Slashdot Mirror

← Back to Stories (view on slashdot.org)

NSA Bought Exploit Service From VUPEN

Posted by Soulskill on from the they-get-by-with-a-little-help-from-vupen dept.

New submitter Reverand Dave writes "The U.S. government – particularly the National Security Agency – is often regarded as having advanced offensive cybersecurity capabilities. But that doesn't mean that they're above bringing in a little outside help when it's needed. A newly public contract shows that the NSA last year bought a subscription to the zero-day service sold by French security firm VUPEN. The contract, made public through a Freedom of Information Act request by MuckRock, an open government project that publishes a variety of such documents, shows that the NSA bought VUPEN's services on Sept. 14, 2012. The NSA contract is for a one-year subscription to the company's 'binary analysis and exploits service.'"

5 of 81 comments (clear)

  1. The truth gets out... by CajunArson · · Score: 5, Interesting

    It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.

    --
    AntiFA: An abbreviation for Anti First Amendment.
    1. Re:The truth gets out... by khasim · · Score: 4, Interesting

      This is a SECURITY firm, not a backroom russian exploits dealer, ...

      Bullshit.

      From TFA:

      VUPEN is one of a handful of companies that sell software exploits and vulnerability details.

      Just because they're French instead of Russian does not change the fact that they're selling exploits.

    2. Re:The truth gets out... by Virtucon · · Score: 4, Interesting

      VUPEN sells access to their vulnerabilities on a sliding scale and It's well known that governments buy services from them. That's not news, but for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems. It would seem to me money well spent if they did and at least closed up these holes or made VUPEN's job harder, making it tougher for these data stealing, scum sucking government agencies breaking into everything and anything.

      --
      Harrison's Postulate - "For every action there is an equal and opposite criticism"
  2. Good by the+eric+conspiracy · · Score: 3, Interesting

    I paid a visit to Northern Va a few weeks ago. The place was crawling with construction projects and high end malls.

    That I am paying for.

    Using Vupen actually sounds like a fairly efficient use of taxpayer money.

  3. So they don't by them AS THEMSELVES. by Ungrounded+Lightning · · Score: 3, Interesting

    for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems

    I would assume that VUPEN would refuse to sell to Microsoft and Cisco on account of it diminishing the value of the zero-days they're holding.

    Or at least not sell them the best stuff.

    Obviously, if Cisco, Microsoft, etc. were going to buy this service, they wouldn't do it (only) as themselves, acting directly. They'd do it through a front, to insure they got the same things the bad guys were getting.

    Just as a startup did, about a decade ago, when I was designing a next-generation routing chip, and we needed to obtain equipment from Cisco for testing it for function and compatibility.

    It took two half-rack, 3/4 megabuck, top-of-the-line Cisco routers to drive it properly. We bought them through another company on a very hush-hush basis, just to be sure Cisco wouldn't be tempted to send us defective or gimmicked equipment, not support it properly, or hold up shipment and slip our schedule.

    --
    Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way