U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report

https://www.zetter-zeroday.com/u-s-government-disclosed-39-zero-day-vulnerabilities-in-2023-per-first-ever-report/

by jc_811 • 1 year ago

221 146 1 year ago

So there was 39 vulnerabilities that affected government systems. The rest didn't so they had no need to disclose.

Similar, but my thought is that they found out some other gov(s) know about it as well. And that it hurts others more than it hurts the US gov.

maerF0x03• 1 year ago

I'd say that's a very cynical take, theres a verification process and they disclosed 90% of them, pretty generous gift to the world if you ask me. They do not have a moral mandate to use their resources to benefit all.

afavour• 1 year ago

What changed the calculus in 2023 isn’t clear.

Well, the calculus didn't change in 2023 if the report was only released a month or so ago. And in fact, in May 2024:

DHS, CISA Announce Membership Changes to the Cyber Safety Review Board https://www.dhs.gov/archive/news/2024/05/06/dhs-cisa-announc...

So some new people came in and decided that more public information was better.

On January 21, 2025, it was reported that the Trump administration fired all members of the CSRB.

Ah, well, never mind then

neuronexmachina• 1 year ago

Yep. From the article:

This lack of transparency could become a greater issue under the Trump administration, which has vowed to ramp up the government's cyber offensive operations, suggesting that the government demand for zero-day vulnerabilities may increase over the next four years. If this occurs, the government’s previous statements that the VEP favors disclosure and defense over withholding and offense may no longer be true. ...
“The VEP and that number of 90 percent was one of the few places where the president and the White House could set the dial on how much they liked defense vs offense,” says Jason Healey, senior research scholar at Columbia University’s School of International and Public Affairs and former senior cybersecurity strategist for CISA. “[The Trump administration] could say we’re disclosing too [many vulnerabilities]. If the default [in the past] was to disclose unless there is a reason to keep, I could easily imagine the default is going to be to keep unless there is a reason to disclose.”

dylan6042• 1 year ago

Were these the same people that declared the 2020 election as being the safest ever? I can't imagine why that would grate Trump

nimbius• 1 year ago

I hope this signals a turning point and lessons learned from the historic practice of hoarding exploits in the hopes they can be weaponized.

when you disclose vulnerabilities and exploits, you effectively take cannons off both sides of the metaphorical battle field. it actively makes society safer.

toomuchtodo2• 1 year ago

Governments who want power will hoard the knowledge, which is power. Other governments will share. This is perpetual tension: we collectively receive utility when good policy is active (rapid dissemination of vuln info), but we need third parties to seek these exploits out when government cannot be relied on. Very similar to the concept of journalism being the Fourth Estate imho.

(vuln mgmt in finance is a component of my day gig)

tptacek29• 1 year ago

This is a little bit like talking about why they hoard the guns. The reason governments have caches of exploit chains is not hard to understand.

thomastjeffery3• 1 year ago

You can't hoard knowledge, just like you can't take it away.

axegon_• 1 year ago

I doubt it. Historically, most government agencies around the world have had appalling security and each iteration is just as bad as the previous with a few half-assed patches on top to cover the known holes.

lenerdenator• 1 year ago

I'd be surprised if the policy continues.

Or if the people who worked at the agency are still there.

burkaman4• 1 year ago

They are not: https://techcrunch.com/2025/01/22/trump-administration-fires...

Also, not a joke, this program contains the word "equity" ("the Director of National Intelligence is required to annually report data related to the Vulnerabilities Equities Process") so it will probably be frozen or cancelled.

spacephysics• 1 year ago

Most likely these vulnerabilities were known by adversaries and they decided to report these to make it more difficult for those adversaries to attack.

I’m sure the really juicy zero days they’ve discovered in-house are kept out of reports like these

thewebguyd2• 1 year ago

This is the most likely scenario. Its not like the government has decided they no longer need to hang on to zero days to use against adversaries.

They've just determined these ones are either no longer useful to them, or adversaries have discovered and began using them.

kevin_thibedeau• 1 year ago

The US depends on exploits being available for the companies it uses to circumvent the 4th amendment.

stephen_g• 1 year ago

The problem is when they don't know that their adversaries know about those exploits...

