Software Flaws Used by U.S. Spies Liable to Exposure

FREMONT, CA: The White House has issued a directive that was made public on April 11, 2014, to the U.S intelligence agencies for limiting the use of software flaws. This may require the thousands of exploits now in the hands of spying units to be disclosed, reports Michael Riley, Bloomberg.

The exploits derived from vulnerabilities exist not just in computer software but also in industrial controlling, heating and cooling systems, printers, anti-virus software, video conferencing systems and encryption protocols.

Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.

The exploits are based on oversights and flaws in computer coding which hackers use for controlling anything that runs with the help of a computer chip and are important for gathering important U.S. intelligence.

According to Richard Clarke, Member of Presidential Panel reviewing National Security Agency practices, said that the directive issued by the White House to the intelligence community recommends that the vulnerabilities be limited and used only for the most critical intelligence goals, else the security flaws could be revealed to protect computer users from hackers. This comes after a report by Bloomberg News that the agency had been using a type of a flaw called Heartbleed, which left consumers vulnerable to hackers.

It will be a challenge for the NSA to comply with the directive. Limiting the use of exploits will cripple the ability of the intelligence organizations in completing their mission, which leads to the question as to how much will change with the new policy which allows computer vulnerability to be kept a secret if it is justified for critical intelligence and law enforcement purposes.

The document of the guidance has not been released and has led to a high-level re-assessment of the policy, however, change in the process will be a task for the NSA director, Admiral Michael Rogers.

NSA’s cyberspies have had full freedom to develop, cache and use the vulnerabilities. The main unit for the agency to gather intelligence through hacking is the Tailored Access Operations. The TAO spends heavily to research and develop flaws; it does so with the help and support of in-house experts and military contractors with the use of expensive and advanced and revolutionary tools for scanning billions of lines of code. The TAO does not have to share all the exploits it makes use of, even with other units in the NSA. That includes the NSA Threat Operations Center, which is responsible for protecting government and military computers.

As zero days pass between the attack and its discovery by the public discovery, it helps the government hackers to remain undetected and to proceed quickly if required. Using other methods to hack systems obstructs and slows down the process, and security experts warn that lag could be destructive and calamitous in a national emergency.

In response to the presidential guidance, the NSA issued a statement that it never used the Heartbleed bug, a glitch in Internet traffic called OpenSSL. The matter is further complicated because Heartbleed has to be turned into a specific exploit thereby creating a class of vulnerabilities rather than just a single one. A small difference in the way the platform like OpenSSL is exploited could lead to differing conclusions about whether the exploits are the same.

According to sources, the agency was aware of the flaw and had used it as part of the intelligence gathering toolkit, and the information released by Snowden showed that the agency had a program for cracking the SSL codenamed BULLRUN.

NSA has many ways to evade the security of SSL and OpenSSL. One work-around is not to block the SSL software but to break into a different system on the target computer on which the software depends. Disclosing this method may increase computer security in general and the NSA might have to consider a hacking technique instead of an SSL vulnerability.

According to Chritopher Soghoian, Principal Technologist, American Civil Liberties Union, “The White House discussion about the government’s policy for its arsenal of zero days represents a major step forward despite the shortcomings in the policy itself.” The government reserves the right to accumulate and supply bugs that which it believes are in the interest of national security or law enforcement.

Jason Healy, Director, Cyber Statecraft Initiative, Atlantic Council in Washington, said implementing the new guidelines requires institutional barriers to be swept away. He said that it is not clear if the new guidance is applicable only to newly discovered vulnerabilities or if it will be applicable for the existing stockpile, which represents millions of dollars of research and development.

He concluded stating that the only way to discover may be through a sudden rise in software patches from major vendors who are now immediately trying to fix flaws which was only known to the NSA previously.