LibreCryptography

"NOBUS" ('nobody but us')

This concept refers to a specific exploit / vulnerability that has been brought to the attention of the NSA that it decides to leave unpatched (or instructs the relevant vendor [i.e., Microsoft or Intel, for example, to leave unpatched]) in cases where the agency believes that they are the only ones with the knowledge, sophistication and resource to actually leverage a compromising attack against the software that utilizes the specific vulnerability / exploit that has been brought to their attention.

According to a statement from NSA Director Michael Hayden:

"You look at a vulnerability through a different lens if even with the vulnerability it requires substantial computational power or substantial other attributes and you have to make the judgment who else can do this? If there's a vulnerability here that weakens encryption but you still need four acres of Cray computers in the basement in order to work it you kind of think "NOBUS" and that's a vulnerability we are not ethically or legally compelled to try to patch – it's one that ethically and legally we could try to exploit in order to keep Americans safe from others."

www.tg-me.com/tw/LibreCryptography/com.librecryptography/278

124 viewsApr 30, 2021 at 10:18

"NOBUS" ('nobody but us')

This concept refers to a specific exploit / vulnerability that has been brought to the attention of the NSA that it decides to leave unpatched (or instructs the relevant vendor [i.e., Microsoft or Intel, for example, to leave unpatched]) in cases where the agency believes that they are the only ones with the knowledge, sophistication and resource to actually leverage a compromising attack against the software that utilizes the specific vulnerability / exploit that has been brought to their attention.

According to a statement from NSA Director Michael Hayden:

"You look at a vulnerability through a different lens if even with the vulnerability it requires substantial computational power or substantial other attributes and you have to make the judgment who else can do this? If there's a vulnerability here that weakens encryption but you still need four acres of Cray computers in the basement in order to work it you kind of think "NOBUS" and that's a vulnerability we are not ethically or legally compelled to try to patch – it's one that ethically and legally we could try to exploit in order to keep Americans safe from others."

BY LibreCryptography