6 ms·

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should h

To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The ethical concern here is whether the NSA should have reported the holes to the manufacturers and the failure to handle its privileged knowledge in a safe manner.

Radle 10y ago
It makes no difference whether they created the security holes by moles in the developers company or whether they simply withheld the information. They put human lives at risk by doing it.
ctrl-j 10y ago
> ... it's not the NSA's fault that software has faults. But every time they ask for there to be legally mandated backdoors - they need to be reminded of these incidents. The NSA actively wants there to be "faults" like these. They just only want the "good" guys to have access to them.
- maerF0x0 10y ago
  I definitely agree wrt intentional exploits ("backdoors") to be added. To me this news highlights the need for fundamentally safe software. Just like we might have safety laws in the automotive or airline industry.
  - winkeltripel 10y ago
    If the NHS has been significantly crippled by this, and the NSA is partly at fault, could the NHS successfully sue the NSA in the UK? (edit: my logic and phrasing was really bad)
    - sbov 10y ago
      At least in the US, there is limited ability to sue foreign sovereigns in our courts - not sure if that's the case in the UK too. Beyond that, I doubt this is a rabbit hole any government, much less the UK - which has a fairly imperialistic past - wants to go down. Glass houses and all.
    - willstrafach 10y ago
      That would be a tough argument to make. Similar to how you would have trouble going after a gun manufacturer for murder rather than the attacker.
    - linkregister 10y ago
      Now that the U.S. has set an alarming precedent that the Kingdom of Saudi Arabia can be sued in U.S. court over terrorist funding, maybe the U.S. government could be sued. I don't think they'd win; the ransomware authors and operators are the ones who perpetrated the act. The U.S. government probably wouldn't be found negligent since the software was stolen. NHS carries partial liability since it was negligent with its patching, according to industry-wide IT security standards. Comparing it to firearms, I can be held partially liable for a wrongful death if I leave my Colt 1911 out on my porch; it's different if a burglar stole my gun safe and committed a crime. (obligatory disclaimer that I am not a lawyer, I just play one on Hacker News)
    - drakonandor 10y ago
      They've been told for years to get off XP. They weren't paying MS to keep it updated. The exploit was patched months ago. Why were these machines even on the internet? I'd say the NHS is far more at fault than anyone else here.
  - deleted 10y ago
    [deleted]
InclinedPlane 10y ago
You may be thinking of the 2nd law of thermodynamics. Possibly.
Stanish 10y ago
Is it not likely that the secret police of the world's most powerful empire in history is leveraging companies into creating these vulnerabilities?
dv_dt 10y ago
I don't think you can completely separate the issue from other gov't actions. When the NSA or other gov't agencies come knocking on the door requiring a backdoor or other system security compromises, I would argue that those actions become a broad discouragement for private industry invest in security beyond a certain point.
ablankst 10y ago
I agree about this ethical concern, but this attack also shows that reporting the holes to manufacturers is of limited use -- these exploits have been known to manufacturers since at least March, and while patches have shipped, the computers remain vulnerable. Clearly, automatic security updates are still not aggressive enough to prevent these kinds of problems. Though it isn't clear from the article how out-of-date the vulnerable systems are, which would help in planning for the future. For example, Windows 10 pushes security updates very aggressively, and I wonder how many of the infected computers were running Windows 10 -- health care providers' computer systems are often notoriously out-of-date.
- djsumdog 10y ago
  I would be curious about this too. I'd assume many of them would be running Windows 7, maybe? (Let's hope it's not XP). Also, does Windows 10 Pro attached to a domain controller still have the same aggressive updates? Or do domain admins dictate that policy? At one company I worked at, everyone in IT could volunteer for the patch group to get security patches a few days before the rest of the machines. That seems to work pretty well. Is there any evidence there might have been a 0 day involved that wasn't patched? I find it disheartening that so many machines in large managed networks like telecos and hospitals could be so far behind on patches! (3 months is A LOT in Internet time). If people are just doing really basic stuff like order entry for doctors/nurses, we really need to get away from the full PC model. Seems like most of these machines should just be Chromebooks, Linux boxes that boot straight to a browser or something of that nature instead of a full PC/Macs. Lower the attack surface with something that's easy to update. Those machines would be lower cost too and easier to manage/patch -- moving back to the terminal/thin-client model.
  - uxp 10y ago
    > Let's hope it's not XP BMJ released a report[0] just two days ago alleging that up to 90% of the NHS's computers are still running XP. > Many hospitals use proprietary software that runs on ancient operating systems. Barts Health NHS Trust’s computers attacked by ransomware in January ran Windows XP. Released in 2001, it is now obsolete, yet 90% of NHS trusts run this version of Windows. [0] http://www.bmj.com/content/357/bmj.j2214 http://www.bmj.com/content/357/bmj.j2214
tmnvix 10y ago
> To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. While this is true, it doesn't address the point that you were responding to: > this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc ...where "should be allowed to have" is interpreted as "should be given by software manufacturers".
deleted 10y ago
[deleted]
cortesoft 10y ago
He is not talking about the actual flaws as being the example as to why we shouldn't give the NSA backdoor access; he is saying that the leaks prove that even the NSA can't keep their stuff secret. If they couldn't keep their hacking tools secret, why should we think they can keep their backdoor access secret?
- Kholo 10y ago
  Good time to remind folks that gmail, facebook, whatsapp, amazon etc aren't going to be able to protect their data forever at the levels they currently are capable off. A couple of bad business decisions and they are where yahoo is today. So be smart about how you use these services and educate the non-technical folks around you.
  - cortesoft 10y ago
    What would 'being smart' about using these services mean? It is pretty difficult to get through life in the modern age without using email for sensitive documents (or at least without using ACCESS to your email as a way to gain access to sensitive services, eg password reset emails, proof of ownership, etc) Since email in the modern world has this type of importance, what should I do? If you say gmail can't protect their data forever, do I not use gmail for email? What do I use then? No service will be free from data leakage, even an email server I run myself.
    - malandrew 10y ago
      I would say that it's probably smart to occasionally purge all your content from online services and keep your data in cold storage you physically control.
      - cortesoft 10y ago
        There is quite a large cost to that, though. Being able to search through old emails is a lifesaver. I can't count how many times I have searched through email to find some account info I set up years ago, or to get date information about when something happened. Just today, I searched my email for my old FastTrak account info, and found it on an email from 5 years ago. Deleting all my email would be a big cost to pay for a gain that I can't exactly quantify; I would have to figure out the likelihood of my data being leaked over time and the cost to me if the data was leaked. That isn't readily obvious what the risk factor is for me, but I KNOW the cost factor.
gigatexal 10y ago
Ok, so show us how you write perfectly secure code. It's sure as hell is the NSA's fault here for mishandling all their hacks into commercial sw.
alasdair_ 10y ago
>To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The NSA has a specific mission to secure the nation's infrastructure. In witholding key information from US companies, it's failing that mission.
- korethr 10y ago
  That's half the NSA's mission. Tt has another half and that is eavesdropping and getting into things. Those two missions are at odds with each other, and so the NSA has to make decisions about trade-offs. As these incidents show, the trade-offs the NSA has chosen to make have turned out to have been bad ideas.
  - robin_reala 10y ago
    This is why the NCSC was split from GCHQ in the UK. https://en.wikipedia.org/wiki/National_Cyber_Security_Centre_%28United_Kingdom%29 https://en.wikipedia.org/wiki/National_Cyber_Security_Centre...

