3 ms·
I think the lesson here is not so much that governments can do this, but that entities with extremely large budgets are implementing broad, interconnected initi
by grandalf 12y ago
I think the lesson here is not so much that governments can do this, but that entities with extremely large budgets are implementing broad, interconnected initiatives like this.
I think realistically any entity with over $20M could participate meaningfully in these kinds of exploits. The key is that in order to be useful many overlapping initiatives need to exist.
It seems like exploiting things like firmware would be pretty easy: You just get a member of your team who is a bit overqualified to apply for a job at the target company. A relatively small team could accomplish this in a few years, aided by the scarcity of top tier engineering talent.
The hard part is the social aspect of the attacks, but a single clever individual can come up with many.
- RockyMcNuts 12y agowell, in TFA it's a little easier for the NSA than embedding a mole, NSA just tells WD they want to buy drives, but need to audit all the source code including firmware for security issues, then modifies firmware, then intercepts hardware orders from targets and replaces them with ones with compromised firmware.
- grandalf 12y agoTrue, but I think it makes more sense to look at these tactics in the most general way possible. Firms could be doing them, as could much smaller governments. Most press about itesec is focused on individual vulnerabilities and the tactics used in specific exploits. What we're seeing is tremendous "long game" strategic sophistication. Stuxnet was one example of using many attack vectors to eventually achieve a goal and these revelations suggest that was just the beginning. Sure, intercepting the mail could be difficult, but all it takes is a few compromised UPS drivers and warrants are no longer needed.