10

From the conference scene and news this year it seems probable that there's an increased amount of spending from governmental agencies on what it getting termed "Cyber Weapons". A key component of these weapons are 0-day vulnerabilities which can be used to get access to systems which may not otherwise present an exploitable flaw.

This in turn has created a trade and market value (which can apparently be quite high) in 0-day sales to governments, with a number of companies springing up to facilitate sales.

Whilst I've seen quite a bit of conversation on the effects of this on security in general, I've not seen too much on the effects on the software development industry, and I'd be interested to here where people think this trend will have an impact.

So far thoughts that had occurred to me

  • There's now an incentive for developers to either deliberately introduce flaws into software (or to fail to patch them) so that they can sell knowledge of this flaw on to 3rd parties.
  • Software companies may come under pressure not to patch issues which are being actively used by the military in "Cyber Space" operations.
  • Software vendors may find it harder to sell to governments other than their home nation as the assumption becomes that they will put back doors or leave exploitable flaws unpatched at the behest of government agencies.
Improve this question
3
  • 1
    Ah yes, cyber-*, the vendor's favourite prefix.
    – Polynomial
    Commented Oct 4, 2012 at 7:37
  • yeah I know, not my favourite prefix thus the quotes, but it seems to be the language that's getting used to describe these things...
    – Rory McCune
    Commented Oct 4, 2012 at 8:01
  • Indeed. It's managed to attach itself to so much infosec sales BS that I generally equate it to FUD these days.
    – Polynomial
    Commented Oct 4, 2012 at 8:07

2 Answers 2

Reset to default
2

Finding people who can get a clearance and program is going to become a priority, just like in the Aerospace/Defence industry, getting people who can do engineering and get a clearance is a priority.

Dead wood people who have a clearance will have job security.

Some kind of certification (of people) and "flight certification" of software will be common, but will just be another worthless hoop to jump through. If the cost of certifying software becomes high enough, all progress will stop, just like in commercial aircraft.

Improve this answer
3
  • Definitely think clearance/vetting will increase further. +1
    – Rory Alsop ♦
    Commented Oct 4, 2012 at 15:03
  • There is no small supply of smart people who are able to get a security clearance. We only have to look at the many people who are at Microsoft, Apple, and other huge companies with people with history in a agency like the NSA. Being able to get a security clearance isn't all that hard, all one has to do is provide accurate information, and at the very basic level provide a complete timeline of where they lived for a period of time. There was a report that indicated that even despite Steve Jobs history with drugs he was able to get one( but apparently turned it down).
    – Ramhound
    Commented Oct 4, 2012 at 15:39
  • @Ramhound: getting a "Confidential" or even a "Secret" isn't that hard, but what about Q-clearances (the Dept of Energy atom bomb knowledge clearances)? What about the clearances above Top Secret? If "Olympic Games" was for real, it was classified well above Top Secret.
    – Bruce Ediger
    Commented Oct 5, 2012 at 2:30
7

I think the most likely outcome would be delayed patches to fixes at the behest of friendly governments. Consider:

  1. Deliberately introducing flaws is not an easy thing. Anyone from the organization could look at the code and see the flaw - so the details might leak.
  2. Continuing point one, if the flaw causes an issue for customers, that would be bad rep for the company.
  3. Protectionism exists already in other industries.
  4. I assume governments do a cursory check of what they install, just in case.
  5. Governments probably use air gaps for anything important. That would reduce the likelihood of the exploit being exploitable if the air gap is properly maintained.

All of this boils down to one thing: the least worst course for a software company that wishes to help a government is to let them find the flaw, and then not patch it for an agreed window especially if it doesn't cause any issues.

Improve this answer
5
  • I heard a rumor around 1988 that the NSA (or some TLA) did exactly what you suggest: "They've got big notebooks full of bugs, for every operating system, even VMS!" And that the TLA in question used those bugs (didn't call them vulns back then) to do nefarious things to the commies.
    – Bruce Ediger
    Commented Oct 3, 2012 at 22:29
  • Concerning point 1, details might leak, but what if the intended goal is nonetheless accomplished? See a rumoured case in the days of mechanical encryption: en.wikipedia.org/wiki/Crypto_AG
    – Mok-Kong Shen
    Commented Oct 3, 2012 at 22:38
  • I wouldn't believe everything you read Bruce. There has been a huge push to use commercial software by the US Government since 1988. In order for the rumor to be true the NSA would have had to collect these bugs on software some other agency was also using. While one can argue that we really don't know what the NSA has done in the last 20 years, and there have beenlaws on the books that seemed to prompt NSA's ability to do certain things, it wouldn't be in the interest of the NSA to collect bugs on software they also have to use in addition the rest US Government.
    – Ramhound
    Commented Oct 4, 2012 at 15:34
  • @Ramhound: See "Farewell Dossier" and en.wikipedia.org/wiki/Siberian_pipeline_sabotage . By 1988 it was well known that the Soviets were acquiring VAXes, so why wouldn't some TLA do that?
    – Bruce Ediger
    Commented Oct 5, 2012 at 2:33
  • @lazrus, some interesting points there, on 1. I'm not sure I agree introducing a flaw could be as simple as ommiting a validation check and I don't think that all software QA/testing processes are rigorous enough to catch that. on 2) you'd think so, but commercial software vendors like Oracle have sat on serious security issues for years without much adverse affect. 4) you'd think wouldn't you but then again experience suggests differently 5) Gov/Mil do use airgaps, but I've not seen it used much in commercial envs.
    – Rory McCune
    Commented Oct 6, 2012 at 9:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .