3 ms·

What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is th

by tedivm 6y ago

What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech. For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting. Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.

stunt 6y ago
If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.
Veserv 6y ago
Yes, what you observe them doing is not all that impressive, but that is all that is needed to attack these systems. There is no need to send a cruise missile when a light shove is enough. Essentially every deployed system is so littered with security defects in every facet of both design and implementation that successful attacks against them can be developed and deployed at a cost of just a few tens of thousands to maybe a million dollars for a really good attack at the high end. Any reasonably-sized state actor can deploy literally thousands of times that many resources against their adversaries without even blinking and we know that the NSA and CIA were independently running hacking programs capable of attacking essentially every publicly deployed system in the world. Offense is so easy and defense is so bad it is ridiculous.

by tedivm 6y ago

stunt 6y ago

If you follow the cyberwarfare space, most of the powerful attacks are actually infowar, and social engineering, and human intelligence. It's not always as technical as Stuxnet (even Stuxnet wasn't possible without information operations and human intelligence). Intelligence Gathering and Cyber Intelligence are the most effective and powerful divisions.

Veserv 6y ago

Yes, what you observe them doing is not all that impressive, but that is all that is needed to attack these systems. There is no need to send a cruise missile when a light shove is enough. Essentially every deployed system is so littered with security defects in every facet of both design and implementation that successful attacks against them can be developed and deployed at a cost of just a few tens of thousands to maybe a million dollars for a really good attack at the high end. Any reasonably-sized state actor can deploy literally thousands of times that many resources against their adversaries without even blinking and we know that the NSA and CIA were independently running hacking programs capable of attacking essentially every publicly deployed system in the world. Offense is so easy and defense is so bad it is ridiculous.