13 ms·
U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report
- HypnoDrone 2y agoSo there was 39 vulnerabilities that affected government systems. The rest didn't so they had no need to disclose.
- bangaladore 2y agoSimilar, but my thought is that they found out some other gov(s) know about it as well. And that it hurts others more than it hurts the US gov.
- maerF0x0 2y agoI'd say that's a very cynical take, theres a verification process and they disclosed 90% of them, pretty generous gift to the world if you ask me. They do not have a moral mandate to use their resources to benefit all.
- afavour 2y ago> What changed the calculus in 2023 isn’t clear. Well, the calculus didn't change in 2023 if the report was only released a month or so ago. And in fact, in May 2024: DHS, CISA Announce Membership Changes to the Cyber Safety Review Board https://www.dhs.gov/archive/news/2024/05/06/dhs-cisa-announce-membership-changes-cyber-safety-review-board https://www.dhs.gov/archive/news/2024/05/06/dhs-cisa-announc... So some new people came in and decided that more public information was better. > On January 21, 2025, it was reported that the Trump administration fired all members of the CSRB. Ah, well, never mind then
- deleted 2y ago[deleted]
- neuronexmachina 2y agoYep. From the article: > This lack of transparency could become a greater issue under the Trump administration, which has vowed to ramp up the government's cyber offensive operations, suggesting that the government demand for zero-day vulnerabilities may increase over the next four years. If this occurs, the government’s previous statements that the VEP favors disclosure and defense over withholding and offense may no longer be true. ... > “The VEP and that number of 90 percent was one of the few places where the president and the White House could set the dial on how much they liked defense vs offense,” says Jason Healey, senior research scholar at Columbia University’s School of International and Public Affairs and former senior cybersecurity strategist for CISA. “[The Trump administration] could say we’re disclosing too [many vulnerabilities]. If the default [in the past] was to disclose unless there is a reason to keep, I could easily imagine the default is going to be to keep unless there is a reason to disclose.”
- dylan604 2y agoWere these the same people that declared the 2020 election as being the safest ever? I can't imagine why that would grate Trump
- nimbius 2y agoI hope this signals a turning point and lessons learned from the historic practice of hoarding exploits in the hopes they can be weaponized. when you disclose vulnerabilities and exploits, you effectively take cannons off both sides of the metaphorical battle field. it actively makes society safer.
- toomuchtodo 2y agoGovernments who want power will hoard the knowledge, which is power. Other governments will share. This is perpetual tension: we collectively receive utility when good policy is active (rapid dissemination of vuln info), but we need third parties to seek these exploits out when government cannot be relied on. Very similar to the concept of journalism being the Fourth Estate imho. (vuln mgmt in finance is a component of my day gig)
- tptacek 2y agoThis is a little bit like talking about why they hoard the guns. The reason governments have caches of exploit chains is not hard to understand.
- toomuchtodo 2y agoYou're the expert, and certainly not wrong, I wrote my comment because I have had to explain this to folks in a professional capacity and thought it might be helpful.
- tptacek 2y agoIt's just a rhetoric thing. We're talking about the USG "hoarding" stuff, but, in a sense, the government has a conceptual monopoly on this kind of coercive capability. Anybody can find vulnerabilities and write exploits, but using them in anger and without mutual consent is an authority exclusively granted to law enforcement and intelligence agencies. This is just an extension of the "monopoly on violence". The longstanding objection to this is that secretly holding a gun doesn't intrinsically make everyone less safe, and there's a sense in which not disclosing a vulnerability does. That argument made more sense back in and before 2010; it doesn't make much sense now.
- JoshTko 2y ago[flagged]
- deleted 2y ago[deleted]
- staticelf 2y agoI think people give the US a lot of unnecessary shit. I don't think my government releases any zero days but I am sure they must have found some. Every government today probably uses zero days but it seems very few release information about them?
- deleted 2y ago[deleted]
- dylan604 2y agoIt's not about being held to a lower standard, it's about being held to a higher standard.
- numbsafari 2y agoNOBUS is a disaster. Knowingly leaving citizens unprotected is an absolute failure of government. Having a robust policy of identifying a resolving cybersecurity faults, and holding organizations accountable for patching and remediation is necessary if we are going to survive a real cyber “war”. We are absolutely unprepared.
