Slashdot Mirror
NSA Bought Exploit Service From VUPEN
New submitter Reverand Dave writes "The U.S. government – particularly the National Security Agency – is often regarded as having advanced offensive cybersecurity capabilities. But that doesn't mean that they're above bringing in a little outside help when it's needed. A newly public contract shows that the NSA last year bought a subscription to the zero-day service sold by French security firm VUPEN. The contract, made public through a Freedom of Information Act request by MuckRock, an open government project that publishes a variety of such documents, shows that the NSA bought VUPEN's services on Sept. 14, 2012. The NSA contract is for a one-year subscription to the company's 'binary analysis and exploits service.'"
It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.
AntiFA: An abbreviation for Anti First Amendment.
Trust your government. That's what they meant by "trusted computing".
Seven puppies were harmed during the making of this post.
The NSA needs to know when the back doors it has built are uncovered. So it probably subscribes to a number of software security services that look for such stuff.
Have gnu, will travel.
This is similar to being surprised that the NSA monitors money changing hands across the border. Not news. Obvious. Not a scandal.
Cloudiot: A person who does not see offsite storage as a way to lose control over access to his or her own data.
No one has that responsibility. US Cybercom doesn't have it, nor does DHS. It's a known gap in our defensive posture. US businesses have resisted any attempts from the gov to regulate their cyber security. No one wants the gummint coming in and telling them how to set up and maintain their networks. And critical infrastructure, like power and other utilities, have likewise resisted any attempts at regulation, even though they are all hooked up to the internet with little thought to security. So, the current situation is we have little cyber security as a nation, and no one is responsible for it.
Tic-Tac-Toe, Global Thermonuclear War, and relationships all have the same winning move.
Of course they buy exploits. Why wouldn't they? I would be somewhat surprised if they didn't leverage every available tool..
Does that make them "freedom exploits"?
10 ?"Hello World" life was simple then
...they are all hooked up to the internet with little thought to security.
Citation and motivation, please.
Prove anything by multiplying Huge Number times Tiny Number
If you are in a business you want to see what your competition are doing, especially if its just a matter of subscribing...
---- Booth was a patriot ----
We finally found the NSA mentioned in the same sentence as an actual, tangible, external threat. And now we see that instead of attacking them, they are giving them money?!? How can they get confused on this? You ATTACK enemies. You HELP friends.
The Exploit marketplace (here symbolized by VUPEN) is possibly the greatest threat to to existence of the internet. You can fight mistakes. You can fight attackers. But it is almost impossible to fight economics. The exploit market is creating an economy that creates and enables exploit. It is a great driving force reconfiguring the Internet for Attack, instead of Defense.
VUPEN is a worthy opponent. The NSA should hack them front, back and center. They should never pat them on the head and give them money.
It looks like the Exploit Marketplace was dreamed up, founded and sustained by the NSA. The leaked Black Budget showed that the NSA devotes huge resources to purchasing exploit. We have also learned that the NSA's budget included vast resources to create exploit:
"The NSA spends $250m a year on a program which, among other goals, works with technology companies to 'covertly influence' their product designs." (From last weeks New York Times and Guardian articles)
So, the NSA creates exploit in everything they can influence. And they can influence almost everything. The NSA purchases exploit. Many times, they must be purchasing info on the exploits that they created. They preserve exploit. They mask everything in secrecy. And it all enhances the exploit marketplace. The NSA is no longer debating the Equities issue (https://www.schneier.com/blog/archives/2008/05/dualuse_technol_1.html ) They have only token interest in defending the Internet.
If we could just get the NSA out of the exploit market, the whole thing would probably collapse like 2008's Housing bubble.
That would be the NSA
http://www.archives.gov/federal-register/codification/executive-order/12333.html
I paid a visit to Northern Va a few weeks ago. The place was crawling with construction projects and high end malls.
That I am paying for.
Using Vupen actually sounds like a fairly efficient use of taxpayer money.
That way they cut out the middleman and get right to the motherload of personal information taken from people without their consent.
I'm not happy with a lot of the stuff the NSA does but this kind of statement ignores the realities of an ugly world. You act as if all we had to do was just ignore the fact that there are people out there that for whatever reason want to infiltrate and attack the USA. Truly in a perfect world we wouldn't need something like the NSA but alas we have to deal with what we have. If a lot of it seems like "the end justifies the means," well that is what it is. In a world with nuclear weapons and serin gas to be totally pacifistic means to be vulnerable to everyone out there and they aren't all nice people. I can't understand why people are surprised that an agency whose entire purpose it to spy, spies on people. It's what they are.
Part of the NSA's mission is ensuring our cybersecurity. Obviously they're doing exactly the opposite of that.
for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems
I would assume that VUPEN would refuse to sell to Microsoft and Cisco on account of it diminishing the value of the zero-days they're holding.
Or at least not sell them the best stuff.
Obviously, if Cisco, Microsoft, etc. were going to buy this service, they wouldn't do it (only) as themselves, acting directly. They'd do it through a front, to insure they got the same things the bad guys were getting.
Just as a startup did, about a decade ago, when I was designing a next-generation routing chip, and we needed to obtain equipment from Cisco for testing it for function and compatibility.
It took two half-rack, 3/4 megabuck, top-of-the-line Cisco routers to drive it properly. We bought them through another company on a very hush-hush basis, just to be sure Cisco wouldn't be tempted to send us defective or gimmicked equipment, not support it properly, or hold up shipment and slip our schedule.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
So they can have task look like it was done by some code sold to 'publicly' with a well hidden trail back to some other group.
The US gov gets what it needs and blame floats around as a press report for years.
Domestic spying is now "Benign Information Gathering"