5 ms·

> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting b

> If you put backdoors in, or exploit 0days for your own This seems like a disingenuous statement. I believe many reasonable folks would agree that inserting backdoors is an awful idea. However, there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors. Mentioning backdoors dilutes the discussion as it makes it seem like there is any sort of relationship with 0-day exploits (Which are the issue at hand). 0-days are going to be in code regardless of who finds them. It would be great to get some clarification on this from the government, but I would be pretty OK if the process looked anything like this: 1. Discover 0-day exploit relevant to mission. 2. Build modular tools to utilize the 0-day. 3. Create detection signatures for the exploit to run against Upstream collected internet communications. 4. If another party is seen using the same 0-day (doesn't matter if it was via leak or independent discovery), have a cutout such as FBI or DHS contact vendor with details to get it patched ASAP.

losteric 9y ago
That's the exact process I'd like to see, but what really happens is more like: 1. Discover 0-day exploits relevant to mission 2. Build modular tools to utilize the 0-day 3. Do nothing 4. Lose control of 0days, or allow other actors to discover them. It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open.
- ganoushoreilly 9y ago
  "It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open" I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.
cairo_x 9y ago
Many of those exploits will be used to knock through a backdoor. I wonder if they use different keys for each one? Fingers crossed they do.
whatshisface 9y ago
>3. Create detection signatures for the exploit to run against Upstream collected internet communications. Yes, it's a good thing that very illegal cyberattacks are never done over encrypted channels. To catch the once-in-a-blue-moon hacker who has their bots log in to the mothership with ssh or something, we could just go ahead and let the government write ring-0 antivirus for us.
- willstrafach 9y ago
  I think you understand that my comment was phrased generically so that the logic applies to multiple scenarios (not just this one).
  - whatshisface 9y ago
    The only signatures that could ever appear in the open would be from, very specifically, attacks on encryption implementations during startup (heartbleed attacked keepalive for example, so no help there). The attack surface of the application itself will always lie entirely behind the no-visiblity line.
3131s 9y ago
> there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors And this seems a little disingenuous. Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers, but in general the NSA has a history of creating backdoors. You and I discussed some of this a bit already in one of the older NSA threads: https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG The idea of "key escrow", used by the NSA in the Clipper Chip's Skipjack algorithm, is really a euphemism for a built-in cryptographic backdoor. https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Skipjack_(cipher) https://en.wikipedia.org/wiki/Skipjack_(cipher)
- willstrafach 9y ago
  I definitely do not deny any previous instances. I am very against backdoors and will never defend them. But it is an extreme accusation to make against Microsoft in this case without evidence, so the fact that there is no evidence should be stated clearly to ensure people do not get confused.
- Karunamon 9y ago
  Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers And right there, GP is correct. Either there is evidence to suggest that these were planted backdoors (difficulty: patched out long before the leaks), or there is not.
cstejerean 9y ago
I think a more reasonable approach would be to have a hard time limit on each discovered exploit. Something like 180 days to use it for any missions, after which they must report the exploit and get it patched. This shortens the window for any leaks or independent discovery while still allowing it to be used for important intelligence gathering activities. In turn this will create a pressure to keep finding more exploits as old ones expire, and that in turn will mean more get fixed 180 days later, etc.
- ethbro 9y ago
  I love comments like this, because they acknowledge that there are two valuable things here: (a) collecting sigint via available means & (b) keeping infrastructure secure. The best solution enables both of these to the maximal extent possible (and has honest discussions about their relative values).
blitmap 9y ago
Would it be crazy to say sitting on exploits is effectively "inserting a backdoor"? Maybe it doesn't have a doormat but it certainly still grants you access. To me this would seem against the mission statement of protecting national security when a whole list of them are published, like now... EDIT: I would agree that without intent to gain access, it's not inserting a backdoor.
- travmatt 9y ago
  >Would it be crazy to say sitting on exploits is effectively "inserting a backdoor" That seems intentionally dishonest, no? If I disagree with a position I'm not justified in intentionally misrepresenting it because I feel morally correct. Unless you're alleging that these vulnerabilities were intentionally placed there, I don't understand why you'd feel the need to say that. Worrying about the effects of stockpiling vulnerabilities seems like a defensible position in and of itself.
- kalmari 9y ago
  its a 0day. a bug not intentional. the effect is the same but can and ussually does get fixed(whether timely or not is another thing).
- willstrafach 9y ago
  Hard to say, that is much more of moral argument rather than one you could argue much based on fact. Part of the NSA's job is signals intelligence, so they specifically find the vulnerabilities as a means of access. And if that were not the case, they would not have spent the time finding the vulnerabilities, so those 0-days would still exist and be potential attack vectors regardless.
lazy_gator 9y ago
A unreported zero day is a de facto backdoor. The chain you mentioned has similar flaws as the current strategy. Step 3 would be incredibly difficult. It would be similar to detecting a virus signature, which are easily circumvented. The second party can use trivial techniques to change the signature in a way that makes it incredibly difficult to detect. Many 0-days are built of of multiple bugs. A triple letter may use bug #1 and bug #2 to get a result, but another party will use bug #1 and bug #3 to get a similar result. Back to square one with corporate/government/personal equipment getting hacked reducing overall security.
- acdha 9y ago
  > A unreported zero day is a de facto backdoor Traditionally the meaning of “backdoor” has involved intent as well as access. Unlike a basic bug, the system is working as designed but the designer wasn't trustworthy.
- willstrafach 9y ago
  > A unreported zero day is a de facto backdoor. This is not true. A backdoor indicates that Microsoft is aware of it (and/or colluded to put it in), but there is no evidence of that. I respect your disagreement with my thoughts on how they should handle 0-days, but re-defining "backdoor" does not seem helpful.
  - lazy_gator 9y ago
    We can debate the meaning of words, but the goal of a backdoor from the perspective of the government is to gain access to a system. The effect of a backdoor is accomplished through a literal backdoor or a figurative backdoor by hoarding exploits, which both are a detriment of security. By de facto, I was implying that they both accomplish the same things with almost the same list of pros and cons.
    - willstrafach 9y ago
      When I worked on jailbreaking tools for iOS devices, we routinely held onto multiple 0-days, waiting for a major iOS release to ensure compatibility. While I know there may be reasons to disagree with that practice, I think it would be a major stretch to say that it meant iOS suddenly had a backdoor.
nullquest 9y ago
I find it strange that you seem to be ignorant of the basic concepts of obsfucation and plausible deniability, yet act as though you are knowledgeable of IT security. Do you also believe spies in the physical world use secret entrances with brass placards placed above them? People like you are the reason why organizations fail at security.

