,
10 tweets,
3 min read
Read on Twitter
This story is typical garbage. There was no sophistication to Conficker. Hyping sophistication is a media trope.
nytimes.com/2019/06/29/opi…
nytimes.com/2019/06/29/opi…
The most sophisticated thing was the discovery of the vulnerability, which white-hat security researchers did, not the black-hats who wrote Conficker.
The next most sophisticated thing was the writing of an exploit, which white-hat security researchers did, not black-hats.
The next most sophisticated thing was the writing of an exploit, which white-hat security researchers did, not black-hats.
Nope nope nope nope. These encryption algorithms weren't "worlds ahead of most". Moreover, it takes no effort at all to copy/paste such encryption algorithms in your code. 
Yes, Rivest is really smart, as demonstrated by his lifetime's work. But that doesn't mean hackers using his algorithm are smart. I can quote Einstein. That doesn't mean I'm as smart as Einstein.
I are smart!
Here's the RC4 algorithm on GitHub. Posting this doesn't mean I'm smart or a sophisticated hacker.
gist.github.com/rverton/a44fc8…
gist.github.com/rverton/a44fc8…
Conficker spread because there are a lot of unpatched Microsoft Windows out there. It's an aspect of the vulnerability, not a feature of the worm. The worm writers have little control over how well their worms will spread.
Why do tornados keep hitting trailer parks? What about swirling air makes to target trailer homes?
The answer is that trailer homes are more damaged by tornados, not that tornados are targeting them. It's the vuln, not the attacker.
The answer is that trailer homes are more damaged by tornados, not that tornados are targeting them. It's the vuln, not the attacker.
When a new Windows exploit is published, hackers can just plug it into their existing code to make a worm. That's what happened with Conficker. That's what happened with WannaCry. There's no sophistication going on, it's mindless.
This is a good point. The writers of Conficker weren't necessarily tyros, either. They were certainly up on the latest developments created by others, like their DNS trickers, or the latest MD6 proposal. It's just that they didn't create any of them.
