Schneier on Security

Clive Robinson • May 5, 2026 2:30 PM

@ ALL,

Sent in parts due to auto-mod.

Part 4,

Kaspersky has also linked two exploits in Coruna’s toolkit to Operation Triangulation, a complex and likely government-led cyberattack allegedly carried out against Russian iPhone users.

After Trenchant developed Coruna — somehow, it’s not clear how — these exploits found their way into the hands of Russian spies and Chinese cybercriminals, perhaps through one or several intermediaries who sell exploits on the underground market. “

That is it was a US Defence designed exploit that somehow “got free” to the Chinese and Russian cyber-criminals and authorities.

Making the point that all “assistance to Law Enforcement” will fairly quickly be found and liberated and used by undesirables both authoritarian and criminal –though there is not much difference– against users who “mistakenly go with convenience rather than established reasonable OpSec”.

Clive Robinson • May 5, 2026 2:33 PM

@ ALL,

Sent in parts due to auto-mod.

Part 6,

Once you understand the OpSec you can then decide how you make such a system “more convenient” for use… But as the oft repeated warning says,

“Don’t roll your own crypto / security system”

Because it’s all to easy to get it wrong if you try to make it to clever / convenient…

[1] If you use your Apple device as only a “communications node” rather than a “user display/play device” then provided the security you use on the actual “message” is sufficient then this current malware only alows access to user message ‘meta-data’ and ‘Cipher-Text’ not the actual message ‘plain-text’.

Clive Robinson • May 6, 2026 10:55 PM

@ Diego,

With regards,

<

blockquote>”New tools being made to exploit zero-days just keep coming. I see how it’s a constant struggle for security teams to keep up.”

<

blockquote>

There will always be new “zero-days” coming down the pipeline. Because as our level of understanding / sophistication grows, so will our ability to,

1, Reason out not just new “blackswan” classes of attack vulnerability instants.
2, But also spot the equivalent of entire new unforeseeable “platypus” classes rippling the surface of the water as they swim by…

With regards,

” Hopefully AI can prove itself as a great tool to help them keep up.

That’s actually unlikely with current AI LLM and ML systems. Because in reality they can only “pattern match” to existing “know classes” of vulnerability that were in the “training data” with some minor random close variations.

So as you note, whilst,

“Mythos seems to be a great tool to start, …”

It actually offers the same advantages and disadvantages to both sides on a “coin toss probability”.

However we then have to think further about the consequences of that on the $64,000 question you ask,

“But will attackers always have the upper hand?”

The answer is –put simply– “yes” based on just “time constraint issues” and that “attackers can work deep out of sight” developing first a “Proof of Concept”(POC) and then developing it into a fully developed APT attack. Whilst “defenders have to work in everyone’s sight” thus they don’t progress even as far as a POC in some cases before “attackers” get to know of the new attack instance and class “methods” and work them into their existing attack chains or attack chain prototypes.

That is for an attacker, if Mythos gives them a new instance/class only that individual attacker knows it, thus “has time” to develop not just a POC but a nicely integrated attack within their existing tool chain sets.

A defender only gets to see that new instance/class and work on it when three things have already happened,

1, It’s been developed into a “fully fledged” attack.
2, The use of the attack in some way shows up “in the logs” as anomalies “to be noticed”.
3, The log anomalies actually get both noticed and recognised as an attack by defenders with spare resources.

The third point being why we named certain stealthy and focused attackers as “Advanced Persistent Threats”(APTs). The second point is unfortunately why some APT attacks may go undetected for years. With the first point being why some APT attacks never get resolved… That is we get to see “payload” but not “intrusion” and why we knee-jerk call such stealth attacks as being “level III” or “State Level”.

Now consider that Mythos hands defenders a new instance/class of attack… Ask the question of what time constraints the defenders have on them, and the fact that as of yet nobody has produced more than a POC and not integrated it into attack tools and the resulting attack chains.

But further consider that new instance/class of APT attacks are increasingly now “compound attacks”. Where two or more zero-days are concatenated for each attack put into use. Some have used four or more zero-days and this makes the defenders job increasingly time and other resource constrained.