A researcher’s tale of defeating traps, tricks, and complex virtual machines
I feel like this gets at something that you don't really hear talked about much, namely: we, as an industry, have for a very long time assumed when thinking about how to secure our products that the attackers those products would face would be either low-skill amateurs ("script kiddies") or, at worst, small gangs of professional criminals. But more and more we're seeing a new class of attacker, actual nation-states (and their associated intelligence services), who can bring resources and expertise to bear that those other attackers could only dream of. Which means they can open up defenses that were more than sufficient against the attackers of the past like soft fruit.That's a big change, and I don't know that most developers have even started to grapple with what it means for the products we build and the way we build them.