NSA Bought Exploit Service From VUPEN 81
New submitter Reverand Dave writes "The U.S. government – particularly the National Security Agency – is often regarded as having advanced offensive cybersecurity capabilities. But that doesn't mean that they're above bringing in a little outside help when it's needed. A newly public contract shows that the NSA last year bought a subscription to the zero-day service sold by French security firm VUPEN. The contract, made public through a Freedom of Information Act request by MuckRock, an open government project that publishes a variety of such documents, shows that the NSA bought VUPEN's services on Sept. 14, 2012. The NSA contract is for a one-year subscription to the company's 'binary analysis and exploits service.'"
The truth gets out... (Score:5, Interesting)
It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.
Re:The truth gets out... (Score:4, Insightful)
It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.
rubbish. I'd be more concerned if they didn't closely monitor all zero Day hacks. This is a SECURITY firm, not a backroom russian exploits dealer, they sell this advanced knowledge because people want to protect themselves and know what is coming. The weather service is not about weather warfare it's about advanced knowledge of what's coming. Insert car analogy here if that's insufficiently obvious.
Re:The truth gets out... (Score:5, Interesting)
Bullshit.
From TFA:
Just because they're French instead of Russian does not change the fact that they're selling exploits.
Re: (Score:1)
Come on, man. They're selling exploits to the highest bidder. The proper way to do it would be to keep it in-house for consulting while keeping the flaws secret from the clients, or disclose the flaws to the affected companies and then the public without rewards. They know what the NSA does with the exploits, these people are not idiots.
Re: (Score:3)
they sell exploits.. to whoever pays for them.
only thing they do different than so called russian exploit dealers is that they sell it as a subscriber service.
heck, many of those reselling probably subscribe to such services. what difference is there where it is from? and if one would think that nsa just has to subscribe to their feed then by that logic the company can ask any fee they damn please from nsa. maybe they did.. and you yanks are wondering where the fuck all your money is going.
Re: (Score:2)
Just because they're French instead of Russian does not change the fact that they're selling exploits.
The French exploits are being served with champagne and escargots, though.
Re: (Score:2)
Re:The truth gets out... (Score:4, Insightful)
Re: (Score:2)
This is a SECURITY firm, not a backroom russian exploits dealer, they sell this advanced knowledge because people want to protect themselves and know what is coming. The weather service is not about weather warfare it's about advanced knowledge of what's coming. Insert car analogy here if that's insufficiently obvious.
The differences is that (unfortunately) I can't enter my credit card number and have the weather service send a network of compromised lightning storm clouds and tornadoes to kill the guy that pissed me off on IRC.
Re: (Score:1, Flamebait)
It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.
Hey. Stop being all logical and shit. We need to be yelling at them for being net.deities who spell billion trillion dollars on backdoors in all the things... then yelling at them for spending a billion trillion dollars on superfluous things like NOCs that look like the Enterprise bridge... and now we have to yell at them for being cost-effective by using exploits published by others.
Get with the program: Everything the NSA does is bad! They can do no right. Even if they right now figured out a cure for can
Re: (Score:3)
Is fskin a new brand of condom?
Re:The truth gets out... (Score:5, Interesting)
VUPEN sells access to their vulnerabilities on a sliding scale and It's well known that governments buy services from them. That's not news, but for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems. It would seem to me money well spent if they did and at least closed up these holes or made VUPEN's job harder, making it tougher for these data stealing, scum sucking government agencies breaking into everything and anything.
Re:The truth gets out... (Score:5, Insightful)
for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems
it's almost as if they've been persuaded not to, eh?
Re: (Score:1)
Or...there has been NO financial penalty for having any of these vulnerabilities, therefore, paying someone to find out how they are finding the vulnerabilities is just giving one of the CEO's Ferraris away.
So they don't by them AS THEMSELVES. (Score:4, Interesting)
for the life of me I don't know why Cisco, Microsoft and other big players just don't pay up to get at least some insight into how these guys are finding exposures in their systems
I would assume that VUPEN would refuse to sell to Microsoft and Cisco on account of it diminishing the value of the zero-days they're holding.
