CBS confirms reporter Sharyl Attkisson’s computer breached

Re:CBS confirms reporter Sharyl Attkisson’s computer breached by lawnchair_larry on Saturday June 15, 2013 @01:37PM (#5885695)

MAPP customers do get proof-of-concept code to trigger the vulnerability, sometimes months in advance. That is a huge head start towards a functional exploit, and has been converted to a fully functional remote code-exec exploit prior to disclosure in at least one case that was fairly public.

Though I do not think this story has anything to do with MAPP.

[ Parent | on HN ]

Re:CBS confirms reporter Sharyl Attkisson’s computer breached by tptacek on Saturday June 15, 2013 @01:41PM (#5885721)

Depending on the vulnerability, a crash POC might be a day's work away from an exploit, or it might be months of work.

MAPP or no MAPP, Microsoft does not have the technical capability to produce reliable exploits for all of the vulnerabilities it's made aware of.

Also, we both know NSA has a (less-well-known) charter for coordinating vulnerability response and computer security across the agencies; NSA has a public huge defensive interest in this stuff as well.

NSA doesn't need Microsoft to enable it to break into arbitrary Windows machines. But it might need their help to keep up with every attack vector on Microsoft code, which is what you need to do if you're doing defensive work.

[ Parent | on HN ]