4 ms·

> You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Officially, the NSA's role is not to sit on zero-day exploits.

> You can't pin that on spy agencies. Criminals would have exploited the same holes eventually. Officially, the NSA's role is not to sit on zero-day exploits. If it discovers zero-day exploits (either by accident or through active research), then it should follow industry practices for disclosing and patching it[0]. [0] There are discussions of what constitututes "industry best practices", but I think we can all agree that "telling nobody, including the software vendors, with the hopes of being able to exploit it later" does not qualify.

PeterisP 9y ago
Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. You might argue whether or not NSA should be into 'hacking other people with 0-days' business or 'making computers more vulnerable' business, but NSA definitely is not in the business of making computers less vulnerable. Especially for computers located in other countries, they have no business helping to protect them - that's against their role, they're paid to facilitate the exact opposite goal.
- infogulch 9y ago
  That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?
  - sillysaurus3 9y ago
    The purpose of the NSA is the same as the purpose of the military: To apply force in the digital arena, the same way the military applies force in the physical arena. In the same vein, the NSA isn't about protection. That's not their role, just like the point of the military isn't protection.
    - infogulch 9y ago
      > the point of the military isn't protection I'd argue that it is, if indirectly.
      - sillysaurus3 9y ago
        It's true. We're all safer thanks to the enormous success of our military. That's why it's valuable, just like the NSA. So it leads to the same logical conclusions: If the point of the military is to apply force to an opponent, then the NSA has to have ways of applying force to a digital opponent. Disclosing vulnerabilities would be precisely the opposite of what they should do.
        ionised 9y ago
        > We're all safer thanks to the enormous success of our military Examples from the last 50 years?
    - extra88 9y ago
      NSA has dual roles, not only spying on others but also protecting U.S. resources. This creates this tension between keeping exploits secret or informing vendors and others. For a long time, security researchers like Bruce Schneier have advocated for splitting the NSA up, essentially one for offense and one for defense.
  - PeterisP 9y ago
    NSA's role could include protecting the nation's citizens or whatever other role the US government decides to assign to NSA, but it currently does not. In addition to it's main role of collection of foreign intelligence data (which includes breaking encryption and finding/making vulnerabilities), it does have a secondary mission of protecting US government systems. Hopefully that does mean that they have ensured that US gov't systems have been patched against those vulnerabilities. For example, Microsoft patching the SMB vulnerability (including for WinXP) before it was made public was likely done after a report from NSA, and would be consistent with such a goal. Having "private" custom patches that would get installed in sensitive gov't systems but not made available to general public would also match this goal. However, the relationship of NSA and the main victims of WannaCry are at best neutral. For example, it seems reasonable that NSA should want companies like Spain's Telefonica to stay vulnerable to various exploits - their mission explicitly includes obtaining intelligence from (among other sources) foreign telecommunications operators, so if they had the ability to protect Telefonica, then doing so would go against the mission given to NSA by the congress.
- qb45 9y ago
  > Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations. That being said, it still wouldn't help against WannaCry because Microsoft made a blunder when they disclosed the vuln by patching new versions of Windows while they left majority of XP installations unfixed. Even without the NSA leak somebody may have reverse engineered the bug from the released updates - such things happened in the past.
  - willstrafach 9y ago
    > Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations. This sounds similar to what IAD does. The difference is that IAD focuses on securing systems against entire classes of vulnerabilities and attacks. SID has the mission of gathering signals intelligence, so that is why it makes sense for them to utilize individual zero day vulnerabilities. They need to get into an adversary system, so vulnerabilities are required (when needed) to get that access.
  - hermitdev 9y ago
    How do you propose to solve the conundrum of this vulnerability is so bad, MS needs to release a fix, even for unsupported OSes, and get people still running those unsupported OSes to install the fix without disclosing there's a critical issue?
    - qb45 9y ago
      I'm not saying they shouldn't be disclosing that the patch is critical, I said that in the case of ancient bugs affecting all versions of Windows they should release all patches at the same time.
- yardie 9y ago
  > but NSA definitely is not in the business of making computers less vulnerable. Last time I spoke with the NSA, admittedly over a decade ago at a college recruitment event, they were in that business as well. So much so that they created a hardened version of Linux that a lot of us today [0]. [0] https://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linux

