1

Consider the following:

An advanced adversary is targeting you. He has the ability to watch most if not all of your network connections and the ones in the neighbourhood. He is sitting on numerous zero days. He can also follow you physically to whereever he wants and knows generally a lot about you and your habits.

You could of course try to buy new hardware, install some IDS but why? Since you're possibly surveilled all the time it is hard to securely bootstrap a system. You maybe can lower the risk here and there a bit but ultimately you wont approach the security level you like to have. (At least I don't). It would also be hard to get a baseline of what would be considered normal network traffic or application behaviour. In contrast, you would risk even more compromise, waste resources, ...

Is their any point in changing your behaviour? Since they already hacked your system(s) it does not really matter if they do so again. So, what to do? Read a book, get some games to play (offline), join the Foreign Legion?

  • You have to state your threat model before this even becomes remotely answerable. Generally, you'd have to suffer through some restrictions in how you use electronics. Deliver information by passing a physical flash drive rather than sending an email (even encrypted, if you assume a GnuPG 0day), for example. – forest Apr 23 '19 at 11:17
  • Advanced adversaries do not target one just because they have too much time and money to spend. They have a specific goal, like stealing information etc. What you need to do depends on what there goal is - for example by making all the sensitive information unreachable. – Steffen Ullrich Apr 23 '19 at 11:18
  • What would you be trying to prevent? If they're doing it "just because they can" then I don't think there's much to worry about. If they have some malicious intent, then it becomes a much different question. – Torin Apr 23 '19 at 11:18
  • "Advanced adversaries do not target one just because they have too much time and money to spend." Citation needed. Of course the attacker has some kind of motivation. However, it is not always possible to change something on your side to the extend that it would make sense or be secure enough. – hangingandchilling Apr 23 '19 at 11:26
  • I would need to know when the attacker has what he wants or gives up. This is hard to know, hence I always assume the worst. @forest "Deliver information by passing a physical flash drive rather than sending an email (even encrypted, if you assume a GnuPG 0day), for example." Pointless if they could get the data possibly by stealing the stick. – hangingandchilling Apr 23 '19 at 11:33

Browse other questions tagged or ask your own question.