Slashdot Mirror
NSA Uses Vulnerabilities Before It Discloses Them, Keeps Some To Itself (reuters.com)
An anonymous reader writes: The NSA, perhaps seeking to repair its reputation, has started talking about how it handles vulnerabilities in computer software. But in doing so, they've only confirmed their own questionable behavior. The agency says it discloses zero-day flaws about 91% of the time. This means, of course, that they hold back about 9% of the flaws for their own use. They also don't mention when they disclose these flaws — which is damning, given statements from several current and former government officials indicating the NSA frequently waits and takes advantage of the vulnerabilities before notifying the companies who make the compromised software. This is the NSA's argument: "[T]here are legitimate pros and cons to the decision to disclose vulnerabilities, and the trade-offs between prompt disclosure and withholding knowledge of some vulnerabilities for a limited time can have significant consequences. Disclosing a vulnerability can mean that we forgo an opportunity to collect crucial foreign intelligence that could thwart a terrorist attack, stop the theft of our nation's intellectual property, or discover even more dangerous vulnerabilities that are being used to exploit our networks."
You want to keep some vulnerabilities for yourself just in case. You never know what will happen in the future.
I am a US citizen as frustrated about unauthorized domestic surveillance as anyone. But this summary goes too far. Finding, keeping and using vulnerabilities is exactly what the NSA is supposed to do, and there is nothing questionable about that behavior.
If the submitter wants the government to have a group that finds and discloses vulnerabilities as part of its remit, then make a case for creating such a group. Don't saddle the NSA with the job.
Questionable perhaps, but the article also provides a pretty good answer by mentioning Stuxnet, which was used to halt Iran's enrichment of uranium. Surely being able to stop what's at best an oppressive theocracy from obtaining nuclear weapons with no casualties or collateral damage has some value?
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Spies use privacy vulnerabilities
Are we going to publicly announce that soldiers kill people next? Perhaps someone thinks it is noteworthy that a bank charges interest on loans! Or that boxers HIT each other.
excitingthingstodo.blogspot.com
Here is the NSA's claim.
"Disclosing a vulnerability can mean that we forgo an opportunity to collect crucial foreign intelligence that could thwart a terrorist attack, stop the theft of our nation's intellectual property, or discover even more dangerous vulnerabilities that are being used to exploit our networks."
a. The Terrorists. The Terrorists. Terrorism has been used by thugs throughout history to justify violations of rights. The TARGETED and use Intelligence in self-defense, on case-by-case basis lawfully approved, is justified and important to security. Even police sometimes need to do this to catch criminals. Mass indiscriminate surveillance of the global population, including violating personal data stores that are supposed to be our private property, is a violation of human rights. The number one violators of the right to privacy in world today seems to be the NSA.
b. How NSA ""Stop the theft of intellectual property" by not disclosing vulnerability? If follows if the NSA finds one so can someone else!
c. What good is the NSA's claim they "discover even more dangerous vulnerabilities that are being used to exploit our networks" when they don't disclose some of them? This is like arguing I disclosed an SQL injection vulnerability but didn't disclose an XSS one. Do hackers and those with malicious intent care what specific vulnterabilities they use to get into systems or is the objective getting into the system?
The fundamental problem though isn't the NSA. The real problem is the megalomaniacs that have encouraging and funding the anything-goes culture of the NSA. This would include both Bush AND Obama.. both Democrats and Republicans. This is one of those rare situations where the issue isn't partisan. Both members of the left and right have been supporting this overarching spying.
Thus those that claim to care about freedom, need to start calling out not only the other guys politicians but their own over this issue too.
Many feel a sense of hostility for the NSA out of control snoopying but the reality
If the police failed to act on information a rape or murder was planned because they wanted to catch the perpetrator in the act, there would be outcry. You don't jeopardize the safety of the innocent to assail the (potentially) guilty. Collecting foreign intelligence is not more important than heading off immediate threats to domestic citizens. Clearly the NSA views it as all about "catching the bad guy" and has forgotten the reason the bad guys are considered bad. It's like SWAT leaving a bomb in a public building because, "Hey, maybe we could trip it when the bad guys get back."
When things get complex, multiply by the complex conjugate.
If so, why?
They are an intelligence agency. You'd EXPECT that they would hold onto some method to do their job, which absolutely involves electronic infiltration. This is neither controversial nor unexpected.
Don't mistake the fact that they reach out to industry to improve everyone's (worldwide) security most of the time, for that being their primary mission or charge. That's a nice bonus.
