13 ms·

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto war

Which is exactly what we crazy cookoo conspiracy theorists have been warning about. It's the same slipperly slope we already went through in the 90's crypto wars, but SV gets amnesia when it gets lots of stupid company valuations and forgets all those lessons apparently. Bottom line is this. If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security... basically all the things important to national security in general. So while I don't disagree that triple letters need some cool tools to get shit done, I think this function needs some technocratic oversight specifically for this issue. It's time for a new Church committee.

sillysaurus3 10y ago
The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it. That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary. That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement. At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.
- icefo 10y ago
  If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.
  - Natsu 10y ago
    They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
    - MichaelGG 10y ago
      I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
  - sillysaurus3 10y ago
    True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.
  - dogma1138 10y ago
    MS has a code sharing program. Large government contracts almost always have a code transfer clause in them if nothing else than if the company goes bust or no longer wants to support the product.
- JumpCrisscross 10y ago
  > If it ever leaks We have evidence that the NSA has no idea from where or through whom it's leaking. My impulse is to say "you get so many years to use an exploit, maybe more with higher-up approval, and then you must disclose it." Unfortunately, with virtually zero independent oversight of these agencies, I have no faith such rules would be followed.
  - sillysaurus3 10y ago
    We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this? https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-question-was-the-nsa-hacked.html https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...
    - bitJericho 10y ago
      The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.
    - deleted 10y ago
      [deleted]
    - cryptarch 10y ago
      Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?
      - TheSpiceIsLife 10y ago
        I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.
- hengheng 10y ago
  > The NSA needs to exploit flaws In the current doctrine, it apparently does.
- avar 10y ago
  > If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapons like normal weapons. The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.
  - sillysaurus3 10y ago
    Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)
- celticninja 10y ago
  Would it be possible to scan for infected systems if you know the 0-day?
  - willstrafach 10y ago
    If I recall correctly from some of the Snowden docs, they do have their passive internet taps watch for exploit signatures of foreign adversaries. I don't see why they would not do the same with their own.
- celticninja 10y ago
  Would it be possible to scan for infected systems if you know the 0-day?
- pavel_lishin 10y ago
  > If it ever leaks You mean, if they become aware of it leaking. Exploits can leak and be utilized without anyone being aware of it, for years. It's not like you see a mushroom cloud on the horizon and your earthquake detectors wobble.
- averagewall 10y ago
  > it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?
  - notgood 10y ago
    Exactly, if the US army starts raping ISIS females later it can't pretend its barbaric for other armies to do the same, incl. american females in the army. Doing the least morally right thing always brings more problems than its worth, and that's exactly what NSA does every time it pokes holes into everyone's software.
  - Ajedi32 10y ago
    > Would you say the same of Chinese government hackers and Syran military? No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them. Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.
    - averagewall 10y ago
      So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race. Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.
      - Ajedi32 10y ago
- LoSboccacc 10y ago
  > The NSA needs to exploit flaws there are plenty legal wiretapping/surveillance alternatives that don't rely on not fixing a compromised worldwide infrastructure.
daveguy 10y ago
You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info. Unless you've got conspiracies on other topics, then maybe. I think it's fairly common for even someone with a cursory knowledge of security to know that backdoors are a bad idea. The triple letters don't get their power from poor products. Those are going to be around no matter what. I'd rather this just drive a push toward more open source products throughout the network stack. The triple letters get their power, not from poor products, but because of existing oversight of the agencies has been lax in the name of fightin' terror. When it is legal for gobs of data to be vacuumed up without any court order then they will have power, no matter how much poor software is in the wild.
- kakarot 10y ago
  It was before Snowden. We have had hard facts since the 90's that mass wiretapping and exploitation has been going on thru vehicles like AT&T and Verizon. And we knew about PRISM for a good two years before its public disclosure. Sudden black square over a remote area in Utah in satellite imagery. Pictures of a massive contruct. Coupled with the fact that we knew they needed a place to centralize all of this collected information, it was plainly public how the NSA was operating. No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them, because we operate on a system of identity politics.
