The FBI is working hard to keep you unsafe

http://techcrunch.com/2016/04/23/the-fbi-is-working-hard-to-keep-you-unsafe/

by colincarter41 • 10 years ago

93 73 10 years ago

"Terrorists hurt you, so we have to hurt you to compensate".

busterarm4• 10 years ago

Let's not forget that Sabu, while an informant for the FBI, supplied Jeremy Hammond with the 0day that he used to hack Stratfor et al.

No 0day, no Stratfor hack. No FBI, no Stratfor hack.

Sometimes I wonder if penetrating other agencies and corporations was part of their gameplan. The FBI were entirely behind the formation of antisec.

Aside: Other interesting observation... The FBI and Apple seem to have an odd antagonistic relationship with one another. One of the Antisec hacks was against an FBI laptop that caused the release of millions of Apple users' data. The FBI was recording and debriefing Sabu every day. How did they allow that to happen?

ryanlol• 10 years ago

AFAIK that's not true, Hammond received the "0day" (mysql server with auth turned off) directly from hyrriiya on crytonet.

busterarm4• 10 years ago

And there's a chatlog where Sabu asked hyrrilya to give him (and I'm assuming by extension then Hammond, which he claimed in his defense) access to Stratfor.

Good correction though. I care a lot less about the technical details with this case than the social/sociopolitical ones.

rm_-rf_slash2• 10 years ago

Let's all accept a depressing fact: effective cyber-security places all of us in a state of perpetual war. You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries, whether they know it or not. We cannot simply fork their nation's Github repo and try out zero-days in a safe and isolated environment.

We shouldn't be so quick to rail against government zero-day stockpiling. It is likely that other branches of government are using these flaws for their own means to monitor foreign states and other entities. If we give up that power we risk crippling our offensive capabilities more than we might stand to gain by having a stronger defense.

I cannot vouch for one side or the other. I am not a senior intelligence official and I do not have all the facts.

busterarm4• 10 years ago

http://www.alternet.org/news-amp-politics/why-idea-big-cyber...

http://dickdestiny.com/blog1/?p=913

rm_-rf_slash2• 10 years ago

If you re-read my comment you will find nothing that suggests catastrophic cyber warfare is a major threat.

The real threat is a death of a thousand cuts. Trade secrets, troop movements, active spies, little snippets of information that can cause a lot of trouble if put in the wrong hands.

coroutines• 10 years ago

You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries...

I'm sorry but this just sounds unethical and wrong. So much can be learned passively.

This is a good read: https://www.nostarch.com/silence.htm

tptacek24• 10 years ago

We don't accept this argument when it's turned on independent researchers. Researching vulnerabilities doesn't create vulnerabilities --- bad software engineering does.

kabdib• 10 years ago

Independent researchers usually disclose, yes? Hopefully responsibly.

There are no silver bullets. We're always going to have bugs, and bad ones that affect security.

Stockpiling of zero-days blurs the line between law enforcement and adversary. The greater good is probably served by disclosure, rather than surveillance, break-ins or advancement of the careers of prosecutors.

tptacek24• 10 years ago

No, many researchers do not disclose. Every time Hacker News (incorrectly) takes the line that Facebook or Google isn't paying enough for a bug bounty, they're acknowledging that.

sqeaky9• 10 years ago

independent researchers

... do not have the funding of the richest nation on the planet and have not shown the level of malice of that government.

tptacek24• 10 years ago

So what? That still doesn't mean USG bug hunters are creating bugs. The bugs are there whether the USG finds them or someone else does. And, having found them, the USG has done nothing to prevent anyone else from finding them later.

and-can• 10 years ago

There's a difference between research to prevent exploits VS. research to enable them. The latter is the FBI.

tptacek24• 10 years ago

It's not at all true that researchers on the whole do what they do to prevent exploits. Many of the best researchers do the opposite!

tremon• 10 years ago

But the FBI isn't exactly independent, is it? Would you say the same about "independent" researchers employed by the Chinese government, or Syria or Israel?

tptacek24• 10 years ago

The same thing.

matthewmcg• 10 years ago

True, but the article is arguing it's the FBI's failure to disclose the vulnerabilities that is making us less safe.

We expect researchers to follow responsible disclosure practices and at least notify the vendor to give them a chance to prepare a patch. I can understand why the FBI might not want to do that, but that's where the OP is coming from.

mc32• 10 years ago

But whether someone knows there are vulnerabilities is not the same as exploiting the vulnerabilities for nefarious uses.

Lets say the FBI did not exist. We know those same vulnerabilities would exist, except an organization would not be aware of them as such since the org does not exist, but the vulns would still be there and software would still be as vulnerable. So them knowing is more or less neutral in terms of making software more or less vulnerable.

mikx007• 10 years ago

What if FDA on behalf of CIA withheld drug interaction information so that CIA could "eliminate" various targets more efficiently? Would that be OK?

“The end cannot justify the means, for the simple and obvious reason that the means employed determine the nature of the ends produced.” ― Aldous Huxley

tptacek24• 10 years ago

No, because we rely on the FDA to certify products before they're marketed. No such agency exists for software.

joesmo• 10 years ago

Do security researchers routinely hide the exploits they find and use them for their own nefarious purposes?

qyv• 10 years ago

The original argument is based on the assumption that the opposite of 'revealing 0-days makes us safer' is 'not revealing 0-days makes us less-safe'. I am not sure that is a correct assumption. On the surface it seems reasonable but it is also very simplistic. If one party knows an exploit that others do not, then that party has an advantage over everyone else, and everyone else is less safe from that party. Does that mean less safe in general? That depends on your opinion and relationship with the advantageous party. Those who feel less safe by this are the ones that distrust the FBI.

wfo• 10 years ago

Yes -- the FBI has no mission to protect the public good. Their job is not to defend ordinary Americans against cyber attacks. That's a different governmental agency, if such an agency even exists (I know there is a defensive part of NSA that does things like SELinux and hardening redhat, etc).

The job of the FBI is to detect and prosecute crimes under their jurisdiction. They've decided they can better do their jobs keeping the 0-day secret than disclosing it -- if it's kept secret, it makes it easier for criminals to commit more crimes for them to prosecute, and simultaneously gives them more investigative tools, win win.

nickpsecurity5• 10 years ago

That I agree with. That's also the government's official position per NSA IAD since Orange Book. They said most software was shit, showed it in evaluations, showed how to do better, proved that with evaluations, and the market stayed on shit for profit margins.

Anyway, I think we should use their own Common Criteria and INFOSEC statements against them in crypto debates.

"Mr. Comey, these NSA documents say a system isn't secure until certain rigorous practices are performed from the chips up to the app. This iPhone wasnt designed to that standard due to to backward compatibility and cost concerns. By your own docs, the Fed's or NSA at least shoukd be able to shred it along with most COTS systems. So why is FBI contradicting NSA's expert testimony?"

Lavabit case defense I wrote previously:

"Your honor, FBI wants to put a black box in the system that can stealthily compromise all users and even forge evidence. You asked for an alternative. In our possession is a network tap that is certified for security by NSA-approved labs per NSA-approved standards. It has a NSA-approved TPM to attest its software hasnt been tampered with. Our administrator of that device has a US security clearance and will testify under oath to its physical integrity. This device can, in audited way, run a specific search on our logs or stored keys to get just the data the court needs. We suggest using it as, per NSA expert testimony, it's all they need to get the job done and has no risk of tampering."

What you think, tptacek? Nice way to make the red tape pay off? ;)

lasermike026• 10 years ago

"Power tends to corrupt, and absolute power corrupts absolutely." - John Emerich Edward Dalberg-Acton

chatmasta• 10 years ago

As long as software exists, by definition, zero-days will exist. A zero-day is simply a bug in its most nascent state; one person has found it, and nobody else knows about it. Whether the finder is a "security researcher," a "blackhat," or a "nation-state" has no impact on whether the bug exists or not. In fact, the bug exists even if nobody finds it! The distinction of who found it, and what they do with it, is purely political. Anyone can still exploit the bug.

Sure, maybe the "friendlier" bug finders will responsibly disclose any bugs they find. But there will never be a way to guarantee that all bugs found will be responsibly disclosed. Even if we convince the FBI/NSA to "responsibly disclose" every bug they find (will never happen), what about every other country? The hundreds of security firms? The thousands of independent hackers and "researchers?"

Zero-days will ALWAYS exist. Software will ALWAYS be exploitable. Worrying about how people react when they find those exploits is the similar to arguing about gun control. Sure, maybe we can convince some actors to responsibly disclose, but the bad actors will always keep the exploits for themselves and use them "irresponsibly." And there will always be bad actors.

So instead of fretting about what happens when someone finds a bug, why don't we prepare for the eventuality that all bugs will be found and exploited, often times without anyone's knowledge? Why don't we build security systems to be tolerant of exploits, instead of resistant to them? There is no security panacea, just as there is no reliability panacea.

We build distributed systems with the assumption that nodes will fail, and we call that "fault tolerance." We don't say a system is broken because a node fails. We say it's broken if it cannot handle a node failing.

Why can't we do the same for our security systems? Exploits are as inevitable as any type of system failure. We need to design for exploit tolerance with the same enthusiasm we design for fault tolerance.

ccvannorman• 10 years ago

Wow - well said. I have often said that modern computer security is akin to trying to float on the ocean in a sieve while constantly plugging each hole in the sieve all the time.

I think the world is ready for a new kind of computer. Want to start a company? ;-]

nickpsecurity5• 10 years ago

Look up CHERI processor and CHERIBSD at Cambridge. Look up Gaisler Leon3/4 SOC. License them, port CHERI tech to Leon, add capability-aware IOMMU, add TRNG, add ROM for main bootloader, fab the joker, and you got critical part of a secure computer. Clone Tandem Nonstop lockstep tech if you want fault-tolerance.

And there you go. A secure PC for only a few million dollars with BSD support. Optionally port EROS microkernel w/ jVPS filesystem for stronger solution.

sqeaky9• 10 years ago

Exploits being inevitable does not exonerate our elected and appointed officials from their responsibilities and obligation of running the government the people who put them in power want.

Do we want a government that collects threats that are more likely to be used against its own people than anyone else? The USA produces and use more software than any other country, not sharing exploit information fundamentally hurts the USA and the Economy of the USA more than other countries.

tptacek24• 10 years ago

It's a pretty big leap you've taken here, between your disagreement with the USG's policy regarding vulnerabilities and their "obligation to run the government people want". Clearly, they're not running the government that message boards want. But that's not the same thing!

The FBI is working hard to keep you unsafe

Related Stories