3 ms·

Seriously. This isn't even bad. Go to DEFCON and you'll see a ton of people doing this crap. There is a reason a bunch of paranoid people (includes me) bought f

by 0xCMP 12y ago

Seriously. This isn't even bad. Go to DEFCON and you'll see a ton of people doing this crap. There is a reason a bunch of paranoid people (includes me) bought faraday cages for our phones. Everyone is trying to break in to the little black boxes we carry around with some of our most personal information. They have ACTUALLY done bad crap. This is normal security research. There is no need to blow normal research and security work out of proportion. Xcode is signed, they can't just modify it and let it go. The OS X updater is also likely secure and maybe they just figured out how to trick their own computers to install a keylogger. Good, but it probably doesn't work that well. And it's fine! It's research! Lets focus on the actual violations, not the tools. Exploits and social engineering doesn't compromise: people do. Focus on the people who broke the rules which make sure our country isn't manipulated in to an oligarchy.

jmcmichael 12y ago
The difference is that when the intelligence community discovers a hole in US-produced software, they will keep it to themselves to exploit the computers of individuals around the world in various operations of dubious value and/or legality. At DEFCON, exploits are publicized so that software vendors and algorithm developers are motivated to strengthen the security of what they produce so that the software that all of use is more effective against attackers.
deveac 12y ago
>Seriously. This isn't even bad....There is no need to blow normal research and security work out of proportion. Is normal security research done with the goal of finding/creating holes with the purpose of keeping them secret in order to use them as attack vectors without letting the owners of the compromised systems know about the vulnerabilities? What's bad about this is the purpose of the research (not to discover and strengthen security, but instead to destroy it), combined with the weaponization of it (the entire goal of doing the research is to use the exploits), and the actor carrying out the attacks (the state). It's obvious on its face why this is alarming.

by 0xCMP 12y ago

jmcmichael 12y ago

The difference is that when the intelligence community discovers a hole in US-produced software, they will keep it to themselves to exploit the computers of individuals around the world in various operations of dubious value and/or legality. At DEFCON, exploits are publicized so that software vendors and algorithm developers are motivated to strengthen the security of what they produce so that the software that all of use is more effective against attackers.

deveac 12y ago

>Seriously. This isn't even bad....There is no need to blow normal research and security work out of proportion. Is normal security research done with the goal of finding/creating holes with the purpose of keeping them secret in order to use them as attack vectors without letting the owners of the compromised systems know about the vulnerabilities? What's bad about this is the purpose of the research (not to discover and strengthen security, but instead to destroy it), combined with the weaponization of it (the entire goal of doing the research is to use the exploits), and the actor carrying out the attacks (the state). It's obvious on its face why this is alarming.