3 ms·

What government and who are the "consultants" ?

by kushti 10y ago

Luc 10y ago
You just want to argue, don't you. I don't have time for this.
- tptecak 10y ago
  That comment wasn't civil nor thoughtful as HN requires of each one of us that want to be part of this experiment. I hope next time you give us a piece of your mind it'll more representative of the best part of it.
  - sctb 10y ago
    This is a personal attack. We've banned this account, and we'll ban your main one if you do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
tptacek 10y ago
There is an industry of reputable, large scale businesses that do attribution work. Generally, if you see attack attributions written up in major news outlets, one or more of them have concurred on the attribution. For instance: the HRC/DNC attribution started with CrowdStrike (whose executive team is not exactly HRC-friendly), and concurrences were later released by some of CrowdStrike's competitors. Attribution is obviously deeply imperfect. But it's not as simple as "this sure seems like Russian and there's some Cyrillic so let's call it a day".
- dunkelheit 10y ago
  So, what are the most common methods for this?
  - tptacek 10y ago
    Extremely large scale instrumentation of endpoints and networks that unpack and fingerprint every transmitted executable across a decent sized fraction of the whole planet. Attack tools are deployed cliquishly, and different groups have different tradecraft; they leave fingerprints.
    - dunkelheit 10y ago
      This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few). How do you fingerprint malicious executables if the traffic is encrypted? I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
      - tptacek 10y ago
        Companies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.
- s_q_b 10y ago
  This particular APT is also not exactly subtle. Their attacks appear to be political maneuverings that the Russians want the American security establishment, which includes many reputable attribution analysts, to recognize as Russian activities.

What government and who are the "consultants" ?

by kushti 10y ago

What government and who are the "consultants" ?

Luc 10y ago

You just want to argue, don't you. I don't have time for this.

tptecak 10y ago
That comment wasn't civil nor thoughtful as HN requires of each one of us that want to be part of this experiment. I hope next time you give us a piece of your mind it'll more representative of the best part of it.
- sctb 10y ago
  This is a personal attack. We've banned this account, and we'll ban your main one if you do it again. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

tptacek 10y ago

There is an industry of reputable, large scale businesses that do attribution work. Generally, if you see attack attributions written up in major news outlets, one or more of them have concurred on the attribution. For instance: the HRC/DNC attribution started with CrowdStrike (whose executive team is not exactly HRC-friendly), and concurrences were later released by some of CrowdStrike's competitors. Attribution is obviously deeply imperfect. But it's not as simple as "this sure seems like Russian and there's some Cyrillic so let's call it a day".

dunkelheit 10y ago
So, what are the most common methods for this?
- tptacek 10y ago
  Extremely large scale instrumentation of endpoints and networks that unpack and fingerprint every transmitted executable across a decent sized fraction of the whole planet. Attack tools are deployed cliquishly, and different groups have different tradecraft; they leave fingerprints.
  - dunkelheit 10y ago
    This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few). How do you fingerprint malicious executables if the traffic is encrypted? I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
    - tptacek 10y ago
      Companies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.
s_q_b 10y ago
This particular APT is also not exactly subtle. Their attacks appear to be political maneuverings that the Russians want the American security establishment, which includes many reputable attribution analysts, to recognize as Russian activities.