US Government Fears Another Explosion Of The Ransomware Plague It Helped Create

It's vastly faster and more reproducible, enough so as to make it a different environment with different considerations.

It's more akin to manufacturing portable arms factories, that can also replicate themselves.

Lose one and you're SOL.

If the vulnerability had come from Google Project Zero, the same worm could have been created. The only difference is a lower barrier to entry, but with enough malware authors out there, even GPZ's descriptions are enough to cause vulnerabilities to turn into exploits in the wild. Why does the discoverer of a vulnerability matter if the vulnerability was patched before it was publicly announced?

Physical objects take dollars and time to design and produce at scale. Most of these vectors take time to design and money for living and the initial computer, but the implementation of them takes almost no money nor time (ok, yes a few miliseconds and the electrical power, but it's basically nothing). Corey Doctorow has said it best : "A lot of threat modeling is based on something like economic rationality by your adversary: you assume that no one would spend $10 to steal $1 from you. But with nitwits, all bets are off: this isn't about designing a safe to keep out a smart mastermind cat-burglar, it's trying to figure out if a drunk and belligerent dudebro will walk up to you on the street and punch you in the face to blow off some pent-up hormonal steam."

(https://boingboing.net/2017/05/13/heroism-through-domain-squ...)

There isn't one. Report the vulnerabilities to the vendor and move on. The trade off is too dangerous. Do you stockpile munitions that can damage global infrastructure so you can target a small number of individuals? No that's just stupid and irresponsible.

Is there any legitimate reason to hold 0 days without disclosing them to the vendor? There probably are reasons I haven't thought of, but do they apply to as active a company as Microsoft?

Edit: I think I misread this and you're asking in the context of the NSA holding them. I still doubt there's a way to do it responsibly, so they probably shouldn't be doing it.

I would say there is a difference between having a bare-bones proof of concept and a fully developed malware.

>>What do you think the best policy is for maintaining an effective arsenal and maintaining "0day responsibility"?

I think the best policy is for them to not maintain an "effective arsenal" at all, the second they find a vulnerability they should report it.

NSA is also responsible for the defense of government computer systems and communications. There may be a duty there, to ensure email from a the government is virus free. If someone can show their worm came from a .gov address, there might be something there.

The NSA made the dangerous part of the weapon, and then they lost it. They knew they lost it, and didn't do enough to harden fed computers. The government isn't allowed to just randomly attack someone, but attacked my hypothetical person that can prove the attack vector anyway.

Of course, i'm not a lawyer.

Them working with the industry on making your country secure doesnt seem like a bad alternative.

I agree, but I also think it's an incomplete answer to the situation.

I think that it's unreasonable to expect there not to be some sort of acting technology strike force within the US government, on the sole basis that they wouldn't let themselves fall behind as a super power in this manner. For the sake of one-upmanship alone I imagine this is happening. But as to what it should be doing? That needs to be reviewed.

Cyber weapons aren't traditional weapons - cyber weapons are nigh-infinitely replicable, easier to lose control over, fast and easy to redistribute, and they're just as harmful to US civilian targets as they are to political/miiltary targets. They're unconventional warfare in that once you let it go, it's almost impossible to reel it back in, and the current state of technology just lends itself to so much collateral damage by the nature of software dependencies. A lot of places have no control over the dependencies for their mission critical software, and either no money for better alternatives or legitimately no alternative.

Cyber weapons are going to be a weird thing for a very long time, since they have the same uncontrollable nature that a lot of banned weapons have, but they don't have the same immediate impact or lasting effect [1] that munitions, chemicals, and so on have. The lack of an immediate real world impact (read: a 'boom' or something toxic) is going to make it a challenge for people to see how damaging this an really be.

[1] - I mark this because I think it's arguable how lasting the impact for any given bit of malware can be. There can be a lot of long-lasting damage if major infrastructure pieces are targeted, or downing entire networks, ruining small to medium businesses, and so on.

Elected officials in charge of the NSA isn't a desirable result. They will just replace the leaders with people loyal to them and we're in the same situation.

> No one knew about it before them.

That we know of, it's entirely possible that other governments have been using the same exploit and that this could have been prevented with NSA disclosure.

Could not the president easily issue an executive order asking NSA to use the hack to protect everyone?

The commentary within the metasploit module for MS17-010 [1] should count for posting 'a reverse engineering' or at least some meaningful analysis of moving parts within EternalBlue SMB exploit.

The researchers involved are @zerosum0x0 and @JennaMagius on twitter. Their work has been impressive (including eliminating a 10 second delay in some of the exploit chain iirc) if you ask me.

Of course I don't disagree with the content of your post - it does appear that the release of a working exploit has driven the release of this malware, rather than the release of the MS patch, or a description of the vulnerability in general (such as within the CVE).

[1] https://github.com/RiskSense-Ops/MS17-010

> the $30k in bitcoin ransoms people have ponied up?

Smokescreen for your $N if you're a rogue agent selling your exploits to another organization - or simply claiming some part of the ransomware pie? Just because the NSA as an organization is paying the price, doesn't mean you as an individual agent are.

Of course, this requires the gumption to think you'll get away with it.