Slashdot Mirror
US Navy Solicits Zero Days
msm1267 writes: The US Navy posted a RFP, which has since removed from FedBizOpps.gov, soliciting contractors to share vulnerability intelligence and develop zero day exploits for most of the leading commercial IT software vendors. The Navy said it was looking for vulnerabilities, exploit reports and operational exploit binaries for commercial software, including but not limited to Microsoft, Adobe, [Oracle] Java, EMC, Novell, IBM, Android, Apple, Cisco IOS, Linksys WRT and Linux, among others. The RFP seemed to indicate that the Navy was not only looking for offensive capabilities, but also wanted use the exploits to test internal defenses.The request, however, does require the contractor to develop exploits for future released CVEs. "Binaries must support configurable, custom, and/or government owned/provided payloads and suppress known network signatures from proof of concept code that may be found in the wild," the RFP said.
So much for post-911 interagency cooperation. While one agency is inserting weaknesses, another is having to buy then on the open market. Though the Navy approach is probably cheaper.
1. Get government to create a security rating (required for government contracts) that requires software audit reports.
2. Have companies submit reports to you as part of the process.
3. Charge companies for the security rating and reviewing their reports.
4. Profit AND build a repository of zero-days.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
does every agency and division of the military need to do this? Seems like the classic not invented here syndrome and a colossal waste of tax payer money.
Little is more Orwellian among our government's many exploits than its attempts to break into our computer systems.
The ever-present security camera? That's bad, but it's still out in public. It's on the street, maybe in the stores. They're not in your home, not yet. Rubber stamp warrants? That's worse: It allows targeted invasions of privacy. But at least it requires a the resources of a human with a paycheck and his own sense of morals. But breaking into computer systems? They're in our pockets, in our homes, and have access to every bit of our modern lives. From shopping lists to love letters to medicine prescriptions they contain whole lives. Snippets from every trip you've taken are encoded there.
And a program doesn't have a sense of right and wrong. It will never refuse to spy on ethical grounds. It won't bring things up to the attention of oversight committees. It won't make anonymous calls to the ethics line. It won't refuse to work, leak information, or demand orders in writing. A program will quietly do as its told, wherever it can. Above all prying surveillance I believe ubiquitous IT access by the government needs to be contained.
If video games influenced behavior the Pac Man generation would be eating pills and running away from their problems.
no. not that.
My first thought was why in the world would the navy want these capabilities, but then I remembered reading a story here that discussed the use of windows NT to run a ship. I suppose the navy is looking for the ability to take out opponent ships control computers?
How many years it officially took the hackers to stumble across the existence of the embedded NSA backdoor inside MS Windows??
Way before the news of that 'discovery' was told to the world, a friend of mine found it, but was told to 'shut up or else' by his then boss
Apparently they (and many other people) already knew about it for quite a while, but none of them bother to tell the world about it
Muchas Gracias, Señor Edward Snowden !
...respond to government requests for zero-days, whether official or unofficial.
Find a zero day and report it to someone who might fix it, that is criminal. Find a zero day and report it to the navy, you've done a service for your country. There is a unfortunate disconnect when the things the government does in the name of keeping us safe, end up making us all decidedly less safe in the end.
You cant disadvantage foreign companies/intelligence agencies by creating new rules, without them suing you under the new proposed trade treaties.
I would have made $x but you changed the rules, pay up!!
If they want to keep their business going internationally, they'd better not give them anything without a fight. Especially now considering that Snowden's leaks made a lot of people, both inside and outside the US, wary of US made software / hardware.
Actually, I wonder why they would want to post such a thing to begin with? The best thing for them (the US) would be to give lip service to reforms while moving and re-securing their espionage activities out of the public eye. By posting this request to the web, they are effectively giving everyone inside and outside the US more proof that the US is not their friend / ally / etc. when it comes to technology, and that anyone and everyone, regardless of where they are, should avoid US technology products and services AT ALL COSTS. "US technology is ABSOLUTELY NOT TRUSTWORTHY AT ALL, it is ALL co-opted by us for our own purposes, and WE WILL USE IT TO OUR ADVANTAGE, we don't care if you know about it or not." That is what the US is saying with this post, and it will come back to bite them when other countries come in to capitalize on the untrustworthiness of the US and seek to replace them.
The sad thing is as a result, the US will utterly destroy it's technology sector and any influence over international technology development and manufacturing it had. It's my opinion, but I foresee future layoffs and more unemployment for US technology workers, as the bad behavior of the US government causes increasing international mandates for any serious development effort to occur completely outside of the US and it's jurisdiction as a security measure.
The navy has been doing signals intelligence for a hundred years or so. Ships do two interesting things - they communicate with their allied forces via radio using giant antennae, and they loiter close to enemy territory, and therefore enemy communications. It's only natural that they would point their large antennae at the enemy, and they've been doing so since just after radio was invented.
The navy also legitimately brings large numbers of personnel into foreign ports on a regular basis. It's only natural to give some of those sailors varying degrees of training in keeping your eyes and ears open while on foreign soil. Thus, the Office of Naval Intelligence has long been a significant part of our foreign intelligence capability.
The navy has been doing signals intelligence for a very long time. Ships communicate with their allied forces via radio using giant antennae, and they loiter close to enemy territory, and therefore enemy communications. It's only natural that they would point their large antennae at the enemy, and they've been doing so since just after radio was invented.
The navy also legitimately brings large numbers of personnel into foreign ports on a regular basis. It's only natural to give some of those sailors varying degrees of training in keeping your eyes and ears open while on foreign soil. Thus, the Office of Naval Intelligence has long been a significant part of our foreign intelligence capability.
Are they also soliciting attack vectors for SCO, VMS, BeOS & CP/M?
never drink kool-aid from a big vat