13 ms·

The FBI is working hard to keep you unsafe

93 points by colincarter41 10y ago

guard-of-terra 10y ago
"Terrorists hurt you, so we have to hurt you to compensate".
busterarm 10y ago
Let's not forget that Sabu, while an informant for the FBI, supplied Jeremy Hammond with the 0day that he used to hack Stratfor et al. No 0day, no Stratfor hack. No FBI, no Stratfor hack. Sometimes I wonder if penetrating other agencies and corporations was part of their gameplan. The FBI were entirely behind the formation of antisec. Aside: Other interesting observation... The FBI and Apple seem to have an odd antagonistic relationship with one another. One of the Antisec hacks was against an FBI laptop that caused the release of millions of Apple users' data. The FBI was recording and debriefing Sabu every day. How did they allow that to happen?
- ryanlol 10y ago
  AFAIK that's not true, Hammond received the "0day" (mysql server with auth turned off) directly from hyrriiya on crytonet.
  - busterarm 10y ago
    And there's a chatlog where Sabu asked hyrrilya to give him (and I'm assuming by extension then Hammond, which he claimed in his defense) access to Stratfor. Good correction though. I care a lot less about the technical details with this case than the social/sociopolitical ones.
rm_-rf_slash 10y ago
Let's all accept a depressing fact: effective cyber-security places all of us in a state of perpetual war. You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries, whether they know it or not. We cannot simply fork their nation's Github repo and try out zero-days in a safe and isolated environment. We shouldn't be so quick to rail against government zero-day stockpiling. It is likely that other branches of government are using these flaws for their own means to monitor foreign states and other entities. If we give up that power we risk crippling our offensive capabilities more than we might stand to gain by having a stronger defense. I cannot vouch for one side or the other. I am not a senior intelligence official and I do not have all the facts.
- busterarm 10y ago
  http://www.alternet.org/news-amp-politics/why-idea-big-cyber-attack-could-create-huge-tech-armageddon-pure-bs http://www.alternet.org/news-amp-politics/why-idea-big-cyber... http://dickdestiny.com/blog1/?p=913 http://dickdestiny.com/blog1/?p=913
  - rm_-rf_slash 10y ago
    If you re-read my comment you will find nothing that suggests catastrophic cyber warfare is a major threat. The real threat is a death of a thousand cuts. Trade secrets, troop movements, active spies, little snippets of information that can cause a lot of trouble if put in the wrong hands.
    - busterarm 10y ago
      And our government shares a ton of information with contractors who are not 'in the know' about these vulnerabilities. If they truly cared about this, they would push vendors to plug the leaks that they know about.
- coroutines 10y ago
  > You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries... I'm sorry but this just sounds unethical and wrong. So much can be learned passively. This is a good read: https://www.nostarch.com/silence.htm https://www.nostarch.com/silence.htm
tptacek 10y ago
We don't accept this argument when it's turned on independent researchers. Researching vulnerabilities doesn't create vulnerabilities --- bad software engineering does.
- kabdib 10y ago
  Independent researchers usually disclose, yes? Hopefully responsibly. There are no silver bullets. We're always going to have bugs, and bad ones that affect security. Stockpiling of zero-days blurs the line between law enforcement and adversary. The greater good is probably served by disclosure, rather than surveillance, break-ins or advancement of the careers of prosecutors.
  - tptacek 10y ago
    No, many researchers do not disclose. Every time Hacker News (incorrectly) takes the line that Facebook or Google isn't paying enough for a bug bounty, they're acknowledging that.
    - diafygi 10y ago
      Then they're not researchers, right? I feel like "researchers" should be synonymous with white hats, and disclose to the company when they find something. People who find something and don't disclose are black hats, or at least grey hats, but definitely shouldn't be considered researchers.
      - tptacek 10y ago
        "Researchers" here is a term of art in the field; for the most part, vulnerability researchers are not researchers in the academic sense, but rather in the newsgathering sense.
      - kenperkins 10y ago
        People who find vulnerabilities purely for the bounty seem to fit the classical definition of Bounty Hunters or Mercenaries. Certainly not researches. They're not in it for the academic benefit or advancing the state of the art. They're in it for the cash.
lasermike026 10y ago
"Power tends to corrupt, and absolute power corrupts absolutely." - John Emerich Edward Dalberg-Acton
chatmasta 10y ago
As long as software exists, by definition, zero-days will exist. A zero-day is simply a bug in its most nascent state; one person has found it, and nobody else knows about it. Whether the finder is a "security researcher," a "blackhat," or a "nation-state" has no impact on whether the bug exists or not. In fact, the bug exists even if nobody finds it! The distinction of who found it, and what they do with it, is purely political. Anyone can still exploit the bug. Sure, maybe the "friendlier" bug finders will responsibly disclose any bugs they find. But there will never be a way to guarantee that all bugs found will be responsibly disclosed. Even if we convince the FBI/NSA to "responsibly disclose" every bug they find (will never happen), what about every other country? The hundreds of security firms? The thousands of independent hackers and "researchers?" Zero-days will ALWAYS exist. Software will ALWAYS be exploitable. Worrying about how people react when they find those exploits is the similar to arguing about gun control. Sure, maybe we can convince some actors to responsibly disclose, but the bad actors will always keep the exploits for themselves and use them "irresponsibly." And there will always be bad actors. So instead of fretting about what happens when someone finds a bug, why don't we prepare for the eventuality that all bugs will be found and exploited, often times without anyone's knowledge? Why don't we build security systems to be tolerant of exploits, instead of resistant to them? There is no security panacea, just as there is no reliability panacea. We build distributed systems with the assumption that nodes will fail, and we call that "fault tolerance." We don't say a system is broken because a node fails. We say it's broken if it cannot handle a node failing. Why can't we do the same for our security systems? Exploits are as inevitable as any type of system failure. We need to design for exploit tolerance with the same enthusiasm we design for fault tolerance.
- ccvannorman 10y ago
  Wow - well said. I have often said that modern computer security is akin to trying to float on the ocean in a sieve while constantly plugging each hole in the sieve all the time. I think the world is ready for a new kind of computer. Want to start a company? ;-]
  - nickpsecurity 10y ago
    Look up CHERI processor and CHERIBSD at Cambridge. Look up Gaisler Leon3/4 SOC. License them, port CHERI tech to Leon, add capability-aware IOMMU, add TRNG, add ROM for main bootloader, fab the joker, and you got critical part of a secure computer. Clone Tandem Nonstop lockstep tech if you want fault-tolerance. And there you go. A secure PC for only a few million dollars with BSD support. Optionally port EROS microkernel w/ jVPS filesystem for stronger solution.

