Exploits, Defeated

The arsenal's one dependency

The most desirable cyber weapons in the world right now are not prized for how they get in. They are prized for what they are worth once inside: a complete zero-click chain against a phone that never has to be touched; a guest-to-host escape in a cloud hypervisor; a stolen token-signing key that lets its holder mint identity itself; a backdoor carried for years inside a trusted component; an implant that lives below the operating system and survives every cleanup; and, in the industrial world, unauthorized knowledge of a physical process — the ability not merely to reach a controller, but to know what to tell it.

These are different weapons, built by different actors, for different targets. They share exactly one dependency, and it is the dependency nobody stationed anything against: every one of them has to act.

Every one of them has to act.

A stolen key is inert until it is spent. A backdoor is decoration until it runs. Persistence is a means; exfiltration, sabotage, and theft are ends — and every end is an act, proposed by something, executed by something, at a specific boundary, in a specific scope. The entire arsenal wins the intrusion and then queues up, like everything else, at the point of action.

This paper is about what happens when something is standing there.

The wrong question and the right one

Thirty years of defensive architecture asks one question at the boundary: is this actor trustworthy? Credentials, signatures, attestation of origin, reputation of the channel. Every weapon class above is, at bottom, a machine for making that question answer "yes." The forged token is cryptographically perfect. The supply-chain payload is properly signed — it is the trusted update. The identity the attacker logs in with is, as far as any relying system can determine, legitimate.

The gate asks a different question, and it asks it of the act rather than the actor: is this specific action, by this principal, within the scope that was attested and sealed before any of this began? Trustworthiness of the channel is not re-litigated, because it was never the gate's claim. Prevention of intrusion is not promised, because against this arsenal it cannot honestly be. What is promised is narrower and, in the end, larger: no act crosses without a verdict, and every verdict is sealed in a record the actor cannot rewrite.

Two gates bracket the system. At the front, intention is attested — signed, fixed, sealed into the chain before entry — because a scope declared after compromise is worth nothing. At the back, each proposed action is judged against that attestation and the standing rules before it executes: ALLOW, ESCALATE, VETO. The verdicts chain, signed, each record bound to the one before it, and the chain's head is periodically countersigned by an external timestamping authority — time, attested by a clock that belongs to neither party. What follows is the arsenal, walked one weapon at a time, with the concession stated plainly in each case: where the gate does not reach, it says so.

1. The forged identity — Golden SAML and the stolen signing key

What the weapon is. In the SolarWinds intrusion, the decisive artifact was not the malware; it was the theft of the token-signing certificate of the identity provider. Whoever holds that key does not break into accounts — he issues them, minting security tokens for any user, with any claims, indistinguishable from legitimate issuance at every relying system. It is the most valuable single theft in modern enterprise intrusion because it converts one compromise into universal, authenticated impersonation.

Where it wins. Everywhere identity is the check. There is no malformed request to detect, no signature that fails. The token verifies, because it is genuinely signed — by the genuine key, in hostile hands.

Where the gate defeats it. The gate never asks the token whether it is valid; it asks the proposed act whether it is in scope. The attestation for a principal — sealed at the front gate, before any compromise — fixes the classes of action that principal may take, in what bounds, under what conditions. The forged administrator arriving to bulk-export the customer database, mint persistent credentials, or reconfigure logging is proposing acts. If they fall outside the attested scope — and theft-shaped acts almost definitionally do — the verdict is VETO, the act does not execute, and the veto itself is sealed into a chain the key cannot touch, because the chain's keys are not the identity provider's keys. The attacker still owns the identity plane. He discovers that identity, at a gated boundary, is not spendable.

The honest limit. Acts inside a legitimately attested scope pass — a forged token wielded with perfect discipline, requesting only what the impersonated principal was attested to do, is indistinguishable from the principal. The gate narrows the theft from "anything, as anyone" to "only what this one person was already permitted." It converts a universal weapon into a bounded one, and it leaves a sealed record of every spend. That is the claim, and it is enough.

2. The trusted update — supply-chain insertion

What the weapon is. In 2024 the xz Utils backdoor was found — by accident, by one engineer chasing a half-second of latency — inside a compression library embedded across the Linux ecosystem. It was not smuggled past the review process; it was installed by it, after a years-long campaign to become the trusted maintainer. One insertion, downstream everywhere, signed and shipped as the legitimate article.

Where it wins. At every control that inspects provenance. The component is authentic. Its maintainers are (by construction) trusted. Its signature verifies. A defense organized around "is this ours?" has no vocabulary for "ours has been turned."

Where the gate defeats it. The backdoor, however patient, is dormant capital until it acts: reaching out to its controller, spawning what the host program never spawns, opening what the component has no business opening. Those are proposals, and the gate judges proposals, not pedigrees. The compromised component can then be amputated — Verity's word, from an earlier paper on a larger theft — because the architecture never extended it trust in the first place, only a stream of individually judged acts. There is nothing to re-establish afterward, no trust to rebuild; there is a list of verdicts, sealed, showing exactly what the component did and when it started.

The honest limit. An insertion whose malicious act is indistinguishable from the component's legitimate function — a compression library that subtly weakens what it compresses — proposes nothing the gate can catch at the action boundary. The gate defeats the insertion as a platform for further acts. It does not audit semantics it was never scoped to judge. Narrow in, narrow out: the scope is the protection, and also the boundary of the claim.

3. The untouched phone — zero-click exploit chains

What the weapon is. A complete exploit chain against a mobile operating system that requires no tap, no click, no visible event: a message arrives, and the device is owned. This class — the Pegasus pattern — commands the highest prices in the public broker market, in the low millions of dollars, because it converts any phone number into total surveillance of the person carrying it.

