Latest in vulnerabilities
Sometimes we are reminded that the "noise" of policy drowns out important practical news. Today is one of those days. While we sit around worrying about Harvey Weinstein and Trump's latest tweet, it turns out that the encryption protocol at the core over almost all WiFi is vulnerable to attack.
Here is the report from Krack Attack. They open:
The Government Accountability Office last week published a report that, among other things, weighs in on the pros and cons of the NSA/CYBERCOM “dual-hat” system (pursuant to which the director of the NSA/CSS and commander of CYBERCOM are the same person). The report deserves attention but also some criticism and context. Here’s a bit of all three.
1. What is the “dual-hat” issue?
The WannaCry and Petya malware, both of which are partially based on hacking tools allegedly developed by the National Security Agency, have revived calls for the U.S. government to release all vulnerabilities that it holds. Proponents argue that this would allow patches to be developed, which in turn would help ensure that networks are secure. On its face, this argument might seem to make sense—but it is a gross oversimplification of the problem, one that not only would not have the desired effect but that also would be dangerous.