Comment by higherpurpose | Hacker News Reader

Comment by higherpurpose | Hacker News Reader

Remember, Microsoft is part of this plot, even if they have "plausible deniability". Microsoft is giving NSA access to lists of vulnerabilities Windows has many months before Microsoft even begins to work on a fix. They are in effect helping NSA break into many computers, even if they are up to date.

http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t...

Every single one of these vulnerabilities could be seen as a backdoor, except Microsoft can have plausible deniability, since they are not actually putting a backdoor in the OS themselves - they're "just telling NSA about the vulnerabilities that exist".

If something like CISPA passes, which NSA keeps pushing for, this capability will expand dramatically, as all companies will be forced to give these vulnerabilities to NSA, but not to "protect us" and for cyber "security", as they keep claiming when they try to promote laws like these, but for offense. They will hoard every single one of them, and then use them in such automated systems to infect millions of computers.

No. None of this is accurate.

Microsoft gets information about vulnerabilities from the same sources as everyone else. They outspend every other software vendor by something like 4:1 on outside software security consultants. If they are in a privileged position regarding WinAPI software vulnerabilities at all, it is a marginally privileged position. No security person working at Microsoft would tell you they were confident that outsiders weren't holding severe, exploitable vulnerabilities back.

NSA, meanwhile, is as competent at sourcing vulnerabilities as any organization on the planet. They have internal research teams that generate them that are presumably competitive with any private research team, and they apparently purchase vulnerabilities like everyone else --- not from Microsoft, but from research teams that sell vulnerabilities.

Microsoft gives pre-release information about vulnerabilities to lots of different organizations; for instance, the IDS and network security vendors get pre-release info to create signatures. This program is, IIRC, over a decade old.

NSA is a dual-role organization; it also houses the USG's center for defensive technology expertise. It is the opposite of surprising that NSA would have the same relationship with Microsoft as, say, Symantec would.

Finally, CISPA does nothing resembling what you claimed it does. CISPA is opt-in; it cannot be used to force a company to disclose anything. CISPA is about incident data, not vulnerabilities. It is already lawful to share vulnerability information with the government. The gray area in data sharing is non- anonymized incident data, which can be covered by any of 10+ different regulations that make even IP-level metadata risky to share for collaborative defense.

CISPA is an extraordinarily short bill; you can simply read it instead of taking my word for it.

Nothing you've uttered refutes the point - that Microsoft hand over vulnerabilities to the NSA, and delay fixing them. Read the docs.

Feel free to cite the document that shows Microsoft delaying fixes for NSA.

Do your own homework, you know how to use Google - so go use it .. a simple query "Microsoft collaborates with NSA" turns up enough reading material .. of course, unless you don't want it to be so easy to enlighten yourself on the issue, in which case no document is going to convince you of your position.

I love seeing Tptacek being proven wrong as much as the rest of us; but this is just weak.

I have no idea who Tptacek is, but - is it really so hard to pay attention? Microsoft collaborates with the NSA. Its in the docs, its been news for months.

For something so obviously well known you seem to have difficulty providing evidence of your specific allegation (microsoft giving NSA advance notice of unpatched zero days.)

I don't doubt it happens, so much as I expect extraordinary claims be backed with extraordinary evidence.

Start your homework engine:

http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-t...

http://arstechnica.com/security/2013/06/nsa-gets-early-acces...

I don't understand. Does the way your argument work rely on people not having read the other comments on this thread? Because neither of those two articles back up the claim made about NSA and Microsoft, and both appear to describe a publicly-known documented program run by Microsoft. And, both of those points have already been made on the thread.

I'm a little slow, my Googling skills suck, and I've been living under a rock for... let's just say "months". Can you spoon-feed me the exact article, line, and phrase where you got this idea that Microsoft delays fixing vulnerabilities at the NSA's behest?

These guys are focusing narrowly on your choice of words ("delay fixes"). It was outed by the Guardian that Microsoft actively circumvents the security of some major products (Outlook, Skype) for the NSA. The Guadrian never released the Snowden doc for Microsoft collaboration [0]. Therefore, we don't the specifics of how. We just know that Microsoft backdoors its products for the federal government without telling its customers.

"Microsoft helped the NSA to circumvent its encryption to address concerns that the agency would be unable to intercept web chats on the new Outlook.com portal;" [1]

[0] https://twitter.com/ggreenwald/status/355391355939340288

[1] http://www.theguardian.com/world/2013/jul/11/microsoft-nsa-c...

No, you just introduced an entirely different concern than the one introduced by the thread. The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch so as to maximize their value to NSA. There is no evidence that anything like this has ever happened.

Your message is a red herring; I could debate your conclusions, but what would be the point? I'm sure you've got 10 more red herrings up your sleeve.

My message is not a red herring. I did not make any conclusions of my own for you to debate. I was trying to add context (note that I replied to fit2rule, I wasn't challenging you). I quoted the Guardian and gave the reason there is no public Snowden document on the Microsoft NSA issue. Therefore, we don't know the specifics of their collaboration/cooperation. I do not dispute what you said about delayed patches, but it is meaningless without that context.

To be fair, there is not much daylight between: 'The root comment suggests that Microsoft arranges to provide NSA with vulnerabilities that they deliberately do not patch' and what the Guardian reported about Outlook. At least to me, but I'm not a security expert. Is it not considered a 'vulnerability' if Microsoft hands over the keys so to speak?

Also on a side note, it is rude to call me out like you did. I don't have herrings up my sleeves. I don't care about internet points. I just wanted to contribute more information to the discussion.

