23 April 2023

CYBOK (Rashid et al. 2021) 提到了系统攻击者的攻击行为的特点时,这么写的:

It is reasonable to assume that the same actors will follow a similar modus operandi in their attacks, and in particular will use the same software exploits to break into their victims’ systems.

这里modus operandi的意思是“特殊做法”、作案手段。这个词本来是拉丁语中“操作方法”的意思。modus 是方法,operandi 是操作。合起来是操作方法。但是,在英语里,这个普普通通的操作方法有了特殊做法的意思。

这就好像,我们古文中说的“道术”,道就是规律、道理。术就是技术、方法。合起来其实就是操作方法的意思吧。但是,因为有了历史的沉淀,道术的意思就很微妙,是一种带有阴谋论的政治权术操控方法论。

OT:ICEFALL (LABS 2022) 探寻了很多 OT 技术中的不安全漏洞,提到:Abusing insecure-by-design native capabilities of OT equipment is the preferred modus operandi of real-world ICS attackers. OT 设备本身的不安全设计成了 ICS 攻击者经常利用来进行攻击的作案手段。

与 modus 相关单词还有比如 incommode 添麻烦,比如 We do not ask others to be faultless, we only ask their faults should not incommode to our own. 我们不要求他人完美无缺,我们只要求他们的缺陷不会妨碍我们。

commodious 宽敞的,方便的。比如 A stop-gap measure merely serves as a commodious addition to some short-sighted result-driven politicians. 一项权宜之计只是为一些目光短浅、以结果为导向的政客提供了方便。

References

LABS, VEDERE. 2022. “OT:ICEFALL - the Legacy of ‘Insecure by Design’ and Its Implications for Certifications and Risk Management.” Forescout Technologies, Inc.
Rashid, Awais, Howard Chivers, Emil Lupu, Andrew Martin, and Steve Schneider. 2021. The Cyber Security Body of Knowledge.