7 ms·

It's always a nation state. A great way to increase defence budgets and not have to admit incompetence.

ardit33 6y ago
I have seen a couple of corporate hacks (not publicized) who happened to be Russian groups hosted in Syria.... By state 'sponsored' it can mean many things, even if the countries just let them be and some officials get bribed to not do anything. In this case it was in Syria, which is a fundamental mess, but the fact that it was Russian groups and they have military presence there, it is enough to put it 'state sponsored' label... .. Edit: This was a purely commercial/blackmail type of thing, so I doubt it was the Russian government/Putin involved directly, but it could just be a side hustle of the same people that do try to hack government targets. If they have the facilities and the state protection, might as well make some money on the side.
- seniorivn 6y ago
  don't underestimate Putin's greed the very friends who are known to be connected to "private" militias operating in Syria, also own companies making money from all sorts of activities of regular people, like 2% of all regular household transactions goes through their bank etc
  - koreanguy 6y ago
    the Americans are making billions from raytheon, the Saudi coalition. The Obama administration sold weapons to saudi to kill yemen people. greed comes worse from the other side.
    - mjburgess 6y ago
      he said putin specifically. An oligarch who stole a nation's wealth in a period of mass destabilisation; and is likely the richest person in the world.
- oceanplexian 6y ago
  I’ve seen these things, including large DDoS attacks from both sides, black hat and white hat. I’ve also been recruited by Cyber Command, NSA, etc. The one thing that rings true is that governments and corporations vastly overestimate the capabilities of nation states, and vastly underestimate the capabilities of unaffiliated hacking groups and individuals. Most of the cutting edge InfoSec work is being done in OSS and the public domain. The Snowden NSA leaks, although ancient history at this point, confirmed a lot of this for me. The only exception would be where the government can flex muscle in low tech applications they can throw money or legal resources at (MiTM/interception, obsolete tech like SCADA) but otherwise I’ve never been been impressed.
  - vmception 6y ago
    And if you arent RPCing into a random Russian computer 5 minutes after browsing darknet markets, what are you doing aside from being discriminated against by captcha’s all day? I would not trust any declaration of “state sponsored hack” and it is a distinction that doesn't really matter but causes more harm than good
  - Godel_unicode 6y ago
    >...obsolete tech like SCADA... ...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps...
    - nobody9999 6y ago
      >>...obsolete tech like SCADA... >...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps... Wow! 2010 called. They want their ideas about what makes the world go back.[0] That's just crazy talk. Everyone knows that hardware has been completely deprecated. It's all clouds. Mostly cumulo-nimbus, in fact. Power plants, chip fabs, heavy machinery, machine tools, factory automation and logistics systems are completely obsolete and never, ever used anymore. Because there's cloudiness, hardware is just a waste of money and space, which is why we can stack 600MB of js libraries on top of each other so we can have the browser render an opaque 40x40px box. [0] https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law (Please refer to the above link reference to resolve any confusion.)
- octoberfranklin 6y ago
  Yeah if I were a blackhat I would launch all my attacks from a cheap VPS in Tehran and sprinkle random Russian gibberish throughout my binaries. Guaranteed nobody will come looking for me. Sincerely yours, Evil mastermind
  - HexagonalKitten 6y ago
    Twenty-five year ago that would fool people. Now things are complex enough that you can't help but leave clues even as you're trying to plant them. The DPR was caught in part from a post on Stack Overflow where he was asking a question unique to his platform. Imagine how hard it would be to write the Flame malware. Now imagine the NSA and CIA hunting for traces afterword. Building that malware required deep information on many system that would likely require badges or intensive social engineering to access, both of which leave traces. Do you really think you could hide? I'm an expert (of sorts) and I'm not sure that I could buy drugs on the dark web 100% securely if those resources were hunting me.
    - xiphias2 6y ago
      You can try to blame somebody else (or even multiple people) by leaving deliberate traces. Cyberwarfare is the most assymetric warfare that we have.
      - octoberfranklin 6y ago
        No, virological warfare gets that award. And I don't mean computer viruses.
    - octoberfranklin 6y ago
      Yeah I'd be safe. If they were looking for me they would find me, but as soon as somebody shouts "Teh Russianz Did It!" everybody stops looking!
syshum 6y ago
Key fact of government is that it NEVER fails, NEVER. It always just a matter of spending a few more billions in tax payer money, you see the program/agency/task/what ever would have work perfectly if we just spend more money
cheaprentalyeti 6y ago
What if it's Lupus instead?

