12 ms·

US Navy Soliciting Zero Days

82 points by mo 11y ago

deleted 11y ago
[deleted]
DickingAround 11y ago
What exactly should we do with this information? It's clear there's a cyber war heating up. Between Stuxnet, the US gov's OPM getting hacked, kaspersky getting attacked, it's become pretty obvious. And since there's seemingly no need to declare such a war before doing it, it'll only get hotter. So what do we do? Is it time to just start running open-bsd? Should I just assume my systems won't be a casualty because it won't get that hot? Air gap the important part?
- Zigurd 11y ago
  It's the cyberwar equivalent of soliciting engineered microbes for which there is no vaccine or treatment. How long would anyone put up with that?
- arca_vorago 11y ago
  Don't you get it. The cyberwar isn't "heating up", what "cyberwar" exists has existed since the 90's. Yes technological pervasiveness is making vulnerabilities being taken advantage of hit larger swaths of devices, but that's not why you see the heating up of the arena. The real reason is that we need a new boogieman to justify the level of surveillance. The public, as deluded and propagandised as they are, is starting to get tired of the same ol terrorism argument, so this is the new communism/terrorism, etc. The point is that it's never about what they say it's about. It's about control. Inverted totalitarianism.
  - harkyns_castle 11y ago
    Not just surveillance, we also need a reason to keep the war machine going. And there'll be demands for more money for national security after this. Ad infinitum until there's a revolt or some kind of political evolution in the states. That fiat cash will get tucked away by some established families and companies, revolving doors aplenty, and then a new threat will be invented/created when this one wears out. The Fed, or the people behind it, will sit back with their hands crossed on their fat, corrupt bellies and say, well, at least we'll enjoy the planet while we live. Screw the rest.
    - arca_vorago 11y ago
      You're right, but what really gets me is that the internet was supposed to be the great equalizer, revealing that the emperor had no clothes, but it's almost as if as the corruption becomes more apparent, the more they have to push it to stay on top of the proletariat. It's worrisome where this trend will end up.
      - harkyns_castle 11y ago
        Ultimately I guess it depends on whether you're optimistic about human nature, over time. I think we're seeing a gross abuse of it, esp. from the leaders of the US and the people pulling the strings. But, I'd like to think we improve over time, despite this kind of evil. And there is no doubt in my mind its an evil, perhaps not biblical, but a vast and greedy, sickening selfishness. Pity we won't be around to see it if and when it turns right, but time is a great healer. I don't think the level of greed we're seeing now can be turned around in a generation.
        marincounty 11y ago
        Personally, I don't see much light at the end of the tunnel? This greed seems cool in some circles--which I can't comprehend. It is not cool in my world. I feel morality is lacking? I don't know how to install morality. I do know this "Just because it's legal, doesn't make it moral" said by a deceased friend of mine.
        harkyns_castle 11y ago
        Idk, but longer term I'd think a co-operative approach would make more sense, and stop destroying the planet for elfish short-term gains. Crazy idea though. Can't have anything compete with those beautiful oil, fracking, banking, warring people though - they mean well! I mean, its just short term, we'll just cut down all the forests, ruin all the topsoil, drill all the oil, frack all the rocks and lpg, and ... well, we don't care, go fuck yourselves, we made money, and we don't care about children or grandchildren. Cya.
        11y ago
  - brador 11y ago
    Control for what purpose?
    - ta0967 11y ago
      for its own sake. for the thrill of being the top-dog, for the giggle of a nation of minions scared shitless into begging you to take more power so you can scare them more.
    - arca_vorago 11y ago
      Suppression of dissent primarily, which is why the internet is and will increasingly be under legislative attack. It has served as one of the last bastions of anarchistic freedom of thought, which threatens the powers that be. Said suppression only happens when you can reliably tie identities online to identities offline. Hence parallel construction, etc.
    - themeek 11y ago
