5 ms·

While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering

While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit. Don't get me wrong, it's entirely inappropriate for an American government agency to be subverting the security of American products made by American companies and used by the American public. We have a unique opportunity that no other country has to coordinate our secret intelligence work with the private sector to completely own the security industry, but we allow our government to take an adversarial approach to defense. It's insane and criminal, but that's how it is. Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. Roll out the patch to American companies first, but leave select targets still vulnerable. No other country could get Microsoft to do that except the United States... And we waste that opportunity by trying to lone-wolf everything.

AndrewGaspar 8y ago
I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly obvious since hackers examine patch payloads, and 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The status quo of a semi-adversarial relationship between the NSA and tech companies for offensive cyber capabilities seems better to me for both parties. Of course it would be good if they were collaborating on defensive cyber security.
- magduf 8y ago
  > 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The fact that foreign governments aren't more skeptical of Microsoft really baffles me. The American government isn't dumb enough to buy security products from Kapersky after all, or devices from Huawei.
  - espeed 8y ago
    Maybe that was part of the motivation for Microsoft moving toward open-source. Showing their cards in a way that can be audited and verified to ease any potential foreign organization's concerns. Software is part of it, but hardware is the harder sell.
    - chopin 8y ago
      Afaik that's only for cloud. There the software runs on an opaque virtualization layer. Windows is still closed source. Therefore there is a lot of speculation around the phone home capabilities.
- daenz 8y ago
  I read a fantastic article on Stuxnet. I can't find it now, but this should cover it, if you don't know the details https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html https://www.csoonline.com/article/3218104/what-is-stuxnet-wh... To pull of what they did, they knew multiple zero-day vulernabilities in Windows. To any reasonable security-minded person, knowing that many vulnerabilities and having the ability to capitalize on them is likely only achievable a few different ways, one of those ways being having an arrangement with the company whose vulnerabilities you were exploiting.
- woodman 8y ago
  > I'm sorry, but this seems a little naive. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY. I thought everybody already knew that US corporations serve as an extension to the surveillance apparatus. Remember all the corporations fighting against the government's mandate at an artificially crippled maximum keysize of 40 bits, in order to allow continued surveillance in the 90s? Yeah, neither do I.
  - geofft 8y ago
    The claim is not "naive" as in "of course the NSA wouldn't want to exploit things, they're innocent angels", the claim is "naive" as in "they have better ways to exploit things." Interpreting _NSAKEY as an NSA backdoor is similarly naive. First, it's named _NSAKEY. Surely they could name it something else. Second, its purpose was reverse-engineered, and it's capable of signing cryptography modules, same as the existing Microsoft key named _KEY. Anything that could be done through _NSAKEY could also be done through _KEY, so it would be easy for the NSA to just ask for a copy of _KEY such that nobody would notice. The conspiracy theory makes no sense - it's like saying "$politician is trying to take away our freedoms by pouring mind-control agents into the water" when $politician is just straight-up signing bills to take away your freedoms.
    - woodman 8y ago
      It was a debugging symbol that a Microsoft developer either negligently or heroically included in a public release... so that explains away the "nobody would be so stupid" argument. You are aware of how the Intel ME killswitch was located right? A commented xml file included with the flashing software helpfully informed anybody willing to look that a field was related to the NSA's High Assurance Platform program. This was after ten years of security researchers pointing at the fact that this was a backdoor. For whatever reason both Intel and the NSA were happy to let the public remain needlessly vulnerable all that time... But yeah, I'm just like one of those water fluoridation loons. The NSA wasn't at all hamfisted in the intentional weakening of elliptic curves and blatant RSA bribery, this isn't an obvious pattern emerging.
      - 8y ago
- zelon88 8y ago
  > Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? I would. However, I'm in no position to deny that I need Microsoft's products. Assuming I'm Iran, I'm not going to convert my entire digital infrastructure away from the status quo. I literally won't be able too anyway. Now if I'm America and we're talking about Huawei undermining my customers.... Yeah I don't have to put up with that and Huawei will lose. I don't care, I've got Samsung and Apple. So I see your point, but you're misrepresenting the scale.
srum 8y ago
