I’ve never liked the term ‘cyberweapon’. It is subtly misleading and gives the non-technical masses misconceptions about how exploits actually work. Cyberweapon implies that exploits are created by governments and let loose on the world, when in reality exploits are existing flaws that were simply discovered by governments or individuals. Exploits are like a serious manufacturing defect in a lock that was only discovered after the fact. I think this misconception has real implications. If you compare exploits to Nuclear weapons, the public reaction will be we need more secrecy and more weapons to protect us from hostile nations. If however you changed the analogy to something like a defective lock, it become obvious that what we really need is openness so exploits can be fixed.
Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
41–50 of 116 posts
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#42Not trying to claim whataboutism, but I think there's an elephant in the room. The end result of the NSA saying "ok, as of today we've completely disarmed our cyberweapon stockpile and released patches for all vulnerabilities to the appropriate software companies" wouldn't be the end of cyberattacks. It would just be someone else doing them. I don't know what the real solution is. Maybe there is none.
The point is that there would be fewer cyber attacks, both because the NSA itself would no longer be adding to the number of hacks and because the NSA would use their sizeable budget to discover and disclose vulnerabilities, presumably making all of us safer.
Their budget is sizeable but less than the annual profits of Google, Microsoft, Apple, etc. And NSA pays for tons of stuff that those corporations don't have to deal with like having thousands of linguists.
Where is the responsibility of corporations in all of this? They have a cash pile that dwarfs the entire intel budget and ought to be the FIRST entities that invest in fixing their OWN products, right?
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#43Earlier quoted context omitted.
Do these missiles require a working communications network? If this goes on long enough, there might not be any way to launch them.
Why do you think that different countries have put missiles in submarines ?
And Russia reportedly even has a deadmans-switch that can be triggered by seismic activity on Russian soil and rapid changes in air pressure. I'd presume that such a system is not connected to the internet.
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#44Earlier quoted context omitted.
A defensive response would be to inform major vendors of our own infrastructure (i.e. Microsoft, Cisco) of the gaping holes in their systems, instead of leaving them open for the world to attack.
I can name at least one netsec guy who attributes his entire team's existence to the NSA calling his employer and doing exactly that.
Right. It's a false dichotomy that the NSA doesn't do that and needs to disarm itself. There's a happy middle ground where people don't attack us because they're worried about our retaliation and we also improve our own defenses.
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#45Earlier quoted context omitted.
Oh what a world we live in where cyberwarfare could result in death. I would have never thought, as a kid, that life (and death) would end up this "real".
The hacker Karl Koch [1] thought being responsible for the disaster at Chernobyl [2] back in 1986 causing 2M deaths in the last 30 years. I think we will never know whether he was right or not. [1] https://en.wikipedia.org/wiki/Karl_Koch_(hacker) [2] (German) https://de.wikipedia.org/wiki/KGB-Hack
I'm confused what the connection is with Chernobyl.
But 2M deaths in the last 30 years is not likely correct - this interesting WHO report on the matter suggests the final toll from the radiation would be more like "up to 4k":
http://www.who.int/mediacentre/news/releases/2005/pr38/en/
http://www.who.int/ionizing_radiation/chernobyl/chernobyl_di...
> The main causes of death in the Chernobyl-affected region are the same as those nationwide — cardiovascular diseases, injuries and poisonings — rather than any radiation-related illnesses
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#46Earlier quoted context omitted.
The point is that there would be fewer cyber attacks, both because the NSA itself would no longer be adding to the number of hacks and because the NSA would use their sizeable budget to discover and disclose vulnerabilities, presumably making all of us safer.
Their budget is sizeable but less than the annual profits of Google, Microsoft, Apple, etc. And NSA pays for tons of stuff that those corporations don't have to deal with like having thousands of linguists. Where is the responsibility of corporations in all of this? They have a cash pile that dwarfs the entire intel budget and ought to be the FIRST entities that invest in fixing their OWN products, right?
> Where is the responsibility of corporations in all of this?
Somewhere around here :-
> "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!"
Sorry shareholders, you'll be getting a tiny dividend this year because we are spending a huge part of our 'profit' on backfixing all the shit we let slide said no CEO ever.
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#47Earlier quoted context omitted.
Why do you think that different countries have put missiles in submarines ?
And Russia reportedly even has a deadmans-switch that can be triggered by seismic activity on Russian soil and rapid changes in air pressure. I'd presume that such a system is not connected to the internet.
All of those systems predate the Internet, so you bet nuclear capabilities will not be affected much by cyber attacks.
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#48Earlier quoted context omitted.
Yes, that would suck. But that's the aggresor's decision, not ours. I'm not sure why we collectively decided to lack courage, but it's unsettling.
> I'm not sure why we collectively decided to lack courage In this case courage is stupidity. Why waste time knocking out their power when we can spend that time making our power more secure. You're like a web master with a downed site due to a DDOS going: > Well I've DDOSed the attacker's site so its okay no its not, you've achieved nothing. Get with the program; this is a defence world not an offence one.
In situations where Person A is attacking Person B and making it sound like Person A's solution is the only one, Person A is usually mistaken.
My mind is open. Convince me. Why is it a good idea to remove the threat of retaliation from our toolkit? It seems like one of the most persuasive reasons not to attack us.
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#49Earlier quoted context omitted.
> When we strike back, does Russia then strike back again? What does it look like after four or five volleys? Will entire power grids be down for days or weeks? Will the stock market crash? And at what point, after "cyber-damaging" some piece of critical infrastructure (and/or harming/killing people), does the the other side run out of exploits and just launch actual missiles instead?
Do these missiles require a working communications network? If this goes on long enough, there might not be any way to launch them.
[deleted]
Re: Hacks Raise Fear Over N.S.A.’s Hold on Cyberweapons
#50> White House officials have deflected many questions, and responded to others by arguing that the focus should be on the attackers themselves, not the manufacturer of their weapons. Am i to understand that if somebody would manage to steal nuclear warheads and launch them we don't hold the people who failed to protect them responsible?
A nuclear weapon is a little different than a patched SMB exploit.