7 ms·

It also highlights the risks of NSA exploiting zero-days and creating malware to conduct offensive operations, rather than reporting vulnerabilities to the vend

It also highlights the risks of NSA exploiting zero-days and creating malware to conduct offensive operations, rather than reporting vulnerabilities to the vendor to make everyone safer. Now these tools have been stolen by one of their adversaries, and may make it out into the public for anyone to take advantage of. I just watched an excellent documentary called "Zero Days" (https://weshare.me/823adb83b8e98628 https://weshare.me/823adb83b8e98628) this morning about the whole Stuxnet (aka Olympic Games) debacle. They really are playing with fire.

2close4comfort 10y ago
A fire that they are showing they do not know how to control.
- derpadelt 10y ago
  They do not know how to perfectly control it. Given the obviously huge scale at which they operate, it seems to work reasonably well. Yet the huge scale is exactly what scares the socks off of knowledgable people - even more than a fire here and there. Their PR problem is that the number of times they successfully work in the dark is somehow confidential...
  - 2close4comfort 10y ago
    You have got it right there! Breaking into a system is easy keeping yours intact is not. That is part that the US GOV still doesn't get the defensive part of the equation. BS (Before Snowden) people suspected but now we know people are listening everywhere. And even the NSA is not immune...that is scary that no matter how good your InfoSec is that your IA is lagging far behind.
  - marcosdumay 10y ago
    It's the consequences, not their size. "Look, we've put off 99.9% of the fires we started last week. Your complaint about we completely burning 2 cities down is baseless, you can't reasonably expect our fire-control to get any better."
diggan 10y ago
Slightly off-topic but I also tried to watch "Zero Days" since the subject interest me. But, with the constant exaggeration and dumbing down of the subject, I could only watch about 20 minutes before I turned it off. If you want something technical that is not exaggerated, you better watch something else. If someone have an recommendation, please share.
- peterkelly 10y ago
  I recommend sticking through till the end. The first 20 minutes just sets the scene - the story gets a lot more interesting once it links up the technical stuff with geopolitics and the relationship between US & Iran, and what they did to the centrifuges. The last part has some insightful commentary by a number of experts on the new world of so-called "cyber warfare" that we're entering into.
- wepple 10y ago
  have you read Countdown to zero day: https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1#nav-subnav https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?... ? It is ultimately penned for the masses, but even if you're technical you'll likely enjoy it. And there's plenty of scope for going off and doing your own research about bits and pieces.
- dmix 10y ago
  The book '@War: The Rise of the Military-Internet Complex' by Shane Harris from The Daily Beast is very good and talks about the obsessions with offensive weapons. And the embarrassingly bad defensive posture the US has via policy failure (ie: focusing on private-public info sharing deals that do nothing, instead of real defence) and inter-agency fighting. https://www.amazon.com/War-Rise-Military-Internet-Complex/dp/0544570286/ https://www.amazon.com/War-Rise-Military-Internet-Complex/dp...
  - linkregister 10y ago
    > focusing on private-public info sharing deals that do nothing, instead of real defence Can you elaborate? I haven't been exposed to any ideas that address this without compromising civil liberties. That is, "real defence" sounds like the government monitoring internet connections to my company for malicious activity. I don't think that's good for business. I might be thinking a little close-minded about it though. Please share what you mean.
JustSomeNobody 10y ago
Question: Does the NSA have an obligation to be ethical?
- peterkelly 10y ago
  I would argue yes, in the sense that all of us do (both in our professional and personal lives). The US likes to promote itself as the "good guys", and if they want that reputation, they have to earn it. NSA's activities are in direct conflict with that ideal. Society only functions properly when people act ethically. We have laws in place for punishing those who harm others in various ways (financially, physically, etc.), as a means to discourage bad behaviour. In theory there's supposed to be international law, but sadly no-one seems to pay much attention to it.
  - 2close4comfort 10y ago
    I would only add that the NSA has politicized themselves in exchange for the expansion of their powers. Now as a political entity it seems they have a much lower standard of ethics and now it is about maintaining power.
- ajdlinux 10y ago
  Does anyone on earth not have an obligation to be ethical? (Yes, I know there is no universally accepted definition of "ethical".)
  - thecatspaw 10y ago
    Yes, noone does. You are not bound by law to be ethical. There's no law about it. Are you _supposed_ to act ethical? absolutely. but you dont have an obligation
    - ajdlinux 10y ago
      Legal obligation being the only possible meaning of "obligation", obviously.
    - 10y ago
wepple 10y ago
Their adversaries likely won't make use of the tools for anything serious. They know the NSA already have detection capabilities for their own 0days, and using these tools is a dead giveaway to the NSA that they've been made. An adversary would do well to be very careful about their use of stolen knowledge. As for it hitting the public like this; I'm not sure we'll see this happening incredibly regularly.
drzaiusapelord 10y ago
>and may make it out into the public for anyone to take advantage of. Why would they do that? Its more likely they'll be kept for other attacks or sold to nation states for vast profits. I also suspect there's nothing magical going on at the NSA. Whatever zero days they have are probably had by other intelligence agencies and hacking groups. Whether to report them publicly is a political decision that these groups have zero incentive to make. Ethical researchers and white hats, from my understanding, are a very small part of the scene, or at least the part of the scene that gets real results.