You’re surely right about the incentives at play, and why no intelligence agency is going to spend millions doing x company’s validation work for them. But how in the world would selective patching work? How do you hide that?
- giancarlostoro 8y ago
  "We are testing beta features on different customers based on regions."
bsamuels 8y ago
>Roll out the patch to American companies first, but leave select targets still vulnerable. I would pay for tickets to the hacker news thread if that ever actually went down
TimTheTinker 8y ago
> Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. While that approach might be effective, the long-term result could be increased distrust of American software companies by other countries, depending on how it's done. I think the primary problems are structural: that (a) a single agency has to act as both red and blue teams, (b) the red team lacks enough oversight to ensure it respects rule of law and civilian civil rights, and (c) the blue team isn't authorized to disclose all its known vulnerabilities to software vendors.
- JumpCrisscross 8y ago
  > the long-term result could be increased distrust of American software companies by other countries, depending on how it's done America isn't Australia. The NSA hoards bugs in software domestic and foreign alike. One amendment to their charter which might make sense would be installing a public ombudsman. This ombudsman reviews the NSA's vulnerability hoard, takes into account the software's usage in the United States and then makes arguments to senior leadership for selectively releasing them.
  - ENOTTY 8y ago
    It seems to me that the public ombudsman role you propose is already played by the other agencies and departments involved in the Vulnerabilities Equities Process https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF https://www.whitehouse.gov/sites/whitehouse.gov/files/images... I would specifically call out Treasury (high dependence of financial sector on publicly available products), OMB (high dependence of government systems on publicly available products), and Commerce (most direct purview of publicly available products) in playing that role.
geofft 8y ago
> Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. Not very. Do you think Iran doesn't have a Windows VM somewhere within the US and is also incapable of reverse-engineering patches?
- giancarlostoro 8y ago
  I'd be surprised if they bother, at that point I'd just fork Linux and go from there...
mc32 8y ago
How would you hide these targeted updates from foes? I’m sure they can at least check the hashes of the updates, if not more. Presuming we’d be targeting their military industrial complexes who one might presume monitor for these kinds of things.
cmurf 8y ago
What stops non-USA companies from applying USA available patches?
jokoon 8y ago
Don't you think it's also dangerous? There were stories that US power plants could be made inoperable. Also how do you really monitor bad actors using those vulnerabilities to do other kinds of damages? To me it doesn't seem cyber weapons are that easy to use, they're volatile, secret, can be fired very quickly without sound, and are very difficult to control. So far one could say the security market was not big enough, and computers not widespread enough, so it was tolerable to let the 0day market open as long as the US has the upper hand, but as this market goes bigger, damages are going to show up more and more. Having the upper hand in term of cyber warfare is one thing, but I have a problem with what the cyber warfare terminology. I'd rather live in a world where weapon trafficking is neutered, instead of a world where bandits can cause damages (small, but still damage). I think the day is coming where higher security standards will be required by law, because the swiss cheese strategy won't work for long. Also, I have doubts that the NSA can really keep the upper hand because they have more brainpower. The cyber warfare is not only the sum of the weapons, because anybody can be taught computer security and learn how to build weapons.
dontbenebby 8y ago
>While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit. What happens when those zero days are leaked or stolen?[1] The government couldn't even protect nuclear secrets.[2] At least with nukes, it's difficult to obtain the fissile material. Even the poorest, smalled, most isolated countries can utilize stolen or leaked 0-days, and depending on how they're used they could kill more people than a nuclear bomb. (Eg: shut off the power to the Midwest during winter) [1] https://en.wikipedia.org/wiki/The_Shadow_Brokers https://en.wikipedia.org/wiki/The_Shadow_Brokers [2]https://en.wikipedia.org/wiki/Atomic_spies#Notable_spies https://en.wikipedia.org/wiki/Atomic_spies#Notable_spies.
chopin 8y ago
Imagine how effective an intelligence campaign would be if the NSA went to Microsoft and let them place backdoors for specific targets. Where would you draw the line?
raxxorrax 8y ago
Microsoft would quickly lose any trust they might have left in foreign markets. Plus, I think elevating the scope of NSA is a bad idea, since they already misused their power as evidenced by multiple leaks. It would be an overall terrible idea. The cyber warfare scare is just a false reiteration to fortify arguments for further military and intelligence arming. > It's insane and criminal, but that's how it is. Just insane and criminal in my opinion because these institutions are not beyond reproach.