Where it wins. At the device, completely. Nothing at the action layer reaches back into the radio stack, and this paper does not pretend otherwise: the gate does not stop the implant landing, reading the handset, or recording its microphone.

Where the gate defeats it. An implant is a collection mechanism; the operation around it is not. The operation must task the implant, receive its take, pivot from the harvested credentials into accounts and systems, and move whatever the collection was for. Every one of those downstream objectives crosses boundaries where gated systems live — and at those boundaries, harvested credentials and perfectly replayed sessions are treated the way the forged token is treated in §1: as presenters of proposals, judged on scope, not on authenticity. The weapon gets in. Its objectives begin failing, one boundary at a time, each failure sealed. Surveillance of a person is a tragedy this architecture does not claim to prevent; the conversion of that surveillance into action inside gated systems is the part it contests.

The honest limit. Against the pure collection mission — read, record, report — the gate is simply not the relevant defense, and saying so is the price of being believed about the rest.

4. The escape — hypervisor and cloud

What the weapon is. A guest-to-host escape collapses the foundational promise of cloud computing: that tenants are isolated from one another and from the platform itself. The attacker who escapes does not own a workload; he owns the floor the workloads stand on.

Where it wins. Over everything the host's authority covers — which, in conventional architecture, is everything: the defender's agents, logs, and controls all run as guests of the machine the attacker now administers.

Where the gate defeats it. The gate's verdicts and chain do not live inside the host's trust domain. Enforcement requires an ALLOW sealed under keys the host does not hold; the record is chained and externally anchored, so the escaped attacker confronts an unfamiliar geometry: he can see the records and cannot forge them, can kill the workloads and cannot mint a verdict, can own the floor and find that the floor was never where the authority lived. Sovereign above, gate outside — the stack's ordering is not organizational decoration; it is the reason host compromise does not cascade into verdict compromise.

The honest limit. The attacker can deny service — a gate that cannot be reached cannot ALLOW, and systems built to fail closed will halt. Against an adversary whose goal is destruction rather than theft or control, the gate trades him a quieter victory: he can stop the machine, but he cannot make it act, and he cannot make the record say it did.

5. The thing below — firmware persistence

What the weapon is. Implants in firmware and baseboard controllers survive the standard remedies — disk replacement, reimaging, in some cases new hardware is the only eviction — because every defensive tool runs above the layer the implant occupies, reading a machine the implant is free to lie about.

Where it wins. Against detection and removal, durably. And against the record: logs the operating system keeps are, to a below-the-OS adversary, a draft he may edit.

Where the gate defeats it. Persistence is not an end. The implant endures in order to act later — to exfiltrate, to enable, to fire on a date — and the acts cross gated boundaries where the firmware's seniority buys nothing. And the record it most needs to falsify is the one it cannot reach: verdicts already sealed and countersigned by an external timestamp authority are outside the machine entirely. The implant's deepest purpose is to act without a trustworthy account of the act ever existing. Against a chain anchored off-box, that purpose fails even when every other purpose succeeds.

The honest limit. Local evidence — what the machine claims about itself between anchors — remains suspect by construction. The architecture's answer is cadence, not faith: anchor often enough that the window of editable history is smaller than the value of editing it.

6. The physical act — industrial control

What the weapon is. The Industroyer lineage: intrusion into operational technology armed with process knowledge — the engineering understanding of the physical system sufficient to command it harmfully. Access alone is trespass. Access with knowledge is a weapon aimed at matter: breakers opened in sequence, processes driven out of envelope, equipment destroyed by its own controls.

Where it wins. Across the IT/OT boundary and through every control that authenticates the operator or the workstation — because the commands, when they come, are well-formed, properly sequenced, and issued through legitimate channels. They are, syntactically, operations.

Where the gate defeats it. This is the gate's cleanest case, because the act is physical, singular, and scoped by physics itself. A narrow attestation of the operating envelope — this class of command, within these process bounds, in this sequence position, from this principal — makes sabotage legible in a way it never is at the network layer: a command that drives the process out of envelope is definitionally out of scope, because driving the process out of envelope is what sabotage means. VETO lands at the last inch before physics, which is the only inch where a veto is worth anything. And because the gate is independent of the control network it judges, the intrusion that owns every workstation still does not own the verdict.

The honest limit. An operator's own attested scope is a sovereign decision; if the sovereign attests a broad envelope, the gate enforces a broad envelope. The gate guarantees the scope is honored and the record is true. Choosing the scope — as with every parameter in this architecture — is the sovereign's judgment, and the sovereign's responsibility.

What the six have in common

In each case the pattern repeats with a different defeat point, because each weapon's power ends at a different joint:

• The forged identity is defeated at spend: the credential is perfect, the act is out of scope.
• The trusted update is defeated at runtime: the component is genuine, its proposals are not.
• The untouched phone is defeated at the objective: collection succeeds, conversion to action fails.
• The escape is defeated at authority: the floor is owned, the verdict keys are elsewhere.
• The implant below is defeated at the record: it can act — briefly, and on the record forever.
• The industrial weapon is defeated at the envelope: the command is well-formed, and outside the physics it was attested to serve.

The industry has spent decades building better answers to the question of who is at the door. The arsenal evolved, rationally, into weapons for which that question has a forged answer. What none of them evolved past is the need to act — to present, at some boundary, a proposal that something must judge. The gate is that judge: independent of the systems it watches, paid by none of the parties to the incident, holding no stake in the outcome except the integrity of its own record. Narrow in, narrow out. The verdict is sealed, the time is countersigned, and the intrusion — however total — discovers it has purchased everything except the one thing it came for: an act that no one approved, that no record will ever call legitimate.