3 ms·
Why use "heavily biased" to characterize the most common entry points for recent state espionage operations and ransomware attacks. These ARE the most routinel
by afrcnc 5y ago
Why use "heavily biased" to characterize the most common entry points for recent state espionage operations and ransomware attacks.
These ARE the most routinely exploited vulnerabilities.
Attacks on end-consumers usually rely on social engineering, not vulnerability exploitation, especially because Windows, Mac, and Linux has been heavily fortified against basic exploits.
Most of the CVEs on the linked list are corporate gear running the same firmware since the 2000s, which explains why these devices are so heavily targeted right now. Easy exploits, large payouts, win!
- tptacek 5y agoI'm not making a value judgement. The list of most commonly-observed exploit vectors is probably interesting on its own merits. But the headline is "Top Routinely Exploited Vulnerabilities", and, if you're a tech startup, these are almost certainly not the most commonly-exploited vulnerabilities in your environment.
- afrcnc 5y agoYou're not making any sense. Do you think tech startups don't use edge devices? Also, since when are tech startups, which account only for a fraction of the economy, the barometer for anything. They're an outlier in an ocean of multiple industry verticals that usually account for most of the GDI and today's employment. The joint advisory is about attacks overall, not tech startups. Trust me when I say that tech startups use gear listed in that advisory. Unless your idea of a tech startup is a mom-and-pop shop that can't afford to run an AD or intranet -- which most do, and are usually using VPNs and network access gateways to control traffic to it, hence potentially vulnerable.
- tptacek 5y agoAgain, you're responding as if I'm making a value judgement. I was specific about who my comment was targeted towards.