5 ms·

Let's hope those chicken never come home to roost. NSA has a history of losing offensive cyber tools. IIRC both Texas and California had widespread power outag

by bflesch 9mo ago

Let's hope those chicken never come home to roost. NSA has a history of losing offensive cyber tools. IIRC both Texas and California had widespread power outages in the last few years. I am not convinced that US power grid is much better defended than the one in the EU.

ericmay 9mo ago
Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU. That's why the EU is experiencing cyber attacks and cyber warfare with clear culpability from Russia, but is unable to do much about it besides give Ukraine more weapons. If Russia launched a cyber attack and shut down JFK the way it did Heathrow, the US would actually do something about it even with all the Trump is a Russian agent stuff aside.
- bflesch 9mo ago
  Sounds too good to be true. I'd love to believe it. Didn't russia claim to have the full Epstein files, so how did they get them if not by hacking US government? Attribution of cyber attacks is extremely difficult, and US seems to notoriously under invest into infrastructure. Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
  - ericmay 9mo ago
    > Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe? I didn't say it was safe by virtue of defensive capabilities, but it's safe by virtue of the US will very likely come bomb you or use its own cyber capabilities if you do something to the US. This is in contrast to the EU which was the comparison point, which is unable and unwilling to do much against cyber attacks.
    - bflesch 9mo ago
      My original post was more focused on defensive capabilities, but those things are hard to discern - you need to know about vulnerabilities in order to protect yourself from them. If the damage is done, of course the US can massively retaliate. But ideally no damage is done :)
      - ericmay 9mo ago
        Ideally yes, but there's a cost. All I was saying was that the US is better equipped than the EU because both are vulnerable but the US actually has and is willing to use offensive capabilities, which provide a defensive deterrent to an aggressor.
        bflesch 9mo ago
        If US had such amazing offensive cyber capabilities, why are bug bounties like HackerOne not already bankrupt? The NSA hackers could just easily farm all those bounties and make significantly more than they earn at the government. I feel the answer to this is that most of what we call NSA offensive capabilities are not "real" offensive capabilities in terms of vulnerabilities and exploits, but simple backdoors in US equipment and US tech companies. And I think they got really complacent because analyzing Facebook, Google and Apple data combined with credit card payments, phone call and browser history is doing the job just fine in 90% of the cases. Due to large size of US traditional military, they have advanced capabilities in terms of physical network tapping that many other countries don't possess. Maybe they have super binoculars to spy on people typing in their passwords through the window from space. But in the end it is again white-collar "analysts" going through the data instead of clever people actually finding novel vulnerabilities in software, which is also the skill that is rewarded in bug bounties such as HackerOne. Why invest into learning how to reverse engineer a cisco router if you can just call your buddy at Cisco and tell them to commit a new backdoor to the code. By not using these skills they atrophy and once you hit a "real" adversary who is not on Windows and permanently uploading their data to Facebook and iCloud while using a credit card with apple pay, they might struggle very much. I recall things like omg cable being a revolution in red team pentesting. Of course they had prototypes before, but I don't think it was widely utilized. Because why invest into such fancy hardware gimmicks if you can get the data directly from a US tech company who is forced to provide access for you anyways. It's much cheaper and more reliable. Edit: I just noticed that due to this significant reliance on backdoors in US equipment they also hurt the defensive posture much more. It's difficult to have different versions of firmware floating around and to ensure they are deployed for your own companies. It's much easier to add backdoors to companies from your own country than to add backdoors to foreign equipment. This is totally in line with what we observe with endless CVEs and backdoors in US networking equipment.
