6 ms·
As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed
by thephyber 6y ago
As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here).
The DoJ used similar wording when prosecuting Aaron Schwartz for using Python scripts to glue together "curl" calls.
- zitterbewegung 6y agoJust wait until Krebs on Security talks about it.
- dayjobpork 6y agoKrebs on Doxxing
- game_the0ry 6y agoI think you interpreted this dishonest PR spin just fine.
- IncRnd 6y agoOften, security bulletins will use the word sophisticated when describing multi-step attacks.
- Zircom 6y agoStep 1: Type in stolen username Step 2: Type in stolen password Step 3: Click log in button Step 4: ( •_• ) ( •_• )>⌐■-■ ( ⌐■_■) Step 5: I'm in One example of a "sophisticated" attack
- apocalypstyx 6y agoNow you're making me wonder how many places the sunglasses meme in unicode could be used as a valid password.
- Madzen__ 6y agoonly one way to find out (⌐■_■)
- hunter2_ 6y agoI think the metaphor of "orchestration" refers to, as an analogy to actually composing/arranging music for an orchestra, getting lots of other entities to do what one entity specifies that they do. Amplification of control. Not "basically anything." "Sophisticated" I suppose means above-average in complexity, which indeed could be "basically anything."
- dwd 6y agoUnless they come out with details of a convoluted deeper infiltration, escalation of privilege, and careful exfiltration of data over a period of time to escape detection I wouldn't buy the PR bs.
- all_blue_chucks 6y agoAs someone who works in cybersecurity, it is perfectly clear to me that victims of attacks don't want to sound inept in their announcements so they ALWAYS say attacks are "sophisticated," "orchestrated," or "advanced." Nobody is going to say "we were hacked because we lack even basic security precautions." Instead, everything is an "APT."
- mauvehaus 6y agoPoint of order: the victims of the attack are the million or so people reading about it in the news. The targets of the attack are doing their level best to control the narrative by spinning their attackers as extremely sophisticated so they don’t end up with a million or so people holding torches and pitchforks outside their offices.
- all_blue_chucks 6y agoWell, targets are also victims to some degree, but I get your gist. I would take it a step further: for identity theft the company that fails to verify your identity before reporting false info to a credit agency is at fault - for libel with damages. My SSN is not a form of authentication and using it as such should be a crime.
- tricolon 6y agoBy the way, it's Swartz
- GillBates666 6y agoMy Swartz is bigger than yours.
- ddod 6y agoSpeaking of misleading cybersecurity language, note how you used the term "nation-state", which is a word that indicates a specific subset of countries and is not just a fancy synonym for "country".
- thephyber 6y agoThat's an existing problem that hasn't been solved in geopolitical meatspace. I don't expect it to be solved in cybersecurity first. That said, for my understanding: which political bodies are countries but not nation-states? Is this a reference to places like Singapore and the Vatican, which are probably more accurately labeled city-states?
- juki 6y agohttps://en.wikipedia.org/wiki/Multinational_state https://en.wikipedia.org/wiki/Multinational_state > Present-day examples of multinational states are Afghanistan, Belgium, Bolivia, Bosnia and Herzegovina, Brazil, Canada, China, France, Ethiopia, India, Indonesia, Iraq, Madagascar, Malaysia, Mauritius, Montenegro, Nigeria, Pakistan, Philippines, Russia, Serbia, Singapore, South Africa, Spain, Sri Lanka, Suriname, Switzerland, United Kingdom and United States.
- Balgair 6y agoTo be fair, curl is a nightmare of pedantry without something like postman to deal with it all for you. BTW, when did postman come out anyway?
- Godel_unicode 6y agoIf by which you mean it adheres to the specs and does what you tell it to, then sure?
- thephyber 6y agoPostman is nice and ergonomic! curl is great if you already have the command crafted. My suspicion is that the Python script scraping a web page for URLs/IDs which then ran a curl shell command which saved the resulting document to the file system.
- AviationAtom 6y agoOn the subject of nation-states, they want the data to help out spies