never mentioned "secrets", like your example of trial evidence, I said "secret" as in know outside knowledge of ruling/decision. If the rulings are all secret, oversight is impossible. It's not just the US FISA courts that make "secret" rulings, but the UK has numerous secret courts as well.

          We have had a similar discussion before. I _agree_ that some things should not be public knowledge. Plans for making weapons, locations of CIA houses, lists of operative names, etc.. are all fine to be restricted from the public. We don't need those to be available to have discussion on mass surveillance. The public should be aware of the Government plans to scoop all data from everyone everywhere using ever possible means including those that are considered illegal by their respective countries laws.

          For example, if you start dumping all of the traffic from a site you could (and perhaps would depending on the target) go to jail based on numerous wiretapping laws related to computers. The list of laws is extensive, I'll suggest you get a book on CEH, CISSP, etc.. that explain those all of those laws. If the Government is going to break all of those laws, that should be a matter of public knowledge and debate. Not the agents names, and maybe not even the agency doing the work. The actions are what is important.

          I mean, the government's using circular logic, and that's wrong. But the people raging against it are using equally broken logic. And there's perfectly good discussion not happening because everyone flung themselves to the polar extremes. Why?

          I don't agree with there only being two extremes, and I don't agree that the majority of the discussion about mass surveillance is using broken logic. Most of the discussion against it has been using law which is not circular. The Government debate for mass surveillance is mostly that they don't have to follow the law, which is also not circular logic.

          • I searched high and low in your post for some kind of disagreement. And I'll be damned, but you didn't put any in. You just backfilled what I said in more detail. O__O My tenuous grip on reality might have just slipped a bit more at the notion that this is now four exchanges in, and there's no sign of anything but civilized discourse yet. Quick, make a Hitler reference before I pass out from shock!

            • by s.petry (762400)
              Sieg Heil?
            • by s.petry (762400)

              On a serious note, I mentioned before that I believe we agree on numerous principles. I also think you are either used to people being disagreeable, so jump to a defensive posture quickly during dialogue.

              Reading many of your posts, I believe the first to be truthful though admit that we disagree on details. The latter, take for what it's worth. I do the same on occasion, but try to improve my temperament.

        • Re:Heh. (Score:5, Insightful)

          by Heed00 (1473203) on Monday November 11, 2013 @12:38PM (#45391993)

          They have to know that it's necessary at some level...

          If by "it" you mean some sort of surveillance that's targeted, based on suspicion and granted on a case by case basis by an oversight (court, law, etc.) body that's just not a rubber stamp factory, then yes -- but I haven't really seen anyone argue against that, so I don't know where you are getting the notion of a false dichotomy.

          Unless by "it" you mean "suspicionless mass surveillance" -- in which case, no, it is not necessary at some level.

          • but I haven't really seen anyone argue against that, so I don't know where you are getting the notion of a false dichotomy.

            Sometimes in waiting rooms and airports, they have CNN or Fox News on. Sometimes I get trapped in those places and forget to bring my TV-B-Gone. I assure you, it's not intentional... but sometimes you just hear these sorts of things. As I understand it though... a lot of people purposefully watch the "news", and regrettably do not carry covert ways of turning off banks of televisions. I don't really understand it myself, but, I guess watching the "news" is a thing in society.

        • The problem is when secrecy exceeds its mandate

          The problem is that without detailed and extensive oversight of the secrecy, it *will* exceed it's mandate. It's simply human nature.

        • by AmiMoJo (196126) *

          They have to know that it's necessary at some level, but they reduce this wide breadth of space from no surveillance to police society to a binary.

          Ironically the GP didn't make that assumption, you did. He was merely arguing that the current oversight situation is unacceptable, and in particular the fact that both the rules and rulings are secret is problematic.

          I see this a lot on Slashdot. No-body assumes any argument they disagree with is rational, and every debate polarizes into people who think the other side are all extremists and morons.

        • Re:Heh. (Score:5, Insightful)

          by interkin3tic (1469267) on Monday November 11, 2013 @02:28PM (#45393111)

          What irks me is people's reactionary "teh guv'ment's tryin' to take away mah freedomz!" to every discussion presented about government surveillance and/or intelligence activities. They have to know that it's necessary at some level, but they reduce this wide breadth of space from no surveillance to police society to a binary. I don't understand why so many people engage in black and white thinking when the problem so obviously isn't as clear cut as the overwhelmingly vast majority of people argue it is.

          I'd suggest the overreaction is caused by the government's actions. Looking at the level of lying going on with NSA, and how many abuses the war on terror has been used to justified, I can't fathom how anyone would make a "lets not throw the baby out with the bathwater." They've justified an overreaction toward the side of freedom rather than security. I think at this point it's only safe to assume the worst of the government.

