Hacker News Reader

Comment by munin | Hacker News Reader

Or, they have a MAPP[1] subscription. You too could have information about bugs in Microsoft software before the fix has been released, if you could become a MAPP partner or subscriber.

1. http://www.microsoft.com/security/msrc/collaboration/mapp.as...

View on HN

If you're in the MAPP program, you promise (on application, and presumably contractually upon membership as well), to:

   Do you agree to publish monthly protections derived from MAPP information 
   only after Microsoft’s public security update release?

I'm doubting the NSA / military hackers make, or honor, any such agreement.

This is very different from your original (hysterical, sensational) claim that MSFT is giving the government "zero days" to "hack people with".

not really

what does msft think they're doing with them?

"The Government" is a huge employer with a massive installation base of Windows systems, many of which contain sensitive information wanted by well motivated attackers. They would be keenly interested in new threats to those systems, the same way that any large corporation with a similar installation base and threat model would.

Ask yourself, if you receive information via MAPP, you have some information which could be turned into an exploit, but it will not be useful towards a goal of hacking other peoples computers for long because, by definition, it is going to be patched soon. "Make hay while the sun shines" perhaps? The same window of opportunity is open to governments and corporations around the world (many Chinese companies are MAPP subscribes, the one leak of a MAPP exploit happened perhaps because of a Chinese company).

That just says you can't publish exploits derived from the ones they've told you about until they've published the original ones themselves. It doesn't say you can't use, abuse and defend against them yourself. You're effectively buying zero days.

The NSA is not known to publish things.

Don't forget their internal 'zine, Cryptolog. There was a story here(1) about how it was recently declassified. Heavily redacted, but still very cool.

http://www.nsa.gov/public_info/declass/cryptologs.shtml

(1) https://news.ycombinator.com/item?id=5407036

Reply on news.ycombinator.com