Slashdot Mirror
Hey CIA, You Held On To Security Flaw Information -- But Now It's Out. That's Not How It Should Work (eff.org)
Cindy Cohn, writing for EFF: The dark side of this story is that the documents confirm that the CIA holds on to security vulnerabilities in software and devices -- including Android phones, iPhones, and Samsung televisions -- that millions of people around the world rely on. The agency appears to have failed to accurately assess the risk of not disclosing vulnerabilities to responsible vendors and failed to follow even the limited Vulnerabilities Equities Process. As these leaks show, we're all made less safe by the CIA's decision to keep -- rather than ensure the patching of -- vulnerabilities. Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.
Is it the CIA's responsibility to point these out? How many "flaws" are intentional?
The NSA is supposed to help and disclose vulnerabilities to the US at the evry least, rather than exploit them. The CIA on the other hand has no such goal, and the sole reason to search vulnerabilities is to exploit them onto every other countries.
The CIA doesn't have the interest of the American public. They're used to committing illegal acts to get things done. Look up Iran Contra.
Right, so when the CIA/NSA/whatever, uses a vulnerability that gives them access to information -- that it is their reason for existing, they should immediately turn the vulnerability over to the device manufacturer so that they will patch it.
Because these agencies exist and are financed to perform vulnerability testing for Apple/Google/Microsoft/HP/Dell/ZTE/Huawei/etc!?!?
Methinks that anyone that can say "that's not how it should work" with a straight face can only be a lawyer, habituated to defining truth as "whatever best serves me/my client".
We cannot be appalled by the lies of people like Trump and at the same time accept it when people who are say that they are defending us from his and other deceptions are also lying to us.
EFF, this does not help as it only gives Trump et all more ammunition.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
nt
That some of the exploits they decided to hang onto, were actually malware code samples that would allow them to attribute attacks to foreign governments. When in fact they had nothing do to with said attack. In addition to this, they appear to have held onto exploits for vehicle control systems, that would allow them to ASSASSINATE people without detection. This is CERTAINLY NOT what they were hired to do. Not by any of the US citizens/agents that I know anyway. These are EXPOSED Black Ops Projects, by any other definition. Its time that someone unbiased investigated the CIA/NSA... They clearly are into some things they shouldn't be. Things that are CLEARLY ILLEGAL...
It looks to me like the list of CIA hacking tools is a list of vulnerabilities that we already knew about and have been discusssing since forever, and it's hardly just the CIA that's been taking advantage of the environment.
And it also looks like a list of vulnerabilities that the vendors all know about and we've all been complaining about.
Soooo why exactly should the CIA tell Apple "we have an evil app that intercepts messages before encryption" when Apple and everyone else who's been paying attention already knows about these apps. Should the CIA have meetings with every half-assed IOT vendor to tell them that their device is a POS and hiw the CIA takes advantage when we and they all know this already?
This is the EFF. Their minds dance forever in utopian fields of wildflowers.
http://www.news.com.au/finance...
So obsessed with the letter of the mission statement, that you forget its spirit. Subjects you were meant to serve become means, and disposable resources in achieving goals that no longer serve their purpose, as the cost outweighs benefits by way too much.
CIA was created to protect safety of USA citizens. It got specific goals and means by which it would serve in that mission, and focused on them so much the mission went entirely out of focus. Collateral damage is no longer considered an issue. No matter how much CIA hurts and weakens the USA, it considers the actions a success if the "enemy" (actual or potential) is weakened in the process.
It's silly to expect a spy agency to obey the law and play always fair. But whatever it does, no matter how nefarious and slimy, it should always put the good of its citizens first. And it's ridiculous to expect whatever they might have gained through holding to these exploits outweighs the losses of the public caused by the non-disclosure. CIA no longer serves USA. CIA just serves goals of CIA, and if means to these goals conflict with the good of USA, so be it, USA be damned.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.
The CIA's website says "CIA’s primary mission is to collect, analyze, evaluate, and disseminate foreign intelligence to the President and senior US government policymakers in making decisions relating to national security".
It seems pretty clear that they are focused on gathering information relating to US national security... it says nothing about protecting private individuals information. I can guess that they will claim to have weighed up the threat to private individuals vs the intelligence gathering advantages of not disclosing these vulnerabilities. I'm not saying I agree with this sentiment, but I don't think this exposes the CIA to the extent that the article suggests.
...Even spy agencies like the CIA have a responsibility to protect the security and privacy of Americans.
Section 202 of the National Security Act of 1947 established the CIA, and nowhere in the charter does it state it's their responsibility to protect the privacy of Americans.
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
It is the job of the CIA to collect intelligence. Central Intelligence Agency, right there in the name. It's not their job to post software patches.
I think what Cindy Cohn meant was "it would sure be nice if the CIA had let us know about the problems rather than keep them secret", and I agree that would have been awfully nice of them - but wanting the CIA to reveal tactical information that helps it do its job is silly.
They're a spy agency, folks. This is what spies do.
Weaselmancer
rediculous.
Their job is to stop Mohammed from blowing up your children.
