3 ms·
This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still. To do this kind of fingerprinting one needs to be a
by dunkelheit 10y ago
This is fascinating stuff. I am going to ask more dumb questions :) I guess most of it is secret but still.
To do this kind of fingerprinting one needs to be able to inspect a large chunk of traffic of the whole Internet. I thought that was not really possible for private companies (except maybe a few).
How do you fingerprint malicious executables if the traffic is encrypted?
I suppose attempts to cover your tracks and to impersonate other groups are common. Are they feasible?
- tptacek 10y agoCompanies like Crowdstrike instrument, in effect, the victims of these attacks. Think of them as a kind of antivirus software, with desktop installations across an enterprise, coupled with a C&C channel that funnels all the executables they find back to a central analysis system. By the time something like Crowdstrike or FireEye is seeing an executable, it's already been decrypted. It's totally possible to impersonate another hacking group, but you have to know a lot about their tradecraft to do so with any fidelity.