5 ms·
This report is a joke. I didn't find any reasoning about attribution. Here is the only valuable part: " rule PAS_TOOL_PHP_WEB_KIT { meta: description = "PAS T
by Dolores12 10y ago
This report is a joke. I didn't find any reasoning about attribution.
Here is the only valuable part:
"
rule PAS_TOOL_PHP_WEB_KIT
{
meta:
description = "PAS TOOL PHP WEB KIT FOUND"
strings:
$php = "<?php"
$base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
$strreplace = "(str_replace("
$md5 = ".substr(md5(strrev("
$gzinflate = "gzinflate"
$cookie = "_COOKIE"
$isset = "isset"
condition:
(filesize > 20KB and filesize < 22KB) and
#cookie == 2 and
#isset == 3 and
all of them
}
"
- ryanlol 10y agoI guess you missed https://www.us-cert.gov/sites/default/files/publications/JAR-16-20296.csv https://www.us-cert.gov/sites/default/files/publications/JAR...
- alexandercrohde 10y agoWhat exactly is this? A list of IP addresses and countries? It's unclear which attributes from this list associate the hack with Russia, and presumably it's more than IP address seeing as how trivial proxying is.
- ryanlol 10y ago>What exactly is this? A list of IP addresses and countries? It's just a list of IOCs. IPs, file hashes, urls, a few traffic samples. >presumably it's more than IP address seeing as how trivial proxying is. https://news.ycombinator.com/item?id=13280068 https://news.ycombinator.com/item?id=13280068
- AlexCoventry 10y agoThat and the supporting indicator files[0]. [0] https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE... This would probably be a better link for the OP than the PDF it links.
- dominotw 10y agoHow do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .
- ryanlol 10y agoI guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia? Unless you can answer that, yours doesn't really make much sense.
- 15155 10y agoWhy would IP addresses _in Russia_ automatically make attacks attributable to Russia?
- ryanlol 10y agoThey wouldn't?
- codedokode 10y agoThey would not. Most probably found IP addresses will be either some cheap VPS bought by anonymous person or a Tor exit node (or maybe some infected machine). It is unlikely that government hackers would use stolen passwords at a computer in Kremlin or Capitol or Beijing or whereever they are.
- dominotw 10y ago>why should these IP addresses from those countries make this attack attributable to Russia? "DHS has released a Joint Analysis Report (JAR) attributing those compromises to Russian malicious cyber activity, designated as GRIZZLY STEPPE. " This is one of the 'GRIZZLY STEPPE Indicators' . Am i reading this wrong ?
- ryanlol 10y ago
- mundo 10y agoIs your prior for "The FBI would publicly make an accusation like this without any conclusive technical evidence" really higher than your prior for "The FBI would not include all of the evidence they based the accusation on in the public report"?
- Natsu 10y agoThe burden of proof is put on the one making claims. There is no other rational way to do things.
- sigmar 10y agoDid you read the first page? This report has nothing to do with detailing or justifying attribution
- ra1n85 10y agoThen why did the report attribute any of this to Russia without substantiating those claims? It's one thing to detail mitigations, it's another to call out Russia as the perpetrator without adding contextual value - the majority of the addresses involved aren't Russian.
- mundo 10y agoDid they really need to say, "We also have other data about the attack that we're not publishing because it's classified"? Isn't that kind of safe to assume?
- UnoriginalGuy 10y agoI don't think it is safe to assume at all. They laid this at Russia's feet almost immediately and before any investigation was conducted.
- ra1n85 10y agoWhen things like this are used as a pretext to sanction other countries, I will assume nothing and expect data. The bogus weapons of mass destruction in Iraq was enough to convince me that "just trust us" isn't sufficient data.
- y_u_no_rust 10y agoTOP KEK!
- mundo 10y agoFrom the downvotes, I guess the FBI doesn't typically keep information to itself, it just releases it on principle. How nice of them!