The Nation State Actor Ate My Homework!
summary
Leaked toolsets from Shadow Brokers, WikiLeaks and Snowden show nation-state capabilities like zero days and firmware implants and Tempest EM collection are reproducible by smaller actors; attackers reuse OS calls, build modular implants (swap payloads, exfil modules) and exploit DLL search paths to gain persistence. Case studies include long SWIFT intrusions spanning >12 months, hardware firmware reverse‑engineering, cheap kit (Raspberry Pi, ESP8266, retroreflectors) lowering costs, and deliberate false artifacts for misattribution and anti‑forensics. Defenses focus on network monitoring, firmware checksums and compartmentalisation.
AI-written summary · about
chapters (25)
- 0:00Intro
- 0:12About me
- 0:42About the Research
- 4:13Key areas
- 4:49Original focus
- 5:17Why Nation state actors
- 6:29Why Zero Days
- 7:14Analogy
- 7:31Problem Context 2
- 10:34Attacker Techniques
- 14:33Defender Tactics 1
- 15:15Attackers Respect
- 17:32Defender Tactics 2
- 18:42Lessons Learned 1
- 19:42Lessons Learned 2
- 25:12Interesting Observations
- 27:07Mis attribution
- 29:26Overt
- 30:16Anatomy of a hack
- 30:59SWIFT Network Intrusions 5&6
- 34:19Hack all the things
- 35:15Inherent exploitability
- 37:46Processes
- 38:05Closing thoughts
- 38:36Thank you
related talks
26mTechnical Tracks
07mEntrevista
47mThe Blurred Lines between Cybercrime and Statecraft
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
40mThe Last Remaining Cover for Action
55mGovernments As Malware Authors: The Next Generation
43mBecoming a Dark Knight: Adversary Emulation Demonstration for ATT&CK Evaluations
49mConducting a Successful False Flag Cyber Operation (Blame it on China)