- ASalazarMX 9mo ago
  [flagged]
  - ericmay 9mo ago
    Sure, of course it's not that simple. If China for example did a cyber attack it doesn't necessitate an immediate kinetic response or some sort of gargantuan nation-state level warfare to take place. But if one of those countries shut down the US power grid we absolutely would respond and you're naive to think that the US would not respond out of some "fear" about only fighting very asymmetric wars. Amongst some there seems to be this idea that because the US has taken military action in other countries over the years, more recent being more important, and because those countries "couldn't fight back" that the US is unable or unwilling to take further action against other nation states that theoretically could fight back (India could not, for example as a weak military power with nuclear weapons), but instead I'd caution you look at those action with respect to the ability of other countries to take action. In other words, it feels good to throw in zingers like the US only beats up on weaker countries or something which, let's be frank would be every country or bloc except China, but you're missing the fact that those countries are not even able to project power to or willingness or ability to attack other countries.
    - bflesch 9mo ago
      [flagged]
      - ericmay 9mo ago
        > I only remember that if one US state loses power the other states laugh about it because obviously it is because the current governor is a black female democrat. Yea that's obviously dumb, but the difference is you hear about America's problems, but not the problems in other countries. Russia has its oil facilities regularly bombed. China has institutionalized corruption down to the local level. It's not all peaches and rainbows in every country on earth. > It'd be great progress to actually detect what caused it in a timely manner and then do a proper cyber attribution. Who says we aren't? > Generally I think you are using a lot of big words to compensate for the fact that the US ignored the Minsk agreement. Can you elaborate? What's the broader point you want to get at here? > The russian government has been publicly joking about Trump, broadcasting nude pictures of the first lady and boasting about possessing the Epstein tapes. Before that was the hack of Hillary's mail server and fake news campaigns. No kinetic repercussions, even red carpet for putin's visit in Alaska. Yes, totally. The United States should have bombed Russia for publicly joking about Donald Trump. Give me a break. Why even post stuff like this? > Apart from all this a modern drone war would be a big problem for the US, and countries like Ukraine, russia and china are much better prepared for such a scenario. Who do you think is operating in Ukraine and advising the Ukrainians and learning from their drone warfare techniques and capabilities? Do you really not know how this stuff works? Are you not aware that the United States is actively testing weapons in Ukraine to prepare for drone warfare? Is that why you're saying stuff like the US should have a kinetic response against Russia for posting pictures and joking about Donald Trump?
- tokai 9mo ago
  Russia conduct cyber attacks on US all the time. North Korea did a high profile attack too. China flew a balloon over the whole country, not bothering a single airport, without any response. US never does anything to anyone that can hit back.
  - ericmay 9mo ago
    Three points: 1. You don't actually know what actions the US has taken. 2. The only country outside of one using nuclear bombs that could theoretically "hit back" is China. 3. Flying some balloons across the US doesn't necessarily necessitate some sort of massive response. There's levels.
    - tokai 9mo ago
      Oh I thought you said the actions would be kinetic.
      - ericmay 9mo ago
        No, sorry. I wrote: > Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU.
Qem 9mo ago
> Let's hope those chicken never come home to roost. Bare minimum it gives chinese tech suppliers a great pitch to convince buyers to choose their products over US suppliers. Even if theirs are also full of backdoors, at least they have no history of taking advantage of them to kidnap heads of state far away.
- ericmay 9mo ago
  > at least they have no history of taking advantage of them to kidnap heads of state far away. Ha. Someone else wrote: > USA is only willing to fight very asymmetrical wars. I say: > China is only willing to kidnap defenseless people

