6 ms·

The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report,

The antidote seems to be for the NSA to maintain a security report for each discovered zero day. If it ever leaks, they can send the target company the report, which explains both what the exploit is and how to fix it. That seems fair enough. The NSA needs to exploit flaws, but they can be a bit less evil about it by being ready to fix them if necessary. That doesn't solve the fact that NSA's competitors could find and exploit the same flaws, or that sometimes it's hard to tell whether any leaks have happened, but it's an improvement. At the end of it, it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. But we can think of ways to reduce the impact without getting in the way of their job.

icefo 10y ago
If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.
- Natsu 10y ago
  They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
  - MichaelGG 10y ago
    I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
- sillysaurus3 10y ago
  True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.
- dogma1138 10y ago
  MS has a code sharing program. Large government contracts almost always have a code transfer clause in them if nothing else than if the company goes bust or no longer wants to support the product.
JumpCrisscross 10y ago
> If it ever leaks We have evidence that the NSA has no idea from where or through whom it's leaking. My impulse is to say "you get so many years to use an exploit, maybe more with higher-up approval, and then you must disclose it." Unfortunately, with virtually zero independent oversight of these agencies, I have no faith such rules would be followed.
- sillysaurus3 10y ago
  We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this? https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-question-was-the-nsa-hacked.html https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...
  - bitJericho 10y ago
    The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.
  - deleted 10y ago
    [deleted]
  - cryptarch 10y ago
    Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?
    - TheSpiceIsLife 10y ago
      I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.
hengheng 10y ago
> The NSA needs to exploit flaws In the current doctrine, it apparently does.
avar 10y ago
> If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapons like normal weapons. The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.
- sillysaurus3 10y ago
  Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)
celticninja 10y ago
Would it be possible to scan for infected systems if you know the 0-day?
- willstrafach 10y ago
  If I recall correctly from some of the Snowden docs, they do have their passive internet taps watch for exploit signatures of foreign adversaries. I don't see why they would not do the same with their own.
celticninja 10y ago
Would it be possible to scan for infected systems if you know the 0-day?
pavel_lishin 10y ago
> If it ever leaks You mean, if they become aware of it leaking. Exploits can leak and be utilized without anyone being aware of it, for years. It's not like you see a mushroom cloud on the horizon and your earthquake detectors wobble.
averagewall 10y ago
> it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?
- notgood 10y ago
  Exactly, if the US army starts raping ISIS females later it can't pretend its barbaric for other armies to do the same, incl. american females in the army. Doing the least morally right thing always brings more problems than its worth, and that's exactly what NSA does every time it pokes holes into everyone's software.
- Ajedi32 10y ago
  > Would you say the same of Chinese government hackers and Syran military? No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them. Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.
  - averagewall 10y ago
    So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race. Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.
    - Ajedi32 10y ago
LoSboccacc 10y ago
> The NSA needs to exploit flaws there are plenty legal wiretapping/surveillance alternatives that don't rely on not fixing a compromised worldwide infrastructure.

icefo 10y ago

If the 0 day is in an open source project this seems doable but I don't know if the NSA has access to the Microsoft or Cisco source code.

Natsu 10y ago
They very likely do have access to the Windows source code. Microsoft does share that with certain governments & educational institutions. I think the Chinese government also has access, FWIW, but it's been a long time since I looked into this.
- MichaelGG 10y ago
  I got personal access to the Windows source along with many others via the MS MVP program. And it's unlikely that even if MS was secretive that the USG cannot get multiple people working at MS with access.
sillysaurus3 10y ago
True, but blackbox pentesting is pretty common. If a company is informed of a flaw in their XYZ service with details of how the flaw operates, it would probably be enough.
dogma1138 10y ago
MS has a code sharing program. Large government contracts almost always have a code transfer clause in them if nothing else than if the company goes bust or no longer wants to support the product.

