Microsoft Said To Give Zero Day Exploits To US Government Before It Patches Them

Re:Microsoft Said To Give Zero Day Exploits To US Government... by Breakthrough on Friday June 14, 2013 @01:35PM (#5881200)

Funny you mention this, because I don't see US Government, Department of Defense, or the Natural Security Agency on that list (not that I expected to find them there in the first place). Also, last I checked, the purpose of MAPP wasn't to allow MAPP-partners the ability "to exploit vulnerabilities in software sold to foreign governments"... And indeed, that would only compound the problem (have a look at the last question on the MAPP Application Request: "Do you sell or create products used to attack or weaken the security posture of networks or applications?").

> If you want to be outraged, check out all the Chinese companies on the list of partners!

Wow, really? :|

I might be outraged if I saw Government of China on that list, but the majority of Chinese companies on that list are large telecommunications companies (like Huawei) or Chinese-based antivirus companies. And even then, Chinese-based companies only make up a fraction of the (unsettlingly large) list.

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by fuzzbang on Friday June 14, 2013 @02:26PM (#5881527)

Thats because there is more than one program providing this sort of information. MAPP is for AV and other security software companies. There is also: CIPP http://www.microsoft.com/security/cipp/ and another one for "Defence" which is all government, military and intelligence agencies (apparently).

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by freyr on Friday June 14, 2013 @05:11PM (#5882537)

> last I checked, the purpose of MAPP wasn't to allow MAPP-partners the ability "to exploit vulnerabilities in software sold to foreign governments"

The phrase you quoted is utterly meaningless, and the article provides absolutely no evidence that the vulnerability notifications are used for that purpose.

It's just an anonymous source is saying "with knowledge of unpatched vulnerabilities, the government could exploit that knowledge." Obviously! With knowledge of unpatched vulnerabilities, YOU could exploit that knoweldge. Anybody could. What of it?

The quote is garbage.

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by throwaway2048 on Friday June 14, 2013 @02:13PM (#5881431)

its important to note, the government of china has a controlling stake in a large number of those companies.

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by fragmede on Friday June 14, 2013 @02:26PM (#5881524)

I feel it's equally important to note, we don't know which companies on that list are a front for the CIA.

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by peripetylabs on Saturday June 15, 2013 @11:02AM (#5885166)

I think the US government is not on the list because they don't need this program. The NSA finds its exploits directly from the source code, which Microsoft shares with them and many other governments, not second-hand from Microsoft.

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by HelpfulBot on Friday June 14, 2013 @04:01PM (#5882120)

Natural Security Agency ... hah!

[ Parent | on HN ]

Re:Microsoft Said To Give Zero Day Exploits To US Government... by krapp on Friday June 14, 2013 @04:04PM (#5882133)

... the intelligence branch of the Department of the Interior?

[ Parent | on HN ]