3 ms·

> are in most cases known only to law enforcement and to a few very reputable attribution firms. No one in eastern europe knows how to run a honeypot? Or the a

> are in most cases known only to law enforcement and to a few very reputable attribution firms. No one in eastern europe knows how to run a honeypot? Or the article is wrong that Russia attacked them? If they are attacking non government computers that doesn't include every candidate's website? I have no question that Russia has infiltrated these machines and is as interested in manipulating elections as the US is capable, but manipulation through public disclosure of data is not a precedent Russia should want. I think the treatment of Russia is clearly a boogey man response and everyone would know that and know they needed such a deflection, if they were going to mount such a rough shod attack. Forensics could only deal with a serial killer who collected used condoms to confuse them since he used too many. I have to wonder how many were cleverer and didnt make it into tales of the forensic experts.. Digital forensics can only recognize patterns and know what the chosen style was, which can at most eliminate amatuers that are too low value to attract attacks.

tptacek 10y ago
This is an interesting twist on the ninja defense ("I am a ninja, ninjas are undetectable, therefore I could not have done it") where Russia is simultaneously capable of hacking both US political parties without leaving a trace, but so stupid that they fell into some rando's honeypot --- and then the randos subsequently framed them. We're getting into Calvinball territory here.
- languagewars 10y ago
  ? You have strange beliefs about what is easy and what is hard on machines that are setup properly in advance and ones that are not. I could believe that the DoD can occasionally do attributions on attacks into its network. That poorly administered machines attacked over years contain sufficient data to identify that only one perpetrator took data and then which attack they were needs a lead actor like travolta. (Nowhere did I say Russia attacks without traces, script kiddies just watch ninja films. They are among the tens of thousands of attackers that leave traces of attempts every few minutes. The only inherent advantage state attackers have is that they don't need to monitize so 90% of the ways they should get noticed are gone, leaving them to get noticed more by honeypots than people running machines on the open Internet with no specific plan to detect intrusions.)
  - tptacek 10y ago
    I think this is a (rare) case where my beliefs are pretty much entirely within the mainstream of the broader infosec community.
    - languagewars 10y ago
      Well it is a shame to see the industry converging on believing the seemingly impossible based on secret evidence when presented by people who have every reason to lie (or build their own overconfidence) about their capabilities. When I worked in infosec the dominant opinion was that anyone with extrodinary claims should be ignored until they presented means of community verification, not just more salesmen who said they can do it too.

tptacek 10y ago

This is an interesting twist on the ninja defense ("I am a ninja, ninjas are undetectable, therefore I could not have done it") where Russia is simultaneously capable of hacking both US political parties without leaving a trace, but so stupid that they fell into some rando's honeypot --- and then the randos subsequently framed them. We're getting into Calvinball territory here.

languagewars 10y ago
? You have strange beliefs about what is easy and what is hard on machines that are setup properly in advance and ones that are not. I could believe that the DoD can occasionally do attributions on attacks into its network. That poorly administered machines attacked over years contain sufficient data to identify that only one perpetrator took data and then which attack they were needs a lead actor like travolta. (Nowhere did I say Russia attacks without traces, script kiddies just watch ninja films. They are among the tens of thousands of attackers that leave traces of attempts every few minutes. The only inherent advantage state attackers have is that they don't need to monitize so 90% of the ways they should get noticed are gone, leaving them to get noticed more by honeypots than people running machines on the open Internet with no specific plan to detect intrusions.)
- tptacek 10y ago
  I think this is a (rare) case where my beliefs are pretty much entirely within the mainstream of the broader infosec community.
  - languagewars 10y ago
    Well it is a shame to see the industry converging on believing the seemingly impossible based on secret evidence when presented by people who have every reason to lie (or build their own overconfidence) about their capabilities. When I worked in infosec the dominant opinion was that anyone with extrodinary claims should be ignored until they presented means of community verification, not just more salesmen who said they can do it too.