  - daveguy 10y ago
    > It was before Snowden. I wasn't saying that's when it started. I was saying that's when people stopped viewing "government is listening to everyone" as conspiracy. > No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them... It didn't have anything to do with Snowden's "celebrity". Do you think he was a celebrity before he produced physical evidence? Turns out, no one wanted to friggin listen, until someone had proof.
    - arca_vorago 10y ago
      "when people stopped viewing "government is listening to everyone" as conspiracy." The entire point is that the public isn't listening to the dangers presented beforehand. Yes, now people dont think you're crazy for thinking we are surveilled heavily, but now the equivalent is when I tell people why they put the surveillance in place at all. Typical responses include "but they're just doing it for national security". If 1/3 of the public only knew half the shit the gov was up to there would be a revolt tomorrow morning. It's deeper and darker than just massive surveillance. My only question for years has been if the public will wake up enough to realize it. With the failing education and financial systems and the propaganda levels turned up to 11, I'm beginning to doubt it.
downrightmike 10y ago
SV doesn't get amnesia, it gets younger people reinventing the wheel to "disrupt".
macspoofing 10y ago
>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your security agency is so nefarious. That is literally why they were created to do, and this is what every other foreign security agency is doing as well. >So while I don't disagree that triple letters need some cool tools to get shit done Sounds like you do. >I think this function needs some technocratic oversight specifically for this issue. How about congressional, judicial and executive oversight? Because that's what we have now.
- losteric 10y ago
  The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?
  - macspoofing 10y ago
    Isn't that partly the mission statement of the NSA and CIA and FBI?
    - losteric 10y ago
      The CIA and NSA are externally oriented. Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution. We need an organization focused on preemptively securing our infrastructure.
      - knowaveragejoe 10y ago
        The NSA is actually tasked with that mission: > NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency
willstrafach 10y ago
> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea. However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day exploits (Which are the issue at hand). 0-days are going to be in code regardless of who finds them. It would be great to get some clarification on this from the government, but I would be pretty OK if the process looked anything like this: 1. Discover 0-day exploit relevant to mission. 2. Build modular tools to utilize the 0-day. 3. Create detection signatures for the exploit to run against Upstream collected internet communications. 4. If another party is seen using the same 0-day (doesn't matter if it was via leak or independent discovery), have a cutout such as FBI or DHS contact vendor with details to get it patched ASAP.
- losteric 10y ago
  That's the exact process I'd like to see, but what really happens is more like: 1. Discover 0-day exploits relevant to mission 2. Build modular tools to utilize the 0-day 3. Do nothing 4. Lose control of 0days, or allow other actors to discover them. It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open.
  - ganoushoreilly 10y ago
    "It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open" I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.
- cairo_x 10y ago
cmurf 10y ago
No, the people who know how hard good security is, how easy it is for this material to spread around when a huge chunk of your intelligence services are private for-profit contractors, and had completely sane ideas about how weaponized the government's tools were likely to be - were not crazy or cuckoo or conspiracy oriented. Conspiracy theorists are where 3 million illegal voters, thousands of Arabs dancing on buildings, and the last president being a Kenyan with a falsified birth certificate, all come from.
zxcmx 10y ago
So the tool is getting used everywhere by "kiddies"? I don't see any discussion about the fact that, if you were the NSA, you'd absolutely want this to happen to muddy the waters for attribution.
mtempm 10y ago
Why do 3 letter agencies need special tools? Who will they be accountable to that these tools are being used ethically? We already have a bunch of stories of crooked cops using databases to stalk love interests, etc. Then look at the Michael Hastings incident. Imagine how much abuse goes unreported.
dmix 10y ago
What does this have to do with SV company valuations? Seems like you're pigeonholing a pet issue into something totally unrelated.
oblio 10y ago
They don't even need to go out into the wild. https://en.wikipedia.org/wiki/Aldrich_Ames https://en.wikipedia.org/wiki/Aldrich_Ames https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen The US intelligence agencies have a less than stellar history regarding moles.

sillysaurus3 10y ago

The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it. That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary. That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement. At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.

