4 ms·
Recap: An attacker exploited a vulnerability on their firewall that allowed unauthenticated users to reboot. Exploit was public, firewall was unpatched. Unlikel
by yourad_io 7y ago
Recap: An attacker exploited a vulnerability on their firewall that allowed unauthenticated users to reboot. Exploit was public, firewall was unpatched. Unlikely that the attack was targeted, making "cyber-attack" somewhat of a stretch in my book.
- badrabbit 7y agoS/Unlikely/unknown
- arcticfox 7y agos/unknown/unlikely, according to the expert quoted in the piece. > "So far, I don't see any evidence that this was really targeted," said Reid Wightman, senior vulnerability analyst at industrial cybersecurity firm Dragos Inc. "This was probably just an automated bot that was scanning the internet for vulnerable devices, or some script kiddie," he said, using a term for an unskilled hacker.
- themark 7y agoPeople still say script kiddie?
- badfrog 7y agoWhy not?
- de_watcher 7y agoWhat's the other term?
- badrabbit 7y agoInformally I'd say unlikely,formal analysis? Unknown. It is also likely for APT attackers maintain an inventory of their target's network. The "scan" could very well be an APT actor testing the exploit or using it as a distraction for other attacks. It's best to list what is possible and conclude there isn't enough information to lean either way. Maybe it's just semantics but I believe retroactive analysis should not list attribution without some evidence. Proactive analysis can of course state what attackers are likely to employ specific attacks.
- tastroder 7y agoTheir first lesson learned: "Follow good industry practices for vulnerability and patch management". Retroactive or not, this sounds like just about every article about ransomware "attacks". > there isn't enough information to lean either way Somebody messed up keeping their infrastructure up to date, there is nothing in the article or linked document to suggest otherwise. Probabilities exist and the probability of automated scripts scanning a network segment for known vulnerabilities is still higher than an "APT" misbehaving and rebooting firewalls. Not leaning either way is often just feeding an unrealistic picture with FUD, which I find unconstructive.
- badrabbit 7y agoI think you miss the whole point of an analysis. It isn't to enable some public discussion. The purpose is to present facts to decision makers that will use the information in the analysis to justify changes. Proactive can be speculative for obvious reasons. Retroactive carries a muh higher weight since we're talking about what has happened not what could have or may have happened. It's important to be very clear as to avoid misinterpretation,a decision maker that isn't familiar with the subject matter might misunderstand "unlikely" to mean you know for sure more sophisticated attackers will are not likely to have used this technique (after all, you have evidence on your hands) but what you meant is statistically these attacks are more likely to be untargeted. Especially non-technical readers don't know if you're guessing ,guesstimating based on objective trends or using evidence from the attack and comparing it with known attacker TTP. That's why i made the formal/informal distinction. Informally,i know what you /author meant.