AndrewGaspar 8y ago

I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly obvious since hackers examine patch payloads, and 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The status quo of a semi-adversarial relationship between the NSA and tech companies for offensive cyber capabilities seems better to me for both parties. Of course it would be good if they were collaborating on defensive cyber security.

magduf 8y ago
> 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The fact that foreign governments aren't more skeptical of Microsoft really baffles me. The American government isn't dumb enough to buy security products from Kapersky after all, or devices from Huawei.
- espeed 8y ago
  Maybe that was part of the motivation for Microsoft moving toward open-source. Showing their cards in a way that can be audited and verified to ease any potential foreign organization's concerns. Software is part of it, but hardware is the harder sell.
  - chopin 8y ago
    Afaik that's only for cloud. There the software runs on an opaque virtualization layer. Windows is still closed source. Therefore there is a lot of speculation around the phone home capabilities.
daenz 8y ago
I read a fantastic article on Stuxnet. I can't find it now, but this should cover it, if you don't know the details https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html https://www.csoonline.com/article/3218104/what-is-stuxnet-wh... To pull of what they did, they knew multiple zero-day vulernabilities in Windows. To any reasonable security-minded person, knowing that many vulnerabilities and having the ability to capitalize on them is likely only achievable a few different ways, one of those ways being having an arrangement with the company whose vulnerabilities you were exploiting.
woodman 8y ago
> I'm sorry, but this seems a little naive. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY. I thought everybody already knew that US corporations serve as an extension to the surveillance apparatus. Remember all the corporations fighting against the government's mandate at an artificially crippled maximum keysize of 40 bits, in order to allow continued surveillance in the 90s? Yeah, neither do I.
- geofft 8y ago
  The claim is not "naive" as in "of course the NSA wouldn't want to exploit things, they're innocent angels", the claim is "naive" as in "they have better ways to exploit things." Interpreting _NSAKEY as an NSA backdoor is similarly naive. First, it's named _NSAKEY. Surely they could name it something else. Second, its purpose was reverse-engineered, and it's capable of signing cryptography modules, same as the existing Microsoft key named _KEY. Anything that could be done through _NSAKEY could also be done through _KEY, so it would be easy for the NSA to just ask for a copy of _KEY such that nobody would notice. The conspiracy theory makes no sense - it's like saying "$politician is trying to take away our freedoms by pouring mind-control agents into the water" when $politician is just straight-up signing bills to take away your freedoms.
  - woodman 8y ago
    It was a debugging symbol that a Microsoft developer either negligently or heroically included in a public release... so that explains away the "nobody would be so stupid" argument. You are aware of how the Intel ME killswitch was located right? A commented xml file included with the flashing software helpfully informed anybody willing to look that a field was related to the NSA's High Assurance Platform program. This was after ten years of security researchers pointing at the fact that this was a backdoor. For whatever reason both Intel and the NSA were happy to let the public remain needlessly vulnerable all that time... But yeah, I'm just like one of those water fluoridation loons. The NSA wasn't at all hamfisted in the intentional weakening of elliptic curves and blatant RSA bribery, this isn't an obvious pattern emerging.
    - 8y ago
zelon88 8y ago
> Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? I would. However, I'm in no position to deny that I need Microsoft's products. Assuming I'm Iran, I'm not going to convert my entire digital infrastructure away from the status quo. I literally won't be able too anyway. Now if I'm America and we're talking about Huawei undermining my customers.... Yeah I don't have to put up with that and Huawei will lose. I don't care, I've got Samsung and Apple. So I see your point, but you're misrepresenting the scale.

srum 8y ago

You’re surely right about the incentives at play, and why no intelligence agency is going to spend millions doing x company’s validation work for them. But how in the world would selective patching work? How do you hide that?

giancarlostoro 8y ago
"We are testing beta features on different customers based on regions."

bsamuels 8y ago

>Roll out the patch to American companies first, but leave select targets still vulnerable. I would pay for tickets to the hacker news thread if that ever actually went down

TimTheTinker 8y ago

> Imagine how effective an intelligence campaign would be against, say, Iran, if the NSA went to Microsoft, disclosed a vuln, and then told them to patch the vuln ONLY in specific markets. While that approach might be effective, the long-term result could be increased distrust of American software companies by other countries, depending on how it's done. I think the primary problems are structural: that (a) a single agency has to act as both red and blue teams, (b) the red team lacks enough oversight to ensure it respects rule of law and civilian civil rights, and (c) the blue team isn't authorized to disclose all its known vulnerabilities to software vendors.

