Sophisticated malware discovered after 7 years, likely created by a nation-state

[patteeu]

Originally Posted by planetdoc

us govt opened up pandora's box by weaponizing the internet. Now its a free for all.

That makes no sense. If the US government unilaterally declines to participate in an "arms race", it doesn't mean the race won't happen, it just means that we will lose it.

[listopencil]

Originally Posted by patteeu

That makes no sense. If the US government unilaterally declines to participate in an "arms race", it doesn't mean the race won't happen, it just means that we will lose it.

Pretty much.

[planetdoc]

Originally Posted by patteeu

That makes no sense. If the US government unilaterally declines to participate in an "arms race", it doesn't mean the race won't happen, it just means that we will lose it.

nope. you dont have to use those offensive capabilities like the US did with stuxnet. Its like saying that since the US has nuclear weapons than they should go ahead and use it.

1. The US declared cyberattacks an act of war.

2. US undermined this position with the Stuxnet and Flame virus.

3. Instead of working to make US interests more secure, the US government has worked to cripple and backdoor hardware and software. This makes US companies and infrastructure more vulnerable to attack.

4. US finds and gather 0-day exploits and vulnerabilities for offensive attacks, but fail to tell US companies so that they may fix their vulnerabilities....once again making them more vulnerable to attack.

America has been so busy with offensive capabilities and an cybe offensive arms race that they have neglected defense.

[listopencil]

Originally Posted by planetdoc

nope. you dont have to use those offensive capabilities like the US did with stuxnet. Its like saying that since the US has nuclear weapons than they should go ahead and use it.

1. The US declared cyberattacks an act of war.

2. US undermined this position with the Stuxnet and Flame virus.

3. Instead of working to make US interests more secure, the US government has worked to cripple and backdoor hardware and software. This makes US companies and infrastructure more vulnerable to attack.

4. US finds and gather 0-day exploits and vulnerabilities for offensive attacks, but fail to tell US companies so that they may fix their vulnerabilities....once again making them more vulnerable to attack.

America has been so busy with offensive capabilities and an cybe offensive arms race that they have neglected defense.

Why not do both?

[planetdoc]

Originally Posted by listopencil

Why not do both?

Patching vulnerabilities could undermine your own offensive capabilties assuming that your target patches vulnerabilities you have made public.

Although the US could gather cyber weapons, using them such as they have with stuxnet and Flame lead to the arms-race.

Its like the idea of mutually assured destruction (aka MAD). No one uses nukes because they are scared others will too. After the US used cyberweapons, now plenty of others are as well.

The worst part about all of this is that the US is more technologically advanced than most (if not all) other countries, and thus are the most vulnerable to cyberattacks. They have neglected defending the homeland to go on the offensive.

[patteeu]

Originally Posted by planetdoc

Patching vulnerabilities could undermine your own offensive capabilties assuming that your target patches vulnerabilities you have made public.

Although the US could gather cyber weapons, using them such as they have with stuxnet and Flame lead to the arms-race.

Its like the idea of mutually assured destruction (aka MAD). No one uses nukes because they are scared others will too. After the US used cyberweapons, now plenty of others are as well.

The worst part about all of this is that the US is more technologically advanced than most (if not all) other countries, and thus are the most vulnerable to cyberattacks. They have neglected defending the homeland to go on the offensive.

Again, where do you get your confidence? What makes you think the US used cyberweapons first? Or that others wouldn't have acted without the US acting first?

[patteeu]

Originally Posted by planetdoc

nope. you dont have to use those offensive capabilities like the US did with stuxnet. Its like saying that since the US has nuclear weapons than they should go ahead and use it.

1. The US declared cyberattacks an act of war.

2. US undermined this position with the Stuxnet and Flame virus.

3. Instead of working to make US interests more secure, the US government has worked to cripple and backdoor hardware and software. This makes US companies and infrastructure more vulnerable to attack.

