3 ms·

I had assumed Google/Microsoft/Apple had better security teams than the US Government because they could pay so much more. I wouldn't be surprised if maybe the

I had assumed Google/Microsoft/Apple had better security teams than the US Government because they could pay so much more. I wouldn't be surprised if maybe the NSA had better red teams than Google, but I'm honestly surprised the US Government outguns Google outside of that.

Veserv 3y ago
Exploit development is more about effort and focus than difficulty. Any halfway-competent team can completely compromise any commercial IT security system. It is a competition to see who can crack the most eggs. Anybody can do it, but the winner is who is willing to spend the most time doing it. Google, and any commercial non-hacking organization, just has very little incentive to really waste a lot of money on that task. Where as basically every military and law enforcement arm of the US government has a ton of incentive and boatloads of money to spend cracking eggs. The military arms certainly spend billions a year and it would be quite unexpected if the law enforcement arms are not each, individually, spending hundreds of millions to billions per year. Is the quality lower? Maybe. But exploit development is so easy that hardly matters. If you want to hack somebody then good enough is enough.
- kasey_junk 3y ago
  Do you have any evidence at all that law enforcement agencies engage in vulnerability research in any significant way? I’ve never heard of a single program.
  - Veserv 3y ago
    You do realize the FBI is a law enforcement agency, right? It is so commonplace and expected that they have literally issued press releases where they publicly claim to have hacked criminal networks [1]. For that matter, who do you think hired various domestic hackers out of jail? At this point, the advantages of exploit development are so obvious and lopsided that you need evidence that an agency with motive is not engaging in exploit development. Even then, they routinely lean on the other agencies to get access to hacking capabilities that they might not have in-house, so the gap is even smaller if we talk about hacking capabilities. [1] https://www.justice.gov/opa/pr/us-department-justice-disrupts-hive-ransomware-variant https://www.justice.gov/opa/pr/us-department-justice-disrupt...
    - tptacek 3y ago
      Law enforcement agencies buy from exploit developers who supply complete toolchains; I don't know for sure but I kind of doubt the FBI staffs any vulnerability researchers, or even any CNI people.

Veserv 3y ago

Exploit development is more about effort and focus than difficulty. Any halfway-competent team can completely compromise any commercial IT security system. It is a competition to see who can crack the most eggs. Anybody can do it, but the winner is who is willing to spend the most time doing it. Google, and any commercial non-hacking organization, just has very little incentive to really waste a lot of money on that task. Where as basically every military and law enforcement arm of the US government has a ton of incentive and boatloads of money to spend cracking eggs. The military arms certainly spend billions a year and it would be quite unexpected if the law enforcement arms are not each, individually, spending hundreds of millions to billions per year. Is the quality lower? Maybe. But exploit development is so easy that hardly matters. If you want to hack somebody then good enough is enough.

kasey_junk 3y ago
Do you have any evidence at all that law enforcement agencies engage in vulnerability research in any significant way? I’ve never heard of a single program.
- Veserv 3y ago
  You do realize the FBI is a law enforcement agency, right? It is so commonplace and expected that they have literally issued press releases where they publicly claim to have hacked criminal networks [1]. For that matter, who do you think hired various domestic hackers out of jail? At this point, the advantages of exploit development are so obvious and lopsided that you need evidence that an agency with motive is not engaging in exploit development. Even then, they routinely lean on the other agencies to get access to hacking capabilities that they might not have in-house, so the gap is even smaller if we talk about hacking capabilities. [1] https://www.justice.gov/opa/pr/us-department-justice-disrupts-hive-ransomware-variant https://www.justice.gov/opa/pr/us-department-justice-disrupt...
  - tptacek 3y ago
    Law enforcement agencies buy from exploit developers who supply complete toolchains; I don't know for sure but I kind of doubt the FBI staffs any vulnerability researchers, or even any CNI people.