Email or username:

Password:

Forgot your password?
lcamtuf :verified: :verified: :verified:'s posts Post Back to profile
Top-level
Irenes (many)

@timbray @lcamtuf @rfc6919 @projectgus we do think there's a good chance of this being an organized effort, as the essay suggests. good piece! thanks for it!

we note, however, the existence of ideological motives that could drive an individual to do this.

30 March at 4:04 | Wall-to-wall | Open on mastodon.social
9 comments
Irenes (many)

@timbray @lcamtuf @rfc6919 @projectgus online manipulation and bullying tactics such as those sockpuppet complaints about maintainership are well-established in other areas of life, unrelated to software development. they are also well-known, which means lots of unaffiliated actors use them for lots of different goals.

30 March at 4:05 | Open on mastodon.social
Irenes (many)

@timbray @lcamtuf @rfc6919 @projectgus overall, yeah, this is an absurdly PATIENT attack. we think that more than anything else does suggest organization behind it.

30 March at 4:05 | Open on mastodon.social
Brad Rubenstein “:verified:”

So maybe not a maintenance team, since the crucial software is, as you say, long since finished.

Rather, a community of monks, whose religious vocation is to protect and defend the obelisk for eternity.

@irenes @timbray @lcamtuf @rfc6919 @projectgus

30 March at 6:36 | Open on infosec.exchange
Bruce Heerssen

@irenes @timbray @lcamtuf @rfc6919 @projectgus

I think there are many governments that would be willing to do something like this, and wouldn't care if it affected their own systems too as long as only they knew about it. Hell, that probably describes most governments, including in the United States and the UK.

There have been several agencies and officials in the U.S. who have openly expressed discomfort with the idea of impenetrable cryptography.

30 March at 4:14 | Open on darkmoon.social
Irenes (many)

@bruce @timbray @lcamtuf @rfc6919 @projectgus oh, absolutely agreed on all that. furthermore, whether or not THIS attack was state-sponsored, now everybody has seen the strategy.

30 March at 4:17 | Open on mastodon.social
Bruce Heerssen

@irenes @timbray @lcamtuf @rfc6919 @projectgus

Yup. And to be clear, I don't necessarily think the US or UK in particular is behind this. I think it's more likely China, or perhaps Russia. The point is, we don't know. And like you implied, it could still turn out to have been an individual with an agenda.

30 March at 4:19 | Open on darkmoon.social
Janne Moren

@bruce @irenes @timbray @lcamtuf @rfc6919 @projectgus
Or, an individual with the idea of selling backdoors as a service. That'd be one reason to be this patient and persistent: you'd not use it (and presumably other created vulnerabilities) yourself once; you sell access to other people. With luck you could perhaps sell this a half a dozen times before it gets discovered and patched.

30 March at 4:52 | Open on fosstodon.org
lcamtuf :verified: :verified: :verified:

@jannem @bruce @irenes @timbray @rfc6919 @projectgus This is an awful lot of effort to put into a "product" that has a non-trivial chance of getting burned on first try if your customer is careless.

It's something you use when a really compelling need arises, and where you can control most of the variables to minimize the risk of loss.

30 March at 5:06 | Open on infosec.exchange
sabik
Go Up