3 ms·

The biggest thing for me that points to a state actor is the amount of time committed to the social engineering attack versus the expected value of the prize. A

The biggest thing for me that points to a state actor is the amount of time committed to the social engineering attack versus the expected value of the prize. A for-profit scheme built this way would be irrational, which doesn't preclude it being an irrational actor (or an individual with a motive other than profit) but does point to a state actor as a likely candidate. The total value of the prize, if successful, would be worth a lot if you could sell it, but the odds of successfully getting an exploit into major infrastructure that goes undetected for long enough for your customers to buy and use it are tiny. States can afford moonshots, but I tend to expect private individuals to seek targets with a higher expected value. Of course, that doesn't mean it was a competent state actor or that they allocated a ton of resources to it.

fl7305 3y ago
> I tend to expect private individuals to seek targets with a higher expected value. If you're a very skilled and dedicated hacker, what other targets do you have that can net you many millions of dollars? > or an individual with a motive other than profit Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit? I mean, there are people who spend all their free time over several decades just digging tunnels under their property. Or build a 6502 CPU from discrete transistors. Etc.
- lolinder 3y ago
  > Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit? You're conflating the hacker-as-in-threat-actor community with the hacker-as-in-Linux-maintainer community.
  - fl7305 3y ago
    Sure, generally speaking, people who try to break into computer systems for profit do not have a lot of overlap with people who spends lots of time writing open source software for fun. But in this case it is not hard to imagine that the XZ-perpetrator came from the second group, right? Edit: I mean, this wouldn't be that different from when Ken Thompson demonstrated how to do a hidden backdoor in the C compiler?

fl7305 3y ago

> I tend to expect private individuals to seek targets with a higher expected value. If you're a very skilled and dedicated hacker, what other targets do you have that can net you many millions of dollars? > or an individual with a motive other than profit Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit? I mean, there are people who spend all their free time over several decades just digging tunnels under their property. Or build a 6502 CPU from discrete transistors. Etc.

lolinder 3y ago
> Isn't one of the most striking things about the hacker community the extreme amounts of time and effort that are put into things that are not expected to generate any profit? You're conflating the hacker-as-in-threat-actor community with the hacker-as-in-Linux-maintainer community.
- fl7305 3y ago
  Sure, generally speaking, people who try to break into computer systems for profit do not have a lot of overlap with people who spends lots of time writing open source software for fun. But in this case it is not hard to imagine that the XZ-perpetrator came from the second group, right? Edit: I mean, this wouldn't be that different from when Ken Thompson demonstrated how to do a hidden backdoor in the C compiler?