6 ms·

The damages caused by US agencies* are easily underestimated. It's not just the equipment rendered useless and data lost due to their software. It's also the mi

by flexie 9y ago

The damages caused by US agencies* are easily underestimated. It's not just the equipment rendered useless and data lost due to their software. It's also the millions of hours spent by IT departments worldwide battling with infected computers and securing not yet infected computers. Damages are easily in the tens of billions of USD. And then there is the loss of credibility of the US government and the companies involved. *Edit: FBI changed to US agencies.

cmurf 9y ago
Quite an incentive for an untimely and disproportionate response to the attackers, should they be located. Edit: Umm, humans have formed armies and started wars over far less theft and far lesser threats to their populations than this. If the attackers are located, some piano wire around their necks is really cheap in comparison. And for this amount of damage, I do not doubt for a moment that it's a consideration by every single government spy organization.
- chasing 9y ago
  If these hackers caused tens of billions of dollars worth of damage... I'm happy to see a rapid and decisive response severe enough to dissuade people from trying a stunt like this again. Maybe leaving my front door unlocked was a bad idea, but you still robbed my house.
- abraves10001 9y ago
  Or, you know, just improving their practices.
pcr0 9y ago
I think you meant to refer to the NSA instead of the FBI.
simonh 9y ago
The recent hacks used NSA tech, the FBI had nothing to do with it. The OP is generalizing that un-closed vulnerabilities in the hands of any government agency are an unacceptable risk, which I agree with, but let's put the blame for the current issue where it belongs.
- flexie 9y ago
  Agree and edited, although it really is two units under the same government - and that's where the blame belongs.
- rhizome 9y ago
  but let's put the blame for the current issue where it belongs Was GP generalizing, or overspecifying? Because from where I sit the responsibility (for not notifying Microsoft) does appear to lie within the Departments of Defense and Justice, and I wouldn't be surprised if the Venn diagram for the split responsibility is based on a simple division of labor.
AJ007 9y ago
It is espionage by the US intelligence community against US companies. A lot of these guys should be in prison. I've repeatedly said on HN -- if the US tech companies can't build the most secure systems possible, the US government itself will not be able to secure their own systems. Secure devices and communication is not a given nor will it become easier.
- sillysaurus3 9y ago
  Are you of the opinion that we should dismantle our military? Because that's what you'd literally be doing by sending NSA employees to prison. They are military. It was a cyberweapon. That's the point of a cyber weapon. Russians stole it from the NSA. Yes, that's incompetence, but an attacker only has to get lucky once. It's much harder to defend a cyberweapon than a tomahawk missile. Does that mean we shouldn't build cyberweapons? No. That's just how cyberweapons are. That's the reality we live in now, and the world will just have to deal with it. There's nothing to be done, is there? Not unless you're suggesting that computers should never be used for offensive capabilities, which from a game theory perspective means that country will be powerless in the digital arena.
  - stale2002 9y ago
    If the people working for the NSA don't want to go to prison, then maybe they should stop committing treason by breaking our constitution and illegally spying on Americans through illegal programs. Don't do the crime if you cant do the time. Personally, I'd rather our military NOT be full of people who are willing to do this kind of thing. If this discussion was about missiles, and the gov agency in charge of the missiles were using them on Americans, I'd say that they should go to jail as well. You are right. These cyber exploits are weapons. And they should stop using those weapons on Americans, as a multitude of leaks have shown that they do, through mass spying and mass data collection programs.
    - sillysaurus3 9y ago
      It's not productive to reduce the argument to this extreme. There's no way for the NSA to do what the NSA does without searching for exploits and weaponizing them. That's the whole reason to have an NSA.
naasking 9y ago
> It's not just the equipment rendered useless and data lost due to their software. It's also the millions of hours spent by IT departments worldwide battling with infected computers and securing not yet infected computers. Damages are easily in the tens of billions of USD. You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Manufacturers and software developers could just start using better languages and better development practices instead of whinging every time their C/C++ software is trivially owned.
- deleted 9y ago
  [deleted]
- chimeracoder 9y ago
  > You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Officially, the NSA's role is not to sit on zero-day exploits. If it discovers zero-day exploits (either by accident or through active research), then it should follow industry practices for disclosing and patching it[0]. [0] There are discussions of what constitututes "industry best practices", but I think we can all agree that "telling nobody, including the software vendors, with the hopes of being able to exploit it later" does not qualify.
  - PeterisP 9y ago
    Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. You might argue whether or not NSA should be into 'hacking other people with 0-days' business or 'making computers more vulnerable' business, but NSA definitely is not in the business of making computers less vulnerable. Especially for computers located in other countries, they have no business helping to protect them - that's against their role, they're paid to facilitate the exact opposite goal.
    - infogulch 9y ago
      That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?
jwdunne 9y ago
Lives too. Our already financially crippled NHS was hit extremely hard. They are not allowed to upgrade automatically because their software will break. The cost to upgrade the software isn't feasible when you have a multi-billion wide gap.

