4 ms·

There is a difference between infiltrating companies and deliberately introducing a bug that compromises a large chunk of the Internet. I would assume the NSA i

There is a difference between infiltrating companies and deliberately introducing a bug that compromises a large chunk of the Internet. I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails.

doctorfoo 13y ago
Perhaps they assume all software is buggy, so they may as well own the bugs?
spacemanmatt 13y ago
I would assume the NSA always assumed (note past tense) that their secrets stay pretty secret, and their wide-open backdoors will not get knockers.
- mpyne 13y ago
  They don't assume that. I don't see why people think that NSA is simultaneously genius-level forces of the Illumanti architecting events that will culminate years later, and yet would make the rookie level mistake of introducing a backdoor that is protected only by obscurity. They know other security services understand how to decompile code (or read the original source). More importantly, they know that critical government services they can't predict will end up possibly running things like their broken version of OpenSSL. There's a FIPS standard, of course, but note that the Heartbleed page made quite clear that FIPS is vulnerable too.
jrochkind1 13y ago
> I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails. Don't we actually already have evidence of other cases of the NSA adding backdoors to widely used systems, exploitable by anyone aware of them? Isn't that what the elliptic curve backdoor was? http://www.wired.com/2013/09/nsa-backdoor/all/ http://www.wired.com/2013/09/nsa-backdoor/all/ Apparently your assumption is quite not safe to assume. I guess the NSA either figures nobody else will notice the backdoor, or just doesn't care. I guess only they know their motivations.
- caf 13y ago
  The mooted backdoor in the Dual-ECDRBG involves the possibility that the public parameters were generated based on some secret values, such that knowing the secret values allows you to break the generator. It doesn't allow just anyone to break it - merely knowing the backdoor is there isn't enough.
rbanffy 13y ago
> the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails. If possible, yes. However, if they were indeed responsible for this, they'd probably have a couple honeypots to detect exploitation by third parties. If they considered the third party harmless, they could decide whether the vulnerability should be "independently discovered" or not. Planting a complicated exploit would be harder and increase the risk it could be traced back to them.

doctorfoo 13y ago

Perhaps they assume all software is buggy, so they may as well own the bugs?

spacemanmatt 13y ago

I would assume the NSA always assumed (note past tense) that their secrets stay pretty secret, and their wide-open backdoors will not get knockers.

mpyne 13y ago
They don't assume that. I don't see why people think that NSA is simultaneously genius-level forces of the Illumanti architecting events that will culminate years later, and yet would make the rookie level mistake of introducing a backdoor that is protected only by obscurity. They know other security services understand how to decompile code (or read the original source). More importantly, they know that critical government services they can't predict will end up possibly running things like their broken version of OpenSSL. There's a FIPS standard, of course, but note that the Heartbleed page made quite clear that FIPS is vulnerable too.

jrochkind1 13y ago

> I would assume the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails. Don't we actually already have evidence of other cases of the NSA adding backdoors to widely used systems, exploitable by anyone aware of them? Isn't that what the elliptic curve backdoor was? http://www.wired.com/2013/09/nsa-backdoor/all/ http://www.wired.com/2013/09/nsa-backdoor/all/ Apparently your assumption is quite not safe to assume. I guess the NSA either figures nobody else will notice the backdoor, or just doesn't care. I guess only they know their motivations.

caf 13y ago
The mooted backdoor in the Dual-ECDRBG involves the possibility that the public parameters were generated based on some secret values, such that knowing the secret values allows you to break the generator. It doesn't allow just anyone to break it - merely knowing the backdoor is there isn't enough.

rbanffy 13y ago

> the NSA is interested in gaining access to systems in a way that doesn't allow basically anyone to ride on their coattails. If possible, yes. However, if they were indeed responsible for this, they'd probably have a couple honeypots to detect exploitation by third parties. If they considered the third party harmless, they could decide whether the vulnerability should be "independently discovered" or not. Planting a complicated exploit would be harder and increase the risk it could be traced back to them.