A nation state can probably buy the building across the street if that's the value of hacking your system.
Of course there are almost certainly cheaper options,but that's the level of time and budget you are up against...teams of motivated and well resourced experienced professionals working against you full time.
https://en.wikipedia.org/wiki/Vault_7
The nation states still have a money/people/breaking+entering advantage, but the cyberattack code is now something everyone has to protect against. Also some companies are important enough that they have to protect against nation state attacks, like pipeline operators, chemical plant operators, utilities, and telecom companies:
https://www.nytimes.com/2024/11/22/us/politics/chinese-hack-...
And criminals won't hestitate to use your family to blackmail you, so all the families of people with critical jobs need to be protect also, and their friends families, and...basically everybody.
https://www.cia.gov/readingroom/docs/CIA-RDP90-01208R0001002...
If you're afraid about directional microphones out in the woods there are countermeasures for that too, but security is very possible even against the very most well-funded attackers.
Furthermore, I don't think even internet-connected secure computers are so hard that they can't be built. Limit what you do, so that you can write the program short enough that you can afford to have theoretical guarantees-- maybe write it to run on a computer with Harvard architecture to avoid buffer overflows, and you can probably build one on an FPGA, even as a hobbyist.
State attackers aren't magic.
Also, if you really keep it short, you can always check that he hasn't by reading it. You could also just never update it, and it let become ancient and well-tested.
Lots of body shop contractors are fake people anyway. Pretty easy to imagine placing a compromised person in a low sensitivity area, then moving laterally.
Furthermore, surely it would just be one guy who knows OS and FPGA stuff and another guy to check it?
What I'm arguing for is that a sensible solution to security problems is to avoid complexity, so that things can be obviously secure.
Carefully defined interfaces designed to be clear, impossible to misinterpret and which are designed to be parsed and implemented without doing anything requiring some kind of fiddly parsing that can lead difficulties, and small enough that someone can implement them in an afternoon; and then you combine that with a machine inherently robust to things like buffer overflows such as Harvard architecture type things, and it's easy even for a single engineer to program something like that up on an FPGA.
You hire them for other lower priority roles, but they are inside the firewall. Most large organizations have an immature zero trust environment.
Look at the Microsoft PKI breach. The adversary was able to compromise certificate services in a corporate dev environment and parlay that in accessing US government mailboxes in a supposedly isolated cloud tenant. Microsoft has a world class security practice. The average Fortune 1000 is toast.
When you read the report, it was very clear that Microsoft wasn't doing "World Class Security Practice", they were taking shortcuts like everyone else does.
Their software is huge, with all sorts of things integrated into it and no focus at all on keeping the software small enough that one person can read it through with such care that it can be assured to be secure.
They probably run their cloud stuff on processors that can reorder instructions and all sorts of things, whereas what I'm arguing for is simple computers, things that can run a text-only search engine and where the text editor is substantially simpler than nano.
Where you decide exactly what your requirements are and make a system which solves that problem and nothing else.
Used to think the Chinese were paranoid with their bans on iPhones and Tesla's...
I've always seen it as pretty strange to carry around other people's computers or using external services-- so I've always seen things like phones, Google Maps, etc. as things that it is strange that any country that isn't the US allows people to use.
I don't think one absolutely needs to make everything oneself, but I can't imagine that it's sensible that everybody use external services, so that so much information ends up in one place.
In any case as in all things defense, you assume your adversary is to some extent rational and making attacks harder (more expensive, risky, opportunity cost, etc) improves the equation for you.
And then you’ve got Stuxnet, which both clearly involved many more people than that, but also actual physical espionage.
So make them spend that money.
Or, more likely, convince them to refocus on a cheaper target.
it is quite plausible that the target was a nation state sponsored entity, so fair game? its not like they did this to a local fish n chips shop
If basic security is not implemented, you have bigger problems. (backdoors in Cisco, Fortinet, Palo Alto Networks, skipping tests - Cloudstrike)
You are outgunned.
> Upon examining those logs, Volexity found that in January and February, password-spray attacks had been carried out against this service and three accounts had been successfully compromised by an attacker.
> ...
> The Enterprise Wi-Fi network, however, did not require MFA and only required a user's valid domain username and password to authenticate
> ...
> While the Guest Wi-Fi network had been believed to be completely isolated from the corporate wired network, where the high-value targeted data resided, there was one system that was accessible from both the Wi-Fi network and the corporate wired network.
Bad passwords, no certificate based network authentication or MFA, bad network separation. Basic stuff.
[1] https://www.volexity.com/blog/2024/11/22/the-nearest-neighbo...
(This should have been the referenced page IMHO.)
Do you leave your door unlocked, because "if your threat model involves crowbars, you are outgunned"?
Ironic that this comment was posted (yet again), because this time it seems like the hackers used the same "guns" as everyone else.
What's interesting is that wifi is so hackable, when anyone with any cryptography knowledge knows that it needn't be. But it seems to me that we're all using less-than-secure locks so that the "good guys" can get in if needed.