JumpCrisscross 10y ago

> If it ever leaks We have evidence that the NSA has no idea from where or through whom it's leaking. My impulse is to say "you get so many years to use an exploit, maybe more with higher-up approval, and then you must disclose it." Unfortunately, with virtually zero independent oversight of these agencies, I have no faith such rules would be followed.

sillysaurus3 10y ago
We have evidence that the NSA has no idea from where or through whom it's leaking. The general consensus seems to be that Russia was the source of the leaks. The US government knows this, and everyone involved knows who is leaking what, and why. If so, then this is a political move. Is there evidence to contradict this? https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-raises-alarming-question-was-the-nsa-hacked.html https://www.nytimes.com/2016/08/17/us/shadow-brokers-leak-ra...
- bitJericho 10y ago
  The current enemy is always the source of the leaks. A few months back it was china. The political move is just the finger pointing.
- deleted 10y ago
  [deleted]
- cryptarch 10y ago
  Who cares what nation state actor alledgedly moved the exploits from an NSA employee to WikiLeaks? Why would the medium matter in the least, in the case of hoarding 0days?
  - TheSpiceIsLife 10y ago
    I agree with this and want to further add to it. Firstly by saying: isn't it interesting that, if it is Russia who moved the exploits from the NSA employee / contractor to WikiLeaks then they (the Russians) have acted in the service of the global public. But let's not get distracted. The source of all NSA leaks is never some rogue employee, or contractor. It's never "The Russians"™ or "The Chinese"™. The source of NSA leaks is the goddamn NSA.

hengheng 10y ago

> The NSA needs to exploit flaws In the current doctrine, it apparently does.

avar 10y ago

> If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapons like normal weapons. The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.

sillysaurus3 10y ago
Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)

celticninja 10y ago

Would it be possible to scan for infected systems if you know the 0-day?

willstrafach 10y ago
If I recall correctly from some of the Snowden docs, they do have their passive internet taps watch for exploit signatures of foreign adversaries. I don't see why they would not do the same with their own.

celticninja 10y ago

Would it be possible to scan for infected systems if you know the 0-day?

pavel_lishin 10y ago

> If it ever leaks You mean, if they become aware of it leaking. Exploits can leak and be utilized without anyone being aware of it, for years. It's not like you see a mushroom cloud on the horizon and your earthquake detectors wobble.

averagewall 10y ago

> it's hard to seriously argue that the NSA should stop exploiting computers. It's their role. We need them, just like we need a military. Would you say the same of Chinese government hackers and Syran military? If yes, OK. I understand you accept the need for competition in arms. If not, can you explain why?

notgood 10y ago
Exactly, if the US army starts raping ISIS females later it can't pretend its barbaric for other armies to do the same, incl. american females in the army. Doing the least morally right thing always brings more problems than its worth, and that's exactly what NSA does every time it pokes holes into everyone's software.
Ajedi32 10y ago
> Would you say the same of Chinese government hackers and Syran military? No, for the same reason why I'm okay with the US military having nukes but wouldn't be okay with Syria having them. Obviously it'd be great if we could get by with no military powers having to possess zero-day exploits (or nukes), but so long as we can't be sure no other nations are benefiting from such exploits, it makes no sense strategically to forbid our own governments from doing the same.
- averagewall 10y ago
  So it equally makes no sense for China to forbid itself from using their own exploits? As long as they can't be sure America isn't benefiting from them, they'd better keep up with the arms race. Or do you consider America to be special and that it deserves these powers more than other countries? Personally I don't think it's competent to hold them because it has an ongoing history of using its weapons to destroy other countries, property and lives. If I had to choose who wins the arms race, I would prefer a less hostile country like China or Germany to have them instead of America. But really, why not nobody? Exploits are offensive weapons, not defensive ones.
  - Ajedi32 10y ago

LoSboccacc 10y ago

> The NSA needs to exploit flaws there are plenty legal wiretapping/surveillance alternatives that don't rely on not fixing a compromised worldwide infrastructure.