To be honest I was a little disappointed when I saw this talk. Its title was not accurate for a presentation at ccc. It is neither advanced nor attributable to a nation state. It grossed me out when the nontechnical guy hyped things and the hired gun shied away, making it clear the nontechnical guy is grandstanding - also not appropriate for ccc- so I left before it ended.
To be honest I was a little disappointed when I saw this talk.
Agreed. The technical sophistication of the described spear-fishing attack was certainly low, using 10-year-old software and requiring the victim to enable macros, when prompted, after opening the excel spreadsheet. The only takeaway from this talk was that a dozen or so fishing emails were related together by the excel spreadsheet metadata.
Certainly not worthy material for the front page of HN, in my opinion.
I am really confused as to why the security community is obsessed with the term "nation state". Every single publication or quote from security researchers that wants to attribute some worm or attack to a country incorrectly calls it a nation state.
A nation state is a specific thing that is not just a pompous way of saying state or country.
If you're wondering, you can check the Wikipedia entry on it. There's nothing inherent about any type of technical attack that could connect to a nation state.
It's sort of a shibboleth of someone who is self-important and doesn't fact-check.
What's even more problematic is that you have been downvoted on a community that was founded by people who participated in building the tech responsible for forging history's first self-sustaining post-nationalist identity (the internet) in history.
The nation-state must be the enemy, which can only be defeated by a nation-state... because the concept of a nation-state is dying and is engaging in full blown Hegelian dialectics to keep itself afloat. Unions, nationalists, and identity zealots have been having a field day with HackerNews as of late.
It means the internet allows people to communicate, share ideas, and form cultural bonds and identities outside of the highly-restricted context of national frameworks.
This is technically correct in concept, but not in practice, as organized religion existed long before the formalization of the nation-state. In fact, one can even argue that nationalism is an agnostic subdivision of organized theology since it utilizes identical symbol worship mechanisms.
I'd put it down to the aesthetics of common usage. 'Nation state' looks and sounds better than the alternatives. Words mean whatever their users intend them to mean regardless of whether the usage is technically, or historically, incorrect.
Wouldn't the definition then mean that you should say "state" or "state actor"? To attribute a worm or attack to a country would only mean that it originated there, not that it was created by the well-resourced state organization that is associated with that country (which is what the people using the "nation-state" label seek to imply).
I'm not in netsec, but i'm still a little fuzzy on some details here:
1)what's the evidence that this is tied to/from the off the shelf core-impact product? using a similar api call? a controlling server is used?
2)other than the target being an israeli aerospace firm and payload pretending to be military in nature (im guessing to generate curiosity, how are 'nation-states' involved?
EDIT: maybe answering my own question
1. a "Campaign" identifier is a variable found
2. lure document exists elsewhere and has been seen targeting multiple nations over years. at academics and defense orgs.
13 comments
[ 3.1 ms ] story [ 40.6 ms ] threadAgreed. The technical sophistication of the described spear-fishing attack was certainly low, using 10-year-old software and requiring the victim to enable macros, when prompted, after opening the excel spreadsheet. The only takeaway from this talk was that a dozen or so fishing emails were related together by the excel spreadsheet metadata.
Certainly not worthy material for the front page of HN, in my opinion.
A nation state is a specific thing that is not just a pompous way of saying state or country.
If you're wondering, you can check the Wikipedia entry on it. There's nothing inherent about any type of technical attack that could connect to a nation state.
It's sort of a shibboleth of someone who is self-important and doesn't fact-check.
The nation-state must be the enemy, which can only be defeated by a nation-state... because the concept of a nation-state is dying and is engaging in full blown Hegelian dialectics to keep itself afloat. Unions, nationalists, and identity zealots have been having a field day with HackerNews as of late.
What do you mean by this?
I am not a historian, but wouldn't that honor go to religion? Regardless, religion is certainly older than the Internet.
Edit: a word
1)what's the evidence that this is tied to/from the off the shelf core-impact product? using a similar api call? a controlling server is used?
2)other than the target being an israeli aerospace firm and payload pretending to be military in nature (im guessing to generate curiosity, how are 'nation-states' involved?
EDIT: maybe answering my own question 1. a "Campaign" identifier is a variable found
2. lure document exists elsewhere and has been seen targeting multiple nations over years. at academics and defense orgs.