8 ms·

The real take-away from this is that you have a _very_ competent cyber-actor (Iran) getting pancaked at will by an _extremely_ competent cyber-actor (Israel) in

by ajcp 6y ago

The real take-away from this is that you have a _very_ competent cyber-actor (Iran) getting pancaked at will by an _extremely_ competent cyber-actor (Israel) in what one would presume to be one of it's most, _if not most_, cybersecure locations (Natanz). Nation-states using cyber capabilities in this way, and the non-response it evokes, is reminiscent of how pre-WWI nation-states would conduct policy and international affairs with their armies. It's something I wish the general public were more cognizant of. We need to openly talk about this type of power and conflict. Otherwise we're going to have another WWI-type moment, where it takes millions of people dying before we realize that the state of the game has changed because of new technologies.

shoto_io 6y ago
There is a new cyber study from HP and a UK Uni. “We may be at far greater risk from the internet than was ever suspected,” Michail McGuire, senior lecturer of criminology, said. His new study of the nation-state cybersphere shows that we may be closer to advanced cyber conflict (cyberwar) than at any point since the inception of the internet. I thought it was far fetched, but incident like this show it’s not. https://press.hp.com/content/dam/sites/garage-press/press/press-releases/2021/web-of-profit/hp-bps-web-of-profit-report-april-2021.pdf https://press.hp.com/content/dam/sites/garage-press/press/pr...
- ajcp 6y ago
  > A cyber-treaty won’t be coming overnight: As a comparatively new area of international relations, there are fewer 'rules' and far more grey areas – for example, blurred lines between Advanced Persistent Threat (APT) groups and Nation States. While there is hope we will one day come to an agreement on cyberwarfare and cyberweapons, today there is very little in place that can stem the tide. And there it is on page 1! Excellent contribution, thank you so much for this.
- Jon_Lowtek 6y ago
  "closer" as in "if you listen to the firewall log, you can hear the artillery"
deleted 6y ago
[deleted]
lovedswain 6y ago
> _very_ competent cyber-actor Please elaborate on this. As someone with direct exposure to this area and in this geography, my experience could not be described this way at all. Let's not forget Iran's first "military satellite" was launched with an over the counter unencrypted amateur cubesat transponder manufactured by a Californian company
- dfsegoat 6y ago
  I am not at all involved in security, but from my novice understanding, they appear somewhat competent. Wiping of a US casino's IT infra in 2014: https://arstechnica.com/information-technology/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/ https://arstechnica.com/information-technology/2014/12/irani... Breaching of critical power/water infrastructure in 2015: https://www.cbc.ca/news/technology/hackers-infrastructure-1.3376342 https://www.cbc.ca/news/technology/hackers-infrastructure-1....
  - tedivm 6y ago
    What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech. For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting. Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.
    - stunt 6y ago
      If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.
kevin_thibedeau 6y ago
> a _very_ competent cyber-actor (Iran) Nation state security competence includes locking down USB ports so someone can't deploy malware found off the street.
- ajcp 6y ago
  The same thing that has plagued the U.S. DoD since the advent of USB, but there's no denying that the U.S. is an _extremely_ competent cyber-actor.
  - rebuilder 6y ago
    It seems defense is harder than offense in this context.
  - kijin 6y ago
    Attacking is often easier than defense. How many countries that have ICBMs can reliably block incoming ICBMs?
    - emodendroket 6y ago
      On paper or in reality?
      - spijdar 6y ago
        Either, really. Very few have the ability even in theory, whether anyone could intercept a bunch of ICBMs launched "in anger" seems questionable. Seems like an apt analogy talking about cybersecurity defenses.
        emodendroket 6y ago
        Well yeah, that’s what I mean. I’m not convinced any of these actually work.
- GartzenDeHaes 6y ago
Natsu 6y ago
I wonder if they sealed up their USB ports so nobody would randomly plug in a USB key this time?
waihtis 6y ago
Having competency in red team scenarios doesn't translate to having a cyber-proof national infrastructure, as is evident. They are actually two wildly different problem sets. And the latter is boring & unsexy.
- tetha 6y ago
  Also in my opinion, blue teaming is harder. Red team has to find one weakness to win. If blue team misses any system, vulnerability, process, anything, they are in trouble against the right attackers. This can be seen by how many automated infiltration agents are around, and how few automated defense systems. And how annoyingly succesful they are.
  - waihtis 6y ago
    Absolutely. The cyber security asymmetry in play. I'm actually working on this problem so it's very close to heart!
dan-robertson 6y ago
> Nation-states using cyber capabilities in this way Strictly speaking, Iran is not a nation-state. It is a multiethnic state. The way to avoid this confusion is to write ‘state’ (problem here is that this word also refers to American states) or ‘country’ (I think people might feel like this word is not sufficiently sophisticated?). However the error is understandable as it is particularly common in discussions about cybersecurity (or national security, where ‘national’ means the USA). It’s especially silly in those cases as some typical US adversaries (Iran, Russia) are states which are not nation states.
- ajcp 6y ago
  This is true, although when I was studying international relations "nation-state" was an accepted catch-all for a "top-level" polity in international politics.
- tptacek 6y ago
  "State-level actor" is, I guess, the accurate schmancy way to say "country".
- gen220 6y ago
  Is it not the case that a nation can be multiethnic? I don’t see how Iran’s multiethnic populace disqualifies it’s claim on a national identity (Shia Islam). On the wiki page for multinational states, I find reasonable examples (Russia, Belgium, UK), and Iran is absent. [1] Does this have to do with the Kurdish nation claiming territory within Iran? Not trying to say you’re wrong, just trying to understand the terminology better. [1]: https://en.m.wikipedia.org/wiki/Multinational_state https://en.m.wikipedia.org/wiki/Multinational_state
  - dan-robertson 6y ago
    Nation is a word with two meanings. One is ‘country’ so the answer is yes (note that nation-state is a silly phrase under this meaning). You see it in terms like nationalisation of industry or national anthem. The other meaning is a group of people with (typically) shared ethnicity, cultural heritage, language, and often, country. For this a multiethnic country doesn’t usually fit the bill. But to some extent words can mean whatever you want them to and lots of groups want themselves to be considered nations (either to promote some unity across diverse people or to push out undesirable groups) even if they don’t strictly fit the usual definition.
pengaru 6y ago
Nothing in the article speaks to either Iran's nor Israel's cyber competencies, those aren't take-aways, you brought them. From where I'm sitting, Iran is a cyber circus.
- ajcp 6y ago
  The article is reporting on an event. We apply analysis and context to that event so that we may understand it's implications and effects. We then conduct our lives accordingly. In that we have taken something away with us from the article.
29athrowaway 6y ago
Can be achieved not only through technological means but also sabotage and infiltration.
MeinBlutIstBlau 6y ago
Pretty sure there is a myriad of american working and middle class that would outright oppose a draft now more than ever. The government would have to go full on chinese censorship with the internet to suppress free speech regarding why you shouldn't have to go.
A4ET8a8uTh0 6y ago
Sadly, I think I agree with your assessment that we are in a pre-next world war mode. There are now multiple smaller scale events that could easily transform from a local to a regional conflict. Reasonable people should be worried, because at least in WW2 we couldn't destroy the entire planet with one wrong move.

