4 ms·

> _very_ competent cyber-actor Please elaborate on this. As someone with direct exposure to this area and in this geography, my experience could not be describ

> _very_ competent cyber-actor Please elaborate on this. As someone with direct exposure to this area and in this geography, my experience could not be described this way at all. Let's not forget Iran's first "military satellite" was launched with an over the counter unencrypted amateur cubesat transponder manufactured by a Californian company

dfsegoat 5y ago
I am not at all involved in security, but from my novice understanding, they appear somewhat competent. Wiping of a US casino's IT infra in 2014: https://arstechnica.com/information-technology/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/ https://arstechnica.com/information-technology/2014/12/irani... Breaching of critical power/water infrastructure in 2015: https://www.cbc.ca/news/technology/hackers-infrastructure-1.3376342 https://www.cbc.ca/news/technology/hackers-infrastructure-1....
- tedivm 5y ago
  What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech. For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting. Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.
  - stunt 5y ago
    If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.
  - Veserv 5y ago
    Yes, what you observe them doing is not all that impressive, but that is all that is needed to attack these systems. There is no need to send a cruise missile when a light shove is enough. Essentially every deployed system is so littered with security defects in every facet of both design and implementation that successful attacks against them can be developed and deployed at a cost of just a few tens of thousands to maybe a million dollars for a really good attack at the high end. Any reasonably-sized state actor can deploy literally thousands of times that many resources against their adversaries without even blinking and we know that the NSA and CIA were independently running hacking programs capable of attacking essentially every publicly deployed system in the world. Offense is so easy and defense is so bad it is ridiculous.
- stunt 5y ago
  Iran has been both victim and predator of several cyberwarfare operations. They clearly have the experience and they are spending a lot of resources for a long time. A quick search about their operations: - Shamoon malware was categorized as cyberwarfare and it was used against Saudi Aramco, allegedly by Iran. https://en.wikipedia.org/wiki/Shamoon https://en.wikipedia.org/wiki/Shamoon - A blackout in Turkey was also linked to Iran https://observer.com/2015/04/iran-flexes-its-power-by-transporting-turkey-to-the-stone-ages/ https://observer.com/2015/04/iran-flexes-its-power-by-transp... - Iran is also (allegedly) active in Information Warfare, which is much more complicated than technical cyber attacks. https://www.cnbc.com/2021/03/16/russia-and-iran-tried-to-interfere-with-2020-election-us-intelligence-agencies-say.html https://www.cnbc.com/2021/03/16/russia-and-iran-tried-to-int... - Israel and Iran are actively attacking each others infrastructure for a while. https://foreignpolicy.com/2020/06/05/israel-and-iran-just-showed-us-the-future-of-cyberwar-with-their-unusual-attacks/ https://foreignpolicy.com/2020/06/05/israel-and-iran-just-sh... - Operation Newscaster. Cyber espionage and social engineering targeted senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors. https://en.wikipedia.org/wiki/Operation_Newscaster https://en.wikipedia.org/wiki/Operation_Newscaster - Operation Cleaver. targeted the military, oil and gas, energy and utilities, transportation, airlines, airports, hospitals and aerospace industries organizations worldwide. https://en.wikipedia.org/wiki/Operation_Cleaver https://en.wikipedia.org/wiki/Operation_Cleaver