93 points by colincarter41 10y ago

"Terrorists hurt you, so we have to hurt you to compensate".

Let's not forget that Sabu, while an informant for the FBI, supplied Jeremy Hammond with the 0day that he used to hack Stratfor et al. No 0day, no Stratfor hack. No FBI, no Stratfor hack. Sometimes I wonder if penetrating other agencies and corporations was part of their gameplan. The FBI were entirely behind the formation of antisec. Aside: Other interesting observation... The FBI and Apple seem to have an odd antagonistic relationship with one another. One of the Antisec hacks was against an FBI laptop that caused the release of millions of Apple users' data. The FBI was recording and debriefing Sabu every day. How did they allow that to happen?

ryanlol 10y ago
AFAIK that's not true, Hammond received the "0day" (mysql server with auth turned off) directly from hyrriiya on crytonet.
- busterarm 10y ago
  And there's a chatlog where Sabu asked hyrrilya to give him (and I'm assuming by extension then Hammond, which he claimed in his defense) access to Stratfor. Good correction though. I care a lot less about the technical details with this case than the social/sociopolitical ones.

rm_-rf_slash 10y ago

Let's all accept a depressing fact: effective cyber-security places all of us in a state of perpetual war. You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries, whether they know it or not. We cannot simply fork their nation's Github repo and try out zero-days in a safe and isolated environment. We shouldn't be so quick to rail against government zero-day stockpiling. It is likely that other branches of government are using these flaws for their own means to monitor foreign states and other entities. If we give up that power we risk crippling our offensive capabilities more than we might stand to gain by having a stronger defense. I cannot vouch for one side or the other. I am not a senior intelligence official and I do not have all the facts.

