5 ms·

I do not understand this "they're making us less secure" argument. The only way that the NSA could be actively making systems less secure would be if they were

by ryao 10y ago

I do not understand this "they're making us less secure" argument. The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. The reality is that the NSA need not do that because these systems were already insecure and the NSA just had to figure out how they were insecure. They would have been insecure, even if the NSA had never scrutinized them. The affected systems are ones that I had told others were likely insecure (by virtue of being closed source), but no one listened to me. If you care about network security, then you should use a properly configured software firewall/router running Linux or *BSD. This Cisco/Juniper/etcetera equipment is closed source, hard to scrutinize and almost certainly has horrible flaws that would never be allowed into a serious OSS project. Of course, things like pfSense are not "enterprise grade", so people will continue to ignore advice to use them, put these vulnerable systems into production and then be surprised when it comes out that the security was terrible.

JustSomeNobody 10y ago
He says, "Hoarding zero-day vulnerabilities is a bad idea. It means that we're all less secure." I take this to mean we are less secure than we would be if we could fix the issues (obviously). I don't think this means the same thing as saying it "makes us less secure".
- ryao 10y ago
  Bruce Schneier is well documented to equate failing to disclose vulnerabilities with making systems less secure, or as he put it in this interview, less safe: https://www.technologyreview.com/s/519336/bruce-schneier-nsa-spying-is-making-us-less-safe/ https://www.technologyreview.com/s/519336/bruce-schneier-nsa... To his credit, he was talking about weakening encryption standards, but then elaborated that simply looking for security vulnerabilities and not telling anyone what they found was also doing that. I find that latter position ridiculous. It would be like saying studying malaria and not reporting your findings makes people less healthy.
  - pdkl95 10y ago
    This isn't just "looking for security vulnerabilities". Tools were created to exploit the vulnerabilities. Both the archive of hoarded vulnerability knowledge and the archive of exploit tools is a valuable target... because it would be extremely useful for an attacker, thus making us less safe. This isn't a hypothetical concern, because the Shadow Broker archive is an example of one - or more - of those archives falling into unknown hands. Hoarding vulnerability information concentrates risk which invites thieves.
    - ryao 10y ago
      Less safe than what? The tools could be developed by anyone who works long enough. These systems were always insecure and the idea that we should ignore that rather than replace them with systems that are less insecure by virtue of being developed with OSS best practices is ridiculous. People need to recognize bad decisions and start making good ones rather than find scapegoats to avoid the issue.
      - pdkl95 10y ago
        > Less safe than what? World A contains an archive of concentrated vulnerability information. World B doesn't. World A is strictly less safe than World B, because concentrating information creates a more attractive target. Without that concentrated archive, the vulnerabilities would have to be discovered on their own. Do you really want to argue that allowing the archive of stolen tools recently released by the "Shadow Brokers" didn't make people less safe? Even though it contained attacks on various routers that were previously unknown? Is it really your assertion that those same tools were never used before the "action" announcement? > the idea that we should ignore that Nobody is saying that. Where did you get the idea that we should ignore vulnerabilities? > could be developed by anyone who works long enough Obviously, which is why I also discussed the hoarding of vulnerability knowledge. Maybe all of those vulnerabilities would have been discovered independently, but stealing the archive from the NSA would have been a lot easier and faster. These are not traits you can simply brush off as irrelevant, as most security is not about perfection, but instead about how long the security features will delay an attacker. > scapegoats This isn't about finding a scapegoat. The NSA making us less safe is the "bad decision" that needs to be recognized.
jonquark 10y ago
Aren't they literally "making us less secure" by keeping records of vulnerabilities on computer systems but not disclosing them? This means they can't be fixed by the software company but as this data dump shows, shady characters might be able to discover these vulnerabilities by (illictly) accessing computer systems used by the NSA. Edit: Yes the shady characters might be able to independently discover the vulnerabilities if they are not "NOBUS" but this is another avenue.
- tptacek 10y ago
  No? Learning about a vulnerability doesn't create the vulnerability, or prevent others from learning it as well.
liquidise 10y ago
> The reality is that these systems would have been just as insecure had the NSA never scrutinized them In theory, sure. In practice, this is false. When the NSA finds a vulnerability it can exploit there is information created. As Snowden and the recent hack confirm: data is prone to leaking. Once data leaks, the systems that NSA attacks are fundamentally and operationally less secure than they would be had the NSA not attacked them. This is the very reason it is important that zero-days are reported and fixed.
explorigin 10y ago
There are three sides to the "making us less secure" argument. 1. If they would work with companies to get the vulnerabilities fixed, we would be more secure. The lack of action in this area doesn't make us less secure. It merely delays increasing security. Not the same thing so this argument is not logically sound. (It's like the RIAA saying that downloaded albums is directly lost revenue while there's no guarantee that the pirate would buy instead of download.) 2. Having a large cache of exploits that they cannot successfully secure creates a target for bad actors. If this cache is compromised then we all are actually less secure. 3. Other efforts by the NSA such as compromising RNGs and security protocols do actually make us all less secure.
- ryao 10y ago