- deleted 2y ago[deleted]
- sneak 2y agoThis presupposes that the purpose of government is to protect citizens. The purpose of government is to take and maintain power and prevent any other organization from displacing them. It involves citizens only as a means to an end. It would be a failure of government to place citizen safety over continuity of government.
- ambicapter 2y agoIt can be both at the same time. A government won't be great at protecting its citizens if it has no power over bad actors, both inside and outside.
- acdha 2y agoYour first sentence seems like a distraction because the same criticism of NOBUS holds either way. Even if the leaders do not care about the citizens except as a means to an end, an oppressive government especially needs to maintain security because it needs to project force to deter threats to its power. If they have a known vulnerability, they should be even more worried that internal dissidents or an external foe will find it because they are even more dependent on power in the absence of democratic legitimacy.
- pythonguython 2y agoThis is a classic security dilemma that is not easily resolvable. Suppose we just look at the US and China. Each side will discover some number of vulnerabilities. Some of those vulnerabilities will be discovered by both countries, some just by one party. If the US discloses every vulnerability, we’re left with no offensive capability and our adversary will have all of the vulnerabilities not mutually discovered. Everyone disclosing and patching vulnerabilities sounds nice, but is an unrealistic scenario in a world with states that have competing strategic interests.
- ipunchghosts 2y ago[flagged]
- deleted 2y ago[deleted]
- shermantanktop 2y agoEasy, just hire people who constantly say “thank you for your leadership sir.” I often talk about encouraging a truthseeking culture at work, because people naturally tend to gravitate toward easy or popular ideas. But this is more like a lie-seeking culture.
- int_ 2y ago[flagged]
- deleted 2y ago[deleted]
- pentel-0_5 2y agoThese are just the disclosed ones. The weaponized ones (as mentioned) found or bought kept secret by the NSA, etc. such as from Zerodium (ex-VUPEN) and similar aren't counted obviously. ;)
- tptacek 2y agoIt's a "tell" in these discussions when they center exclusively on NSA, since there are dozens of agencies in the USG that traffick in exploit chains.
- ggernov 2y agoThese are wins because if they're actually patched it takes offensive tools away from our adversaries.
- davemp 2y agoWhile I don’t think we should be hoarding vulns, the idea of the government having huge budgets to find and disclose software defects is a bit strange to me. Seems like another instance of socializing bad externalities.
- mattmaroon 2y ago"What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations." This is a bit of a prisoner's dilemma. The world would be better off if everyone disclosed every such exploit for obvious reasons. But if government A discloses everything and government B reserves them to exploit later, then government B has a strong advantage over government A. The only responses then are war, diplomacy, or we do it too and create yet another mutually assured destruction scenario. War is not going to happen because the cure would be worse than the disease. The major players are all nuclear powers. Diplomacy would be ideal if there were sufficient trust and buy-in, but it seems unlikely the U.S. and Russia could get there. And with nuclear treaties there's an easy verification method since nuclear weapons are big and hard to do on the sly. It'd be hard to come up with a sufficient verification regime here. So we're left with mutually assured cyber destruction. I'd prefer we weren't, but I don't see the alternative.
- dadrian 2y agoIf Government A and Government B are not equally "good" for the world, then the world is _not_ better off if everyone disclosed, since the main users of CNE are LE/IC.
- mattmaroon 2y agoI'm not sure what some of these initialisms are but the whole idea behind disclosing is to take tools away from the bad guys (whoever you think they are) because presumably they'll have found some of them too.
- tptacek 2y agoCNE: the modern term of art for deploying exploits to accomplish real-world objectives ("computer network exploitation"). LE: law enforcement, a major buyer of CNE tooling. IC: the intelligence community, the buyer of CNE tooling everyone thinks about first.
- josefritzishere 2y agoI guess there wont be one in 2024
- skirge 2y agoBurning 0-days makes your enemies spend more time on finding new ones - costs rise so they will go bankrupt. Cold war 2.0. It's not enough to just run grep / memcpy finder on software like 20-15 years ago.
- deleted 2y ago[deleted]
- ikmckenz 2y agoThere is no such thing as a "Nobody But Us" vulnerability. Leaving holes in systems and praying enemies won't discover them, with the hope of attacking them ourselves is extremely foolish.
