Slashdot Mirror
NSA Director Says Agency Shares Most, But Not All, Bugs It Finds
Trailrunner7 writes: When the National Security Agency discovers a new vulnerability that looks like it might be of use in penetrating target networks, the agency considers a number of factors, including how popular the affected software is and where it's typically deployed, before deciding whether to share the new bug. The agency shares most of the bugs it finds, NSA Director Mike Rogers said, but not all of them.
Speaking at an event at Stanford University, Rogers said that the NSA has been told by President Barack Obama that the default decision should be to share information on new vulnerabilities "The president has been very specific to us in saying, look, the balance I want you to strike will be largely focused on when you find vulnerabilities, we're going to share them. By orders of magnitude, when we find new vulnerabilities, we share them," Rogers said.
Speaking at an event at Stanford University, Rogers said that the NSA has been told by President Barack Obama that the default decision should be to share information on new vulnerabilities "The president has been very specific to us in saying, look, the balance I want you to strike will be largely focused on when you find vulnerabilities, we're going to share them. By orders of magnitude, when we find new vulnerabilities, we share them," Rogers said.
It's nice to know they care.
That sounds good. Except for one tiny thing:
I DON'T BELIEVE YOU.
In addition, I'm fairly certain they have partnerships with major corps to "introduce" specific "vulnerabilities" into massively popular software.... like iOS and Windows.
"If any question why we died, Tell them because our fathers lied."
By orders of magnitude, when we find new vulnerabilities, we share them
Number is irrelevant compared to severity, and you can be damn sure they keep the severe ones to themselves.
Politicians.
In other news: "Most of our citizens are as free as in America, North Korea's supreme commander Kim Jon Un said, but not all of them."
except the one or two really useful ones that let us attack and gain access to any computer we want.
And why should we believe what Rogers says?
To what standard do you hold the US government as opposed to other governments? You can be damn sure that every other intelligence agency is doing exactly the same thing... but you're criticizing NSA why exactly?
My government protects me as I expect your government to protect you. Can't believe I'm going to do this... quoting blacklist quoting orwell, because i've certainly never read the mans essays myself, “Those who abjure violence can only do so by others committing violence on their behalf.”
I laughed at the Merkel spying thing... as if they didn't expect us to get as much information as possible, and as if we didn't expect them to return the favor. Faux outrage over common practices. IMO. If you don't want your leaders getting spied on... spend more money on your own agencies.
Honestly, why should we believe you this time? After all the lies, after breaking the law, after your mass data collections... What possible reason should we have to believe you?
So I assume all the deliberately introduced vulnerabilities are excluded from the tally because they technically "did not find them" ?
That's like saying most, but not all, chain links are made of steel. I'd still not want to rely on that chain.
Or would you want to buy a castle that has 3 well secured walls and one made out of plywood?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
"(TS//SI//REL) DEITYBOUNCE provides software application persistence on Dell PowerEdge servers by exploiting the motherboard BIOS and utilizing System Management Mode (SMM) to gain periodic execution while the Operating System loads."
"(TS//SI//REL) This technique supports multi-processor systems with RAID hardware and Microsoft Windows 2000, 2003, and XP. It currently targets Dell PowerEdge 1850/2850/1950/2950 RAID servers, using BIOS versions A02, A05, A06, 1.1.0, 1.2.0, or 1.3.7."
"(TS//SI//REL) Through remote access or interdiction, ARKSTREAM is used to reflash the BIOS on a target machine to implant DEITYBOUNCE and its payload (the implant installer). Implantation via interdiction may be accomplished by nontechnical operator through use of a USB thumb drive. Once implanted, DEITYBOUNCE's frequency of execution (dropping the payload) is configurable and will occur when the target machine powers on."
https://www.schneier.com/blog/archives/2014/01/nsa_exploit_of.html
So there was an explot on the BIOS of Dell Power Edge servers, and it allowed them to re-flash the bios with their own code, and they didn't disclose that, they kept it secret to use for themselves, and every semi-tech country like China and Russia to use, undermining Dell, one of the major US exporters.
Well f*** you, NSA.
Look at the lastest disclosure, GCHQ can spy on Americans via commercially obtained data and access to the NSA database, NSA must be aware of this and does nothing because GCHQ is in 5-eyes and so they get the data too. So regardless of how Congress and the Courts rules, NSA can bypass that decision.
