Slashdot Mirror
GCHQ Has Disclosed Over 20 Vulnerabilities This Year (vice.com)
Joseph Cox, reporting for Motherboard: Earlier this week, it emerged that a section of Government Communications Headquarters (GCHQ), the UK's signal intelligence agency, had disclosed a serious vulnerability in Firefox to Mozilla. Now, GCHQ has said it helped fix nearly two dozen individual vulnerabilities in the past few months, including in highly popular pieces of software like iOS. "So far in 2016 GCHQ/CESG has disclosed more than 20 vulnerabilities across a number of software products," a GCHQ spokesperson told Motherboard in an email. CESG, or the National Technical Authority for Information Assurance, is the information security wing of GCHQ. Those issues include a kernel vulnerability in OS X El Captain v10.11.4, the latest version, that would allow arbitrary code execution, and two in iOS 9.3, one of which would have done largely the same thing, and the other could have let an application launch a denial of service attack.
enough to set them free!
gchq is doing, at a cost of billions for taxpayers, what many security researchers are doing for free.
leave it for british to be that stupid.
Have the Firefox devs fixed Australis yet? As I understand it, Australis is the name of the bug that has resulted in Firefox's UI becoming unusable. It is trendy for bugs to have their own names these days, like Shellshock and Heartbleed. In any case, this Australis bug has ruined Firefox for me, which is why I'm using Vivaldi these days. I'd try this Pale Moon browser that people have been talking about, but it doesn't support OS X as far as I can tell, so it is useless to me.
I actually find that a government agency letting software developers know of vulnerabilities is actually refreshing. Sure, they probably exploited those same vulnerabilities but at least we'll get them out in the open so they can be addressed.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
Meanwhile the NSA get billions of tax payer money to discover vulnerabilities then use them against citizens.
Leave it to the americans to be that stupid.
Those security researchers are idiots if they are finding bugs for free.
"GCHQ Has Disclosed Over 20 Vulnerabilities This Year"
How many have they kept for their own use?
So how many did they find not disclose?
gchq is doing, at a cost of billions for taxpayers, what many security researchers are doing for free.
leave it for british to be that stupid.
It's a by product of what they do. You do realize they have other things to do? In short, are you a troll, or, shall we say, a bit slow? Or both of course.
Or maybe they are disclosing vulnerabilities that they discover foreign intelligence services are using.
And if they didn't reveal anything we'd be pecking away at their rotten corpse for hording an undisclosed amount of exploits.
Victory is impossible.
Democracy in Britain is mostly a sham. Oligarchy's would be a better description of what's actually happening. Security organizations like the GHCQ (and NSA) don't exist to protect the British public. They exist to protect the interests of the establishment. This is precisely why Cameron argues we need the GCHQ to gather Yahoo naked web cam images for "security" but then is morally outraged when someone else discloses his offshore tax haven fiances!
Mass surveillance gives the establishment the power of selective disclosures. What better way to assassinate a political opponent than by discrediting them though intelligence derived character assignation? I'm sure the GCHQ could have figured out Cameron inappropriately uses tax shelters but wasn't remotely interested in defending the average British taxpayer from that.
Bug bounties, steady government pay for university researchers, systematic search for exploits for intelligence work, training and internship for students, private "security" companies, reputation from the community for future employment, feel good factor for helping the humanity. No, nobody is doing it for free.
It's GCHQ's job not only to gather intelligence (SIGINT) but also to protect the UK from cyber spying. Given that most of this is coming from China, I'd be a little more circumspect if I were you.
mod parent up
They should have the right to exploit a security hole for spying ONLY if it's in a foreign product and not used on national soil.
Non-Linux Penguins ?
They probably just publish the list of obsolete backdoors they sneaked into the code base earlier. Meanwhile using later, unpublished exploits to spy on you and me.
So let me guess, when say, Russia, or China, is know to have discovered a vulnerability and using it in the wild, they burn the bridge by "being nice" publicly?
nah no offense taken as we know American ARE that stupid to begin with.
Don't worry, I'm sure GCHQ keeps the best ones to itself, and always checks with the NSA to make sure they aren't releasing any that their parent company is using.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC