3 ms·
> Did they want to protect themselves before alerting anyone? Probably yes. > Did they want to use this to infiltrate others? Also probably yes. The NSA doe
by clouddrover 5y ago
> Did they want to protect themselves before alerting anyone?
Probably yes.
> Did they want to use this to infiltrate others?
Also probably yes.
The NSA does the same thing. They stockpile security vulnerabilities and selectively tell the software vendors about some of them. They like to keep the "high value" vulnerabilities to themselves for use in exploits.
The WannaCry ransomware (see https://en.wikipedia.org/wiki/WannaCry_ransomware_attack https://en.wikipedia.org/wiki/WannaCry_ransomware_attack and https://en.wikipedia.org/wiki/EternalBlue https://en.wikipedia.org/wiki/EternalBlue) did worldwide economic damage and was built on an NSA developed exploit. The NSA knew about this vulnerability in Windows for years and never told Microsoft.
Unfortunately all intelligence agencies everywhere will continue to take this cowboy approach. Until we can get these bad actors under control, their constant undermining of internet infrastructure will continue to hinder efforts to improve internet security.
- ButtSpark69 5y agoIt's not the same thing to develop and keep an exploit for yourself, as it is to require the public companies in your country to report the important bugs they find while effectively also under a temporary gag order. They are super different things.
- clouddrover 5y agoThe super result is super the same: more vulnerabilities exploited for longer.
- mlyle 5y agoSurely you can see there's some difference in magnitude here, right? Which one does it more? And even if the end result has some overlap, there's a bit of an ethical difference between: * developing an exploit that you keep quiet * preventing others from talking about exploits they discover
- clouddrover 5y agoSurely you can see that they're all bad actors, undermining the software and infrastructure that we all use, putting our systems and our data at risk through their grubby actions and even their grubby inaction, right? I don't care which bunch of spies does it more. I don't want spies doing it at all.
- mlyle 5y ago> and even their grubby inaction, right? Yah, I guess by not searching for new exploits tonight for public disclosure, I'm putting the entire software world marginally more at risk by "grubby inaction." > I don't care which bunch of spies does it more. I don't want spies doing it at all. I care: some bad actors in my government vs. forcing an entire massive economy to participate in bad actions will have massively different magnitudes of effect. There's always going to be bad actors, but preventing 15% of the world's population from being good actors surely is a pretty significant thing.
- mthoms 5y agoEthically, it’s not the same.
- clouddrover 5y agoThere's nothing ethical about leaving your nation's infrastructure vulnerable to attack just because you want to indulge in the boy's own adventure of attacking the infrastructure of other nations. It's not ethical. It's not professional. It's school boy stuff.
- mthoms 5y agoWhoa, I think we're on the same team. I was saying it's not ethical to tell only your gov't about the exploit, and not your customers.
- iszomer 5y agoThis gave me a good chuckle. * Google Project Zero researcher: "we found a bug!" * NSA (internally): "Damnit, scratch that one off the list boys.."