4 ms·
> I'm unclear on why I'm meant to take this particular Windows SMB exploit so seriously the way I understand it, most of the affected, including the paper, tak
by acqq 7y ago
> I'm unclear on why I'm meant to take this particular Windows SMB exploit so seriously
the way I understand it, most of the affected, including the paper, take it seriously because it's their "tax money at work."
I understand also that somebody at the receiving end of the said money is not satisfied that that topic is raised.
- tptacek 7y agoThe tax money was spent enabling the NSA to hack into foreign computers, which is the SIGINT directorate's whole job. It sucks that their favorite bug got burned! It is a problem that it leaked, and developing a new pet bug ahead of schedule is an inefficient use of tax dollars. But NSA didn't make this bug, and it's not even unlikely that other people had it before it leaked, just in a different exploit package. Now that there's a reliable exploit attributable to NSA, everyone is going to use that one regardless.
- plczyk 7y agoAre you checzh or polish er just need to know. I am fan of both.
- tptacek 7y agoI'm from the south side of Chicago.
- keepingitreal 7y agoNot far from the eight Mile my brother. Love your surname though. But perhaps it is opsec.
- tptacek 7y agoYou'd have to ask my parents about that.
- whichiwill 7y agoUnderstood.
- sixothree 7y ago> But NSA didn't make this bug We don't know that.
- tptacek 7y agoSo, you think ETERNALBLUE was an inside job?
- acct1771 7y agoAlways worth considering. Intelligence agencies put people everywhere.
- AgentME 7y agoMemory unsafe languages are already the perfect generator of exploitable bugs with how easy they are to make exploitable mistakes in. Few exploits need more explanation than that. (It would be interesting if the popularity of memory unsafe languages like C/C++ was somehow encouraged by the NSA to keep the world exploitable, but I've never heard of any evidence of that.)