3 ms·

Critical exploits make it into the wild all the time. At worst they cause a tiny, temporary dip in stock price and frequently they cause the stock price to go u

by Veserv 3y ago

Critical exploits make it into the wild all the time. At worst they cause a tiny, temporary dip in stock price and frequently they cause the stock price to go up long term due to publicity. That is why they only spend 10 M$ on bounties, there is literally no point to spending more because the ROI is garbage. The only reason to run a bug bounty program is optics. You run a program paying out paltry amounts so that when your security is routinely completely compromised you can say you were a upstanding company who tried to work with upstanding offensive researchers. It is those evil, dastardly criminals funded by insert government here using "advanced", "unique" techniques and who can stop that? Therefore it is not our fault, now go keep buying our products and stock even though we have made no changes to our incompetent security process. Works every time.

hollerith 3y ago
OK, but governments operates computers, too, and don't want other governments to be able to break into those computers, so do they just not spend a lot on making it hard for the attackers from foreign governments or is defense different from offense here in that a government's inability (the US gov at least) to pay sky-high salaries does limit its ability to create and maintain good defenses?
- Veserv 3y ago
  Offense is easy because defense is a joke. Nobody in the entire world has network connected commercial IT systems that are even minimally adequate. Yes, that includes Google, Amazon, Crowdstrike, any bank, Microsoft, Apple, Mandiant, and whoever else you care to name. All useless against small professional teams with a most a few million dollars of budget; amounts so small many of those companies have their financials denominated in larger units despite most of them spending hundreds of millions to billions of dollars trying to stop such attackers. If you are actually trying to stop a government with any of that garbage you might as well try to use an egg to stop a steamroller.
  - hollerith 3y ago
    If offense is as heavily favored as you say, then how come Russia hasn't done more damage to computer systems in Ukraine or in Western countries that support Ukraine? Clearly Russia is committed to spending whatever it takes to win the war and clearly Russia is not being held back by Russian worries about how the West will respond to Russian attacks on Western computers nor is it being held back by worries that if they deploy whatever exploits they have now (in attacks on Western computers) then those exploits will not be available for a more serious conflict with the West -- the Kremlin sees the current conflict as already extremely serious and consequential. For example, after Musk gave Starlink terminals to Ukraine (and Musk admitted as much in public) why wasn't Starlink's web site constantly being taken offline by Russian cyber-attacks? Ditto the routers that route traffic to and from Starlink's satellites. Is it your position that Russian spies are constantly breaking into Ukrainian and Western computer systems, but then they are only exfiltrating data because if they take those systems offline then that announces to the enemy the existence of the compromise, which the enemy can then respond effectively to (e.g., by buying new servers)?

by Veserv 3y ago

hollerith 3y ago

OK, but governments operates computers, too, and don't want other governments to be able to break into those computers, so do they just not spend a lot on making it hard for the attackers from foreign governments or is defense different from offense here in that a government's inability (the US gov at least) to pay sky-high salaries does limit its ability to create and maintain good defenses?

Veserv 3y ago
Offense is easy because defense is a joke. Nobody in the entire world has network connected commercial IT systems that are even minimally adequate. Yes, that includes Google, Amazon, Crowdstrike, any bank, Microsoft, Apple, Mandiant, and whoever else you care to name. All useless against small professional teams with a most a few million dollars of budget; amounts so small many of those companies have their financials denominated in larger units despite most of them spending hundreds of millions to billions of dollars trying to stop such attackers. If you are actually trying to stop a government with any of that garbage you might as well try to use an egg to stop a steamroller.
- hollerith 3y ago
  If offense is as heavily favored as you say, then how come Russia hasn't done more damage to computer systems in Ukraine or in Western countries that support Ukraine? Clearly Russia is committed to spending whatever it takes to win the war and clearly Russia is not being held back by Russian worries about how the West will respond to Russian attacks on Western computers nor is it being held back by worries that if they deploy whatever exploits they have now (in attacks on Western computers) then those exploits will not be available for a more serious conflict with the West -- the Kremlin sees the current conflict as already extremely serious and consequential. For example, after Musk gave Starlink terminals to Ukraine (and Musk admitted as much in public) why wasn't Starlink's web site constantly being taken offline by Russian cyber-attacks? Ditto the routers that route traffic to and from Starlink's satellites. Is it your position that Russian spies are constantly breaking into Ukrainian and Western computer systems, but then they are only exfiltrating data because if they take those systems offline then that announces to the enemy the existence of the compromise, which the enemy can then respond effectively to (e.g., by buying new servers)?