  #1 is a false equivalence. There really is no more secure here. The system is either secure or insecure. If it is insecure, then the only questions are how bad is it and how it could be made less insecure? If something is secure (e.g. seL4), then there is no room for improvement. #2 is nonsense because the system is already insecure. #3 is a straw man because we are talking about the NSA not contributing the results of their security research to the world. The other things that they do that actually making things less secure are not the subject here.
  - explorigin 10y ago
    #1 "the system is either secure or insecure" - only according to the particular system's threat model. Your counter-argument falls flat because it assumes all computers share one universal threat-model. "more secure" refers to probabilities built into a particular threat-model. If you're going to make security a binary thing, then without absolute knowledge of the entire system...it is insecure and we're wasting our digital ink. #2 depends on #1 #3 if the subject is "things the NSA does do to make us less secure" then it is the subject.
    - ryao 10y ago
      Security like temperature. It has an absolute limit. We are really only talking about how insecure a system is. That becomes obvious when reading about things like seL4.
anexprogrammer 10y ago
If they know of a vulnerability, not announcing it is simply hoping (or worse presuming) that others haven't found it. Not all vulns are found by people who make a nice blog post, claim their $2k, and move on - some will be keeping very quiet and actively exploiting for poltical or financial reasons. Even with the most positive view, some small subset of those vulnerabilities will be known to others and some will be actively exploited. Hence making us less secure.
- ryao 10y ago
  Security of a system is an intrinsic property that does not change upon scrutiny. Rather than accuse those not reporting the results of their researchers we should focus on building systems that are secure like seL4. This blame game is counterproductive and distracts from making secure systems.
  - anexprogrammer 10y ago
    I'm not suggesting accusation of researchers, but in the case of NSA isn't part of their mission improving network security? They founded SELinux after all. It's not like vulnerabilities are rare or aren't going to be exploited if not revealed.
    - ryao 10y ago
      I do not think that it is feasible to expect a government agency to solve bad engineering. There is no pixie dust that the NSA can sprinkle on systems to make them secure, even if it dedicated all of its resources to trying. If anything, by doing what they are doing, they are exposing the fallacy of such expectations and hastening the development of systems that are actually secure. By that measure, this is actually improving security in the long term far more than attempting to bolster the status quo ever could.
CWuestefeld 10y ago
The NSA found vulnerabilities, built tools to exploit them, and then allowed those tools to leak. That made us less secure, QED. The argument against that is going to be "they weren't supposed to leak". But that's dumb. This is the real world, and the best laid plans, etc. We need to build systems robust to what will happen, not just what we want or expect to happen.
- ryao 10y ago
  The argument against that is that you are hopelessly insecure if your security strategy is to hope no one develops tools around vulnerabilities in proprietary systems. That is going to happen and they are going to leak whether the NSA does it or not. The best bet is to aim to build systems like seL4 and use properly configured well engineered OSS solutions until solutions like seL4 become available.
- deleted 10y ago
  [deleted]
- tptacek 10y ago
  That is an argument whose logical conclusion is that NSA can't do any SIGINT using vulnerabilities: that the "equities process" result should simply be "always disclose". But that's not on the table in any proposal, including the VEP proposal.
  - CWuestefeld 10y ago
    That is an argument whose logical conclusion is that NSA can't do any SIGINT using vulnerabilities My argument shows that in some specific instances, we are less secure. There's probably still a "net global" argument to be made saying that although there do exist costs, they're outweighed by the overall benefits. The problem with that, in turn, is that we're not allowed to know either of the arguments into the equation. They argue that the costs are zero (which is clearly false), and they won't tell us what the benefits are (other than the unsupported claim that they're immense).
chinathrow 10y ago
"The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon." After seeing the Snowden revelations - who says they don't actually do this?
woliveirajr 10y ago
I think that the line is that if they're not fixing it, making us "more secure", then we're "less secure" (when, after all, we're just left in the same status we were before).
danjoc 10y ago
>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. I just wanted to point out that the NSA does that.[1][2] [1]http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html http://www.nytimes.com/interactive/2013/09/05/us/documents-r... [2]https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryption/ https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryptio...
- tptacek 10y ago
  I believe he's referring to the argument Schneier is making, not to the entire notion of NSA's SIGINT mission. Dual EC was indeed an instance of NSA harming everyone's security (less, at least in the US, than is broadly supposed, but clearly and deliberately). But it's not an instance of NSA acquiring zero-day vulnerabilities and then using them to harm everyone's security.
  - ryao 10y ago
    That is correct.
wepple 10y ago
>The affected systems are ones that I had told others were likely insecure (by virtue of being closed source), but no one listened to me. If you care about network security, then you should use a properly configured software firewall/router running Linux or *BSD. This Cisco/Juniper/etcetera equipment is closed source, hard to scrutinize and almost certainly has horrible flaws that would never be allowed into a serious OSS project. You went wildly off the rails here; the OSS vs closed source security argument is foolish. If you think 'many eyes, shallow bugs' still has validity in 2016, you're not up to speed.
Johnny555 10y ago
Well one way is that they are building tools that exploit those vulnerabilities, and leaving the tools on poorly protected "staging servers" where they can be stolen and revealed to the world. Whoever stole the tools this time announced them to the public -- how many times have the tools been stolen in the past and kept quiet so they could be used?

