4 ms·

A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?

by wgx 8y ago

setquk 8y ago
Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g...
- giancarlostoro 8y ago
  This makes me wonder if this is how Stuxnet was birthed, very interesting.
  - krylon 8y ago
    A former coworker of mine who works in industrial automation told me that Siemens had to give US authorities access to their source code; I would not be surprised if that source code had "leaked" to the intelligence services.
- 394549 8y ago
  >> A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is? > Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g... Though, it's worth noting that the NSA actually two roles: 1) ensuring the security of US Government communications systems and 2) conducting signals intelligence against other foreign communications systems. People focus so much on the former that they often forget the latter. Given their defensive role, being "done" with these exploits may mean simply having patched/secured all their systems against them.
dx87 8y ago
Probably not true. You can see from the leaked shadow brokers tools that they had to develop exploits to get on the devices, they didn't just have free access.
- shshhdhs 8y ago
  I don’t follow. In most cases, you still have to develop exploits to “exploit” vulnerabilities. Very few of them just offer you a login prompt over the internet.
  - dx87 8y ago
    What don't you follow? If 3 letter agencies had been given backdoor access by Cisco, why would the 3 letter agencies need to develop exploits that take advantage of flaws in the software? Cisco could have just added port knocking instead of adding additional accounts and logic errors and hoping nobody except the US govt finds it.
    - drb91 8y ago
      Maybe I’m reading wrong, but nobody implied Cisco installed the backdoor at the request of the government.
      - Buge 8y ago
        wgx seemed to be saying that.
code_duck 8y ago
I’m sure the NSA and other extreme security organizations knew about some of them. Is what you’re asking whether they have control or influence with Cisco regarding the release, other than choosing to not report?

A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?

by wgx 8y ago

A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is?

setquk 8y ago

Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g...

giancarlostoro 8y ago
This makes me wonder if this is how Stuxnet was birthed, very interesting.
- krylon 8y ago
  A former coworker of mine who works in industrial automation told me that Siemens had to give US authorities access to their source code; I would not be surprised if that source code had "leaked" to the intelligence services.
394549 8y ago
>> A colleague said: "The three-letter agencies are done with these, so they can go public now" - I wonder how true that is? > Likely. Considering the three letter agencies get early access to these things from other vendors: https://arstechnica.com/information-technology/2013/06/nsa-gets-early-access-to-zero-day-data-from-microsoft-others/ https://arstechnica.com/information-technology/2013/06/nsa-g... Though, it's worth noting that the NSA actually two roles: 1) ensuring the security of US Government communications systems and 2) conducting signals intelligence against other foreign communications systems. People focus so much on the former that they often forget the latter. Given their defensive role, being "done" with these exploits may mean simply having patched/secured all their systems against them.

dx87 8y ago

Probably not true. You can see from the leaked shadow brokers tools that they had to develop exploits to get on the devices, they didn't just have free access.

shshhdhs 8y ago
I don’t follow. In most cases, you still have to develop exploits to “exploit” vulnerabilities. Very few of them just offer you a login prompt over the internet.
- dx87 8y ago
  What don't you follow? If 3 letter agencies had been given backdoor access by Cisco, why would the 3 letter agencies need to develop exploits that take advantage of flaws in the software? Cisco could have just added port knocking instead of adding additional accounts and logic errors and hoping nobody except the US govt finds it.
  - drb91 8y ago
    Maybe I’m reading wrong, but nobody implied Cisco installed the backdoor at the request of the government.
    - Buge 8y ago
      wgx seemed to be saying that.

code_duck 8y ago

I’m sure the NSA and other extreme security organizations knew about some of them. Is what you’re asking whether they have control or influence with Cisco regarding the release, other than choosing to not report?