NSA Director Says Agency Shares Vast Majority of Bugs It Finds

http://threatpost.com/nsa-director-says-agency-shares-vast-majority-of-bugs-it-finds/109170

by randomname2 • 12 years ago

62 59 12 years ago

jgrahamc• 12 years ago

In the video of that discussion[1] he also says that NSA developed the Heartbleed patch after hearing about the vulnerability on April 7 and shared with the private sector on April 8.

Interesting to compare with timeline: http://www.smh.com.au/it-pro/security-it/heartbleed-disclosu...

[1] https://www.youtube.com/watch?v=yhwy2ZWi_y8

pwnna• 12 years ago

Facebook and Microsoft donate $US15,000 to Neel Mehta via the Internet Bug Bounty program for finding the OpenSSL bug.

Hm. I didn't know that MS would be involved in this as well since they're not really affected by this.

pbz• 12 years ago

They run a bunch of Linux servers (Azure), so they were affected.

higherpurpose2• 12 years ago

Google's Adam Langley: Nope - https://twitter.com/agl__/status/530004568784916480

opendais• 12 years ago

I'd say this is a case of non-technical people being told by coworkers the "issue was fixed and the patch is public" on April 8th [after OpenSSL patches it] and confuses it with his coworkers creating the solution.

I'm just depressed because I suspect many people will start claiming the NSA solved Heartbleed. :/

scintill762• 12 years ago

So, this is going to sound like I'm determined to find a reason to hate the NSA, but.. this doesn't make them look good either. It's the most accessible and widely-deployed memory disclosure bug of recent years, if not ever. Surely there are at least 1000 vulnerable (at the time) servers they'd specifically love to have this window into, for intelligence on the "bad guys." Surely they know the "bad guys" would love to look into and attack American servers the same way. Exploiting and defending this kind of thing is exactly what the NSA is supposedly for, but they're telling us they didn't know about it.

I guess all their good talent and money was tied up in domestic call metadata social graph analysis. But at least they had someone smart enough to do the trivial patch once the vulnerability was known![0]

P.S. I also notice they didn't mention "Shellshock". Why not?

[0] https://twitter.com/agl__/status/530004568784916480

sliverstorm• 12 years ago

So your argument is "If the NSA is any good, they must know about every vulnerability in the world before the private sector- otherwise they are incompetent"?

tlb• 12 years ago

That must be an interesting decision to make. Presumably, they'd only keep quiet about bugs they were fairly confident that unfriendly governments weren't also likely to find and exploit. I assume they'd also launch a big honeypot, so if someone else started to exploit it they could could change strategies.

It's the New New Great Game.

higherpurpose2• 12 years ago

I don't buy it. I think he's just trying to make NSA look "useful" to private companies, so they support laws like CISA, where sharing between NSA and tech companies will be forced.

doe88• 12 years ago

It may or may not be true, having repeatedly lied in the recent past they have lost all credibility.

x0x0• 12 years ago

So, the NSA are, to a person, lying sacks of shit. After their director's performance in front on congress -- the "least untruthful answer possible" -- don't trust a damn word.

So when they say they share, with whom? And what priority? Ooh, you found a documentation bug; is that the one you chose to share? The more severe a bug is, the more useful to them.

There's a million ways to parse this bullshit that come down to mean they're doing what they did all along but better at lying in public.

dalke• 12 years ago

I want to be more specific about the concept of sharing.

There are two uses of "sharing" in the response. One was sharing of vulnerabilities. It was never clear who it was shared with. It could be with the DoD, with GCHQ, with private contractors under contract with the NSA, etc. and still be counted as "sharing."

The other is an example of sharing one patch, for the Bash vulnerability, with the private sector.

I think we are supposed to connect those two pieces of data, but there's no reason to do so.

wsloth514• 12 years ago

The problem is... I DO NOT TRUST YOU.

justanother• 12 years ago

So they share a "vast majority," but still keep many to themselves because they don't think anyone else is persistent enough to find them ("How likely are others to find it?"), in addition to telling a lie about developing the fix for Heartbleed. Nothing new here.

sarciszewski4• 12 years ago

Wasn't that developed by Adam Langley? (Google employee.)

biesnecker• 12 years ago

Do they disclose them before or after they exploit them?

eyeareque• 12 years ago

I'm sure they share them as soon as they discover someone else is aware of the same exploits.

c0achmcguirk• 12 years ago

I've talked to some employees of TrueSec (the firm that just discovered the Yosemite "rootpipe" exploit) and they told me that many security research firms are "on retainer" with intelligence agencies. They didn't share specifics but they said that they have friends who are paid to share exploits with, say, British Intelligence and to not report it to the vendor with the exploit in it.

I assume this is why Stuxnet had so many zero-day exploits in it. The agencies behind it had security firms feeding them.

http://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/

xnull2guest4• 12 years ago

Yes.

