Slashdot Mirror
Hacks Raise Fear Over NSA's Hold on Cyberweapons (nytimes.com)
Nicole Perlroth, and David Sanger, writing for The New York Times: Twice in the past month, National Security Agency cyberweapons stolen from its arsenal have been turned against two very different partners of the United States -- Britain and Ukraine. The N.S.A. has kept quiet, not acknowledging its role in developing the weapons (alternative source). White House officials have deflected many questions, and responded to others by arguing that the focus should be on the attackers themselves, not the manufacturer of their weapons. But the silence is wearing thin for victims of the assaults, as a series of escalating attacks using N.S.A. cyberweapons have hit hospitals, a nuclear site and American businesses. Now there is growing concern that United States intelligence agencies have rushed to create digital weapons that they cannot keep safe from adversaries or disable once they fall into the wrong hands. On Wednesday, the calls for the agency to address its role in the latest attacks grew louder, as victims and technology companies cried foul. Representative Ted Lieu, a California Democrat and a former Air Force officer who serves on the House Judiciary and Foreign Affairs Committees, urged the N.S.A. to help stop the attacks and to stop hoarding knowledge of the computer vulnerabilities upon which these weapons rely.
Only my opinion, but I really dislike this ter, "cyberweapon". Actually, anything with "cyber" other than "cybersex" sets me off a bit...
If you want news from today, you have to come back tomorrow.
Even worse than that is they expect us to believe that they can securely escrow master keys to break all encryption. What a bunch of jokers.
Unlike real weapons, these weapons can be multiplied easily. Try that with a tank.
That alone should mean that these "virtual guns" are under a tighter control. Even a nuke can only detonate once, but one such "weapon" can be used all over the globe billions of times.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Never create a weapon that you wouldn't want to fall into the hands of your worst enemy.
Anons need not reply. Questions end with a question mark.
Eg, skin is vulnerable to penetration by small bits of high velocity metal, so guns aren't weapons?
Your statement doesn't even make sense. So if I shoot a rocket at the cracked part of a wall the rocket ceases to be a weapon?
I found this for you:
https://en.wikipedia.org/wiki/Ukraine%E2%80%93United_States_relations
Truer words have never been spoken
The analogy is that these are very much like biological weapons. If you're going to use those, you have to be damn sure that the "good guys" all have vaccines, and that the weapon can't mutate.
There is a very good reason that biological weapons are NOT used.
Aah, change is good. -- Rafiki
Yeah, but it ain't easy. -- Simba
The NSA. It pooped it's pants right there in the public square. And rather than trying to clean up, it just stands there yelling "MY SHIT DON'T STINK!" while continuing to make squeaky farts..
This is probably go to a new school next year level public humiliation, but they apparently have no shame.
If you should see someone who works for the NSA, hand them a roll of toilet paper.
Exactly. The problem here is that people are trying to apply pre- information age thinking to post- information age constructs. This idea that you can build a cyber "weapon" that can only attack "bad" people and cannot be trivially altered to ignore whatever protections you put into place to keep it from being used against "good" people, is ludicrous.
Yes, exactly like guns. It's ludicrous to think you can proliferate millions of guns to "good" people, and they won't be also used by "bad" people.
The market would be tanking.
How can anyone innovate, compete, and do business when everything they make can be destroyed 'with a click of a button'?
This situation is enforcing the status quo to a hideous degree. The time is long past for violent revolt.
But the silence is wearing thin for victims of the assaults, as a series of escalating attacks using N.S.A. cyberweapons have hit hospitals, a nuclear site and American businesses.
IMHO it's just getting started. The source code to a whole BUNCH of their tools has gotten out - a treasure trove for the bad guys. Now they don't have to design this stuff themselves - it's all there, ready to be customized. We're just seeing the leading edge from the early adopters.
Now there is growing concern that United States intelligence agencies have rushed to create digital weapons that they cannot keep safe from adversaries or disable once they fall into the wrong hands.