JumpCrisscross 8y ago
> the long-term result could be increased distrust of American software companies by other countries, depending on how it's done America isn't Australia. The NSA hoards bugs in software domestic and foreign alike. One amendment to their charter which might make sense would be installing a public ombudsman. This ombudsman reviews the NSA's vulnerability hoard, takes into account the software's usage in the United States and then makes arguments to senior leadership for selectively releasing them.
- ENOTTY 8y ago
  It seems to me that the public ombudsman role you propose is already played by the other agencies and departments involved in the Vulnerabilities Equities Process https://www.whitehouse.gov/sites/whitehouse.gov/files/images/External%20-%20Unclassified%20VEP%20Charter%20FINAL.PDF https://www.whitehouse.gov/sites/whitehouse.gov/files/images... I would specifically call out Treasury (high dependence of financial sector on publicly available products), OMB (high dependence of government systems on publicly available products), and Commerce (most direct purview of publicly available products) in playing that role.

geofft 8y ago

giancarlostoro 8y ago
I'd be surprised if they bother, at that point I'd just fork Linux and go from there...

mc32 8y ago

How would you hide these targeted updates from foes? I’m sure they can at least check the hashes of the updates, if not more. Presuming we’d be targeting their military industrial complexes who one might presume monitor for these kinds of things.

cmurf 8y ago

What stops non-USA companies from applying USA available patches?

jokoon 8y ago

Don't you think it's also dangerous? There were stories that US power plants could be made inoperable. Also how do you really monitor bad actors using those vulnerabilities to do other kinds of damages? To me it doesn't seem cyber weapons are that easy to use, they're volatile, secret, can be fired very quickly without sound, and are very difficult to control. So far one could say the security market was not big enough, and computers not widespread enough, so it was tolerable to let the 0day market open as long as the US has the upper hand, but as this market goes bigger, damages are going to show up more and more. Having the upper hand in term of cyber warfare is one thing, but I have a problem with what the cyber warfare terminology. I'd rather live in a world where weapon trafficking is neutered, instead of a world where bandits can cause damages (small, but still damage). I think the day is coming where higher security standards will be required by law, because the swiss cheese strategy won't work for long. Also, I have doubts that the NSA can really keep the upper hand because they have more brainpower. The cyber warfare is not only the sum of the weapons, because anybody can be taught computer security and learn how to build weapons.

dontbenebby 8y ago

>While I agree and I hate the NSA's practice of hoarding zero days, they do this to keep software vulnerable on purpose. They've invested millions in uncovering zero days SPECIFICALLY so they could then spend millions more to be the only ones exploiting these vulnerabilities. If they share the zero day, the vendor will write a patch and it's game-over for their multi-million dollar exploit. What happens when those zero days are leaked or stolen?[1] The government couldn't even protect nuclear secrets.[2] At least with nukes, it's difficult to obtain the fissile material. Even the poorest, smalled, most isolated countries can utilize stolen or leaked 0-days, and depending on how they're used they could kill more people than a nuclear bomb. (Eg: shut off the power to the Midwest during winter) [1] https://en.wikipedia.org/wiki/The_Shadow_Brokers https://en.wikipedia.org/wiki/The_Shadow_Brokers [2]https://en.wikipedia.org/wiki/Atomic_spies#Notable_spies https://en.wikipedia.org/wiki/Atomic_spies#Notable_spies.

chopin 8y ago

Imagine how effective an intelligence campaign would be if the NSA went to Microsoft and let them place backdoors for specific targets. Where would you draw the line?

raxxorrax 8y ago

Microsoft would quickly lose any trust they might have left in foreign markets. Plus, I think elevating the scope of NSA is a bad idea, since they already misused their power as evidenced by multiple leaks. It would be an overall terrible idea. The cyber warfare scare is just a false reiteration to fortify arguments for further military and intelligence arming. > It's insane and criminal, but that's how it is. Just insane and criminal in my opinion because these institutions are not beyond reproach.