by ajcp 6y ago

shoto_io 6y ago

There is a new cyber study from HP and a UK Uni. “We may be at far greater risk from the internet than was ever suspected,” Michail McGuire, senior lecturer of criminology, said. His new study of the nation-state cybersphere shows that we may be closer to advanced cyber conflict (cyberwar) than at any point since the inception of the internet. I thought it was far fetched, but incident like this show it’s not. https://press.hp.com/content/dam/sites/garage-press/press/press-releases/2021/web-of-profit/hp-bps-web-of-profit-report-april-2021.pdf https://press.hp.com/content/dam/sites/garage-press/press/pr...

ajcp 6y ago
> A cyber-treaty won’t be coming overnight: As a comparatively new area of international relations, there are fewer 'rules' and far more grey areas – for example, blurred lines between Advanced Persistent Threat (APT) groups and Nation States. While there is hope we will one day come to an agreement on cyberwarfare and cyberweapons, today there is very little in place that can stem the tide. And there it is on page 1! Excellent contribution, thank you so much for this.
Jon_Lowtek 6y ago
"closer" as in "if you listen to the firewall log, you can hear the artillery"

deleted 6y ago

[deleted]

lovedswain 6y ago

> _very_ competent cyber-actor Please elaborate on this. As someone with direct exposure to this area and in this geography, my experience could not be described this way at all. Let's not forget Iran's first "military satellite" was launched with an over the counter unencrypted amateur cubesat transponder manufactured by a Californian company

dfsegoat 6y ago
I am not at all involved in security, but from my novice understanding, they appear somewhat competent. Wiping of a US casino's IT infra in 2014: https://arstechnica.com/information-technology/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/ https://arstechnica.com/information-technology/2014/12/irani... Breaching of critical power/water infrastructure in 2015: https://www.cbc.ca/news/technology/hackers-infrastructure-1.3376342 https://www.cbc.ca/news/technology/hackers-infrastructure-1....
- tedivm 6y ago
  What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech. For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting. Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.
  - stunt 6y ago
    If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.

