5 ms·
The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR mo
by andreyf 10y ago
The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance.
Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking-patch/ http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking...
http://bgr.com/2017/03/09/google-says-many-android-exploits-detailed-in-wikileaks-cia-files-are-already-fixed/ http://bgr.com/2017/03/09/google-says-many-android-exploits-...
- saycheese 10y agohttps://wikileaks.org/ciav7p1/ https://wikileaks.org/ciav7p1/
- andreyf 10y agoOf course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability. https://www.wired.com/2014/04/obama-zero-day/ https://www.wired.com/2014/04/obama-zero-day/
- filoleg 10y agoTwo things: 1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.
- andreyf 10y ago1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies. 2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS https://en.wikipedia.org/wiki/NOBUS
- filoleg 10y ago1. The recent leaks were concerning CIA and not NSA. 2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.
- deleted 10y ago[deleted]
- andreyf 10y ago1. Makes no difference. 2. Makes no difference. How do you know the CIA found these vulns, and that they weren't shared from IC partners? You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.
- deleted 10y ago[deleted]
- problems 10y agoThey do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.
- willstrafach 10y agoThere is zero evidence of this.
- problems 10y agoiOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html https://wikileaks.org/ciav7p1/cms/page_13205587.html Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html https://wikileaks.org/ciav7p1/cms/page_11629096.html Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.
- willstrafach 10y agoI definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit. My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.