While the US government says that it reports to industry more than 90 percent of the software flaws it discovers, so that they can be fixed, “Eternal Blue” was clearly part of the 10 percent it held on to in order to bolster American firepower. Microsoft never heard about the vulnerability until after the weapon based on it was stolen. Yet the US government acted as if it bore no responsibility for the devastating cyberattack. When I asked Bossert, and his deputy, Rob Joyce, who ran the TAO and clearly knew something of what happened to these pilfered weapons, they argued that the fault was
...more
