Hacker News Reader

Comment by x0x0 | Hacker News Reader

Holy shit.

   Microsoft Corp. (MSFT), the world’s largest software company, provides 
   intelligence agencies with information about bugs in its popular software 
   before it publicly releases a fix, according to two people familiar with the 
   process. That information can be used to protect government computers and to 
   access the computers of terrorists or military foes.

Microsoft gives US military hackers and the NSA zero days to go hack people with.

I think this helps explain Google's 7-day disclosure. Also, fuck microsoft. Running your mouth and trying to blackball people who don't give you 60 days while (presumably selling) those exploits to governments? Just amazing.

Edit: here [1] is discussion of Tavis Ormandy / Google's new 7 day policy. I really wonder if this was partially driven by eg Microsoft's abhorrent behavior.

[1] http://www.theverge.com/2013/5/30/4379004/google-to-make-cri...

View on HN

Or, they have a MAPP[1] subscription. You too could have information about bugs in Microsoft software before the fix has been released, if you could become a MAPP partner or subscriber.

1. http://www.microsoft.com/security/msrc/collaboration/mapp.as...

If you're in the MAPP program, you promise (on application, and presumably contractually upon membership as well), to:

   Do you agree to publish monthly protections derived from MAPP information 
   only after Microsoft’s public security update release?

I'm doubting the NSA / military hackers make, or honor, any such agreement.

This is very different from your original (hysterical, sensational) claim that MSFT is giving the government "zero days" to "hack people with".

not really

what does msft think they're doing with them?

"The Government" is a huge employer with a massive installation base of Windows systems, many of which contain sensitive information wanted by well motivated attackers. They would be keenly interested in new threats to those systems, the same way that any large corporation with a similar installation base and threat model would.

Ask yourself, if you receive information via MAPP, you have some information which could be turned into an exploit, but it will not be useful towards a goal of hacking other peoples computers for long because, by definition, it is going to be patched soon. "Make hay while the sun shines" perhaps? The same window of opportunity is open to governments and corporations around the world (many Chinese companies are MAPP subscribes, the one leak of a MAPP exploit happened perhaps because of a Chinese company).

The NSA is not known to publish things.

Don't forget their internal 'zine, Cryptolog. There was a story here(1) about how it was recently declassified. Heavily redacted, but still very cool.

http://www.nsa.gov/public_info/declass/cryptologs.shtml

(1) https://news.ycombinator.com/item?id=5407036

That just says you can't publish exploits derived from the ones they've told you about until they've published the original ones themselves. It doesn't say you can't use, abuse and defend against them yourself. You're effectively buying zero days.

Every foreign government and overseas company handling potentially sensitive information should immediately sue Microsoft, in U.S. and foreign courts, for damages.

Well, I don't think this is as bad as you make it out to be. This is fairly standard practice for firms, releasing the knowledge of security holes to customers, especially if a patch isn't prepared.

See the entire Heroku/Postgres for another, less insidious example.

the information is not released publicly. You need to be their partner.

  provides intelligence agencies with information about bugs in its popular software before it *publicly* releases a fix

emphasis mine.

offcourse, bug fixes will be released publicly. No doubt. The prior information of these bugs is what is not released publicly.

You know what surprisingly I am not that outraged by it. Why? Because I was expecting far worse. Installing backdoor for the govt and purposefully leaving an exploit open.. etc. So the govt get a head start with the vulnerabilities that Microsoft knows? Okay.. I am guessing there are far more undisclosed ones in the black market that they can buy off.

It has been alleged that the WMF vulnerability was deliberate: http://en.wikipedia.org/wiki/Windows_Metafile_vulnerability#...

Playing devil's advocate, keep in mind that domestic computer security is part of the NSA's charter. Remember the rainbow books?

It would be completely legitimate for MSFT to warn NSA about vulnerabilities in the most common desktop operating systems in the USA if the warning were intended to aid in preventing a larger attack.

It's a write-only bugtraq. :-)

The head of NSA is also the head of the US military's cybercommand and offensive operations are definitely part of their bottom line.

This intersection between protecting civilians and attacking our military enemies should absolutely worry you, the worst nightmare of 'responsible disclosure' has just been revealed: security updates aren't being rolled out as a matter of official policy, for the explicit purpose of military offensive operations.

Since the head of the NSA is a senior military officer, they are likely to be the most qualified to head the military's computer offense capabilities.

Theoretically, there is presidential and congressional oversight to prevent them from overstepping their bounds. Unfortunately, we've largely squandered the threat of congressional inquiry on blue dresses and cigars.

What I find confusing is that, ultimately, you have to follow the money. How has MSFT been benefiting from a conspiracy to exploit their own software in overseas markets?

They know that embarrassing information will get out eventually. They also have a distant planning horizon regarding continued existence. Whatever they get in return has to have been perceived as worth the loss of any trust and goodwill as a result of the eventual disclosure.

Microsoft are running a "Your privacy is our priority" ad campaign at the moment in the UK (Started before the PRISM story broke)

http://www.microsoft.com/en-gb/security/online-privacy/overv...

Now we know, I would presume, exactly how Stuxnet and Duqu were born...

governments of every other country should shit in their pants after reading this. Stop using MSFT os at this very moment.

I can't believe there's a government anywhere in the world surprised by this news.

There's a difference between baseless speculation and justified paranoia.

I have not seen any statement that MS does not also provide this same info to other governments.

Further evidence that "responsible disclosure" is not responsible.

The EFF notably feels[1] that 'zero-day' exploits should be front and center in cybersecurity debates.

Their stance is that they directly oppose 'green hats' who are selling exploits to customers that don't intend on fixing the flaws (buying a hacker's silence) and selling to governments whom intend on using the exploits for clandestine operations.

[1] https://www.eff.org/deeplinks/2012/03/zero-day-exploit-sales...

"You are not even aware of what is possible. The extent of their capabilities is horrifying. We can plant bugs in machines. Once you go on the network, I can identify your machine. You will never be safe whatever protections you put in place." –Edward Snowden

http://www.guardian.co.uk/world/2013/jun/09/nsa-whistleblowe...

Reply on news.ycombinator.com