[Dailydave] Shamoon && the Iranian nation-state team

[Haroon Meer]

Heya(s)

On Mon, Sep 10, 2012 at 7:54 PM, Dave Aitel <dave at immunityinc.com> wrote:
> I've read some of the analysis of it, and I think the story is a bit more
> interesting (depending on your perspective) than the one people appear to be
> writing about

Agree completely..

> I think it's clear that the Iranian nation-state team is == "Cutting Sword
> of Justice". It doesn't take a Palantir-loaded analyst super-hero to see
> that they are sending the message of "you attack our oil industry, and we
> will attack yours". They've stopped short of doing anything that would
> actually damage operations at Saudi Aramco, because that's a red line, but
> they've demonstrated capability, which is all you need for the "mutual" part
> of "mutually assured disruption".

Hmm.. Theres a lot of certainty here (on a pretty uncertain thing.)

If you consider that the attack would have scared the Saudis, but not
crossed "the red line", then you have to consider that the attack
could well have come from one of its allies? Maybe one with a huge
military-digital complex that is looking for other markets? Maybe the
conclusion we are all supposed to jump to is: "you really ought to let
your friends step in to help you"

> The interesting corollary is that not only do you have to extend your information security
> umbrella over your own private industry, you have to extend it over your
> allies as well...:>

oh..

The 3 (other) interesting things to note here are:
- The Iranians didn't really need to prove capability by taking out
Aramco. I mean.. they (seem to have) captured a drone in flight and
certainly have allies of their own with proven capability;
- The people who need to know opposing teams capabilities, probably
dont need to learn it from headline stealing attacks;
- Attribution.. maybe its not that easy after all ;>

/mh

-- 
Haroon Meer | Thinkst Applied Research
http://thinkst.com/pgp/haroon.txt
Tel: +27 83 786 6637