We live in a (brave?) New World and we are going to have to learn to live with the full realization that we are all vulnerable (as a nation, as businesses, as individuals). Although I think we do have to worry about our 4th Amendment Rights in our country (and our political process needs to properly work out what needs to evolve with the great American experiment in Democracy based on the conditions as the exist today) I think we face far greater threats from outside entities (organizations and nation-states) than we do from our own government. As those who take up Snowden's and Greenwlad's cause and will focus on the US government, all these other countries and organizations that are developing cyber capabilities are being given a free pass and enjoying the show as American feeds on the Snowden and Greenwald case with the possible result that the US will neuter its security capabilities. At the same time others will continue to develop the capabilities to exploit Americans economically and financially, influence American opinion, and develop the capability to attack US infrastructure that is undefended or under defended. Yes, I know I sound like Chicken Little and I will be very happy to be proven wrong and learn that the sky is not falling but from an enemy perspective the best way to attack America is to create the conditions for America to attack itself from within and I believe that Snowden has contributed to that attack.
(note: of course not every country listed below is hostile to the US and obviously some are allies. What I think may be different is that all these nations are taking steps to develop offensive and defensive capabilities to survive and even thrive in this New World while the US succumbs to internal controversy and stifles its own ability to operate in the New World. Again, I think we need to work out the 4th Amendment issues but that should be done through our political process and not have the debate controlled by the likes of Snowden and Greenwald – And from now on I intend to use Snowden and Greenwald in tandem in all my comments because Greenwald has chosen to make him part of the story and he is aiding and abetting Snowden particular through his communication of threats against the US).
V/R
Dave
July 13, 2013
Nations Buying as Hackers Sell Flaws in Computer Code
By NICOLE PERLROTH and DAVID E. SANGER
On the tiny Mediterranean island of Malta, two Italian hackers have been searching for bugs — not the island’s many beetle varieties, but secret flaws in computer code that governments pay hundreds of thousands of dollars to learn about and exploit.
The hackers, Luigi Auriemma, 32, and Donato Ferrante, 28, sell technical details of such vulnerabilities to countries that want to break into the computer systems of foreign adversaries. The two will not reveal the clients of their company, ReVuln, but big buyers of services like theirs include the National Security Agency — which seeks the flaws for America’s growing arsenal of cyberweapons — and American adversaries like the Revolutionary Guards of Iran.
All over the world, from South Africa to South Korea, business is booming in what hackers call “zero days,” the coding flaws in software like Microsoft Windows that can give a buyer unfettered access to a computer and any business, agency or individual dependent on one.
Just a few years ago, hackers like Mr. Auriemma and Mr. Ferrante would have sold the knowledge of coding flaws to companies like Microsoft and Apple, which would fix them. Last month, Microsoft sharply increased the amount it was willing to pay for such flaws, raising its top offer to $150,000.
But increasingly the businesses are being outbid by countries with the goal of exploiting the flaws in pursuit of the kind of success, albeit temporary, that the United States and Israel achieved three summers ago when they attacked Iran’s nuclear enrichment program with a computer worm that became known as “Stuxnet.”
The flaws get their name from the fact that once discovered, “zero days” exist for the user of the computer system to fix them before hackers can take advantage of the vulnerability. A “zero-day exploit” occurs when hackers or governments strike by using the flaw before anyone else knows it exists, like a burglar who finds, after months of probing, that there is a previously undiscovered way to break into a house without sounding an alarm.
“Governments are starting to say, ‘In order to best protect my country, I need to find vulnerabilities in other countries,’ ” said Howard Schmidt, a former White House cybersecurity coordinator. “The problem is that we all fundamentally become less secure.”
A zero-day bug could be as simple as a hacker’s discovering an online account that asks for a password but does not actually require typing one to get in. Bypassing the system by hitting the “Enter” key becomes a zero-day exploit. The average attack persists for almost a year — 312 days — before it is detected, according to Symantec, the maker of antivirus software. Until then it can be exploited or “weaponized” by both criminals and governments to spy on, steal from or attack their target.
Ten years ago, hackers would hand knowledge of such flaws to Microsoft and Google free, in exchange for a T-shirt or perhaps for an honorable mention on a company’s Web site. Even today, so-called patriotic hackers in China regularly hand over the information to the government.
(Continued at the link below)
No comments:
Post a Comment