4 ms·

"Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..." I'm not that knowledgeable about current hacking technologies so m

"Falcon had identified not one but two Russian intruders: Cozy Bear, ... and Fancy Bear ..." I'm not that knowledgeable about current hacking technologies so maybe this is a dumb question, but how can they 'identify' the origin of these spy-/malwares? Wouldn't a group with equal or more knowledge be able to obfuscate their origin? I think it's kind of suspicious that Russian state hackers would send the data to a server that's apparently already known to be owned by Russia.

strictnein 10y ago
Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.
- Bartweiss 10y ago
  As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.
- legacynl 10y ago
  That is pretty flimsy, any other examples of those indicators?
  - strictnein 10y ago
    I was just offering an example of another indicator, not that it was proof of anything by itself. Some technical indicators: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...
open_bear 10y ago
There was a joke another day, What media tells us: Russian state-sponsored hackers breach the deepest secrets of the country. What really happened: script-kiddie pwned the WordPress blog through hacked Russian VPS.

strictnein 10y ago

Reading a report on one of the groups, I believe they only worked during Russian business hours, took off Russian holidays, etc. I mean, sure, you could do all that from Tahiti, but you couple that with other indicators and it starts to form a clearer picture.

Bartweiss 10y ago
As I understand it, similar logic fingered the Equation Group as a US actor. Their timestamps and activity logs all accommodated US timezones, and specifically US Government working hours and holiday schedules. None of which is ironclad, but frankly there's not much reason for e.g. a Russian actor to bother faking that. Both states have groups doing this stuff, they're not really hiding it, and they might as well work on a reasonable timeframe.
legacynl 10y ago
That is pretty flimsy, any other examples of those indicators?
- strictnein 10y ago
  I was just offering an example of another indicator, not that it was proof of anything by itself. Some technical indicators: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ https://www.crowdstrike.com/blog/bears-midst-intrusion-democ...

open_bear 10y ago

There was a joke another day, What media tells us: Russian state-sponsored hackers breach the deepest secrets of the country. What really happened: script-kiddie pwned the WordPress blog through hacked Russian VPS.