I wonder if there's a bet to be made on future 8K disclosures following quietly updated signing keys. A bet against F5 placed this morning would've only made 3.6%.

> I keep seeing it pop up again and again and it only makes sense in that context.

Not saying that these companies would turn down corporate welfare given the chance, but I’ll offer an alternative explanation: it shifts accountability away from the company by positing a highly resourced attacker the company could not reasonably be expected to protect against.

If you have a physical security program that you’ve spent millions of dollars on, and a random drug addict breaks in and steals your deepest corporate secrets people are going to ask questions.

If a foreign spy does the same, you have a bit more room to claim there’s nothing you could have done to prevent the theft.

I’ve seen a bunch of incident response reports over the years. It is extremely common for IR vendors to claim that an attack has some hallmark or another of a nation-state actor. While these reports get used to fund the security program, I always read those statements as a “get out of jail free” card for the CISOs who got popped.

> Something about this statement screams that companies are setting themselves up for free money from big old gov'ment welfare titties.

From the published CISA mitigation[0]:

  A nation-state affiliated cyber threat actor has 
  compromised F5’s systems and exfiltrated files, which 
  included a portion of its BIG-IP source code and 
  vulnerability information. The threat actor’s access to 
  F5’s proprietary source code could provide that threat 
  actor with a technical advantage to exploit F5 devices and 
  software. 

Or maybe it is a responsible vulnerability disclosure whose impact is described thusly[0]:

  This cyber threat actor presents an imminent threat to 
  federal networks using F5 devices and software. Successful 
  exploitation of the impacted F5 products could enable a 
  threat actor to access embedded credentials and Application 
  Programming Interface (API) keys, move laterally within an 
  organization’s network, exfiltrate data, and establish 
  persistent system access. This could potentially lead to a 
  full compromise of target information systems.

This is a mean-spirited interpretation of what happens when you claim nation state.

Generally the government (as of now) is not paying private (but maybe some Critical Infrastructure companies) companies to secure things. We are in the very early stages of figuring out how to hold companies accountable for security breaches, and part of that is figuring out if they should have stopped it.

A lot of that comes down to a few principles:

* How resourced is the defender versus the attacker? * Who was the attacker (attribution matters - (shoutout @ImposeCost on Twitter/X) * Was the victim of the attack performing all reasonable steps to show the cause wasn't some form of gross negligence.

Nation state attacker jobs aren't particularly different from many software shops.

* You have teams of engineers/analysts whose job it is to analyze nearly every piece of software under the sun and find vulnerabilities.

* You have teams whose job it is to build the infrastructure and tooling necessary to run operations

* You have teams whose job it is to turn vulnerabilities into exploits and payloads to be deployed along that infrastructure

* You have teams of people whose job it is to be hands on keyboard running the operation(s)

Depending on the victim organization, if a top-tier country wants what you have, they are going to get it and you'll probably never know.

F5 is, at least by q2 revenue[0], we very profitable, well resourced company that has seen some things and been victims of some high profile attacks and vulns over the years. It's likely that they were still outmatched because there's been a team of people who found a weakness and exploited it.

When they use verbage like nation-state, it's to give a signal that they were doing most/all the right things and they got popped. The relevant government officials already know what happened, this is a signal to the market that they did what they were supposed to and aren't negligent.

[0] -https://www.f5.com/company/news/press-releases/earnings-q2-f...

If there was some government program I was previously unaware of that pays organizations that were compromised by nation state hackers then I’m going to be upgrading all my networking infrastructure to F5 products and start reading up on BIG-IP migrations.

That is to say, sometimes nation state hackers _were_ behind the compromise. F5 is a very believable and logical target for such groups.

Is there an example of a company getting money from the government in response to a statement like this?

Nation-states sponsored hackers make up a huge amount of known targeted intrusion groups. This is not some random company tilting at windmills, these are real threats that hit American and American-aligned companies daily.

There's huge incentive for nation-state level actors to recruit, train and spend oodles on extremely sophisticated hacking programs with little legal oversight and basically endless resources. I have no idea why you're incredulous about this.

If I were running a country practically my highest priority would be cyberattacks and defense. The ability to arbitrarily penetrate even any corporate network, let alone military network, is basically infinite free IP.

This report seems empty of useful information. It’s just “contact us under these circumstances”.

Is it just me?

They say the attacker exfiltrated data, including source code.

They claim the vulnerabilities discovered through the exfiltration were not used though.

Even if it was actually an honest to god nation-state I can't see why security circles get hyperfixated on the term. Does it really matter at all if it's a nation, state, or nation-state? Of course not, but "nation-state" sounds really cool so that's the go to, even when it's not actually a nation-state.

BIG-IP runs DPI (not as good as Sandvine Active Logic), but it's an authoritarian states best friend. Want to compromise another nation state that runs all their traffic through it? These vulns aren't a bad place to start...

Often it can be like that. This a case where the kind of attacker seems highly relevant, though. Imagine a group like Shiny Hunters were the ones to steal these vulns from F5, you'd know if they hit your F5s because they'd have already dumped all your databases and bragged about it. The attacker being a "nation-state" warrants a more careful investigation of historical activity if you're the kind of organization that gets targeted by espionage motivated attacks.

BRB, changing handle to 'nation-state'. Need the resume fodder.

This def seems like corpo disaster PR copy. Not the kind of content I expected and love HN for

Nation-state actors do this kind of stuff all the time, and they're difficult to defend against because they tend to be well-funded and therefore able to hire talent, have resources, and spend money on intelligence and 0days. And they're immune from prosecution unless they're stupid enough to travel to a hostile state.

North Korea really does spend a lot of money on this, and so does Russia and China. And US and Israel, for that matter.

I mean the traffic came from a nation soo it must be

Yes, i raise my eyebrow too. "F5 is a Fortune 500 tech giant specializing in cybersecurity" and "the attackers had gained long-term access to its system" doesn't seem to agree with each other.

I mean, because it depends where the attack happened. Working with large companies like this in CI/CD there are a number of tools that the source code gets checked on, but not fed back into the system that could have been the source of the attack.

The NCC attestation letter is wild:

F5, Inc. (“F5”) engaged NCC Group to perform (i) a security assessment of critical F5 software source code, including critical software components of the BIG-IP product, as provided by F5, and (ii) a review of portions of the software development build pipeline related to the same, and designated as critical by F5 (collectively, the “In-Scope Items”). NCC Group’s assessment included a source code security review by 76 consultants over a total of 551 person-days of effort.

Wonder what the bill was?

> highly sophisticated nation-state threat actor

Sure thing. It's so hard not to hate this PR stuff when they can't even be a tiny bit humble. "The hackers were so sophisticated and organized, we didn't even have a change! They could've hacked everyone!"

> In response to this incident, we are taking proactive measures to protect our customers

Such as, fixing the bugs or the structural problems that led to you being hacked and leaking information about even more bugs that you left undisclosed and just postponed to fix it? This wording sounds like they're now going the extra mile to protect their customers and makes it sound like a good thing, when keeping your systems secure and fixing known bugs should've been the first meters they should've gone.

Just be honest, you fucked up twice. It's shit, but it happens. I just hate PR.

Yeah, I was trying to make sense of what was described here.

Is it that (through some mechanism) an actor gained access to F5's sytems, and literally found undisclosed vulnerabilities documented within F5's source control / documentation that affects F5's products?

If so, lol.