News for hackers. Stuff that matters.
Re:NSO Group's iPhone Zero-Days used against a UAE Human Rig... by kbenson on Friday August 26, 2016 @01:37AM (#12364424)
> Smallpox is inherently dangerous.

I think the equivalent (or much worse, actually) for exploits is something that is self replicating and disruptive. For example, a bug in the BGP routing protocol (or a certain percentage of the common implementations) that propagates bogus routes and disrupts some or all traffic for affected systems and spreads. Something that disrupted a large enough chunk of global traffic would not only be horrendous in its own right, but would also make dissemination of any fix quite problematic.

Then again, I assume it's probably good practice to somewhat lock down how BGP functions in your routers (if that makes sense. I'm not that familiar with it), but a certain incident from last year[1] leads me to believe that's either not possible, hard to do, or people just don't do it.

1: http://www.bgpmon.net/massive-route-leak-cause-internet-slow...

Re:NSO Group's iPhone Zero-Days used against a UAE Human Rig... by pixl97 on Friday August 26, 2016 @09:16AM (#12365955)
The analogy still fails.

If you have the tooling to keep smallpox and not kill yourself you can also keep ebola around too, if you go to the effort to go find it. Really dangerous stuff and is going to be costly.

The problem here is I can make and keep 'digital smallpox' on my home PC, and for many pieces of equipment it is surprisingly easy to find exploits for them. Are you planning on watching every computer? Every person in the world?

Take a lesson from the failed war on drugs, where there is significant profit motivation people will do what is necessary to make massive amounts of money. There are massive amounts of money in blackhat work.

Re:NSO Group's iPhone Zero-Days used against a UAE Human Rig... by AnthonyMouse on Friday August 26, 2016 @11:56AM (#12367090)
Which is exactly what I mean by "there aren't enough independent security layers protecting sensitive systems." We've known that BGP has terrible security for many years.

Fixing it is hard because it requires a lot of independent parties to agree on what to do and update their routers. In theory this is the sort of thing a government could help with by providing funding, to fund research into solutions and/or provide cash incentives to early adopters.

But the market also solves these things eventually, since successful attacks are bad for business. It just takes for the attacks to actually happen first in that case.