5 ms·

Personally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another

by runamok 10y ago

Personally I think this is a function the the FBI should fill. However, there is a risk they would sit on zero days and weaponize them (or give them to another three letter agency). I wonder if an org like the EFF could add this to their scope.

archon810 10y ago
You're thinking CIA and NSA.
- runamok 10y ago
  And DEA, DHS and many, many more. > The National Security Agency is now able to share raw surveillance data with all 16 of the United States government's intelligence groups, including the Central Intelligence Agency, Federal Bureau of Investigation, Department of Homeland Security and Drug Enforcement Administration. refs: https://www.engadget.com/2017/01/12/obama-expands-the-nsas-ability-to-share-data-with-other-agencie/ https://www.engadget.com/2017/01/12/obama-expands-the-nsas-a... https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Members https://en.wikipedia.org/wiki/United_States_Intelligence_Com... http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...
user5994461 10y ago
> However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda. There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.
- WJW 10y ago
  So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
  - strictnein 10y ago
    It'd be tough to form an international legal entity anyways.
  - user5994461 10y ago
    Then you don't report that to the FBI, it's not their jurisdiction.
  - thecrazyone 10y ago
    It's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)
- colordrops 10y ago
  What makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.
- njharman 10y ago
  > They are still here to protect americans That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".
  - pdelbarba 10y ago
    They were perfectly happy to use the vulnerabilities exploited by Stingray after all.
  - anigbrowl 10y ago
    Don't mix up the existence of incentives with the idea that you have insight into what people's goals are.
  - Spooky23 10y ago
    Have you ever interacted with law enforcement on any professional basis? They aren't like that at all.
    - njharman 9y ago
      1) yes, but with the "troops" and lower level managers. 2) the Director of the FBI (and other other high level managers) is much more of a political bureaucrat than they are a LEO.
- jxcole 10y ago
  While it may be true that in this particular instance the FBI might act benevolently, the idea was that it would be nice if there was an organization you could go to with any zero day bug. Even if the FBI is not mismanaged and always tries to protect Americans, you could easily imagine a scenario where someone reports an exploit to an OS where anyone can remotely install a key logger. The FBI wouldn't be a good organization to report this to because they may want to use this to track down criminals which, they would no doubt feel, would greatly outweigh the cost to Americans that the zero day represents. The EFF seems like a good choice. In general you would need to pick an organization that does not have a vested interest in using exploits.
  - eric_h 10y ago
    > While it may be true that in this particular instance the FBI might act benevolently Indeed. Didn't the FBI effectively purchase a zero day to break into the iPhone of the San Bernardino shooter? Didn't they also then not disclose said zero day to Apple? There's no way that any LE agency can be trusted with this responsibility; I'm not convinced that it can be done by the federal government at all. EFF seems like a reasonable choice, but even non-profits have the potential to be corrupted/subverted (and operating as a dump for zero days has the power to corrupt, for sure, regardless of how moral your organization claims to be on its website). This definitely falls under the umbrella of hard-problems-in-politics-that-will-not-be-solved-any-time-soon
    - sverhagen 10y ago
      What if there were multiple non-profits that can keep each other honest?
    - deleted 10y ago
      [deleted]
rz2k 10y ago
How about the National Institute of Standards and Technology? My impression is that they are less interested in offense compared to the NSA, and more serious than possible private entities like PCI.
tptacek 10y ago
Whatever we might think about this idea, neither FBI nor NIST has the staffing to handle vulnerability reports. I've heard good things about reporting incidents to FBI, but there's pretty much no chance FBI (or NIST) is going to help you coordinate disclosure. FBI works cases. NIST is, for security stuff, something like 10 people.
steamer25 10y ago
Someone in another forum commented recently that there should be a new top-line federal agency whose mission is to promote the security of America's information infrastructure. They suggested it should be established as an adversarial check/balance against e.g., the CIA and NSA. https://twitter.com/Snowden/status/839168025517522944 https://twitter.com/Snowden/status/839168025517522944 Maybe if they were required by statute to accept anonymous submissions and make FOIA-style responsible disclosures after a reasonably short period of time, they wouldn't end up colluding right away.
- azernik 10y ago
  The already exists an agency with this mission: the NSA. The problem is that they have two often-conflicting mission statements, WTH the other being to spy on foreign adversaries. Really what this would entail is splitting the NSA into two bureaucracies, with the information-security one then being able to wholeheartedly pursue vulnerabilities that affect American infrastructure. The offensive organization wold probably then still sit on vulnerabilities only it knew about, but at least this would be better than the current situation.
  - nickpsecurity 10y ago
    "The already exists an agency with this mission: the NSA." It's a myth far as I know. I've studied them a long time seeing much conflicting info about this. A declassified, historical document I found at one point about them said their job was SIGINT and COMSEC (just communications security!) for U.S. government. A later provision extended this to protecting COMSEC of defense contractors. The IAD seems to have policy-driven stuff about helping protect INFOSEC in general. There could've been a COTS mandate of some sort at some point but it was clearly toothless. The NSA is mandated to protect communication security of defense sector. That's it. Even then, the defense sector keeps asking them to downgrade the security to let in more quick-moving products from commercial sector that are hacker fodder. They've since started on a program that lets them in after a 90-day evaluation against the lowest standards from Common Criteria. The NSA is the last group that should be responsible for INFOSEC given all this w/ market an utter failure, too. The groups that have done the most are probably NSF and DARPA for funding strong security with NIST and DISA (esp STIGS) at least trying to do something with hardening guides and crypto recommendations. I prefer reputation-driven nonprofits that are funded with combo of donations, licensing of quality software, and consulting fees. They can't get acquired or be destroyed by changes in government policy.

