4 ms·

[flagged]

catigula 1y ago
There's huge incentive for nation-state level actors to recruit, train and spend oodles on extremely sophisticated hacking programs with little legal oversight and basically endless resources. I have no idea why you're incredulous about this. If I were running a country practically my highest priority would be cyberattacks and defense. The ability to arbitrarily penetrate even any corporate network, let alone military network, is basically infinite free IP.
- tiahura 1y ago
  You can get a lot of fat kids on a computer in a bedroom for the cost of building and maintaining a 6th Gen fighter.
- citizenpaul 1y ago
  > I have no idea why you're incredulous about this. I understand human nature.
- cindyllm 1y ago
  [dead]
- behringer 1y ago
  It doesn't matter who hacks me. If my job is on the line I'm going to claim it's someone impossible to defend against like a state actor. There's a thousand things to point at that would make it plausible. I might even convince myself of it out of sheer embarrassment.
  - catigula 1y ago
    I don't lie generally but most of all about things that could precipitate FBI involvement in what you're doing. This is a fantasy.
sickofparadox 1y ago
Nation-states sponsored hackers make up a huge amount of known targeted intrusion groups. This is not some random company tilting at windmills, these are real threats that hit American and American-aligned companies daily.
- deleted 1y ago
  [deleted]
marcusb 1y ago
> I keep seeing it pop up again and again and it only makes sense in that context. Not saying that these companies would turn down corporate welfare given the chance, but I’ll offer an alternative explanation: it shifts accountability away from the company by positing a highly resourced attacker the company could not reasonably be expected to protect against. If you have a physical security program that you’ve spent millions of dollars on, and a random drug addict breaks in and steals your deepest corporate secrets people are going to ask questions. If a foreign spy does the same, you have a bit more room to claim there’s nothing you could have done to prevent the theft. I’ve seen a bunch of incident response reports over the years. It is extremely common for IR vendors to claim that an attack has some hallmark or another of a nation-state actor. While these reports get used to fund the security program, I always read those statements as a “get out of jail free” card for the CISOs who got popped.
- citizenpaul 1y ago
  >it shifts accountability away I agree. I think what we are split on is purpose/intent. >could not reasonably be expected to protect against. Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who? Number one is probably compliance/regulation. > “get out of jail free” This is one of my red flags I also keep seeing. Whoops we can't do the thing we say we do. The entire sec industry seems shady AF. Which is why I think they are a huge future rent seek lobby. Once the insurance industry catches on. > these reports get used to fund the security program So we agree?
  - marcusb 1y ago
    > I agree. I think what we are split on is purpose/intent. I… don’t think so? Your original comment was that companies claim nation state attack as a way to get government funding. That has nothing to do with assessing blame for an attack. > Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who? If you think you as a private entity can defend against a tier 1 nation state group like the NSA or Unit 8200, you are gravely mistaken. For one thing, these groups have zero day procurement budgets bigger than most company market caps. That’s why companies reflexively blame nation state actors. It isn’t to get government funding. It is to avoid blame for an attack by framing it as something they could not have prevented. > So we agree? No, I don’t believe we do.
wyldberry 1y ago
This is a mean-spirited interpretation of what happens when you claim nation state. Generally the government (as of now) is not paying private (but maybe some Critical Infrastructure companies) companies to secure things. We are in the very early stages of figuring out how to hold companies accountable for security breaches, and part of that is figuring out if they should have stopped it. A lot of that comes down to a few principles: * How resourced is the defender versus the attacker? * Who was the attacker (attribution matters - (shoutout @ImposeCost on Twitter/X) * Was the victim of the attack performing all reasonable steps to show the cause wasn't some form of gross negligence. Nation state attacker jobs aren't particularly different from many software shops. * You have teams of engineers/analysts whose job it is to analyze nearly every piece of software under the sun and find vulnerabilities. * You have teams whose job it is to build the infrastructure and tooling necessary to run operations * You have teams whose job it is to turn vulnerabilities into exploits and payloads to be deployed along that infrastructure * You have teams of people whose job it is to be hands on keyboard running the operation(s) Depending on the victim organization, if a top-tier country wants what you have, they are going to get it and you'll probably never know. F5 is, at least by q2 revenue[0], we very profitable, well resourced company that has seen some things and been victims of some high profile attacks and vulns over the years. It's likely that they were still outmatched because there's been a team of people who found a weakness and exploited it. When they use verbage like nation-state, it's to give a signal that they were doing most/all the right things and they got popped. The relevant government officials already know what happened, this is a signal to the market that they did what they were supposed to and aren't negligent. [0] -https://www.f5.com/company/news/press-releases/earnings-q2-fy25 https://www.f5.com/company/news/press-releases/earnings-q2-f...
- worthless-trash 1y ago
  HN can be unnecessarily vicious when it comes to these situations. They have a very narrow slit in which they see companies because they extrapolate their understanding into the large corporation. The attacker needs to find 1 fault in a system to start attacking a system, the company needs to plug ALL of them to be successful, continually for all updates, for all staff, for all time. Having been on both sides of that fence, I dont envy the defenders, it is a losing battle.
akerl_ 1y ago
Is there an example of a company getting money from the government in response to a statement like this?
- dwd 1y ago
  I don't believe Equifax received money, just a long list of demands to be allowed to continue as a viable business. That it was a nation-state actor may have allowed them some grace, as it didn't result in individuals' details being wholesale sold on the dark web, and the fallout was most-likely a national security issue. It would definitely have helped the CCP target individuals who were vulnerable to recruitment due to their financial status. Especially when combined with the Office of Personnel Management data hack.
sigmarule 1y ago
If there was some government program I was previously unaware of that pays organizations that were compromised by nation state hackers then I’m going to be upgrading all my networking infrastructure to F5 products and start reading up on BIG-IP migrations. That is to say, sometimes nation state hackers _were_ behind the compromise. F5 is a very believable and logical target for such groups.
AdieuToLogic 1y ago
> Something about this statement screams that companies are setting themselves up for free money from big old gov'ment welfare titties. From the published CISA mitigation[0]: A nation-state affiliated cyber threat actor has compromised F5’s systems and exfiltrated files, which included a portion of its BIG-IP source code and vulnerability information. The threat actor’s access to F5’s proprietary source code could provide that threat actor with a technical advantage to exploit F5 devices and software. > Its the boogyman [sic] like terrorism. Or maybe it is a responsible vulnerability disclosure whose impact is described thusly[0]: This cyber threat actor presents an imminent threat to federal networks using F5 devices and software. Successful exploitation of the impacted F5 products could enable a threat actor to access embedded credentials and Application Programming Interface (API) keys, move laterally within an organization’s network, exfiltrate data, and establish persistent system access. This could potentially lead to a full compromise of target information systems. 0 - https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices https://www.cisa.gov/news-events/directives/ed-26-01-mitigat...
- ExoticPearTree 1y ago
  If it was a “nation-state” actor, f5 should have named it and provided irrefutable evidence to this effect. Until this happens, its just CYA at its best to hide flaws in their systems and procedures.
hhh 1y ago
It’s also just a fact. We don’t need a bogeyman when other nations are actually executing these attacks every day.

