NSA Denies Prior Knowledge Of Meltdown, Spectre Exploits; Claims It Would 'Never' Harm Companies By Withholding Vulns

from the lol-ok-then dept

News surfaced late last week indicating everything about computing is fucked. Two critical flaws with zero perfect fixes -- affecting millions of processors -- were exposed by security researchers. Patches have been deployed and more are on their way, but even the best fixes seem to guarantee a noticeable slowdown in processing speed.

The government has stepped up to say that, for once, it's not involved in making computing less safe.

Current and former U.S. officials... said the NSA did not know about or use Meltdown or Spectre to enable electronic surveillance on targets overseas. The agency often uses computer flaws to break into targeted machines, but it also has a mandate to warn companies about particularly dangerous or widespread flaws so that they can be fixed.

Rob Joyce, White House cybersecurity coordinator, said, “NSA did not know about the flaw, has not exploited it and certainly the U.S. government would never put a major company like Intel in a position of risk like this to try to hold open a vulnerability.”

The veracity of this statement is largely dependent on the credibility attributed to the person making it. While it is conceivable the NSA did not know about the flaw (leading to it being unable to exploit it), it's laughable to assert the NSA wouldn't "put a major company in a position of risk" by withholding details on an exploit. We only have the entire history of the NSA's use of exploits/vulnerabilities and its hesitant compliance with the Vulnerability Equities Process to serve as a counterargument.

The NSA has left major companies in vulnerable positions, often for years -- something exposed in the very recent past when an employee/contractor left the NSA in a vulnerable position by leaving TAO tools out in the open. The Shadow Brokers have been flogging NSA exploits for months and recent worldwide malware/ransomware attacks are tied to exploits the agency never informed major players like Microsoft about until the code was already out in the open.

These recently-discovered exploits may be the ones that got away -- ones the NSA never uncovered and never used. But this statement portrays the NSA as an honest broker, which it isn't. If the NSA had access to these exploits, it most certainly would have used them before informing affected companies. That's just how this works. As long as exploits are returning intel otherwise inaccessible, the NSA will use the exploits for as long as possible before disclosing this info to US companies. The agency has historically shown little concern about collateral damage and I don't believe putting someone new in charge of the VEP is going to make that much of a difference in the future.

Filed Under: meltdown, nsa, rob joyce, spectre, vep, vulnerabilities, vulnerabilities equities process
Companies: intel

UK Copyright Group Plans Heavy Anti-Piracy Measures For Bond Film Because Of How Successful It Will Be

from the wut? dept

FACT, the UK's anti-piracy group that has long waged war on cammers and occassionally likes to cosplay as law enforcement officers, has built quite a reputation for itself throughout the years. That said, as I find with most of these copyright and entertainment groups, I just can't seem to make sense of their lexicon. Only recently, FACT has made it publicly known that it is upping its battle against in-theater cameras that might record the upcoming Bond film, Spectre.

Due to the national and international importance of Bond’s latest outing, FACT have issued a somewhat unusual proactive anti-piracy statement, presumably to deter would-be pirates from leaking the movie.

“James Bond is a big risk and we will be working with cinema operators and the distributors making sure we will keep that as tight as possible. We really don’t want to see that recorded,” says FACT director general Kieron Sharp. “The bigger the film and the more anticipated it is, the higher risk it is. We have staff on extra alert for that. They are on alert, particularly with the bigger films like James Bond, to really drill down to who is in the auditorium and who might possibly be recording.”

Except that's almost never the case. Risk -- assuming that FACT means financial risk at the hands of piracy -- is almost never really a factor in the AAA, box-office busting films. In fact, it's quite easy to draw a correlation between the box office success of a film and the levels to which it's pirated. Why? Well, because of the not complicated reason that good movies are good and people, all people, want to see good movies. Paying customers want to see good movies, as do those willing to pirate. Piracy doesn't necessarily make films successful, but it sure doesn't keep the massive releases from being successful, either. And it seems everyone kind of knows this.

While FACT are always keen to deter pirates, why the special fuss over Bond? The profile of the movie and its commercial importance are obviously key factors since Spectre is likely to be one of the biggest box-office hits this year.

So FACT is ramping up the war on piracy because it knows that the film is going to be successful? How does that make even the tiniest bit of sense? Now, as for the real reason the industry is so concerned, it's because that same industry is going out of its way to make piracy a natural remedy for its own stupid release windows.

The real surprise here is that UK pirates are being given almost two weeks to record Spectre and begin online distribution before it hits cinemas in the United States and the rest of the world on October 6. That probably goes a long way to explaining why FACT are being forced to implement extraordinary security measures – a U.S. pre-release is exactly what the anti-piracy group is trying to avoid.

But why take the chance that someone slips through the net? Hollywood knows that these windows fuel ‘camming’ yet MGM and Columbia are apparently prepared to risk “the most damaging form of piracy” by leaving the entire world dangling for 12 days while potentially millions of illicit copies of Spectre float around the Internet.

And, make no mistake, those illicit copies will certainly be available. In other words, the industry was faced with two choices to deter piracy: it could valiantly fail to keep any camming from happening and being released on the internet or it could adjust to the reality of the market and release the film worldwide at the same time as the UK release. It chose the former, because apparently playing some kind of spy game to police a spy movie while not accomplishing anything is more fun than actually barely-altering a business model to give customers what they want.

Filed Under: camming, copyright, fact, james bond, overreaction, spectre, uk
Companies: fact