Comment by cstross | Hacker News Reader

Comment by cstross | Hacker News Reader

Parent Full thread

It used to be the case during the Cold War that there was an unspoken, tacit understanding that assassination would not be used as a tool against the leadership of the great powers: assassins are cheap, so if it became established as a tool it would create a level playing field.

(There were exceptions, e.g. in the third world, but there was a big difference between a front-rank player (the USSR) murdering someone like Hafizullah Amin during the opening moves of an invasion, and something like the shootdown of Dag Hammarskjöld's plane during the Congo crisis: assassinating the UN Secretary General was a huge scandal at the time.)

Today, the use of weaponized CVEs by SIGINT agencies seems to have developed into a free-for-all: the big players were clueless about the potential for accidentally normalizing this practice, or the scale of the consequences as computers became ubiquitous and indispensable components of everything from hospital medicine carts to automobiles, and thereby leveled the playing field and quasi-legitimized it for non-state level actors.

And we're all going to be paying the price for at least a generation.

I am not sure how you are getting from SIGINT to assassination. Since at least WW2, and almost certainly long before, there has been no tacit agreement that the great powers wouldn't spy on each other. Quite the opposite, in fact.

Is your argument instead that things like ransomware attacks are more akin to sabotage than to intelligence gathering? In that case, I'd suggest keeping two things in mind:

1. The one well-attributed case of state-level ransomware attacks was to North Korea, the norms-violating exception that somewhat proves the rule.

2. The majority of ransomware attacks are carried out by bona fide private actors unaffiliated with any state, and ransomware is also a part of our current norm, and has been for many years.

It will be interesting to see what happens when China shuts the power grid in Omaha, Nebraska off --- a capability they almost certainly have. The fact that you don't see things like that happening today suggests to me that the norm (I believe) you're referring to remains intact.

Major powers set international standards, and failure to establish standards for cyber has produced a situation where exploitation of CVEs has become so normalized that there are almost zero repercussions for using them in destructive ways. Especially if you are a non major power or non state actor, there seems to be little incentive not to wreak damage and havoc.

The US and Europe have failed to clearly state the consequences for a major attack, instead, we muddle along assuming that that the implications will be enough. Even huge damage attacks by nation state actors such as the Sony North Korea hack seem to have gone unpunished.

Respectfully, that's pretty silly. People have been "wreaking havoc" with exploits for as long as there have been exploits. Nobody in the world was waiting for China's permission to do this kind of stuff. I don't think that's the previous commenter's argument.

No country "needed" permission for anything, ever. But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies. The same can be said with the arms control treaties, nuclear weapons, non-proliferation, etc.

That all seems to have gone out the window in the cyber realm, where there aren't any standards or consequences for nefarious actions.

This seems like a very basic and obvious observation.

The "nobody" that didn't need China's permission are PRIVATE actors. Taboo on assassination by against great power leaders did not stop Lee Harvey Oswald, and likewise a balance of deterrence between China and the US on active sabotage hasn't kept criminals from carrying out the same kinds of attacks for profit.

It's not "gone out the window in the cyber realm" - as you say, the major powers were able to set informal international standards for intelligence, espionage and data collection, for themselves and for their allies, and those standards definitely, absolutely permit all such actions of SIGINT, industrial espionage and even sabotage. If a weaponised exploit could affect something in 1980s, then it would get used by intelligence agencies with no qualms, there wasn't any "gentleman's agreement" or the like that would make them think twice about that. E.g. there's description of supposed events in 1982 https://en.wikipedia.org/wiki/At_the_Abyss that may or may not be true, but noone on USSR or USA side would claim that this action (if it happened) would have broken some Cold War taboo.

The basic observation is false - the standards haven't disappeared because (unlike major assasinations) there never were any informal standards that would prohibit this; and (unlike nuclear and missile arms) there have never been any formal treaties restricting this, nor are such standards or treaties likely to happen in the coming decades because multiple major powers believe that lack of such standards is beneficial to them.

I have made the opposite conclusion - large parts of critical infrastructure are vulnerable today and we shouldn't underestimate just how disruptive and destructive one could be without great expertise. It's a ticking bomb. Trivial example, but try browsing Shodan for a wakeup call. And that's just already publicly indexed opportunities.

