8 ms·

> I work for a US company that routinely has to deal with cyber attacks by Iranian professionals, probably government sponsored. It's hard to posit a moral hig

> I work for a US company that routinely has to deal with cyber attacks by Iranian professionals, probably government sponsored. It's hard to posit a moral high-ground here, when basically every state is actively seeking to undermine the others' cyber security, including the US. Stuxnet is one of the most formidable state-sponsored cyber security exploits, and that was targeted at Iran, it seems easy justification to increase their offensive capability. I have to admit some naivete here, I don't know the frequency and scale of cyber attacks emanating from Iran, but I'd guess that hostile foreign policy from the US would only intensify that threat towards the US.

chewbaxxa 7y ago
Maybe it’s just me, but I’m always baffled when people categorically claim that they know the source of their cyber attacks. It’s not exactly difficult for someone with the most basic knowledge of networking to disguise that information or masquerade as someone they’re not.
- TACIXAT 7y ago
  There is a lot more to tracking these groups than ip addresses. To impersonate any of the known groups you will need a lot of knowledge about the tools and infra that they use.
  - gdy 7y ago
    And how these 'known' groups got attributed to a particular country in the first place?
  - A2017U1 7y ago
    And if you have that knowledge it's impossible to imitate? Can't really tell if your comment is refuting or agreeing, attribution is hard.
    - kd5bjo 7y ago
      Knowing that a thing is true is categorically different from knowing how to do something— Knowing that group A uses technique B doesn’t automatically make you proficient at using B yourself. Masquerading as a particular cyber-attack group requires not only knowing what techniques and tools they tend to use, but also how to do those things yourself, while imitating their style. It’s not impossible, but neither is it trivial: We’re not talking about simply first impressions here, but fooling a concerted, post-hoc investigation.
      - computerex 7y ago
        Can you give some specific examples? What do you mean by "imitating their style"? What data would be used to "fingerprint" these groups?
        zPwoo 7y ago
        I'm no "cyber security expert", but from what I can understand it can be something as simple as, what was mentioned above, tracking ip addresses to analyzing the processes leading up to and used in the attack. Whether that is how they approach the target, the tools used and/or any evidence left behind. When a large enough amount of attacks are performed by one group you gain some insight in how they work & approach problems. Very similar to how law enforcement would be able to "fingerprint" a serial killer based on his patterns or how a professor would be able to tell you plagiarized the code for a project based on the pattern of your early assignments. People are not immune to patterns and habits. Groups, much like people, are effectively extensions of these patterns and habits but on a grander scale. In a normal workplace this is called company "culture".
        A2017U1 7y ago
        This is a great comment. Thanks.
mc32 7y ago
Do you think Russian efforts on this same front are a result of US policies? Should those policies change, stay the same or something else?
- gdy 7y ago
  Most certainly. See 'Prevent re-emergence of a new rival (1992)'[0] and 'From Lisbon to Vladivostok: Putin Envisions a Russia-EU Free Trade Zone (2010)'[1]. Can't let that happen, can you. [0] https://www.nytimes.com/1992/03/08/world/excerpts-from-pentagon-s-plan-prevent-the-re-emergence-of-a-new-rival.html https://www.nytimes.com/1992/03/08/world/excerpts-from-penta... [1] https://m.spiegel.de/international/europe/from-lisbon-to-vladivostok-putin-envisions-a-russia-eu-free-trade-zone-a-731109.html https://m.spiegel.de/international/europe/from-lisbon-to-vla...
stickfigure 7y ago
I don't think Stuxnet forfeits the moral high ground. It was narrowly focused on attacking a specific military project. It's exactly the kind of thing I want the CIA (or whatever) doing, especially if the alternative is sending bombs. State sponsored attempts to hack public network infrastructure fit into a totally different category. These are not the same.
- gdy 7y ago
  And why is it ok to attack another country's military project in the peace time? There are plenty of American military projects that deeply worry other countries.
  - stickfigure 7y ago
    I challenge you to name any American military project that is as worrisome as Iran's 'Supreme Leader of the Islamic Revolution' having control of a nuclear weapon.
    - gdy 7y ago
      Challenge accepted. "The US nuclear forces modernization program has been portrayed to the public as an effort to ensure the reliability and safety of warheads in the US nuclear arsenal, rather than to enhance their military capabilities. In reality, however, that program has implemented revolutionary new technologies that will vastly increase the targeting capability of the US ballistic missile arsenal. This increase in capability is astonishing—boosting the overall killing power of existing US ballistic missile forces by a factor of roughly three—and it creates exactly what one would expect to see, if a nuclear-armed state were planning to have the capacity to fight and win a nuclear war by disarming enemies with a surprise first strike." https://thebulletin.org/2017/03/how-us-nuclear-force-modernization-is-undermining-strategic-stability-the-burst-height-compensating-super-fuze/ https://thebulletin.org/2017/03/how-us-nuclear-force-moderni...
      - jfnixon 7y ago
throwaway-klsdj 7y ago
Maybe I can consider this in more familiar terms, as if both sides have guns. Do they use them differently? I at least can't know for sure. What it boils down to for me is which side do you want to win? Being fair and impartial doesn't mean considering that both of the nations are the same and the outcome will be the same if either side wins, with only a different name and flag for the victor. If the US wins, a rough semblance of the freedom and democracy the "West" is accustomed to will be able to face other existential internal or external threats. If Iran wins, the end. We start over at square one winning back our freedoms. Maybe we start immediately, maybe it takes 1,000 years. If I have to choose, I want the US to win this one. It doesn't matter who started it, who is doing it worse. I would like things that support the regime in Iran to stop supporting that regime (in the most humane way possible). And I would like the US, with all its warts and flaws, to win a cyber war with Iran if one must be fought. Maybe this all sounds extremely unlikely, but the first step towards a superpower like the USA to lose to Iran is for the USA to not be trying at all, and Iran to be trying very hard. Also nuclear weapons are a great leveler. Therefore the USA must do two things at minimum. Try to have cybersecurity supremacy over Iran, and try to keep Iran from having nuclear weapons. If both of these objectives can be met we don't need to fight them, we can leave them in peace. If either is not met, this war might have to get very physical very quickly. So right now the sanctions don't look so bad, among available options. Not saying there aren't better options, but it's above my pay grade.
- gdy 7y ago
  "If Iran wins, the end. We start over at square one winning back our freedoms." You really believe there is a threat of Iran occupying the US and it's the reason for the US policy towards Iran? Gosh, it's scary that people like you vote to choose the government controlling by far the most powerful military in the world.
- tsimionescu 7y ago
  > What it boils down to for me is which side do you want to win? Being fair and impartial doesn't mean considering that both of the nations are the same and the outcome will be the same if either side wins, with only a different name and flag for the victor. Your argument makes sense, but it starts with a very flawed assumption: that Iran wants to dominate the world. The reality accepted by everyone except the US and its few allies on this issue is that Iran is an extremely defensive country. The current regime, and the country in general, feels threatened in the region, being generally sorrounded by belligerent hostile countries, with the backing of the US (Saudi Arabia and Israel being the most powerful and the most belligerent). So, if Iran wins, what will actually happen is that Iran will be left alone to function just like any other non-democratic state. Is the regime bad for its people? Yes. Is it better than being at war? Absolutely. And regarding nuclear weapons, Iran has declared numerous times that it would gladly participate in an agreement, enforced by UN/IANA inspectors, to declare the entire region a nuclear-free area. Israel is blocking any such agreement. Iran has entered deals with the US and other western countries to renounce its nuclear weapons program in exchange for lifting the embargo and other kinds of help. The US has backed up from these deals twice now. The second time, they have not even claimed to have any evidence that Iran is not respecting the deal; and the other parties to the agreement, like the entire rest of 'the West' have in fact remained in the deal, as has Iran, despite the new US sanctions (deemed illegal by the UN).

