[Opinion] No, the US gov't did not plant malware in Russian critical infrastructure systems

I've read some news today that the US government is bragging about having put malware in Russian critical infrastructure systems in preparation to launch cyberwarfare attacks against Russia. This is, in my opinion, self-refuting garbage, and I'll explain why.

I do not consider myself to be an expert on cyber security; however, I know a thing or two, and if I were to really, seriously set myself to hacking a target, it would be a matter of when, not if. So I certainly know enough to say that the most fundamental principle of hacking is that, once you've compromised some target, you simply. do. not. tell the target that you've compromised them.

This isn't just some 1337 hacker tradition, either; it's because once your target knows they've been compromised, you've lost the majority of your advantage in having compromised them. If the target takes the threat seriously (and ask yourself, dear reader, will Russia take this seriously?), they will begin looking for and removing the malicious implants in their systems. This is a bit of a crapshoot, so more importantly they'll begin creating and implementing redundancies and fall-backs so that if their main systems fail, secondary systems which are less vulnerable to cyberattack will fall in to pick up the slack.

Furthermore, since this is state-level bickering, we must examine it from a political perspective as well as a technical one. If the US government really had successfully implanted malicious daemons into Russian infrastructure, and for some absurd reason they actually did want Russia to know about it, they would quietly leak it to Russian intelligence; not broadcast it from the rooftops. Since they've published it in the news, the Russian people will be aware of the threat, and thus the Russian government will be able to carry out preparations and mitigations in the light of day, and with the people's support, making their response much faster. People will be more willing to accept interruptions in service and inconveniences when they understand that it's due to preventing a real threat of US-government-sponsored cyberterrorism.

The Russian people will also be prepared to enact fallback plans in case of critical infrastructure failures. This is of utmost import, because if they already have a plan in place, and are psychologically prepared to enact it, this does little to disrupt their lives until an attack takes place, but if an attack does occur, they'll be ready to carry on as best they can, without fear. They'll be pissed off, for sure, but they won't be crippled by fear. This will make them a more dangerous adversary. The purpose of any attack, cyber or otherwise, is to make the adversary less dangerous. So if the threat is real, the US government just shot themselves in the foot, then handed Russia the gun.

Finally, let's recall the fact that the deep state has been desperately trying to start world war three for quite a while now, and is resorting to increasingly pitiful ploys to spark conflict. In light of this fact, it seems far more likely that the 'malware in Russian computers' bit is nothing more than a bluff, yet another feeble attempt to build animosity between the Russian and US governments in hopes that the Russian government will escalate. After all, as we have seen, the only value of the notion that the US government has malware lying in wait in Russian systems is as a bluff. If it were really true, it would have negative value for the US to publicize it.

Of course, this is just my opinion, and others may have information I don't have which changes the landscape. If you are such a person, please do let us know your thoughts in the comments!

Thanks for reading!

---

With a background in software development and a passion for security, Nathan has identified blockchain technology as his niche. He is dedicated to creating applications which empower individuals to shape a better world for themselves and others.

Note to @cheetah, et al.: I published a comment substantially similar to this post on a Free Thought Project news article. I am the author of both posts, and no content was plagiarized.