[flagged]

There's huge incentive for nation-state level actors to recruit, train and spend oodles on extremely sophisticated hacking programs with little legal oversight and basically endless resources. I have no idea why you're incredulous about this. If I were running a country practically my highest priority would be cyberattacks and defense. The ability to arbitrarily penetrate even any corporate network, let alone military network, is basically infinite free IP.

tiahura 1y ago
You can get a lot of fat kids on a computer in a bedroom for the cost of building and maintaining a 6th Gen fighter.
citizenpaul 1y ago
> I have no idea why you're incredulous about this. I understand human nature.
cindyllm 1y ago
[dead]
behringer 1y ago
It doesn't matter who hacks me. If my job is on the line I'm going to claim it's someone impossible to defend against like a state actor. There's a thousand things to point at that would make it plausible. I might even convince myself of it out of sheer embarrassment.
- catigula 1y ago
  I don't lie generally but most of all about things that could precipitate FBI involvement in what you're doing. This is a fantasy.

sickofparadox 1y ago

Nation-states sponsored hackers make up a huge amount of known targeted intrusion groups. This is not some random company tilting at windmills, these are real threats that hit American and American-aligned companies daily.

deleted 1y ago
[deleted]

marcusb 1y ago

> I keep seeing it pop up again and again and it only makes sense in that context. Not saying that these companies would turn down corporate welfare given the chance, but I’ll offer an alternative explanation: it shifts accountability away from the company by positing a highly resourced attacker the company could not reasonably be expected to protect against. If you have a physical security program that you’ve spent millions of dollars on, and a random drug addict breaks in and steals your deepest corporate secrets people are going to ask questions. If a foreign spy does the same, you have a bit more room to claim there’s nothing you could have done to prevent the theft. I’ve seen a bunch of incident response reports over the years. It is extremely common for IR vendors to claim that an attack has some hallmark or another of a nation-state actor. While these reports get used to fund the security program, I always read those statements as a “get out of jail free” card for the CISOs who got popped.

