4 ms·

Most hackers aren’t finding their own 0days like this. If a motivated state level attacker targets you, you’re in trouble. But most companies that get hacked f

Most hackers aren’t finding their own 0days like this. If a motivated state level attacker targets you, you’re in trouble. But most companies that get hacked fail in much dumber ways - like failing to update chrome long after a bug like this has been fixed. Or using stupid, guessable passwords. Of course we should have sympathy for the 1% of companies who fall victim to 0days from state level attackers. But I have no sympathy for the other 99% of data leaks where the devs forgot to put a password on a public mongodb instance, or let their login cookies be enumerable or something equally ridiculous. Just because we can’t make security perfect doesn’t mean we shouldn’t make it good.

mandevil 3y ago
James Mickens gave a lecture at a conference (I think it's this one: https://www.youtube.com/watch?v=tF24WHumvIc https://www.youtube.com/watch?v=tF24WHumvIc but I don't have time to actually listen through it) about how there are two different threat models for computer security: bored five year olds and the Mossad. And bored five year olds just try the same three things again and again, and as long as you take basic precautions you can protect yourself against them. You cannot protect yourself against the Mossad, don't even try. When I first started paying attention to computer security I was at a start-up and tasked to rewrite their PCI infrastructure for credit card processing, so I did some research into the state of the art. That week news of a casino hack came out. Billionaire casino/media magnate and conservative donor Sheldon Adelson gave a speech in October 2013 about how the US should threaten to use nuclear weapons to destroy Iran's nuclear program. In February 2014 a 150 line VB virus was installed on his casino's network which wiped all of the hard drives it could find, costing the Sands hundreds of millions of dollars. This was at a casino, some place which absolutely cares about their computer security and presumably spends a lot on that security, and they failed to successfully protect themselves against a nation-state level threat. So whatever the hell startup I was working at had no chance if someone at that level wanted it. We could stop the five year olds. Just not the nation-states.
- tialaramex 3y ago
  None of these entities have unlimited resources or unlimited political cover. At some point you're making too big of a hole in the budget, too many people must be sacrificed and it's not worth it.
- Timber-6539 3y ago
  Seems Youtube took down that video. I get "This video isn't available anymore."

mandevil 3y ago

James Mickens gave a lecture at a conference (I think it's this one: https://www.youtube.com/watch?v=tF24WHumvIc https://www.youtube.com/watch?v=tF24WHumvIc but I don't have time to actually listen through it) about how there are two different threat models for computer security: bored five year olds and the Mossad. And bored five year olds just try the same three things again and again, and as long as you take basic precautions you can protect yourself against them. You cannot protect yourself against the Mossad, don't even try. When I first started paying attention to computer security I was at a start-up and tasked to rewrite their PCI infrastructure for credit card processing, so I did some research into the state of the art. That week news of a casino hack came out. Billionaire casino/media magnate and conservative donor Sheldon Adelson gave a speech in October 2013 about how the US should threaten to use nuclear weapons to destroy Iran's nuclear program. In February 2014 a 150 line VB virus was installed on his casino's network which wiped all of the hard drives it could find, costing the Sands hundreds of millions of dollars. This was at a casino, some place which absolutely cares about their computer security and presumably spends a lot on that security, and they failed to successfully protect themselves against a nation-state level threat. So whatever the hell startup I was working at had no chance if someone at that level wanted it. We could stop the five year olds. Just not the nation-states.

tialaramex 3y ago
None of these entities have unlimited resources or unlimited political cover. At some point you're making too big of a hole in the budget, too many people must be sacrificed and it's not worth it.
Timber-6539 3y ago
Seems Youtube took down that video. I get "This video isn't available anymore."