4 ms·
> The FBI bulletin listed eight separate IP addresses that were the sources of the two attacks and suggested that the attacks may have been linked, noting that
by headShrinker 10y ago
> The FBI bulletin listed eight separate IP addresses that were the sources of the two attacks and suggested that the attacks may have been linked, noting that one of the IP addresses was used in both intrusions... “Attempts should not be made to touch or ping the IP addresses directly.”
The whole thing just sounds so basic and rudimentary. They didn't spoof ip addresses or cover their tracks. Then FBI has to remind techs not to contact the hackers directly by resolving the ip. It reminds me that we are a sitting duck if someone with skills wants to do damage.
- heartbreak 10y agoJust because they used the same IP twice doesn't mean the IP address corresponds directly to an ISP account paid for by the attacker(s). Could just be a zombie or any of a dozen other means of misdirection. It's a safe assumption that the FBI is competent in these matters and knows a lot more about this than they're saying even in this leaked document.
- neom 10y ago"It's a safe assumption that the FBI is competent in these matters" LOLOL, ok. Clearly you've never listen to James Comey talk at length on, well, any subject at all.
- heartbreak 10y agoIt's also safe to assume that the FBI Director is not in the weeds on highly technical investigations like this.
- neom 10y agoI mean the guy is a bumbling fool, so I can't imagine he knows how to build a team of competent technologist,something you tend to be charged with doing when you're the director. His congressional hearing talks are embarrassing. eyeroll
- wcummings 10y agoYou can't really just "spoof ip addresses" with most protocols. The ip's are prolly proxies/owned boxes/relays.
- CWuestefeld 10y agoYes, which makes me wonder why they're trying so hard to push the "Russians are doing it" narrative. Although I have no more evidence than do they, it feels rather like a diversion.
- wcummings 10y agoCan't let people think you aren't capable of attributing attacks.
- joshstrange 10y agoYeah, this argument always falls pretty flat with me, it feels like the gov just traces IP's as far back as they have to make their case. "The attack came from an owned box in the USA that we can trace was connected to from an owned box in France that we can trace to an owned box in Russia, I guess the Russians did it" .... Not to mention it shouldn't be terribly difficult to hide your tracks connecting to an owned box meaning that any hacker worth their salt can make an attack look like it's coming from wherever they want.