5 ms·

I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly o

I'm sorry, but this seems a little naive. 1) It assumes that the NSA would only want to exploit a vulnerability exactly once, 2) this behavior would be fairly obvious since hackers examine patch payloads, and 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The status quo of a semi-adversarial relationship between the NSA and tech companies for offensive cyber capabilities seems better to me for both parties. Of course it would be good if they were collaborating on defensive cyber security.

magduf 8y ago
> 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The fact that foreign governments aren't more skeptical of Microsoft really baffles me. The American government isn't dumb enough to buy security products from Kapersky after all, or devices from Huawei.
- espeed 8y ago
  Maybe that was part of the motivation for Microsoft moving toward open-source. Showing their cards in a way that can be audited and verified to ease any potential foreign organization's concerns. Software is part of it, but hardware is the harder sell.
  - chopin 8y ago
    Afaik that's only for cloud. There the software runs on an opaque virtualization layer. Windows is still closed source. Therefore there is a lot of speculation around the phone home capabilities.
daenz 8y ago
I read a fantastic article on Stuxnet. I can't find it now, but this should cover it, if you don't know the details https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html https://www.csoonline.com/article/3218104/what-is-stuxnet-wh... To pull of what they did, they knew multiple zero-day vulernabilities in Windows. To any reasonable security-minded person, knowing that many vulnerabilities and having the ability to capitalize on them is likely only achievable a few different ways, one of those ways being having an arrangement with the company whose vulnerabilities you were exploiting.
woodman 8y ago
> I'm sorry, but this seems a little naive. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY. I thought everybody already knew that US corporations serve as an extension to the surveillance apparatus. Remember all the corporations fighting against the government's mandate at an artificially crippled maximum keysize of 40 bits, in order to allow continued surveillance in the 90s? Yeah, neither do I.
- geofft 8y ago
  The claim is not "naive" as in "of course the NSA wouldn't want to exploit things, they're innocent angels", the claim is "naive" as in "they have better ways to exploit things." Interpreting _NSAKEY as an NSA backdoor is similarly naive. First, it's named _NSAKEY. Surely they could name it something else. Second, its purpose was reverse-engineered, and it's capable of signing cryptography modules, same as the existing Microsoft key named _KEY. Anything that could be done through _NSAKEY could also be done through _KEY, so it would be easy for the NSA to just ask for a copy of _KEY such that nobody would notice. The conspiracy theory makes no sense - it's like saying "$politician is trying to take away our freedoms by pouring mind-control agents into the water" when $politician is just straight-up signing bills to take away your freedoms.
  - woodman 8y ago
    It was a debugging symbol that a Microsoft developer either negligently or heroically included in a public release... so that explains away the "nobody would be so stupid" argument. You are aware of how the Intel ME killswitch was located right? A commented xml file included with the flashing software helpfully informed anybody willing to look that a field was related to the NSA's High Assurance Platform program. This was after ten years of security researchers pointing at the fact that this was a backdoor. For whatever reason both Intel and the NSA were happy to let the public remain needlessly vulnerable all that time... But yeah, I'm just like one of those water fluoridation loons. The NSA wasn't at all hamfisted in the intentional weakening of elliptic curves and blatant RSA bribery, this isn't an obvious pattern emerging.
    - 8y ago
zelon88 8y ago
> Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? I would. However, I'm in no position to deny that I need Microsoft's products. Assuming I'm Iran, I'm not going to convert my entire digital infrastructure away from the status quo. I literally won't be able too anyway. Now if I'm America and we're talking about Huawei undermining my customers.... Yeah I don't have to put up with that and Huawei will lose. I don't care, I've got Samsung and Apple. So I see your point, but you're misrepresenting the scale.

magduf 8y ago

> 3) this behavior on the part of American tech would undermine their credibility globally. Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? The fact that foreign governments aren't more skeptical of Microsoft really baffles me. The American government isn't dumb enough to buy security products from Kapersky after all, or devices from Huawei.

espeed 8y ago
Maybe that was part of the motivation for Microsoft moving toward open-source. Showing their cards in a way that can be audited and verified to ease any potential foreign organization's concerns. Software is part of it, but hardware is the harder sell.
- chopin 8y ago
  Afaik that's only for cloud. There the software runs on an opaque virtualization layer. Windows is still closed source. Therefore there is a lot of speculation around the phone home capabilities.

daenz 8y ago

I read a fantastic article on Stuxnet. I can't find it now, but this should cover it, if you don't know the details https://www.csoonline.com/article/3218104/what-is-stuxnet-who-created-it-and-how-does-it-work.html https://www.csoonline.com/article/3218104/what-is-stuxnet-wh... To pull of what they did, they knew multiple zero-day vulernabilities in Windows. To any reasonable security-minded person, knowing that many vulnerabilities and having the ability to capitalize on them is likely only achievable a few different ways, one of those ways being having an arrangement with the company whose vulnerabilities you were exploiting.

woodman 8y ago

> I'm sorry, but this seems a little naive. https://en.wikipedia.org/wiki/NSAKEY https://en.wikipedia.org/wiki/NSAKEY. I thought everybody already knew that US corporations serve as an extension to the surveillance apparatus. Remember all the corporations fighting against the government's mandate at an artificially crippled maximum keysize of 40 bits, in order to allow continued surveillance in the 90s? Yeah, neither do I.

geofft 8y ago
The claim is not "naive" as in "of course the NSA wouldn't want to exploit things, they're innocent angels", the claim is "naive" as in "they have better ways to exploit things." Interpreting _NSAKEY as an NSA backdoor is similarly naive. First, it's named _NSAKEY. Surely they could name it something else. Second, its purpose was reverse-engineered, and it's capable of signing cryptography modules, same as the existing Microsoft key named _KEY. Anything that could be done through _NSAKEY could also be done through _KEY, so it would be easy for the NSA to just ask for a copy of _KEY such that nobody would notice. The conspiracy theory makes no sense - it's like saying "$politician is trying to take away our freedoms by pouring mind-control agents into the water" when $politician is just straight-up signing bills to take away your freedoms.
- woodman 8y ago
  It was a debugging symbol that a Microsoft developer either negligently or heroically included in a public release... so that explains away the "nobody would be so stupid" argument. You are aware of how the Intel ME killswitch was located right? A commented xml file included with the flashing software helpfully informed anybody willing to look that a field was related to the NSA's High Assurance Platform program. This was after ten years of security researchers pointing at the fact that this was a backdoor. For whatever reason both Intel and the NSA were happy to let the public remain needlessly vulnerable all that time... But yeah, I'm just like one of those water fluoridation loons. The NSA wasn't at all hamfisted in the intentional weakening of elliptic curves and blatant RSA bribery, this isn't an obvious pattern emerging.
  - 8y ago

zelon88 8y ago

> Wouldn't you reasonably be very skeptical of Microsoft if you were a foreign government if you knew they were actively working with the American government to pwn you? I would. However, I'm in no position to deny that I need Microsoft's products. Assuming I'm Iran, I'm not going to convert my entire digital infrastructure away from the status quo. I literally won't be able too anyway. Now if I'm America and we're talking about Huawei undermining my customers.... Yeah I don't have to put up with that and Huawei will lose. I don't care, I've got Samsung and Apple. So I see your point, but you're misrepresenting the scale.