3 ms·

That and the supporting indicator files[0]. [0] https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity https://www.us-ce

That and the supporting indicator files[0]. [0] https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity https://www.us-cert.gov/security-publications/GRIZZLY-STEPPE... This would probably be a better link for the OP than the PDF it links.

dominotw 10y ago
How do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .
- ryanlol 10y ago
  I guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia? Unless you can answer that, yours doesn't really make much sense.
  - 15155 10y ago
    Why would IP addresses _in Russia_ automatically make attacks attributable to Russia?
    - ryanlol 10y ago
      They wouldn't?
      - codedokode 10y ago
        They would not. Most probably found IP addresses will be either some cheap VPS bought by anonymous person or a Tor exit node (or maybe some infected machine). It is unlikely that government hackers would use stolen passwords at a computer in Kremlin or Capitol or Beijing or whereever they are.
  - dominotw 10y ago
    >why should these IP addresses from those countries make this attack attributable to Russia? "DHS has released a Joint Analysis Report (JAR) attributing those compromises to Russian malicious cyber activity, designated as GRIZZLY STEPPE. " This is one of the 'GRIZZLY STEPPE Indicators' . Am i reading this wrong ?
    - ryanlol 10y ago
      Yes. I can't imagine how you could possibly come to the conclusion that there's supposed to be anything attribution related here. They explicitly stated this is just indicators of compromise that network administrators should look for. >DHS recommends that network administrators review the Security Publication for more information and implement the recommendations provided. not >DHS recommends that everyone review the irrefutable proof that communists hacked DNC

dominotw 10y ago

How do bunch of ip addresses form china/Sweden/germany/canada make this attack attributable to russians .

ryanlol 10y ago
I guess the real question is, why should these IP addresses from those countries make this attack attributable to Russia? Unless you can answer that, yours doesn't really make much sense.
- 15155 10y ago
  Why would IP addresses _in Russia_ automatically make attacks attributable to Russia?
  - ryanlol 10y ago
    They wouldn't?
    - codedokode 10y ago
      They would not. Most probably found IP addresses will be either some cheap VPS bought by anonymous person or a Tor exit node (or maybe some infected machine). It is unlikely that government hackers would use stolen passwords at a computer in Kremlin or Capitol or Beijing or whereever they are.
- dominotw 10y ago
  >why should these IP addresses from those countries make this attack attributable to Russia? "DHS has released a Joint Analysis Report (JAR) attributing those compromises to Russian malicious cyber activity, designated as GRIZZLY STEPPE. " This is one of the 'GRIZZLY STEPPE Indicators' . Am i reading this wrong ?
  - ryanlol 10y ago
    Yes. I can't imagine how you could possibly come to the conclusion that there's supposed to be anything attribution related here. They explicitly stated this is just indicators of compromise that network administrators should look for. >DHS recommends that network administrators review the Security Publication for more information and implement the recommendations provided. not >DHS recommends that everyone review the irrefutable proof that communists hacked DNC