by flexie 9y ago

cmurf 9y ago

Quite an incentive for an untimely and disproportionate response to the attackers, should they be located. Edit: Umm, humans have formed armies and started wars over far less theft and far lesser threats to their populations than this. If the attackers are located, some piano wire around their necks is really cheap in comparison. And for this amount of damage, I do not doubt for a moment that it's a consideration by every single government spy organization.

chasing 9y ago
If these hackers caused tens of billions of dollars worth of damage... I'm happy to see a rapid and decisive response severe enough to dissuade people from trying a stunt like this again. Maybe leaving my front door unlocked was a bad idea, but you still robbed my house.
abraves10001 9y ago
Or, you know, just improving their practices.

pcr0 9y ago

I think you meant to refer to the NSA instead of the FBI.

simonh 9y ago

The recent hacks used NSA tech, the FBI had nothing to do with it. The OP is generalizing that un-closed vulnerabilities in the hands of any government agency are an unacceptable risk, which I agree with, but let's put the blame for the current issue where it belongs.

flexie 9y ago
Agree and edited, although it really is two units under the same government - and that's where the blame belongs.
rhizome 9y ago
but let's put the blame for the current issue where it belongs Was GP generalizing, or overspecifying? Because from where I sit the responsibility (for not notifying Microsoft) does appear to lie within the Departments of Defense and Justice, and I wouldn't be surprised if the Venn diagram for the split responsibility is based on a simple division of labor.

AJ007 9y ago

It is espionage by the US intelligence community against US companies. A lot of these guys should be in prison. I've repeatedly said on HN -- if the US tech companies can't build the most secure systems possible, the US government itself will not be able to secure their own systems. Secure devices and communication is not a given nor will it become easier.

sillysaurus3 9y ago
Are you of the opinion that we should dismantle our military? Because that's what you'd literally be doing by sending NSA employees to prison. They are military. It was a cyberweapon. That's the point of a cyber weapon. Russians stole it from the NSA. Yes, that's incompetence, but an attacker only has to get lucky once. It's much harder to defend a cyberweapon than a tomahawk missile. Does that mean we shouldn't build cyberweapons? No. That's just how cyberweapons are. That's the reality we live in now, and the world will just have to deal with it. There's nothing to be done, is there? Not unless you're suggesting that computers should never be used for offensive capabilities, which from a game theory perspective means that country will be powerless in the digital arena.
- stale2002 9y ago
  If the people working for the NSA don't want to go to prison, then maybe they should stop committing treason by breaking our constitution and illegally spying on Americans through illegal programs. Don't do the crime if you cant do the time. Personally, I'd rather our military NOT be full of people who are willing to do this kind of thing. If this discussion was about missiles, and the gov agency in charge of the missiles were using them on Americans, I'd say that they should go to jail as well. You are right. These cyber exploits are weapons. And they should stop using those weapons on Americans, as a multitude of leaks have shown that they do, through mass spying and mass data collection programs.
  - sillysaurus3 9y ago
    It's not productive to reduce the argument to this extreme. There's no way for the NSA to do what the NSA does without searching for exploits and weaponizing them. That's the whole reason to have an NSA.

naasking 9y ago

> It's not just the equipment rendered useless and data lost due to their software. It's also the millions of hours spent by IT departments worldwide battling with infected computers and securing not yet infected computers. Damages are easily in the tens of billions of USD. You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Manufacturers and software developers could just start using better languages and better development practices instead of whinging every time their C/C++ software is trivially owned.

deleted 9y ago
[deleted]
chimeracoder 9y ago
> You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Officially, the NSA's role is not to sit on zero-day exploits. If it discovers zero-day exploits (either by accident or through active research), then it should follow industry practices for disclosing and patching it[0]. [0] There are discussions of what constitututes "industry best practices", but I think we can all agree that "telling nobody, including the software vendors, with the hopes of being able to exploit it later" does not qualify.
- PeterisP 9y ago
  Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. You might argue whether or not NSA should be into 'hacking other people with 0-days' business or 'making computers more vulnerable' business, but NSA definitely is not in the business of making computers less vulnerable. Especially for computers located in other countries, they have no business helping to protect them - that's against their role, they're paid to facilitate the exact opposite goal.
  - infogulch 9y ago
    That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?

jwdunne 9y ago

Lives too. Our already financially crippled NHS was hit extremely hard. They are not allowed to upgrade automatically because their software will break. The cost to upgrade the software isn't feasible when you have a multi-billion wide gap.