4 ms·

Why? Did they want to protect themselves before alerting anyone? Did they want to use this to infiltrate others?

by xupybd 5y ago

clouddrover 5y ago
> Did they want to protect themselves before alerting anyone? Probably yes. > Did they want to use this to infiltrate others? Also probably yes. The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits. The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft. Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.
- ButtSpark69 5y ago
  It's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.
  - clouddrover 5y ago
    The super result is super the same: more vulnerabilities exploited for longer.
    - mlyle 5y ago
      Surely you can see there's some difference in magnitude here, right? Which one does it more? And even if the end result has some overlap, there's a bit of an ethical difference between: * developing an exploit that you keep quiet * preventing others from talking about exploits they discover
      - clouddrover 5y ago
        Surely you can see that they're all bad actors, undermining the software and infrastructure that we all use, putting our systems and our data at risk through their grubby actions and even their grubby inaction, right? I don't care which bunch of spies does it more. I don't want spies doing it at all.
        mlyle 5y ago
        > and even their grubby inaction, right? Yah, I guess by not searching for new exploits tonight for public disclosure, I'm putting the entire software world marginally more at risk by "grubby inaction." > I don't care which bunch of spies does it more. I don't want spies doing it at all. I care: some bad actors in my government vs. forcing an entire massive economy to participate in bad actions will have massively different magnitudes of effect. There's always going to be bad actors, but preventing 15% of the world's population from being good actors surely is a pretty significant thing.
    - mthoms 5y ago
      Ethically, it’s not the same.
      - clouddrover 5y ago
        There's nothing ethical about leaving your nation's infrastructure vulnerable to attack just because you want to indulge in the boy's own adventure of attacking the infrastructure of other nations. It's not ethical. It's not professional. It's school boy stuff.
        mthoms 5y ago
        Whoa, I think we're on the same team. I was saying it's not ethical to tell only your gov't about the exploit, and not your customers.
- iszomer 5y ago
  This gave me a good chuckle. * Google Project Zero researcher: "we found a bug!" * NSA (internally): "Damnit, scratch that one off the list boys.."
addicted 5y ago
Probably both? It may not even be so much about this particular vulnerability, but rather just setting the law that any future vulnerabilities must first be reported to the party which can then decide to either defend from it or weaponize it.
my50cents 5y ago
There is a rule that requires cloud providers like Alibaba Cloud to report vulnerabilities within 2 days. Alibaba violated this rule. Note that the article is misleading as the rule doesn't require the disclosure must be made to the government first.
- boston_clone 5y ago
  Would you mind citing the rule? A similar-sounding policy linked elsewhere doesn't seem to apply to this situation.
  - sudosysgen 5y ago
    This is the law that is mentioned in the article, as a link says that this is application of the MIIT ruling that came into effect September 1st: http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Here is a machine translation of the relevant section that seems to agree with the GP: >Article 7 Network product providers shall perform the following network product security vulnerabilities management obligations, ensure that their product security vulnerabilities are repaired in a timely manner and reasonably released, and guide and support product users to take preventive measures: >(1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. >(2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. >(3) Remediation of network product security vulnerabilities should be organized in a timely manner. For product users (including downstream manufacturers) that need to take measures such as software and firmware upgrades, network product security vulnerabilities and repair methods should be promptly informed of the product users who may be affected , And provide the necessary technical support.
1una 5y ago
They do use this to infiltrate others: https://www.wsj.com/articles/cyber-daily-hackers-backed-by-china-seen-exploiting-log4j-flaw-11639664930 https://www.wsj.com/articles/cyber-daily-hackers-backed-by-c...
- yesbut 5y ago
  well, if the US does, why wouldn't other governments? I guess everyone has forgotten wikileaks and Snowden already.
  - checkthisguyout 5y ago
    - yesbut 5y ago
      sorry bro, american, born and raised. I'm whiter than mayonnaise. anti-Imperialism != pro-China I guess your not a fan of Doom metal.
      - checkthisguyout 5y ago
        Sorry, like Fassbender’s erroneous three sign in the bar, your corps joke a little while ago betrays you. Regardless of education level every American knows how to pronounce corps. Because of the Marine Corps. You should have claimed to be interested in American politics but someone who learned English as a second language, perhaps a Western European. You’re burnt, bro. Nearly your entire comment history is related to the foreign policy priorities of China with just enough testing thereof to make your position plausible. Pack it up and start over. It’s interesting that I didn’t say what you were and you’ve defended a specific allegation. Intriguing, that. I also like the idea that someone “whiter than mayonnaise” would opine that China will never invade Taiwan. Is anyone “whiter than mayonnaise” certain of that at all? Press X to doubt.
        yesbut 5y ago
odiroot 5y ago
I would be surprised, even disappointed a bit, if NSA didn't use it for infiltration for a good few months already.

Why? Did they want to protect themselves before alerting anyone? Did they want to use this to infiltrate others?

by xupybd 5y ago

Why? Did they want to protect themselves before alerting anyone? Did they want to use this to infiltrate others?

> Did they want to protect themselves before alerting anyone? Probably yes. > Did they want to use this to infiltrate others? Also probably yes. The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits. The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft. Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.