icefo 10y ago
If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.
- Natsu 10y ago
  They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
  - MichaelGG 10y ago
    I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
- sillysaurus3 10y ago
  True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.
- dogma1138 10y ago
  MS has a code sharing program. Large government contracts almost always have a code transfer clause in them if nothing else than if the company goes bust or no longer wants to support the product.
JumpCrisscross 10y ago
> If it ever leaks We have evidence that the NSA has no idea from where or through whom it's leaking. My impulse is to say "you get so many years to use an exploit, maybe more with higher-up approval, and then you must disclose it." Unfortunately, with virtually zero independent oversight of these agencies, I have no faith such rules would be followed.
- sillysaurus3 10y ago
  We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this? https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-question-was-the-nsa-hacked.html https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...
  - bitJericho 10y ago
    The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.
  - deleted 10y ago
    [deleted]
  - cryptarch 10y ago
    Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?
    - TheSpiceIsLife 10y ago
      I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.
hengheng 10y ago
> The NSA needs to exploit flaws In the current doctrine, it apparently does.
avar 10y ago
> If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapons like normal weapons. The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.
- sillysaurus3 10y ago
  Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)
celticninja 10y ago
Would it be possible to scan for infected systems if you know the 0-day?
- willstrafach 10y ago
  If I recall correctly from some of the Snowden docs, they do have their passive internet taps watch for exploit signatures of foreign adversaries. I don't see why they would not do the same with their own.
celticninja 10y ago
Would it be possible to scan for infected systems if you know the 0-day?
pavel_lishin 10y ago
> If it ever leaks You mean, if they become aware of it leaking. Exploits can leak and be utilized without anyone being aware of it, for years. It's not like you see a mushroom cloud on the horizon and your earthquake detectors wobble.
averagewall 10y ago
> it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?
- notgood 10y ago
  Exactly, if the US army starts raping ISIS females later it can't pretend its barbaric for other armies to do the same, incl. american females in the army. Doing the least morally right thing always brings more problems than its worth, and that's exactly what NSA does every time it pokes holes into everyone's software.
- Ajedi32 10y ago
  > Would you say the same of Chinese government hackers and Syran military? No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them. Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.
  - averagewall 10y ago
    So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race. Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.
    - Ajedi32 10y ago
LoSboccacc 10y ago
> The NSA needs to exploit flaws there are plenty legal wiretapping/surveillance alternatives that don't rely on not fixing a compromised worldwide infrastructure.

daveguy 10y ago

You haven't been a crazy cookoo conspiracy theorists since the Snowden dropped his info. Unless you've got conspiracies on other topics, then maybe. I think it's fairly common for even someone with a cursory knowledge of security to know that backdoors are a bad idea. The triple letters don't get their power from poor products. Those are going to be around no matter what. I'd rather this just drive a push toward more open source products throughout the network stack. The triple letters get their power, not from poor products, but because of existing oversight of the agencies has been lax in the name of fightin' terror. When it is legal for gobs of data to be vacuumed up without any court order then they will have power, no matter how much poor software is in the wild.

kakarot 10y ago
It was before Snowden. We have had hard facts since the 90's that mass wiretapping and exploitation has been going on thru vehicles like AT&T and Verizon. And we knew about PRISM for a good two years before its public disclosure. Sudden black square over a remote area in Utah in satellite imagery. Pictures of a massive contruct. Coupled with the fact that we knew they needed a place to centralize all of this collected information, it was plainly public how the NSA was operating. No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them, because we operate on a system of identity politics.
- daveguy 10y ago
  > It was before Snowden. I wasn't saying that's when it started. I was saying that's when people stopped viewing "government is listening to everyone" as conspiracy. > No one just wanted to frigging listen until they had a celebrity icon like Snowden to interest them... It didn't have anything to do with Snowden's "celebrity". Do you think he was a celebrity before he produced physical evidence? Turns out, no one wanted to friggin listen, until someone had proof.
  - arca_vorago 10y ago
    "when people stopped viewing "government is listening to everyone" as conspiracy." The entire point is that the public isn't listening to the dangers presented beforehand. Yes, now people dont think you're crazy for thinking we are surveilled heavily, but now the equivalent is when I tell people why they put the surveillance in place at all. Typical responses include "but they're just doing it for national security". If 1/3 of the public only knew half the shit the gov was up to there would be a revolt tomorrow morning. It's deeper and darker than just massive surveillance. My only question for years has been if the public will wake up enough to realize it. With the failing education and financial systems and the propaganda levels turned up to 11, I'm beginning to doubt it.