What's happening within the NSA is they follow a cult, the cult of General Alexander, and so there is the laws of the USA, and the laws of the EU and there is the cult, and the cult trumps to the laws, and in doing so it trumps the democracy. The NSA and GCHQ staff need to get their shit together and think for themselves and realize they pose the biggest threat to the free world.
... when the NSA is lying to us?
A: Anytime their lips are moving.
No trees were killed in the making of this post; however, many trillions of electrons were horribly inconvenienced.
The condom stopped most, but not all of the sperm.
I don't care what people say-- Obama is doing a good job, especially when it comes to social issues.
The NSA sounds like a dirty prostitute.
That is all.
NSA is like an organization full of sick perverts who, had we not advanced to the technological point we have today, would be leering into strangers' windows to catch a glimpse of them naked.
The NSA has a dual mission of information assurance–protecting American networks–and signals intelligence–gathering electronic data on foreign networks.
Unfortunately for them, both American networks and foreign networks use the same software. So their mission is "make sure nobody can get in that safe, including you" and also "break into that safe." This is a no win situation.
They only report the bugs they find, not the ones they create.
In spite of unknown billions in funding they find fewer bugs than any of dozens of companies or OSS groups alone, and never any interesting bugs in highly technical specaities (e.g. cryptosystem implementation bugs)... so, we get to choose if we believe they are liars or ineffective and incompetent.
I believe them. Why, just the other day I got a very helpful email from the NSA suggesting that I fix a few spelling errors in my weekly status report before I send it to my manager. They've got my back.
Why should we believe this guy ? His predecessor and his boss have been caught lying more than once. They have a FILE ON EVERYBODY. "Just in case" - you might be a "problem" in one of their illegal wars in 10 years time, ya know.
Also, all three branches of the Armed Forces intend to "dominate cyberspace". What that means is that they want the ability to PENETRATE EVERY SINGLE CONNECTED SYSTEM.
They store the "full take" of Emails and SMSs FOREVER, but they claimed otherwise.
So - Liars.
They probably pass on the chaff and keep the juicy ones. But let me ask you this: If you had their brief, would you do anything different?
Its their job.
I wish they'd stop fucking with civilians but short of that... they can go hog wild with that crap.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
There shouldn't be just one organization with those two jobs. There should be an open, well-funded office in, say the National Institute for Standards and Technology that searches for vulnerabilities and has a responsible disclosure policy for everything it finds.
The Government has had this problem before - there used to be one body that handled both promotion and regulation of atomic energy in the US, the US Atomic Energy Commission. In 1974 it got broken up into two agencies, the Nuclear Regulatory Commission (the regulator) and the Energy Research and Development Administration (the promoter).
To a Lisp hacker, XML is S-expressions in drag.
The fact that a POTUS would even understand what a software vulnerability is speaks volumes.
I can't even imagine what this conversation would have sounded like with the two previous presidents.
He doesn't say.
Safe to assume he meant "share with other intelligence agencies", rather than "share with you"?
Ok, so what part of that* are you now not sharing with us?
* the answer to this question, vulnerabilities contained therein etc.
I was *the* man who took vulnerability reports for a massive software company. I received between 3 and 60 legitimate (sounding) vulnerability reports every day.
Exactly zero reports came from the NSA.
Unless they had a special back channel I didn't know about, they didn't report anything.
On the other hand, we do have evidence of US intelligence agencies exploiting our software in attacks. I suppose that's an indirect way to report vulnerabilities, right?
Your words are as empty as your soul. Mankind ill needs a savior such as you.
To what standard do you hold the US government as opposed to other governments?
A higher one. I expect better out of my government than that of any other in the world. Which includes not needing to spy on its' citizenry. And should include not needing to spy on others.
Yep, we will share it. With mossad.
Agreed! How can any reasonable person believe you?!
Create?! They cannot create bugs in software published and sold by others. Merely discover them. They can create hacks to discover and exploit bugs. A 'bug' is an inherent flaw in the application, usually an overlooked potential for trouble.
Bugs are for the most part bad ... and NSA is probably quite happy keeping us all on a path we feel is safe. If they left the bugs in, they would face a combinatorially expanding complexity of problems to solve.
"There is no god but allah" - well, they got it half right.