4 ms·

The assumption of NOBUS is equivalent to security through obscurity.

by Kenji 10y ago

tptacek 10y ago
No, it's not. I believe Schneier is simply abusing the term. As I've seen it deployed, "NOBUS" usually refers to capabilities protected cryptographically, not by kernel reference monitors that hide keys, but by actual secret keys. I don't believe zero-day vulnerabilities are considered "NOBUS" by NSA. That would be silly, because every time they're used on public-sector IP networks (which is usually where they're used!), they're disclosed.
- AnimalMuppet 10y ago
  > ... every time they're used on public-sector IP networks (which is usually where they're used!), they're disclosed. Could you explain what you mean by that? Do you mean that NSA discloses everything they use on public IP networks? If so, can you provide some references, because I have never heard of them doing so. Or do you mean that every time the NSA does so, they get caught and exposed? That seems to be based on the idea that we never hear of them using exploits on public IP networks without getting caught, which, if you think for a second, you realize is a completely silly argument. Or did you mean something else? If so, what?
  - tptacek 10y ago
    I mean that running the exploit discloses it to anyone who's doing full packet captures on the protocol the exploit uses.
    - AnimalMuppet 10y ago
      OK, so they're "disclosed" in the sense that "the information (in packet form) is released onto a public network". But that's potential discovery if someone is paying very close attention. And the point of a zero-day is that nobody's paying attention to that specifically, because nobody knows to do so yet. So, yes, somebody could have a packet capture of it, along with a billion other packets. So you're using "disclosure" here in a very restricted sense. It more normally means something more like "sending an email to the vendor" or "making a press release".
      - tptacek 10y ago
        To paraphrase someone smarter on these issues than I am: NSA's adversaries spend more on coffee than Cisco does on product security. When vulns like the ones we've seen are used on public networks, they are disclosed. The question isn't whether they're disclosed to vendors. It's whether they're NOBUS flaws. Schneier is suggesting NSA views them as NOBUS. They do not.
        srtjstjsj 10y ago
        you mean the NSA staff spends more on coffee than Cisco does on product security? otherwise, the claim makes no sense. the NSA's adversaries include huge swaths of non-security-conscious users, and includes Cisco.
        tptacek 10y ago
        The NSA's adversaries include the rest of the world's largest SIGINT agencies.

The assumption of NOBUS is equivalent to security through obscurity.

by Kenji 10y ago

The assumption of NOBUS is equivalent to security through obscurity.

No, it's not. I believe Schneier is simply abusing the term. As I've seen it deployed, "NOBUS" usually refers to capabilities protected cryptographically, not by kernel reference monitors that hide keys, but by actual secret keys. I don't believe zero-day vulnerabilities are considered "NOBUS" by NSA. That would be silly, because every time they're used on public-sector IP networks (which is usually where they're used!), they're disclosed.

AnimalMuppet 10y ago
> ... every time they're used on public-sector IP networks (which is usually where they're used!), they're disclosed. Could you explain what you mean by that? Do you mean that NSA discloses everything they use on public IP networks? If so, can you provide some references, because I have never heard of them doing so. Or do you mean that every time the NSA does so, they get caught and exposed? That seems to be based on the idea that we never hear of them using exploits on public IP networks without getting caught, which, if you think for a second, you realize is a completely silly argument. Or did you mean something else? If so, what?
- tptacek 10y ago
  I mean that running the exploit discloses it to anyone who's doing full packet captures on the protocol the exploit uses.
  - AnimalMuppet 10y ago
    OK, so they're "disclosed" in the sense that "the information (in packet form) is released onto a public network". But that's potential discovery if someone is paying very close attention. And the point of a zero-day is that nobody's paying attention to that specifically, because nobody knows to do so yet. So, yes, somebody could have a packet capture of it, along with a billion other packets. So you're using "disclosure" here in a very restricted sense. It more normally means something more like "sending an email to the vendor" or "making a press release".
    - tptacek 10y ago
      To paraphrase someone smarter on these issues than I am: NSA's adversaries spend more on coffee than Cisco does on product security. When vulns like the ones we've seen are used on public networks, they are disclosed. The question isn't whether they're disclosed to vendors. It's whether they're NOBUS flaws. Schneier is suggesting NSA views them as NOBUS. They do not.
      - srtjstjsj 10y ago
        you mean the NSA staff spends more on coffee than Cisco does on product security? otherwise, the claim makes no sense. the NSA's adversaries include huge swaths of non-security-conscious users, and includes Cisco.
        tptacek 10y ago
        The NSA's adversaries include the rest of the world's largest SIGINT agencies.