No, that would not be considered a "vulnerability" in the sense used on this thread.

Is the user more - or less - vulnerable to an attack? You're quite the pedant, whoever you are ..

I'll happily accept this as an admission that you don't have a source to back up your original (extraordinary) claim. Thanks.

Hey, so you don't understand words. I get it. Thats quite a vulnerability you've got there.

The only official response from Microsoft that I can find is in reply to a question from Bloomberg [1] on this question. Frank Shaw, lead communications for Microsoft, responded by email to the question that, according to Bloomberg, information regarding 0day or other exploits are provided to a number of government agencies as an "early start", prior to public announcement.

The original email text is unavailable as far as I can see. It of course makes perfect sense that, at least under certain circumstances, and this was the sense of limit inferable from the email, that government agencies should be given the opportunity to assess whether the item being notified about has some security implication.

The claim is made by Bloomberg, by reference to "two unnamed government officials", that Microsoft is aware that such information might be applied for reasons not primarily connected to domestic defensive security. But this is only an unsubstantiated assertion.

The number of potential exploits that are known only to Microsoft at the time of notification to those agencies would be, at a lazy guess, somewhat proportional to their exploit assessment man hours, compared to the overall exploit discovery effort. I would think that would be the much smaller proportion.

1. http://mobile.bloomberg.com/news/2013-06-14/u-s-agencies-sai...

You read the docs. http://technet.microsoft.com/en-us/security/dn467918

This is a publicly disclosed, publicly available program. Implying that it's somehow a government conspiracy is lying.

This.

Very frustrating as I work with a Microsoft-oriented company at the moment. Any mention of this to their architectural team results in nothing short of "mwuhahaha you're talking shit". There is some weird universal trust there that really makes no sense at all.

To add insult to injury they don't log, don't have an IDS and don't have a clue stick to hit themselves with.

Their funeral!

As if having an IDS would make a difference.

You're right - it wouldn't but at least it'd look like they gave a crap.

MS's program to provide information on upcoming security issues to large customers isn't anything sinister. It's an obvious step to achieve a better overall security by allowing larger users to mitigate damage before a patch is available.

You can spin it as a secret NSA-program, but I don't think that's very useful as this program does legitimately help a ton of users.

(Not that it really would excuse things, but I'd be very surprised if intelligence agencies don't have people inside companies like Microsoft anyways.)

I disagree.

I've worked for a few large European financial orgs over the years and MS will not disclose issues early to them despite begging and piles of money. We're talking 50k+ employees here.

However DoD connected companies like Lockheed Martin, Boeing and Raytheon are right in there without an invite.

You just get the feeling there's something off when relationships are made like that.

Probably because they don't care about any of that. They probably care about releasing products and making clients happy.

Also, mwuhahaha you're talking shit.

And this is why I'm glad my main OS is linux.

Not impossible for NSA to get in but a lot more difficult.

> I use Ubuntu, take that NSA!

You're cute.

Close... It's Arch though.

So the only thing the NSA has to do is hack/convince/rendition/break-into-house a single person who holds a package signing key, and then they can MITM your pacman updater and have you as well.

And there's enough people with such a key to choose from: https://www.archlinux.org/master-keys/.

(I run Arch as well, but I have no such illusions of security.)

As i said not impossible but at least we're not giving the NSA information about vulnerabilities months in advance of us fixing it.

Where there's a will there's a way especially if you have billions of dollars in funding and the freedom to do so i just aim to make it as difficult as possible.

Is running Linux all you can do to make it as difficult as possible?

No obviously not.

There's a lot of things you can do to protect you privacy but it all starts with a good choice of OS and hardware.

If the foundation is compromised there's no point in anything else you do to protect your privacy.

Edit: Yes Arch it's not particularly security conscious I choose to compromise some security to stay on the bleeding edge now that could mean that I get some bad code sometimes but that also means that it gets fixed sooner too.

Having a rolling release system that you can mold to your needs is worth it for me.

I'm not trying to bash Arch, but it never looked like a particularly security-conscious or focused distro. To me it looked like it's about being cool and bleeding edge and Gentoo with binary packages... and I have a faint recollection of seeing some rather unimpressive packaging, though that was long time ago.

So it runs on i686 and amd64 only. How do you select "good" hardware?

In an ideal world it would be open source hardware where you can review anything from the circuit diagram to the firmware.

However since there's no such thing you will have to choose who you trust.

Or just employ people to contribute to some of the many popular upstream projects to slip in a vulnerability or two.

Edit: not to discredit Linux of FLOSS, at least there is the possibility to analyse the source code.

While Linux is probably slightly harder for a sophisticated attacker (and a lot harder for a unsophisticated one), a lot of your protection probably comes from the fact that they spend most of their time targeting the 98% of the desktop software base- that isn't Linux. Of course maybe their server oriented efforts make this moot.

The most vulnerable part of a server is the fact that it's a server.

It's a lot easier to attack the website running on the server and escalate from there then attack the OS directly.

So the vulnerability would have to be in something that both servers and desktops have in common.

I seriously doubt linux presents a challenge for them. Think about all the web servers that are linux, you think they don't have an army of experts that can pwn those OS's?

> Think about all the web servers that are linux

None, unless you install them and activate them? What sort of desktop distro comes with pre-configured webservers?

I think you misunderstood the GP. He means that the internet runs on linux, so the OS is a high-value target. Thus, it is reasonable to assume that the intelligence agencies have collected some as-of-now-unknown-to-the-public vulnerabilities for libraries that are typically used with Linux.

Reply on news.ycombinator.com