          It seems pretty black and white to them. There seem to be alarmingly few voices inside the government expressing concern over moving to a police state. Those few that do seem to be expelled through groupthink, see Snowden and Manning for examples. Even very high government officials who voiced opposition were subject to backlash. Ashcroft decided stellar wind went too far. Bush sent people to harass him in the hospital trying to get him to cave. The attorney general, they did this to. And Bush went around him anyway. There seems to be no line the government isn't willing to cross.

          Partisan politics as of late have also convinced me that the only way to fight determined zealots is with equally determination in the opposite direction. When you try to be reasonable with such stubbornness, you don't arrive at a middle ground that's a good balance for all, you end up being pushed backwards more and more. So if the government is willing to go full throttle towards police state, the only response is for us to go full throttle... whatever the opposite is. No state secrets. Ever. Oh, that will potentially endanger people? I'm dubious. There's two giant oceans between us and most people who would harm us, we have enough military might to literally kill everyone on earth, and anyone who would attack us is too dumb to cause any real damage. Moreover, we've faced bigger threats before without spying on everyone. You can't tell me we need the NSA spy program to defeat a bunch of islamic cultists but we DIDN'T need it to defeat the Nazis or get through the Cold War.

          Even if it does endanger some people, I can live with that on my conscience better than I can live with allowing big brother to develop.

        • Trainee-

          You are an apologist for an overreach of which you don't seem to fully comprehend or appreciate.

          In the early days of these Snowden releases, Senator Nancy Pelosi represented your perspective. She downplayed the NSA programs saying there was full Congressional oversight and she had been aware of them through her briefings and they were ok.

          Every week she was asked by reporters, "Did you know about such-and-such, and did you approve of it?" Early on she answered "Yes" to these queries. But somew
      • Re:Heh. (Score:4, Informative)

        by AmiMoJo (196126) * <mojo @ w orld3.net> on Monday November 11, 2013 @01:48PM (#45392689) Homepage

        Read their statement carefully. They say it was "authorized" and "necessary", but not "legal". As recent Snowden leaks have shown they know it isn't legal, but seem to have the support of politicians and the police since there has not been a criminal investigation started.

    • I expect that it was the People's Chamber [wikipedia.org], or "Volkskammer*," that granted the Stasi it's authority to spy.

      In the UK it would be up to the democratically elected Parliament to pass legislation authorizing GCHQ's work.

      * To an English speaking ear that is oddly similar to Volks hammer or people's hammer. Oddly appropriate in reference to the Stasi which combined both surveillance and repression. I think I would also stay away from any "People's Courts."

    • Re:Heh. (Score:5, Interesting)

      by lorinc (2470890) on Monday November 11, 2013 @11:55AM (#45391555) Homepage Journal

      It's funny to see people finally realize that the world we're headed to is very similar to that of East Germany, with the slight difference that you won't be assured to have a house, a job and food every day. Probably these points were not among the good things to retain from the Commies, whereas global surveillance was.

      • with the slight difference that you won't be assured to have a house, a job and food every day.

        You need to go back and look at some of the photos of East Germany once the wall came down. Not everyone had a house, a job, and food every day. That's one of the compelling reasons why they kept trying to cross to West Germany; Economic conditions.

      • by houghi (78078)

        They were not retained. They were developed individually. That is even scarier.

        Also scary is the fact that it crept up and became slowly worse over a period of , say, 50 years. I am afraid that if you want to reverse it in a democratic way, it will take another 50 years. And I have NO idea if it is even possible to put the genie back in the bottle.

        When I was 15, I had discussions about what privacy was. We had images of a high political person that would harm his career AND he was not of our political idea.

      • I'm of the opinion that the fall of the USSR has hurt not just its former citizens, but just about everyone in the world. The loss of ideological competition has opened up the flood gates of corruption in western democracies. The loss of military competition has slowed our scientific progress significantly. Economy-wise we seem to be headed towards something resembling feudalism. How exactly we will dig ourselves out of this I don't know.
  • https? (Score:5, Insightful)

    by Anonymous Coward on Monday November 11, 2013 @11:33AM (#45391335)

    So, when is Slashdot going to turn on https and stop the attack vector?

    • Re:https? (Score:5, Insightful)

      by Gravis Zero (934156) on Monday November 11, 2013 @11:52AM (#45391527)

      So, when is Slashdot going to turn on https and stop the attack vector?

      the real question is when will the internet switch to an uncompromised encryption scheme.

