6 ms·
The NSA helps the companies find weaknesses in their products. But it also pays the companies not to fix some of them. Those weak spots give the agency
by mikegioia 12y ago
The NSA helps the companies find weaknesses in their
products. But it also pays the companies not to fix some
of them. Those weak spots give the agency an entry point
for spying or attacking foreign governments that install
the products in their intelligence agencies, their
militaries, and their critical infrastructure.
That's probably the most frightening thing imaginable, but where is this info coming from? What are the sources on all of these accusations because it feels like a pretty casual mention that all of the hardware/software manufacturers in the US intentionally leave in back doors.
- tdullien 12y agoAs someone who has been very closely involved with Infosec and who has followed all the vulnerability market rumors, I have never heard of "pays the companies to not fix them" before, and I strongly doubt the veracity of that statement.
- cpleppert 12y agoI agree, I think the author is confusing mandatory monetary compensation for FISA/warrants etc with just straight up paying for a company to comply. Companies don't want to be paid especially because the monetary gains aren't worth it and the reputation risks are enormous.
- deleted 12y ago[deleted]
- meowface 12y agoI agree. It is, however, true that there are many cases where intelligence agencies research, develop, and weaponize vulnerabilities in products without informing the pertinent companies. Stuxnet is one of many examples.
- lern_too_spel 12y agoThe author seems to be confusing documented surveillance access points used by various governments for their lawful wiretaps with hidden backdoors inserted solely for the US government, which stretches credulity.
- tedunangst 12y agoThe following sentences provide three examples, which if spun properly, can almost be construed to mean that. Paying for advance notice of a fix somehow becomes paying not to fix.
- nitrogen 12y agoThere was something in the Snowden leaks about NSA stockpiling vulnerabilities in software instead of helping vendors fix the vulnerabilities. Also, IIRC they requested an extra delay from some software vendor(s?) after revealing a vulnerability, but before the vendor patching it.