losteric 9y ago

That's the exact process I'd like to see, but what really happens is more like: 1. Discover 0-day exploits relevant to mission 2. Build modular tools to utilize the 0-day 3. Do nothing 4. Lose control of 0days, or allow other actors to discover them. It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open.

ganoushoreilly 9y ago
"It seems like the NSA is trying to avoid perceptions that they're scanning domestic internet traffic, but that leaves us in the vulnerable position of hacking everyone while leaving our own doors wide open" I'm curious as to what your response would be to solve this. If it's to scan domestically, then that's a 180 from every other argument point people make against the NSA and domestic operations. That said, they do spend a regular amount of time working with private companies to remedy and solve breaches by nation- state & similar actors. For an example lookup the aurora investigation.

cairo_x 9y ago

Many of those exploits will be used to knock through a backdoor. I wonder if they use different keys for each one? Fingers crossed they do.

whatshisface 9y ago

>3. Create detection signatures for the exploit to run against Upstream collected internet communications. Yes, it's a good thing that very illegal cyberattacks are never done over encrypted channels. To catch the once-in-a-blue-moon hacker who has their bots log in to the mothership with ssh or something, we could just go ahead and let the government write ring-0 antivirus for us.

willstrafach 9y ago
I think you understand that my comment was phrased generically so that the logic applies to multiple scenarios (not just this one).
- whatshisface 9y ago
  The only signatures that could ever appear in the open would be from, very specifically, attacks on encryption implementations during startup (heartbleed attacked keepalive for example, so no help there). The attack surface of the application itself will always lie entirely behind the no-visiblity line.