Radle 10y ago

It makes no difference whether they created the security holes by moles in the developers company or whether they simply withheld the information. They put human lives at risk by doing it.

ctrl-j 10y ago

> ... it's not the NSA's fault that software has faults. But every time they ask for there to be legally mandated backdoors - they need to be reminded of these incidents. The NSA actively wants there to be "faults" like these. They just only want the "good" guys to have access to them.

maerF0x0 10y ago
I definitely agree wrt intentional exploits ("backdoors") to be added. To me this news highlights the need for fundamentally safe software. Just like we might have safety laws in the automotive or airline industry.
- winkeltripel 10y ago
  If the NHS has been significantly crippled by this, and the NSA is partly at fault, could the NHS successfully sue the NSA in the UK? (edit: my logic and phrasing was really bad)
  - sbov 10y ago
    At least in the US, there is limited ability to sue foreign sovereigns in our courts - not sure if that's the case in the UK too. Beyond that, I doubt this is a rabbit hole any government, much less the UK - which has a fairly imperialistic past - wants to go down. Glass houses and all.
  - willstrafach 10y ago
    That would be a tough argument to make. Similar to how you would have trouble going after a gun manufacturer for murder rather than the attacker.
  - linkregister 10y ago
    Now that the U.S. has set an alarming precedent that the Kingdom of Saudi Arabia can be sued in U.S. court over terrorist funding, maybe the U.S. government could be sued. I don't think they'd win; the ransomware authors and operators are the ones who perpetrated the act. The U.S. government probably wouldn't be found negligent since the software was stolen. NHS carries partial liability since it was negligent with its patching, according to industry-wide IT security standards. Comparing it to firearms, I can be held partially liable for a wrongful death if I leave my Colt 1911 out on my porch; it's different if a burglar stole my gun safe and committed a crime. (obligatory disclaimer that I am not a lawyer, I just play one on Hacker News)
  - drakonandor 10y ago
    They've been told for years to get off XP. They weren't paying MS to keep it updated. The exploit was patched months ago. Why were these machines even on the internet? I'd say the NHS is far more at fault than anyone else here.
- deleted 10y ago
  [deleted]

InclinedPlane 10y ago

You may be thinking of the 2nd law of thermodynamics. Possibly.