Or at least not sell them the best stuff.
Obviously, if Cisco, Microsoft, etc. were going to buy this service, they wouldn't do it (only) as themselves, acting directly. They'd do it through a front, to insure they got the same things the bad guys were getting.
Just as a startup did, about a decade ago, when I was designing a next-generation routing chip, and we needed to obtain equipment from Cisco for testing it for function and compatibility.
It took two half-rack, 3/4 megabuck, top-of-the-line Cisco routers to drive it properly. We bought them through another company on a very hush-hush basis, just to be sure Cisco wouldn't be tempted to send us defective or gimmicked equipment, not support it properly, or hold up shipment and slip our schedule.
Re: (Score:2)
Well, that's pretty obvious isn't it? They won't sell it to them because they'd quickly patch up exploits and make them useless. I'm pretty sure that all of their customers (government agencies, police etc) also have a clause in their contract that they can't even give a hint to ISVs about vulnerabilities t
Re: (Score:2)
Well so paying VUPEN is like paying a drug dealer then but the first taste isn't free. Why don't we just have a Drone take them out?
Re: (Score:1)
Re: (Score:3, Insightful)
This isn't the only way or even the main way that the NSA exploits systems.
Things we know:
1) The NSA collects SSL keys.
2) The NSA can generate fake SSL keys.
3) The NSA has performed MiTM attacks against Google and Microsoft.
4) We know where many of the places are that the splice into the undersea cables.
5) US embassies often have Echelon hardware for tracking satellite communication.
6) The GCHQ stores three days of internet traffic (not metadata but everything).
7) The NSA collects metadata from everything.
Re: (Score:2)
It's not as conspiracy-theory cool as magical backdoors implanted in every piece of hardware, but this is how the NSA actually breaks into systems... they do it the same way everyone else does, just on a much larger scale and with even less fear of legal repercussions that the cyber criminals.
Oh [cisco.com] really? [theguardian.com] I don't see "everyone else" spending millions to deliberately subvert encryption standards [techcrunch.com], either.
And since the CAs have been co-opted, SSL is laughable. Try Steve Gibson's cert "fingerprint" service [grc.com] and see for yourself. I tried it, and he gets a different cert for www.google.co.nz than I do. Is it the NSA? Who knows, but someone is up in my business >:-(
Re: (Score:2)
Eh, so the US subscribes to the 0-day list, maybe they just want to know if anyone is getting close to their magical backdoors?
Re: (Score:2)
If they knew it was a planted NSA backdoor, would they tell the NSA if someone found it? Or would they sell it to everyone else for a higher price first?
I wonder if one of the big news outlets could subscribe through a front...then some interesting data might be "leaked"...
A eyball everywhere (Score:3)
Re: (Score:2)
I'm not happy with a lot of the stuff the NSA does but this kind of statement ignores the realities of an ugly world. You act as if all we had to do was just ignore the fact that there are people out there that for whatever reason want to infiltrate and attack the USA. Truly in a perfect world we wouldn't need something like the NSA but alas we have to deal with what we have. If a lot of it seems like "the end justifies the means," well that is what it is. In a world with nuclear weapons and serin gas t
Makes sense (Score:2)
The NSA needs to know when the back doors it has built are uncovered. So it probably subscribes to a number of software security services that look for such stuff.
Re: (Score:2)
Or perhaps they want to know what other exploits are out there so they can further secure their own systems against those attacks.
Re: (Score:2)
Re: (Score:3)
The NSA needs to know when the back doors it has built are uncovered. So it probably subscribes to a number of software security services that look for such stuff.
No, that is not what is happening. The NSA, because it doesn't have backdoors everywhere, have to buy 0 day exploits to gain access to systems.
While NSA might be able to get some companies to put back doors in their software, they can't get most. So they have to use exploits to break into systems.
This is actually common sense, we just have some proof of it now.
