3 ms·

How would this work for a private individual? Would this help create a precedent for private security researchers where they might be held liable for not disclo

by tuxxy 9y ago

How would this work for a private individual? Would this help create a precedent for private security researchers where they might be held liable for not disclosing 0days? I agree that this would definitely curb potential damage, but I'm not sure if this is exactly the right way to go about it. NSA is first and foremost an intelligence agency. What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"?

setq 9y ago
There isn't one. Report the vulnerabilities to the vendor and move on. The trade off is too dangerous. Do you stockpile munitions that can damage global infrastructure so you can target a small number of individuals? No that's just stupid and irresponsible.
mcintyre1994 9y ago
Is there any legitimate reason to hold 0 days without disclosing them to the vendor? There probably are reasons I haven't thought of, but do they apply to as active a company as Microsoft? Edit: I think I misread this and you're asking in the context of the NSA holding them. I still doubt there's a way to do it responsibly, so they probably shouldn't be doing it.
- downandout 9y ago
  Sure there is a legitimate reason to withhold them, though many would say it's not a very ethical one: money. Private researchers hold them for sale to the NSA and other agencies all the time. Here are a few exchanges (there are also high end "agents" - akin to Hollywood agents - that broker these deals): [1] https://zerodium.com/ https://zerodium.com/ [2] https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e... And some info on this market: https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
  - frubar 9y ago
    Every possible job doesn't need to exist. We shouldn't put the whole online world at risk so a handful of people can make a buck.
Asooka 9y ago
I would say there is a difference between having a bare-bones proof of concept and a fully developed malware.
syshum 9y ago
>>What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"? I think the best policy is for them to not maintain an "effective arsenal" at all, the second they find a vulnerability they should report it.

by tuxxy 9y ago

setq 9y ago

There isn't one. Report the vulnerabilities to the vendor and move on. The trade off is too dangerous. Do you stockpile munitions that can damage global infrastructure so you can target a small number of individuals? No that's just stupid and irresponsible.

mcintyre1994 9y ago

Is there any legitimate reason to hold 0 days without disclosing them to the vendor? There probably are reasons I haven't thought of, but do they apply to as active a company as Microsoft? Edit: I think I misread this and you're asking in the context of the NSA holding them. I still doubt there's a way to do it responsibly, so they probably shouldn't be doing it.

downandout 9y ago
Sure there is a legitimate reason to withhold them, though many would say it's not a very ethical one: money. Private researchers hold them for sale to the NSA and other agencies all the time. Here are a few exchanges (there are also high end "agents" - akin to Hollywood agents - that broker these deals): [1] https://zerodium.com/ https://zerodium.com/ [2] https://www.mitnicksecurity.com/shopping/absolute-zero-day-exploit-exchange https://www.mitnicksecurity.com/shopping/absolute-zero-day-e... And some info on this market: https://en.wikipedia.org/wiki/Market_for_zero-day_exploits https://en.wikipedia.org/wiki/Market_for_zero-day_exploits
- frubar 9y ago
  Every possible job doesn't need to exist. We shouldn't put the whole online world at risk so a handful of people can make a buck.

Asooka 9y ago

I would say there is a difference between having a bare-bones proof of concept and a fully developed malware.

syshum 9y ago

>>What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"? I think the best policy is for them to not maintain an "effective arsenal" at all, the second they find a vulnerability they should report it.