We haven't seen anything yet.

> But there's a reason that the cold war didn't turn hot, and in part it was because the major powers, US and Russia, were able to set formal and informal international standards for intelligence, espionage and data collection, for themselves and for their allies.

It didn't turn hot because of mutual destruction threat.

I think what parent is trying to say is that there's a present (with different choices in the past) where Hacking Team et al. are illegal, and governments and corporations instead pay out mandated bounties for responsibly disclosed cybersecurity research.

I'd prefer that present. But it's certainly not the one we're living in.

And the NSA, Russian APT 28/29, Chinese APT 1 have responsibility. Not just for their own actions, but for creating a world in which similar actions by anyone are normal.

Everything NSA and the APT groups do now (in this arena) was done first by private actors, so, no, I don't think this argument works.

Chronology is immaterial to this argument.

What matters is whether the state, with its ultimate monopoly on force, sanctions a given method by its active use.

The state clearly does not have a monopoly on computer/network exploitation.

I was referring to the state's monopoly on the ability to punish.

The US has already done cyber attwto Russian banking system back in 2016, and even when not a great power, there have been serious claims of the Venezuelan electric failures being caused by US intervention, beyond that the Snowden leaks showed that the US has set in place mechanisms that could shutdown entire energy grids if they really wanted to

I thought the big deal with EternalBlue is that the Shadow Brokers released the NSA's hacking trove as open-source, thus opening it up to all sorts of people with minimal technical skills. There's a big difference between having a zero-day but requiring the technical chops to turn it into a working exploit, and downloading a file off the Internet and running it.

There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now.

(For that matter, all these attacks are credited to Russia or North Korea or Iran - but do we actually have any evidence that that's who's behind them? Couldn't it just as easily be a teenager in his bed in upstate NY who has compromised a server in Russia? $100K in Bitcoin ransom is peanuts for a nation-state and would even be peanuts for a number of Silicon Valley techies on this site, but it's a lot of money to a high school kid.)

This BlackHat keynote[0] makes the good point that cyberattacks by other countries, especially Russia (the 'bears') work fundamentally differently from the US. In the US, private companies aren't allowed to do any hacking whatsoever, and organized crime is swiftly prosecuted by the FBI. The NSA would often have a dozen meetings before changing course on an operation... the bureaucracy is slow and autonomy is non-existent.

In Russia, there is no extradition for hackers, and it's rare for someone to be prosecuted for ransomware. Malware writers and organized crime rings form a loose network with Kremlin officials. Attacks are done as favors, or even launched because the hackers think Putin would like it. Guccifer 2.0 is a prime example of this.. their espionage op against the DNC got blown, and 12 hours later they relaunched the op as a hacktivist campaign. It's altogether more casual and efficient.

As a bonus, you don't have to pay your hackers if you let them make their own profits... hence all the ransomware. $100k is a good haul for an enterprising Russian criminal.

0. https://youtu.be/gvS4efEakpY

Corrections:

> it's rare for someone to be prosecuted for ransomware.

Because of the choice between prison time with blackmail and other dirty deeds or working on the 3-letter organization. Russian law enforcement agencies are large criminal organizations themselves.

> Malware writers and organized crime rings form a loose network with Kremlin officials.

Those form a very tight network, former also with Lubyanka officials (location of FSB HQ).

There has been pretty strong attribution for NK in the past doing ransomware.

100k isn't a lot but you are talking about NK, a country that has it's diplomats selling meth and heroin

> There's this huge pandora's box about opening up state-level weaponry to the general public. Ultimately, it undermines the nation state as an organizing principle. And that's the world we live in now.

I feel like this point is hardly ever appreciated. I don't think we quite live in that world (where's my open source nuke?), but we're always oscillating on the continuum if we take a long enough view of the situation. The extent to which power is distributed relies on the extent to which technology is distributed, but also the extent to which the distributed technology can be utilised by a relatively small group. A small group with equally good spear designs still loses to the larger group. A small group with equally good drones, nukes, viruses, and firewalls might be able to put up something closer to an even fight. A radical open sourcing of technology might lead to a breakup of the modern nation state into smaller entities. Until it does, or some sort of parallel structures form alongside the nation states which they are unable to actually police, I wouldn't call them undermined. The parallel structure scenario might be somewhat arguable today, but always has been; the line between organized crime and government is blurry. I don't think we've moved significantly far in that direction as a result of open source tools yet. If there ever comes a day when private defense contractors can accept Bitcoin without KYC and taxes, just rolling through the streets in a small division of tanks selling AK-47s to passing school children, I'll completely agree that the nation state has been undermined.

