• Hey, guest user. Hope you're enjoying NeoGAF! Have you considered registering for an account? Come join us and add your take to the daily discourse.

Microsoft Said To Give Zero Day Exploits To US Government Before It Patches Them

P

Poetic.Injustice

Member
Last month, we had written about how the feds were certainly collecting hacks and vulnerabilities for offensive purposes, but it wasn't clear at the time that some of these exploits were coming directly from the companies themselves.

The report names one major participant: Microsoft:

Microsoft Corp. (MSFT), the world’s largest software company, provides intelligence agencies with information about bugs in its popular software before it publicly releases a fix, according to two people familiar with the process. That information can be used to protect government computers and to access the computers of terrorists or military foes.

Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials. Microsoft doesn’t ask and can’t be told how the government uses such tip-offs, said the officials, who asked not to be identified because the matter is confidential.
Click to expand...

The same report, once again, implicates the big telcos for their cushy relationship with the intelligence community -- in which the telcos willingly and voluntarily hand over massive amounts of user data. There's no oversight here, because the telcos apparently have no problem dismantling the privacy of their users.

Some U.S. telecommunications companies willingly provide intelligence agencies with access to facilities and data offshore that would require a judge’s order if it were done in the U.S., one of the four people said.

In these cases, no oversight is necessary under the Foreign Intelligence Surveillance Act, and companies are providing the information voluntarily.
Click to expand...

http://www.techdirt.com/articles/20...to-us-government-before-it-patches-them.shtml

Does not bode well for Kinect, Does it?
 
E

Einbroch

Banned
So Microsoft turns a blind eye to bugs and exploits in systems that it sells to foreign nations and tells only the US about said exploits?

Why does that sound so slimy and wrong?
 
FranXico

FranXico

Member
The thing is, this does not just impact the XBox brand. Windows PCs worldwide effectively have backdoors only known to the NSA.
 
F

Freezie KO

Banned
FranXico said:
The thing is, this does not just impact the XBox brand. Windows PCs worldwide effectively have backdoors only known to the NSA.
Click to expand...

Yeah, but what's the NSA going to do? Wiretap everyone's phone conversation and keep all their metadata? Sure, buddy...
 
T

TheD

The Detective
And shit like this is why I am going to start using Linux for my everyday net usage and only switch to windows for games.
 
C

Chris M. Ferguson

Neo Member
Y'know, this console war is fun and everything, but supporting Microsoft/Skype after their long romantic relationship with the NSA is dumb. Vote with your wallets. This coming from someone who just sold their 360 last week.

TheD said:
And shit like this is why I am going to start using Linux for my everyday net usage and only switch to windows for games.
Click to expand...

Also +1 for Linux. Our only hope for the future is open source and owning what we buy.
 
T

ThoseDeafMutes

Member
This is a repost from an OT thread but has actually already got more discussion than the original thread so I'll leave it open.

ThoseDeafMutes said:
For some historical context, in the 1990's there was a Bill introduced that tried to make it legally mandatory for the creators of cryptographic protocols to include back-doors into them so that the government could break these codes. The PGP protocol was released in direct response to this, although that rule never became legally binding. The protocol's creator was taken to court though, because at the time any algorithm that made use of cryptographic keys of more than 40 bits in length was considered to be a "munition", which he had exported.
Click to expand...
 
S

Sendaquill

Neo Member
Einbroch said:
So Microsoft turns a blind eye to bugs and exploits in systems that it sells to foreign nations and tells only the US about said exploits?
Click to expand...

No, that's not what's being said:

provides intelligence agencies with information about bugs in its popular software before it publicly releases a fix
Click to expand...

There's no turning a blind eye to bugs.
 
B

Branduil

Member
ThoseDeafMutes said:
This is a repost from an OT thread but has actually already got more discussion than the original thread so I'll leave it open.
Click to expand...

The protocol's creator was taken to court though, because at the time any algorithm that made use of cryptographic keys of more than 40 bits in length was considered to be a "munition", which he had exported.
Click to expand...

The heck?
 
B

Bending_Unit_22

Member
Something that redounds to Microsoft's advantage in my eyes. Having the largest most important software house should benefit its nation and her allies.

Einbroch said:
So Microsoft turns a blind eye to bugs and exploits in systems that it sells to foreign nations and tells only the US about said exploits?

Why does that sound so slimy and wrong?
Click to expand...

Yes, exactly, and it isn't (Great Britain, Canada, Australia, and Israel would learn at the same time I suspect, maybe Japan as well).
 