- newpresotr456tr 2y ago[dead]
- joshfraser 2y agoI've seen the invite-only marketplaces where these exploits are sold. You can buy an exploit to compromise any piece of software or hardware that you can imagine. Many of them go for millions of dollars. There are known exploits to get root access to every phone or laptop in the world. But researchers won't disclose these to the manufacturers when they can make millions of dollars selling them to governments. Governments won't disclose them because they want to use them to spy on their citizens and foreign adversaries. The manufacturers prefer to fix these bugs, but aren't usually willing to pay as much as the nation states that are bidding. All they do is drive up the price. Worse, intelligence agencies like the NSA often pressure or incentivize major tech companies to keep zero-days unpatched for exploitation. It's a really hard problem. There are a bunch of perverse incentives that are putting us all at risk.
- timewizard 2y ago> It's a really hard problem. Classify them as weapons of mass destruction. That's what they are. That's how they should be managed in a legal framework and how you completely remove any incentives around their sale and use.
- joshfraser 2y agoYes. Except our government is the largest buyer.
- Symbiote 2y agoThe USA has 5044 nuclear missiles, so that shouldn't be a problem.
- kingaillas 2y agoHow about some penalties for their creation? If NSA is discovering or buying, someone else is creating them (even if unintentionally). Otherwise corporations will be incentivized (even more than they are now) to pay minimal lip service to security - why bother investing beyond a token amount, enough to make PR claims when security inevitably fails - if there is effectively no penalty and secure programming eats into profits? Just shove all risk onto the legal system and government for investigation and clean up.
- maerF0x0 2y agothe US often gets negative takes for doing what many other nations are also doing. For example in 2018 Tencent (basically, China) withdrew from hacking competitions like pwn2own taking along with them the disclosures that proceeded.
- tptacek 2y agoEssentially every other industrialized nation.
- fluoridation 2y agoWhataboutism. What China does doesn't invalidate any criticism the US gets. Or are you saying that actually it's perfectly fine to do this?
- tptacek 2y agoThat would be true if it was just China, but when it's so many countries that it's essentially an international norm, the "whataboutism" charge loses some of its sting.
- fluoridation 2y ago"But other countries do it too" is whataboutism, no matter how many other countries that is; it doesn't invalidate the criticism no matter the number. So I ask again: is the real counterargument that actually this is perfectly fine to do?
- Veserv 2y agoDisclosing zero-days so the vendor can patch them and declare "mission accomplished" is such a waste. "Penetrate and Patch" is about as effective for software security as it is for bulletproof vests. If you randomly select 10 bulletproof vests for testing, shoot each 10 times and get 10 holes each, you do not patch those holes and call it good. What you learned from your verification process is that the process that lead to that bulletproof vest is incapable of consistently delivering products that meet the requirements. Only development process changes that result in passing new verification tests give any confidence of adequacy. Absent actively, or likely actively, exploited vulnerabilitys, the government should organize vulnerabilitys by "difficulty" and announce the presence of, but not disclose the precise nature of, vulnerabilitys and demand process improvement until vulnerabilitys of that "difficulty" are not longer present as indicated by fixing all "known, but undiclosed" vulnerabilitys of that "difficulty". Only that provides initial supporting evidence that the process has improved enough to categorically prevent vulnerabilitys of that "difficulty". Anything less is just papering over defective products on the government's dime.
- JumpCrisscross 2y ago> the government should organize vulnerabilitys by "difficulty" and announce the presence of, but not disclose the precise nature of, vulnerabilitys and demand process improvement until vulnerabilitys of that "difficulty" are not longer present as indicated by fixing all "known, but undiclosed" vulnerabilitys of that "difficulty" For this amount of bureaucracy, the government should just hire all coders and write all software.
- Veserv 2y agoYou appear to misunderstand what I am saying: 1) Government already has vulnerabilitys. 2) Government identifies vulnerabilitys they already own by "difficulty to discovery". 3) Government selects the lowest "difficulty to discover" vulnerabilitys they already own. 4) Government announces products with known "lowest difficulty to discover" vulnerabilitys are vulnerable, but does not disclose them. 5) Government keeps announcing those products continue to be the most "insecure" until all vulnerabilitys they already own at that level are fixed. 6) Repeat.
- deleted 2y ago[deleted]
- egberts1 2y agoSimply because not enough anti-malware vendors are willing to let US government know that one of their favorite hoard of malware has lost "its edge". So, either they form a department of viability or they lose it all.