4 ms·

I am curious why this information appears now. Is this in reference to Microsoft given exploits to the government? If that is the case, could this problem be s

I am curious why this information appears now. Is this in reference to Microsoft given exploits to the government? If that is the case, could this problem be solve by installing linux? I am not a linux fan, but the point of the source code being open and review by millions of people starts making me feeling more secure.

tptacek 13y ago
Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures. NSA does not need Microsoft's help to break into computers.
- temp9251 13y ago
  It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.
  - tptacek 13y ago
    Which specific statement did I make that you disagree with? I'm happy to go into more depth.
    - temp9251 13y ago
      Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?
      - tptacek 13y ago
        Did I say something above that you disagree with?
- kunai 13y ago
  This is going to sound dickish, but technically it's "the NSA," not just "NSA". "National Security Administration doesn't need Microsoft to break into computers." vs "The National Security Administration doesn't need Microsoft to break into computers." Too much of a tangent, perhaps?
  - tptacek 13y ago
    Doesn't sound dickish. You're probably right. Force of habit.
  - adoyle 13y ago
    National Security Agency, not Administration ;)
  - dfc 13y ago
    Tangent or not I'm interested. I think its less settled than you think. In fact I was always on the opposite team; its "NSA/DoD/DoE did x" just like it is "IBM did x" and not "the IBM did x." I did enough research to conclude that it was not a settled issue. Its clear that if the initials were lower case and referred to a generic agency that deals with national security it would be "the national security agency" similar to the "the fishing tackle section of a sporting goods store." On the other hand a gander at DoD's style guide[1] makes it clear that they do not like the "the." I'd love to see why you think its opposite. That's not dickish, that's a desire to answer a question that's been nagging me for a long time. [1] http://www.dtic.mil/whs/directives/corres/writing/Writing_Style_Guide.pdf http://www.dtic.mil/whs/directives/corres/writing/Writing_St... From the english.SX: "Is it proper to use “the” before the name of a government organization?" http://english.stackexchange.com/questions/76976/is-it-proper-to-use-the-before-the-name-of-a-government-organization http://english.stackexchange.com/questions/76976/is-it-prope... "Using the definite article with acronyms and initialisms" http://english.stackexchange.com/questions/30596/using-the-definite-article-with-acronyms-and-initialisms http://english.stackexchange.com/questions/30596/using-the-d... "Definite article with proper nouns, titles followed by a common noun" http://english.stackexchange.com/questions/2327/definite-article-with-proper-nouns-titles-followed-by-a-common-noun http://english.stackexchange.com/questions/2327/definite-art... "The definite article usage with objects that have names" http://english.stackexchange.com/questions/16988/the-definite-article-usage-with-objects-that-have-names http://english.stackexchange.com/questions/16988/the-definit... "Capitalising the definite article in names" http://english.stackexchange.com/questions/84288/capitalising-the-definite-article-in-names http://english.stackexchange.com/questions/84288/capitalisin...
- lawnchair_larry 13y ago
  MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public. Though I do not think this story has anything to do with MAPP.
  - tptacek 13y ago
    Depending on the vulnerability, a crash POC might be a day's work away from an exploit, or it might be months of work. MAPP or no MAPP, Microsoft does not have the technical capability to produce reliable exploits for all of the vulnerabilities it's made aware of. Also, we both know NSA has a (less-well-known) charter for coordinating vulnerability response and computer security across the agencies; NSA has a public huge defensive interest in this stuff as well. NSA doesn't need Microsoft to enable it to break into arbitrary Windows machines. But it might need their help to keep up with every attack vector on Microsoft code, which is what you need to do if you're doing defensive work.
- cientifico 13y ago
  Seems like microsoft have that expertises: http://www.techdirt.com/articles/20130614/02110223467/microsoft-said-to-give-zero-day-exploits-to-us-government-before-it-patches-them.shtml http://www.techdirt.com/articles/20130614/02110223467/micros...
hga 13y ago
Only the official confirmation is new, word that she thought her computer(s) were compromised has been out for a while. I'm not at all sure Linux is the solution; the only plausible culprit for whom that would be a barrier is a non-state actor doing a modern variety of "Will no one rid me of this turbulent priest" (http://en.wikipedia.org/wiki/Thomas_Becket http://en.wikipedia.org/wiki/Thomas_Becket). But the reported sophistication of the attack makes that less likely that previously speculated, and I assume that "Linux" is not a high enough barrier to a state actor.
- kunai 13y ago
  Assuming that the NSA doesn't possess quantum computers, perhaps 4096-bit PGP email hosted on a local mail server, along with SELinux, full disk encryption and a strong firewall that blocks all incoming connections, should do the trick. Am I correct? It's the setup I'm using now.
  - hga 13y ago
    Do you have 24/7 control over the access to your computer? Or at least something that cannot be bypassed that would make tampering evident? If not, you're subject to a "black bag" job that could easily bypass all your protections, e.g. a physical key logger that would pick up your password/pass phrase that unlocks your disk encryption so you can use it. Otherwise, do you surf the net from it? I don't take all your precautions, but I do run my browsers in a dedicated VM that has limited access to the rest of my infrastructure.
    - kunai 13y ago
      > Do you have 24/7 control Pretty much. It's a single user MacBook Air, and I carry it with me at all times, never leaving it out or in the open, or even at home. For suspicious individuals, the CIA can obtain a warrant without notifying the individual, and search his/her apartment/home at convenient times when away, so I never leave it at home, either. It's pretty much the only computing device I have that has highly sensitive data on it. I don't really care if they take my Kindle Fire; the only stuff on that is books and personal email.

