US Navy Soliciting Zero Days

https://threatpost.com/us-navy-soliciting-zero-days/113308

by mo • 11 years ago

82 53 11 years ago

What exactly should we do with this information? It's clear there's a cyber war heating up. Between Stuxnet, the US gov's OPM getting hacked, kaspersky getting attacked, it's become pretty obvious. And since there's seemingly no need to declare such a war before doing it, it'll only get hotter.

So what do we do? Is it time to just start running open-bsd? Should I just assume my systems won't be a casualty because it won't get that hot? Air gap the important part?

Zigurd• 11 years ago

It's the cyberwar equivalent of soliciting engineered microbes for which there is no vaccine or treatment. How long would anyone put up with that?

arca_vorago5• 11 years ago

Don't you get it. The cyberwar isn't "heating up", what "cyberwar" exists has existed since the 90's. Yes technological pervasiveness is making vulnerabilities being taken advantage of hit larger swaths of devices, but that's not why you see the heating up of the arena.

The real reason is that we need a new boogieman to justify the level of surveillance. The public, as deluded and propagandised as they are, is starting to get tired of the same ol terrorism argument, so this is the new communism/terrorism, etc.

The point is that it's never about what they say it's about. It's about control. Inverted totalitarianism.

harkyns_castle8• 11 years ago

Not just surveillance, we also need a reason to keep the war machine going. And there'll be demands for more money for national security after this. Ad infinitum until there's a revolt or some kind of political evolution in the states.

That fiat cash will get tucked away by some established families and companies, revolving doors aplenty, and then a new threat will be invented/created when this one wears out. The Fed, or the people behind it, will sit back with their hands crossed on their fat, corrupt bellies and say, well, at least we'll enjoy the planet while we live. Screw the rest.

brador• 11 years ago

Control for what purpose?

justonepost• 11 years ago

If by "has existed" you mean to say that there were people who attacked computers in the 90s, yes, that's technically correct. However - I think the parent post was trying to say rather than 100s of millions being spent worldwide on this, 100s of billions are now being spent.

themeek3• 11 years ago

The control is not always in the hue of totalitarianism or evil or malice.

Some control is necessary of any government.

Some control is perceived to be, but is not actually, necessary.

Some control is self-interested and self-concerned.

Some control is conspired by those who seek to wield it for their own benefit.

When it comes to the US government, there's a big mix of the above and its never enough to establish one grand motive behind everything.

This of course doesn't take away your point - it is about power. It's just that the angle on this power has to be negotiated circumstantially and available alternatives. (If there's an simple, cheap and effective way to solve a problem but a power consolidating method is chosen instead the mask has slipped).

hellameta3• 11 years ago

Can someone "ELI5" this to me? How is it possible that in the Western world there is a collective 'they' that are doing this? It seems more reasonable that the behavior we dislike is emergent. Anyone working in even a medium-sized company knows that it couldn't possibly collude to get out of its own way. How is it that the US government can do it? Who is this magical 'they' we keep blaming and criticizing? Sorry if I'm being dense - sincerely trying to understand.

wahsd3• 11 years ago

Sorry to break it to you, but air gapping is not really an impediment for a determined adversary.

zaphar• 11 years ago

Neither is paper only storage. But it's still going to make it harder for the adversary than being connected to the internet.

Security is all about striking a balance between how hard you make it for the adversary vs how hard you make it for yourself.

Even committing only to memory and never writing it down is not going to stop a committed enough adversary kidnapping and torture do exist after all. The only question is where do you want to draw the line.

sliverstorm• 11 years ago

It occurs to me that zero days are kind of like lethal force. We would really rather the government have none, but it must to deal with defense. It could be levied at us, but we usually believe it won't.

Does that mean we need a Second Amendment for encryption?

themartorana2• 11 years ago

$27.5m fixed bid for a 24 month contract. That's extremely good work if you can get it.

pmorici• 11 years ago

It doesn't say that. the number $27.5 million is the cut off for a business to be considered a "small business" which would receive special considerations under the law.

themartorana2• 11 years ago

Ah. You're right. Thanks for that.

sailfast• 11 years ago

Does anyone have a link to the original solicitation?

tempodox• 11 years ago

Why not 0 seconds, instead of 0 days? I didn't think you can buy time anywhere, but why the gratuitous use of the “days” unit when the quantity is zero anyway?

