4 ms·

So, this is going to sound like I'm determined to find a reason to hate the NSA, but.. this doesn't make them look good either. It's the most accessible and wi

So, this is going to sound like I'm determined to find a reason to hate the NSA, but.. this doesn't make them look good either. It's the most accessible and widely-deployed memory disclosure bug of recent years, if not ever. Surely there are at least 1000 vulnerable (at the time) servers they'd specifically love to have this window into, for intelligence on the "bad guys." Surely they know the "bad guys" would love to look into and attack American servers the same way. Exploiting and defending this kind of thing is exactly what the NSA is supposedly for, but they're telling us they didn't know about it. I guess all their good talent and money was tied up in domestic call metadata social graph analysis. But at least they had someone smart enough to do the trivial patch once the vulnerability was known![0] P.S. I also notice they didn't mention "Shellshock". Why not? [0] https://twitter.com/agl__/status/530004568784916480 https://twitter.com/agl__/status/530004568784916480

sliverstorm 12y ago
So your argument is "If the NSA is any good, they must know about every vulnerability in the world before the private sector- otherwise they are incompetent"?
- venomsnake 12y ago
  With the amount of money they spend, I would suggest that the US taxpayer should get some value out of it. So while not every - at least a lot.
  - scintill76 12y ago
    Right. I agree it's not reasonable to expect any one entity to know every possible vulnerability in the world. But with all the money and brains they have, how huge this particular target was (for both defensive and offensive purposes), and how high the stakes are (as they remind us whenever we challenge them), you'd think they'd have static code analysis flagging these kinds of things the moment they're checked in to a public repository of any notoriety, fuzzers running 24/7, "shadow" code review against things like OpenSSL by their best hackers, etc., at which point it does almost become incompetence that they either don't have that, or it failed. At least, I'm wondering what all that money is for. No, it doesn't really prove incompetence, but on the other hand "we released a trivial patch for an issue the private sector already found and fixed"* doesn't prove competence either, or inspire any sympathy from me. These are the types of people who trot out imagery like "cyber Pearl Harbor" when they're telling us why they need to be granted more power to protect us, yet their go-to public example of fixing a critical vulnerability in the national digital infrastructure is laughably irrelevant. * Depending on what time of day it was, the official fix may or may not have been publicly released when NSA did whatever they're claiming they did.
- SwellJoe 12y ago
  I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding and fixing these kinds of vulnerabilities. They expend vastly more on spying, cataloging, and archiving information about people than they do on figuring out when the software that runs the Internet is vulnerable. If they are to exist on the taxpayer dime, they should serve the taxpayer first and foremost. They like to brag about this kind of thing, because it makes them look good (and maybe allows them to believe they are "good people", as I often see folks who defend the NSA say of them) but it isn't actually their priority, and it is not something they have a history of doing. For example, this is the kind of thing the NSA actually spends significant money on: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center That same money would have employed a number of excellent security researchers, and the tools they need to help make the Internet a safer, more secure place, for all Americans. In short, this kind of article is misdirection, and people in our industry should not be snowed by those tactics. We should know better, based on their historical behavior.

sliverstorm 12y ago

So your argument is "If the NSA is any good, they must know about every vulnerability in the world before the private sector- otherwise they are incompetent"?

venomsnake 12y ago
With the amount of money they spend, I would suggest that the US taxpayer should get some value out of it. So while not every - at least a lot.
- scintill76 12y ago
  Right. I agree it's not reasonable to expect any one entity to know every possible vulnerability in the world. But with all the money and brains they have, how huge this particular target was (for both defensive and offensive purposes), and how high the stakes are (as they remind us whenever we challenge them), you'd think they'd have static code analysis flagging these kinds of things the moment they're checked in to a public repository of any notoriety, fuzzers running 24/7, "shadow" code review against things like OpenSSL by their best hackers, etc., at which point it does almost become incompetence that they either don't have that, or it failed. At least, I'm wondering what all that money is for. No, it doesn't really prove incompetence, but on the other hand "we released a trivial patch for an issue the private sector already found and fixed"* doesn't prove competence either, or inspire any sympathy from me. These are the types of people who trot out imagery like "cyber Pearl Harbor" when they're telling us why they need to be granted more power to protect us, yet their go-to public example of fixing a critical vulnerability in the national digital infrastructure is laughably irrelevant. * Depending on what time of day it was, the official fix may or may not have been publicly released when NSA did whatever they're claiming they did.
SwellJoe 12y ago
I don't believe the NSA are incompetent. I believe they are malevolent, in that they prioritize spying on American citizens (indirectly, of course) over finding and fixing these kinds of vulnerabilities. They expend vastly more on spying, cataloging, and archiving information about people than they do on figuring out when the software that runs the Internet is vulnerable. If they are to exist on the taxpayer dime, they should serve the taxpayer first and foremost. They like to brag about this kind of thing, because it makes them look good (and maybe allows them to believe they are "good people", as I often see folks who defend the NSA say of them) but it isn't actually their priority, and it is not something they have a history of doing. For example, this is the kind of thing the NSA actually spends significant money on: https://en.wikipedia.org/wiki/Utah_Data_Center https://en.wikipedia.org/wiki/Utah_Data_Center That same money would have employed a number of excellent security researchers, and the tools they need to help make the Internet a safer, more secure place, for all Americans. In short, this kind of article is misdirection, and people in our industry should not be snowed by those tactics. We should know better, based on their historical behavior.