ButtSpark69 5y ago
It's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.
- clouddrover 5y ago
  The super result is super the same: more vulnerabilities exploited for longer.
  - mlyle 5y ago
    Surely you can see there's some difference in magnitude here, right? Which one does it more? And even if the end result has some overlap, there's a bit of an ethical difference between: * developing an exploit that you keep quiet * preventing others from talking about exploits they discover
    - clouddrover 5y ago
      Surely you can see that they're all bad actors, undermining the software and infrastructure that we all use, putting our systems and our data at risk through their grubby actions and even their grubby inaction, right? I don't care which bunch of spies does it more. I don't want spies doing it at all.
      - mlyle 5y ago
        > and even their grubby inaction, right? Yah, I guess by not searching for new exploits tonight for public disclosure, I'm putting the entire software world marginally more at risk by "grubby inaction." > I don't care which bunch of spies does it more. I don't want spies doing it at all. I care: some bad actors in my government vs. forcing an entire massive economy to participate in bad actions will have massively different magnitudes of effect. There's always going to be bad actors, but preventing 15% of the world's population from being good actors surely is a pretty significant thing.
  - mthoms 5y ago
    Ethically, it’s not the same.
    - clouddrover 5y ago
      There's nothing ethical about leaving your nation's infrastructure vulnerable to attack just because you want to indulge in the boy's own adventure of attacking the infrastructure of other nations. It's not ethical. It's not professional. It's school boy stuff.
      - mthoms 5y ago
        Whoa, I think we're on the same team. I was saying it's not ethical to tell only your gov't about the exploit, and not your customers.
iszomer 5y ago
This gave me a good chuckle. * Google Project Zero researcher: "we found a bug!" * NSA (internally): "Damnit, scratch that one off the list boys.."

addicted 5y ago

Probably both? It may not even be so much about this particular vulnerability, but rather just setting the law that any future vulnerabilities must first be reported to the party which can then decide to either defend from it or weaponize it.

my50cents 5y ago

There is a rule that requires cloud providers like Alibaba Cloud to report vulnerabilities within 2 days. Alibaba violated this rule. Note that the article is misleading as the rule doesn't require the disclosure must be made to the government first.

boston_clone 5y ago
Would you mind citing the rule? A similar-sounding policy linked elsewhere doesn't seem to apply to this situation.
- sudosysgen 5y ago
  This is the law that is mentioned in the article, as a link says that this is application of the MIIT ruling that came into effect September 1st: http://www.gov.cn/gongbao/content/2021/content_5641351.htm http://www.gov.cn/gongbao/content/2021/content_5641351.htm Here is a machine translation of the relevant section that seems to agree with the GP: >Article 7 Network product providers shall perform the following network product security vulnerabilities management obligations, ensure that their product security vulnerabilities are repaired in a timely manner and reasonably released, and guide and support product users to take preventive measures: >(1) After discovering or learning about the security vulnerabilities in the provided network products, they should immediately take measures and organize verification of the security vulnerabilities to assess the degree of harm and the scope of the security vulnerabilities; for the security vulnerabilities in their upstream products or components, they should Notify the relevant product provider immediately. >(2) The relevant vulnerability information should be reported to the Ministry of Industry and Information Technology's cyber security threat and vulnerability information sharing platform within 2 days. The content of the submission shall include the product name, model, version, and the technical characteristics, harm, and scope of the vulnerability that have security loopholes in network products. >(3) Remediation of network product security vulnerabilities should be organized in a timely manner. For product users (including downstream manufacturers) that need to take measures such as software and firmware upgrades, network product security vulnerabilities and repair methods should be promptly informed of the product users who may be affected , And provide the necessary technical support.

1una 5y ago

They do use this to infiltrate others: https://www.wsj.com/articles/cyber-daily-hackers-backed-by-china-seen-exploiting-log4j-flaw-11639664930 https://www.wsj.com/articles/cyber-daily-hackers-backed-by-c...

yesbut 5y ago
well, if the US does, why wouldn't other governments? I guess everyone has forgotten wikileaks and Snowden already.
- checkthisguyout 5y ago
  - yesbut 5y ago
    sorry bro, american, born and raised. I'm whiter than mayonnaise. anti-Imperialism != pro-China I guess your not a fan of Doom metal.
    - checkthisguyout 5y ago
      Sorry, like Fassbender’s erroneous three sign in the bar, your corps joke a little while ago betrays you. Regardless of education level every American knows how to pronounce corps. Because of the Marine Corps. You should have claimed to be interested in American politics but someone who learned English as a second language, perhaps a Western European. You’re burnt, bro. Nearly your entire comment history is related to the foreign policy priorities of China with just enough testing thereof to make your position plausible. Pack it up and start over. It’s interesting that I didn’t say what you were and you’ve defended a specific allegation. Intriguing, that. I also like the idea that someone “whiter than mayonnaise” would opine that China will never invade Taiwan. Is anyone “whiter than mayonnaise” certain of that at all? Press X to doubt.
      - yesbut 5y ago

odiroot 5y ago

I would be surprised, even disappointed a bit, if NSA didn't use it for infiltration for a good few months already.