  - 1cvmask 5y ago
    The observer article on the blackout in Turkey caused allegedly by Iran is just an opinion piece and claims to be one.
emodendroket 5y ago
If citing a couple boneheaded moves like that mean they're not a competent actor, then who is? Consider: https://www.huffpost.com/entry/nuclear-missile-code-00000000-cold-war_n_4386784 https://www.huffpost.com/entry/nuclear-missile-code-00000000...
- kps 5y ago
  That wasn't incompetence, it was malicious compliance.
ajcp 5y ago
Given when we're talking about nations states as cyber-actors we're working with a pool of ~190. Compared to 90% of the other nation-states out there Iran is a _very_ competent cyber-actor. Enough so that it may even export that capability. This still means there are ~20 that are more competent, if not _extremely_ so. Given your exposure in this geography can you name any of it's neighbors who have greater or even equal competency that aren't Israel or don't use citizens from an _extremely_ competent nation-state? They certainly had their way with Aramco, so not Saudi Arabia. Egypt? Jordan? Syria? Iraq? Perhaps Lebanon? And this just their neighbors. What about compared to Portugal or Spain? South Africa? Nigeria? Argentina or Mexico?
- lovedswain 5y ago
  > Compared to 90% of the other nation-states out there Iran is a _very_ competent cyber-actor. . > Given your exposure in this geography can you name any of it's neighbors Saudi Arabia targetted at least Bezos' phone
  - tptacek 5y ago
    This is all pretty silly, isn't it? For the dollar figures involved in pulling off a highly-sophisticated attack (one that chains multiple zero days, including some in obscure products that imply the commissioning of vulnerabilities and not just their purchase off the black-market shelf as well as some in mainstream products with a real bidding interest), you're still talking about amounts of money so low that Cape Verde could be a _very_ competent cyber-actor if they wanted.
    - lovedswain 5y ago
      Seems we're both triggered by this emphasis on "_very_", or even use of that word at all. Obviously Iran has a variety of technical capabilities, such as evidenced by their national firewall and internal infrastructure, but are there any documented offensive campaigns successfully mounted against a foreign target? The only attacks I know of are low brow phishing, DoS and web site defacements.
kodah 5y ago
In my mind, most countries can't figure out how to plan or coordinate a cyber-attack. With a limited pool of nations to pick from, even being able to coordinate an attack makes you relatively "very competent" (among your peers), however, that would also be a matter of perspective. It's equally valid to determine a criteria of competency and rank/describe countries based on those thresholds.
LatteLazy 5y ago
I agree with your wider point but... Launching a satellite means you can put a warhead anywhere on earth and no one can stop it. It's a achievement in rocketry, not whatever is on the end of the rocket. The actual satellite could be a crushed car for all anyone cares.

