Where is the responsibility of corporations in all of this? They have a cash pile that dwarfs the entire intel budget and ought to be the FIRST entities that invest in fixing their OWN products, right?
Somewhere around here :-
> "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!"
Sorry shareholders, you'll be getting a tiny dividend this year because we are spending a huge part of our 'profit' on backfixing all the shit we let slide said no CEO ever.
Right now, the process is:
1. Find a way to survey the target environment, learn what software and hardware they are running
2. Acquire vulnerabilities to exploit the known target software/hardware, either from a third-party, a contractor, or manual reverse engineering of those specific components.
3. Adapt mission specific payloads to use on the target.
4. Use for as long as needed.
5. Disclose to vendor after the purpose is served.
If the agency mission changed to be purely about discovery and reporting, that might not help the general public. If this were to happen, it seems like the focus would likely be on protection of only software/hardware in classified systems, as that is already their defensive mission. Instead of having things like EternalBlue patched we would have them open and available for a different party to discover. That seems worrisome to me, but I am really curious to know if you might have a different take on how this would work.
This is a strawman. No one knowledgeable is saying it would create 100% security, just that it would be a net increase in the security of our infrastructure.
What I'm saying is not to do nothing, but rather we need to have a plan for continued attacks (like how spam filters came into being) in addition to trying to get any and all vulns fixed.
Instead of (ab)using somebody else's mistakes to your own advantage (and possibly have it backfire) you could also tell that person about their mistakes so the whole world could benefit and there would be 1 issue less in the world to worry about.
Here's one reason such a stockpile could be used for good: say a previously unknown vuln is attacking "our" (whomever that is for you) infrastructure. The command and control has been traced back to a cluster that's vulnerable to one of the weapons in your stockpile. Now you can potentially disable it, stop it spreading, tell all of them to run an updated version of the code that essentially does nothing, etc. For all I know, this could have happened already.