5 ms·

it's very telling how everyone here is making the same mistakes USA intelligence made on 911 itself. 911 was some internal actors, sponsored by some CIA traine

by gcb0 8y ago

it's very telling how everyone here is making the same mistakes USA intelligence made on 911 itself. 911 was some internal actors, sponsored by some CIA trained warlord who they forgot from 20 years before, but they could only see attacks coming from big nation states. Here the comments are making the same mistake. cyber 911 can be something like a random operative who was given some covert training and now focus it on the coutry who trained them. instead everyone can only see full blown world war from well organized and funded nation states. my guess: the (israeli?) company the US outsourced scada atacks on iran (stuxnet) will start selling the same tech (which most US facilities are still vulnerable to) other actors, such as north korea or syrians who felt betrayed with the US constant side-changing.

tyingq 8y ago
I read the other comments, and it's not "everyone here", or even a majority. There's also one specifically pointing out that 9/11 wasn't state sponsored, posted more than an hour ago.
Haydos585x2 8y ago
I think you're right. I wrote about this in a mediocre essay for a university competition (https://nickhayden.com/blog/war-poverty-and-the-human-elements-of-cybersecurity/ https://nickhayden.com/blog/war-poverty-and-the-human-elemen...) I think what we'll see is people living in poverty being radicalised, not too different from what we have in Syria, Iraq and Afghanistan except now instead of risking their lives attacking a US convoy they just start hitting businesses with invalid security until they find something big. We're probably not too far away from it.
- stef25 8y ago
  > until they find something big What do you envisage that to be?
  - Hextinium 8y ago
    If the electrical grid in the US to go down for greater than 2 weeks I think that could be an example of systematic shutdown that would be something big enough to sufficiently scare people into radically different habits.
  - Haydos585x2 8y ago
    Maybe this attacker gets into a few generic companies like accountants, builders, marketers. Nothing really valuable beyond the scope of the particular company and their customers. Maybe they find their way into a oil/gas/mining operation, specialised software development company or everyone's favourite example, the electrical grid/water systems. Without data to back it up, I think that most attackers don't want to cause nation-wide problems and are motivated by money or revenge against a specific target. The biggest risk for them is if they did nation-wide damage whether deliberately or accidentally they might be on the receiving end of a response similar to OBL. Whether or not that would happen I don't know but it's the perception that matters. My biggest reason for hope is that the people I've seen working in government and large corp security have been skilled, aware of the risks and are ready to put in the work keeping systems safe.
stef25 8y ago
> 911 was some internal actors, sponsored by some CIA trained warlord who they forgot from 20 years before, but they could only see attacks coming from big nation states. Despite popular opinion, Bin Laden wasn't trained by the CIA or a hero of the Afghan jihad. He hid out in caves Pakistan for the most of that war and made occasional forays in to Afghanistan with a rag tag group of "fighters" whose exploits were comical more than anything else. Bin Laden's family very much wanted him to "stop dicking around", as did the Saudi govt and secret service. If I'm not mistaken he was persona-non-grata in Saudi Arabia and the only country that would have him was Sudan, where he lived in squalor, even before 911 happened (source: The Looming Tower). > cyber 911 can be something like a random operative who was given some covert training and now focus it on the coutry who trained them Most of those tools are for espionage, not warfare. Stuxnet was sabotage, highly specialised and took huge amounts of effort to develop and deploy. Afaik Middle Eastern hackers are mainly defacing websites and N-Korea is hacking entertainment companies and robbing banks. The cyber realm is different from the physical world in the sense that it has much more eyes on it than 911 had during the planning phase. Stuxnet was discovered by a tiny E-European IT shop and examined by a handful of people working in the private sector. To really start a war using software (say by launching missiles) you'd need highly specialised, precisely targeted tools that aren't lying around to be sold by rogue agents.
- TheOtherHobbes 8y ago
  To really start a war you need to persuade the people with the missiles they should launch them. Or maybe that voters should elect someone who is more likely to launch them. That's a whole lot easier than hacking into the launch systems.

by gcb0 8y ago

tyingq 8y ago

I read the other comments, and it's not "everyone here", or even a majority. There's also one specifically pointing out that 9/11 wasn't state sponsored, posted more than an hour ago.

Haydos585x2 8y ago

I think you're right. I wrote about this in a mediocre essay for a university competition (https://nickhayden.com/blog/war-poverty-and-the-human-elements-of-cybersecurity/ https://nickhayden.com/blog/war-poverty-and-the-human-elemen...) I think what we'll see is people living in poverty being radicalised, not too different from what we have in Syria, Iraq and Afghanistan except now instead of risking their lives attacking a US convoy they just start hitting businesses with invalid security until they find something big. We're probably not too far away from it.

stef25 8y ago
> until they find something big What do you envisage that to be?
- Hextinium 8y ago
  If the electrical grid in the US to go down for greater than 2 weeks I think that could be an example of systematic shutdown that would be something big enough to sufficiently scare people into radically different habits.
- Haydos585x2 8y ago
  Maybe this attacker gets into a few generic companies like accountants, builders, marketers. Nothing really valuable beyond the scope of the particular company and their customers. Maybe they find their way into a oil/gas/mining operation, specialised software development company or everyone's favourite example, the electrical grid/water systems. Without data to back it up, I think that most attackers don't want to cause nation-wide problems and are motivated by money or revenge against a specific target. The biggest risk for them is if they did nation-wide damage whether deliberately or accidentally they might be on the receiving end of a response similar to OBL. Whether or not that would happen I don't know but it's the perception that matters. My biggest reason for hope is that the people I've seen working in government and large corp security have been skilled, aware of the risks and are ready to put in the work keeping systems safe.

stef25 8y ago

> 911 was some internal actors, sponsored by some CIA trained warlord who they forgot from 20 years before, but they could only see attacks coming from big nation states. Despite popular opinion, Bin Laden wasn't trained by the CIA or a hero of the Afghan jihad. He hid out in caves Pakistan for the most of that war and made occasional forays in to Afghanistan with a rag tag group of "fighters" whose exploits were comical more than anything else. Bin Laden's family very much wanted him to "stop dicking around", as did the Saudi govt and secret service. If I'm not mistaken he was persona-non-grata in Saudi Arabia and the only country that would have him was Sudan, where he lived in squalor, even before 911 happened (source: The Looming Tower). > cyber 911 can be something like a random operative who was given some covert training and now focus it on the coutry who trained them Most of those tools are for espionage, not warfare. Stuxnet was sabotage, highly specialised and took huge amounts of effort to develop and deploy. Afaik Middle Eastern hackers are mainly defacing websites and N-Korea is hacking entertainment companies and robbing banks. The cyber realm is different from the physical world in the sense that it has much more eyes on it than 911 had during the planning phase. Stuxnet was discovered by a tiny E-European IT shop and examined by a handful of people working in the private sector. To really start a war using software (say by launching missiles) you'd need highly specialised, precisely targeted tools that aren't lying around to be sold by rogue agents.

TheOtherHobbes 8y ago
To really start a war you need to persuade the people with the missiles they should launch them. Or maybe that voters should elect someone who is more likely to launch them. That's a whole lot easier than hacking into the launch systems.