3 ms·

I’ve never liked the term ‘cyberweapon’. It is subtly misleading and gives the non-technical masses misconceptions about how exploits actually work. Cyberweapo

by valine 9y ago

I’ve never liked the term ‘cyberweapon’. It is subtly misleading and gives the non-technical masses misconceptions about how exploits actually work. Cyberweapon implies that exploits are created by governments and let loose on the world, when in reality exploits are existing flaws that were simply discovered by governments or individuals. Exploits are like a serious manufacturing defect in a lock that was only discovered after the fact. I think this misconception has real implications. If you compare exploits to Nuclear weapons, the public reaction will be we need more secrecy and more weapons to protect us from hostile nations. If however you changed the analogy to something like a defective lock, it become obvious that what we really need is openness so exploits can be fixed.

horsawlarway 9y ago
While I understand where you're coming from, and I agree with you to some extent, it's not really that simple. While the majority of exploits we currently see in the wild are things I think the "defective lock" analogy works well for, there's a subset of attacks that would be equivalent to cutting the lock with bolt cutters. In those cases, there are specially crafted tools that aren't exploiting a defective lock, they're destroying the basic premise that let the lock work. I'd say that RowHammer fits that description pretty aptly. It's a cyberweapon. It's not an exploit. It's so much of a weapon that (as far as I know, someone please correct me if I'm out of date!) there's still no known mitigation strategy that completely solves the problem. We have lots of partial mitigations, but nothing surefire yet. So... it's both. We certainly have lots of defective locks, but we also have some very nasty tools that exploit some fundamental premises of our tech in clearly malicious ways, and were absolutely designed and implemented to do exactly that.
- wybiral 9y ago
  In this case we're talking about the recent NSA exploits leaked by Shadow Brokers and then utilized by WannaCry and the Petya attack. Both of those had a "weapon" (the ransomware itself) that spread by way of an exploit found by NSA (a defect in Windows that people failed to patch). In this case, I feel that blaming NSA for the exploit and calling those "cyberweapons" is wrong. The entity who put the ransomware on top of them and deployed them built a weapon.
pyrale 9y ago
Chemical and biologic weapons also fit your bill: we didn't create or invent anthrax or smallpox. However, a government deliberately hiding results from their medical research, or misleading/exploiting their pharmacy industry would be in a dark ethical corner.

by valine 9y ago

horsawlarway 9y ago

While I understand where you're coming from, and I agree with you to some extent, it's not really that simple. While the majority of exploits we currently see in the wild are things I think the "defective lock" analogy works well for, there's a subset of attacks that would be equivalent to cutting the lock with bolt cutters. In those cases, there are specially crafted tools that aren't exploiting a defective lock, they're destroying the basic premise that let the lock work. I'd say that RowHammer fits that description pretty aptly. It's a cyberweapon. It's not an exploit. It's so much of a weapon that (as far as I know, someone please correct me if I'm out of date!) there's still no known mitigation strategy that completely solves the problem. We have lots of partial mitigations, but nothing surefire yet. So... it's both. We certainly have lots of defective locks, but we also have some very nasty tools that exploit some fundamental premises of our tech in clearly malicious ways, and were absolutely designed and implemented to do exactly that.

wybiral 9y ago
In this case we're talking about the recent NSA exploits leaked by Shadow Brokers and then utilized by WannaCry and the Petya attack. Both of those had a "weapon" (the ransomware itself) that spread by way of an exploit found by NSA (a defect in Windows that people failed to patch). In this case, I feel that blaming NSA for the exploit and calling those "cyberweapons" is wrong. The entity who put the ransomware on top of them and deployed them built a weapon.

pyrale 9y ago

Chemical and biologic weapons also fit your bill: we didn't create or invent anthrax or smallpox. However, a government deliberately hiding results from their medical research, or misleading/exploiting their pharmacy industry would be in a dark ethical corner.