The attack that temporarily crippled the NHS in Britain and dozens of other institutions across Europe and Russia reveals the failure of the US government’s protocols for warning software developers and the private sector about system vulnerabilities, a cyber-security expert told the Guardian.
Under the vulnerability equities process (VEP) established by the US government, US intelligence agencies are supposed to collectively determine whether to disclose a vulnerability it has obtained or discovered – so the software developer has a chance to fix the problem – or withhold the information to use the flaw for offensive or defensive purposes.
“The NSA is supposed to lead the vulnerability equities process with all the other government agencies gathered round to discuss their interests in the vulnerability, and to weigh the offensive capabilities against defensive concerns for the private sector and US interests,” said Adam Segal, the director of the digital and cyberspace policy program at the Council on Foreign Relations. The EternalBlue-WannaCry attack showed that the NSA did not reveal the vulnerability it had discovered before it was stolen and apparently auctioned off, Segal said.
The US government has consistently indicated it is predisposed to releasing vulnerabilities and leaning toward taking a defensive position. In testimony, NSA director Mike Rogers has said the intelligence agencies revealed close to 90% of vulnerabilities they discover.
According to Segal, the Shadow Brokers case and Wikileaks’ recent ‘Vault 7’ release of CIA hacking tools have led to increasing suspicion that may only be true given a narrow definition of vulnerability.
“It seems that in this case their hand was forced. They knew the vulnerability was online because of Shadow Brokers and Vault 7 so they went to Microsoft and warned the company they needed to patch it,” he said. The attack affected PCs using Microsoft’s Windows operating system.
Jon Lindsay, director of the Trudeau Centre for Peace, Conflict and Justice at the Munk School of Global Affairs at the University of Toronto, said the cyber-intelligence community had for years anticipated the day when an offensive NSA “exploit” was obtained and released by hackers.
“The trade-off between exploits stockpiled for offensive rather than defensive purposes has been a sharp issue for many years and this attack really brings it home.”
While the defense intelligence agencies may have revealed 90% of the vulnerabilities they found, that still left 10% of offensive exploits that are had not been patched.
“When the Stuxnet code came out people talk about it as tutorial for how to use this, but Shadow Brokers cache have a lot more useable exploits,” Lindsay believes.
Such weaknesses, when discovered, are typically termed “zero-day vulnerability” because once they are discovered they may be used immediately to gain access to secure data, thus giving developers “zero days” to issue a patch.
“This could have been a lot worse, “ says Lindsay. “The attacker left this domain unguarded so the attack was easy to turn off.” These exploits, he predicts, “will continue to be incorporated into grey market attack tool-kits. Many will have already been patched, but some will be high-end, zero-day.”
But according to Segal, the fundamental flaw in the system lies between the government and the private sector.
“The patching and updating systems are broken, basically, in the private sector and in government agencies,” he said. “There’s no assurance that even if the government reveals a vulnerability people are going to move quickly enough to make and apply the patch.”
Without yet knowing who or which groups are behind the attack, experts are wary of assigning motive beyond extortion.
One of the theories is that the attack is an attempt to embarrass the NSA and the intelligence community, and to put more stress on the relationship between the government agencies and the private sector and the vulnerability equities process.
Still, the attack will discomfort the Trump administration, coming just days after the president signed an executive order to strengthen cybersecurity on federal networks and critical infrastructure.
Segal said he believed the attack is probably not related to the executive order but “part of a larger campaign to embarrass the intelligence community.”
The accompanying concern, he said, will be the government’s inability to secure vulnerabilities. “That opens a lot of questions about backdoors and access to encryption that the government argues it needs from the private sector for security.”