      So many different purposes. Sometimes control is necessary for everyone's benefit - government has a legitimate claim to power. Sometimes control is self-interested - it does one party more good than it can do the other. Sometimes control is about a brace for an uncertain future - the American Empire right now is being seriously challenged for its global primacy. Sometimes control is about self-benefit - it consolidates power specifically to disadvantage the other power. Etc. Etc. Power consolidation right now is a mixed bag. Those who want power for their own purposes find a good partner with those who consolidate power for noble purposes find a good partner with those who brace for the future, etc. You can only pick voices from the cacophony if you train your ear in one direction. They are all there and it takes every singer in the chorus to work.
  - justonepost 11y ago
    If by "has existed" you mean to say that there were people who attacked computers in the 90s, yes, that's technically correct. However - I think the parent post was trying to say rather than 100s of millions being spent worldwide on this, 100s of billions are now being spent.
    - themeek 11y ago
      By cyberwar he means that nation states were investing in state-of-the-art capabilities to use Computer Network Exploitation for the purposes of espionage and sabotage. This has been happening since the 90s. It is true that it has gotten consistently warmer on the internet. There is a term called "hybrid warfare" now that is being traded in the US defense sector. Hybrid warfare means assymetric capabilities in tandem with ground forces: IO (intelligence operations) with kinetic operations. IO itself is a broad category consisting of Military Deception (MILDEC), PSYOPS or Strategic Communication (propaganda operations), Electronic Warfare (to disrupt communication, coordination and execution), and Signals Collection for espionage (SIGINT). The US now considers hybrid warfare the norm and deploys IO operations with every kinetic force. In Syria this meant hacking their air force and grounding their planes - in Ukraine it means winning the 'idea war' in neutral territories and providing morale and information support to civilians and the military alike. Cyberwar continues to change, as does all war, with the advancement of technology, the capabilities of the parties, the state of the art, and the scale of conflicts. But we've had it now for a couple decades in one stage of evolution or another.
  - themeek 11y ago
    The control is not always in the hue of totalitarianism or evil or malice. Some control is necessary of any government. Some control is perceived to be, but is not actually, necessary. Some control is self-interested and self-concerned. Some control is conspired by those who seek to wield it for their own benefit. When it comes to the US government, there's a big mix of the above and its never enough to establish one grand motive behind everything. This of course doesn't take away your point - it is about power. It's just that the angle on this power has to be negotiated circumstantially and available alternatives. (If there's an simple, cheap and effective way to solve a problem but a power consolidating method is chosen instead the mask has slipped).
  - hellameta 11y ago
    Can someone "ELI5" this to me? How is it possible that in the Western world there is a collective 'they' that are doing this? It seems more reasonable that the behavior we dislike is emergent. Anyone working in even a medium-sized company knows that it couldn't possibly collude to get out of its own way. How is it that the US government can do it? Who is this magical 'they' we keep blaming and criticizing? Sorry if I'm being dense - sincerely trying to understand.
    - tw04 11y ago
      I dunno, AT&T had room 641a running for an awful long time. And when someone finally DID speak up, they were dismissed as a kook. I think you're greatly, GREATLY underestimating the amount of collusion that can and does occur.
      - hellameta 11y ago
        Thank you for your response. I don't disagree that there is collusion - I disagree that it is as effective as we give it credit for. Namely, that there is a systematic 'them' which is against 'us'. That the NSA can tap communication is to me an example of very small collusion. It's the level alluded to here that confuses me: >... a new boogieman to justify the level of surveillance... the point is that it's never about what they say it's about. It's about control. Inverted totalitarianism. Is there really this kind of 'collusion' going on? Is there a backroom where people say this with a straight face? I'm completely prepared to hear this is the case but I'm trying to find a reasonable explanation. It seems to me these people go home to their wives and kids at the end of the day just like the rest of us. To build this a little further. I toy with the idea that we ourselves are creating these mythical boogymen and THAT is what hurts our ability to change anything. I don't know :\
        arca_vorago 11y ago
        I hesitated to respond because honestly, it's a dangerous question you are asking, and a truthful answer in the wrong place or time can be social and political suicide. I understand your view, and generally agree with your primary point that it's not a single overarching group in total control. The world of Machiavellian Realpolitik is much more nuanced and complex than that, and I mostly chalk it up to our tendency as humans seek to simplify things. First, I would like to point out that I consider Hanlon's razor a logical fallacy that should be relegated to the dustbin of debate. It is far too often used in the discussion of this matter. Now to your original question of who "they" is. In short, my conclusion is that it is primarily but not restricted to the supranational aristocratic elite, in particular the ones who desire global governance (at least on the surface). The most obvious example of this is the kinds of people who are C-level or board level who have positions across the world. A good primary jumping point for this would be the analysis of control networks in this very good paper: http://arxiv.org/pdf/1107.5728.pdf http://arxiv.org/pdf/1107.5728.pdf All that paper does though is show the level of interconnectedness, but what it doesn't show is intent. That wasn't your question though and is best left for another discussion. The bottom line to me is that "they" is the uber-wealthy, and that class-warfare and return of a type of neo-feudalism is right around the corner if not already here. If you want to know where the collusion happens, look to the round table groups; eg. the council on foreign relations, the bilderberg group, the trilateral commision, and various think-tanks, superpacs, and tax-exempt foundations, and yes, even secret societies. The main mistake though is to think they are all in on it or even understand it. That's not how control at a high level works. Imagine how control of a secretive org such as the CIA/NSA works. It's so wrapped up in compartmentalization that it's easy to take people who mean well and task them with something they don't understand the bigger picture implications of, and combine many of them to accomplish a big thing that none of them understand but a few key people at the top. I propose that the majority of "the key people at the top" are comprimised in some form or fashion, so even they are pawns in a game they don't fully understand... many simply want to make money or protect their reputations, though some are most definitely being blackmailed or threatened with much, much worse.
- wahsd 11y ago
  Sorry to break it to you, but air gapping is not really an impediment for a determined adversary.
  - zaphar 11y ago
    Neither is paper only storage. But it's still going to make it harder for the adversary than being connected to the internet. Security is all about striking a balance between how hard you make it for the adversary vs how hard you make it for yourself. Even committing only to memory and never writing it down is not going to stop a committed enough adversary kidnapping and torture do exist after all. The only question is where do you want to draw the line.
- sliverstorm 11y ago
  It occurs to me that zero days are kind of like lethal force. We would really rather the government have none, but it must to deal with defense. It could be levied at us, but we usually believe it won't. Does that mean we need a Second Amendment for encryption?
themartorana 11y ago
$27.5m fixed bid for a 24 month contract. That's extremely good work if you can get it.
- pmorici 11y ago
  It doesn't say that. the number $27.5 million is the cut off for a business to be considered a "small business" which would receive special considerations under the law.
  - themartorana 11y ago
    Ah. You're right. Thanks for that.
- sailfast 11y ago
  Does anyone have a link to the original solicitation?
tempodox 11y ago
Why not 0 seconds, instead of 0 days? I didn't think you can buy time anywhere, but why the gratuitous use of the “days” unit when the quantity is zero anyway? Still, a gov't agency would surely pay plenty, even for nothing at all, so what's the going rate for “no time at all” these days?
- ugexe 11y ago
  0 seconds sounds stupid and is being pedantic, especially as Wikipedia even says zero days are also referred to as 0 hours
  - pjc50 11y ago
    "Zero hour" has a specific, different meaning though.
    - ugexe 11y ago
      https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing) A zero-day (also known as zero-hour or 0-day)
- userbinator 11y ago
