Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

cisa.gov

Post reply on HN
Print view View original

11–20 of 24 posts

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#11

Post by tptacek »

dragonwriter wrote: post #9
tptacek wrote: post #3

It'd be useful if someone at State could inform CISA of the meaning of the term "nation-state", unless CISA is very subtly trying to signal which particular countries these attacks are coming from, since nation-states are a small subset of all countries.

Nation-state has a few different uses, the most common of which seems to be exactly what is correctly used here, the principal soveriegn subjects of international law under the Westphalian system (these are typically know in international law as simply “states” but outside of documents of a clearly international-law character, that is easily conflated with other meanings of “state”, especially in places like the US w…

Whatever else is going on with terms like "nation-state", there's some creepy politics behind the notion that countries are generally nations. I'm fine with the idea that "nation-states" don't generally exist. The word "state" in "state-level actor" is unambiguous.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#12

Post by dragonwriter »

tptacek wrote: post #11
dragonwriter wrote: post #9

Earlier quoted context omitted.

Nation-state has a few different uses, the most common of which seems to be exactly what is correctly used here, the principal soveriegn subjects of international law under the Westphalian system (these are typically know in international law as simply “states” but outside of documents of a clearly international-law character, that is easily conflated with other meanings of “state”, especially in places like the US w…

Whatever else is going on with terms like "nation-state", there's some creepy politics behind the notion that countries are generally nations. I'm fine with the idea that "nation-states" don't generally exist. The word "state" in "state-level actor" is unambiguous.

Honestly, with or without “nation-”, “state-level actor” is a useless phrase, because (other than juridically), “state” isn't a level of an actor (particularly, it isn’t a capability level.)

If you mean a “major regional power”-level actor, or a “global superpower”-level actor, then say that, but a category that includes both the United States of America and Tuvalu isn't communicating a coherent capability level in any domain.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#13

Post by tptacek »

dragonwriter wrote: post #12
tptacek wrote: post #11

Earlier quoted context omitted.

Whatever else is going on with terms like "nation-state", there's some creepy politics behind the notion that countries are generally nations. I'm fine with the idea that "nation-states" don't generally exist. The word "state" in "state-level actor" is unambiguous.

Honestly, with or without “nation-”, “state-level actor” is a useless phrase, because (other than juridically ), “state” isn't a level of an actor (particularly, it isn’t a capability level.) If you mean a “major regional power”-level actor, or a “global superpower”-level actor, then say that, but a category that includes both the United States of America and Tuvalu isn't communicating a coherent capability level in…

Global superpower gets the dynamics exactly backwards. Another hobbyhorse of mine: Belize could be a major player in these kinds of threats if they wanted to be. At the scale of sovereign states, none of this is real money.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#14

Post by 3pac »

tptacek wrote: post #3

It'd be useful if someone at State could inform CISA of the meaning of the term "nation-state", unless CISA is very subtly trying to signal which particular countries these attacks are coming from, since nation-states are a small subset of all countries.

It's just a heavy metal umlaut for someone who could have written "state-level" or "country". Like forcing the word "geopolitical". I would not get too worked up about it.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#16

Post by BearhatBeer »

Can we just eliminate bad actor nation states like China and Israel from the Internet? Filter all packets coming from or going to there, have the backbone spyware sever proxy connections, etc? One year the first time, forever with repeat offenders.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#17

Post by fomine3 »

mmstr wrote: post #2

Context for people reading the comments: CVE-2022-47966 is a Zoho vulnerability, while the other is a fortigate one, both are RCEs Both have had public PoCs published at least early this year, there's a bunch more of publicly known RCEs that are still unpatched and used by some tens of thousands of machines, according to Shodan

*Zoho ManageEngine

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#18

Post by rurban »

tptacek wrote: post #3

It'd be useful if someone at State could inform CISA of the meaning of the term "nation-state", unless CISA is very subtly trying to signal which particular countries these attacks are coming from, since nation-states are a small subset of all countries.

Nation-state actors are just illegal criminal organizations, authorities, backed by governments. Above the law, with large budgets.

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#19

Post by hulitu »

BearhatBeer wrote: post #16

Can we just eliminate bad actor nation states like China and Israel from the Internet? Filter all packets coming from or going to there, have the backbone spyware sever proxy connections, etc? One year the first time, forever with repeat offenders.

> Can we just eliminate bad actor nation states

FAANG is located in USA. /s

Re: Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

#20

Post by rdtsc »

tptacek wrote: post #3

It'd be useful if someone at State could inform CISA of the meaning of the term "nation-state", unless CISA is very subtly trying to signal which particular countries these attacks are coming from, since nation-states are a small subset of all countries.

Nobody wants to be hacked by a random kid from their parent’s basement. It’s kind of embarrassing. It’s nicer to just say that we are being attacked by a nation state. “It’s understandable, nobody could resist such force!”
Post reply on HN