NSA opens a github account

[vorticalbox]

https://nationalsecurityagency.github.io/

 

opening up software they have developed to everyone. These include:

 

DCP
A program that reduces the timespan needed for making a forensic copy of hard drives for forensic analysis.

 

MAPLESYRUP
Assesses the security state of an ARM-based device by examining the system register interface of the processor.

 

SECURITY-ENHANCED LINUX (SELINUX)
A mandatory access control mechanism in the Linux kernel that checks for allowed operations after standard discretionary access controls are checked. It can enforce rules on files and processes in a Linux system, and on the actions they perform, based on defined policies. SELinux has been part of the Linux kernel since version 2.6.0.

 

SECURITY ENHANCEMENTS FOR ANDROID (SEANDROID)
Confines privileged processes based on security policies by enforcing mandatory access control over all Android processes. SE for Android has been part of Android since Android 4.3.

 

any many others, its nice to see an agency becoming more open though this probably to get back in the good books after wanna cry.

[You_are_a_cunt]

Someone's trying to get some positive PR.

 

I might actually give DCP a shot once I'm sure it's not all just a scam to get a backdoor into people's systems by offering "free tools" to the general populous

[Bouzoo]

Plot twist when all published software has a built in backdoor.

[You_are_a_cunt]

@Trik'Stari is already ordering more tinfoil.
 

[tarmacd]

"I'm from the government, and I'm here to help"

 

Cue skepticism here...

[vorticalbox]

16 minutes ago, revsilverspine said:

Someone's trying to get some positive PR.

 

I might actually give DCP a shot once I'm sure it's not all just a scam to get a backdoor into people's systems by offering "free tools" to the general populous

i recently started getting into data forensics and recovery so far I've use dd and ddff something to take a copy of a drive anything to speed up that process is good in my books. 

[SCHISCHKA]

24 minutes ago, revsilverspine said:

Someone's trying to get some positive PR.

 

I might actually give DCP a shot once I'm sure it's not all just a scam to get a backdoor into people's systems by offering "free tools" to the general populous

If we have learnt anything from recent events it is not that they put back doors in but they with hold knowledge of exploits to create tools that then insert back doors. This is why I think selinux is dodgy. I assume they know how to fool it.

[Ryujin2003]

What's the proof that this is a legit GitHub account?

[TheKDub]

8 minutes ago, Ryujin2003 said:

What's the proof that this is a legit GitHub account?

I doubt they would have a legitimate NSA email address at the bottom for people to contact with questions about the stuff if it was fake.

[vorticalbox]

2 hours ago, Ryujin2003 said:

What's the proof that this is a legit GitHub account?

 

2 hours ago, TheKDub said:

I doubt they would have a legitimate NSA email address at the bottom for people to contact with questions about the stuff if it was fake.

I have spent a while looking on the nsa twitter and on search engines but haven't found an "official" statement in regards to its authenticity.

[BuckGup]

100% sure it's fake

[GOTSpectrum]

3 hours ago, tarmacd said:

"I'm from the government, and I'm here to help"

The scariest sentence in the English language!

[Guest]

4 hours ago, vorticalbox said:

snip

it'd be pretty funny if some 6th grader thought of this. 

[Sauron]

4 hours ago, Bouzoo said:

Plot twist when all published software has a built in backdoor.

Well since it's open source I give it 3 days until someone notices that if it really is the case. Either way SELinux has been around for years, SEandroid too - in fact I'm surprised there wasn't a git archive for those somewhere already.

[Orangeator]

50 minutes ago, BuckGup said:

100% sure it's fake

Looks pretty legit to me tbh. I might be wrong, but I think it is legit.

[NumLock21]

5 hours ago, revsilverspine said:

@Trik'Stari is already ordering more tinfoil.
 

Foil won't be enough.

 

[vanished]

12 hours ago, vorticalbox said:

DCP
A program that reduces the timespan needed for making a forensic copy of hard drives for forensic analysis.

It saves time by skipping pieces and then injecting false data to plant evidence

/s

but actually I wouldn't be surprised.

[Delicieuxz]

Are the files on the account all open source?

[DKL]

1 hour ago, Delicieuxz said:

Are the files on the account all open source?

If they aren't they will be

[straight_stewie]

Well, I'm not sure if it's real or not. We know that GCHQ maintains a github, so it stands to reason that other FVEY members might jump on the bandwagon.

However, I've been reading some of the stuff they've posted. Some of it is pretty slick, others is stupid. Here's an example of stupid, overengineered solutions: https://github.com/iadgov/Control-Flow-Integrity/blob/master/paper/Hardware Control Flow Integrity for an IT Ecosystem.pdf

The paper seeks to identify a way to, in hardware, prevent buffer overflow exploits. It uses things like "control flow graphs" and such, but I can easily think of a much simpler, much more historied way: Just switch to harvard architecture rather than von neumann architecture computers. So you lose the ability to do metaprogramming and reflection (which are actually very important things that there are alternatives to), but you gain so much in security.

Conversely, FEMTO seems like a pretty slick system to do parallel queries on arrays of binary data (and could be modified to support any type of data). I'll work on one of my old AIO's tonight, get an isolated test environment up and running, and start doing some testing tomorrow.
 

[Master Disaster]

So the CIA now want us to help them develop the tools they use against us, how nice of them.

[Tech_Dreamer]

[vorticalbox]

3 hours ago, straight_stewie said:

Well, I'm not sure if it's real or not. We know that GCHQ maintains a github, so it stands to reason that other FVEY members might jump on the bandwagon.

However, I've been reading some of the stuff they've posted. Some of it is pretty slick, others is stupid. Here's an example of stupid, overengineered solutions: https://github.com/iadgov/Control-Flow-Integrity/blob/master/paper/Hardware Control Flow Integrity for an IT Ecosystem.pdf

The paper seeks to identify a way to, in hardware, prevent buffer overflow exploits. It uses things like "control flow graphs" and such, but I can easily think of a much simpler, much more historied way: Just switch to harvard architecture rather than von neumann architecture computers. So you lose the ability to do metaprogramming and reflection (which are actually very important things that there are alternatives to), but you gain so much in security.

Conversely, FEMTO seems like a pretty slick system to do parallel queries on arrays of binary data (and could be modified to support any type of data). I'll work on one of my old AIO's tonight, get an isolated test environment up and running, and start doing some testing tomorrow.
 

do report back. 

2 hours ago, Master Disaster said:

So the CIA now want us to help them develop the tools they use against us, how nice of them.

NSA and is it really such a bad thing? Maybe you can find an way to get around the tool?