Multiple Nation-State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475

Re:Multiple Nation-State Threat Actors Exploit CVE-2022-4796... by dragonwriter on Thursday September 07, 2023 @06:13PM (#37426342)

Nation-state has a few different uses, the most common of which seems to be exactly what is correctly used here, the principal soveriegn subjects of international law under the Westphalian system (these are typically know in international law as simply “states” but outside of documents of a clearly international-law character, that is easily conflated with other meanings of “state”, especially in places like the US where that term is typically used for subordinate entities.)

Weird pedants want to insist that the only proper use of the term is for states in the international law sense whuch are coextensive with nations in the sociological sense, which was somewhat normalized as an ideal, particularly in Europe, compared to the status quo ante by the Westphalian system, which both sonewhat aligned states with nations and resulted in states where working to reshape national identity around their own citizenry. But this sense is a pure unrealized ideal: there is essentially nothing which is actually a nation-state in this sense, though its a common aspirations, with nations without states seeking to form states and states without nations seeking to build national identities, and nations that roughly correspond to states, or vice versa, trying to round out the edges (sometimes via building more inclusive national identities, sometimes via ethnic cleansing) — but its only ever at best aoproximate and always in flux.

[ Parent | on HN ]

Re:Multiple Nation-State Threat Actors Exploit CVE-2022-4796... by tptacek on Thursday September 07, 2023 @07:28PM (#37427115)

Whatever else is going on with terms like "nation-state", there's some creepy politics behind the notion that countries are generally nations. I'm fine with the idea that "nation-states" don't generally exist. The word "state" in "state-level actor" is unambiguous.

[ Parent | on HN ]

Re:Multiple Nation-State Threat Actors Exploit CVE-2022-4796... by dragonwriter on Thursday September 07, 2023 @07:33PM (#37427158)

Honestly, with or without “nation-”, “state-level actor” is a useless phrase, because (other than juridically), “state” isn't a level of an actor (particularly, it isn’t a capability level.)

If you mean a “major regional power”-level actor, or a “global superpower”-level actor, then say that, but a category that includes both the United States of America and Tuvalu isn't communicating a coherent capability level in any domain.

[ Parent | on HN ]

Re:Multiple Nation-State Threat Actors Exploit CVE-2022-4796... by tptacek on Thursday September 07, 2023 @07:43PM (#37427251)

Global superpower gets the dynamics exactly backwards. Another hobbyhorse of mine: Belize could be a major player in these kinds of threats if they wanted to be. At the scale of sovereign states, none of this is real money.

[ Parent | on HN ]

Re:Multiple Nation-State Threat Actors Exploit CVE-2022-4796... by hollerith on Monday September 11, 2023 @12:12AM (#37462787)

>“state-level actor” is a useless phrase

I disagree.

Google can probably outspend the Israeli government, but the Israeli government has capabilities Google will never acquire because Google's control over its employees is limited (mainly to contract law). Google cannot sentence an employee to decades in prison for betraying Google's secrets.

So for example, it turns out that 1 or 2 of the employees of the Manhattan Project betrayed the project by giving nuclear secrets to the Soviet Union, but at least the US government had a realistic chance of keeping secrets there whereas a private corporation embarking on a project of similar scale (i.e., a similar number of employees with similar levels of knowledge and skill) has no realistic hope of doing so.

I think this argument is relevant to computer security because having an exploit is almost completely useless if the entity you hope to use the exploit against knows you have the exploit.

[ Parent | on HN ]