by ryao 10y ago

JustSomeNobody 10y ago

He says, "Hoarding zero-day vulnerabilities is a bad idea. It means that we're all less secure." I take this to mean we are less secure than we would be if we could fix the issues (obviously). I don't think this means the same thing as saying it "makes us less secure".

ryao 10y ago
Bruce Schneier is well documented to equate failing to disclose vulnerabilities with making systems less secure, or as he put it in this interview, less safe: https://www.technologyreview.com/s/519336/bruce-schneier-nsa-spying-is-making-us-less-safe/ https://www.technologyreview.com/s/519336/bruce-schneier-nsa... To his credit, he was talking about weakening encryption standards, but then elaborated that simply looking for security vulnerabilities and not telling anyone what they found was also doing that. I find that latter position ridiculous. It would be like saying studying malaria and not reporting your findings makes people less healthy.
- pdkl95 10y ago
  This isn't just "looking for security vulnerabilities". Tools were created to exploit the vulnerabilities. Both the archive of hoarded vulnerability knowledge and the archive of exploit tools is a valuable target... because it would be extremely useful for an attacker, thus making us less safe. This isn't a hypothetical concern, because the Shadow Broker archive is an example of one - or more - of those archives falling into unknown hands. Hoarding vulnerability information concentrates risk which invites thieves.
  - ryao 10y ago
    Less safe than what? The tools could be developed by anyone who works long enough. These systems were always insecure and the idea that we should ignore that rather than replace them with systems that are less insecure by virtue of being developed with OSS best practices is ridiculous. People need to recognize bad decisions and start making good ones rather than find scapegoats to avoid the issue.
    - pdkl95 10y ago
      > Less safe than what? World A contains an archive of concentrated vulnerability information. World B doesn't. World A is strictly less safe than World B, because concentrating information creates a more attractive target. Without that concentrated archive, the vulnerabilities would have to be discovered on their own. Do you really want to argue that allowing the archive of stolen tools recently released by the "Shadow Brokers" didn't make people less safe? Even though it contained attacks on various routers that were previously unknown? Is it really your assertion that those same tools were never used before the "action" announcement? > the idea that we should ignore that Nobody is saying that. Where did you get the idea that we should ignore vulnerabilities? > could be developed by anyone who works long enough Obviously, which is why I also discussed the hoarding of vulnerability knowledge. Maybe all of those vulnerabilities would have been discovered independently, but stealing the archive from the NSA would have been a lot easier and faster. These are not traits you can simply brush off as irrelevant, as most security is not about perfection, but instead about how long the security features will delay an attacker. > scapegoats This isn't about finding a scapegoat. The NSA making us less safe is the "bad decision" that needs to be recognized.

