3 ms·
Joe Fitz does not think much of this article. https://twitter.com/securelyfitz/status/1360266293190873090 https://twitter.com/securelyfitz/status/13602662931908
by kbrosnan 6y ago
Joe Fitz does not think much of this article. https://twitter.com/securelyfitz/status/1360266293190873090 https://twitter.com/securelyfitz/status/1360266293190873090
Worth reviewing the B-Sides PDX 2018 panel on the Supermicro "hack". The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. The reporter would take the attack that Joe came up with and ask another security researcher does this seem like a real threat. Then take the attack that the other researcher came up with and test Joe. https://www.youtube.com/watch?v=8omlNyUVllY https://www.youtube.com/watch?v=8omlNyUVllY
- yjftsjthsd-h 6y ago> The reporter was mirroring and testing for plausibility of comments from two or more security researchers attacks on each other. That seems completely reasonable? How else would a reporter tell if something is plausible in a field where they lack personal experience?
- kbrosnan 6y agoReporters do and should use this technique to understand what their article is about and verify a base understanding. They should be careful when it becomes an awkward game of telephone. [1] As Joe Fitz and Joe Grand say in the panel it is a theoretical attack. There are plenty of ways to do an attack with similar effectiveness for cheaper and with more precision. See NSA's ANT catalog where individual boards and devices were created to target specific individuals or organizations. [1] https://en.wikipedia.org/wiki/Telephone_(game) https://en.wikipedia.org/wiki/Telephone_(game)