4 ms·

Competent people regularly discover state-sponsored zero-day attacks. Maybe it's a higher level than 'sysadmining', but I suspect there are people who are calle

Competent people regularly discover state-sponsored zero-day attacks. Maybe it's a higher level than 'sysadmining', but I suspect there are people who are called sysadmins who do discover these kinds of things.

saagarjha 1y ago
"State-sponsored" covers a broad range from sending phishing links to zero-click exploit chains. It takes specialized talent to find the latter. Most of those people would not call themselves sysadmins.
- impossiblefork 1y ago
  Isn't it the sysadmin's job to set up honeypots etc., with the intent of actually getting the zero-day exploit chains? So they do need that competence if they are to be sysadmins.
  - saagarjha 1y ago
    Honeypots to catch this kind of thing are very hard to set up. People throwing exploits are generally really careful about targeting.
    - impossiblefork 1y ago
      Yes, of course, but it is possible. For a phone though, there is an external homogeneity that could make setting it up as a honeypot easier. I'm not incredibly familiar with phone OSs, but I see it as an interesting opportunity.
      - saagarjha 1y ago
        I have worked on this professionally; it's quite hard. Even getting exploits off of non-honeypot devices is hard. Setting up a honeypot adds even more complexity, especially because of how much fingerprinting attackers do. Before sending the initial payload it's likely that your phone OS, hardware model is already known–they're critical to deploying the exploit. Rough geographical location, who you've been around, which one of your devices is being targeted–all of these are not that hard to get. Once you're on the device and have elevated privileges you can run even more checks!
        impossiblefork 1y ago
        Yes, but surely getting exploits off non-honeypot devices shouldn't possible in general? Surely it should only be generally possible if you have special monitoring.
        saagarjha 1y ago
        Exploit authors are not perfect and sometimes they leave traces behind in accessible places that can be found if you know where to look.

saagarjha 1y ago

"State-sponsored" covers a broad range from sending phishing links to zero-click exploit chains. It takes specialized talent to find the latter. Most of those people would not call themselves sysadmins.

impossiblefork 1y ago
Isn't it the sysadmin's job to set up honeypots etc., with the intent of actually getting the zero-day exploit chains? So they do need that competence if they are to be sysadmins.
- saagarjha 1y ago
  Honeypots to catch this kind of thing are very hard to set up. People throwing exploits are generally really careful about targeting.
  - impossiblefork 1y ago
    Yes, of course, but it is possible. For a phone though, there is an external homogeneity that could make setting it up as a honeypot easier. I'm not incredibly familiar with phone OSs, but I see it as an interesting opportunity.
    - saagarjha 1y ago
      I have worked on this professionally; it's quite hard. Even getting exploits off of non-honeypot devices is hard. Setting up a honeypot adds even more complexity, especially because of how much fingerprinting attackers do. Before sending the initial payload it's likely that your phone OS, hardware model is already known–they're critical to deploying the exploit. Rough geographical location, who you've been around, which one of your devices is being targeted–all of these are not that hard to get. Once you're on the device and have elevated privileges you can run even more checks!
      - impossiblefork 1y ago
        Yes, but surely getting exploits off non-honeypot devices shouldn't possible in general? Surely it should only be generally possible if you have special monitoring.
        saagarjha 1y ago
        Exploit authors are not perfect and sometimes they leave traces behind in accessible places that can be found if you know where to look.