4 ms·
I think this is bad news for hackers, spyware companies and malware in general. We all knew vulnerabilities exist, many are known and kept secret to be used at
by stephc_int13 6mo ago
I think this is bad news for hackers, spyware companies and malware in general.
We all knew vulnerabilities exist, many are known and kept secret to be used at an appropriate time.
There is a whole market for them, but more importantly large teams in North Korea, Russia, China, Israel and everyone else who are jealously harvesting them.
Automation will considerably devalue and neuter this attack vector.
Of course this is not the end of the story and we've seen how supply chain attacks can inject new vulnerabilities without being detected.
I believe automation can help here too, and we may end-up with a considerably stronger and reliable software stack.
- tptacek 6mo agoI don't think it matters one way or the other to your thesis but I'm skeptical that state-level CNE organizations were hoarding vulnerabilities before; my understanding is that at least on the NATO side of the board they were all basically carefully managing an enablement pipeline that would have put them N deep into reliable exploit packages, for some surprisingly small N. There are a bunch of little reasons why the economics of hoarding aren't all that great.
- stephc_int13 6mo agoThe economics would be different in say, North Korea, don't you think?
- tptacek 6mo agoWhy? What do you mean?
- postsantum 6mo agoHe really believes that exploits come out of North Korea (as per Daily Post reporting), not from other countries
- kortilla 6mo agoNorth Korea uses a lot more them specifically to generate revenue.