busterarm 10y ago
http://www.alternet.org/news-amp-politics/why-idea-big-cyber-attack-could-create-huge-tech-armageddon-pure-bs http://www.alternet.org/news-amp-politics/why-idea-big-cyber... http://dickdestiny.com/blog1/?p=913 http://dickdestiny.com/blog1/?p=913
- rm_-rf_slash 10y ago
  If you re-read my comment you will find nothing that suggests catastrophic cyber warfare is a major threat. The real threat is a death of a thousand cuts. Trade secrets, troop movements, active spies, little snippets of information that can cause a lot of trouble if put in the wrong hands.
  - busterarm 10y ago
    And our government shares a ton of information with contractors who are not 'in the know' about these vulnerabilities. If they truly cared about this, they would push vendors to plug the leaks that they know about.
coroutines 10y ago
> You cannot learn from your enemy without invasive action, and you cannot test your capabilities without constantly attacking your adversaries... I'm sorry but this just sounds unethical and wrong. So much can be learned passively. This is a good read: https://www.nostarch.com/silence.htm https://www.nostarch.com/silence.htm

tptacek 10y ago

We don't accept this argument when it's turned on independent researchers. Researching vulnerabilities doesn't create vulnerabilities --- bad software engineering does.

kabdib 10y ago
Independent researchers usually disclose, yes? Hopefully responsibly. There are no silver bullets. We're always going to have bugs, and bad ones that affect security. Stockpiling of zero-days blurs the line between law enforcement and adversary. The greater good is probably served by disclosure, rather than surveillance, break-ins or advancement of the careers of prosecutors.
- tptacek 10y ago
  No, many researchers do not disclose. Every time Hacker News (incorrectly) takes the line that Facebook or Google isn't paying enough for a bug bounty, they're acknowledging that.
  - diafygi 10y ago
    Then they're not researchers, right? I feel like "researchers" should be synonymous with white hats, and disclose to the company when they find something. People who find something and don't disclose are black hats, or at least grey hats, but definitely shouldn't be considered researchers.
    - tptacek 10y ago
      "Researchers" here is a term of art in the field; for the most part, vulnerability researchers are not researchers in the academic sense, but rather in the newsgathering sense.
    - kenperkins 10y ago
      People who find vulnerabilities purely for the bounty seem to fit the classical definition of Bounty Hunters or Mercenaries. Certainly not researches. They're not in it for the academic benefit or advancing the state of the art. They're in it for the cash.

lasermike026 10y ago

"Power tends to corrupt, and absolute power corrupts absolutely." - John Emerich Edward Dalberg-Acton

chatmasta 10y ago

As long as software exists, by definition, zero-days will exist. A zero-day is simply a bug in its most nascent state; one person has found it, and nobody else knows about it. Whether the finder is a "security researcher," a "blackhat," or a "nation-state" has no impact on whether the bug exists or not. In fact, the bug exists even if nobody finds it! The distinction of who found it, and what they do with it, is purely political. Anyone can still exploit the bug. Sure, maybe the "friendlier" bug finders will responsibly disclose any bugs they find. But there will never be a way to guarantee that all bugs found will be responsibly disclosed. Even if we convince the FBI/NSA to "responsibly disclose" every bug they find (will never happen), what about every other country? The hundreds of security firms? The thousands of independent hackers and "researchers?" Zero-days will ALWAYS exist. Software will ALWAYS be exploitable. Worrying about how people react when they find those exploits is the similar to arguing about gun control. Sure, maybe we can convince some actors to responsibly disclose, but the bad actors will always keep the exploits for themselves and use them "irresponsibly." And there will always be bad actors. So instead of fretting about what happens when someone finds a bug, why don't we prepare for the eventuality that all bugs will be found and exploited, often times without anyone's knowledge? Why don't we build security systems to be tolerant of exploits, instead of resistant to them? There is no security panacea, just as there is no reliability panacea. We build distributed systems with the assumption that nodes will fail, and we call that "fault tolerance." We don't say a system is broken because a node fails. We say it's broken if it cannot handle a node failing. Why can't we do the same for our security systems? Exploits are as inevitable as any type of system failure. We need to design for exploit tolerance with the same enthusiasm we design for fault tolerance.

ccvannorman 10y ago
Wow - well said. I have often said that modern computer security is akin to trying to float on the ocean in a sieve while constantly plugging each hole in the sieve all the time. I think the world is ready for a new kind of computer. Want to start a company? ;-]
- nickpsecurity 10y ago
  Look up CHERI processor and CHERIBSD at Cambridge. Look up Gaisler Leon3/4 SOC. License them, port CHERI tech to Leon, add capability-aware IOMMU, add TRNG, add ROM for main bootloader, fab the joker, and you got critical part of a secure computer. Clone Tandem Nonstop lockstep tech if you want fault-tolerance. And there you go. A secure PC for only a few million dollars with BSD support. Optionally port EROS microkernel w/ jVPS filesystem for stronger solution.