by bflesch 9mo ago

ericmay 9mo ago

Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU. That's why the EU is experiencing cyber attacks and cyber warfare with clear culpability from Russia, but is unable to do much about it besides give Ukraine more weapons. If Russia launched a cyber attack and shut down JFK the way it did Heathrow, the US would actually do something about it even with all the Trump is a Russian agent stuff aside.

bflesch 9mo ago
Sounds too good to be true. I'd love to believe it. Didn't russia claim to have the full Epstein files, so how did they get them if not by hacking US government? Attribution of cyber attacks is extremely difficult, and US seems to notoriously under invest into infrastructure. Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe?
- ericmay 9mo ago
  > Unlike other countries, most of the power grid is above ground. How can you be so sure that it is safe? I didn't say it was safe by virtue of defensive capabilities, but it's safe by virtue of the US will very likely come bomb you or use its own cyber capabilities if you do something to the US. This is in contrast to the EU which was the comparison point, which is unable and unwilling to do much against cyber attacks.
  - bflesch 9mo ago
    My original post was more focused on defensive capabilities, but those things are hard to discern - you need to know about vulnerabilities in order to protect yourself from them. If the damage is done, of course the US can massively retaliate. But ideally no damage is done :)
    - ericmay 9mo ago
      Ideally yes, but there's a cost. All I was saying was that the US is better equipped than the EU because both are vulnerable but the US actually has and is willing to use offensive capabilities, which provide a defensive deterrent to an aggressor.
      - bflesch 9mo ago
        If US had such amazing offensive cyber capabilities, why are bug bounties like HackerOne not already bankrupt? The NSA hackers could just easily farm all those bounties and make significantly more than they earn at the government. I feel the answer to this is that most of what we call NSA offensive capabilities are not "real" offensive capabilities in terms of vulnerabilities and exploits, but simple backdoors in US equipment and US tech companies. And I think they got really complacent because analyzing Facebook, Google and Apple data combined with credit card payments, phone call and browser history is doing the job just fine in 90% of the cases. Due to large size of US traditional military, they have advanced capabilities in terms of physical network tapping that many other countries don't possess. Maybe they have super binoculars to spy on people typing in their passwords through the window from space. But in the end it is again white-collar "analysts" going through the data instead of clever people actually finding novel vulnerabilities in software, which is also the skill that is rewarded in bug bounties such as HackerOne. Why invest into learning how to reverse engineer a cisco router if you can just call your buddy at Cisco and tell them to commit a new backdoor to the code. By not using these skills they atrophy and once you hit a "real" adversary who is not on Windows and permanently uploading their data to Facebook and iCloud while using a credit card with apple pay, they might struggle very much. I recall things like omg cable being a revolution in red team pentesting. Of course they had prototypes before, but I don't think it was widely utilized. Because why invest into such fancy hardware gimmicks if you can get the data directly from a US tech company who is forced to provide access for you anyways. It's much cheaper and more reliable. Edit: I just noticed that due to this significant reliance on backdoors in US equipment they also hurt the defensive posture much more. It's difficult to have different versions of firmware floating around and to ensure they are deployed for your own companies. It's much easier to add backdoors to companies from your own country than to add backdoors to foreign equipment. This is totally in line with what we observe with endless CVEs and backdoors in US networking equipment.
ASalazarMX 9mo ago
[flagged]
- ericmay 9mo ago
  Sure, of course it's not that simple. If China for example did a cyber attack it doesn't necessitate an immediate kinetic response or some sort of gargantuan nation-state level warfare to take place. But if one of those countries shut down the US power grid we absolutely would respond and you're naive to think that the US would not respond out of some "fear" about only fighting very asymmetric wars. Amongst some there seems to be this idea that because the US has taken military action in other countries over the years, more recent being more important, and because those countries "couldn't fight back" that the US is unable or unwilling to take further action against other nation states that theoretically could fight back (India could not, for example as a weak military power with nuclear weapons), but instead I'd caution you look at those action with respect to the ability of other countries to take action. In other words, it feels good to throw in zingers like the US only beats up on weaker countries or something which, let's be frank would be every country or bloc except China, but you're missing the fact that those countries are not even able to project power to or willingness or ability to attack other countries.
  - bflesch 9mo ago
    [flagged]
    - ericmay 9mo ago
      > I only remember that if one US state loses power the other states laugh about it because obviously it is because the current governor is a black female democrat. Yea that's obviously dumb, but the difference is you hear about America's problems, but not the problems in other countries. Russia has its oil facilities regularly bombed. China has institutionalized corruption down to the local level. It's not all peaches and rainbows in every country on earth. > It'd be great progress to actually detect what caused it in a timely manner and then do a proper cyber attribution. Who says we aren't? > Generally I think you are using a lot of big words to compensate for the fact that the US ignored the Minsk agreement. Can you elaborate? What's the broader point you want to get at here? > The russian government has been publicly joking about Trump, broadcasting nude pictures of the first lady and boasting about possessing the Epstein tapes. Before that was the hack of Hillary's mail server and fake news campaigns. No kinetic repercussions, even red carpet for putin's visit in Alaska. Yes, totally. The United States should have bombed Russia for publicly joking about Donald Trump. Give me a break. Why even post stuff like this? > Apart from all this a modern drone war would be a big problem for the US, and countries like Ukraine, russia and china are much better prepared for such a scenario. Who do you think is operating in Ukraine and advising the Ukrainians and learning from their drone warfare techniques and capabilities? Do you really not know how this stuff works? Are you not aware that the United States is actively testing weapons in Ukraine to prepare for drone warfare? Is that why you're saying stuff like the US should have a kinetic response against Russia for posting pictures and joking about Donald Trump?
tokai 9mo ago
Russia conduct cyber attacks on US all the time. North Korea did a high profile attack too. China flew a balloon over the whole country, not bothering a single airport, without any response. US never does anything to anyone that can hit back.
- ericmay 9mo ago
  Three points: 1. You don't actually know what actions the US has taken. 2. The only country outside of one using nuclear bombs that could theoretically "hit back" is China. 3. Flying some balloons across the US doesn't necessarily necessitate some sort of massive response. There's levels.
  - tokai 9mo ago
    Oh I thought you said the actions would be kinetic.
    - ericmay 9mo ago
      No, sorry. I wrote: > Yes, you're missing that if you mess with the power grid the US will go and kinetically strike back (read: bomb your country) or attack you with its own cyber warfare capabilities, unlike the EU.

Qem 9mo ago

> Let's hope those chicken never come home to roost. Bare minimum it gives chinese tech suppliers a great pitch to convince buyers to choose their products over US suppliers. Even if theirs are also full of backdoors, at least they have no history of taking advantage of them to kidnap heads of state far away.

ericmay 9mo ago
> at least they have no history of taking advantage of them to kidnap heads of state far away. Ha. Someone else wrote: > USA is only willing to fight very asymmetrical wars. I say: > China is only willing to kidnap defenseless people