Imho, what keeps the nation-state from being undermined by the techno-anarchist crowd is the requirement to hold territory.

Any halfway competent person in a number of fields (cyber security, virology, chemistry) could probably "take over" a small town with a few buddies.

And then the US government surrounds it. Blockades it. Allows nothing in or out. And waits.

As the Palestinians, South Sudanese, Tibetans, Taiwanese, Hongkongers have found (with varying degrees of success), independence is only viable as a going concern if you have international allies and trade.

Agree completely. I think this is one of the reasons for so much interest in seasteading despite the high barrier of entry and maintenance compared to living on land (not that a group of ships can't be surrounded and sanctioned). Ultimately, I fear that joining the WMD club is a prerequisite to true self determination.

And the price of leaving the WMD club (eg Ukraine and Libya) is so high that there is no way a diplomatic solution to denuclearization

History shows any group that is disarmed by another group is about to get run over. The logic scales from the individuals of a nation to the nation itself.

As a small note, I think the word we're looking for in this thread is not "nation-state", but simply "state" i.e. sovereign country or polity.

Not all states are "nation-states". A "nation" (⋆) is specifically a group of people who are culturally homogeneous, and a "nation-state" (⋆⋆) is a sovereign state that is also culturally homogeneous. In most of these discussions we are talking simply about sovereign states, not nation-states specifically.

Someone else pointed this out onetime in another HN comment, and now "can't unsee".

(⋆) https://en.wikipedia.org/wiki/Nation (⋆⋆) https://en.wikipedia.org/wiki/Nation_state

That's certainly what "nation" meant a hundred years ago, and what it means in context of nationalist ideology.

I think that in modern English, "nation" and "nation state" mostly mean "sovereign country or polity". I think this usage is partly because obviously most uses of "state" are references to obviously-non-sovereign internal divisions of territory, whether in the US or Austria or Australia or Brazil or India, and including extremal cases like the states of Palau (most of which comprise less than a thousand people).

Probably another cause is that so few people take 19th-C / 20th-C nationalism seriously that there's no real need for the word "nation" in this context.

But if you're keen on the political-science definitions, note that states don't have to be sovereign. The word "country" won't do because they don't have to be sovereign either (e.g. England or Greenland). I think if you want to formally say "sovereign state", you have to say "sovereign state".

I think that in modern English, "nation" and "nation state" mostly mean "sovereign country or polity".

It's just very recent modern infosec and internet English and it's seeping out into all sorts of other places. Probably too late to stop it.

As a check, I just searched NYT's site for 'nation state' and other than its original non-redundant sense or in quotes, they don't use it, best I can tell.

Having mentioned the Palestinians, it's only fair to include the Israelis. Especially because it was US support that almost guaranteed their independence. The British had been far more even-handed, back in the 20s to early 40s. But they were (in a way) defeated by the US in WWII, along with just about every other nation involved, except for the Soviets.

> where's my open source nuke?

There are "open-source" (leaked) designs out there, I'm sure. Or at least, old designs. Maybe for something like the Hiroshima bomb.

But you'd need enriched uranium. And for that, you'd need a bunch of gas centrifuges. And a chemical plant to make the hexafluoride, and convert the enriched stuff back to uranium.

And that's why you don't have open-source nukes.

Another way to look at it is that if you have all the prerequisites for that (talent, staff, money, resources, physical space, etc) to do those things, there are plenty of other more profitable enterprises they could be leveraged for unless you specifically need a saber to rattle, which is usually only the dominion of a well-funded despot and/or Bond villain.

https://tvtropes.org/pmwiki/pmwiki.php/Main/CutLexLuthorAChe...

How Pepsi briefly became the 6th largest military in the world: https://www.businessinsider.com/how-pepsi-briefly-became-the...

Reply on news.ycombinator.com