chewbaxxa 7y ago

Maybe it’s just me, but I’m always baffled when people categorically claim that they know the source of their cyber attacks. It’s not exactly difficult for someone with the most basic knowledge of networking to disguise that information or masquerade as someone they’re not.

TACIXAT 7y ago
There is a lot more to tracking these groups than ip addresses. To impersonate any of the known groups you will need a lot of knowledge about the tools and infra that they use.
- gdy 7y ago
  And how these 'known' groups got attributed to a particular country in the first place?
- A2017U1 7y ago
  And if you have that knowledge it's impossible to imitate? Can't really tell if your comment is refuting or agreeing, attribution is hard.
  - kd5bjo 7y ago
    Knowing that a thing is true is categorically different from knowing how to do something— Knowing that group A uses technique B doesn’t automatically make you proficient at using B yourself. Masquerading as a particular cyber-attack group requires not only knowing what techniques and tools they tend to use, but also how to do those things yourself, while imitating their style. It’s not impossible, but neither is it trivial: We’re not talking about simply first impressions here, but fooling a concerted, post-hoc investigation.
    - computerex 7y ago
      Can you give some specific examples? What do you mean by "imitating their style"? What data would be used to "fingerprint" these groups?
      - zPwoo 7y ago
        I'm no "cyber security expert", but from what I can understand it can be something as simple as, what was mentioned above, tracking ip addresses to analyzing the processes leading up to and used in the attack. Whether that is how they approach the target, the tools used and/or any evidence left behind. When a large enough amount of attacks are performed by one group you gain some insight in how they work & approach problems. Very similar to how law enforcement would be able to "fingerprint" a serial killer based on his patterns or how a professor would be able to tell you plagiarized the code for a project based on the pattern of your early assignments. People are not immune to patterns and habits. Groups, much like people, are effectively extensions of these patterns and habits but on a grander scale. In a normal workplace this is called company "culture".
        A2017U1 7y ago
        This is a great comment. Thanks.

mc32 7y ago

Do you think Russian efforts on this same front are a result of US policies? Should those policies change, stay the same or something else?