Re: (Score:2)
Re: (Score:2)
The NSA, because it doesn't have backdoors everywhere, have to buy 0 day exploits
VUPEN sells exploit implementations? I thought they did security/vulnerability research and sold maintenance services, patches and related stuff.
If you want to buy the actual exploit, you have to go onto the blacknet, warez boards or whatever you kids are calling them these days. Its a seperate market and no software security firm would risk their reputation by letting it be known that they sold exploits to the other side as well. Who would trust them to report the presence of their own exploit product on
Re: (Score:2)
The fact that NSA subscribes to VUPEN doesn't prove in any way, shape, or form that they do or do not have any backdoors in anything.
The NSA (mostly) isn't stupid. They have the money to cover all their bases, so they do.
So, the NSA is supposed to NOT subscribe? (Score:1)
Re: (Score:2)
An article about the NSA spying on foreign nationals in foreign countries and doing signals intelligence would probably generate traffic and outrage
Why would anyone report on that when they can get twice the outrage and twice the traffic by rerunning yet another document from Snowden regarding the NSA spying on American citizens in America and getting away with it?
Re: (Score:3)
Re: (Score:2)
...they are all hooked up to the internet with little thought to security.
Citation and motivation, please.
Re: (Score:2)
That would be the NSA
http://www.archives.gov/federal-register/codification/executive-order/12333.html [archives.gov]
Re: (Score:2)
Part of the NSA's mission is ensuring our cybersecurity. Obviously they're doing exactly the opposite of that.
Of course (Score:1)
Re: (Score:2)
I would be disappointed if they didn't take advantage of every resource available. A "not invented here" mentality in a high stakes game gets you killed.
Cheese eating surrender monkeys (Score:2)
Re: (Score:2)
The US gov gets what it needs and blame floats around as a press report for years.
Makes sense (Score:2)
If you are in a business you want to see what your competition are doing, especially if its just a matter of subscribing...
NO No no. You ATTACK enemies. You HELP friends. (Score:3, Interesting)
We finally found the NSA mentioned in the same sentence as an actual, tangible, external threat. And now we see that instead of attacking them, they are giving them money?!? How can they get confused on this? You ATTACK enemies. You HELP friends.
The Exploit marketplace (here symbolized by VUPEN) is possibly the greatest threat to to existence of the internet. You can fight mistakes. You can fight attackers. But it is almost impossible to fight economics. The exploit market is creating an economy that creates and enables exploit. It is a great driving force reconfiguring the Internet for Attack, instead of Defense.
VUPEN is a worthy opponent. The NSA should hack them front, back and center. They should never pat them on the head and give them money.
It looks like the Exploit Marketplace was dreamed up, founded and sustained by the NSA. The leaked Black Budget showed that the NSA devotes huge resources to purchasing exploit. We have also learned that the NSA's budget included vast resources to create exploit:
"The NSA spends $250m a year on a program which, among other goals, works with technology companies to 'covertly influence' their product designs." (From last weeks New York Times and Guardian articles)
So, the NSA creates exploit in everything they can influence. And they can influence almost everything. The NSA purchases exploit. Many times, they must be purchasing info on the exploits that they created. They preserve exploit. They mask everything in secrecy. And it all enhances the exploit marketplace. The NSA is no longer debating the Equities issue (https://www.schneier.com/blog/archives/2008/05/dualuse_technol_1.html ) They have only token interest in defending the Internet.
If we could just get the NSA out of the exploit market, the whole thing would probably collapse like 2008's Housing bubble.
Re: (Score:2)
VUPEN is a worthy opponent. The NSA should hack them front, back and center. They should never pat them on the head and give them money.
So, what you are saying is - NSA should do what US government considers 'act of war' (when done to their networks), to a company based in a friendly/allied country?
I am sure noone will have problem with that.
Good (Score:4, Interesting)
I paid a visit to Northern Va a few weeks ago. The place was crawling with construction projects and high end malls.
That I am paying for.
Using Vupen actually sounds like a fairly efficient use of taxpayer money.
NSA should just buy Facebook (Score:2)