kevin_thibedeau 6y ago

> a _very_ competent cyber-actor (Iran) Nation state security competence includes locking down USB ports so someone can't deploy malware found off the street.

ajcp 6y ago
The same thing that has plagued the U.S. DoD since the advent of USB, but there's no denying that the U.S. is an _extremely_ competent cyber-actor.
- rebuilder 6y ago
  It seems defense is harder than offense in this context.
- kijin 6y ago
  Attacking is often easier than defense. How many countries that have ICBMs can reliably block incoming ICBMs?
  - emodendroket 6y ago
    On paper or in reality?
    - spijdar 6y ago
      Either, really. Very few have the ability even in theory, whether anyone could intercept a bunch of ICBMs launched "in anger" seems questionable. Seems like an apt analogy talking about cybersecurity defenses.
      - emodendroket 6y ago
        Well yeah, that’s what I mean. I’m not convinced any of these actually work.
GartzenDeHaes 6y ago

Natsu 6y ago

I wonder if they sealed up their USB ports so nobody would randomly plug in a USB key this time?

waihtis 6y ago

Having competency in red team scenarios doesn't translate to having a cyber-proof national infrastructure, as is evident. They are actually two wildly different problem sets. And the latter is boring & unsexy.

tetha 6y ago
Also in my opinion, blue teaming is harder. Red team has to find one weakness to win. If blue team misses any system, vulnerability, process, anything, they are in trouble against the right attackers. This can be seen by how many automated infiltration agents are around, and how few automated defense systems. And how annoyingly succesful they are.
- waihtis 6y ago
  Absolutely. The cyber security asymmetry in play. I'm actually working on this problem so it's very close to heart!

dan-robertson 6y ago

> Nation-states using cyber capabilities in this way Strictly speaking, Iran is not a nation-state. It is a multiethnic state. The way to avoid this confusion is to write ‘state’ (problem here is that this word also refers to American states) or ‘country’ (I think people might feel like this word is not sufficiently sophisticated?). However the error is understandable as it is particularly common in discussions about cybersecurity (or national security, where ‘national’ means the USA). It’s especially silly in those cases as some typical US adversaries (Iran, Russia) are states which are not nation states.

ajcp 6y ago
This is true, although when I was studying international relations "nation-state" was an accepted catch-all for a "top-level" polity in international politics.
tptacek 6y ago
"State-level actor" is, I guess, the accurate schmancy way to say "country".
gen220 6y ago
Is it not the case that a nation can be multiethnic? I don’t see how Iran’s multiethnic populace disqualifies it’s claim on a national identity (Shia Islam). On the wiki page for multinational states, I find reasonable examples (Russia, Belgium, UK), and Iran is absent. [1] Does this have to do with the Kurdish nation claiming territory within Iran? Not trying to say you’re wrong, just trying to understand the terminology better. [1]: https://en.m.wikipedia.org/wiki/Multinational_state https://en.m.wikipedia.org/wiki/Multinational_state
- dan-robertson 6y ago
  Nation is a word with two meanings. One is ‘country’ so the answer is yes (note that nation-state is a silly phrase under this meaning). You see it in terms like nationalisation of industry or national anthem. The other meaning is a group of people with (typically) shared ethnicity, cultural heritage, language, and often, country. For this a multiethnic country doesn’t usually fit the bill. But to some extent words can mean whatever you want them to and lots of groups want themselves to be considered nations (either to promote some unity across diverse people or to push out undesirable groups) even if they don’t strictly fit the usual definition.

pengaru 6y ago

Nothing in the article speaks to either Iran's nor Israel's cyber competencies, those aren't take-aways, you brought them. From where I'm sitting, Iran is a cyber circus.

ajcp 6y ago
The article is reporting on an event. We apply analysis and context to that event so that we may understand it's implications and effects. We then conduct our lives accordingly. In that we have taken something away with us from the article.

29athrowaway 6y ago

Can be achieved not only through technological means but also sabotage and infiltration.

MeinBlutIstBlau 6y ago

Pretty sure there is a myriad of american working and middle class that would outright oppose a draft now more than ever. The government would have to go full on chinese censorship with the internet to suppress free speech regarding why you shouldn't have to go.

A4ET8a8uTh0 6y ago

Sadly, I think I agree with your assessment that we are in a pre-next world war mode. There are now multiple smaller scale events that could easily transform from a local to a regional conflict. Reasonable people should be worried, because at least in WW2 we couldn't destroy the entire planet with one wrong move.