3 ms·

No way could anyone else have discovered and used the same vulnerability during these 14 years. Thanks for making use safe./s

by benevol 10y ago

wepple 10y ago
I get the point of your comment, but at a minimum if this were indeed NSA work, at least they could monitor for exploitation of the same bug against targets they want to defend (which, given their network reach could be both public and private sector). Fixing it would've at least prevented exploitation, but there is value in knowledge of who else has this exploit and who they're trying to attack.
- eganist 10y ago
  Do we even know anything about their defensive operations? I'm almost glad we don't since defensive capabilities are the kind of thing you'd rather not disclose to your adversary until you truly need to leverage them, but at the same time, with all the leaks, it's as if the NSA just runs offensive operations and reactive analysis/reconnaissance.
  - wbl 10y ago
    Yes. IPsec is widely used, and TLS on top of that with formally verified specialized implementations of IPsec. They also use data diodes, restricting the syntax of data that flows into and out of networks.
    - eganist 10y ago
      I appreciate this, but I should clarify that I'm speaking specifically to active defense (hence defensive operations) rather than developing, publishing, and using defensive best practices, which I'd personally consider more passive than anything else.
nialo 10y ago
I think this actually has the opposite implication from the one you seem to be trying to draw. If different teams finding the same bugs was common, then someone else probably would have found this one sometime in the last 14 years and reported it to Cisco such that it was actually closed. Therefore, finding overlapping bugs is rare -> NSA should stockpile bugs. (We probably should have a separate agency in charge of attempting to make things more secure, perhaps by finding and reporting bugs like this)

No way could anyone else have discovered and used the same vulnerability during these 14 years. Thanks for making use safe./s

by benevol 10y ago

No way could anyone else have discovered and used the same vulnerability during these 14 years. Thanks for making use safe./s

wepple 10y ago

I get the point of your comment, but at a minimum if this were indeed NSA work, at least they could monitor for exploitation of the same bug against targets they want to defend (which, given their network reach could be both public and private sector). Fixing it would've at least prevented exploitation, but there is value in knowledge of who else has this exploit and who they're trying to attack.

eganist 10y ago
Do we even know anything about their defensive operations? I'm almost glad we don't since defensive capabilities are the kind of thing you'd rather not disclose to your adversary until you truly need to leverage them, but at the same time, with all the leaks, it's as if the NSA just runs offensive operations and reactive analysis/reconnaissance.
- wbl 10y ago
  Yes. IPsec is widely used, and TLS on top of that with formally verified specialized implementations of IPsec. They also use data diodes, restricting the syntax of data that flows into and out of networks.
  - eganist 10y ago
    I appreciate this, but I should clarify that I'm speaking specifically to active defense (hence defensive operations) rather than developing, publishing, and using defensive best practices, which I'd personally consider more passive than anything else.

nialo 10y ago

I think this actually has the opposite implication from the one you seem to be trying to draw. If different teams finding the same bugs was common, then someone else probably would have found this one sometime in the last 14 years and reported it to Cisco such that it was actually closed. Therefore, finding overlapping bugs is rare -> NSA should stockpile bugs. (We probably should have a separate agency in charge of attempting to make things more secure, perhaps by finding and reporting bugs like this)