dfsegoat 5y ago

I am not at all involved in security, but from my novice understanding, they appear somewhat competent. Wiping of a US casino's IT infra in 2014: https://arstechnica.com/information-technology/2014/12/iranian-hackers-used-visual-basic-malware-to-wipe-vegas-casinos-network/ https://arstechnica.com/information-technology/2014/12/irani... Breaching of critical power/water infrastructure in 2015: https://www.cbc.ca/news/technology/hackers-infrastructure-1.3376342 https://www.cbc.ca/news/technology/hackers-infrastructure-1....

tedivm 5y ago
What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech. For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting. Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.
- stunt 5y ago
  If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.
- Veserv 5y ago
  Yes, what you observe them doing is not all that impressive, but that is all that is needed to attack these systems. There is no need to send a cruise missile when a light shove is enough. Essentially every deployed system is so littered with security defects in every facet of both design and implementation that successful attacks against them can be developed and deployed at a cost of just a few tens of thousands to maybe a million dollars for a really good attack at the high end. Any reasonably-sized state actor can deploy literally thousands of times that many resources against their adversaries without even blinking and we know that the NSA and CIA were independently running hacking programs capable of attacking essentially every publicly deployed system in the world. Offense is so easy and defense is so bad it is ridiculous.
stunt 5y ago
Iran has been both victim and predator of several cyberwarfare operations. They clearly have the experience and they are spending a lot of resources for a long time. A quick search about their operations: - Shamoon malware was categorized as cyberwarfare and it was used against Saudi Aramco, allegedly by Iran. https://en.wikipedia.org/wiki/Shamoon https://en.wikipedia.org/wiki/Shamoon - A blackout in Turkey was also linked to Iran https://observer.com/2015/04/iran-flexes-its-power-by-transporting-turkey-to-the-stone-ages/ https://observer.com/2015/04/iran-flexes-its-power-by-transp... - Iran is also (allegedly) active in Information Warfare, which is much more complicated than technical cyber attacks. https://www.cnbc.com/2021/03/16/russia-and-iran-tried-to-interfere-with-2020-election-us-intelligence-agencies-say.html https://www.cnbc.com/2021/03/16/russia-and-iran-tried-to-int... - Israel and Iran are actively attacking each others infrastructure for a while. https://foreignpolicy.com/2020/06/05/israel-and-iran-just-showed-us-the-future-of-cyberwar-with-their-unusual-attacks/ https://foreignpolicy.com/2020/06/05/israel-and-iran-just-sh... - Operation Newscaster. Cyber espionage and social engineering targeted senior U.S. military and diplomatic personnel, congresspeople, journalists, lobbyists, think tankers and defense contractors. https://en.wikipedia.org/wiki/Operation_Newscaster https://en.wikipedia.org/wiki/Operation_Newscaster - Operation Cleaver. targeted the military, oil and gas, energy and utilities, transportation, airlines, airports, hospitals and aerospace industries organizations worldwide. https://en.wikipedia.org/wiki/Operation_Cleaver https://en.wikipedia.org/wiki/Operation_Cleaver
- 1cvmask 5y ago
  The observer article on the blackout in Turkey caused allegedly by Iran is just an opinion piece and claims to be one.

emodendroket 5y ago

If citing a couple boneheaded moves like that mean they're not a competent actor, then who is? Consider: https://www.huffpost.com/entry/nuclear-missile-code-00000000-cold-war_n_4386784 https://www.huffpost.com/entry/nuclear-missile-code-00000000...

kps 5y ago
That wasn't incompetence, it was malicious compliance.

ajcp 5y ago

Given when we're talking about nations states as cyber-actors we're working with a pool of ~190. Compared to 90% of the other nation-states out there Iran is a _very_ competent cyber-actor. Enough so that it may even export that capability. This still means there are ~20 that are more competent, if not _extremely_ so. Given your exposure in this geography can you name any of it's neighbors who have greater or even equal competency that aren't Israel or don't use citizens from an _extremely_ competent nation-state? They certainly had their way with Aramco, so not Saudi Arabia. Egypt? Jordan? Syria? Iraq? Perhaps Lebanon? And this just their neighbors. What about compared to Portugal or Spain? South Africa? Nigeria? Argentina or Mexico?

lovedswain 5y ago
> Compared to 90% of the other nation-states out there Iran is a _very_ competent cyber-actor. . > Given your exposure in this geography can you name any of it's neighbors Saudi Arabia targetted at least Bezos' phone
- tptacek 5y ago
  This is all pretty silly, isn't it? For the dollar figures involved in pulling off a highly-sophisticated attack (one that chains multiple zero days, including some in obscure products that imply the commissioning of vulnerabilities and not just their purchase off the black-market shelf as well as some in mainstream products with a real bidding interest), you're still talking about amounts of money so low that Cape Verde could be a _very_ competent cyber-actor if they wanted.
  - lovedswain 5y ago
    Seems we're both triggered by this emphasis on "_very_", or even use of that word at all. Obviously Iran has a variety of technical capabilities, such as evidenced by their national firewall and internal infrastructure, but are there any documented offensive campaigns successfully mounted against a foreign target? The only attacks I know of are low brow phishing, DoS and web site defacements.

kodah 5y ago

In my mind, most countries can't figure out how to plan or coordinate a cyber-attack. With a limited pool of nations to pick from, even being able to coordinate an attack makes you relatively "very competent" (among your peers), however, that would also be a matter of perspective. It's equally valid to determine a criteria of competency and rank/describe countries based on those thresholds.

LatteLazy 5y ago

I agree with your wider point but... Launching a satellite means you can put a warhead anywhere on earth and no one can stop it. It's a achievement in rocketry, not whatever is on the end of the rocket. The actual satellite could be a crushed car for all anyone cares.