4. US finds and gather 0-day exploits and vulnerabilities for offensive attacks, but fail to tell US companies so that they may fix their vulnerabilities....once again making them more vulnerable to attack.

America has been so busy with offensive capabilities and an cybe offensive arms race that they have neglected defense.

I'm not sure why you think you know that.

[planetdoc]

Originally Posted by patteeu

I'm not sure why you think you know that.

Evidence made available to the public.

It doesnt sound like you are disagreeing with anything I said, just wondering how I know. All of this is common knowledge at this point, but if there is a part of my post you disagree with, than CLEARLY let me know. I really dont feel like walking you through this when its readily available via a simple google search.

Originally Posted by patteeu

Again, where do you get your confidence? What makes you think the US used cyberweapons first?

Little Boy used against Hiroshima, was the first KNOWN deployment of an atomic bomb. Could another country have secretly acquired and deployed one first? sure, but their is no evidence of that and the idea is nearly statistically improbable.

That is the same with cyberweapons deployed by Operation Olympic Games.

link

researchers at Symantec have uncovered a version of the Stuxnet computer virus that was used to attack Iran's nuclear program in November 2007, being developed as early as 2005, when Iran was still setting up its uranium enrichment facility.

you are going to be hard pressed to find a deployment of a cyberweapon by a nation state before that time frame.

Originally Posted by patteeu

Or that others wouldn't have acted without the US acting first?

There is no proof that another country wouldnt have deployed atomic and plutonium weapons before the US. Since US deployment in world war II, there has been an arms race to acquire nuclear weapons because it is thought of as the "great equalizer."

Same can be said about cyberweapons. There is no proof that another country wouldn't have acted first, but the fact that the US has, led to a race by other countries to have similar capabilities.

[patteeu]

Originally Posted by planetdoc

Evidence made available to the public.

It doesnt sound like you are disagreeing with anything I said, just wondering how I know. All of this is common knowledge at this point, but if there is a part of my post you disagree with, than CLEARLY let me know. I really dont feel like walking you through this when its readily available via a simple google search.

I find your confidence in these paranoid, blame-America theories of yours fascinating. I was curious how you come by it. I disagree with your entire theory.

Originally Posted by planetdoc

Little Boy used against Hiroshima, was the first KNOWN deployment of an atomic bomb. Could another country have secretly acquired and deployed one first? sure, but their is no evidence of that and the idea is nearly statistically improbable.

That is the same with cyberweapons deployed by Operation Olympic Games.

link

Cyber warfare is often a bit more subtle than a nuclear bomb. It would be tough to miss news of a nuclear bomb detonation, but cyber attacks don't make the same splash if they're even disclosed publicly.

Originally Posted by planetdoc

you are going to be hard pressed to find a deployment of a cyberweapon by a nation state before that time frame.

It took me one google search to find this wikipedia entry:

A 2008 article in the Culture Mandala: The Bulletin of the Centre for East-West Cultural and Economic Studies by Jason Fritz alleges that the Chinese government from 1995 to 2008 was involved in a number of high profile cases of espionage, primarily through the use of a "decentralized network of students, business people, scientists, diplomats, and engineers from within the Chinese Diaspora".[28] A defector in Belgium, purportedly an agent, claimed that there were hundreds of spies in industries throughout Europe, and on his defection to Australia Chinese diplomat Chen Yonglin said there were over 1,000 such in that country. In 2007, a Russian executive was sentenced to 11 years for passing information about the rocket and space technology organization to China. Targets in the United States have included ‘aerospace engineering programs, space shuttle design, C4ISR data, high-performance computers, Nuclear weapon design, cruise missile data, semiconductors, integrated circuit design, and details of US arms sales to Taiwan’.[28]

While China continues to be held responsible for a string of cyber-attacks on a number of public and private institutions in the United States, India, Russia, Canada, and France, the Chinese government denies any involvement in cyber-spying campaigns. The administration maintains the position that China is not the threat but rather the victim of an increasing number of cyber-attacks. Most reports about China's cyber warfare capabilities have yet to be confirmed by the Chinese government.[29]

I know I won't convince you of anything here, but I definitely think your theory that the US opened a pandora's box that hadn't previously been opened with Stuxnet is wrong and I think the information you rely on for your confidence is feeble. I'm sure that in the end, we'll just have to agree to disagree again.

