Should feds worry about the NSA leak?

A leak of alleged NSA exploits that includes previously undisclosed flaws in Cisco routers has been met largely with official silence.

Shutterstock image: open lock.

The leak of a payload of zero-day exploits, allegedly lifted from a National Security Agency server, could pose problems for federal networks, but so far the government’s cybersecurity first responders have been quiet about the incident.

The Department of Homeland Security’s U.S. Computer Emergency Readiness Team has not raised an alarm. A DHS official told FCW that because exploits related to the disclosures have not been released, any threat is hypothetical, and it's hard for experts to recommend specific defenses at this point.

From a technical standpoint, the extent of vulnerability in government systems is unclear. Matthew Green, an assistant professor of computer science at Johns Hopkins University, said the good news is that most of the exploits are for out-of-date routers. He added that in theory, an upgrade path should have made the devices safe by now.

"The problem is that many companies, including the federal government, are probably running out-of-date router software even today,” Green said. "I would hope that federal agencies -- if they have any sense -- are systematically updating the software on all of their routers right now. That could be a pretty daunting task, given how many of these devices there are."

An older line of Cisco products were vulnerable to exploits maintained by the Equation Group, which cybersecurity firm Kaspersky Lab has identified as probably linked to NSA. Cisco issued a security update advising customers about updates to help defend against the exploits.

Another potential line of defense is the Einstein network-protection system DHS operates for federal civilian networks. The system uses threat signatures to detect and deflect intrusion attempts. Although some of those signatures are shared among public- and private-sector cyber defenders, others are classified.

Jason Healey, a senior fellow at the Atlantic Council and a former military cyber operative, told FCW that it is possible that threat signatures for vulnerabilities maintained by the U.S. intelligence community are included in the Einstein security screen.

"Is that plausible?" he asked. "From what I've been able to learn about this process: yes."

Even if NSA does not share such highly classified threat signatures with Einstein, the signatures issued by Cisco could be added to the system, said Ann Barron-DiCamillo, former director of US-CERT and currently CTO at Strategic Cyber Ventures.

She said that behind the scenes, the National Security Council and others are working on responses for federal civilian agencies. Unlike the Heartbleed vulnerability discovered in OpenSSL in 2014, a single patch is not available, and agencies will have to assess their risks and potential exposure.

A senior administration official declined to comment on the release of the exploits, but noted that DHS had released a binding operational directive in May 2015 – in the wake of the hack of the Office of Personnel Management -- requiring federal civilian agencies to patch or mitigate known critical vulnerabilities on their networks within a specified time frame.

Federal cyber responders will have to tell agency IT leaders that "if there is anything leveraged in the wild beyond what was disclosed in the news,… and make sure there is a place to go for updates," Barron-DiCamillo said.

Zero-day equities

NSA's Tailored Access Operations group is responsible for reverse engineering vulnerabilities in commercial systems and network appliances, and former members have identified the latest exploits as the group’s handiwork.

But the decision to keep the vulnerabilities secret is made at the policy level. In 2014, the Obama administration revealed the existence of a "vulnerabilities equities process" for the first time, in which officials from across the government make decisions about whether to publicly reveal their knowledge of flaws in software and systems.

At the time, White House Cybersecurity Coordinator Michael Daniel said, "Building up a huge stockpile of undisclosed vulnerabilities while leaving the internet vulnerable and the American people unprotected would not be in our national security interest."

However, in June, two former White House cybersecurity experts published a paper arguing that a more transparent, clearly articulated process was needed to improve public confidence.

Healey said the Equation Group material proves the thesis of the paper. The Cisco routers at risk were a widely used piece of internet infrastructure, and as the exploits aged, their intelligence value likely diminished.

"You need periodic review" of zero-day exploits held by the government, he said. "You can't just continue to sit on them."

Barron-DiCamillo agreed and said there are risks to nondisclosure. "The U.S. government doesn't have the only cadre of reverse engineers," she added. Other government or non-state actor could acquire the exploits and point them at U.S. targets, including federal networks.

Even less clear than the process of disclosing flaws to vendors and the public is how and when such flaws are communicated among government agencies, including from NSA to the IT chiefs at the Pentagon.

The Defense Department declined to comment on whether such communications took place with regard to the Equation Group material.

David Wennergren, a former deputy CIO at DOD, told FCW that "it would be naïve to think that the DOD CIO wasn't aware of what NSA had access to and knowledge of."

Wennergren, who is now senior vice president for technology at the Professional Services Council, said there is regular information sharing between NSA's Tailored Access Operations and DOD.

Outside the Pentagon, it's another matter. He said it's quite likely that other government agencies did not receive any warning about the vulnerabilities.

Mark Rockwell contributed reporting to this story.

 

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.