downrightmike 10y ago

SV doesn't get amnesia, it gets younger people reinventing the wheel to "disrupt".

macspoofing 10y ago

>Which is exactly what we crazy cookoo conspiracy theorists have been warning about. Which is what exactly? That a spy agency is spying? >If you put backdoors in, or exploit 0days for your own, they will get out in the wild eventually, and suddenly you have massively weakened infrastructure, corporate, and government security I don't agree with putting in backdoors, but I don't see how exploiting backdoors by your security agency is so nefarious. That is literally why they were created to do, and this is what every other foreign security agency is doing as well. >So while I don't disagree that triple letters need some cool tools to get shit done Sounds like you do. >I think this function needs some technocratic oversight specifically for this issue. How about congressional, judicial and executive oversight? Because that's what we have now.

losteric 10y ago
The NSA leverages these exploits to spy on foreign nations. That's fine, spies should spy... But it does beg the question: who's protecting our information from foreign intrusions?
- macspoofing 10y ago
  Isn't that partly the mission statement of the NSA and CIA and FBI?
  - losteric 10y ago
    The CIA and NSA are externally oriented. Defense is arguably part of the FBI mission, however they don't have the NSA's level of skill or resources. The FBI might be able to detect abuse when it gets rampant but I have zero confidence that they would discover any of these exploits themselves. The FBI is mostly cleanup and criminal prosecution. We need an organization focused on preemptively securing our infrastructure.
    - knowaveragejoe 10y ago
      The NSA is actually tasked with that mission: > NSA is concurrently charged with protection of U.S. government communications and information systems against penetration and network warfare. https://en.wikipedia.org/wiki/National_Security_Agency https://en.wikipedia.org/wiki/National_Security_Agency

willstrafach 10y ago

> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea. However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day exploits (Which are the issue at hand). 0-days are going to be in code regardless of who finds them. It would be great to get some clarification on this from the government, but I would be pretty OK if the process looked anything like this: 1. Discover 0-day exploit relevant to mission. 2. Build modular tools to utilize the 0-day. 3. Create detection signatures for the exploit to run against Upstream collected internet communications. 4. If another party is seen using the same 0-day (doesn't matter if it was via leak or independent discovery), have a cutout such as FBI or DHS contact vendor with details to get it patched ASAP.

losteric 10y ago
That's the exact process I'd like to see, but what really happens is more like: 1. Discover 0-day exploits relevant to mission 2. Build modular tools to utilize the 0-day 3. Do nothing 4. Lose control of 0days, or allow other actors to discover them. It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open.
- ganoushoreilly 10y ago
  "It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open" I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.
cairo_x 10y ago

cmurf 10y ago

No, the people who know how hard good security is, how easy it is for this material to spread around when a huge chunk of your intelligence services are private for-profit contractors, and had completely sane ideas about how weaponized the government's tools were likely to be - were not crazy or cuckoo or conspiracy oriented. Conspiracy theorists are where 3 million illegal voters, thousands of Arabs dancing on buildings, and the last president being a Kenyan with a falsified birth certificate, all come from.

zxcmx 10y ago

So the tool is getting used everywhere by "kiddies"? I don't see any discussion about the fact that, if you were the NSA, you'd absolutely want this to happen to muddy the waters for attribution.

mtempm 10y ago

Why do 3 letter agencies need special tools? Who will they be accountable to that these tools are being used ethically? We already have a bunch of stories of crooked cops using databases to stalk love interests, etc. Then look at the Michael Hastings incident. Imagine how much abuse goes unreported.

dmix 10y ago

What does this have to do with SV company valuations? Seems like you're pigeonholing a pet issue into something totally unrelated.

oblio 10y ago

They don't even need to go out into the wild. https://en.wikipedia.org/wiki/Aldrich_Ames https://en.wikipedia.org/wiki/Aldrich_Ames https://en.wikipedia.org/wiki/Robert_Hanssen https://en.wikipedia.org/wiki/Robert_Hanssen The US intelligence agencies have a less than stellar history regarding moles.