  A "0day" is a noun. I still remember when it was commonly used to refer to warez releases, but now it seems it's been used to refer more to exploits... the times have changed. https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing)
- aric 11y ago
  Days convey immediacy and scale. "Today" and "same day" balance precision. If time between an exploit becoming known and fixed consistently happened in 100 seconds or less, 0-sec might sound ok. Come to think of it, 0-sec is a fitting pun.
  - bentcorner 11y ago
    "0-sec" isn't too bad, but the plural can make for awkward conversation.
vaadu 11y ago
This is why the mission of securing America's networks needs to be removed from the NSA. “What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” wrote Nate Cardozo and Andrew Crocker of the Electronic Frontier Foundation. “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”
- wahsd 11y ago
  To be fair, they don't monitor whether the 0Day exploits are widely used so they have no idea when they should make them public for general security purposes. (yes, that's sarcasm) But the way the entities operate that are actually seeking these, is by thinking of themselves as outside of the regular set of rules and even reality. They are seeking 0Day exploits with an assumption that the individual or individuals that provide them will not sell them to someone else or even use them for themselves. I can guarantee that these "cyber wars" are going to result in some sort of cluster-fuck-up at some point because humans have a tendency to entrust the least responsible people with the most devastating technologies even remotely before we fully understand the ramifications. On a side note; please take note of the fact that many of the current issues regarding anonymity and security on the internet and in technology in general is a direct fractal result of prior decisions by researchers and developers to not focus on anonymity and security as a primary requirement. The internet is a security nightmare, precisely because some researchers decided to ignore security requirements early on.
- jallmann 11y ago
  > This is why the mission of securing America's networks needs to be removed from the NSA. And who should be responsible for this mission? Are you saying that the offensive and defensive cyber capabilities should be split between different agencies? > “What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” The article mentions that the government itself acknowledges that there is a delicate balance between disclosure and maintaining the ability to accomplish other missions [1]. That dilemma never going away, no matter how the responsibilities are organized. > “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.” Haven't read the EFF paper yet (and I hold the EFF in high regard), but in the context of zero-days, that quote is a bit of a strawman. You don't burn zero-days by indiscriminately propagating exploits (eg, for mass surveillance), it would be found out pretty quickly. You tap cables and get NSLs for mass surveillance. Payloads attached to a zero-day would be used for more specific purposes, rather than slurping up data en masse. [1] https://www.whitehouse.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders...
T3RMINATED 11y ago
US Navy terrorists of the World and Defenders of the New World Order.
harkyns_castle 11y ago
Didn't foresee all this nonsense when I started to enjoy IT back in the younger days. Wish I didn't see it now either. What a mess. Long live the petrodollar and killing other humans for a fiat currency.
wahsd 11y ago
Just to be clear, this is not really the Navy as most of you think of it that is seeking this.
BuildTheRobots 11y ago
Site seems overloaded. Link for the lazy: https://web.archive.org/web/20150615233609/https://threatpost.com/us-navy-soliciting-zero-days/113308 https://web.archive.org/web/20150615233609/https://threatpos...
harkyns_castle 11y ago
Give it some more time, all dissenting posts will be greyed out hehe.
smegel 11y ago
I find it really strange the Navy is doing this. Does it actually have an intelligence wing capable of taking advantage of this? And if you thought the NSA was the cyber intelligence wing of the DoD, so did I.
- ethanbond 11y ago
  Considering the Navy (Naval Research Laboratory) built TOR...
- modoc 11y ago
  The ONI (Office of Naval Intelligence) is the US's OLDEST Intelligence agency, so yes.. :)
- dsl 11y ago
  What you are seeing is the so called "black budget" at work. Money is allocated for say, the NSA, to get 10 new exploits but the actual funds go to the Navy or Air Force who handle the procurement process. Sometimes the supplier doesn't even know who is receiving the final product.

