13 ms·

Sophistication isn't necessarily mean technical wizardry. IMHO, it's pretty sophisticated to thoroughly look for easily-exploitable goofs, and extract maximum

by ardy42 6y ago

Sophistication isn't necessarily mean technical wizardry. IMHO, it's pretty sophisticated to thoroughly look for easily-exploitable goofs, and extract maximum value from them. The big advantage nation states have is probably mainly staffing and funding, and why use a zero-day when a leaked password will do?

porknubbins 6y ago
I can see how this could be called sophisticated, but worry about language inflation because we still need something to describe technical feats that are govt/military level like Stuxnet.
- ardy42 6y ago
  > I can see how this could be called sophisticated, but worry about language inflation because we still need something to describe technical feats that are govt/military level like Stuxnet. To start, I want to clear a potential confusion in my previous comment. By "technical wizardry" I meant "technical hacking wizardry," e.g. buffer overflows, ROP, etc. That said, I think Stuxnet and this hack may actually both be characterized by some of the same kind of sophistication I was referring to. IIRC, one of the biggest unique things about Stuxnet was the application of professional software engineering practices to malware. It wasn't a quick and dirty thing that one or two guys whipped up, it was a project, developed professionally over time by a team, to meet a set of requirements and allow code-reuse, etc. Not so much hacking wizardry but an application of government-scale money and personnel.
dx87 6y ago
Yeah, sophistication to me sounds more like the skill of the hacker. For example, logging in with leaked creds but cleaning up all relevant logs, and doing it during normal business hours for that account is a more sophisticated attack than using a zero day remote exploit and leaving a mess of evidence on the target systems.
deleted 6y ago
[deleted]
coldtea 6y ago
>IMHO, it's pretty sophisticated to thoroughly look for easily-exploitable goofs Yes, but only on opposite-day.

by ardy42 6y ago

porknubbins 6y ago

I can see how this could be called sophisticated, but worry about language inflation because we still need something to describe technical feats that are govt/military level like Stuxnet.

ardy42 6y ago
> I can see how this could be called sophisticated, but worry about language inflation because we still need something to describe technical feats that are govt/military level like Stuxnet. To start, I want to clear a potential confusion in my previous comment. By "technical wizardry" I meant "technical hacking wizardry," e.g. buffer overflows, ROP, etc. That said, I think Stuxnet and this hack may actually both be characterized by some of the same kind of sophistication I was referring to. IIRC, one of the biggest unique things about Stuxnet was the application of professional software engineering practices to malware. It wasn't a quick and dirty thing that one or two guys whipped up, it was a project, developed professionally over time by a team, to meet a set of requirements and allow code-reuse, etc. Not so much hacking wizardry but an application of government-scale money and personnel.

dx87 6y ago

Yeah, sophistication to me sounds more like the skill of the hacker. For example, logging in with leaked creds but cleaning up all relevant logs, and doing it during normal business hours for that account is a more sophisticated attack than using a zero day remote exploit and leaving a mess of evidence on the target systems.

deleted 6y ago

[deleted]

coldtea 6y ago

>IMHO, it's pretty sophisticated to thoroughly look for easily-exploitable goofs Yes, but only on opposite-day.