3 ms·

I agree that US/UK are most likely but I see other possibilities too: Israel, or one of the other EU states. Israel might not have any qualms about targeting A

by api 12y ago

I agree that US/UK are most likely but I see other possibilities too: Israel, or one of the other EU states. Israel might not have any qualms about targeting American targets -- at the very least they would have no legal restriction against doing so. But they might not do so for pragmatic reasons: lack of interest, or to generate the impression that the threat is U.S. based.

jacquesm 12y ago
I think you can rule out the other EU states based on capability alone. Israel is a good one, hadn't thought of that. China as a target is a hard one. In part this is because they have relatively little IT infrastructure relative to the size of the population and because the number of juicy targets is rather limited (government mostly).
- tptacek 12y ago
  Based on what capability? Symantec's PR machine aside: what do you think something like this would cost to develop? Based on the high-level summary we have here, it looks like a 6-figure project. Latvia could afford to build this thing. I probably didn't look at this any more carefully than you did, so if there's some specific capability you think narrows down the sources of this trojan, let me know; I probably missed it.
  - AlyssaRowan 12y ago
    Just six figures? To build this and maintain it over multiple years, including a menu of payloads and exploits? When individual exclusive 0day exploits each rank at 5 figures upwards? Salaries? That seems unrealistically low for this. Sounds like much better value for money than any nation state would actually get in practice, and more in the ballpark of Malware-as-a-Service outlets like Hacking Team. (Why the love for .lv?)
    - tptacek 12y ago
      I'm not counting payloads and exploits against the cost of the framework, because the framework is all we have to go on. Exploits cost a lot of if you (a) need zero-day, (b) need mass-infection, or (c) need to foil attribution. They're significantly cheaper if you relax those concerns. Similarly: I assume the payload that physically corrupts a centrifuge array is a bit pricier than the one that scans the hard drive for credit card numbers. Latvia's just the smallest EU economy that came into my head.
  - jacquesm 12y ago
    Capability is constrained by more dimensions than just a financial one. Try to imagine the fall-out of say the Dutch spying on all these countries, including one of their EU countries is interesting. I really can't see any of the EU countries that might be implicated by a thing like this having to admit at some point in time on having spied on Belgium or Austria. That they can afford it is besides the point, though I'd like to see some politician willingly sign off on this. Since the put-out-to-pasture trajectory of past their prime EU politicians is to be promoted to Bruxelles I highly doubt they would limit their careers in such a drastic way. Whoever did this needed to have the desire first, the capability second (technical capability, for instance (this doesn't strike me as a small undertaking easily contracted out), but also to be un-encumbered legally) and then finally they need the money. That's the least of the problems but I don't see them crossing the legal barrier to begin with. The French have had some egg on their faces in the past with actions against non-government entities operating nominally under the flag of other member states (for instance, the Rainbow Warrior incident) and they will forever be remembered because of that. I don't think (or maybe wish to think) that any of the countries that are currently signatory to the various EU and other treaties would willingly cross the lines on something as sensitive as this. One leak and the press would be all over this.
  - BWStearns 12y ago
    I moderately hope some news agency researcher carelessly reads this thread and we get some big cable news company blaming this malware on Latvia.
  - lawnchair_larry 12y ago
    Hah, this is 8 figures easily. I'm honestly baffled that you could have any doubt it would be the work of the US. Like I was when you were skeptical of stuxnet. Everything about it screams nation state.
- hackuser 12y ago
  > China as a target is a hard one. ... and because the number of juicy targets is rather limited (government mostly). China is one of the world's largest markets for many industries. Why not industrial espionage against them?

by api 12y ago

jacquesm 12y ago

I think you can rule out the other EU states based on capability alone. Israel is a good one, hadn't thought of that. China as a target is a hard one. In part this is because they have relatively little IT infrastructure relative to the size of the population and because the number of juicy targets is rather limited (government mostly).

tptacek 12y ago
Based on what capability? Symantec's PR machine aside: what do you think something like this would cost to develop? Based on the high-level summary we have here, it looks like a 6-figure project. Latvia could afford to build this thing. I probably didn't look at this any more carefully than you did, so if there's some specific capability you think narrows down the sources of this trojan, let me know; I probably missed it.
- AlyssaRowan 12y ago
  Just six figures? To build this and maintain it over multiple years, including a menu of payloads and exploits? When individual exclusive 0day exploits each rank at 5 figures upwards? Salaries? That seems unrealistically low for this. Sounds like much better value for money than any nation state would actually get in practice, and more in the ballpark of Malware-as-a-Service outlets like Hacking Team. (Why the love for .lv?)
  - tptacek 12y ago
    I'm not counting payloads and exploits against the cost of the framework, because the framework is all we have to go on. Exploits cost a lot of if you (a) need zero-day, (b) need mass-infection, or (c) need to foil attribution. They're significantly cheaper if you relax those concerns. Similarly: I assume the payload that physically corrupts a centrifuge array is a bit pricier than the one that scans the hard drive for credit card numbers. Latvia's just the smallest EU economy that came into my head.
- jacquesm 12y ago
  Capability is constrained by more dimensions than just a financial one. Try to imagine the fall-out of say the Dutch spying on all these countries, including one of their EU countries is interesting. I really can't see any of the EU countries that might be implicated by a thing like this having to admit at some point in time on having spied on Belgium or Austria. That they can afford it is besides the point, though I'd like to see some politician willingly sign off on this. Since the put-out-to-pasture trajectory of past their prime EU politicians is to be promoted to Bruxelles I highly doubt they would limit their careers in such a drastic way. Whoever did this needed to have the desire first, the capability second (technical capability, for instance (this doesn't strike me as a small undertaking easily contracted out), but also to be un-encumbered legally) and then finally they need the money. That's the least of the problems but I don't see them crossing the legal barrier to begin with. The French have had some egg on their faces in the past with actions against non-government entities operating nominally under the flag of other member states (for instance, the Rainbow Warrior incident) and they will forever be remembered because of that. I don't think (or maybe wish to think) that any of the countries that are currently signatory to the various EU and other treaties would willingly cross the lines on something as sensitive as this. One leak and the press would be all over this.
- BWStearns 12y ago
  I moderately hope some news agency researcher carelessly reads this thread and we get some big cable news company blaming this malware on Latvia.
- lawnchair_larry 12y ago
  Hah, this is 8 figures easily. I'm honestly baffled that you could have any doubt it would be the work of the US. Like I was when you were skeptical of stuxnet. Everything about it screams nation state.
hackuser 12y ago
> China as a target is a hard one. ... and because the number of juicy targets is rather limited (government mostly). China is one of the world's largest markets for many industries. Why not industrial espionage against them?