This is a great perspective but it's important to remember your sample bias -- you're only making judgments about the offender you've identified. Or more snarkily, you've only caught the people dumber than you.

When you're talking about basic attacks to steal some money, this is a substantial but not world-changing effect. On the other hand, a government or cartel willing to invest significant resources in cyber offense can really move the needle. What we've seen Russia, North Korea, Israel, and others achieve is probably only a fraction of what they've actually achieved.

Yes, but they don't put their crack team on most stuff.

Have you read the Snowden leaks? The actual raw content?

It's pretty tame shit. My main takeaway was ahh, yes the world is as insecure as I thought it was not oh, these guys are using space laser technology hacks.

They've got crack teams to break into some harder gear, and they've got some crazy awesome cryptanalyses going on, but for most of it it's just what you were I would do if someone asked us to get into a bank or whatever. Most stuff is easy to hack anyway unless it's a fully patched iPhone or patched / stripped / locked down Windows server.

Plus you can see the codebases these guys have put out anyway. There was that peodophile CIA coder that had some of his personal codebase match his internal work and there are a bunch of current and former NSA / CSE guys floating around conferences.

I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack.

They're not gods shimon.

> I sat with a whole table of them and watched them fall for a simple social engineering attack one minute after being told they were going to fall for the attack.

Story time?

I mean it isn't that interesting of a story, really.[-1]

And I want to stress I'm not a full time government contractor. I just did a couple short contracts for a department and it made me wtf so hard I signed up for one of those conferences where they set the ticket price so high it keeps out the curious[0], but it isn't classified or even protected.

But I'll share anyway because you asked.

I walk into the room titled "something something Social Engineering Attacks" because the other one was on something I couldn't care less about. Fiddling with AWS settings probably.

Look around. Mostly tired, overworked looking sysadmins from different government departments and the occasional consulting company or bank.

Walk further into the room and there it is, a table full of my people. Dungeons and dragons (D&D) looking types of both genders that looked like they were born in or around 1984.

Sit down. "Hi." They're friendly; I forget what we talk about, but they all have sigint department name tags. Most were slated to give talks later in the conference.

Talk starts. Guy on stage.

Guy: "Within one minute of explaining what I'm going to socially engineer you to do you will do it."

Me: Internal monologue; The fuck you will.

D&D: Look kinda intrigued, kinda befuddled.

Guy: "Ok so first thing we need to do is to get you to stand up. Don't worry the clock hasn't started yet. We're just standing."

Me: Squints skeptically. Stands. Internal monologue: Where the hell is this going?

D&D: Stands up like the rest of the room, faces guy.

Guy: "Ok here is the game I'm going to get you to flip your hands like this."

Guy: Flips hands from palms down to palms up.

Me: Internal monologue: The fuck you are.

Me: Crosses arms.

D&D & Room: Chuckle.

Guy: "Ok, you ready? Go. Oh; one last thing..."

Me: Internal monologue: Ha! Good fucking luck buddy you already said "go" and I'm already crossed.

Guy: "...otherwise there is no game at all you'll just cross your arms and stand there. So you have to put your arms in front of you like this..."

Guy: Begins to slowly raise his arms.

D&D & Room: Begin to raise their arms so their palms are face down to the ground.

Guy: "... like this."

Guy: Shows arms out in-front of him with the palms face up.

Me (Quietly, to my table of future elf and dwarven partisans.): "Nooo. Don't do it."

D&D & Room: Flip their hands over to match guy.[2]

D&D: Look away from guy to me.

Guy: Does the TA-DA gesture.

Room: Laughs.

D&D: "How did you know?"

Me: "I know how these people think."

Rest of the conference people were convinced I was a Canadian spy or something. It's ok though. I got too drunk and made a fool of myself because a convo I had with a cyberwarfare guy (essentially) confirmed my fears that self-driving cars were WMDs due to class-attack (bad server update ala notPetya, say).

Gunna be feeling the burning shame on that one for at least another year.

Whatever.

At least all that foolishness is over. I thought I was losing my mind. Now that Schneier's book is out and it's been almost a year I'm back to being able to trust my own mind again. The cybersec scene is kinda stressful, but it's nothing compared to the kind of stress where you can't trust your own mind.

[-1] Well it wasn't going to be, so I spiced it up a bit by expanding into my failings as a human.

[0] Well most of the time, anyway. Can't stop me from lolsing into a conference to get a better read on where things are at.

[1] Memory isn't perfect, but you get the idea.

[2] Room of 100 people and I'm almost certain I was the only one that didn't get tricked.

There are some interesting social pressure group dynamics at play (e.g. go out in public and start staring at the sky and a people will start trying to see what you are looking at and glance at the sky-- literally monkey see monkey do?)

If somebody's staring at the sky, either there's something interesting to look at or they're nuts, and I like to give people the benefit of the doubt by not assuming the latter.

VPN?