4 ms·

> To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage wit

by aj3 6y ago

> To clarify, I am literally asking for a simplified threat model. That's a simplification beyond any usefulness. You wouldn't be able to do as much damage with $100k budget in a few months as a well-staffed national agency in a week. > The question is just me looking for broad strokes anecdotes. Even Jeff Bezos wouldn't be able to orchestrate a cyberattack that crashes International Space Station with astronauts aboard.

Veserv 6y ago
I do not care what parameter set you choose if you actually want to answer the question. Pick one, state the parameters, and then specify it. To illustrate: How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in? How much damage could a well-staffed national agency do in a week to that system? For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost? The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security? Jeff Bezos has over $100B. Therefore, I take your answer to mean: With $100B nobody could orchestrate an cyberattack that could crash the ISS? The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air-gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program? Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.

by aj3 6y ago

Veserv 6y ago

I do not care what parameter set you choose if you actually want to answer the question. Pick one, state the parameters, and then specify it. To illustrate: How much damage could somebody do with a $100K budget in a few months to the best system you have been personally involved in? How much damage could a well-staffed national agency do in a week to that system? For all credible adversaries that could cause $X in damage, choose the 20th percentile cost adversary, how much would that cost? The question is also specifically limited to systems the answerer has worked on to avoid speculation on practices or "grass is always greener" mentality. Did you work on the ISS on software or software security? Jeff Bezos has over $100B. Therefore, I take your answer to mean: With $100B nobody could orchestrate an cyberattack that could crash the ISS? The cost to develop the Stuxnet attack has been estimated to be $1M according to former director of the NSA General Hayden. This is likely an underestimate only accounting for the cost of the exploit itself. Kaspersky Lab claims it cost in the regime of $100M to develop and deploy. So, lets take the high number and multiple it by 10 leaving the cost of disabling the secret air-gapped Iranian Nuclear Weapons Program at $1B. Do you think the cost of a critical attack against the ISS is 100x higher than a critical attack on the Iranian Nuclear Weapons Program? Please avoid limiting your imagination to just direct attack on the ISS itself. There are multiple entities which when attacked would likely be able to de-orbit the ISS and kill all the astronauts. Please verify that none of these could occur for less than $100B: taking over a rocket to the ISS, taking over a rocket to LEO, active satellites in the correct orbital plane, decommissioned satellites that are no longer tracked but with enough fuel to intercept, scientist laptops that connect to the ISS network, over-drawing the laptop batteries so they blow up while in the ISS, etc. This also ignores more clever tactics you could do with $100B such as buy a company directly supplying critical needs of the ISS and then insert backdoors into the software.