K

King Tubby

Member
SummitAve said:
Would you trust somebody that regurgitates garbage?
Click to expand...

Sorry that I'm not as willing to give Microsoft the benefit of the doubt as you are. I don't see any reason to trust them as a company, just going by the news and their actions.

Is the Kinect going to stream video of its users to the gubmint 24/7? No, probably won't stream an iota of video. It doesn't have to. It analyzes what it captures and turns it into data. How much it analyzes and records and transmits to Microsoft's cloud is a mystery. I'm not taking their word when they say they'll preserve and protect my privacy, if there's even a possibility they could do otherwise without my knowledge. I guarantee that one of the whole ideas behind the Kinect being so integral to the console is to collect such data for marketing purposes, like Facebook on steroids.

People are fond of saying that even if all of everyone's data is visible to the government or a corporation, there's so much of it that it would be impossible to even take a cursory view of. But that work will be done more and more by computers, which only get faster and more capable with time. With the trends in technology and intelligence gathering, the future is scary. Xbox One is trying to set yet another precedent in terms of what formerly private information can be collected, stored, and transmitted from consumers, and eventually analyzed to all hell once the processing power catches up with it.
 
R

RedStep

Member
King Tubby said:
Xbox One is trying to set yet another precedent in terms of what formerly private information can be collected, stored, and transmitted from consumers, and eventually analyzed to all hell once the processing power catches up with it.
Click to expand...

You realize you just made every word of that up, right? None of what you stated as fact has even been suggested, much less leaked or confirmed.
 
S

SummitAve

Banned
King Tubby said:
Sorry that I'm not as willing to give Microsoft the benefit of the doubt as you are. I don't see any reason to trust them as a company, just going by the news and their actions.
Click to expand...

The US government used the power of the FISA law (Foreign Intelligence Surveillance Law) to gain access to certain kinds of information from data companies like Microsoft. They weren't just willing to hand over sensitive information like you are assuming. I don't believe you understand the color of the law or how the recent PRISM program even worked. You saw the overblown headlines (original news sources such as the Washington Post have backed off since) and other irate posters and decided to keep perpetuating nonsense because hating Microsoft is the in thing to do right now.

King Tubby said:
Would you trust a company that is willing to give out personal data of its users to government agencies at a whim with an always-connected, always-listening HD camera in your home?
Click to expand...


I mean read that again, and tell me that there is any basis to your accusations.
 
N

Nachtmaer

Member
King Tubby said:
People are fond of saying that even if all of everyone's data is visible to the government or a corporation, there's so much of it that it would be impossible to even take a cursory view of. But that work will be done more and more by computers, which only get faster and more capable with time. With the trends in technology and intelligence gathering, the future is scary. Xbox One is trying to set yet another precedent in terms of what formerly private information can be collected, stored, and transmitted from consumers, and eventually analyzed to all hell once the processing power catches up with it.
Click to expand...

The thing that worries me is that most people will be like, "What does it matter? I have nothing hide anyway."
 
W

Walshicus

Member
Legit question: would Americans prefer Microsoft didn't inform your intelligence services of known-but-not-yet-patched exploits?
 
G

GoofsterStud

Member
Sir Fragula said:
Legit question: would Americans prefer Microsoft didn't inform your intelligence services of known-but-not-yet-patched exploits?
Click to expand...

Why would they care. It's not like people won't own the system. Also they aren't hiding anything and looking deceptive in the process. Most people who are dead set on getting the next Xbox will ignore this or be uninformed anyway.
 
G

Garrett 2U

Member
GoofsterStud said:
Why would they care. It's not like people won't own the system. Also they aren't hiding anything and looking deceptive in the process. Most people who are dead set on getting the next Xbox will ignore this or be uninformed anyway.
Click to expand...

Much more importantly, anyone with a Window OS should be worried about it if this is a big deal
 
S

Surreal

Member
SummitAve said:
The US government used the power of the FISA law (Foreign Intelligence Surveillance Law) to gain access to certain kinds of information from data companies like Microsoft. They weren't just willing to hand over sensitive information like you are assuming. I don't believe you understand the color of the law or how the recent PRISM program even worked. You saw the overblown headlines (original news sources such as the Washington Post have backed off since) and other irate posters and decided to keep perpetuating nonsense because hating Microsoft is the in thing to do right now.
Click to expand...

I agree that guy is taking it a bit too far, but assuming that PRISM is the extent of the CIA's digital information gathering efforts doesn't seem realistic. They don't built stuff like this for no reason. Fact is Snowden ruined the rest of his life to tell people about PRISM and if he didn't do that, we'd never know about it. Tech giants (although surely they didn't have a choice in the matter) and the government were pretty comfortable never telling anyone about this stuff. So it begs the question, what else do we not know?

