3 ms·

> If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapon

by avar 10y ago

> If it ever leaks, they can send the target > company the report. Any usage of the exploit by the NSA constitutes leaking it. You can't treat cyberweapons like normal weapons. The analogy is not that you come up with a secret bomb design and drop it on the target, but that to use your bomb you must send the full Top Secret designs for the bomb to every target, hoping that they voluntarily use it to blow themselves up instead of writing the design down & using it against you.

sillysaurus3 10y ago
Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)

by avar 10y ago

sillysaurus3 10y ago

Sort of. For example, the NSA developed a way to hotpatch an ethernet adapter's firmware to respond to incoming packets that operate out of band with normal IP packets. Meaning it's a way to communicate with a target computer that's completely undetectable by standard tools. Using such an exploit against a computer isn't typically a risk, because the target you're exploiting isn't sophisticated enough to catch the exploit. And even if they were, and they send their computer to a foreign intelligence agency for extensive analysis, that typically wouldn't confer an advantage to that agency. They were already developing their own exploits to use against us, and there are only so many unique techniques. The way to protect against this is probably to have constant security audits. But these are expensive, so the situation is that there will always be exploitable computers and software, especially when a nation-state adversary is doing the exploitation. The solution is what it's always been: Political control. We have terrifying weapons, and what keeps them at bay is aligning the incentives of our politicians so that the calculus of employing them is more costly than keeping them unused. (Unfortunately this may not be possible with cyberweapons, because unlike real weapons, there is no death and destruction as a side effect.)