4 ms·
People grossly underestimate APTs. It is more common than an average IT curious person thinks. I happened to be oncall when one of these guys hacked into Gmail
by dev_l1x_be 11mo ago
People grossly underestimate APTs. It is more common than an average IT curious person thinks. I happened to be oncall when one of these guys hacked into Gmail from our infra. It took principal security engineers a few days before they could clearly understand what happened. Multiple zero days, stolen credit cards, massive social campaign to get one of the Google admins click on a funny cat video finally. The investigation revealed which state actor was involved because they did not bother to mask what exactly they were looking for. AI just accelerates the effectiveness of such attacks, lowers the bar a bit. Maybe quite a bit?
- jmkni 11mo agoDo you mean APT (Advanced persistent threat)?
- names_are_hard 11mo agoIt's confusing. Various vendors sell products they call ATPs [0] to defend yourself from APTs... [0] Advanced Threat Protection
- jmkni 11mo agorelevant username :)
- dev_l1x_be 11mo agoYes, sorry typo.
- dang 11mo agoI've taken the liberty of fixing it in your post. I hope that's ok!
- dev_l1x_be 11mo agoAbsolutely, thank you!
- chasd00 11mo agoi seriously thought APT meant advanced persistent teen
- f311a 11mo agoA lot of people behind APTs are low-skilled and make silly mistakes. I worked for a company that investigates traces of APTs, they make very silly mistakes all the time. For example, oftentimes (there are tens of cases) they want to download stuff from their servers, and they do it by setting up an HTTP server that serves the root folder of a user without any password protection. Their files end up indexed by crawlers since they run such servers on default ports. That includes logs such as bash history, tool logs, private keys, and so on. They win because of quantity, not quality. But still, I don't trust Anthropic's report.
- marcusb 11mo agoThe security world overemphasizes (fetishizes, even,) the "advanced" part because zero days and security tools to compensate against zero days are cool and fun, and underemphasizes the "persistent" part because that's boring and hard work and no fun. And, unless you are Rob Joyce, talking about the persistent part doesn't get you on the main stage at a security conference (e.g., https://m.youtube.com/watch?v=bDJb8WOJYdA https://m.youtube.com/watch?v=bDJb8WOJYdA)
- lxgr 11mo agoImportant callout. It starts with comforting voices in the background keeping you up to date about the latest hardware and software releases, but before you know it, you've subscribed to yet another tech podcast.
- sidewndr46 11mo agoYou're telling me you were targeted by Multiple Zero Days in 1 single attack?
- ikiris 11mo agoThat's generally how actual APT attacks go, yes.
- dev_l1x_be 11mo agoGoogle was.
- sidewndr46 11mo agoOK so when you say "hacked into Gmail" you actually mean someone breached the infra of email. Not that they did some credential stuffing / password reset attack & got into one person's Gmail account?
- dev_l1x_be 11mo agoYes.
- datadrivenangel 11mo agoUsually the most advanced attacks are a few chained zero days or a zero day on top of a configuration /patching error. The worst attacks are when a zero day for wordpress or outlook comes out.
- AdamN 11mo agoNot just effectiveness, but speed.