3131s 9y ago

> there is no evidence at all which indicates the exploits leaked by Shadow Brokers are intentional backdoors And this seems a little disingenuous. Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers, but in general the NSA has a history of creating backdoors. You and I discussed some of this a bit already in one of the older NSA threads: https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Bullrun_(decryption_program) https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG The idea of "key escrow", used by the NSA in the Clipper Chip's Skipjack algorithm, is really a euphemism for a built-in cryptographic backdoor. https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Clipper_chip https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Key_escrow https://en.wikipedia.org/wiki/Skipjack_(cipher) https://en.wikipedia.org/wiki/Skipjack_(cipher)

willstrafach 9y ago
I definitely do not deny any previous instances. I am very against backdoors and will never defend them. But it is an extreme accusation to make against Microsoft in this case without evidence, so the fact that there is no evidence should be stated clearly to ensure people do not get confused.
Karunamon 9y ago
Perhaps there is no evidence so far regarding these particular leaks from Shadow Brokers And right there, GP is correct. Either there is evidence to suggest that these were planted backdoors (difficulty: patched out long before the leaks), or there is not.

cstejerean 9y ago

I think a more reasonable approach would be to have a hard time limit on each discovered exploit. Something like 180 days to use it for any missions, after which they must report the exploit and get it patched. This shortens the window for any leaks or independent discovery while still allowing it to be used for important intelligence gathering activities. In turn this will create a pressure to keep finding more exploits as old ones expire, and that in turn will mean more get fixed 180 days later, etc.

ethbro 9y ago
I love comments like this, because they acknowledge that there are two valuable things here: (a) collecting sigint via available means & (b) keeping infrastructure secure. The best solution enables both of these to the maximal extent possible (and has honest discussions about their relative values).

blitmap 9y ago

Would it be crazy to say sitting on exploits is effectively "inserting a backdoor"? Maybe it doesn't have a doormat but it certainly still grants you access. To me this would seem against the mission statement of protecting national security when a whole list of them are published, like now... EDIT: I would agree that without intent to gain access, it's not inserting a backdoor.

travmatt 9y ago
>Would it be crazy to say sitting on exploits is effectively "inserting a backdoor" That seems intentionally dishonest, no? If I disagree with a position I'm not justified in intentionally misrepresenting it because I feel morally correct. Unless you're alleging that these vulnerabilities were intentionally placed there, I don't understand why you'd feel the need to say that. Worrying about the effects of stockpiling vulnerabilities seems like a defensible position in and of itself.
kalmari 9y ago
its a 0day. a bug not intentional. the effect is the same but can and ussually does get fixed(whether timely or not is another thing).
willstrafach 9y ago
Hard to say, that is much more of moral argument rather than one you could argue much based on fact. Part of the NSA's job is signals intelligence, so they specifically find the vulnerabilities as a means of access. And if that were not the case, they would not have spent the time finding the vulnerabilities, so those 0-days would still exist and be potential attack vectors regardless.

lazy_gator 9y ago

A unreported zero day is a de facto backdoor. The chain you mentioned has similar flaws as the current strategy. Step 3 would be incredibly difficult. It would be similar to detecting a virus signature, which are easily circumvented. The second party can use trivial techniques to change the signature in a way that makes it incredibly difficult to detect. Many 0-days are built of of multiple bugs. A triple letter may use bug #1 and bug #2 to get a result, but another party will use bug #1 and bug #3 to get a similar result. Back to square one with corporate/government/personal equipment getting hacked reducing overall security.

acdha 9y ago
> A unreported zero day is a de facto backdoor Traditionally the meaning of “backdoor” has involved intent as well as access. Unlike a basic bug, the system is working as designed but the designer wasn't trustworthy.
willstrafach 9y ago
> A unreported zero day is a de facto backdoor. This is not true. A backdoor indicates that Microsoft is aware of it (and/or colluded to put it in), but there is no evidence of that. I respect your disagreement with my thoughts on how they should handle 0-days, but re-defining "backdoor" does not seem helpful.
- lazy_gator 9y ago
  We can debate the meaning of words, but the goal of a backdoor from the perspective of the government is to gain access to a system. The effect of a backdoor is accomplished through a literal backdoor or a figurative backdoor by hoarding exploits, which both are a detriment of security. By de facto, I was implying that they both accomplish the same things with almost the same list of pros and cons.
  - willstrafach 9y ago
    When I worked on jailbreaking tools for iOS devices, we routinely held onto multiple 0-days, waiting for a major iOS release to ensure compatibility. While I know there may be reasons to disagree with that practice, I think it would be a major stretch to say that it meant iOS suddenly had a backdoor.

nullquest 9y ago

I find it strange that you seem to be ignorant of the basic concepts of obsfucation and plausible deniability, yet act as though you are knowledgeable of IT security. Do you also believe spies in the physical world use secret entrances with brass placards placed above them? People like you are the reason why organizations fail at security.