I have seen a couple of corporate hacks (not publicized) who happened to be Russian groups hosted in Syria.... By state 'sponsored' it can mean many things, even if the countries just let them be and some officials get bribed to not do anything. In this case it was in Syria, which is a fundamental mess, but the fact that it was Russian groups and they have military presence there, it is enough to put it 'state sponsored' label... .. Edit: This was a purely commercial/blackmail type of thing, so I doubt it was the Russian government/Putin involved directly, but it could just be a side hustle of the same people that do try to hack government targets. If they have the facilities and the state protection, might as well make some money on the side.

seniorivn 6y ago
don't underestimate Putin's greed the very friends who are known to be connected to "private" militias operating in Syria, also own companies making money from all sorts of activities of regular people, like 2% of all regular household transactions goes through their bank etc
- koreanguy 6y ago
  the Americans are making billions from raytheon, the Saudi coalition. The Obama administration sold weapons to saudi to kill yemen people. greed comes worse from the other side.
  - mjburgess 6y ago
    he said putin specifically. An oligarch who stole a nation's wealth in a period of mass destabilisation; and is likely the richest person in the world.
oceanplexian 6y ago
I’ve seen these things, including large DDoS attacks from both sides, black hat and white hat. I’ve also been recruited by Cyber Command, NSA, etc. The one thing that rings true is that governments and corporations vastly overestimate the capabilities of nation states, and vastly underestimate the capabilities of unaffiliated hacking groups and individuals. Most of the cutting edge InfoSec work is being done in OSS and the public domain. The Snowden NSA leaks, although ancient history at this point, confirmed a lot of this for me. The only exception would be where the government can flex muscle in low tech applications they can throw money or legal resources at (MiTM/interception, obsolete tech like SCADA) but otherwise I’ve never been been impressed.
- vmception 6y ago
  And if you arent RPCing into a random Russian computer 5 minutes after browsing darknet markets, what are you doing aside from being discriminated against by captcha’s all day? I would not trust any declaration of “state sponsored hack” and it is a distinction that doesn't really matter but causes more harm than good
- Godel_unicode 6y ago
  >...obsolete tech like SCADA... ...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps...
  - nobody9999 6y ago
    >>...obsolete tech like SCADA... >...wow. you're aware that "obsolete tech" is what basically all critical infrastructure uses, right? The world is bigger than FAANG webapps... Wow! 2010 called. They want their ideas about what makes the world go back.[0] That's just crazy talk. Everyone knows that hardware has been completely deprecated. It's all clouds. Mostly cumulo-nimbus, in fact. Power plants, chip fabs, heavy machinery, machine tools, factory automation and logistics systems are completely obsolete and never, ever used anymore. Because there's cloudiness, hardware is just a waste of money and space, which is why we can stack 600MB of js libraries on top of each other so we can have the browser render an opaque 40x40px box. [0] https://en.wikipedia.org/wiki/Poe%27s_law https://en.wikipedia.org/wiki/Poe%27s_law (Please refer to the above link reference to resolve any confusion.)
octoberfranklin 6y ago
Yeah if I were a blackhat I would launch all my attacks from a cheap VPS in Tehran and sprinkle random Russian gibberish throughout my binaries. Guaranteed nobody will come looking for me. Sincerely yours, Evil mastermind
- HexagonalKitten 6y ago
  Twenty-five year ago that would fool people. Now things are complex enough that you can't help but leave clues even as you're trying to plant them. The DPR was caught in part from a post on Stack Overflow where he was asking a question unique to his platform. Imagine how hard it would be to write the Flame malware. Now imagine the NSA and CIA hunting for traces afterword. Building that malware required deep information on many system that would likely require badges or intensive social engineering to access, both of which leave traces. Do you really think you could hide? I'm an expert (of sorts) and I'm not sure that I could buy drugs on the dark web 100% securely if those resources were hunting me.
  - xiphias2 6y ago
    You can try to blame somebody else (or even multiple people) by leaving deliberate traces. Cyberwarfare is the most assymetric warfare that we have.
    - octoberfranklin 6y ago
      No, virological warfare gets that award. And I don't mean computer viruses.
  - octoberfranklin 6y ago
    Yeah I'd be safe. If they were looking for me they would find me, but as soon as somebody shouts "Teh Russianz Did It!" everybody stops looking!

syshum 6y ago

Key fact of government is that it NEVER fails, NEVER. It always just a matter of spending a few more billions in tax payer money, you see the program/agency/task/what ever would have work perfectly if we just spend more money

cheaprentalyeti 6y ago

What if it's Lupus instead?