gdy 7y ago
Most certainly. See 'Prevent re-emergence of a new rival (1992)'[0] and 'From Lisbon to Vladivostok: Putin Envisions a Russia-EU Free Trade Zone (2010)'[1]. Can't let that happen, can you. [0] https://www.nytimes.com/1992/03/08/world/excerpts-from-pentagon-s-plan-prevent-the-re-emergence-of-a-new-rival.html https://www.nytimes.com/1992/03/08/world/excerpts-from-penta... [1] https://m.spiegel.de/international/europe/from-lisbon-to-vladivostok-putin-envisions-a-russia-eu-free-trade-zone-a-731109.html https://m.spiegel.de/international/europe/from-lisbon-to-vla...

stickfigure 7y ago

I don't think Stuxnet forfeits the moral high ground. It was narrowly focused on attacking a specific military project. It's exactly the kind of thing I want the CIA (or whatever) doing, especially if the alternative is sending bombs. State sponsored attempts to hack public network infrastructure fit into a totally different category. These are not the same.

gdy 7y ago
And why is it ok to attack another country's military project in the peace time? There are plenty of American military projects that deeply worry other countries.
- stickfigure 7y ago
  I challenge you to name any American military project that is as worrisome as Iran's 'Supreme Leader of the Islamic Revolution' having control of a nuclear weapon.
  - gdy 7y ago
    Challenge accepted. "The US nuclear forces modernization program has been portrayed to the public as an effort to ensure the reliability and safety of warheads in the US nuclear arsenal, rather than to enhance their military capabilities. In reality, however, that program has implemented revolutionary new technologies that will vastly increase the targeting capability of the US ballistic missile arsenal. This increase in capability is astonishing—boosting the overall killing power of existing US ballistic missile forces by a factor of roughly three—and it creates exactly what one would expect to see, if a nuclear-armed state were planning to have the capacity to fight and win a nuclear war by disarming enemies with a surprise first strike." https://thebulletin.org/2017/03/how-us-nuclear-force-modernization-is-undermining-strategic-stability-the-burst-height-compensating-super-fuze/ https://thebulletin.org/2017/03/how-us-nuclear-force-moderni...
    - jfnixon 7y ago

throwaway-klsdj 7y ago

Maybe I can consider this in more familiar terms, as if both sides have guns. Do they use them differently? I at least can't know for sure. What it boils down to for me is which side do you want to win? Being fair and impartial doesn't mean considering that both of the nations are the same and the outcome will be the same if either side wins, with only a different name and flag for the victor. If the US wins, a rough semblance of the freedom and democracy the "West" is accustomed to will be able to face other existential internal or external threats. If Iran wins, the end. We start over at square one winning back our freedoms. Maybe we start immediately, maybe it takes 1,000 years. If I have to choose, I want the US to win this one. It doesn't matter who started it, who is doing it worse. I would like things that support the regime in Iran to stop supporting that regime (in the most humane way possible). And I would like the US, with all its warts and flaws, to win a cyber war with Iran if one must be fought. Maybe this all sounds extremely unlikely, but the first step towards a superpower like the USA to lose to Iran is for the USA to not be trying at all, and Iran to be trying very hard. Also nuclear weapons are a great leveler. Therefore the USA must do two things at minimum. Try to have cybersecurity supremacy over Iran, and try to keep Iran from having nuclear weapons. If both of these objectives can be met we don't need to fight them, we can leave them in peace. If either is not met, this war might have to get very physical very quickly. So right now the sanctions don't look so bad, among available options. Not saying there aren't better options, but it's above my pay grade.

gdy 7y ago
"If Iran wins, the end. We start over at square one winning back our freedoms." You really believe there is a threat of Iran occupying the US and it's the reason for the US policy towards Iran? Gosh, it's scary that people like you vote to choose the government controlling by far the most powerful military in the world.
tsimionescu 7y ago
> What it boils down to for me is which side do you want to win? Being fair and impartial doesn't mean considering that both of the nations are the same and the outcome will be the same if either side wins, with only a different name and flag for the victor. Your argument makes sense, but it starts with a very flawed assumption: that Iran wants to dominate the world. The reality accepted by everyone except the US and its few allies on this issue is that Iran is an extremely defensive country. The current regime, and the country in general, feels threatened in the region, being generally sorrounded by belligerent hostile countries, with the backing of the US (Saudi Arabia and Israel being the most powerful and the most belligerent). So, if Iran wins, what will actually happen is that Iran will be left alone to function just like any other non-democratic state. Is the regime bad for its people? Yes. Is it better than being at war? Absolutely. And regarding nuclear weapons, Iran has declared numerous times that it would gladly participate in an agreement, enforced by UN/IANA inspectors, to declare the entire region a nuclear-free area. Israel is blocking any such agreement. Iran has entered deals with the US and other western countries to renounce its nuclear weapons program in exchange for lifting the embargo and other kinds of help. The US has backed up from these deals twice now. The second time, they have not even claimed to have any evidence that Iran is not respecting the deal; and the other parties to the agreement, like the entire rest of 'the West' have in fact remained in the deal, as has Iran, despite the new US sanctions (deemed illegal by the UN).