3 ms·

The authors of Stuxnet were “motivated enough” and had the means at their disposal to do what they did. I’m just saying, where the motivate and means exist, it

The authors of Stuxnet were “motivated enough” and had the means at their disposal to do what they did. I’m just saying, where the motivate and means exist, it’s possible.

nothercastle 2y ago
You can’t protect against a state level actor. They could just get physical access in most cases anyway and force got to give up the codes
- binary132 2y ago
  You’re assuming a domestic state actor, no? I don’t think it’s a positive certainty that e.g. a foreign state will certainly be able to physically access your systems. Of course, I suppose if you send it in to a foreign country for repair, anything can happen.
  - readthenotes1 2y ago
    If properly motivated, I don't think national boundaries are going to stop someone from accessing a physical device. There may be a small list of countries with very good border controls and lack of existing foreign agents. I'd be curious to know which ones fit
bastawhiz 2y ago
I'm not disagreeing with you. That said, Stuxnet was built by a state actor with the motivation to target nuclear industrial equipment, not your media server's Ryzen 3000. It would be an hell of a lot of motivation without obvious payoff to use this vulnerability to, say, make nastier ransomware or steal crypto. The novelty of this exploit is the durability of it (persisting beyond a full wipe), which isn't something your garden-variety malware needs to extract value. If you have ring0, you already won. If you're a person who needs to be careful about this sort of stuff (e.g., you're Edward Snowden or run Iran's nuclear program), you hopefully are already paying attention. If you are a mere muggle like the rest of us, the risk is probably not high enough for you to get upset.
- binary132 2y ago
  I don’t think it’s so crazy to think about the fact that tools like this can be both used by, _and designed for the use of_ state actors, whether in actions against other governments or troublesome individuals — for example, Pegasus is not only for state actors.

The authors of Stuxnet were “motivated enough” and had the means at their disposal to do what they did. I’m just saying, where the motivate and means exist, it’s possible.

nothercastle 2y ago

You can’t protect against a state level actor. They could just get physical access in most cases anyway and force got to give up the codes

binary132 2y ago
You’re assuming a domestic state actor, no? I don’t think it’s a positive certainty that e.g. a foreign state will certainly be able to physically access your systems. Of course, I suppose if you send it in to a foreign country for repair, anything can happen.
- readthenotes1 2y ago
  If properly motivated, I don't think national boundaries are going to stop someone from accessing a physical device. There may be a small list of countries with very good border controls and lack of existing foreign agents. I'd be curious to know which ones fit

bastawhiz 2y ago

I'm not disagreeing with you. That said, Stuxnet was built by a state actor with the motivation to target nuclear industrial equipment, not your media server's Ryzen 3000. It would be an hell of a lot of motivation without obvious payoff to use this vulnerability to, say, make nastier ransomware or steal crypto. The novelty of this exploit is the durability of it (persisting beyond a full wipe), which isn't something your garden-variety malware needs to extract value. If you have ring0, you already won. If you're a person who needs to be careful about this sort of stuff (e.g., you're Edward Snowden or run Iran's nuclear program), you hopefully are already paying attention. If you are a mere muggle like the rest of us, the risk is probably not high enough for you to get upset.

binary132 2y ago
I don’t think it’s so crazy to think about the fact that tools like this can be both used by, _and designed for the use of_ state actors, whether in actions against other governments or troublesome individuals — for example, Pegasus is not only for state actors.