citizenpaul 1y ago
>it shifts accountability away I agree. I think what we are split on is purpose/intent. >could not reasonably be expected to protect against. Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who? Number one is probably compliance/regulation. > “get out of jail free” This is one of my red flags I also keep seeing. Whoops we can't do the thing we say we do. The entire sec industry seems shady AF. Which is why I think they are a huge future rent seek lobby. Once the insurance industry catches on. > these reports get used to fund the security program So we agree?
- marcusb 1y ago
  > I agree. I think what we are split on is purpose/intent. I… don’t think so? Your original comment was that companies claim nation state attack as a way to get government funding. That has nothing to do with assessing blame for an attack. > Why not? If I'm hiring a cybersec thats probably in my top 3 reasons to hire them, if not them then who? If you think you as a private entity can defend against a tier 1 nation state group like the NSA or Unit 8200, you are gravely mistaken. For one thing, these groups have zero day procurement budgets bigger than most company market caps. That’s why companies reflexively blame nation state actors. It isn’t to get government funding. It is to avoid blame for an attack by framing it as something they could not have prevented. > So we agree? No, I don’t believe we do.

wyldberry 1y ago

This is a mean-spirited interpretation of what happens when you claim nation state. Generally the government (as of now) is not paying private (but maybe some Critical Infrastructure companies) companies to secure things. We are in the very early stages of figuring out how to hold companies accountable for security breaches, and part of that is figuring out if they should have stopped it. A lot of that comes down to a few principles: * How resourced is the defender versus the attacker? * Who was the attacker (attribution matters - (shoutout @ImposeCost on Twitter/X) * Was the victim of the attack performing all reasonable steps to show the cause wasn't some form of gross negligence. Nation state attacker jobs aren't particularly different from many software shops. * You have teams of engineers/analysts whose job it is to analyze nearly every piece of software under the sun and find vulnerabilities. * You have teams whose job it is to build the infrastructure and tooling necessary to run operations * You have teams whose job it is to turn vulnerabilities into exploits and payloads to be deployed along that infrastructure * You have teams of people whose job it is to be hands on keyboard running the operation(s) Depending on the victim organization, if a top-tier country wants what you have, they are going to get it and you'll probably never know. F5 is, at least by q2 revenue[0], we very profitable, well resourced company that has seen some things and been victims of some high profile attacks and vulns over the years. It's likely that they were still outmatched because there's been a team of people who found a weakness and exploited it. When they use verbage like nation-state, it's to give a signal that they were doing most/all the right things and they got popped. The relevant government officials already know what happened, this is a signal to the market that they did what they were supposed to and aren't negligent. [0] -https://www.f5.com/company/news/press-releases/earnings-q2-fy25 https://www.f5.com/company/news/press-releases/earnings-q2-f...

worthless-trash 1y ago
HN can be unnecessarily vicious when it comes to these situations. They have a very narrow slit in which they see companies because they extrapolate their understanding into the large corporation. The attacker needs to find 1 fault in a system to start attacking a system, the company needs to plug ALL of them to be successful, continually for all updates, for all staff, for all time. Having been on both sides of that fence, I dont envy the defenders, it is a losing battle.

akerl_ 1y ago

Is there an example of a company getting money from the government in response to a statement like this?

dwd 1y ago
I don't believe Equifax received money, just a long list of demands to be allowed to continue as a viable business. That it was a nation-state actor may have allowed them some grace, as it didn't result in individuals' details being wholesale sold on the dark web, and the fallout was most-likely a national security issue. It would definitely have helped the CCP target individuals who were vulnerable to recruitment due to their financial status. Especially when combined with the Office of Personnel Management data hack.

sigmarule 1y ago

If there was some government program I was previously unaware of that pays organizations that were compromised by nation state hackers then I’m going to be upgrading all my networking infrastructure to F5 products and start reading up on BIG-IP migrations. That is to say, sometimes nation state hackers _were_ behind the compromise. F5 is a very believable and logical target for such groups.

AdieuToLogic 1y ago

> Something about this statement screams that companies are setting themselves up for free money from big old gov'ment welfare titties. From the published CISA mitigation[0]: A nation-state affiliated cyber threat actor has compromised F5’s systems and exfiltrated files, which included a portion of its BIG-IP source code and vulnerability information. The threat actor’s access to F5’s proprietary source code could provide that threat actor with a technical advantage to exploit F5 devices and software. > Its the boogyman [sic] like terrorism. Or maybe it is a responsible vulnerability disclosure whose impact is described thusly[0]: This cyber threat actor presents an imminent threat to federal networks using F5 devices and software. Successful exploitation of the impacted F5 products could enable a threat actor to access embedded credentials and Application Programming Interface (API) keys, move laterally within an organization’s network, exfiltrate data, and establish persistent system access. This could potentially lead to a full compromise of target information systems. 0 - https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices https://www.cisa.gov/news-events/directives/ed-26-01-mitigat...

ExoticPearTree 1y ago
If it was a “nation-state” actor, f5 should have named it and provided irrefutable evidence to this effect. Until this happens, its just CYA at its best to hide flaws in their systems and procedures.

hhh 1y ago

It’s also just a fact. We don’t need a bogeyman when other nations are actually executing these attacks every day.