There's a lot of arrogance and hubris with the idea of NOBUS, and they often make things worse assuming only they know...

downrightmike• 1 year ago

Probably not, trump's first term he was all for allowing ransomware. And the only reason we started seeing a strategy for mitigating was because of Biden. Since trump is all in on crypto and the fact that russia is the main beneficiary of ransomware, I highly expect cybercrime to ramp up as the current admin is positioned to benefit directly.

meowface2• 1 year ago

I might be a contrarian, but I think it makes sense for the NSA to hoard 0-days. They should disclose only after they burn them.

thomastjeffery3• 1 year ago

You can't actually hoard them, though. They aren't objects, they are knowledge.

A 0-day is present in every instance of the software it can exploit.

rozab• 1 year ago

Great, fantastic, awesome plan.

https://en.wikipedia.org/wiki/The_Shadow_Brokers

burkaman4• 1 year ago

Any 0-day found by an NSA employee can and will be found by someone else, and then sold or used.

tptacek29• 1 year ago

You're only a contrarian on message boards. The economics of CNE SIGINT are so clear --- you'd be paying integer multiples just in health benefits for the extra staff you'd need if you replaced it --- that vulnerabilities could get 10x, maybe 100x more expensive and the only thing that would change would be how lucrative it was to be a competitive vuln developer.

A lot of things can be understood better through the lens of "what reduces truck rolls".

timewizard5• 1 year ago

The NSAs charter should be to secure this country and not attack others.

edm0nd• 1 year ago

Aint no way.

All major governments hoard 0days or buy them to use for espionage. I dont see this being some kind of "turning point" and more of a feel good easy PR win for the US gov but really they are still using many 0days to spy.

thewebguyd2• 1 year ago

Yeah, this is more like "these vulnerabilities are no longer useful to us" or "adversaries have discovered these and began using them, so here you go."

tptacek29• 1 year ago

It is not that turning point. These are VEP vulnerabilities. Like every major government, the US will continue to do online SIGINT.

timewizard5• 1 year ago

The lesson is not in vulnerability management.

The lesson is that our desktop software is garbage and the vendors are not properly held to account.

JumpCrisscross12• 1 year ago

when you disclose vulnerabilities and exploits, you effectively take cannons off both sides of the metaphorical battle field. it actively makes society safer

If I know you always disclose, and I find something you haven't disclosed, I know I have an edge. That incentivises using it because I know you can't retaliate in kind.

The hoarding of vulns is a stability-instability paradox.

Retr0id• 1 year ago

How would you ever know that someone always discloses, if you can't know what they don't disclose?

staticelf• 1 year ago

I think people give the US a lot of unnecessary shit. I don't think my government releases any zero days but I am sure they must have found some. Every government today probably uses zero days but it seems very few release information about them?

dylan6042• 1 year ago

It's not about being held to a lower standard, it's about being held to a higher standard.

numbsafari• 1 year ago

NOBUS is a disaster. Knowingly leaving citizens unprotected is an absolute failure of government. Having a robust policy of identifying a resolving cybersecurity faults, and holding organizations accountable for patching and remediation is necessary if we are going to survive a real cyber “war”. We are absolutely unprepared.

sneak• 1 year ago

This presupposes that the purpose of government is to protect citizens.

The purpose of government is to take and maintain power and prevent any other organization from displacing them. It involves citizens only as a means to an end.

It would be a failure of government to place citizen safety over continuity of government.

ambicapter• 1 year ago

It can be both at the same time. A government won't be great at protecting its citizens if it has no power over bad actors, both inside and outside.

acdha• 1 year ago

Your first sentence seems like a distraction because the same criticism of NOBUS holds either way. Even if the leaders do not care about the citizens except as a means to an end, an oppressive government especially needs to maintain security because it needs to project force to deter threats to its power. If they have a known vulnerability, they should be even more worried that internal dissidents or an external foe will find it because they are even more dependent on power in the absence of democratic legitimacy.

pythonguython• 1 year ago

This is a classic security dilemma that is not easily resolvable. Suppose we just look at the US and China. Each side will discover some number of vulnerabilities. Some of those vulnerabilities will be discovered by both countries, some just by one party. If the US discloses every vulnerability, we’re left with no offensive capability and our adversary will have all of the vulnerabilities not mutually discovered. Everyone disclosing and patching vulnerabilities sounds nice, but is an unrealistic scenario in a world with states that have competing strategic interests.

tptacek29• 1 year ago

The US VEP, which is like 10 years old now, is explicit about the fact that zero-day exploits are not fundamentally "NOBUS". That term describes things like Dual EC, or hardware embedded vulnerabilities; things that are actually Hard for an adversary to take advantage of. Chrome chains don't count.

pentel-0_5• 1 year ago

These are just the disclosed ones. The weaponized ones (as mentioned) found or bought kept secret by the NSA, etc. such as from Zerodium (ex-VUPEN) and similar aren't counted obviously. ;)

tptacek29• 1 year ago

It's a "tell" in these discussions when they center exclusively on NSA, since there are dozens of agencies in the USG that traffick in exploit chains.

ggernov• 1 year ago

These are wins because if they're actually patched it takes offensive tools away from our adversaries.

davemp• 1 year ago

While I don’t think we should be hoarding vulns, the idea of the government having huge budgets to find and disclose software defects is a bit strange to me. Seems like another instance of socializing bad externalities.

mattmaroon2• 1 year ago

"What the government didn't reveal is how many zero days it discovered in 2023 that it kept to exploit rather than disclose. Whatever that number, it likely will increase under the Trump administration, which has vowed to ramp up government hacking operations."

This is a bit of a prisoner's dilemma. The world would be better off if everyone disclosed every such exploit for obvious reasons. But if government A discloses everything and government B reserves them to exploit later, then government B has a strong advantage over government A.

The only responses then are war, diplomacy, or we do it too and create yet another mutually assured destruction scenario.

War is not going to happen because the cure would be worse than the disease. The major players are all nuclear powers. Diplomacy would be ideal if there were sufficient trust and buy-in, but it seems unlikely the U.S. and Russia could get there. And with nuclear treaties there's an easy verification method since nuclear weapons are big and hard to do on the sly. It'd be hard to come up with a sufficient verification regime here.

So we're left with mutually assured cyber destruction. I'd prefer we weren't, but I don't see the alternative.

dadrian2• 1 year ago

If Government A and Government B are not equally "good" for the world, then the world is _not_ better off if everyone disclosed, since the main users of CNE are LE/IC.

mattmaroon2• 1 year ago

I'm not sure what some of these initialisms are but the whole idea behind disclosing is to take tools away from the bad guys (whoever you think they are) because presumably they'll have found some of them too.

josefritzishere• 1 year ago

I guess there wont be one in 2024

skirge4• 1 year ago

Burning 0-days makes your enemies spend more time on finding new ones - costs rise so they will go bankrupt. Cold war 2.0. It's not enough to just run grep / memcpy finder on software like 20-15 years ago.

ikmckenz• 1 year ago

There is no such thing as a "Nobody But Us" vulnerability. Leaving holes in systems and praying enemies won't discover them, with the hope of attacking them ourselves is extremely foolish.

tptacek29• 1 year ago

CNE "zero-day" isn't "NOBUS", so you're arguing with a straw man.

jjk1662• 1 year ago

I mean there are certainly vulnerabilities that are substantially asymmetric.

joshfraser3• 1 year ago

I've seen the invite-only marketplaces where these exploits are sold. You can buy an exploit to compromise any piece of software or hardware that you can imagine. Many of them go for millions of dollars.

There are known exploits to get root access to every phone or laptop in the world. But researchers won't disclose these to the manufacturers when they can make millions of dollars selling them to governments. Governments won't disclose them because they want to use them to spy on their citizens and foreign adversaries.

The manufacturers prefer to fix these bugs, but aren't usually willing to pay as much as the nation states that are bidding. All they do is drive up the price. Worse, intelligence agencies like the NSA often pressure or incentivize major tech companies to keep zero-days unpatched for exploitation.