Well, DUH! If you've got the source it's anywhere from reasonably easy to trivial to disable or change any kill switch. Changing vulnerable mechanisms key to the operation are more difficult, but still doable. So even if they did spend extra engineer time to build in the equivalent of "gun smart chips" - and they worked - it would, at best, be initially mitigating but ultimately futile.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
....or introduce security flaws that let the enemy use your own stock against you
Twinstiq, game news
There is plenty of speculation to be made over have many of the current 'epidemics' we've had in the recent world are simply mutations, versus being field testing of refined biological agents against captive populations.
Dump a slightly modified flu virus in your own, or a foreign nation's livestock, one intended to hop into humans, then wait and watch and document its effectiveness, issues, etc. Make individual changes across dozens of mild contagions, then use the resulting field data to help refine the 'master agent' combining each technique you utilized on individual samples to create something far more effective.
It is about as farfetched as a US Space Corps...
Yes, exactly like guns. It's ludicrous to think you can proliferate millions of guns to "good" people, and they won't be also used by "bad" people.
Well, the horses have already left the barn on criminals having/using guns. They aren't going to turn them in if they were banned.
The question remaining is, do you allow people the ability to defend themselves, seeing as police rarely ever arrive in time to do anything other than write reports and gather evidence, or do you leave them defenseless?
Note that there are far more good people than bad people. That means that by allowing people to arm themselves there will be far more good people with guns vs bad people with guns, and the only thing that stops a bad guy with a gun is a good guy with a gun.
The option to disarm everyone is impossible in the US, too many guns already out there and far too easy to smuggle in across the land borders. Any serious attempt would only trigger a civil war.
Strat
Progressivism (aka US 'Liberalism'): Ideas so good they need a police/surveillance-state to enforce.
or should we just ban anything that can be used by "bad" people to commit crimes? or should we focus on the individual that commits the crimes instead of their chosen tools?
"They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety."
One other aspect to keep in mind- For YEARS now, the intelligence services of the USA have been pouring millions of dollars a year into the Black Hat Black Markets, where these vulnerabilities are traded and sold. They aren't some bit player, occasionally picking up a new trick, they are the primary source of funding to many of these marketplaces.
The bugs would still exist either way, but the government has been intentionally funding organized crime into developing these vulnerabilities, and making the situation much worse. Since they are the primary entity putting money into this marketplace, they are playing the key role to allow black hats to quit their day job and focus on writing exploits.
The thing about vulnerabilities is one single entity can't find everything. If you're then disclosing those to get everything patched you are harming your offensive capabilities. It may impact another party's offensive capabilities as well, but it's very likely they have vulnerabilities that you don't know about. So then you have a double edged sword. Do you keep the exploit to use offensively and risk the undisclosed exploit being used against you, or disclose it and still risk another undisclosed exploit you don't know about still being used against you? Exploits are a limited resource and they expire. Once used they have an even shorter shelf life before discovery. You don't know when things will get discovered by another party as well. They need a constant influx of new vulnerabilities because the ones they have may not be useful against an assigned target tomorrow. Your warhead, information collection, and mission ability is all determined by the offensive software you have at your disposal. Everyone else will call it malware. A reachable known target can be implanted with a non-replicating tool. These are the most covert, but also the most difficult as you may not have a direct path to the target machine. That goes into getting access to a well defended network. That requires something that spreads on it's own so it can possibly reach the machines you need coverage on. This is also a double edged sword as putting in limitations to spreading also gives away the fact it's not a random infection. Those type of tools always end up spreading to unintended places and getting examined by security researchers. If a worm component is added then you cross into the realms of epidemiology and outbreaks though without geographic isolation as a barrier. It only takes one user in a network to get infected and then it'll spread until AV and OS patches catch up. So disclosing vulnerabilities isn't always an option if you want to remain effective offensively. It becomes a lot like a classic game theory problem The strategic choice would be to hang onto as many vulnerabilities as long as they can, and that's what everyone does.
If a couple 0dayz (+ a month or two) can cause this kind of a mess. Then how many guys worldwide are actively writing exploits? I think the skill should have at least a few thousand practitioners, so where is the daily chaos?