jonquark 10y ago

Aren't they literally "making us less secure" by keeping records of vulnerabilities on computer systems but not disclosing them? This means they can't be fixed by the software company but as this data dump shows, shady characters might be able to discover these vulnerabilities by (illictly) accessing computer systems used by the NSA. Edit: Yes the shady characters might be able to independently discover the vulnerabilities if they are not "NOBUS" but this is another avenue.

tptacek 10y ago
No? Learning about a vulnerability doesn't create the vulnerability, or prevent others from learning it as well.

liquidise 10y ago

> The reality is that these systems would have been just as insecure had the NSA never scrutinized them In theory, sure. In practice, this is false. When the NSA finds a vulnerability it can exploit there is information created. As Snowden and the recent hack confirm: data is prone to leaking. Once data leaks, the systems that NSA attacks are fundamentally and operationally less secure than they would be had the NSA not attacked them. This is the very reason it is important that zero-days are reported and fixed.

explorigin 10y ago

There are three sides to the "making us less secure" argument. 1. If they would work with companies to get the vulnerabilities fixed, we would be more secure. The lack of action in this area doesn't make us less secure. It merely delays increasing security. Not the same thing so this argument is not logically sound. (It's like the RIAA saying that downloaded albums is directly lost revenue while there's no guarantee that the pirate would buy instead of download.) 2. Having a large cache of exploits that they cannot successfully secure creates a target for bad actors. If this cache is compromised then we all are actually less secure. 3. Other efforts by the NSA such as compromising RNGs and security protocols do actually make us all less secure.

ryao 10y ago
#1 is a false equivalence. There really is no more secure here. The system is either secure or insecure. If it is insecure, then the only questions are how bad is it and how it could be made less insecure? If something is secure (e.g. seL4), then there is no room for improvement. #2 is nonsense because the system is already insecure. #3 is a straw man because we are talking about the NSA not contributing the results of their security research to the world. The other things that they do that actually making things less secure are not the subject here.
- explorigin 10y ago
  #1 "the system is either secure or insecure" - only according to the particular system's threat model. Your counter-argument falls flat because it assumes all computers share one universal threat-model. "more secure" refers to probabilities built into a particular threat-model. If you're going to make security a binary thing, then without absolute knowledge of the entire system...it is insecure and we're wasting our digital ink. #2 depends on #1 #3 if the subject is "things the NSA does do to make us less secure" then it is the subject.
  - ryao 10y ago
    Security like temperature. It has an absolute limit. We are really only talking about how insecure a system is. That becomes obvious when reading about things like seL4.

anexprogrammer 10y ago

If they know of a vulnerability, not announcing it is simply hoping (or worse presuming) that others haven't found it. Not all vulns are found by people who make a nice blog post, claim their $2k, and move on - some will be keeping very quiet and actively exploiting for poltical or financial reasons. Even with the most positive view, some small subset of those vulnerabilities will be known to others and some will be actively exploited. Hence making us less secure.