2close4comfort 10y ago

A fire that they are showing they do not know how to control.

derpadelt 10y ago
They do not know how to perfectly control it. Given the obviously huge scale at which they operate, it seems to work reasonably well. Yet the huge scale is exactly what scares the socks off of knowledgable people - even more than a fire here and there. Their PR problem is that the number of times they successfully work in the dark is somehow confidential...
- 2close4comfort 10y ago
  You have got it right there! Breaking into a system is easy keeping yours intact is not. That is part that the US GOV still doesn't get the defensive part of the equation. BS (Before Snowden) people suspected but now we know people are listening everywhere. And even the NSA is not immune...that is scary that no matter how good your InfoSec is that your IA is lagging far behind.
- marcosdumay 10y ago
  It's the consequences, not their size. "Look, we've put off 99.9% of the fires we started last week. Your complaint about we completely burning 2 cities down is baseless, you can't reasonably expect our fire-control to get any better."

diggan 10y ago

Slightly off-topic but I also tried to watch "Zero Days" since the subject interest me. But, with the constant exaggeration and dumbing down of the subject, I could only watch about 20 minutes before I turned it off. If you want something technical that is not exaggerated, you better watch something else. If someone have an recommendation, please share.

peterkelly 10y ago
I recommend sticking through till the end. The first 20 minutes just sets the scene - the story gets a lot more interesting once it links up the technical stuff with geopolitics and the relationship between US & Iran, and what they did to the centrifuges. The last part has some insightful commentary by a number of experts on the new world of so-called "cyber warfare" that we're entering into.
wepple 10y ago
have you read Countdown to zero day: https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?_encoding=UTF8&btkr=1#nav-subnav https://www.amazon.com/dp/B00KEPLC08/ref=dp-kindle-redirect?... ? It is ultimately penned for the masses, but even if you're technical you'll likely enjoy it. And there's plenty of scope for going off and doing your own research about bits and pieces.
dmix 10y ago
The book '@War: The Rise of the Military-Internet Complex' by Shane Harris from The Daily Beast is very good and talks about the obsessions with offensive weapons. And the embarrassingly bad defensive posture the US has via policy failure (ie: focusing on private-public info sharing deals that do nothing, instead of real defence) and inter-agency fighting. https://www.amazon.com/War-Rise-Military-Internet-Complex/dp/0544570286/ https://www.amazon.com/War-Rise-Military-Internet-Complex/dp...
- linkregister 10y ago
  > focusing on private-public info sharing deals that do nothing, instead of real defence Can you elaborate? I haven't been exposed to any ideas that address this without compromising civil liberties. That is, "real defence" sounds like the government monitoring internet connections to my company for malicious activity. I don't think that's good for business. I might be thinking a little close-minded about it though. Please share what you mean.

JustSomeNobody 10y ago

Question: Does the NSA have an obligation to be ethical?

peterkelly 10y ago
I would argue yes, in the sense that all of us do (both in our professional and personal lives). The US likes to promote itself as the "good guys", and if they want that reputation, they have to earn it. NSA's activities are in direct conflict with that ideal. Society only functions properly when people act ethically. We have laws in place for punishing those who harm others in various ways (financially, physically, etc.), as a means to discourage bad behaviour. In theory there's supposed to be international law, but sadly no-one seems to pay much attention to it.
- 2close4comfort 10y ago
  I would only add that the NSA has politicized themselves in exchange for the expansion of their powers. Now as a political entity it seems they have a much lower standard of ethics and now it is about maintaining power.
ajdlinux 10y ago
Does anyone on earth not have an obligation to be ethical? (Yes, I know there is no universally accepted definition of "ethical".)
- thecatspaw 10y ago
  Yes, noone does. You are not bound by law to be ethical. There's no law about it. Are you _supposed_ to act ethical? absolutely. but you dont have an obligation
  - ajdlinux 10y ago
    Legal obligation being the only possible meaning of "obligation", obviously.
  - 10y ago

wepple 10y ago

Their adversaries likely won't make use of the tools for anything serious. They know the NSA already have detection capabilities for their own 0days, and using these tools is a dead giveaway to the NSA that they've been made. An adversary would do well to be very careful about their use of stolen knowledge. As for it hitting the public like this; I'm not sure we'll see this happening incredibly regularly.

drzaiusapelord 10y ago

>and may make it out into the public for anyone to take advantage of. Why would they do that? Its more likely they'll be kept for other attacks or sold to nation states for vast profits. I also suspect there's nothing magical going on at the NSA. Whatever zero days they have are probably had by other intelligence agencies and hacking groups. Whether to report them publicly is a political decision that these groups have zero incentive to make. Ethical researchers and white hats, from my understanding, are a very small part of the scene, or at least the part of the scene that gets real results.