3 ms·

I‘m quite sure there are a lot of attacks like that. Most of them just never get noticed. The best backdoors are those, which are never found.

by andix 6y ago

makomk 6y ago
Like, say, that backdoor someone wrote an article about recently which ran from RAM and had a sophisticated self-destruct mechanism that erased all traces if anyone tried to dump its memory? I wonder how many companies had exploits like that which they either didn't notice or didn't have the sophistication to actually catch and dump.
- tkinom 6y ago
  There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block. In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked. Windows update are only allowed when I in the mood for it (~once a year). Anyone can do this easily by control srvhost.exe 's internet access with windows firewall app.
  - sundarurfriend 6y ago
    > If one controls/monitors for every app in system Quis custodiet ipsos custodes? Who monitors the monitor? What happens when it is compromised, loopholed through, gets its inputs tampered with, etc.? For a home setup and its threat model, this sounds a simple, workable plan. When you're dealing with attacks of the level of sophistication described in the OP, trusting trust [1] becomes complicated and difficult. [1] http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...
  - pitaj 6y ago
    Only pulling security updates once a year probably puts you at higher risk than you're protecting against by firewalling outbound traffic.
  - thyrsus 6y ago
    I think you mean "blocked, then investigated", which it sounds like you're doing. A company running a large variety of software - particularly third party - needs to have staffing sufficient to such investigations.
boomboomsubban 6y ago
Here's an excellent article on the topic, this is a huge uproar on an everyday occurrence. https://blog.thinkst.com/p/if-nsa-has-been-hacking-everything-how.html https://blog.thinkst.com/p/if-nsa-has-been-hacking-everythin...
CyberRage 6y ago
Well, usually highly targeted attacks are orchestrated with a reason. You want to leverage your access to perform actions because you got get revealed\blocked even not intentionally. Once you act, let's deploy some ransom, wipe some data, shut down power plants, you will be shown. Keeping a perfectly stealth backdoor for years as environments, software and personal change is extremely difficult.
- andix 6y ago
  If you want to stay unnoticed you need to remove the backdoor and all the traces after you are done with what you wanted to do (steal some information, damage something, ...), sure.

I‘m quite sure there are a lot of attacks like that. Most of them just never get noticed. The best backdoors are those, which are never found.

by andix 6y ago

I‘m quite sure there are a lot of attacks like that. Most of them just never get noticed. The best backdoors are those, which are never found.

makomk 6y ago

Like, say, that backdoor someone wrote an article about recently which ran from RAM and had a sophisticated self-destruct mechanism that erased all traces if anyone tried to dump its memory? I wonder how many companies had exploits like that which they either didn't notice or didn't have the sophistication to actually catch and dump.

tkinom 6y ago
There are defences for this: If one controls/monitors for every app in system for network access, as soon as any unusually network access are triggered, it is investigated and block. In my home windows setup, only windows defender, firefox and chrome are allowed out going internet access in regular base. Everything else are blocked. Windows update are only allowed when I in the mood for it (~once a year). Anyone can do this easily by control srvhost.exe 's internet access with windows firewall app.
- sundarurfriend 6y ago
  > If one controls/monitors for every app in system Quis custodiet ipsos custodes? Who monitors the monitor? What happens when it is compromised, loopholed through, gets its inputs tampered with, etc.? For a home setup and its threat model, this sounds a simple, workable plan. When you're dealing with attacks of the level of sophistication described in the OP, trusting trust [1] becomes complicated and difficult. [1] http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...
- pitaj 6y ago
  Only pulling security updates once a year probably puts you at higher risk than you're protecting against by firewalling outbound traffic.
- thyrsus 6y ago
  I think you mean "blocked, then investigated", which it sounds like you're doing. A company running a large variety of software - particularly third party - needs to have staffing sufficient to such investigations.

boomboomsubban 6y ago

Here's an excellent article on the topic, this is a huge uproar on an everyday occurrence. https://blog.thinkst.com/p/if-nsa-has-been-hacking-everything-how.html https://blog.thinkst.com/p/if-nsa-has-been-hacking-everythin...

CyberRage 6y ago

Well, usually highly targeted attacks are orchestrated with a reason. You want to leverage your access to perform actions because you got get revealed\blocked even not intentionally. Once you act, let's deploy some ransom, wipe some data, shut down power plants, you will be shown. Keeping a perfectly stealth backdoor for years as environments, software and personal change is extremely difficult.

andix 6y ago
If you want to stay unnoticed you need to remove the backdoor and all the traces after you are done with what you wanted to do (steal some information, damage something, ...), sure.