Hacker News Reader

Comment by addedlovely | Hacker News Reader

I wander what phones / computers CIA operatives use - do they have special patched versions which address the zero day exploits they are aware of.

View on HN

Doubtful. Part of being an undercover operative means deniability. Imagine if a foreign power arrested a suspected spy, and found non-standard software on their phone.

So they'd probably use off the shelf software and mitigate risks in other ways.

(Ex: not bringing smartphones to sensitive meetings)

This is a great question. Surely they look for vulnerabilities also in their own systems but then what do they do when they find them? Is there some special set of software that always gets patched because the CIA uses it?

> Is there some special set of software that always gets patched because the CIA uses it?

If so, a diff between the "CIA version" and the "civilian version" would be highly instructive.

Presumably the same thing others do when they know about 0-days? Signatures.

Could you explain a bit more? I'm not sure what you mean.

Sure, this is essentially the argument for disclosure of bugs before they've been patched. If I had known about e.g. shellshock before the patch was out, I could have written a Snort signature looking for it in network traffic and have my IPS drop the packets. I do this on my network with bugs I find before the vendor patches them.

This is an example of security through defense in depth; patching is one layer of defense, but if you can't patch there are other mitigating actions you can take to protect against (especially) known threats. It allows someone with an offensive and defensive mission to simultaneously use exploits while not being vulnerable to them.

Reply on news.ycombinator.com