by runamok 10y ago

archon810 10y ago

You're thinking CIA and NSA.

runamok 10y ago
And DEA, DHS and many, many more. > The National Security Agency is now able to share raw surveillance data with all 16 of the United States government's intelligence groups, including the Central Intelligence Agency, Federal Bureau of Investigation, Department of Homeland Security and Drug Enforcement Administration. refs: https://www.engadget.com/2017/01/12/obama-expands-the-nsas-ability-to-share-data-with-other-agencie/ https://www.engadget.com/2017/01/12/obama-expands-the-nsas-a... https://en.wikipedia.org/wiki/United_States_Intelligence_Community#Members https://en.wikipedia.org/wiki/United_States_Intelligence_Com... http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130805 http://www.reuters.com/article/us-dea-sod-idUSBRE97409R20130...

user5994461 10y ago

> However, there is a risk they would sit on zero days Unlikely. They are still here to protect americans, in a sense. Stealing money from a bank or a regular business is not on their agenda. There is a 10% of vulnerabilities that might have re-use for intelligence purpose, but it shall be alright for the bulk of it.

WJW 10y ago
So what happens if you find a zero day vulnerability in a Russian bank? Not everyone on the internet is from the US.
- strictnein 10y ago
  It'd be tough to form an international legal entity anyways.
- user5994461 10y ago
  Then you don't report that to the FBI, it's not their jurisdiction.
- thecrazyone 10y ago
  It's good to have this as a general reminder: "Not everyone is from the US", people tend to forget that so often :)
colordrops 10y ago
What makes you say that? Plenty of evidence points to upper management at the FBI and other 3 letter agencies being more interested in power brokering than honesty and serving the public.
njharman 10y ago
> They are still here to protect americans That may be the charter of the the organization. But the individual people running the FBI goals are to 1) be reappointed / not get fired 2) continually expand their budget / power. Given US politics 1&2 are not always congruent esp in short term with "protecting americans".
- pdelbarba 10y ago
  They were perfectly happy to use the vulnerabilities exploited by Stingray after all.
- anigbrowl 10y ago
  Don't mix up the existence of incentives with the idea that you have insight into what people's goals are.
- Spooky23 10y ago
  Have you ever interacted with law enforcement on any professional basis? They aren't like that at all.
  - njharman 9y ago
    1) yes, but with the "troops" and lower level managers. 2) the Director of the FBI (and other other high level managers) is much more of a political bureaucrat than they are a LEO.
jxcole 10y ago
While it may be true that in this particular instance the FBI might act benevolently, the idea was that it would be nice if there was an organization you could go to with any zero day bug. Even if the FBI is not mismanaged and always tries to protect Americans, you could easily imagine a scenario where someone reports an exploit to an OS where anyone can remotely install a key logger. The FBI wouldn't be a good organization to report this to because they may want to use this to track down criminals which, they would no doubt feel, would greatly outweigh the cost to Americans that the zero day represents. The EFF seems like a good choice. In general you would need to pick an organization that does not have a vested interest in using exploits.
- eric_h 10y ago
