The article does not mention specific exploits. I'll change my mind if they actually close vulnerabilities because of this, but as of now, it seems like a PR move without much substance.

Never mind, look like I'm wrong :-) http://bgr.com/2017/03/08/cia-wikileaks-apple-iphone-hacking... http://bgr.com/2017/03/09/google-says-many-android-exploits-...

They do have exploits - they had lists of vulnerabilities in iOS and Android they were planning to report and release after patching has occurred.

There is zero evidence of this.

iOS: https://wikileaks.org/ciav7p1/cms/page_13205587.html

Android: https://wikileaks.org/ciav7p1/cms/page_11629096.html

Now, some of those are known existing exploits, others are 0 days, but unless you think they're straight up making these lists up, they've got them.

I definitely do not dispute the lists. One of them (Corona) is from the jailbreak group I started. They are certainly legit.

My issue is with the claim of 0-days, because the bugs are dead. You cannot hack an up-to-date phone with anything in this dump.

Of course the NSA looks for software vulnerabilities, and it's a vital part of both their core missions. And of course they don't neutralize their offensive capabilities by immediately revealing all of them to software makers. There's a balance that is struck between offensive and defensive missions with respect to each vulnerability.

https://www.wired.com/2014/04/obama-zero-day/

Two things:

1. It is about CIA, not NSA. 2. What CIA did goes against the promise previous administration had made after Snowden leaks, where they promised that agencies will be immediately disclosing discovered vulnerabilities to the affected US tech companies.

1. It's the CIA and the NSA, as well as a host of friendly non-US intelligence agencies. They develop vulnerabilities, share them, and release them when the improvement to the defensive advantage the release provides outweighs the hindrance to the offensive advantage they provide over adversarial intelligence agencies.

2. Not only was such a promise never made, but it's well outside of the realm of reason. Of all the vulnerabilities out there (and the way the market works, there are more shipped every day), only small disjoint fractions have been discovered by intelligence agencies both friendly and hostile to the USIC, and hence there is absolutely no reason for them to disclose NOBUS vulns: https://en.wikipedia.org/wiki/NOBUS

1. The recent leaks were concerning CIA and not NSA.

2. I am not talking about all leaks ever, I am talking about the ones that CIA found. Also, NOBUS is in the domain of NSA, not CIA.

1. Makes no difference.

2. Makes no difference.

How do you know the CIA found these vulns, and that they weren't shared from IC partners?

You are, at best, advocating a policy which would lead to an absolutely disastrous disadvantage to the USICs SIGINT capabilities in relation to its adversaries.