Cyber Command Knows Its Tools Can Also Be Used By Their Targets

US military commanders say that when US Cyber Command and the National Security Agency use a capability against targets abroad, they understand it might eventually be used by an adversary.

The threat of having the NSA’s tools leaked has been an issue inside the agency for years now, former NSA contractor Edward Snowden brought it into the public domain when he revealed a trove of NSA programs in 2013, but the risk of having adversaries detect, obtain or reverse engineers NSA-used tools has become especially salient.

Researchers from cybersecurity firm Symantec revealed that a Chinese-linked hacking group had repurposed tools linked with the NSA as early as March of 2016 and used them to attack various targets around the world.

It is unclear how the group, known as Buckeye, obtained the tools, but Symantec assesses it is possible it observed an NSA-linked attack, then gathered enough info to repurpose the code. It is also possible Buckeye stole the tools from an unsecured server or leaked the code to the group, although Symantec said that was less likely.

“There’s always a risk calculus in any sort of operation that we take on in Cyber Command,” said David Luber, the executive director of US Cyber Command, during a recent media roundtable. “The commander Gen. Paul Nakasone looks at those scenarios every single day.”

According to The George Washington University’s National Security Archive, Cyber Command runs an internal deliberation process before deciding to launch a mission.

The deliberation includes an assessment of intelligence gain loss, a blowback assessment, an assessment of collateral effects, a legal review and a risk assessment report.

Through its Vulnerabilities Equities Process (VEP),  government officials determine to either withhold or disclose information to tech companies about newly discovered software flaws. The VEP allows the government to keep certain “limited categories” from being shared, the details of which remain classified.

According to an appendix the White House released two years ago, one of the factors officials consider in VEP deliberations is how widely used the affected product is. But the trade-off is to also consider whether flaws can be exploited to support intelligence collection and cyber operations.

Jordan Rae Kelly, the former director for Cyber Incident Response on the National Security Council who oversaw the VEP, said the deliberation is a balancing act.

“It’s about really looking and understanding vulnerabilities in a deep way,” Kelly, who is now senior managing director at FTI Consulting, told CyberScoop. “Understanding how agencies might use individual exploits or if the exploits will be used in a series of tools is part of the evaluation equation.”

Speaking to CyberScoop, Neil Jenkins, a former cyber adviser at the Department of Homeland Security, said that the Symantec research highlights possible flaws in the VEP.

“We have to be taking into better consideration how prominent an exploit is in the ecosystem. … This was a vulnerability in a Microsoft product in Windows,” Jenkins, now the chief analytic officer of the Cyber Threat Alliance, told CyberScoop. “That alone should have been enough to say … we should disclose this exploit.”

Kelly said she “wouldn’t say that any one factor is weighed more heavily” in the process.

The NSA, which is the executive secretariat of the VEP, has said in the past it’s disclosed 91 percent of the vulnerabilities it finds. In the case of the vulnerabilities that Buckeye was found to be using, the NSA shared its software vulnerabilities with Microsoft so it could patch the flaws, according to The New York Times.

The NSA would not comment on the VEP. Cyber Command and the White House’s National Security Council did not respond to request for comment.

The VEP’s review process, which traces its development back to the Obama administration, was only publicly disclosed for the first time in 2014. In those deliberations, the reviewers are supposed to consider whether exploiting the vulnerability will cause harm or if adversaries are likely to use the vulnerability for their own purposes.

Luber said that Cyber Command, just like other parts of the Department of Defense, participates in the review process.

“When it comes to working in an environment where our tools will be used in our operations, we participate just like other parts of the U.S. government in the VEP,” Luber said.

Cyberscoop

You Might Also Read:

‘Chinese Spies’ Had NSA Cyber Weapons Before The Shadow Brokers Leak:

America Remains Vulnerable To Cyber Attack:

 

 
« Two Years After WannaCry Severe Risks Remain
Is The US Planning A Cyber Attack On Iran? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

NESEC

NESEC

NESEC is a specialist in information security consulting services and solutions.

Cybernance

Cybernance

Cybernance provide an enterprise-wide, web-based software solution for managing and mitigating cyber risk based on key compliance frameworks.

Be Cyber Aware At Sea

Be Cyber Aware At Sea

Be Cyber Aware At Sea is a global maritime and offshore industry initiative to raise awareness and educate crew members and the offshore workforce.

Namogoo

Namogoo

Namogoo’s disruptive technology identifies and blocks unauthorized product ads that are injected into customer web sessions by client-side Digital Malware.

TÜV Informationstechnik (TÜViT)

TÜV Informationstechnik (TÜViT)

TÜViT is a leading service provider in the IT sector offering unbiased and independent tests and certifications of IT products, hardware, software, systems and processes.

Telecommunications Industry Association (TIA)

Telecommunications Industry Association (TIA)

TIA works to secure trust in networks by advocating public policy positions on the security of ICT equipment and services related to critical infrastructure, supply chain and information sharing.

ISEC7 Group

ISEC7 Group

ISEC7 Group is a global provider of mobile business services and software solutions. The company was one of the first movers in mobilising company and business processes.

Salt Security

Salt Security

Salt Security protects the APIs that are the core of every SaaS, web, mobile, microservices and IoT application.

Echosec Systems

Echosec Systems

Echosec Systems is a data discovery company delivering social media and dark web threat intelligence. Our web based security software delivers critical information for situational awareness.

Securd

Securd

Securd takes opportunities away from your cyber adversaries. Cloud-delivered zero-trust DNS firewall and web filtering protection keep your business network and remote employees safe.

Arkphire

Arkphire

Arkphire provide solutions across every aspect of IT to help your business perform better.

Polestar Industrial IT

Polestar Industrial IT

Polestar work on both sides of the IT & OT divide. Network, Data & Asset Security is our priority. Polestar installations are robust and resilient and comply with the appropriate security.

Pangu Laboratory

Pangu Laboratory

Beijing Qi an Pangu Laboratory Technology Co., Ltd. was established on the basis of Pangu laboratory, a well-known cyber security team.

Innov8tif

Innov8tif

Innov8tif is an AI company specialised in providing ID assurance solutions — helping digital businesses to prevent frauds by verifying and authenticating customers identity.

Kong

Kong

Kong - powering the API world. Increase developer productivity, security, and performance at scale with the unified platform for API management, service mesh, and ingress controller.

nandin Innovation Centre

nandin Innovation Centre

nandin is ANSTO’s Innovation Centre (Australian Nuclear Science and Technology Organisation) where science and technology entrepreneurs, startups and graduates come together.