Skip to content
Hallway
0:00 / 0:00

#poul-henningkamp#nsa#openssl

NSA operation ORCHESTRA: Annual Status Report

HUP

317 subscribers • 1 video on Hallway

YouTube
  • Recommended by 10 people: 9 on Hacker News and 1 in engineering communities.
  • A classic. People kept recommending it from 2014 to 2019.
  • Presented by Poul-Henning Kamp, FreeBSD developer
  • An opinion. It argues one side of a question engineers disagree on.

Intermediate. Assumes working knowledge.

29K views12 years ago10 recommendations

SecurityTools and practiceWeb and application securityExploits and vulnerabilitiesCryptography

Poul-Henning Kamp delivers a hypothetical report on how intelligence agencies sabotage open-source software, standards, and security libraries like OpenSSL.

Poul-Henning Kamp (FreeBSD developer) @ FOSDEM '14 2014. február 2. License: CC BY

Why it's here

10 people recommend this

What people say. Recommended as an eye-opening talk on how subtle software complexity and bad standards can be exploited for state-sponsored surveillance.

ensmotkoon Hacker News • Recommends

On “"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"”

Check out phk's fosdem talk0. I've linked to the the part where he talks about openSSL, but I'd suggest watching the whole thing. I'm now starting to believe the talk wasn't a joke at all... 0 link to this video
View on Hacker News

TacticalCoderon Hacker News • Recommends

On “"OpenSSL has exploit mitigation countermeasures to make sure it's exploitable"”

There's a talk that was given in Belgium / Brussels at FOSDEM2014 two months ago or so by Poul-Henning Kamp (FreeBSD) regarding the NSA and how he'd do it if he had to create holes in software: link to this video He's talking specifically about OpenSSL quite a lot (basically saying it's too complex to ever be secure and probably received many "security patches" from NSA employees). The entire talk is an eye opener. He explains how NSA shills are reading reddit / HN and poisoning communities / standards / protocols / etc. How everything is made, on purpose, needlessly complex to prevent honest developers from working on important things. He talks about shills submitting a few correct patches over the mo…
View on Hacker News

higherpurposeon Hacker News • Recommends

On “Julian Assange: "Debian Is Owned By The NSA"”

Debian's 2006 PRNG anyone?! Maybe these are stupid dumb mistakes, but if I were NSA this is exactly how I'd implement backdoors. 2 lines of code cloned here (go to fail), 2 lines of code commented out there (Debian PRNG issue), and just like that you create huge vulnerabilities in the system. Hard to notice, and impossible to blame on anyone. Everytime they seem to be some brilliant "stupid mistakes". And as others have said, do listen to the FreeBSD developer's talk on NSA' ORCHESTRA operation (subverting open source projects): link to this video
View on Hacker News

notdonspauldingon Hacker News • Recommends

On “PHK: OpenSSL must die, for it will never get any better.”

Also worth watching is his FOSDEM talk where he was calling for this before news of Heartbleed broke. link to this video
View on Hacker News

romanovcodeon Hacker News • Recommends

On “IBM, Microsoft, Facebook, Google, others pledge $3.6 million to fund OpenSSL”

OpenSSL source code is a disaster. It's spaghetti that doesn't do what you think it does with horrible documentation. People submit patches from people they don't even know and then you have it: An SSL library that is flawed but everyone is using it. An spying agency and hackers dream. We don't need OpenSSL, we need another library built from scratch with very clean code and documentation. Everyone who has more interest on why OpenSSL is a catastrophe should watch operation ORCHESTRA0. 0 link to this video
View on Hacker News

AlyssaRowanon Hacker News • Recommends

On “Making sure crypto remains insecure [pdf]”

Hmmm… and ElGamal's signing scheme didn't qualify? I don't think that's a reason, or even an excuse: Schnorr actually did claim his patent read on DSA. (That obviously never went anywhere, and the US Government, in a show of force via the NSA, filed their own patent on DSA.) The NSA also really doesn't seem to have had much of a problem negotiating the licensing of patents with industry participants in the past! It is, after all, in an extraordinarily strong bargaining position: an awful lot of public money to throw around (openly, via on-the-book government contracts, and otherwise); the backing of a 'superpower' government and its negotiators; a remarkably good idea of what the position of…
View on Hacker News

hackermailmanon Hacker News • Recommends

On “Ask HN: What is your favourite tech talk?”

