News for hackers. Stuff that matters.

A comment on Operation Triangulation: What You Get When Attack iPhones of Researchers. Parent comment

Re:Operation Triangulation: What You Get When Attack iPhones... by malfist on Wednesday December 27, 2023 @03:17PM (#38786182)
> But the really suspicious thing is the hash. What kind of hardware interface does arbitrary DMA protected by a secret but weak hash function? Is there any legitimate usage for such a thing? I've never heard of such an interface before.

Never attribute to malice that which can be attributed to incompetence. There are plenty of examples in the wild of going halfway with strong security, but halfway still leaves the barn door open.

[ Parent | on HN ]
Re:Operation Triangulation: What You Get When Attack iPhones... by joe_the_user on Wednesday December 27, 2023 @04:50PM (#38787198)
Never attribute to malice that which can be attributed to incompetence. There are plenty of examples in the wild of going halfway with strong security, but halfway still leaves the barn door open.

That rule should only be applied in the normal world. The world of security where you know bad actors are out there trying to do stuff, it doesn't apply. And there are examples of spy types injecting plans to go halfway with security for their purposes - not that this proves the origin of a given plan, incompetence is still one possibility, it just returns to original point, that this stuff is mysterious.

[ Parent | on HN ]
Re:Operation Triangulation: What You Get When Attack iPhones... by chatmasta on Wednesday December 27, 2023 @06:00PM (#38787926)
As a defender, you should treat malice and incompetence as functionally equivalent. Save the attribution for the post-mortem (or better yet, don't let it come to that).
[ Parent | on HN ]