I do see to some extent the frustration the NSA must have over this. If the abusers weren't dropping ransom ware everywhere this wouldn't have had such a huge impact.
Nasty 0days come out every week.
Cwm, fjord-bank glyphs vext quiz
And this is why, every day, so many shootings are interrupted or prevented by good guys with guns. Obviously the media don't report these incidents. If we could only further increase gun ownership we might be able to stop mass-shootings entirely.
The NSA _DID_ tell Microsoft and the other targeted software firms which vulnerabilities they were using months before the russians began releasing them (and pointing their finger at the NSA). It's the reason that patches were available on Win10 before the russian release and that Microsoft released patches for their unsupported OS's _the_day_ the russians leaked them.
Now there are better questions that need to be answered: Why are people blaming the NSA, and _ONLY_ the NSA? We know that the exploits were not a major problem until the russians released them because the NSA used the exploits for years and the public impact was nonexistent -- because the NSA was using them in targeted exploits and not as a tool of widespread untargeted economic destruction the way the russians have. We also know that the Russians have used other 0Days in the past and will certainly use different 0Days in the future that they didn't steal from the NSA. At what point will you recognise that the NSA _isn't_ the major problem here and that the big problem is with Putin's "patriotic" hackers spreading malware without _any_ thought to the consequences? Why does Putin get a free pass?
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue
It was alleged (and since debunked) that during WW II Churchill sacrificed Coventry to mask the fact that the British had compromised German military ciphers. Does the sequestering of these exploits really serve the greater good? By its actions, the NSA has failed in what SHOULD be it's primary goal to preserve the life, liberty, and property of the citizens of our nation and our allies.
Soon enough these exploits will be patched.
The NSA would be insane to get involved.
I am very small, utmostly microscopic.
A crack in a wall would be the "vulnerability" so supposedly using something against it would mean it is not a weapon.
Yes, that's why NATO troops are there, and why Russia attacked them with cyberweapons which then spread to India, Pakistan, and other countries.
Russia is not our friend.
And the easiest way to defeat them is to triple or quadruple Renewable Energy usage, cutting off their supply lines at the knees.
-- Tigger warning: This post may contain tiggers! --
Seriously as long as you don't use Microsoft Windows on the Intel chip set you should be safe. And who exactly had their fear raised over this. What I would like to know is what retard made the decision to store all his hacking tools on the Internet.
Except the "Good" seem to fail MOST of the time
Or even Add to the carnage!
From my essay: http://www.pdfernhout.net/reco... ... ... irony. :-)"
"Likewise, even United States three-letter agencies like the NSA and the CIA, as well as their foreign counterparts, are becoming ironic institutions in many ways. Despite probably having more computing power per square foot than any other place in the world, they seem not to have thought much about the implications of all that computer power and organized information to transform the world into a place of abundance for all. Cheap computing makes possible just about cheap everything else, as does the ability to make better designs through shared computing.
There is a fundamental mismatch between 21st century reality and 20th century security thinking. Those "security" agencies are using those tools of abundance, cooperation, and sharing mainly from a mindset of scarcity, competition, and secrecy. Given the power of 21st century technology as an amplifier (including as weapons of mass destruction), a scarcity-based approach to using such technology ultimately is just making us all insecure. Such powerful technologies of abundance, designed, organized, and used from a mindset of scarcity could well ironically doom us all whether through military robots, nukes, plagues, propaganda, or whatever else... Or alternatively, as Bucky Fuller and others have suggested, we could use such technologies to build a world that is abundant and secure for all.
So, while in the past, we had "nothing to fear but fear itself", the thing to fear these days is ironcially
Thanks for the interesting link to the harvardpolitics site.
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Because we don't expect the Russians to be the good guys. We do kinda expect that from an organization that is allegedly protecting us.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Were that true there would have to be _some_ condemnation of Russian hackers amongst the incessant blaming of the NSA. As that's not the case and people like shotgun keep repeating the same falsehoods, something else is happening & it's not innocent.
Democracy is a sheep and two wolves deciding what to have for lunch. Freedom is a well armed sheep contesting the issue