      • by smash (1351)
        Nah, the real question is when more than 1% of the internet's user base give a shit enough to be concerned enough to even consider whether or not the remote site they are talking to is trustworthy. Let's start with trying to stop them from opening attachments first, then we'll worry about solving global surveillance issues, eh? Baby steps.
    • by Nerdfest (867930)

      If you use Linux, it's actually quite easy to turn on DNSSEC, which I assume would help mitigate this problem.

    • Re:https? (Score:4, Insightful)

      by ledow (319597) on Monday November 11, 2013 @11:58AM (#45391587) Homepage

      When they enable IPv6 and stop publishing IPv6 stories, most probably.

    • Re:https? (Score:5, Insightful)

      by ColdWetDog (752185) on Monday November 11, 2013 @12:10PM (#45391693) Homepage

      No need. All you have to do is insert some unicode in your post or response. If it renders correctly either 1) Hell just froze over or 2) You've been pawned.

      • Re:https? (Score:4, Funny)

        by girlintraining (1395911) on Monday November 11, 2013 @12:30PM (#45391893)

        2) You've been pawned.

        1.e4 e5
        2.Bc4 Nf6
        3.d3 c6
        4.Bg5 h6
        5.Bxf6 Qxf
        6 6.Nc3 b5
        7.Bb3 a5
        8.a3 Bc5
        9.Nf3 d6
        10.Qd2 Be6
        11.Bxe6 fxe6
        12.O-O g5
        13.h3 Nd7
        14.Nh2 h5
        15.g3 Ke7
        16.Kg2 d5
        17.f3 Nf8
        18.Ne2 Ng6
        19.c3 Rag8
        20.d4 Bb6
        21.dxe5 Qxe5
        22.Nd4 Kd7
        23.Rae1 h4
        24.Qf2 Bc7
        25.Ne2 hxg3
        26.Qxg3 Qxg3+
        27.Nxg3 Nf4+
        28.Kh1 Rxh3
        29.Rg1 Rxh2+

        You were saying?

  • Fuck the fuck off!
  • I have a hard time believing that someone convinced them this site was worthwhile. Was this just some kind of training exercise for them, to make sure that they could handle the traffic volume from a dying site before they go and try to intercept traffic from one that is relevant?
    • I have a hard time believing that someone convinced them this site was worthwhile.

      That's because you're letting your ego get in the way. This isn't about you. This is about one or more specific targets that they believed or suspected were slashdot users.

      • I have a hard time believing that someone convinced them this site was worthwhile.

        That's because you're letting your ego get in the way. This isn't about you.

        I don't for a moment suspect this is about me. I'm incredibly uninteresting in pretty much every conceivable metric. My argument is that there are so few slashdot users at this point that the likelihood of anyone on here being worthwhile is remote at best.

        This is about one or more specific targets that they believed or suspected were slashdot users.

        I would think they'd have better luck on 4chan.

      • That's because you're letting your ego get in the way. This isn't about you. This is about one or more specific targets that they believed or suspected were slashdot users.

        We're probably not talking about people with their fingers on the detonators of bombs. More likely people who criticize certain people in power, you know, common slashdot conversations. Maybe it's MY ego getting in the way, but slashdot more and more is becoming the modern Federalist Papers, and that has to be of concern to the powers at be.

    • by Captain Hook (923766) on Monday November 11, 2013 @11:41AM (#45391411)

      Really? British intelligence went after slashdot?

      No, the target were Belgium Telco workers.

      GCHQ needed a way to insert malicous scripts on the workers PC in order to gain a foothold on the Belgium Telcoms networks. The way they did that was to run a man-in-the-middle attack on the sites that those workers were going to visit.

    • by s.petry (762400)

      I have a hard time believing that someone convinced them this site was worthwhile. Was this just some kind of training exercise for them, to make sure that they could handle the traffic volume from a dying site before they go and try to intercept traffic from one that is relevant?

      Sites like Slashdot and Reddit are very legit targets. If you want to measure public opinion you actually need sites like this. I'm sure that they also scan forums on intellectual sites like Science, etc... How do you know how to spin things, or continue to spin things, if you don't know how much information the public has.

      Do I think they use it to track individual users? I have no evidence of this, but that does not mean it does not happen. If we can't see what they do I have no trust in them. If they

      • If you want to measure public opinion you actually need sites like this.

        This site skews so hard to the right that they'd be just as well off scanning an NRA forum. Saying that it accurately gauges public opinion on a whole is laughable.

        How do you know how to spin things, or continue to spin things, if you don't know how much information the public has.

        This site would show a lot of how little some vocal subset of the public has. As far as representing a cross-section of the public as a whole it is pretty near useless.

        • by s.petry (762400)

          This site skews so hard to the right that they'd be just as well off scanning an NRA forum. Saying that it accurately gauges public opinion on a whole is laughable.

