3 ms·
>To put it another way, the alternative is not that the NSA would have Microsoft about EternalBlue years ago, but that the underlying bug would have remained un
by lowbloodsugar 9y ago
>To put it another way, the alternative is not that the NSA would have Microsoft about EternalBlue years ago, but that the underlying bug would have remained un-patched for even longer than it was (perhaps to be discovered by other entities like China or Russia; the NSA is not the only organization searching for bugs).
False dichotomy. The choices are not only:
a) NSA pays lots of money to identify exploits and then hoards and uses them, vs
b) NSA does not identify exploits, leaving it up to China or Russia to do so and leaving us vulnerable.
There is a third choice:
c) NSA recognizes that only State actors have the money or time for this kind of thing, and should invest the money to detect and report exploits because China and Russia are probably doing so.
In fact (a) doesn't actually provide defense against China and Russia having the exploit: we were undefended until the exploit leaked, and without the leak, China or Russia could have executed an attack at any time. They didn't.
- sigmar 9y ago>c) NSA recognizes that only State actors have the money or time for this kind of thing, and should invest the money to detect and report exploits because China and Russia are probably doing so. China and Russia are reporting vulnerabilities? Got a source for that?
- deleted 9y ago[deleted]
- Sniffnoy 9y agoI'm pretty sure they meant "because China and Russia are probably identifying exploits", not "because China and Russia are reporting exploits". I.e. it's a defensive measure.
- sbov 9y ago> They didn't. How do we know? Presumably the NSA has used this exploit before, and we didn't know. Presumably Russia and China use their exploits in similar ways. It's not about locking someone out of their computer and displaying a giant skull and crossbones to say "I was here". Isn't it more about getting information off computers without people knowing you were there? That's why this event is so interesting. It's an obvious hazard we can point to from hording vulnerabilities. In contrast, isn't it pretty much impossible to point to some target having their system opened up so enemies can read information? It seems like there's no way for us to know how many NSA horded (or planted) vulnerabilities have been exploited by people they don't want to exploit them.
- misterbowfinger 9y agoBut to the NSA, reporting exploits helps opposing State actors. They want to hoard the exploits so that no one else has them. Perhaps it's possible to only communicate exploits to US companies, but that's really unlikely to go well.