It's a really hard problem. There are a bunch of perverse incentives that are putting us all at risk.

timewizard5• 1 year ago

It's a really hard problem.

Classify them as weapons of mass destruction. That's what they are. That's how they should be managed in a legal framework and how you completely remove any incentives around their sale and use.

joshfraser3• 1 year ago

Yes. Except our government is the largest buyer.

kingaillas• 1 year ago

How about some penalties for their creation? If NSA is discovering or buying, someone else is creating them (even if unintentionally).

Otherwise corporations will be incentivized (even more than they are now) to pay minimal lip service to security - why bother investing beyond a token amount, enough to make PR claims when security inevitably fails - if there is effectively no penalty and secure programming eats into profits? Just shove all risk onto the legal system and government for investigation and clean up.

tptacek29• 1 year ago

That is never, ever going to happen, and they are nothing at all like NBC weapons.

JumpCrisscross12• 1 year ago

weapons of mass destruction. That's what they are

Seriously HN? Your Netflix password being compromised is equivalent to thermonuclear war?

Henchman212• 1 year ago

Suddenly I felt like re-reading Ken Thompson’s essay Reflections on Trusting Trust.

We’ve created such a house of cards. I hope when it all comes crashing down that the species survives.

davisr• 1 year ago

Instead of hoping, you can do a lot just by ditching your cell phone and using Debian stable.

tptacek29• 1 year ago

The markets here are complicated and the terms on "million dollar" vulnerabilities are complicated and a lot of intuitive things, like the incentives for actors to "hoard" vulnerabilities, are complicated.

We got Mark Dowd to record an episode with us to talk through a lot of this stuff (he had given a talk whose slides you can find floating around, long before) and I'd recommend it for people who are interested in how grey-market exploit chain acquisition actually works.

https://securitycryptographywhatever.com/2024/06/24/mdowd/

JumpCrisscross12• 1 year ago

It's a really hard problem

Hard problems are usually collective-action problems. This isn't one. It's a tragedy of the commons [1], the commons being our digital security.

The simplest solution is a public body that buys and releases exploits. For a variety of reasons, this is a bad idea.

The less-simple but, in my opinion, better model is an insurance model. Think: FDIC. Large device and software makers have to buy a policy, whose rate is based on number of devices or users in America multiplied by a fixed risk premium. The body is tasked with (a) paying out damages to cybersecurity victims, up to a cap and (b) buying exploits in a cost-sharing model, where the company for whom the exploit is being bought pays a flat co-pay and the fund pays the rest. Importantly, the companies don't decide which exploits get bought--the fund does.

Throw in a border-adjustment tax for foreign devices and software and call it a tariff for MAGA points.

[1] https://en.wikipedia.org/wiki/Tragedy_of_the_commons

fluoridation7• 1 year ago

A tragedy of the commons occurs when multiple independent agents exploit a freely available but finite resource until it's completely depleted. Security isn't a resource that's consumed when a given action is performed, and you can never run out of security.

impossiblefork3• 1 year ago

I think what is actually the problem is the software and hardware manufacturers.

Secure use of any device requires a correct specification. These should be available to device buyers and there should be legal requirements for them to be correct and complete.

Furthermore, such specifications should be required also for software-- precisely what it does and legal guarantees that it's correct.

This hasn't ever been more feasible, also considering that we Europeans are basically at war with the Russians, it seems reasonable to secure our devices.

Always42• 1 year ago

Please no more mandated insurance programs.

skirge4• 1 year ago

security maybe considered "commons" but accountables are individual manufacturers. If my car is malfunctioning I'm punished by law enforcement. There are inspections and quality standards. Private entities may provide certifications.

westoque• 1 year ago

reminds me of the anthropic claude jailbreak challenge which only pays around $10,000. if you drive the price up, i'm pretty sure you'll get some takers. incentives are not aligned.

Melatonic• 1 year ago

Makes me wonder if there are engineers on the inside of some of these manufacturers intentionally hiding 0 days so that they can then go and sell them (or engineers placed there by companies who design 0 days)

tptacek29• 1 year ago

People have been worrying about this for 15 years now, but there's not much evidence of it actually happening.

