Navy Solicits Vulnerabilities
Navy Solicits Vulnerabilities
Written by Alex Armstrong   
Wednesday, 17 June 2015

The US Navy is, or rather was last week, looking for contractors to supply it with zero-day vulnerabilities and similar - for what reasons?

News of the availability of a 12-month contract, with three further 12-month options, was posted as Solicitation Number N0018915T0245 on FedBizOpps. This is a publicly accessible site  where government agencies routinely post contracting opportunities.


The details of what were required were:

 “access to vulnerability intelligence, exploit reports and operational exploit binaries affecting widely used and relied upon commercial software,”

It specified the commercial products as including but not limited to:

Microsoft, Adobe, JAVA, EMC, Novell, IBM, Android, Apple CISCO IOS, Linksys WRT, Linux and all others

and that the vendor must be rated to Capability Maturity Model Integration (CMMI) Level 3 or greater.

As captured in a tweet from Dava Mass, the solicatation stated:


“the vendor shall provide the government with a proposed list of available vulnerabilities, 0-day or N-day (no older than 6 months old). . . The government will select from the supplied list and direct development of exploit binaries.” 




Shortly after this link was tweeted the page was removed but the Electronic Frontier Foundation recovered it from a Google cache so you can read still the solicitation in full (pdf).





The EFF, which posted the above cartoon also commented:

...the fact that the United States government is looking for vendors to sell it software vulnerabilities isn’t news—we’ve known for some time that the government uses software vulnerabilities, sometimes known as zero-days, for offensive intelligence-gathering and espionage. .

What’s more noteworthy is how little regard the government seems to have for the process of deciding to exploit vulnerabilities.  As we’ve explained before, the decision to use a vulnerability for “offensive” purposes rather than disclosing it to the developer is one that prioritizes surveillance over the security of millions of users.


Whether the contract has already been awarded we don't know. But if you have the right level of expertise the navy may still need you.



esapple - ESP8266 As An Apple 1

The ESP8266 is a marvel of modern technology a tiny $5 WiFi processor. The Apple 1 was a breakthrough design by Woz and now it is reborn as an emulation running on an ESP8266.

Quantum Computation on edX

A series of three courses from MIT on the theory and practice of quantum computation starts next week on the edX platform. One of the two instructors for the courses, which comprise videos of live lec [ ... ]

More News




blog comments powered by Disqus

Last Updated ( Wednesday, 17 June 2015 )

RSS feed of news items only
I Programmer News
Copyright © 2018 All Rights Reserved.
Joomla! is Free Software released under the GNU/GPL License.