3 ms·

It's hard to say to which extend this "assessment" is honestly backed by solid evidence, or if it was written first and foremost for political reasons. The broa

It's hard to say to which extend this "assessment" is honestly backed by solid evidence, or if it was written first and foremost for political reasons. The broad claims, apparent lack of factual evidence (only statements about what has been discovered), and rather overarching nature of the whole report, sure do suggest it could be the latter. Pure speculation on my own part, of course. I have not gone through the full report (yet), but while reading just a few sections my sales-pitch-bullshit-meter went on full tilt, at least a few times. The timing of this report is also peculiar, to say the least. Who is Finite State? What is their track record, to date? Who owns the company? What business relationships/interests do the company and its owners have? Yes, I realize/know these are suggestive questions. Questions that should nonetheless have satisfying/assuring answers, in order take this report seriously. There's a lot at stake here, so at least examining the validity of this report/summary isn't just a luxury. Are the factual findings behind this report publicly available?

gtirloni 7y ago
They did it using their analysis automation software (iotasphere) and the list of devices is in appendix A. Someone knowledgeable about forensics with access to the same devices probably can validate those claims.
- elmo2you 7y ago
  I sure hope that someone will. I do not have access these devices, neither do I have any inclination to buying their commercial product in order to verify their claims. Maybe their product is brilliant, and/or maybe they did a lot of manual verification of their automated scans, in which case their report could be accurate (though still hard to verify). That said, my experience with both static analysis and runtime security scanner is less than stellar. They are without a doubt useful tools, if not indispensable. But they usually generate more leads for further (manual) analyses, rather than generate (accurate) final verdicts. Granted that pen-testing is a different animal (but one I have more experience with), I often have had to explain to customers that the reports they got from security auditing companies were full of false conclusion. More often than not because those companies were relying/trusting too much on automatically generated results, in addition to them trying to sell additional services. So, forgive me if I'm skeptical. That Finite State apparently has a stake of their own here (promotion of their product), which makes me only less inclined towards giving them the benefit of a doubt. As I mentioned before, this is of course all speculation on my part. Still, until Finite State publishes their factual/detailed scan results, I believe I have every reason to consider that this might be either a political motivated report, or more likely be an attempt to use/abuse the current political climate to promote their own product and services.

gtirloni 7y ago

They did it using their analysis automation software (iotasphere) and the list of devices is in appendix A. Someone knowledgeable about forensics with access to the same devices probably can validate those claims.

elmo2you 7y ago
I sure hope that someone will. I do not have access these devices, neither do I have any inclination to buying their commercial product in order to verify their claims. Maybe their product is brilliant, and/or maybe they did a lot of manual verification of their automated scans, in which case their report could be accurate (though still hard to verify). That said, my experience with both static analysis and runtime security scanner is less than stellar. They are without a doubt useful tools, if not indispensable. But they usually generate more leads for further (manual) analyses, rather than generate (accurate) final verdicts. Granted that pen-testing is a different animal (but one I have more experience with), I often have had to explain to customers that the reports they got from security auditing companies were full of false conclusion. More often than not because those companies were relying/trusting too much on automatically generated results, in addition to them trying to sell additional services. So, forgive me if I'm skeptical. That Finite State apparently has a stake of their own here (promotion of their product), which makes me only less inclined towards giving them the benefit of a doubt. As I mentioned before, this is of course all speculation on my part. Still, until Finite State publishes their factual/detailed scan results, I believe I have every reason to consider that this might be either a political motivated report, or more likely be an attempt to use/abuse the current political climate to promote their own product and services.