4 ms·

How WADA can distinguish Russian group from any other? How anti-doping agency becomes proficient in cyber security?

by kushti 10y ago

Luc 10y ago
Government & consultants.
- kushti 10y ago
  What government and who are the "consultants" ?
  - Luc 10y ago
    You just want to argue, don't you. I don't have time for this.
    - tptecak 10y ago
      That comment wasn't civil nor thoughtful as HN requires of each one of us that want to be part of this experiment. I hope next time you give us a piece of your mind it'll more representative of the best part of it.
      - sctb 10y ago
        This is a personal attack. We've banned this account, and we'll ban your main one if you do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
  - tptacek 10y ago
    There is an industry of reputable, large scale businesses that do attribution work. Generally, if you see attack attributions written up in major news outlets, one or more of them have concurred on the attribution. For instance: the HRC/DNC attribution started with CrowdStrike (whose executive team is not exactly HRC-friendly), and concurrences were later released by some of CrowdStrike's competitors. Attribution is obviously deeply imperfect. But it's not as simple as "this sure seems like Russian and there's some Cyrillic so let's call it a day".
    - dunkelheit 10y ago
      So, what are the most common methods for this?
      - tptacek 10y ago
        Extremely large scale instrumentation of endpoints and networks that unpack and fingerprint every transmitted executable across a decent sized fraction of the whole planet. Attack tools are deployed cliquishly, and different groups have different tradecraft; they leave fingerprints.
        dunkelheit 10y ago
        This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few). How do you fingerprint malicious executables if the traffic is encrypted? I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
        tptacek 10y ago
        Companies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.
    - s_q_b 10y ago
      This particular APT is also not exactly subtle. Their attacks appear to be political maneuverings that the Russians want the American security establishment, which includes many reputable attribution analysts, to recognize as Russian activities.
bsder 10y ago
Likely the Royal Canadian Mounted Police (Canada's Federal Police Force) given that WADA is based in Montreal. The quote from the article: "WADA has been informed by law enforcement authorities that these attacks are originating out of Russia,” he continued."
- celticninja 10y ago
  And even without that it was pretty obvious who the attackers were given the released data: 1) Focus on US athletes 2) Bear mentioned in name of hackers 3) Focus on sports doping (which Russia was recently found guilty of) Now I know that many hacks and hackers will obfuscate the trail to them as much as possible but this is a fairly basic attack with little in the way of real impact as a result of the releases. It was obvious even to a non-security professional that the most likely culprits were russian nationalist hackers.
linkregister 10y ago
ThreatConnect, and FireEye, computer security companies, performed the attribution. I had never heard of ThreatConnect before today; FireEye is well-known for accurate analysis. It's attribution reputation is similar to that of Kaspersky Labs.

How WADA can distinguish Russian group from any other? How anti-doping agency becomes proficient in cyber security?

by kushti 10y ago

How WADA can distinguish Russian group from any other? How anti-doping agency becomes proficient in cyber security?

Luc 10y ago

Government & consultants.

kushti 10y ago
What government and who are the "consultants" ?
- Luc 10y ago
  You just want to argue, don't you. I don't have time for this.
  - tptecak 10y ago
    That comment wasn't civil nor thoughtful as HN requires of each one of us that want to be part of this experiment. I hope next time you give us a piece of your mind it'll more representative of the best part of it.
    - sctb 10y ago
      This is a personal attack. We've banned this account, and we'll ban your main one if you do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- tptacek 10y ago
  There is an industry of reputable, large scale businesses that do attribution work. Generally, if you see attack attributions written up in major news outlets, one or more of them have concurred on the attribution. For instance: the HRC/DNC attribution started with CrowdStrike (whose executive team is not exactly HRC-friendly), and concurrences were later released by some of CrowdStrike's competitors. Attribution is obviously deeply imperfect. But it's not as simple as "this sure seems like Russian and there's some Cyrillic so let's call it a day".
  - dunkelheit 10y ago
    So, what are the most common methods for this?
    - tptacek 10y ago
      Extremely large scale instrumentation of endpoints and networks that unpack and fingerprint every transmitted executable across a decent sized fraction of the whole planet. Attack tools are deployed cliquishly, and different groups have different tradecraft; they leave fingerprints.
      - dunkelheit 10y ago
        This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few). How do you fingerprint malicious executables if the traffic is encrypted? I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
        tptacek 10y ago
        Companies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.
  - s_q_b 10y ago
    This particular APT is also not exactly subtle. Their attacks appear to be political maneuverings that the Russians want the American security establishment, which includes many reputable attribution analysts, to recognize as Russian activities.

bsder 10y ago

Likely the Royal Canadian Mounted Police (Canada's Federal Police Force) given that WADA is based in Montreal. The quote from the article: "WADA has been informed by law enforcement authorities that these attacks are originating out of Russia,” he continued."

celticninja 10y ago
And even without that it was pretty obvious who the attackers were given the released data: 1) Focus on US athletes 2) Bear mentioned in name of hackers 3) Focus on sports doping (which Russia was recently found guilty of) Now I know that many hacks and hackers will obfuscate the trail to them as much as possible but this is a fairly basic attack with little in the way of real impact as a result of the releases. It was obvious even to a non-security professional that the most likely culprits were russian nationalist hackers.

linkregister 10y ago

ThreatConnect, and FireEye, computer security companies, performed the attribution. I had never heard of ThreatConnect before today; FireEye is well-known for accurate analysis. It's attribution reputation is similar to that of Kaspersky Labs.