3 ms·

So, what are the most common methods for this?

• tptacek 10y ago
  Extremely large scale instrumentation of endpoints and networks that unpack and fingerprint every transmitted executable across a decent sized fraction of the whole planet. Attack tools are deployed cliquishly, and different groups have different tradecraft; they leave fingerprints.
  • dunkelheit 10y ago
    This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few). How do you fingerprint malicious executables if the traffic is encrypted? I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
    • tptacek 10y ago
      Companies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.