82 points by mo 11y ago

deleted 11y ago

[deleted]

What exactly should we do with this information? It's clear there's a cyber war heating up. Between Stuxnet, the US gov's OPM getting hacked, kaspersky getting attacked, it's become pretty obvious. And since there's seemingly no need to declare such a war before doing it, it'll only get hotter. So what do we do? Is it time to just start running open-bsd? Should I just assume my systems won't be a casualty because it won't get that hot? Air gap the important part?

Zigurd 11y ago
It's the cyberwar equivalent of soliciting engineered microbes for which there is no vaccine or treatment. How long would anyone put up with that?
arca_vorago 11y ago
Don't you get it. The cyberwar isn't "heating up", what "cyberwar" exists has existed since the 90's. Yes technological pervasiveness is making vulnerabilities being taken advantage of hit larger swaths of devices, but that's not why you see the heating up of the arena. The real reason is that we need a new boogieman to justify the level of surveillance. The public, as deluded and propagandised as they are, is starting to get tired of the same ol terrorism argument, so this is the new communism/terrorism, etc. The point is that it's never about what they say it's about. It's about control. Inverted totalitarianism.
- harkyns_castle 11y ago
  Not just surveillance, we also need a reason to keep the war machine going. And there'll be demands for more money for national security after this. Ad infinitum until there's a revolt or some kind of political evolution in the states. That fiat cash will get tucked away by some established families and companies, revolving doors aplenty, and then a new threat will be invented/created when this one wears out. The Fed, or the people behind it, will sit back with their hands crossed on their fat, corrupt bellies and say, well, at least we'll enjoy the planet while we live. Screw the rest.
  - arca_vorago 11y ago
    You're right, but what really gets me is that the internet was supposed to be the great equalizer, revealing that the emperor had no clothes, but it's almost as if as the corruption becomes more apparent, the more they have to push it to stay on top of the proletariat. It's worrisome where this trend will end up.
    - harkyns_castle 11y ago
      Ultimately I guess it depends on whether you're optimistic about human nature, over time. I think we're seeing a gross abuse of it, esp. from the leaders of the US and the people pulling the strings. But, I'd like to think we improve over time, despite this kind of evil. And there is no doubt in my mind its an evil, perhaps not biblical, but a vast and greedy, sickening selfishness. Pity we won't be around to see it if and when it turns right, but time is a great healer. I don't think the level of greed we're seeing now can be turned around in a generation.
      - marincounty 11y ago
        Personally, I don't see much light at the end of the tunnel? This greed seems cool in some circles--which I can't comprehend. It is not cool in my world. I feel morality is lacking? I don't know how to install morality. I do know this "Just because it's legal, doesn't make it moral" said by a deceased friend of mine.
        harkyns_castle 11y ago
        Idk, but longer term I'd think a co-operative approach would make more sense, and stop destroying the planet for elfish short-term gains. Crazy idea though. Can't have anything compete with those beautiful oil, fracking, banking, warring people though - they mean well! I mean, its just short term, we'll just cut down all the forests, ruin all the topsoil, drill all the oil, frack all the rocks and lpg, and ... well, we don't care, go fuck yourselves, we made money, and we don't care about children or grandchildren. Cya.
        11y ago
- brador 11y ago
  Control for what purpose?
  - ta0967 11y ago
    for its own sake. for the thrill of being the top-dog, for the giggle of a nation of minions scared shitless into begging you to take more power so you can scare them more.
  - arca_vorago 11y ago
    Suppression of dissent primarily, which is why the internet is and will increasingly be under legislative attack. It has served as one of the last bastions of anarchistic freedom of thought, which threatens the powers that be. Said suppression only happens when you can reliably tie identities online to identities offline. Hence parallel construction, etc.
  - themeek 11y ago
    So many different purposes. Sometimes control is necessary for everyone's benefit - government has a legitimate claim to power. Sometimes control is self-interested - it does one party more good than it can do the other. Sometimes control is about a brace for an uncertain future - the American Empire right now is being seriously challenged for its global primacy. Sometimes control is about self-benefit - it consolidates power specifically to disadvantage the other power. Etc. Etc. Power consolidation right now is a mixed bag. Those who want power for their own purposes find a good partner with those who consolidate power for noble purposes find a good partner with those who brace for the future, etc. You can only pick voices from the cacophony if you train your ear in one direction. They are all there and it takes every singer in the chorus to work.
- justonepost 11y ago
  If by "has existed" you mean to say that there were people who attacked computers in the 90s, yes, that's technically correct. However - I think the parent post was trying to say rather than 100s of millions being spent worldwide on this, 100s of billions are now being spent.
  - themeek 11y ago
    By cyberwar he means that nation states were investing in state-of-the-art capabilities to use Computer Network Exploitation for the purposes of espionage and sabotage. This has been happening since the 90s. It is true that it has gotten consistently warmer on the internet. There is a term called "hybrid warfare" now that is being traded in the US defense sector. Hybrid warfare means assymetric capabilities in tandem with ground forces: IO (intelligence operations) with kinetic operations. IO itself is a broad category consisting of Military Deception (MILDEC), PSYOPS or Strategic Communication (propaganda operations), Electronic Warfare (to disrupt communication, coordination and execution), and Signals Collection for espionage (SIGINT). The US now considers hybrid warfare the norm and deploys IO operations with every kinetic force. In Syria this meant hacking their air force and grounding their planes - in Ukraine it means winning the 'idea war' in neutral territories and providing morale and information support to civilians and the military alike. Cyberwar continues to change, as does all war, with the advancement of technology, the capabilities of the parties, the state of the art, and the scale of conflicts. But we've had it now for a couple decades in one stage of evolution or another.
