4 ms·

Major powers set international standards, and failure to establish standards for cyber has produced a situation where exploitation of CVEs has become so normali

Major powers set international standards, and failure to establish standards for cyber has produced a situation where exploitation of CVEs has become so normalized that there are almost zero repercussions for using them in destructive ways. Especially if you are a non major power or non state actor, there seems to be little incentive not to wreak damage and havoc. The US and Europe have failed to clearly state the consequences for a major attack, instead, we muddle along assuming that that the implications will be enough. Even huge damage attacks by nation state actors such as the Sony North Korea hack seem to have gone unpunished.

tptacek 7y ago
Respectfully, that's pretty silly. People have been "wreaking havoc" with exploits for as long as there have been exploits. Nobody in the world was waiting for China's permission to do this kind of stuff. I don't think that's the previous commenter's argument.
- jorblumesea 7y ago
  No country "needed" permission for anything, ever. But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. The same can be said with the arms control treaties, nuclear weapons, non-proliferation, etc. That all seems to have gone out the window in the cyber realm, where there aren't any standards or consequences for nefarious actions. This seems like a very basic and obvious observation.
  - azernik 7y ago
    The "nobody" that didn't need China's permission are PRIVATE actors. Taboo on assassination by against great power leaders did not stop Lee Harvey Oswald, and likewise a balance of deterrence between China and the US on active sabotage hasn't kept criminals from carrying out the same kinds of attacks for profit.
  - PeterisP 7y ago
    It's not "gone out the window in the cyber realm" - as you say, the major powers were able to set informal international standards for intelligence, espionage and data collection, for themselves and for their allies, and those standards definitely, absolutely permit all such actions of SIGINT, industrial espionage and even sabotage. If a weaponised exploit could affect something in 1980s, then it would get used by intelligence agencies with no qualms, there wasn't any "gentleman's agreement" or the like that would make them think twice about that. E.g. there's description of supposed events in 1982 https://en.wikipedia.org/wiki/At_the_Abyss https://en.wikipedia.org/wiki/At_the_Abyss that may or may not be true, but noone on USSR or USA side would claim that this action (if it happened) would have broken some Cold War taboo. The basic observation is false - the standards haven't disappeared because (unlike major assasinations) there never were any informal standards that would prohibit this; and (unlike nuclear and missile arms) there have never been any formal treaties restricting this, nor are such standards or treaties likely to happen in the coming decades because multiple major powers believe that lack of such standards is beneficial to them.
  - Legogris 7y ago
    I have made the opposite conclusion - large parts of critical infrastructure are vulnerable today and we shouldn't underestimate just how disruptive and destructive one could be without great expertise. It's a ticking bomb. Trivial example, but try browsing Shodan for a wakeup call. And that's just already publicly indexed opportunities. We haven't seen anything yet.
  - anticodon 7y ago
    > But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. It didn't turn hot because of mutual destruction threat.

tptacek 7y ago

Respectfully, that's pretty silly. People have been "wreaking havoc" with exploits for as long as there have been exploits. Nobody in the world was waiting for China's permission to do this kind of stuff. I don't think that's the previous commenter's argument.

jorblumesea 7y ago
No country "needed" permission for anything, ever. But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. The same can be said with the arms control treaties, nuclear weapons, non-proliferation, etc. That all seems to have gone out the window in the cyber realm, where there aren't any standards or consequences for nefarious actions. This seems like a very basic and obvious observation.
- azernik 7y ago
  The "nobody" that didn't need China's permission are PRIVATE actors. Taboo on assassination by against great power leaders did not stop Lee Harvey Oswald, and likewise a balance of deterrence between China and the US on active sabotage hasn't kept criminals from carrying out the same kinds of attacks for profit.
- PeterisP 7y ago
  It's not "gone out the window in the cyber realm" - as you say, the major powers were able to set informal international standards for intelligence, espionage and data collection, for themselves and for their allies, and those standards definitely, absolutely permit all such actions of SIGINT, industrial espionage and even sabotage. If a weaponised exploit could affect something in 1980s, then it would get used by intelligence agencies with no qualms, there wasn't any "gentleman's agreement" or the like that would make them think twice about that. E.g. there's description of supposed events in 1982 https://en.wikipedia.org/wiki/At_the_Abyss https://en.wikipedia.org/wiki/At_the_Abyss that may or may not be true, but noone on USSR or USA side would claim that this action (if it happened) would have broken some Cold War taboo. The basic observation is false - the standards haven't disappeared because (unlike major assasinations) there never were any informal standards that would prohibit this; and (unlike nuclear and missile arms) there have never been any formal treaties restricting this, nor are such standards or treaties likely to happen in the coming decades because multiple major powers believe that lack of such standards is beneficial to them.
- Legogris 7y ago
  I have made the opposite conclusion - large parts of critical infrastructure are vulnerable today and we shouldn't underestimate just how disruptive and destructive one could be without great expertise. It's a ticking bomb. Trivial example, but try browsing Shodan for a wakeup call. And that's just already publicly indexed opportunities. We haven't seen anything yet.
- anticodon 7y ago
  > But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. It didn't turn hot because of mutual destruction threat.