It's a bit late for that, unless they also have time machines. The best way to prevent "Mohammed from blowing up your children" (and when did that last happen in the USA?) would have been to refrain from blowing up his children. And his wife, and his aunts and uncles and his parents and his friends. And his dog.
Unfortunately that carrier task force sailed decades ago.
I am sure that there are many other solipsists out there.
Try about 1400 years ago... A Few Questions for you... when was the last Cure invented by Muslims? The Last Surgical Procedure? The Last Great Piece of Technology? The Last Great Scientific Discovery? Then was the last time they lead a Humanitarian mission, to say, anywhere? When was the last time Israel, Iraq, Iran, Syria, Pakistan, or Afghanistan took in Refugees? When was the last Vaccine they invented? The last Nobel Prize? The Last Accomplishment in Space Travel? The Last Accomplishment in Women's Rights? Their Last Peace Accord? Their Last PUBLIC Admonishment Of The Muslim Brotherhood, Hamas, ISIS, the Taliban, the Rapes in Cologne, or ANY of the Recent Attrocities attributed to their people? Typically, I see them making excuses for Terrorists. nothing more. Show me their VALUE to society... I would TRULY like to see it. They invented Algebra about 2000 years ago. So that does NOT count. Show me what good they have done for the world LATELY. Last 1400 years or so. List their accomplishments. Lets hear it. :-)
Saddly I have to agree. While in those fields of wildflowers, the ideal humanity has nothing but love and respect for its fellow human, but as long as that ideal exists, countries will continue to need security organizations like the CIA to keep an eye on those that dno not share those ideals. Until the entire world unilaterally accepts one another and the common good, there is a need for a defensive stance and that stance cannot support the altruistic ideas that most of us would love to adopt.
All of that said, the EFF does an outstanding job working to hold non-defense organizations accountable to their conumers and the self imposed privacy rules that they claim to hold so near and dear. I just wish that they would pick their battles a bit better rather than trying to fight everyone at once.
Dissenter
"There is no knowledge that is not power."
"The dark side of this story is that the documents confirm that the CIA holds on to security vulnerabilities in software and devices -- including Android phones, iPhones, and Samsung televisions -- that millions of people around the world rely on."
This is EXACTLY what I would expect of them. This is how they gain their advantage.
No sane person would ever expect the CIA/NSA/FBI to announce that they found a security vulnerability. It would be like a burglar announcing to a home owner that he found an unlocked door.
Just cruising through this digital world at 33 1/3 rpm...
The Vulnerabilities Equities Process doesn't have a mandate to disclosure, merely to determine if they should disclose or keep it for use. The EFF explains it:
EFF filed a lawsuit under the Freedom of Information Act in 2014 to get access to the government's "Vulnerability Equities Process" (VEP), the policy it uses to decide whether to disclose information about security vulnerabilities or instead withhold this information for its own purposes, including law enforcement, intelligence collection, and "offensive" exploitation.
EFF v. NSA, ODNI - Vulnerabilities FOIA"
The EFF has a heavily redacted copy of the policy the key statement in there is "When a decision is made to disseminate..."
I'm a consultant - I convert gibberish into cash-flow.
Challenge accepted. In the last 10 years:
-Malala Yousafzai is a nobel peace prize winner and she is from pakistan. https://www.nobelprize.org/nob...
-Aziz Sancar was born and educated in turkey (difficult to tell whether he is of muslim faith or not, but he was probably at least raised in that culture) and is a chemistry nobel prize recipient.
-Maryam Mirzakhani was born and educated (up to bachelor) in Iran and received a Fields medal.
CIA is leasing them.
It is the same wink and nod that fouls poor Theo de Radt until he found where one of his co-developers contracted a vulnerability. I'm aware of one security firm that sells exploits top-dollar to agencies of government around the world and his personal team were at the forefront of DefCON wowing entrants:
lookup Gary Storer around either Redondo or Hermosa.
Dude, that's HORRIBLE! Somebody should invent UEFI so there would be a way to disable it in a UEFI configuration!
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
You are right. The CIA is NOT responsible for ones personal security. They are involved in NATIONAL security, which is related to personal security, but the two concepts are NOT the same thing.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Journalist Michael Hastings Was Investigating CIA Director John Brennan Before He Was Killed in Fiery Car Crash
http://www.news.com.au/finance...
Some of us have been saying that for a long time. I work in security in the auto industry. The vehicle Michael Hastings was driving has throttle-by-wire. The Mercedes C-class has a feature called ADAPTIVE BRAKE which sounds like it needs brake-by-wire. If you've got by-wire control of throttle and break, a sophisticated attacker (like the CIA or NSA) could mostly likely cause a crash like the Michael Hastings crash.
Yea, in the addled minds of some posters They think the following statement is true: National security == Personal security
Sorry folks, that evaluates to false...
The CIA is charged with protecting National Security by gathering intelligence on foreign targets. They are NOT charged with protecting individual's personal security though their protection of the nation does protect the individual in some ways.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
Looks like APK is off his meds again, or the institution let him on the internet. again.