One possible reason: knowing about a vulnerability is a relatively small amount of the work in providing customers with a working exploit chain, and an even smaller amount of the economically valuable labor. When you read about the prices "vulnerabilities" get on the grey market, you're really seeing an all-in price that includes value generated over time. Being an insider with source code access might get you a (diminishing, in 2025) edge on initial vulnerability discovery, but it's not helping you that much on actually building a reliable exploit, and it doesn't help you at all in maintaining that exploit.

maerF0x03• 1 year ago

the US often gets negative takes for doing what many other nations are also doing.

For example in 2018 Tencent (basically, China) withdrew from hacking competitions like pwn2own taking along with them the disclosures that proceeded.

tptacek29• 1 year ago

Essentially every other industrialized nation.

fluoridation7• 1 year ago

Whataboutism. What China does doesn't invalidate any criticism the US gets. Or are you saying that actually it's perfectly fine to do this?

tptacek29• 1 year ago

That would be true if it was just China, but when it's so many countries that it's essentially an international norm, the "whataboutism" charge loses some of its sting.

daedrdev• 1 year ago

China hiding exploits it find has a large jmpace on Us policy. Should the Us reveal every zero day it knows, in a theoretical conflict with china China will have zero days US didnt know about but the US will have none.

Veserv9• 1 year ago

Disclosing zero-days so the vendor can patch them and declare "mission accomplished" is such a waste.

"Penetrate and Patch" is about as effective for software security as it is for bulletproof vests. If you randomly select 10 bulletproof vests for testing, shoot each 10 times and get 10 holes each, you do not patch those holes and call it good. What you learned from your verification process is that the process that lead to that bulletproof vest is incapable of consistently delivering products that meet the requirements. Only development process changes that result in passing new verification tests give any confidence of adequacy.

Absent actively, or likely actively, exploited vulnerabilitys, the government should organize vulnerabilitys by "difficulty" and announce the presence of, but not disclose the precise nature of, vulnerabilitys and demand process improvement until vulnerabilitys of that "difficulty" are not longer present as indicated by fixing all "known, but undiclosed" vulnerabilitys of that "difficulty". Only that provides initial supporting evidence that the process has improved enough to categorically prevent vulnerabilitys of that "difficulty". Anything less is just papering over defective products on the government's dime.

JumpCrisscross12• 1 year ago

the government should organize vulnerabilitys by "difficulty" and announce the presence of, but not disclose the precise nature of, vulnerabilitys and demand process improvement until vulnerabilitys of that "difficulty" are not longer present as indicated by fixing all "known, but undiclosed" vulnerabilitys of that "difficulty"

For this amount of bureaucracy, the government should just hire all coders and write all software.

Veserv9• 1 year ago

You appear to misunderstand what I am saying:

1) Government already has vulnerabilitys.

2) Government identifies vulnerabilitys they already own by "difficulty to discovery".

3) Government selects the lowest "difficulty to discover" vulnerabilitys they already own.

4) Government announces products with known "lowest difficulty to discover" vulnerabilitys are vulnerable, but does not disclose them.

5) Government keeps announcing those products continue to be the most "insecure" until all vulnerabilitys they already own at that level are fixed.

6) Repeat.

tptacek29• 1 year ago

"Penetrate and patch" is a term of art Marcus J. Ranum tried to popularize 15-20 years ago, as part of an effort to vilify independent security research. Ranum was part of an older iteration of software security that was driven by vendor-sponsored cliques. The status quo ante of "penetrate and patch" that he was subtextually supporting is not something that most HN people would be comfortable with.

Veserv9• 1 year ago

"Penetrate and Patch" as a failed security process is distinct from vilifying independent security research, and it should be obvious from my post as I point out that penetration testing is a integral part of the testing and verification process. It tells you if your process and design have failed, but it is not a good development process itself.

egberts1• 1 year ago

Simply because not enough anti-malware vendors are willing to let US government know that one of their favorite hoard of malware has lost "its edge".

So, either they form a department of viability or they lose it all.

U.S. Government Disclosed 39 Zero-Day Vulnerabilities in 2023, First-Ever Report

Related Stories