171–180 of 507 posts
Earlier quoted context omitted.
We're quickly heading toward the age of the first Virtual WMD. The implications can be as wide as your imagination, but possibly worse than existing WMDs.
I'm having a hard time imagining a virtual WMD that is worse than the instant obliteration of millions of people.
> This driver was digitally signed by Realtek > that driver started signing it with secret keys from JMicron I think this is the scariest part of the worm. Not only do the people writing it have access to zero-days, they also somehow have (possibly physical) access to the private keys of two large corporations.
https://arstechnica.com/information-technology/2012/06/flame...
This isn't stealing a cert or burning four zero-days. This is dropping a zero-day cryptographical attack, which hasn't been reverse engineered yet.
Earlier quoted context omitted.
> I'd bet that they somehow had access to the HSM, to have it sign the driver for them. Or were able to duplicate the HSM before it was delivered. You know, like how the NSA intercepted shipments of internet routers in transit and inserted backdoors.
That wouldn't work because HSMs are typically not delivered with keys, you generate the private key yourself.
Earlier quoted context omitted.
Blackouts. Do what Stuxnet did to the control rooms of a large number of power plants, spinning up the machines to hard, coordinate this attack so it triggers in a large number of places. If you can pull this off for a continental scale, you're looking at potentially months to restore power to everywhere. https://en.wikipedia.org/wiki/December_2015_Ukraine_power_gr...
Without power, logistics & supply lines stop working, no more groceries after a few days, riots and plunderings in the streets a week later...
Which makes me concerned about the future; if the transport network becomes electric, a power outage will cripple things even more. Unless we build self-contained, internet-disconnected charging stations maybe, but that's not going to be done at any kind of significant scale.
Earlier quoted context omitted.
If you are a state actor, it's not difficult to gather a couple of programmers from the "antivirus" and security field and build something that is hard to detect. It would be impressive if it was the work of a teenager but it's not.
You also somehow need access to the industrial grade target platform in some way shape or form which is not something a teenager has lying around in their room nor extensive knowledge about to this extent.
Industrial automation stuff like this is a common part of the "technical high school" curricula where I live. (of course only on the "press this button and then that happens" level)
Earlier quoted context omitted.
You don't ship HSM's with keys (you initialise them on-device yourself) nor can you read read keys out from one (at least in theory).
In theory, theory and practice are the same, in practice they're not.
The scary thing about this is: Stuxnet is one of the "most sophisticated" pieces of malware we have discovered up until now . Who knows what kinds of software are still out there quietly doing their thing in the shadows.
Earlier quoted context omitted.
The problem is not everyone on the world stage is a rational game theory nerd that links to papers like we want them to be. Also 60 years of treating every other country as a box in a threat model to be manipulated against other boxes has been a completely unmitigated disaster, so maybe we should stop that.
> 60 years of treating every other country as a box in a threat model to be manipulated against other boxes has been a completely unmitigated disaster Has it? The last 60 years have been relatively peaceful, by historical standards.
Earlier quoted context omitted.
Err, they absolutely were trying for a nuclear weapon. That’s what Stuxnet and (later) JCPOA were trying to stop.
You're confusing uranium enrichment with attempts to build nuclear weapons. Irans's research into nuclear weapons has ended in 2003, 15 years ago. Iran has nuclear power plants though, and uranium enrichment is needed to fuel them. I think the reason Trump and Netanyahu are so enraged by the JCPOA agreement is that it makes concessions to Iran in exchange of.. nothing, since Iran already didn't have any active nuclea…