The capitalist tool suggesting capitalism does not work as desired. Remarkable.
India: Offensive Cyber Activity or a Swipe at Specialized Software and Threat Intelligence
September 29, 2021
I read “Exclusive: An American Company Fears Its Windows Hacks Helped India Spy On China And Pakistan.” The write up reports:
A U.S. company’s tech was abused by the Indian government, amidst warnings Americans are contributing to a spyware industry already under fire for being out of control.
The write up’s emphasis is on an intriguing point; to wit:
Sometimes American companies aren’t the victims, but the ones fueling costly digital espionage.
The named firm is Exodus. Forbes presents this factoid, which I assume is “true”:
“They’re significant because the size of the market is relatively small, and the skill set required [to find zero days] is in possession of just a few thousand people worldwide at any given time,” says Katie Moussouris, founder of Luta Security and creator of Microsoft’s bug bounty program to reward hackers for vulnerability disclosures.
Okay, the market is small. And the expert? From another low profile outfit called Luta. But the story is not straight forward.
Exodus pumped out a report of an exploit. India’s technology professionals (presumably one of the few thousand in the world) recognized the value of the information. Then hunted around for another vulnerability its cyber fighters could employ.
The Forbes’s report says:
Any such zero-day spill would be especially concerning coming from a company that tries to keep a lid on around 50 zero days a year, covering the world’s most popular operating systems, from Windows to Android to Apple’s iOS. And Brown isn’t alone in seeing his creation used in ways he didn’t intend.
Exodus cut off India from its threat information. The write up concludes:
With the supply there, American government is hungry for hacks of all kinds of technologies.
Several observations:
- How many companies pump out threat intelligence? Are there other examples of “customers” using threat intelligence to develop cyber weapons?
- Why is Microsoft opining about security; specifically, NSO Group? The reasons exploits exist may be in part due to the security posture of Microsoft itself. No, Windows 11 did not distract me from noticing the Redmond giant’s magnetism for bad actors.
- What’s the agenda for this story? A lack of regulation? The behavior of the many, many outfits engaged in generating alerts, notices of exploitable flaws, or the damage done by leaking once secret specialized software into the public spotlight?
Stephen E Arnold, September 29, 2021
Comments
-
- Subscribe to Beyond Search
Feature archive
News archive
-
