<div dir="ltr">I don't think that the "avoid all systems with HIPS" had anything to do with being sufficiently advanced. That looked like a decision to avoid complexity because the people following that decision tree weren't skilled enough to handle attacking those systems and the default toolset wasn't designed to handle evasion on those systems.<br>
<br>I have no doubt that the NSA has all the tools necessary to exploit or evade HIPS but this doesn't look like evidence of it. Using your framing, this looks like "what we are doing is so sensitive and questionable and high risk that it is better to ignore targets we are even a little bit queasy about rather than risk detection". That's avoiding consequences, not being amazingly bad-ass.<br>
<br>toby<br></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Mar 11, 2014 at 6:41 AM, Dave Aitel <span dir="ltr"><<a href="mailto:dave@immunityinc.com" target="_blank">dave@immunityinc.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
So the thing about being advanced enough is that you don't really
have to be persistent in any normal sense of the word. Nobody has
pointed out how the first stage of the NSA shellcode (as leaked by
"backgrounded by the Constitution and definitely not at all a
narcissist" Snowden) just avoids executing anything on systems
protected by HIPS. Imagine if you were so good at your job you could
ignore targets you already had execution on if you felt even a <i>little
bit</i> queasy about their defense. <br>
<br>
Look, Richard Beitlitch <a href="http://taosecurity.blogspot.com/2014/02/the-limits-of-tool-and-tactics-centric.html" target="_blank">thinks
I don't know anything about "Strategy"</a>. This may be true! But
on the other hand, sometimes just <a href="https://www.youtube.com/watch?v=G02FiZNbZHY" target="_blank">outshooting
your opponent</a> everywhere you engage them is a pretty decent
strategy. And that comes down to "Tools, Tactics and Procedures" on
the ground. Speaking of which - INNUENDO is going to be 1.0 Beta
today because I can't find any more bugs in it. :><span class="HOEnZb"><font color="#888888"><br>
<br>
-dave<br>
<br>
</font></span></div>
<br>_______________________________________________<br>
Dailydave mailing list<br>
<a href="mailto:Dailydave@lists.immunityinc.com">Dailydave@lists.immunityinc.com</a><br>
<a href="https://lists.immunityinc.com/mailman/listinfo/dailydave" target="_blank">https://lists.immunityinc.com/mailman/listinfo/dailydave</a><br>
<br></blockquote></div><br></div>