Schneier on Security

Clive Robinson • January 17, 2024 7:15 AM

@ Bruce, SpaceLifeForm, ALL,

Re : Nation State APT etc.

As SpaceLifeForm, myself and one or two others had been pointing out,

“Atribution is hard”

When the Mirai Botnet happened just about all the CompSec people especially those getting business via the US Government went along the lines of

“It’s Nation State APT”

For reasons I suggest it’s best to let them explain (not that it is likely they ever will do).

Eventually people started to “grow up” and put distance between themselves and those who for self promotion reasons were almost always claiming it must be one of the four “US Axis of Evil” nations of,

China, Iran, North Korea, Russia.

Especially as the US Gov would only claim one of them at a time, based on prevailing politics not actual evidence.

The reality is that whilst these countries –like all countries of some level of technical sophistication– do have state funded cyber espionarge as part of their SigInt and other Inteligence agencies the majority of attacks that become public are Cyber-Crime.

One of the things most noticeable about the current US Executive is they are much less reactive and rather more proactive with regards ICTsec than previous US Executives.

Hopefully this is something that will remain in the next Executive cycle.

But also of note is that with effectively three state level conflicts occuring, just how little State Level Cyber-warfare is of the APT form and more the Crime form.

This maybe because of the belligerents involved but it might also be because of an “over play” by those making pronouncements.

Look at it this way,

On your home You put locks on your doors and shutters on your windows to keep out opportunistic criminals, not soldiers and their bullets or bombs. For the latter you dig a hole in the ground and pour concrete with reinforcing into it and a couple or three layers on top and call it an “air raid shelter” you tend not to put a door as such on it and even when you do you tend not to put locks on it.

Thus you do the opposite for security against criminals that you do against nation state attackers.

This mentality has apparently carried forward into ICTsec, in that whilst we do take some precautions against opportunistic criminals we take little or no precautions against what we have been led to believe are Unstopable Nation State Actors and their APT, even though broadly the targets are the same…

So far we are basically seeing criminal not nation state in the reporting of the current wars.

As such they are more nuisance than damaging… Something we might all usefully take on board in ICT.