  > While it may be true that in this particular instance the FBI might act benevolently Indeed. Didn't the FBI effectively purchase a zero day to break into the iPhone of the San Bernardino shooter? Didn't they also then not disclose said zero day to Apple? There's no way that any LE agency can be trusted with this responsibility; I'm not convinced that it can be done by the federal government at all. EFF seems like a reasonable choice, but even non-profits have the potential to be corrupted/subverted (and operating as a dump for zero days has the power to corrupt, for sure, regardless of how moral your organization claims to be on its website). This definitely falls under the umbrella of hard-problems-in-politics-that-will-not-be-solved-any-time-soon
  - sverhagen 10y ago
    What if there were multiple non-profits that can keep each other honest?
  - deleted 10y ago
    [deleted]

rz2k 10y ago

How about the National Institute of Standards and Technology? My impression is that they are less interested in offense compared to the NSA, and more serious than possible private entities like PCI.

tptacek 10y ago

Whatever we might think about this idea, neither FBI nor NIST has the staffing to handle vulnerability reports. I've heard good things about reporting incidents to FBI, but there's pretty much no chance FBI (or NIST) is going to help you coordinate disclosure. FBI works cases. NIST is, for security stuff, something like 10 people.

steamer25 10y ago

Someone in another forum commented recently that there should be a new top-line federal agency whose mission is to promote the security of America's information infrastructure. They suggested it should be established as an adversarial check/balance against e.g., the CIA and NSA. https://twitter.com/Snowden/status/839168025517522944 https://twitter.com/Snowden/status/839168025517522944 Maybe if they were required by statute to accept anonymous submissions and make FOIA-style responsible disclosures after a reasonably short period of time, they wouldn't end up colluding right away.

azernik 10y ago
The already exists an agency with this mission: the NSA. The problem is that they have two often-conflicting mission statements, WTH the other being to spy on foreign adversaries. Really what this would entail is splitting the NSA into two bureaucracies, with the information-security one then being able to wholeheartedly pursue vulnerabilities that affect American infrastructure. The offensive organization wold probably then still sit on vulnerabilities only it knew about, but at least this would be better than the current situation.
- nickpsecurity 10y ago
  "The already exists an agency with this mission: the NSA." It's a myth far as I know. I've studied them a long time seeing much conflicting info about this. A declassified, historical document I found at one point about them said their job was SIGINT and COMSEC (just communications security!) for U.S. government. A later provision extended this to protecting COMSEC of defense contractors. The IAD seems to have policy-driven stuff about helping protect INFOSEC in general. There could've been a COTS mandate of some sort at some point but it was clearly toothless. The NSA is mandated to protect communication security of defense sector. That's it. Even then, the defense sector keeps asking them to downgrade the security to let in more quick-moving products from commercial sector that are hacker fodder. They've since started on a program that lets them in after a 90-day evaluation against the lowest standards from Common Criteria. The NSA is the last group that should be responsible for INFOSEC given all this w/ market an utter failure, too. The groups that have done the most are probably NSF and DARPA for funding strong security with NIST and DISA (esp STIGS) at least trying to do something with hardening guides and crypto recommendations. I prefer reputation-driven nonprofits that are funded with combo of donations, licensing of quality software, and consulting fees. They can't get acquired or be destroyed by changes in government policy.