News for hackers. Stuff that matters.

A comment on Thousands of computers now compromised with leaked NSA tools, researchers say. Parent comment

Re:Thousands of computers now compromised with leaked NSA to... by whatshisface on Sunday April 23, 2017 @07:10PM (#14180952)
>3. Create detection signatures for the exploit to run against Upstream collected internet communications.

Yes, it's a good thing that very illegal cyberattacks are never done over encrypted channels. To catch the once-in-a-blue-moon hacker who has their bots log in to the mothership with ssh or something, we could just go ahead and let the government write ring-0 antivirus for us.

[ Parent | on HN ]
Re:Thousands of computers now compromised with leaked NSA to... by willstrafach on Sunday April 23, 2017 @07:45PM (#14181072)
I think you understand that my comment was phrased generically so that the logic applies to multiple scenarios (not just this one).
[ Parent | on HN ]
Re:Thousands of computers now compromised with leaked NSA to... by whatshisface on Sunday April 23, 2017 @07:58PM (#14181106)
The only signatures that could ever appear in the open would be from, very specifically, attacks on encryption implementations during startup (heartbleed attacked keepalive for example, so no help there). The attack surface of the application itself will always lie entirely behind the no-visiblity line.
[ Parent | on HN ]