The market for 0days has been cooling off in recent years, but for a good decade there you could sell 0days, even mediocre ones for six digits. Nowdays you'll need a pretty good vuln for six digits, and something pretty stellar for seven (this isn't unheard of). ZDI, frsirt and others got into the game as middlemen. They allow(ed) you to not know who the final purchaser is and would allow you to sell 0days that may or may not be interesting to a government entity - in this case ZDI, etc would swallow the cost.

Edit: http://www.vupen.com/english/services/lea-index.php

karmacondon• 12 years ago

I'm not sure if I agree with the ethics of selling security exploits, but it's a world I know very little about. You seem knowledgeable, is there any more information you could share about the business and culture of selling 0days? Like, how many people are doing that full time now (dozens or thousands?). Why do you think that the market slowed down, and do you think that most of the security hackers are trying to sell exploits to the responsible parties or do they expect most of them to go to government and other black hats?

Sorry for the questions, no contact info in your profile. Answers from anyone would also be appreciated.

tptacek8• 12 years ago

What is the least interesting vulnerability whose sale you have firsthand knowledge of that fetched more than $20,000?

Have you personally ever sold a vulnerability?

tptacek8• 12 years ago

Most security research firms have no links whatsoever to intelligence agencies, but every security researcher in the world gossips about those links. Clearly some do, though.

I have no firsthand knowledge of how these connections work (the gossip I hear tends to involve firms proffering vulnerabilities to middleman "commercial" firms --- not ZDI, by the way --- but who knows?). But I'm skeptical of the idea that security research firms are a real feeder for vulnerability intel to NSA, because based on the people NSA spits back out into commercial industry, they appear to have a very, very capable internal research staff.

grkvlt• 12 years ago

But isn't that exactly what a security researcher with links to intelligence agencies _would_ say ;)

wavefunction• 12 years ago

They've been lying so much at this point I don't know what it matters what they say. They were so caught up in seizing power with no regard to the consequences that they forgot that Trust is most precious and fleeting and far more valuable than lying about your law-breaking.

crumpled• 12 years ago

lol, "vast majority". That's like telling your spouse "Most of the time, I don't cheat on you" full-disclosure: I didn't read the article.

paulannesley• 12 years ago

Director of lying overreaching unconstitutional spy agency makes unprovable claim that it's not stockpiling digital weapons. I think I'll skip reading this one.

JBNixx• 12 years ago

I assume they do share the majority of vulnerabilities they find, but keep the top 2% for their own use. By top 2% I mean the vulnerabilities that are highly unlikely to be discovered by other nations.

The other 98% of zero days that are easy enough to stumble upon by foreign cyber units might be better to disclose and get fixed.

If the NSA can find a bug relatively easy, then we can assume China(example) might be able to as well. Getting those bugs fixed is a big gain for national security. Although, it will boost security of all nations.

djcapelis• 12 years ago

So how often do they share bugs? Has anyone seen it happen with any regularity?

nullc2• 12 years ago

Then where are the fixes? They spend untold billions per year... their visible bugfix output is very low, including in low level cryptographic domains that you might expect them to be power-houses.

The claim makes me think either that they're lying about sharing what they find (either intentionally or via institutional stupidity); or they're really inept and not finding much at all compared to much less well funded OSS developers and participants in industry.

It would be interesting for someone to setup a scorecard site to document NSA's infosec contributions.

tptacek8• 12 years ago

Bug volume in crypto is also very low, and the "fixes" to major crypto bugs tend to take the form of entirely new constructions... which users are not happy to get from NSA (this was a problem even in the 1970s!)

So I'm not sure this is a valid critique.

dllthomas• 12 years ago

There was the SHA0 -> SHA1 thing. Which mostly illustrates what you say here, of course, just seemed to deserve mention.

xnull4• 12 years ago

Bug volume in crypto is extremely high. How many developers reuse IVs in stream ciphers? How many blindly use AES or somesuch other symmetric library and then build in no authentication whatsoever? How many antequated implementations of RSA are used in practice today (see recent Bleichenbacher flaw in NSS)? How many times are poor chaining modes for block ciphers chosen? How many implementations of [anything] fail on side cases (elliptic curves) or massively leak through side channels? How many DH-family protocols miss checks for identity inputs?

The answer is a lot.

nullc2• 12 years ago

It's not the NSA that is publishing cryptanalysis of proposed constructions with any frequency compared to industry/academia. Considering the number of mathematicians they employ and their focus on cryptography this is more than a little surprising.

But I did also mean that more broader than just construct attacks..., implementations of cryptosystems are often flawed in low level ways which people without special expertise are unlikely to notice... both from a design perspective (any of the great many protocol design flaws in TLS that have turned around an bitten us), or straight forward coding (e.g. it wasn't the NSA that reported reference implementations of Curve25519 had broken carry propagation).

tedunangst2• 12 years ago

Well, there was that time a tor developer claimed the NSA was leaking him fixes... https://news.ycombinator.com/item?id=8210319

NSA Director Says Agency Shares Vast Majority of Bugs It Finds

Related Stories