          I never claimed that this site was the whole of the public, take my generalization "sites" very literally. The generalization should have been obvious due to listing other potential sites to target.

  • by Nerdfest (867930)

    I detect the odour burning trousers.

  • 'We have no comment to make on this particular story.' It added: 'All GCHQ's work is carried out ....

    Sure looks like a comment to me.

  • for a minute there I thought america was the only country that invented a secret court to grant secret warrants to undisclosed agencies seeking to wiretap undisclosed targets.
    turns out now that everything you did to slashdot is "legal" we can move on to more pressing issues like when are we getting more Doctor Who? I feel like personally thats the only way i could ever call the whole 'we have no respect for the internet' thing squaresies
  • "We have no comment to make on this particular story."

    How is this a response?

    • by Joining Yet Again (2992179) on Monday November 11, 2013 @11:52AM (#45391515)

      Assuming this isn't a hoax, feathers successfully ruffled.

      How often does GCHQ make an official statement in response to some random guys on the Internet claiming that they overstepped their bounds? It's surely not setting a precedent, so why has it respnded to this one?

      ["no comment"]
      [junior PR flunky boilerplate sounding like it's from a FTSE 100 corp.]

      • by ledow (319597)

        Er... it hasn't.

        It's responded with "No Comment" like it has for just about every media outlet that has ever asked it.

        It might even be legally bound to reply to "press enquiries", in whatever form. I'm pretty sure if I wrote them a letter, they would reply. Most likely with a similar response.

        Just because they're spies does not mean they don't have a press office and/or a secretary who just fobs off anyone who asks. Hell, you can get replies from Santa if you post them in a Royal Mail postbox (even if yo

    • by smash (1351)
      Of course it is a response. "Yes, we received your message".
  • I'm very glad they have this in place. Just knowing they are policing themselves with laws made to fit within the policies they've made up makes me feel so much better now. I'll never have to worrry about privacy again.

    • by Virtucon (127420)

      Yes we can all feel safer that there's checks and balances to ensure that we don't do bad things.

  • "Yeah, we hacked your shit. Now GFO."
  • With all the uproar over US spying, you could always use a Tor solution that excludes US and US intelligence friendly exit nodes. PAPARouter [paparouter.com] (disclaimer: my company) is a router that has Tor in it and US and US friendly exit nodes are excluded (US, UK, Australia, New Zealand and all Commonwealth countries) by default. Anonymize several devices just hooking to the wireless access point. (Or build your own Onion-Pi from Adafruit and save a couple of bucks)
  • Very nice to see!
  • by Anonymous Coward

    we have never cooperated with any government agency

    What they mean to say is, "We have never cooperated with any government agency, unless compelled by law, or because the FBI asked nicely while threatening to throw us in jail, and even if we did cooperate, we aren't allowed to reveal that we did, and even if we are allowed to reveal that we did, we wouldn't because that would make us look bad."

    • by Hartree (191324)

      Actually what they meant to say was: "The NSA pays AT&T and others millions every year for data, and the GCHQ didn't even offer us a damn dime! Wankers."

  • From TFS: "However, the story has been slightly garbaged into it being fake [LinkedIn and Slashdot] accounts, as opposed to network spoofing."

    What on earth is "garbaging"? I always thought "garbage" was a noun. "Verb-ing" nouns is a time-honored tradition, but there are plenty of perfectly good verbs that would have worked here (mangled is the first that comes to mind) without devising a new one that is confusing, at best, in this context.

    A quick googling does reveal garbaging as a verb, but in contexts t

  • Of course, they haven't broken any/all the laws, because some secret people in secret room said so.

    Laws only apply to "other people", obviously.

  • I made a lot of the technology your horticultural sector needs to stay alive (and even got on the BBC for it so you know I'm not fucking joking.) Don't piss me off or you'll find the British Pound suddenly worth as much as a Zimbabwe dollar.

    Backdoors and insurance. Much like Edward Snowden, I always carry a trump card or ten.

    Game on, you fuckin' wankers.

  • How do I know I'm on the real Slashdot right now then? Quick, someone post something snarky and bitch about Microsoft or I'll assume this is a fake.
  • Hi,

    the main problem is that anybody entering slashdot.org in the addressbar expects to get the data slashdot sends,
    but as this MIM attack has shown, this data can be altered even for hand picked connections, these attacks were discussed in the past.

    So we have a key problem here:

    data transmission is compromised (yes even now it is compromised, because european traffic travels over great britian)
    - by this compromise I cannot authentificate that slashdot.org data is really displayed to me (I cannot authentific

It's time to boot, do your boot ROMs know where your disk controllers are?

Working...