PeterisP 9y ago

Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. You might argue whether or not NSA should be into 'hacking other people with 0-days' business or 'making computers more vulnerable' business, but NSA definitely is not in the business of making computers less vulnerable. Especially for computers located in other countries, they have no business helping to protect them - that's against their role, they're paid to facilitate the exact opposite goal.

infogulch 9y ago
That looks like a false dichotomy to me. I don't see any reason why the NSA's role couldn't include protecting the nation's citizens. I mean that's the original purpose of government, no?
- sillysaurus3 9y ago
  The purpose of the NSA is the same as the purpose of the military: To apply force in the digital arena, the same way the military applies force in the physical arena. In the same vein, the NSA isn't about protection. That's not their role, just like the point of the military isn't protection.
  - infogulch 9y ago
    > the point of the military isn't protection I'd argue that it is, if indirectly.
    - sillysaurus3 9y ago
      It's true. We're all safer thanks to the enormous success of our military. That's why it's valuable, just like the NSA. So it leads to the same logical conclusions: If the point of the military is to apply force to an opponent, then the NSA has to have ways of applying force to a digital opponent. Disclosing vulnerabilities would be precisely the opposite of what they should do.
      - ionised 9y ago
        > We're all safer thanks to the enormous success of our military Examples from the last 50 years?
  - extra88 9y ago
    NSA has dual roles, not only spying on others but also protecting U.S. resources. This creates this tension between keeping exploits secret or informing vendors and others. For a long time, security researchers like Bruce Schneier have advocated for splitting the NSA up, essentially one for offense and one for defense.
- PeterisP 9y ago
  NSA's role could include protecting the nation's citizens or whatever other role the US government decides to assign to NSA, but it currently does not. In addition to it's main role of collection of foreign intelligence data (which includes breaking encryption and finding/making vulnerabilities), it does have a secondary mission of protecting US government systems. Hopefully that does mean that they have ensured that US gov't systems have been patched against those vulnerabilities. For example, Microsoft patching the SMB vulnerability (including for WinXP) before it was made public was likely done after a report from NSA, and would be consistent with such a goal. Having "private" custom patches that would get installed in sensitive gov't systems but not made available to general public would also match this goal. However, the relationship of NSA and the main victims of WannaCry are at best neutral. For example, it seems reasonable that NSA should want companies like Spain's Telefonica to stay vulnerable to various exploits - their mission explicitly includes obtaining intelligence from (among other sources) foreign telecommunications operators, so if they had the ability to protect Telefonica, then doing so would go against the mission given to NSA by the congress.
qb45 9y ago
> Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose. Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations. That being said, it still wouldn't help against WannaCry because Microsoft made a blunder when they disclosed the vuln by patching new versions of Windows while they left majority of XP installations unfixed. Even without the NSA leak somebody may have reverse engineered the bug from the released updates - such things happened in the past.
- willstrafach 9y ago
  > Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations. This sounds similar to what IAD does. The difference is that IAD focuses on securing systems against entire classes of vulnerabilities and attacks. SID has the mission of gathering signals intelligence, so that is why it makes sense for them to utilize individual zero day vulnerabilities. They need to get into an adversary system, so vulnerabilities are required (when needed) to get that access.
- hermitdev 9y ago
  How do you propose to solve the conundrum of this vulnerability is so bad, MS needs to release a fix, even for unsupported OSes, and get people still running those unsupported OSes to install the fix without disclosing there's a critical issue?
  - qb45 9y ago
    I'm not saying they shouldn't be disclosing that the patch is critical, I said that in the case of ancient bugs affecting all versions of Windows they should release all patches at the same time.
yardie 9y ago
> but NSA definitely is not in the business of making computers less vulnerable. Last time I spoke with the NSA, admittedly over a decade ago at a college recruitment event, they were in that business as well. So much so that they created a hardened version of Linux that a lot of us today [0]. [0] https://en.wikipedia.org/wiki/Security-Enhanced_Linux https://en.wikipedia.org/wiki/Security-Enhanced_Linux