4 ms·

Honestly it's as if people have forgotten one of the fundamental principles of strategy and tactics. The attacker almost always has the advantage. Its true in t

Honestly it's as if people have forgotten one of the fundamental principles of strategy and tactics. The attacker almost always has the advantage. Its true in the book of five rings, its true in the art of war, it's just a basic principle. Now, thats not to say an adanced attacker still can't be defended against, but as a sysadmin who has seen the inside of companies from law firms to publicly traded big guys to the IT firms themselves... And that's that almost no managment has put forward the personell or the budgets or the culture needed to really secure things. Hell, a family member of mine recently got a tour of spacex and was apalled at the security. If Musk and his money dont do it right or well, almost nobody is. I've basically told people who run windows systems for business they're already comprimised most likely, and the best thing to do is to be doing hids and good log analysis so you catch it when it happens quickly... but you probably arent going to stop any kind of semi-advanced attacker. So to be frank, it completely makes sense to me that a company like Palantir would be massively vulnerable from thr inside. The edge of the sword they live on cuts both ways. These days, its about response time and forensic afteraction. "When Palantir’s information security employees finally discovered the intruders, they “provided a rapid network response in which they identified and mitigated” the “majority” of the red team’s actions within days, the report says. Compared with other large companies, this defensive response was unusually robust, the industry source said, based on a reading of the report."

muglug 10y ago
The red team also had the big benefit that there would be no legal ramifications if/when they were discovered. That no doubt encouraged them to take bigger risks, and consequently get further, than a malicious hacker would.
- snarf 10y ago
  Do you honestly think that state sponsored hackers care about the legal ramifications of being discovered?
  - meowface 10y ago
    In some cases, they do care very much. Just not from a legal standpoint. Many nation states prefer not to be detected when conducting espionage. And if they are detected, they really prefer to not have the attack be attributed to their country. At the very least, they want some plausible deniability; ideally full-on anonymity or framing, if they can. Sometimes they really don't care if the source of the attack is known. It depends on the political rationale behind it. But when they do care, they're definitely at more of a disadvantage than a hired red team. The red team has no real anxiety over whether they're caught or attributed, and can act more quickly and aggressively.
    - threatofrain 10y ago
      I think that if a state desires to engage in a cyberattack, there's really no way you can pinpoint it back, because there's no evidence to show why a hacker on a Chinese IP is associated with the Chinese government -- unless you're depending on sloppiness. It could be a private industrially motivated actor, it could be the actions of someone looking to embarrass the Chinese government, or it could be some nationalist. The US can say "shame on you" because they feel they have enough evidence to support a narrative, and China will say, "How can you engage in such irresponsible rhetoric?" The Chinese government will condemn rogue criminals and perform a cursory investigation and that will be the end of it. And then all countries and all companies in the world continue operating as usual. No political consequences. All nations understand it.
      - meowface 10y ago
        There are many different kinds of indicators left behind in attacks, even very sophisticated attacks. Way more than just IP addresses. The entire recon, infection, exfiltration, pivoting, and C&C chain can leave hundreds or thousands of host-based, network-based, and identity-based indicators behind. Of course, those indicators can be intentionally or unintentionally misleading or ambiguous. But by finding a dozen or more consistent IOCs/TTPs without any inconsistent ones, combined with a motive, often you can start making some possible accusations. Those assumptions will often remain unproven, but keep in mind government APT groups are still run by humans, and humans can always be sloppy. Also, in some cases one state may have so thoroughly compromised another that they could find explicit evidence that an attack was ordered.

muglug 10y ago

The red team also had the big benefit that there would be no legal ramifications if/when they were discovered. That no doubt encouraged them to take bigger risks, and consequently get further, than a malicious hacker would.

snarf 10y ago
Do you honestly think that state sponsored hackers care about the legal ramifications of being discovered?
- meowface 10y ago
  In some cases, they do care very much. Just not from a legal standpoint. Many nation states prefer not to be detected when conducting espionage. And if they are detected, they really prefer to not have the attack be attributed to their country. At the very least, they want some plausible deniability; ideally full-on anonymity or framing, if they can. Sometimes they really don't care if the source of the attack is known. It depends on the political rationale behind it. But when they do care, they're definitely at more of a disadvantage than a hired red team. The red team has no real anxiety over whether they're caught or attributed, and can act more quickly and aggressively.
  - threatofrain 10y ago
    I think that if a state desires to engage in a cyberattack, there's really no way you can pinpoint it back, because there's no evidence to show why a hacker on a Chinese IP is associated with the Chinese government -- unless you're depending on sloppiness. It could be a private industrially motivated actor, it could be the actions of someone looking to embarrass the Chinese government, or it could be some nationalist. The US can say "shame on you" because they feel they have enough evidence to support a narrative, and China will say, "How can you engage in such irresponsible rhetoric?" The Chinese government will condemn rogue criminals and perform a cursory investigation and that will be the end of it. And then all countries and all companies in the world continue operating as usual. No political consequences. All nations understand it.
    - meowface 10y ago
      There are many different kinds of indicators left behind in attacks, even very sophisticated attacks. Way more than just IP addresses. The entire recon, infection, exfiltration, pivoting, and C&C chain can leave hundreds or thousands of host-based, network-based, and identity-based indicators behind. Of course, those indicators can be intentionally or unintentionally misleading or ambiguous. But by finding a dozen or more consistent IOCs/TTPs without any inconsistent ones, combined with a motive, often you can start making some possible accusations. Those assumptions will often remain unproven, but keep in mind government APT groups are still run by humans, and humans can always be sloppy. Also, in some cases one state may have so thoroughly compromised another that they could find explicit evidence that an attack was ordered.