News for hackers. Stuff that matters.

A comment on Tim Cook’s refusal to help FBI hack iPhone is validated by ‘WannaCry’ attack. Parent comment

Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by qb45 on Monday May 15, 2017 @03:25PM (#14344364)
> Either NSA's role involves using zero-day exploits, in which case they shouldn't disclose them; or NSA's role doesn't involve using zero-day exploits, in which case it shouldn't be looking for them and would have nothing to disclose.

Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations.

That being said, it still wouldn't help against WannaCry because Microsoft made a blunder when they disclosed the vuln by patching new versions of Windows while they left majority of XP installations unfixed. Even without the NSA leak somebody may have reverse engineered the bug from the released updates - such things happened in the past.

[ Parent | on HN ]
Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by willstrafach on Monday May 15, 2017 @03:49PM (#14344551)
> Third possibility: their role involves securing domestic infrastructure, in which case they should be looking for vulns and getting them fixed. IIRC this actually is part of their statutory mandate, alongside offensive operations.

This sounds similar to what IAD does. The difference is that IAD focuses on securing systems against entire classes of vulnerabilities and attacks.

SID has the mission of gathering signals intelligence, so that is why it makes sense for them to utilize individual zero day vulnerabilities. They need to get into an adversary system, so vulnerabilities are required (when needed) to get that access.

[ Parent | on HN ]
Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by hermitdev on Monday May 15, 2017 @04:35PM (#14344890)
How do you propose to solve the conundrum of this vulnerability is so bad, MS needs to release a fix, even for unsupported OSes, and get people still running those unsupported OSes to install the fix without disclosing there's a critical issue?
[ Parent | on HN ]
Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by qb45 on Tuesday May 16, 2017 @01:40AM (#14347603)
I'm not saying they shouldn't be disclosing that the patch is critical, I said that in the case of ancient bugs affecting all versions of Windows they should release all patches at the same time.
[ Parent | on HN ]
Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by hermitdev on Wednesday May 24, 2017 @11:07PM (#14415040)
Correct me if I'm wrong, but isn't that what they did? Didn't they do it on the usual patch Tuesday?

I don't have any old versions of Windows installed, so I truly don't know how it rolled out there.

[ Parent | on HN ]
Re:Tim Cook’s refusal to help FBI hack iPhone is validated b... by qb45 on Thursday May 25, 2017 @07:35AM (#14416660)
Wow, that's an old post. For currently supported versions I believe they released all patches at the same time, but XP was a problem because users without extended support contracts were left vulnerable which facilitated spread of WannaCry until they pushed updates to everyone. It's Microsoft's policy not to release fixes for unsupported versions to the public (this was an exception) and it leads to this kind of problems.
[ Parent | on HN ]