Time to offend someone
It is the responsibility of US spy agencies not to violate the security and privacy of Americans; it is not their responsibility to fix security and privacy problems domestically.
You're probably confused because sometimes spy agencies say "in our operations, we protect the security and privacy of Americans", but that's in the same sense of "when we ship glass, we protect it from breaking", not "we protect all American glass from breaking ever".
God outsourced his job responsibilities to the CIA in order to give him more time to watch you masturbate.
I think watching people masturbate was outsourced to DHS and FBI at some point.
I wonder what god does now, with so much free time on his hands.
"we are all atheists about most of the gods that societies have ever believed in. Some of us just go one god further."
So they are guilty. The NSA are guilty. The FBI are guilty. The whole government is guilty. And all I see is a lot of people discussing it and no action taken.
If I as a kid stole a cookie and my mom told me of and I stole another one and still nothing happened, why would I stop stealing the cookies? They are great tasting cookies.
As long as there are no consequences, except for some whining, why would they NOT do it? You can discuss it among yourselves, but they do not care.
Don't fight for your country, if your country does not fight for you.
...intelligence documents? Just asking.
I have no problem with our intelligence agencies keeping tools and means to hack.
I DO HAVE a problem when they're used against American citizens and even used to murder them without a trial.
Our government should be doing everything it can to PROTECT us against China, Russia, etc. It should not be treating >us like antagonists to be targeted and crushed. It's time we stop treating our citizens like "criminals in the making".
The agency appears to have failed to accurately assess the risk of not disclosing vulnerabilities to responsible vendors and failed to follow even the limited Vulnerabilities Equities Process.
This is the same group of idiots that are largely responsible for polio still being around (citation below). Failing to accurately assess risk and shortsighted thinking are nothing new to these folks.
Citation:
https://www.scientificamerican...
Seriously does anyone take EFF seriously ? Put on your big boy pants and learn how the real world works, no one in government is in computer security for altruistic reasons and gives 2 shits about making other people more secure, they just want information to give them more power.
And yet you seem to be able to prove my point time and time again with your delusions, non-sequiturs, circular arguments, incoherent ravings, and general paranoia. Although I should have know it wasn't you who made that post even though the author does a pretty good job of copying your /. style as you do claim credit for your mad ravings. It is also rather entertaining to bait you and then just stop responding once the rise has been gotten like I am going to do now.
Time to offend someone
If you think that coming up with ways to assassinate people is worthy work, then your mind is warped.
Oh, so you wouldn't have assassinated Hitler, given the chance? We could have saved a lot of grief had it been possible to assassinate Saddam Hussein rather than drive in there and drag him out of his spider hole in person.
Socialism: a lie told by totalitarians and believed by fools.
But slashdot being infested by merkins mostly describes the problems of the USA from a USA centric perspective. Go to WL and look up the document releases. And you will find one for Russia or China quite easily. Ergo, the answer to your petulant whinge is "They do, you just never bother to remember"
You'd have to physically modify the car to kill someone in anything other than a sudden lane switch into an oncoming car.
What evidence do you have that physical access would be required?
This is a The Mercedes C-class with a cellular modem built into it with full access to the CAN bus and by-wire system.
That's like claiming an Internet connected server absolutely requires physical access to break into, a claim that has been proven false time and time again.
Every other scenario in a pure software hack setting is defeated by putting the car into neutral and pulling the parking brake. The electronic systems control neither of those things.
The electronic control system absolutely has control over the breaks. It must, since the peddle is nothing but a switch and the breaks are controlled electronically. It would be impossible to apply the breaks and stop without the electronic control system.
The same is true for the accelerator, and the transmission controller.
Being physically in the car it would be impossible to put the transmission in neutral once the computer was instructed to ignore the input channel from the gear shift switches, and it would be impossible to break once the computer was instructed to ignore the input channel for the break peddle.
Even steering can be by-wire. I don't personally know if the C-class uses that or not, but there is no reason to make any assumptions either way.
By-wire and physical shaft steering are both things that exist and that Mercedes can choose which to avail themselves of.
If its a false flag then no children were harmed.
See my subject Bob the Super WEASEL behind a FAKE NAME online for your FAKE LIFE sockpuppet that you are w/ no balls:
I'm pretty sure we all knew "Bob the Super Hamster" wasn't actually his real name. Just sayin'
Socialism: a lie told by totalitarians and believed by fools.
Er, how does any of that justify blowing them up?
I am sure that there are many other solipsists out there.
Challenge accepted.
And you therefore lose. You have accepted a challenge to debate an irrelevant, orthogonal issue. Whether it is right to kill Muslims wholesale does not depend on how many gadgets they invent or how many Nobel Prizes they win.
Best not feed the trolls.
I am sure that there are many other solipsists out there.
Three. The first of which is worthless.
Was that the best you could do?
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
Whoosh!!!
Dear The Hoi Polloi,
We'll do what we want. What are you going to do about it?
Yours (up the a$$),
The CIA.
2.... in 1400 years. Do you actually consider this a societal accomplishment? LOLOLOL