ryao 10y ago
Security of a system is an intrinsic property that does not change upon scrutiny. Rather than accuse those not reporting the results of their researchers we should focus on building systems that are secure like seL4. This blame game is counterproductive and distracts from making secure systems.
- anexprogrammer 10y ago
  I'm not suggesting accusation of researchers, but in the case of NSA isn't part of their mission improving network security? They founded SELinux after all. It's not like vulnerabilities are rare or aren't going to be exploited if not revealed.
  - ryao 10y ago
    I do not think that it is feasible to expect a government agency to solve bad engineering. There is no pixie dust that the NSA can sprinkle on systems to make them secure, even if it dedicated all of its resources to trying. If anything, by doing what they are doing, they are exposing the fallacy of such expectations and hastening the development of systems that are actually secure. By that measure, this is actually improving security in the long term far more than attempting to bolster the status quo ever could.

CWuestefeld 10y ago

The NSA found vulnerabilities, built tools to exploit them, and then allowed those tools to leak. That made us less secure, QED. The argument against that is going to be "they weren't supposed to leak". But that's dumb. This is the real world, and the best laid plans, etc. We need to build systems robust to what will happen, not just what we want or expect to happen.

ryao 10y ago
The argument against that is that you are hopelessly insecure if your security strategy is to hope no one develops tools around vulnerabilities in proprietary systems. That is going to happen and they are going to leak whether the NSA does it or not. The best bet is to aim to build systems like seL4 and use properly configured well engineered OSS solutions until solutions like seL4 become available.
deleted 10y ago
[deleted]
tptacek 10y ago
That is an argument whose logical conclusion is that NSA can't do any SIGINT using vulnerabilities: that the "equities process" result should simply be "always disclose". But that's not on the table in any proposal, including the VEP proposal.
- CWuestefeld 10y ago
  That is an argument whose logical conclusion is that NSA can't do any SIGINT using vulnerabilities My argument shows that in some specific instances, we are less secure. There's probably still a "net global" argument to be made saying that although there do exist costs, they're outweighed by the overall benefits. The problem with that, in turn, is that we're not allowed to know either of the arguments into the equation. They argue that the costs are zero (which is clearly false), and they won't tell us what the benefits are (other than the unsupported claim that they're immense).

chinathrow 10y ago

"The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon." After seeing the Snowden revelations - who says they don't actually do this?

woliveirajr 10y ago

I think that the line is that if they're not fixing it, making us "more secure", then we're "less secure" (when, after all, we're just left in the same status we were before).

danjoc 10y ago

>The only way that the NSA could be actively making systems less secure would be if they were putting vulnerabilities into the source code or silicon. I just wanted to point out that the NSA does that.[1][2] [1]http://www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html http://www.nytimes.com/interactive/2013/09/05/us/documents-r... [2]https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryption/ https://www.grahamcluley.com/2013/12/nsa-bribe-rsa-encryptio...

tptacek 10y ago
I believe he's referring to the argument Schneier is making, not to the entire notion of NSA's SIGINT mission. Dual EC was indeed an instance of NSA harming everyone's security (less, at least in the US, than is broadly supposed, but clearly and deliberately). But it's not an instance of NSA acquiring zero-day vulnerabilities and then using them to harm everyone's security.
- ryao 10y ago
  That is correct.

wepple 10y ago

>The affected systems are ones that I had told others were likely insecure (by virtue of being closed source), but no one listened to me. If you care about network security, then you should use a properly configured software firewall/router running Linux or *BSD. This Cisco/Juniper/etcetera equipment is closed source, hard to scrutinize and almost certainly has horrible flaws that would never be allowed into a serious OSS project. You went wildly off the rails here; the OSS vs closed source security argument is foolish. If you think 'many eyes, shallow bugs' still has validity in 2016, you're not up to speed.

Johnny555 10y ago

Well one way is that they are building tools that exploit those vulnerabilities, and leaving the tools on poorly protected "staging servers" where they can be stolen and revealed to the world. Whoever stole the tools this time announced them to the public -- how many times have the tools been stolen in the past and kept quiet so they could be used?