- themeek 11y ago
  The control is not always in the hue of totalitarianism or evil or malice. Some control is necessary of any government. Some control is perceived to be, but is not actually, necessary. Some control is self-interested and self-concerned. Some control is conspired by those who seek to wield it for their own benefit. When it comes to the US government, there's a big mix of the above and its never enough to establish one grand motive behind everything. This of course doesn't take away your point - it is about power. It's just that the angle on this power has to be negotiated circumstantially and available alternatives. (If there's an simple, cheap and effective way to solve a problem but a power consolidating method is chosen instead the mask has slipped).
- hellameta 11y ago
  Can someone "ELI5" this to me? How is it possible that in the Western world there is a collective 'they' that are doing this? It seems more reasonable that the behavior we dislike is emergent. Anyone working in even a medium-sized company knows that it couldn't possibly collude to get out of its own way. How is it that the US government can do it? Who is this magical 'they' we keep blaming and criticizing? Sorry if I'm being dense - sincerely trying to understand.
  - tw04 11y ago
    I dunno, AT&T had room 641a running for an awful long time. And when someone finally DID speak up, they were dismissed as a kook. I think you're greatly, GREATLY underestimating the amount of collusion that can and does occur.
    - hellameta 11y ago
      Thank you for your response. I don't disagree that there is collusion - I disagree that it is as effective as we give it credit for. Namely, that there is a systematic 'them' which is against 'us'. That the NSA can tap communication is to me an example of very small collusion. It's the level alluded to here that confuses me: >... a new boogieman to justify the level of surveillance... the point is that it's never about what they say it's about. It's about control. Inverted totalitarianism. Is there really this kind of 'collusion' going on? Is there a backroom where people say this with a straight face? I'm completely prepared to hear this is the case but I'm trying to find a reasonable explanation. It seems to me these people go home to their wives and kids at the end of the day just like the rest of us. To build this a little further. I toy with the idea that we ourselves are creating these mythical boogymen and THAT is what hurts our ability to change anything. I don't know :\
      - arca_vorago 11y ago
        I hesitated to respond because honestly, it's a dangerous question you are asking, and a truthful answer in the wrong place or time can be social and political suicide. I understand your view, and generally agree with your primary point that it's not a single overarching group in total control. The world of Machiavellian Realpolitik is much more nuanced and complex than that, and I mostly chalk it up to our tendency as humans seek to simplify things. First, I would like to point out that I consider Hanlon's razor a logical fallacy that should be relegated to the dustbin of debate. It is far too often used in the discussion of this matter. Now to your original question of who "they" is. In short, my conclusion is that it is primarily but not restricted to the supranational aristocratic elite, in particular the ones who desire global governance (at least on the surface). The most obvious example of this is the kinds of people who are C-level or board level who have positions across the world. A good primary jumping point for this would be the analysis of control networks in this very good paper: http://arxiv.org/pdf/1107.5728.pdf http://arxiv.org/pdf/1107.5728.pdf All that paper does though is show the level of interconnectedness, but what it doesn't show is intent. That wasn't your question though and is best left for another discussion. The bottom line to me is that "they" is the uber-wealthy, and that class-warfare and return of a type of neo-feudalism is right around the corner if not already here. If you want to know where the collusion happens, look to the round table groups; eg. the council on foreign relations, the bilderberg group, the trilateral commision, and various think-tanks, superpacs, and tax-exempt foundations, and yes, even secret societies. The main mistake though is to think they are all in on it or even understand it. That's not how control at a high level works. Imagine how control of a secretive org such as the CIA/NSA works. It's so wrapped up in compartmentalization that it's easy to take people who mean well and task them with something they don't understand the bigger picture implications of, and combine many of them to accomplish a big thing that none of them understand but a few key people at the top. I propose that the majority of "the key people at the top" are comprimised in some form or fashion, so even they are pawns in a game they don't fully understand... many simply want to make money or protect their reputations, though some are most definitely being blackmailed or threatened with much, much worse.
wahsd 11y ago
Sorry to break it to you, but air gapping is not really an impediment for a determined adversary.
- zaphar 11y ago
  Neither is paper only storage. But it's still going to make it harder for the adversary than being connected to the internet. Security is all about striking a balance between how hard you make it for the adversary vs how hard you make it for yourself. Even committing only to memory and never writing it down is not going to stop a committed enough adversary kidnapping and torture do exist after all. The only question is where do you want to draw the line.
sliverstorm 11y ago
It occurs to me that zero days are kind of like lethal force. We would really rather the government have none, but it must to deal with defense. It could be levied at us, but we usually believe it won't. Does that mean we need a Second Amendment for encryption?

