U.S. Gov Insists It Doesn’t Stockpile Zero-Day Exploits

H

HardOCP News

[H] News
Joined
Dec 31, 1969
Messages
0
Our government swears it isn't stockpiling zero-day exploits to hack our enemies. You know, because they have their hands full exploiting average citizens. ;)

For years the government has refused to talk about or even acknowledge its secret use of zero-day software vulnerabilities to hack into the computers of adversaries and criminal suspects. This year, however, the Obama administration finally acknowledged in a roundabout way what everyone already knew—that the National Security Agency and law enforcement agencies sometimes keep information about software vulnerabilities secret so the government can exploit them for purposes of surveillance and sabotage.
Click to expand...
 
can i sell you an exploitless cellphone in america? NOPE will microsoft ship windows without govt backdoors? NOPE can we ever have another phone conversation that dsps aren't transcribing and cataloging? NOPE...

Move on this ship has sailed
 
Not stockpiling zero-day exploits would be tying the government's hands behind it's back!

Mitch McConnell said:
“This is the worst possible time to be tying our hands behind our backs,” Mr. McConnell said before the vote [on the USA Freedom Act], expressing the concerns of those who argued that the program was a vital tool in the fight against terrorism.
Click to expand...

Good thing we had that Republican landslide...

Republicans: 4 Yays, 41 Nays
Democrats: 52 Yays, 1 Nay
Independents: 2 Yays
 
TwistedAegis said:
Not stockpiling zero-day exploits would be tying the government's hands behind it's back!



Good thing we had that Republican landslide...

Republicans: 4 Yays, 41 Nays
Democrats: 52 Yays, 1 Nay
Independents: 2 Yays
Click to expand...

The privacy versus security debate has always been a pendulum. In the summer of 2013 after the release of the Snowden information, the pendulum had swung as for from the opposite side of security probably since 9/11. With mad men chopping off heads and the Ebola outbreak, the pendulum has inevitably swung towards the middle again.
 
TwistedAegis said:
Not stockpiling zero-day exploits would be tying the government's hands behind it's back!



Good thing we had that Republican landslide...

Republicans: 4 Yays, 41 Nays
Democrats: 52 Yays, 1 Nay
Independents: 2 Yays
Click to expand...

Know why? I bet the mainstream media didn't tell. It was specifically because there was an 2 year extension to the Patriot Act amended into it. There was a major push among Republicans and libertarians to keep this from passing because it would extend the Patriot Act. If that amendment were removed, it would pass.

Of course, the Democrats didn't want that removed. It was a Democrat that added it to this bill. They've been using some aspects of it for political advantage.
 
Pretty sure that isn't why Senate leadership voted against it; they specifically wanted the NSA to keep that ability. A few voted no, like Rand, due to that reason. But the majority didn't want any rollback at all. In fact, an op-ed against it was titled something along the lines of, "The Reform ISIS would want". Scare tactics much?
 
They aren't zero days if nobody knows about them (besides them). See, totally innocent.
 
Aren't these the same creeps that insisted they don't collect cellphone metadata or read everyone's emails? I think there's a credibility problem here.
 
Why don't we just start our hacker army like china? Oh right, they aren't smart enough for that.
 
Skripka said:
Aren't these the same creeps that insisted they don't collect cellphone metadata or read everyone's emails? I think there's a credibility problem here.
Click to expand...

I bet you're onto something. I'm sure they have enough people employed to sift through 319 million Americans' emails.
 
This is TOTAL 100% fucking bullshit

NSA was openly using the Heartbleed bug for ages, and was WELL aware of it to protect their own systems from the flaw, and after the Heartbleed bug was shown and everyone patched it, information came out they were USING it and deemed it an "Acceptable risk" to the public's safety so they could use it to get into other peoples systems

This is total 100% without a fucking doubt bullshit, US Gov does use zero day exploits.
 
ShamisOMally said:
This is TOTAL 100% fucking bullshit

NSA was openly using the Heartbleed bug for ages, and was WELL aware of it to protect their own systems from the flaw, and after the Heartbleed bug was shown and everyone patched it, information came out they were USING it and deemed it an "Acceptable risk" to the public's safety so they could use it to get into other peoples systems

This is total 100% without a fucking doubt bullshit, US Gov does use zero day exploits.
Click to expand...

QFT
 
Steve said:
Our government swears it isn't stockpiling zero-day exploits to hack our enemies. You know, because they have their hands full exploiting average citizens. ;)
Click to expand...

