Dave Duchesneau

Seattle, WA

CTO (executive)

> If it was undetectable,
> how did they notice it was...

Noticing something happen in real time is very different than an after-the-fact post-mortem analysis -- the latter can take as much time as necessary to understand what happened and how it happened, in order to attempt future prevention. In this context, "undectable" refers to the fact that they had no means for differentiating friend from foe in real time ("on the fly"). The warning is a valuable contribution, because, after having analyzed the events, they're essentially saying they STILL don't know how to differentiate friend from foe in real time (at least not as well as they'd like), meaning that there is still a class of attacks that is "undetectable" to them -- at least until some "critical mass" is reached whose negative effect is clearly visible. Kudos to the author for sharing how the sneak attack worked, so others can work to construct detection and prevention strategies.