From what I can see, the government has been giving tech companies more and more protections in exchange for access to user information. So while the Kinect probably isn't streaming a 1080p video feed to some CIA headquarters, would it be so far fetched to assume that the government would be interested in what metadata the Kinect gathers for marketing purposes or otherwise?
 
Alx

Alx

Member
Sir Fragula said:
Legit question: would Americans prefer Microsoft didn't inform your intelligence services of known-but-not-yet-patched exploits?
Click to expand...

I think that should be the prime motivation for that : give the government enough time to patch security-sensitive infrastructures, then make the exploits public. Of course it cannot prevent the government to use it for its own benefits.
What we should know to defend that theory is :
- how much time in advance do they warn the government ?
- do they also provide the patch first, or just point to the exploits ?
 
K

King Tubby

Member
RedStep said:
You realize you just made every word of that up, right? None of what you stated as fact has even been suggested, much less leaked or confirmed.
Click to expand...

Which part? The "formerly private information can be collected, stored, and transmitted" is certainly true. It doesn't have to be suggested, leaked, or confirmed (although it has).

That Article said:
This isn't the first time Microsoft has dealt with privacy issues related to Kinect. When the first iteration of Kinect headed to the market in 2010, Microsoft's Dennis Durken suggested to investors that the peripheral might pass data to advertisers about how you look, play, and speak. "We can cater what content gets presented to you based on who you are," he said, sparking privacy concerns. (Microsoft later denied that the Kinect would use information for targeted advertising.) But even then, the first Kinect was only enabled in specific situations, and didn't have an always-on listening mode.

...

We aren't using Kinect to snoop on anybody at all. We listen for the word 'Xbox on' and then switch on the machine, but we don't transmit personal data in any way, shape or form that could be personally identifiable to you, unless you explicitly opt into that.
Click to expand...

The implication of that being, of course, that data is being collected and transmitted. As for the second part of my statement, it's the logical conclusion.

SummitAve said:
The US government used the power of the FISA law (Foreign Intelligence Surveillance Law) to gain access to certain kinds of information from data companies like Microsoft. They weren't just willing to hand over sensitive information like you are assuming. I don't believe you understand the color of the law or how the recent PRISM program even worked. You saw the overblown headlines (original news sources such as the Washington Post have backed off since) and other irate posters and decided to keep perpetuating nonsense because hating Microsoft is the in thing to do right now.
Click to expand...

You know, I'll concede in one respect. I don't think Microsoft was doing anything intently malicious in giving that information. They're just a company, they have to comply with the law. If the Foreign Intelligence Surveillance Court approves it, as they approved more or less indiscriminately collecting the metadata of millions of Verizon customers, then companies more or less have to comply with the request. So that changes nothing about my statement, except perhaps for the inferred tone. This is a new capacity for surveillance that Microsoft is introducing, whether willingly or not. They are making it possible.
 
J

jorma

is now taking requests
Redmond, Washington-based Microsoft (MSFT) and other software or Internet security companies have been aware that this type of early alert allowed the U.S. to exploit vulnerabilities in software sold to foreign governments, according to two U.S. officials. Microsoft doesn’t ask and can’t be told how the government uses such tip-offs, said the officials, who asked not to be identified because the matter is confidential.
Click to expand...

Absolutely disgusting if true, and it WILL impact government and b2b sales for MS in the long term. No foreign govenment will want to use windows, and any foreign company afraid of industrial espionage will risk using windows. Crazy shit.
 
I

itxaka

Defeatist
Im pretty sure this is false.

MS is not giving out 0-day exploits to them. They probably have a nice backdoor and give them acess to it.

0-day exploits have to be patched and backdoors don't, unless they are found.
 
You must log in or register to reply here.

Similar threads

China bans Intel and AMD processors, Microsoft Windows from government computers
Business
37
3K
Nankatsu replied
US government denies ESRB's AI-powered face-scanning 'age estimation' proposal
News
30
2K
Spukc replied
Financial Times: How Brad Smith used Microsoft’s $1bn law and lobbying machine to win Activision battle
News Drama Business 2 3
127
9K
Topher replied
Nvidia reports record earnings, profits on growth in AI and gaming
Business Analysis Hardware 2
68
4K
FStubbs replied
How the Microsoft-Activision merger could change the Xbox business (Protocol)
Opinion 2
67
6K
ChuckeRearmed replied
Top Bottom