themartorana 11y ago

$27.5m fixed bid for a 24 month contract. That's extremely good work if you can get it.

pmorici 11y ago
It doesn't say that. the number $27.5 million is the cut off for a business to be considered a "small business" which would receive special considerations under the law.
- themartorana 11y ago
  Ah. You're right. Thanks for that.
sailfast 11y ago
Does anyone have a link to the original solicitation?

tempodox 11y ago

Why not 0 seconds, instead of 0 days? I didn't think you can buy time anywhere, but why the gratuitous use of the “days” unit when the quantity is zero anyway? Still, a gov't agency would surely pay plenty, even for nothing at all, so what's the going rate for “no time at all” these days?

ugexe 11y ago
0 seconds sounds stupid and is being pedantic, especially as Wikipedia even says zero days are also referred to as 0 hours
- pjc50 11y ago
  "Zero hour" has a specific, different meaning though.
  - ugexe 11y ago
    https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing) A zero-day (also known as zero-hour or 0-day)
userbinator 11y ago
A "0day" is a noun. I still remember when it was commonly used to refer to warez releases, but now it seems it's been used to refer more to exploits... the times have changed. https://en.wikipedia.org/wiki/Zero-day_(computing) https://en.wikipedia.org/wiki/Zero-day_(computing)
aric 11y ago
Days convey immediacy and scale. "Today" and "same day" balance precision. If time between an exploit becoming known and fixed consistently happened in 100 seconds or less, 0-sec might sound ok. Come to think of it, 0-sec is a fitting pun.
- bentcorner 11y ago
  "0-sec" isn't too bad, but the plural can make for awkward conversation.

vaadu 11y ago

This is why the mission of securing America's networks needs to be removed from the NSA. “What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” wrote Nate Cardozo and Andrew Crocker of the Electronic Frontier Foundation. “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”

wahsd 11y ago
To be fair, they don't monitor whether the 0Day exploits are widely used so they have no idea when they should make them public for general security purposes. (yes, that's sarcasm) But the way the entities operate that are actually seeking these, is by thinking of themselves as outside of the regular set of rules and even reality. They are seeking 0Day exploits with an assumption that the individual or individuals that provide them will not sell them to someone else or even use them for themselves. I can guarantee that these "cyber wars" are going to result in some sort of cluster-fuck-up at some point because humans have a tendency to entrust the least responsible people with the most devastating technologies even remotely before we fully understand the ramifications. On a side note; please take note of the fact that many of the current issues regarding anonymity and security on the internet and in technology in general is a direct fractal result of prior decisions by researchers and developers to not focus on anonymity and security as a primary requirement. The internet is a security nightmare, precisely because some researchers decided to ignore security requirements early on.
jallmann 11y ago
> This is why the mission of securing America's networks needs to be removed from the NSA. And who should be responsible for this mission? Are you saying that the offensive and defensive cyber capabilities should be split between different agencies? > “What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” The article mentions that the government itself acknowledges that there is a delicate balance between disclosure and maintaining the ability to accomplish other missions [1]. That dilemma never going away, no matter how the responsibilities are organized. > “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.” Haven't read the EFF paper yet (and I hold the EFF in high regard), but in the context of zero-days, that quote is a bit of a strawman. You don't burn zero-days by indiscriminately propagating exploits (eg, for mass surveillance), it would be found out pretty quickly. You tap cables and get NSLs for mass surveillance. Payloads attached to a zero-day would be used for more specific purposes, rather than slurping up data en masse. [1] https://www.whitehouse.gov/blog/2014/04/28/heartbleed-understanding-when-we-disclose-cyber-vulnerabilities https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders...

T3RMINATED 11y ago

US Navy terrorists of the World and Defenders of the New World Order.

harkyns_castle 11y ago

Didn't foresee all this nonsense when I started to enjoy IT back in the younger days. Wish I didn't see it now either. What a mess. Long live the petrodollar and killing other humans for a fiat currency.

wahsd 11y ago

Just to be clear, this is not really the Navy as most of you think of it that is seeking this.

BuildTheRobots 11y ago

Site seems overloaded. Link for the lazy: https://web.archive.org/web/20150615233609/https://threatpost.com/us-navy-soliciting-zero-days/113308 https://web.archive.org/web/20150615233609/https://threatpos...

harkyns_castle 11y ago

Give it some more time, all dissenting posts will be greyed out hehe.

smegel 11y ago

I find it really strange the Navy is doing this. Does it actually have an intelligence wing capable of taking advantage of this? And if you thought the NSA was the cyber intelligence wing of the DoD, so did I.

ethanbond 11y ago
Considering the Navy (Naval Research Laboratory) built TOR...
modoc 11y ago
The ONI (Office of Naval Intelligence) is the US's OLDEST Intelligence agency, so yes.. :)
dsl 11y ago
What you are seeing is the so called "black budget" at work. Money is allocated for say, the NSA, to get 10 new exploits but the actual funds go to the Navy or Air Force who handle the procurement process. Sometimes the supplier doesn't even know who is receiving the final product.