This talk was an interesting thought experiment by PhK of FreeBSD on how if he were tasked by some agency to sabotage open source projects and standards how he would go about doing it link to this video A talk by Robert Harper at OPLSS in 2017 is really good as well, covering the basics of programming language background link "concrete syntax is where computer science meets psychology.... at the moment it's all a matter of opinion"
View on Hacker News

no_identdon Hacker News • Recommends

On “Microwave Weapons Are Suspect in Ills of U.S. Embassy Workers”

…e not to take it seriously :) Indeed, it would. A lot of clever people have discussed the issue of disinfo & FUD, you might wish to: * Watch this talk from FOSDEM '14 by Poul-Henning Kamp [Contextually, one important tidbit to keep in mind while watching it: At the time phk gave the talk, the heartbleed vulnerability in OpenSSL wasn't yet known!]: link to this video * and, perhaps, read these two blog posts, but tread carefully with those two, as, unlike the above video, the below edges MOST dangerously close to basket case conspiracy theory territory - arguably, it doesn't get there, but I can definitely say that if one slips while looking into the below, one'll immediately end up in basket case terri…
View on Hacker News

askmikeon Hacker News • Recommends

On “Signal: Incoming call can be connected without user interaction”

I think open-source software is great as well, but assuming these kind of bugs are found because you can inspect the code is very wishful thinking that doesn't always hold up. This specific example required a Google department to find it. Who would have found it if Google got restrained by the NSA?. Other notable examples include openSSL. On top of that, here is a great talk about how easy it would be to infiltrate open source projects: link to this video
View on Hacker News

u/malcolmiin r/netsec • Recommends

Poul-Henning Kamp: NSA operation ORCHESTRA - Annual Status Report
1View on Reddit

glomphon Hacker News • Mentions

On “America Online to Buy Internet Chat Service for $287 Million (1998)”

Is it insane to speculate that pressure is coming from government agencies? In a talk at Fosdem Poul-Henning Kamp talks about the pretty insane timeline with skype and how much it potentially benefited the NSA. link to this video
View on Hacker News

sitkackon Hacker News • Mentions

On “The Heartbleed Bug”

Steps for better security 1. use a managed language 2. use a provable language (Haskell, Idris, etc) Effective Psyops Against Standards and Open Software link to this video
View on Hacker News

antientropicon Hacker News • Mentions

On “OpenSSL is written by monkeys (2009)”

I guess you don't agree with Poul-Henning Kamp in his FOSDEM keynote this year: link to this video (around 15:00) His claim is that browsers treating websites with self-signed certificates as less secure than non-encrypted websites by displaying big fat warnings is just about the greatest gift we can give to organisations like the NSA. It's not true that there is no material distinction between an active attack and passive eavesdropping. For the NSA to do active MITM attacks on all self-signed https traffic (in a world where all unencrypted http is replaced with self-signed https) would take massively more resources than passively monitoring unencrypted traffic. Plus the odds of them getting caught wou…
View on Hacker News

perlpimpon Hacker News • Mentions

On “Shall we fork Debian?”

…go for example? There might be some influence on behalf interested governmental parties giving a push to systemd. I don't have a problem with systemd its just I think it should have been an option not a default for server setups. C programs if they are not really carefully coded can be easily hacked by stack smashers, race condition inducers etc. link to this video…
View on Hacker News

glitchdouton Hacker News • Mentions

On “Assange: Google Is Not What It Seems”

This is straight out of NSA's manual to manipulate online discourse. You can read more about it here: * Revealed: US spy operation that manipulates social media 1 * How Covert Agents Infiltrate The Internet To Manipulate, Deceive, And Destroy Reputations 2 Poul-Henning Kamp, in a hypothetical talk about his work at the NSA, talks about just this. 3 Here's a quote: > The idea is to steer discussions in these forums to or from particular topics (...) and disrupt consensus building against our purposes 1: link 2: link 3: link to this video
View on Hacker News

broheeon Hacker News • Mentions

On “HTTP/2.0 — Bad protocol, bad politics”

His technical prowess are only matched by his privacy champion credentials, see e.g. his Operation ORCHESTRA talk link to this video
View on Hacker News