3 ms·

This framing seems weird: > Two days after receiving the Apple threat notification, Gibson contacted a forensic expert with extensive experience investigating

by ajross 1y ago

This framing seems weird: > Two days after receiving the Apple threat notification, Gibson contacted a forensic expert with extensive experience investigating spyware attacks. Surely as a professional "exploit developer", Gibson himself should have been about as expert at this particular niche as any human being on the planet already. I mean, sure, absolutely he should have called in his friends in the community and gotten more eyes on the device. But the way that's written it sounds like he took it into the local Genius Bar. It also, in context, feels a little obfuscatory. Like he's trying to flag the involvement of senior folks who he can't name.

tptacek 1y ago
I agree it reads weird, but I am leaving room for the idea that there are a lot of very gifted people who work on this stuff as an intellectual challenge, have a sort of straight up systemsy computer science background, and don't have or care about a bigger picture of where they fit into the industry. But still: the companies that became Trenchant were notoriously paranoid about state-sponsored CNE threats! It would still be weird to be surprised by them.
felsokning 1y ago
I think you're conflating two precepts. Just because you can write an exploit, it doesn't - inherently - mean that you have the skills/knowledge/tools of where to look for all signs of exploit having occurred on your device(s). From the inference of that logic, every developer should be able to use gdb or Windbg to ascertain where they shot themselves in the foot - but we know that this specific set of skills isn't inherently required to be a developer. So, the same logic would be true here: Just because you can write a hand full of exploits, it doesn't inherently mean that you have the tools/know-how to be able to ascertain if any of all of the available exploits in the wild (or in private, re: tools for Trenchat) have been used on your phone. Edit: gbd != gdb
- ajross 1y ago
  You're arguing at the wrong side of the problem. Obviously yes, everyone can't be a perfect expert on everything and when doing anything complicated you should ask for help. Duh, as it were. I think I even said as much. The point was at this level of expertise and size of market ("detection of iOS zero day rootkits"), there simply isn't a pool of "experts" you can draw on to do this a-la contract work. It's a tiny world and everyone is fumbling around and asking for help independently. And as a member of that tiny world, Gibson surely knew who he needed to call already. But that's not the way the article framed the interaction, which implies to me that there's more context at work here.

by ajross 1y ago

tptacek 1y ago

I agree it reads weird, but I am leaving room for the idea that there are a lot of very gifted people who work on this stuff as an intellectual challenge, have a sort of straight up systemsy computer science background, and don't have or care about a bigger picture of where they fit into the industry. But still: the companies that became Trenchant were notoriously paranoid about state-sponsored CNE threats! It would still be weird to be surprised by them.

felsokning 1y ago

I think you're conflating two precepts. Just because you can write an exploit, it doesn't - inherently - mean that you have the skills/knowledge/tools of where to look for all signs of exploit having occurred on your device(s). From the inference of that logic, every developer should be able to use gdb or Windbg to ascertain where they shot themselves in the foot - but we know that this specific set of skills isn't inherently required to be a developer. So, the same logic would be true here: Just because you can write a hand full of exploits, it doesn't inherently mean that you have the tools/know-how to be able to ascertain if any of all of the available exploits in the wild (or in private, re: tools for Trenchat) have been used on your phone. Edit: gbd != gdb

ajross 1y ago
You're arguing at the wrong side of the problem. Obviously yes, everyone can't be a perfect expert on everything and when doing anything complicated you should ask for help. Duh, as it were. I think I even said as much. The point was at this level of expertise and size of market ("detection of iOS zero day rootkits"), there simply isn't a pool of "experts" you can draw on to do this a-la contract work. It's a tiny world and everyone is fumbling around and asking for help independently. And as a member of that tiny world, Gibson surely knew who he needed to call already. But that's not the way the article framed the interaction, which implies to me that there's more context at work here.