The revelation by hackers of the internet vulnerabilities stockpiled by US intelligence shows that in the fight against cybercrime public safety is ignored.
Hereâ€™s a phrase to conjure with: â€œzero-day vulnerabilityâ€. If youâ€™re a non-techie, it will sound either like a meaningless piece of jargon or itâ€™ll have a vaguely sinister ring to it. â€œYear Zeroâ€ was the name chosen by the Khmer Rouge for 1975, the year they seized power in Cambodia and embarked on their genocidal rule. Behind the term lay the idea that â€œall culture and traditions within a society must be completely destroyed or discarded and a new revolutionary culture must replace it, starting from scratchâ€.
If you run a computer network, though, especially one that hosts sensitive or confidential data, then zero-day vulnerability evokes nightmares and worse. It means that your system has a security hole that nobody, including you, knew about and that someone is now in a position to exploit. And you have no real defence against it.
All software has bugs and all networked systems have security holes in them. If you wanted to build a model of our online world out of cheese, youâ€™d need emmental to make it realistic. These holes (vulnerabilities) are constantly being discovered and patched, but the process by which this happens is, inevitably, reactive. Someone discovers a vulnerability, reports it either to the software company that wrote the code or to US-CERT, the United States Computer Emergency Readiness Team. A fix for the vulnerability is then devised and a â€œpatchâ€ is issued by computer security companies such as Kaspersky and/or by software and computer companies. At the receiving end, it is hoped that computer users and network administrators will then install the patch. Some do, but many donâ€™t, alas.
Itâ€™s a lousy system, but itâ€™s the only one weâ€™ve got. It has two obvious flaws. The first is that the response always lags behind the threat by days, weeks or months, during which the malicious software that exploits the vulnerability is doing its ghastly work. The second is that it is completely dependent on people reporting the vulnerabilities that they have discovered.
Zero-day vulnerabilities are the unreported ones. Nowadays, they can be very valuable. Software companies and computer manufacturers offer bounties to those who report them. But they are also traded online in the recesses of the dark web, where the customers include not just affluent criminals but also government agencies.
For years, itâ€™s been a reasonable conjecture that intelligence agencies such as theNSA and GCHQ were stockpiling zero-day exploits for use in the wars against cybercrime and global terrorism. Some of these will be vulnerabilities that the spooks themselves have discovered; others will be ones theyâ€™ve bought on the black market. After all, if youâ€™re a public official charged with protecting society against these threats, then you would take all available steps to fulfil that mission.
The agencies wonâ€™t talk about their hoards, for obvious reasons. So up to now all weâ€™ve had are our suspicions. But on 13 August all that changed. A mysterious group calling itself the Shadow Brokers released 300 megabytes of the NSAâ€™s â€œcyberweaponsâ€ stash on the internet. â€œThe people behind the link used casual hacker lingo,â€ reported Bruce Schneier, a leading computer security expert, â€œand made a weird, implausible proposal involving holding a bitcoin auction for the rest of the data: â€˜!!! Attention government sponsors of cyber warfare and those who profit from it !!!! How much you pay for enemies cyberweapons?â€™â€
Nobody knows who these Shadow Brokers are but the stolen material appears to be genuine. In which case, itâ€™s embarrassing for the NSA. What is more interesting, from a democratic point of view is the nature of the zero-day vulnerabilities that have been revealed. For some of them can be exploited not just against enemy states or cybercriminals, but against common internet security systems â€“ Schneier identifies products made by Cisco, Fortinet, Topsec, WatchGuard and Juniper, for example.
Why is this important? Simply because it tells us that the NSA knew about vulnerabilities in networking kit on which the internet relies. They should have been reported to US-CERT and fixed, but apparently they werenâ€™t. Which means that in its determination to screw the bad guys, the NSA left all of us vulnerable. Worse still, we wouldnâ€™t have known about it had not a sinister group, possibly Russian in origin, hacked into the NSAâ€™s systems. Just as we wouldnâ€™t know about a lot of other unacceptable practices had not Edward Snowden blown the whistle. This is no way to run democracies in a digital age. Theresa May, please copy.
ByÂ John Naughton