Should feds worry about the NSA leak?

The leak of a payload of zero-day exploits, allegedly lifted from a National Security Agency server, could pose problems for federal networks, but so far the government’s cybersecurity first responders have been quiet about the incident.

The Department of Homeland Security’s U.S. Computer Emergency Readiness Team has not raised an alarm. A DHS official told FCW that because exploits related to the disclosures have not been released, any threat is hypothetical, and it's hard for experts to recommend specific defenses at this point.

From a technical standpoint, the extent of vulnerability in government systems is unclear. Matthew Green, an assistant professor of computer science at Johns Hopkins University, said the good news is that most of the exploits are for out-of-date routers. He added that in theory, an upgrade path should have made the devices safe by now.

"The problem is that many companies, including the federal government, are probably running out-of-date router software even today,” Green said. "I would hope that federal agencies -- if they have any sense -- are systematically updating the software on all of their routers right now. That could be a pretty daunting task, given how many of these devices there are."

An older line of Cisco products were vulnerable to exploits maintained by the Equation Group, which cybersecurity firm Kaspersky Lab has identified as probably linked to NSA. Cisco issued a security update advising customers about updates to help defend against the exploits.

Another potential line of defense is the Einstein network-protection system DHS operates for federal civilian networks. The system uses threat signatures to detect and deflect intrusion attempts. Although some of those signatures are shared among public- and private-sector cyber defenders, others are classified.

Jason Healey, a senior fellow at the Atlantic Council and a former military cyber operative, told FCW that it is possible that threat signatures for vulnerabilities maintained by the U.S. intelligence community are included in the Einstein security screen.

"Is that plausible?" he asked. "From what I've been able to learn about this process: yes."

Even if NSA does not share such highly classified threat signatures with Einstein, the signatures issued by Cisco could be added to the system, said Ann Barron-DiCamillo, former director of US-CERT and currently CTO at Strategic Cyber Ventures.

She said that behind the scenes, the National Security Council and others are working on responses for federal civilian agencies. Unlike the Heartbleed vulnerability discovered in OpenSSL in 2014, a single patch is not available, and agencies will have to assess their risks and potential exposure.

A senior administration official declined to comment on the release of the exploits, but noted that DHS had released a binding operational directive in May 2015 – in the wake of the hack of the Office of Personnel Management -- requiring federal civilian agencies to patch or mitigate known critical vulnerabilities on their networks within a specified time frame.

Federal cyber responders will have to tell agency IT leaders that "if there is anything leveraged in the wild beyond what was disclosed in the news,… and make sure there is a place to go for updates," Barron-DiCamillo said.

Zero-day equities

NSA's Tailored Access Operations group is responsible for reverse engineering vulnerabilities in commercial systems and network appliances, and former members have identified the latest exploits as the group’s handiwork.

But the decision to keep the vulnerabilities secret is made at the policy level. In 2014, the Obama administration revealed the existence of a "vulnerabilities equities process" for the first time, in which officials from across the government make decisions about whether to publicly reveal their knowledge of flaws in software and systems.

At the time, White House Cybersecurity Coordinator Michael Daniel said, "Building up a huge stockpile of undisclosed vulnerabilities while leaving the internet vulnerable and the American people unprotected would not be in our national security interest."

However, in June, two former White House cybersecurity experts published a paper arguing that a more transparent, clearly articulated process was needed to improve public confidence.

Healey said the Equation Group material proves the thesis of the paper. The Cisco routers at risk were a widely used piece of internet infrastructure, and as the exploits aged, their intelligence value likely diminished.

"You need periodic review" of zero-day exploits held by the government, he said. "You can't just continue to sit on them."

Barron-DiCamillo agreed and said there are risks to nondisclosure. "The U.S. government doesn't have the only cadre of reverse engineers," she added. Other government or non-state actor could acquire the exploits and point them at U.S. targets, including federal networks.

Even less clear than the process of disclosing flaws to vendors and the public is how and when such flaws are communicated among government agencies, including from NSA to the IT chiefs at the Pentagon.

The Defense Department declined to comment on whether such communications took place with regard to the Equation Group material.

David Wennergren, a former deputy CIO at DOD, told FCW that "it would be naïve to think that the DOD CIO wasn't aware of what NSA had access to and knowledge of."

Wennergren, who is now senior vice president for technology at the Professional Services Council, said there is regular information sharing between NSA's Tailored Access Operations and DOD.

Outside the Pentagon, it's another matter. He said it's quite likely that other government agencies did not receive any warning about the vulnerabilities.

Mark Rockwell contributed reporting to this story.