Stanish 10y ago

Is it not likely that the secret police of the world's most powerful empire in history is leveraging companies into creating these vulnerabilities?

dv_dt 10y ago

I don't think you can completely separate the issue from other gov't actions. When the NSA or other gov't agencies come knocking on the door requiring a backdoor or other system security compromises, I would argue that those actions become a broad discouragement for private industry invest in security beyond a certain point.

ablankst 10y ago

I agree about this ethical concern, but this attack also shows that reporting the holes to manufacturers is of limited use -- these exploits have been known to manufacturers since at least March, and while patches have shipped, the computers remain vulnerable. Clearly, automatic security updates are still not aggressive enough to prevent these kinds of problems. Though it isn't clear from the article how out-of-date the vulnerable systems are, which would help in planning for the future. For example, Windows 10 pushes security updates very aggressively, and I wonder how many of the infected computers were running Windows 10 -- health care providers' computer systems are often notoriously out-of-date.

djsumdog 10y ago
I would be curious about this too. I'd assume many of them would be running Windows 7, maybe? (Let's hope it's not XP). Also, does Windows 10 Pro attached to a domain controller still have the same aggressive updates? Or do domain admins dictate that policy? At one company I worked at, everyone in IT could volunteer for the patch group to get security patches a few days before the rest of the machines. That seems to work pretty well. Is there any evidence there might have been a 0 day involved that wasn't patched? I find it disheartening that so many machines in large managed networks like telecos and hospitals could be so far behind on patches! (3 months is A LOT in Internet time). If people are just doing really basic stuff like order entry for doctors/nurses, we really need to get away from the full PC model. Seems like most of these machines should just be Chromebooks, Linux boxes that boot straight to a browser or something of that nature instead of a full PC/Macs. Lower the attack surface with something that's easy to update. Those machines would be lower cost too and easier to manage/patch -- moving back to the terminal/thin-client model.
- uxp 10y ago
  > Let's hope it's not XP BMJ released a report[0] just two days ago alleging that up to 90% of the NHS's computers are still running XP. > Many hospitals use proprietary software that runs on ancient operating systems. Barts Health NHS Trust’s computers attacked by ransomware in January ran Windows XP. Released in 2001, it is now obsolete, yet 90% of NHS trusts run this version of Windows. [0] http://www.bmj.com/content/357/bmj.j2214 http://www.bmj.com/content/357/bmj.j2214

tmnvix 10y ago

> To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. While this is true, it doesn't address the point that you were responding to: > this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc ...where "should be allowed to have" is interpreted as "should be given by software manufacturers".

deleted 10y ago

[deleted]

cortesoft 10y ago

He is not talking about the actual flaws as being the example as to why we shouldn't give the NSA backdoor access; he is saying that the leaks prove that even the NSA can't keep their stuff secret. If they couldn't keep their hacking tools secret, why should we think they can keep their backdoor access secret?

Kholo 10y ago
Good time to remind folks that gmail, facebook, whatsapp, amazon etc aren't going to be able to protect their data forever at the levels they currently are capable off. A couple of bad business decisions and they are where yahoo is today. So be smart about how you use these services and educate the non-technical folks around you.
- cortesoft 10y ago
  What would 'being smart' about using these services mean? It is pretty difficult to get through life in the modern age without using email for sensitive documents (or at least without using ACCESS to your email as a way to gain access to sensitive services, eg password reset emails, proof of ownership, etc) Since email in the modern world has this type of importance, what should I do? If you say gmail can't protect their data forever, do I not use gmail for email? What do I use then? No service will be free from data leakage, even an email server I run myself.
  - malandrew 10y ago
    I would say that it's probably smart to occasionally purge all your content from online services and keep your data in cold storage you physically control.
    - cortesoft 10y ago
      There is quite a large cost to that, though. Being able to search through old emails is a lifesaver. I can't count how many times I have searched through email to find some account info I set up years ago, or to get date information about when something happened. Just today, I searched my email for my old FastTrak account info, and found it on an email from 5 years ago. Deleting all my email would be a big cost to pay for a gain that I can't exactly quantify; I would have to figure out the likelihood of my data being leaked over time and the cost to me if the data was leaked. That isn't readily obvious what the risk factor is for me, but I KNOW the cost factor.

gigatexal 10y ago

Ok, so show us how you write perfectly secure code. It's sure as hell is the NSA's fault here for mishandling all their hacks into commercial sw.

alasdair_ 10y ago

>To be completely fair, it's not the NSA's fault that software has faults. Its the software manufacturers'. The NSA has a specific mission to secure the nation's infrastructure. In witholding key information from US companies, it's failing that mission.

korethr 10y ago
That's half the NSA's mission. Tt has another half and that is eavesdropping and getting into things. Those two missions are at odds with each other, and so the NSA has to make decisions about trade-offs. As these incidents show, the trade-offs the NSA has chosen to make have turned out to have been bad ideas.
- robin_reala 10y ago
  This is why the NCSC was split from GCHQ in the UK. https://en.wikipedia.org/wiki/National_Cyber_Security_Centre_%28United_Kingdom%29 https://en.wikipedia.org/wiki/National_Cyber_Security_Centre...