Still, a gov't agency would surely pay plenty, even for nothing at all, so what's the going rate for “no time at all” these days?

ugexe2• 11 years ago

0 seconds sounds stupid and is being pedantic, especially as Wikipedia even says zero days are also referred to as 0 hours

pjc50• 11 years ago

"Zero hour" has a specific, different meaning though.

userbinator• 11 years ago

A "0day" is a noun. I still remember when it was commonly used to refer to warez releases, but now it seems it's been used to refer more to exploits... the times have changed.

https://en.wikipedia.org/wiki/Zero-day_(computing)

aric• 11 years ago

Days convey immediacy and scale. "Today" and "same day" balance precision. If time between an exploit becoming known and fixed consistently happened in 100 seconds or less, 0-sec might sound ok. Come to think of it, 0-sec is a fitting pun.

bentcorner• 11 years ago

"0-sec" isn't too bad, but the plural can make for awkward conversation.

vaadu• 11 years ago

This is why the mission of securing America's networks needs to be removed from the NSA.

“What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,” wrote Nate Cardozo and Andrew Crocker of the Electronic Frontier Foundation. “As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”

wahsd3• 11 years ago

To be fair, they don't monitor whether the 0Day exploits are widely used so they have no idea when they should make them public for general security purposes. (yes, that's sarcasm)

But the way the entities operate that are actually seeking these, is by thinking of themselves as outside of the regular set of rules and even reality. They are seeking 0Day exploits with an assumption that the individual or individuals that provide them will not sell them to someone else or even use them for themselves.

I can guarantee that these "cyber wars" are going to result in some sort of cluster-fuck-up at some point because humans have a tendency to entrust the least responsible people with the most devastating technologies even remotely before we fully understand the ramifications.

On a side note; please take note of the fact that many of the current issues regarding anonymity and security on the internet and in technology in general is a direct fractal result of prior decisions by researchers and developers to not focus on anonymity and security as a primary requirement. The internet is a security nightmare, precisely because some researchers decided to ignore security requirements early on.

jallmann• 11 years ago

This is why the mission of securing America's networks needs to be removed from the NSA.

And who should be responsible for this mission? Are you saying that the offensive and defensive cyber capabilities should be split between different agencies?

“What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities,”

The article mentions that the government itself acknowledges that there is a delicate balance between disclosure and maintaining the ability to accomplish other missions [1]. That dilemma never going away, no matter how the responsibilities are organized.

“As we’ve explained before, the decision to use a vulnerability for ‘offensive’ purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.”

Haven't read the EFF paper yet (and I hold the EFF in high regard), but in the context of zero-days, that quote is a bit of a strawman. You don't burn zero-days by indiscriminately propagating exploits (eg, for mass surveillance), it would be found out pretty quickly. You tap cables and get NSLs for mass surveillance. Payloads attached to a zero-day would be used for more specific purposes, rather than slurping up data en masse.

[1] https://www.whitehouse.gov/blog/2014/04/28/heartbleed-unders...

Kalium• 11 years ago

And who should be responsible for this mission? Are you saying that the offensive and defensive cyber capabilities should be split between different agencies?

In theory, they already are. The Navy, Air Force, Army, and NSA all maintain somewhat separate cyber capabilities.

harkyns_castle8• 11 years ago

Didn't foresee all this nonsense when I started to enjoy IT back in the younger days.

Wish I didn't see it now either. What a mess. Long live the petrodollar and killing other humans for a fiat currency.

wahsd3• 11 years ago

Just to be clear, this is not really the Navy as most of you think of it that is seeking this.

BuildTheRobots• 11 years ago

Site seems overloaded. Link for the lazy: https://web.archive.org/web/20150615233609/https://threatpos...

harkyns_castle8• 11 years ago

Give it some more time, all dissenting posts will be greyed out hehe.

smegel• 11 years ago

I find it really strange the Navy is doing this. Does it actually have an intelligence wing capable of taking advantage of this? And if you thought the NSA was the cyber intelligence wing of the DoD, so did I.

ethanbond• 11 years ago

Considering the Navy (Naval Research Laboratory) built TOR...

modoc• 11 years ago

The ONI (Office of Naval Intelligence) is the US's OLDEST Intelligence agency, so yes.. :)

dsl• 11 years ago

What you are seeing is the so called "black budget" at work. Money is allocated for say, the NSA, to get 10 new exploits but the actual funds go to the Navy or Air Force who handle the procurement process. Sometimes the supplier doesn't even know who is receiving the final product.

US Navy Soliciting Zero Days

Related Stories