If you want to get worked up, get angry about the same shit Snowden did- the possible indiscriminate spying against US citizens, and the idea that they only way that the government can do its job is by casting a worldwide net that monitors everyone everewhere all the time. Not that they can hack systems, which is a huge part of why they fucking exist.
What do you think the NSA is for??? Free government funded penetration testing and reporting service? Sheesh.
Better known as 318230.
The NSA is a security service. Having tools to break and enter into the communication and data storage of potential enemies of the state is their business. That's what they do. Their whole reason to exist, to be blunt. If they can't do that, well, they can as well not exist at all. Which would not be beneficial for the US, in general, because, well, their enemies sure as fuck won't do away their version of the NSA. You'd deprive yourself of a valuable tool in international espionage.
What something like this needs, and what is sorely lacking today, is oversight. You needn't take away such powerful tools. You need to ensure they are not being abused. That's the real problem here.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The surprise is that they disclose so many. Invasion into personal privacy is only collateral damage at the moment, whilst there are relatively sane governments in power. Things might change in the future.
[T]here are legitimate pros and cons to the decision
No there are not. There is only the LAW. The decision has already been made, ratified and written down. It's not up to some bureaucrat to make things up as he goes along. Governments are compelled to act within the bounds set by law. When they stop doing this, they are no longer law abiding nations and lose the right to enforce law on the people.
Seven puppies were harmed during the making of this post.
I love the USA. I just wish we didn't feel the need to promote malware vectors instead of patch them. I try and keep my Windows computers off the Internet anymore since there are so many viruses you can get just by clicking a wrong link. You don't even need to run a file anymore to get a virus. Things are pretty bad now. I wonder if things will get worse or better for computer security.
God spoke to me
Many, many times in my career I have found some vunerability and delayed disclosing it while enjoying it myself. I found a wonderful way of spiriting - nay, liberating - electronic components out of work that would have found their way into a dumpster. I found a way of accessing peoples' accounts on TSO and VM; I found ways of resetting the prepayment cards for lunch at work. I've keylogged PCs; I have tcpdumped and etherealed to find passwords to gain access to systems. I used I don't know how many exploits to get free Sky TV. I installed an FM transmitter in my manager's office about that time of year when salary plans were being discussed. I've picked many locks. I've used Apache and other exploits to break into systems where admins had long before forgotten root passwords. Not everything I have done has been legal. It's all contributed to me being who I am today, and having the skill set that I rely on to do my job.
If I think about it, I can't expect any different from the NSA. If they are going to learn the skills that they need to do their jobs, they do need to flex their muscles. We do need to have some level of trust in the agencies that have been put into place to protect our citizens.
Such entities are not running on morality. By definition no group of people, unless governed explicitly by some moral codex, will waste a nanosecond pondering the moral implications.
For reference, see corporation.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
A secretive, clandestine spy agency does secretive, clandestine things and has no scruples. Mmm... what a surprise! The thing we should really be complaining about is that they claim to have effective oversight and act within the law.
This reminds me of an idiot who went on a zero day, full disclosure forum, advocating that they should "hold the best stuff back" so that they "look like gods" to the next, upcoming generation of hackers.
Let's just say that this silly jackass was laughed off the board, and is now enjoying his second stint in FPMITAP for unoriginal idiocy with a computer.
So the NSA is at the same basic intellectual (for lack of a better term) level...
Sigh.
Chas - The one, the only.
THANK GOD!!!
I didn't think I would ever see another article with the proper use of the term zero-day. I expect when the NSA talks about zero-day they get the terminology right. An exploit the NSA discovers and doesn't use isn't a zero day until someone else start using it. Exploits they buy are most likely zero-day. Bugs found and reported to vendors but not used aren't zero-day if a patch arrives before an exploit. A real trick is knowing if a new exploit is being used and I think it is clear that the spooks might have an advantage in detecting that sort of thing.
English: Disclosing a vulnerability can mean we forgo an opportunity to use the power of the state to spy on innocent people for no reason, crush legitimate political dissent, blackmail political figures to make them our puppets, engage in economic espionage that puts vast sums in the coffers of political insiders, interfere with foreign governments both friend and foe, cover up our vast incompetence, avoid the consequence of our bad decisions, and interferes with our degenerate addiction to unencumbered personal power that makes use feel superior to everyone else on the planet.
Why is Snark Required?
Golly. I could have not read "Data and Goliath" and learned *one* of the appalling truths in it from Slashdot only a few wees later.
There's no time like the present. Well, the past used to be.
The only surprising thing about this would be if anyone were surprised!
And if that depressing insight is moderated as flamebait rather than insightful, perhaps I should consider that as confirmation. It's been a good run and my karma indicates that I will be missed; perhaps more than some of you realize.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.