Reply to thread

Message

<blockquote data-quote="bazang" data-source="post: 1113915" data-attributes="member: 114717">SUA compromise almost always involves a threat agent targeting a business or organization.UAC can be bypassed on SUA; SUA and UAC are just a speed bump along the threat agent&#039;s path to persistence and lateral/vertical pivoting, and ultimate pwn.Combined/integrated with/packaged with the right exploit or chain of exploits, it could be 100% hidden, virtually undetectable remote code execution and nobody would be the wiser. While you were blissfully using your SpyNetGirl protected SUA, the enemy is within your system and hard at work stealing data, performing reconnaissance, inventorying what is on the network, and exploring pivots.This is the stuff that 5 million and 10 million Euro exploits are made of. Typically, it is nations that are interested and willing to pay for this class of exploits. However, lately, the drug cartels and terrorist organizations have been actively marketing that they are buying and willing to pay. Just think - drug cartels have more money than some countries&#039; total national operating budgets.It is a waste of time to think or worry about this sort of stuff unless you are a political or ideological dissident and you are targeted by nation-state threat agents. If you are a political or ideological dissident, then my advice is &quot;Don&#039;t do that.&quot; Best way to not become a target.</blockquote>

[QUOTE="bazang, post: 1113915, member: 114717"] SUA compromise almost always involves a threat agent targeting a business or organization. UAC can be bypassed on SUA; SUA and UAC are just a speed bump along the threat agent's path to persistence and lateral/vertical pivoting, and ultimate pwn. Combined/integrated with/packaged with the right exploit or chain of exploits, it could be 100% hidden, virtually undetectable remote code execution and nobody would be the wiser. While you were blissfully using your SpyNetGirl protected SUA, the enemy is within your system and hard at work stealing data, performing reconnaissance, inventorying what is on the network, and exploring pivots. This is the stuff that 5 million and 10 million Euro exploits are made of. Typically, it is nations that are interested and willing to pay for this class of exploits. However, lately, the drug cartels and terrorist organizations have been actively marketing that they are buying and willing to pay. Just think - drug cartels have more money than some countries' total national operating budgets. It is a waste of time to think or worry about this sort of stuff unless you are a political or ideological dissident and you are targeted by nation-state threat agents. If you are a political or ideological dissident, then my advice is "Don't do that." Best way to not become a target. [/QUOTE]

Verification