tptacek 13y ago

Microsoft doesn't give "exploits" to the government. Microsoft doesn't have the in-house expertise to write many of those exploits. It provides information about verified security vulnerabilities (different from exploits) before they're patched, because their patch schedules are elaborate and necessarily create a window of unpatched vulnerability. Microsoft also gives the same information to many commercial vendors, so they can write antivirus and IPS signatures. NSA does not need Microsoft's help to break into computers.

temp9251 13y ago
It seems disingenuous to compare it to the disclosure to commercial vendors when the government is not listed as a MAPP partner. I have no clue what they actually disclose, but I disagree that the issue is so cut and dried.
- tptacek 13y ago
  Which specific statement did I make that you disagree with? I'm happy to go into more depth.
  - temp9251 13y ago
    Do you know more than I do about Microsoft's disclosures to the US Government (effectively nothing) or is it an educated guess that what they receive is comparable with MAPP?
    - tptacek 13y ago
      Did I say something above that you disagree with?
kunai 13y ago
This is going to sound dickish, but technically it's "the NSA," not just "NSA". "National Security Administration doesn't need Microsoft to break into computers." vs "The National Security Administration doesn't need Microsoft to break into computers." Too much of a tangent, perhaps?
- tptacek 13y ago
  Doesn't sound dickish. You're probably right. Force of habit.
- adoyle 13y ago
  National Security Agency, not Administration ;)
- dfc 13y ago
  Tangent or not I'm interested. I think its less settled than you think. In fact I was always on the opposite team; its "NSA/DoD/DoE did x" just like it is "IBM did x" and not "the IBM did x." I did enough research to conclude that it was not a settled issue. Its clear that if the initials were lower case and referred to a generic agency that deals with national security it would be "the national security agency" similar to the "the fishing tackle section of a sporting goods store." On the other hand a gander at DoD's style guide[1] makes it clear that they do not like the "the." I'd love to see why you think its opposite. That's not dickish, that's a desire to answer a question that's been nagging me for a long time. [1] http://www.dtic.mil/whs/directives/corres/writing/Writing_Style_Guide.pdf http://www.dtic.mil/whs/directives/corres/writing/Writing_St... From the english.SX: "Is it proper to use “the” before the name of a government organization?" http://english.stackexchange.com/questions/76976/is-it-proper-to-use-the-before-the-name-of-a-government-organization http://english.stackexchange.com/questions/76976/is-it-prope... "Using the definite article with acronyms and initialisms" http://english.stackexchange.com/questions/30596/using-the-definite-article-with-acronyms-and-initialisms http://english.stackexchange.com/questions/30596/using-the-d... "Definite article with proper nouns, titles followed by a common noun" http://english.stackexchange.com/questions/2327/definite-article-with-proper-nouns-titles-followed-by-a-common-noun http://english.stackexchange.com/questions/2327/definite-art... "The definite article usage with objects that have names" http://english.stackexchange.com/questions/16988/the-definite-article-usage-with-objects-that-have-names http://english.stackexchange.com/questions/16988/the-definit... "Capitalising the definite article in names" http://english.stackexchange.com/questions/84288/capitalising-the-definite-article-in-names http://english.stackexchange.com/questions/84288/capitalisin...
lawnchair_larry 13y ago
MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public. Though I do not think this story has anything to do with MAPP.
- tptacek 13y ago
  Depending on the vulnerability, a crash POC might be a day's work away from an exploit, or it might be months of work. MAPP or no MAPP, Microsoft does not have the technical capability to produce reliable exploits for all of the vulnerabilities it's made aware of. Also, we both know NSA has a (less-well-known) charter for coordinating vulnerability response and computer security across the agencies; NSA has a public huge defensive interest in this stuff as well. NSA doesn't need Microsoft to enable it to break into arbitrary Windows machines. But it might need their help to keep up with every attack vector on Microsoft code, which is what you need to do if you're doing defensive work.
cientifico 13y ago
Seems like microsoft have that expertises: http://www.techdirt.com/articles/20130614/02110223467/microsoft-said-to-give-zero-day-exploits-to-us-government-before-it-patches-them.shtml http://www.techdirt.com/articles/20130614/02110223467/micros...

hga 13y ago

Only the official confirmation is new, word that she thought her computer(s) were compromised has been out for a while. I'm not at all sure Linux is the solution; the only plausible culprit for whom that would be a barrier is a non-state actor doing a modern variety of "Will no one rid me of this turbulent priest" (http://en.wikipedia.org/wiki/Thomas_Becket http://en.wikipedia.org/wiki/Thomas_Becket). But the reported sophistication of the attack makes that less likely that previously speculated, and I assume that "Linux" is not a high enough barrier to a state actor.

kunai 13y ago
Assuming that the NSA doesn't possess quantum computers, perhaps 4096-bit PGP email hosted on a local mail server, along with SELinux, full disk encryption and a strong firewall that blocks all incoming connections, should do the trick. Am I correct? It's the setup I'm using now.
- hga 13y ago
  Do you have 24/7 control over the access to your computer? Or at least something that cannot be bypassed that would make tampering evident? If not, you're subject to a "black bag" job that could easily bypass all your protections, e.g. a physical key logger that would pick up your password/pass phrase that unlocks your disk encryption so you can use it. Otherwise, do you surf the net from it? I don't take all your precautions, but I do run my browsers in a dedicated VM that has limited access to the rest of my infrastructure.
  - kunai 13y ago
    > Do you have 24/7 control Pretty much. It's a single user MacBook Air, and I carry it with me at all times, never leaving it out or in the open, or even at home. For suspicious individuals, the CIA can obtain a warrant without notifying the individual, and search his/her apartment/home at convenient times when away, so I never leave it at home, either. It's pretty much the only computing device I have that has highly sensitive data on it. I don't really care if they take my Kindle Fire; the only stuff on that is books and personal email.