4 ms·

Based on what I've read, the NSA and other white-hat organizations have access to 0-days or have discovered 0-days that can crack these things but they're not r

Based on what I've read, the NSA and other white-hat organizations have access to 0-days or have discovered 0-days that can crack these things but they're not released to the public or if they are, they're released years later.

msherry 8y ago
TFA says that Ernst and Young was the company to crack the laptop. Ernst and Young would not burn a zero-day exploit on an auditing job.
- bootloop 8y ago
  Applying a zero-day exploit without making it public doesn't burn anything. After all, no one knows how they did it.
  - solarkraft 8y ago
    But would they even risk raising suspicion?
    - gph 8y ago
      I'm confused why anyone in this thread chain would think a firm like Ernst and Young would have access to zero-days?
      - g45y45 8y ago
        0days are not magic. Stare enough at code and you will find them. E&Y and the other Professional Services companies have a big pentesting team, and they would have made discoveries on their own regarding system security. Any company with a large security / research team would have 0days. What they do with them, (report, sit, burn, etc) is up the organizational and individual ethics of the operator.
      - dagw 8y ago
        Ernst and Young are huge and do a lot of very sophisticated forensic accounting work. If they don't have people in house, they almost certainly have the phone number to someone who does.
      - barkingcat 8y ago
        Because 0-days are accessible to anyone with money. And Ernst and Young would have a ton of money, and plenty of opportunities where clients would come to them and hire them privately about issues like this. Coming up with 0-days is moderately hard with your own cracking team. Buying them is an easy thing to do. Ultimately, that's what 0-days are for in the wider market. You find one and sell it.
    - stordoff 8y ago
      Why would it? If no one else knows the password, just say it was a weak password (or even that you got lucky). There's $137m missing, so clearly something went wrong - one more mistake wouldn't be hard to believe. Even if it does, does it matter? "There's a vulnerability in <OS>" is not exactly news or useful.
    - barkingcat 8y ago
      they probably do this every day. At this level, it would have needed to be packaged similar to the way the NSA tools were. A package of tools that comes on a hardened usb key, just plug it in in the field and it runs through the 0days that it knows about.
- onetimemanytime 8y ago
  If fees were x and the bought exploit cost a lot less, why not?
- Scoundreller 8y ago
  Then TFA was wrong. E&Y’s own reports say that it was the Applicant’s own “expert” that tried to break in. The applicant is the founder’s widow. The expert doesn’t seem to have much of a specialization for breaking into computers. Who knows what kind of mess he caused. S. 12 https://documentcentre.eycan.com/eycm_library/Quadriga%20Fintech%20Solutions%20Corp/English/1.%20Monitor%27s%20Reports/4.%20Third%20Report%20of%20the%20Monitor/Third%20Report%20of%20the%20Monitor%20dated%20March%201,%202019.pdf https://documentcentre.eycan.com/eycm_library/Quadriga%20Fin...
lolc 8y ago
> the NSA and other white-hat organizations First time I hear NSA grouped with white-hats. What definition would permit this categorization?
- sterlind 8y ago
  The NSA wears two hats, one for each head. [0] The white hat secures government communication, prevents industrial espionage, hardens national infrastructure and collaborates on FIPS and other standards. The black hat eavesdrops on foreign government communication, conducts mass surveillance, hacks national infrastructure and backdoors FIPS and other standards. 0. https://en.wikipedia.org/wiki/National_Security_Agency#Mission https://en.wikipedia.org/wiki/National_Security_Agency#Missi... NSA's eavesdropping mission includes radio broadcasting, both from various organizations and individuals, the Internet, telephone calls, and other intercepted forms of communication. Its secure communications mission includes military, diplomatic, and all other sensitive, confidential or secret government communications.[51]

msherry 8y ago

TFA says that Ernst and Young was the company to crack the laptop. Ernst and Young would not burn a zero-day exploit on an auditing job.

bootloop 8y ago
Applying a zero-day exploit without making it public doesn't burn anything. After all, no one knows how they did it.
- solarkraft 8y ago
  But would they even risk raising suspicion?
  - gph 8y ago
    I'm confused why anyone in this thread chain would think a firm like Ernst and Young would have access to zero-days?
    - g45y45 8y ago
      0days are not magic. Stare enough at code and you will find them. E&Y and the other Professional Services companies have a big pentesting team, and they would have made discoveries on their own regarding system security. Any company with a large security / research team would have 0days. What they do with them, (report, sit, burn, etc) is up the organizational and individual ethics of the operator.
    - dagw 8y ago
      Ernst and Young are huge and do a lot of very sophisticated forensic accounting work. If they don't have people in house, they almost certainly have the phone number to someone who does.
    - barkingcat 8y ago
      Because 0-days are accessible to anyone with money. And Ernst and Young would have a ton of money, and plenty of opportunities where clients would come to them and hire them privately about issues like this. Coming up with 0-days is moderately hard with your own cracking team. Buying them is an easy thing to do. Ultimately, that's what 0-days are for in the wider market. You find one and sell it.
  - stordoff 8y ago
    Why would it? If no one else knows the password, just say it was a weak password (or even that you got lucky). There's $137m missing, so clearly something went wrong - one more mistake wouldn't be hard to believe. Even if it does, does it matter? "There's a vulnerability in <OS>" is not exactly news or useful.
  - barkingcat 8y ago
    they probably do this every day. At this level, it would have needed to be packaged similar to the way the NSA tools were. A package of tools that comes on a hardened usb key, just plug it in in the field and it runs through the 0days that it knows about.
onetimemanytime 8y ago
If fees were x and the bought exploit cost a lot less, why not?
Scoundreller 8y ago
Then TFA was wrong. E&Y’s own reports say that it was the Applicant’s own “expert” that tried to break in. The applicant is the founder’s widow. The expert doesn’t seem to have much of a specialization for breaking into computers. Who knows what kind of mess he caused. S. 12 https://documentcentre.eycan.com/eycm_library/Quadriga%20Fintech%20Solutions%20Corp/English/1.%20Monitor%27s%20Reports/4.%20Third%20Report%20of%20the%20Monitor/Third%20Report%20of%20the%20Monitor%20dated%20March%201,%202019.pdf https://documentcentre.eycan.com/eycm_library/Quadriga%20Fin...

lolc 8y ago

> the NSA and other white-hat organizations First time I hear NSA grouped with white-hats. What definition would permit this categorization?

sterlind 8y ago
The NSA wears two hats, one for each head. [0] The white hat secures government communication, prevents industrial espionage, hardens national infrastructure and collaborates on FIPS and other standards. The black hat eavesdrops on foreign government communication, conducts mass surveillance, hacks national infrastructure and backdoors FIPS and other standards. 0. https://en.wikipedia.org/wiki/National_Security_Agency#Mission https://en.wikipedia.org/wiki/National_Security_Agency#Missi... NSA's eavesdropping mission includes radio broadcasting, both from various organizations and individuals, the Internet, telephone calls, and other intercepted forms of communication. Its secure communications mission includes military, diplomatic, and all other sensitive, confidential or secret government communications.[51]