[htismaqe]

Originally Posted by patteeu

I find your confidence in these paranoid, blame-America theories of yours fascinating. I was curious how you come by it. I disagree with your entire theory.

Regardless of who did it first, the US has been involved in some very nefarious cyberattacks, some against US companies.

[planetdoc]

Originally Posted by patteeu

I find your confidence in these paranoid, blame-America theories of yours fascinating. I was curious how you come by it. I disagree with your entire theory.

ok. will walk you through it.

Originally Posted by planetdoc

1. The US declared cyberattacks an act of war.

2. US undermined this position with the Stuxnet and Flame virus.

already linked the first. US originally said that a cyberattack is an act of war. Than Hayden said stuxnet is "not an act of war." Thus the position was undermined.

Originally Posted by planetdoc

3. Instead of working to make US interests more secure, the US government has worked to cripple and backdoor hardware and software. This makes US companies and infrastructure more vulnerable to attack.

4. US finds and gather 0-day exploits and vulnerabilities for offensive attacks, but fail to tell US companies so that they may fix their vulnerabilities....once again making them more vulnerable to attack.

already linked documents citing this in this thread. the link below goes further into the topic and provides sources.
The Currency of Exploitation

Originally Posted by patteeu

Cyber warfare is often a bit more subtle than a nuclear bomb. It would be tough to miss news of a nuclear bomb detonation, but cyber attacks don't make the same splash if they're even disclosed publicly.

sure, that is why it took security researchers years to detect and figure out stuxnet. That being said, there is no evidence of a cyberattack similar to stuxnet prior to stuxnet.

Originally Posted by patteeu

It took me one google search to find this wikipedia entry:

that is no way in any level comparable to stuxnet. Those type of attacks are not sophisticated and can be done by anyone unlike the sophistication of stuxnet. Its like comparing handguns to nuclear weapons.

[patteeu]

Originally Posted by planetdoc

ok. will walk you through it.





already linked the first. US originally said that a cyberattack is an act of war. Than Hayden said stuxnet is "not an act of war." Thus the position was undermined.


already linked documents citing this in this thread. the link below goes further into the topic and provides sources.
The Currency of Exploitation



sure, that is why it took security researchers years to detect and figure out stuxnet. That being said, there is no evidence of a cyberattack similar to stuxnet prior to stuxnet.




that is no way in any level comparable to stuxnet. Those type of attacks are not sophisticated and can be done by anyone unlike the sophistication of stuxnet. Its like comparing handguns to nuclear weapons.

What a cop out. First you said the US launched the first cyber warfare attack. Now, you're complaining because the US may not have actually started it, but they did it better. I hope we continue to be better. You're desperate to blame the US. I think your arguments are garbage.

BTW, I don't care whether one person said cyber warfare is an act of war and then a different person said it isn't. As far as I'm concerned, that's an attempt to deflect from the issue.

[htismaqe]

Originally Posted by planetdoc

3. Instead of working to make US interests more secure, the US government has worked to cripple and backdoor hardware and software. This makes US companies and infrastructure more vulnerable to attack.

4. US finds and gather 0-day exploits and vulnerabilities for offensive attacks, but fail to tell US companies so that they may fix their vulnerabilities....once again making them more vulnerable to attack.

That's because, to the NSA, American companies are potential enemies. Everybody is a potential enemy actually.

The former head of the NSA Cyber program, General Keith Alexandar, was a well known paranoid megalomaniac...