News for hackers. Stuff that matters.

A comment on From 0-Day to Exploit - Buffer Overflow in Belkin N750 (CVE-2014-1635). Parent comment

Re:From 0-Day to Exploit - Buffer Overflow in Belkin N750 (C... by colinbartlett on Monday November 10, 2014 @06:16PM (#8587269)
From the site: "CVE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security."

Serious question: How worried should I be that my defacto, go-to database of software vulnerabilities is paid for by the United States Government? How independently run is it? Need I fret that vulnerabilities won't be publicized if they benefit government agencies?

[ Parent | on HN ]
Re:From 0-Day to Exploit - Buffer Overflow in Belkin N750 (C... by tedunangst on Monday November 10, 2014 @08:03PM (#8587677)
One of the more common (and more visible) ways CVEs are assigned is by asking for one on a public mailing list operated out of Russia.
[ Parent | on HN ]
Re:From 0-Day to Exploit - Buffer Overflow in Belkin N750 (C... by viraptor on Monday November 10, 2014 @08:54PM (#8587827)
They're not the gatekeepers of anything. Even if they didn't accept something, you could still post to http://seclists.org/fulldisclosure and everyone who cares would know about it. So there's no reason for them to hide/refuse any entries.
[ Parent | on HN ]
Re:From 0-Day to Exploit - Buffer Overflow in Belkin N750 (C... by internet_arguer on Monday November 10, 2014 @06:52PM (#8587429)
The culture of different government agencies varies widely. US-CERT is run by Carnegie Mellon University. US-CERT, incidentally is far older than the relatively new DHS. US-CERT, Mitre, and the rest are all about transparency and don't have motivation to hold onto really effective exploits.

However, if NSA discovers a ground-breaking exploit, and it's deemed low-risk to US systems, they'll probably keep it. But they certainly wouldn't disclose it to US-CERT or Mitre. Not to mention, since US-CERT and Mitre aren't in the intelligence community, they don't have a mechanism to keep information like that undisclosed.

[ Parent | on HN ]