Their claim is 100% false, since the way they DO stockpile them is through contracts, which by law are the property OF the united states government. Try not fulfilling your contract, and you get sued. There is tons of case law to support it. So if you are an independant working on a contract FOR THE US GOVT, but NOT a US GOVT employee, they will still charge you AS A US GOVT EMPLOYEE, then by legal case law, the US GOVT does stockpile zero day exploits.
 
Steve said:
Our government swears it isn't stockpiling zero-day exploits to hack our enemies. You know, because they have their hands full exploiting average citizens. ;)
Click to expand...

Didn't we burn something like 4 with Stuxnet? The "smoke 'em if you get 'em" policy has never been too prevalent in our government when it comes to strategic advantages. I'm sure it's like the digital equivalent of Scrooge McDuck swimming in his money tower with the stockpile of zero days they still have.
 
Did we all read the same articles on this? I didn't read this one specifically but this is news from earlier in the week or last week. They said they do use zero-day exploits and don't release them all, but they do not stockpile them in large numbers as people believe. For example heartbleed is one, not thousands stockpiled. They use a few it sounds like and they admitted to it but its not "stockpiles" or an exaggerated amount.
 
jroe52 said:
Did we all read the same articles on this? I didn't read this one specifically but this is news from earlier in the week or last week. They said they do use zero-day exploits and don't release them all, but they do not stockpile them in large numbers as people believe. For example heartbleed is one, not thousands stockpiled. They use a few it sounds like and they admitted to it but its not "stockpiles" or an exaggerated amount.
Click to expand...

What is a "stockpile" though? I think many in InfoSec would agree that a dozen would be a stockpile when it comes to zero day exploits.
 
"I did not have sexual relations...". Politicians can twist words around to make them technically true. They don't stockpile. Technically, they could have a few, but it's not the same as stockpiling thousands of nukes. So, it's not stockpiling. It's saving a few for later. You know, for our safety.
 
d50man said:
can i sell you an exploitless cellphone in america? NOPE will microsoft ship windows without govt backdoors? NOPE can we ever have another phone conversation that dsps aren't transcribing and cataloging? NOPE...

Move on this ship has sailed
Click to expand...

Who's dsps?
 
Skripka said:
Aren't these the same creeps that insisted they don't collect cellphone metadata or read everyone's emails? I think there's a credibility problem here.
Click to expand...

I think there is a basic misunderstanding of what SECRET means.
 
ShamisOMally said:
This is TOTAL 100% fucking bullshit

NSA was openly using the Heartbleed bug for ages, and was WELL aware of it to protect their own systems from the flaw, and after the Heartbleed bug was shown and everyone patched it, information came out they were USING it and deemed it an "Acceptable risk" to the public's safety so they could use it to get into other peoples systems

This is total 100% without a fucking doubt bullshit, US Gov does use zero day exploits.
Click to expand...

Shamus, did you miss that they admitted that they use them?
 
SS_Wehrwolf said:
Their claim is 100% false, since the way they DO stockpile them is through contracts, which by law are the property OF the united states government. Try not fulfilling your contract, and you get sued. There is tons of case law to support it. So if you are an independant working on a contract FOR THE US GOVT, but NOT a US GOVT employee, they will still charge you AS A US GOVT EMPLOYEE, then by legal case law, the US GOVT does stockpile zero day exploits.
Click to expand...

Nooo, this is 100% bullshit. A Contractor working for the Government does have to follow the same rules and laws as the Government themselves. Are there differences, yes, but the Government can't just hire Contractors to do things that would be illegal for them to do themselves.

I know, I Am a contractor.
 
It doesn't count as stockpiling if they actively use them as soon as they find them...
 
I sure wish we lived in a perfect world where all governments had total transparency and there was never any need for anything like this.

But even if the US Government decided to never do anything like this ever again, it sure as shit wouldn't stop Russia, China, and a dozen other shit countries from continuing to do so.

I for one, am not in any great hurry to have my country put at a disadvantage when it comes to the way the world actually works.
 
lcpiper said:
Nooo, this is 100% bullshit. A Contractor working for the Government does have to follow the same rules and laws as the Government themselves. Are there differences, yes, but the Government can't just hire Contractors to do things that would be illegal for them to do themselves.

I know, I Am a contractor.
Click to expand...

Who said anything about it being illegal? Its not illegal. What i said was this is how they get around CLAIMING they personally do not, when in fact contractors DO save and come up with zero day exploits on a daily basis.

So yes, it IS bullshit as they are employed by the US GOVT.
 
You must log in or register to reply here.
Back
Top