6 ms·

If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considere

If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?

dguido 9y ago
Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together. If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf http://www.activeresponse.org/wp-content/uploads/2013/07/dia...
- monocasa 9y ago
  Isn't the CIA here specifically attacking this model of attribution?
  - Natsu 9y ago
    Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here: https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... It was on HN before, but it vanished quickly - https://news.ycombinator.com/item?id=15483529 https://news.ycombinator.com/item?id=15483529
    - dang 9y ago
      Looks like we invited nkurz to repost that one but it didn't happen to get traction either time. Hard to say why, but it wasn't flags.
      - Natsu 9y ago
        Sorry, didn't mean to imply otherwise. It's pretty interesting, IMHO, but just didn't get upvotes/visibility.
  - willstrafach 9y ago
    Not at all. A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily. However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).
- PKop 9y ago
  The FBI never even examined the server themselves, just took the word of a campaign affiliated and funded company. Not credible.
  - akhilcacharya 9y ago
    > The FBI never even examined the server themselves You don't need to look at a physical server to make these conclusions. > just took the word of a campaign affiliated and funded company Literally a company PAID to provide security.
    - vuln 9y ago
      > Literally a company PAID to provide security. The Company was PAID for remediation, to write an execute report, and to testify. Why would you pay a private company versus the United States Government that would have much more man power and most likely free services? You generally pay someone when you want a favorable outcome, isn't that Politics 101?
      - jerkstate 9y ago
        There are 2 types of people who read summaries of the crowdstrike report, those who have retained a security company to produce some type of report and those who haven't.
deleted 9y ago
[deleted]
willstrafach 9y ago
It definitely should not be considered evidence by anyone credible. Attribution requires more than just some snippets of traffic and metadata. Here is a pretty interesting presentation from the Snowden leaks regarding attribution of Chinese CNE (Warning: TS/SI content): https://www.eff.org/files/2015/02/03/20150117-spiegel-byzantine_hades_-_nsa_research_on_targets_of_chinese_network_exploitation_tools.pdf https://www.eff.org/files/2015/02/03/20150117-spiegel-byzant...
- mediocrejoker 9y ago
  What is TS/SI content?
  - jwn 9y ago
    Top Secret/Sensitive Information
    - bradknowles 9y ago
      That’s not what SI means.
      - AnimalMuppet 9y ago
        That's twice in the same minute that you've replied "That's not what SI means" (to two different definitions, so you have to be right at least once). But it would be more useful if you would supply what you think the correct definition is, rather than making us guess (or making us grovel before your superior knowledge, which is not really the point of HN).
  - vetrom 9y ago
    Poster probably meant to say TS/SCI: Top Secret/Security Compartmentalized Information. Part of the contract involved in getting a U.S. government security clearance assigns you liability for exposure to any TS/SCI, even if you were not the publisher. Therefore if you're subject to one of those contracts, you generally (almost always?) want to avoid reading these leaks like the plague.
thephyber 9y ago
If people can lie, then why are humans used as witnesses to crimes? "Evidence" doesn't have to be irrefutable to make it into a court of law (and the standards are far lower for the court of public opinion).

If pretty basic software can place misleading markers on internet traffic and file metadata, why is the presence of Russian metadata in a hack or leak considered evidence?

dguido 9y ago

Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together. If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf http://www.activeresponse.org/wp-content/uploads/2013/07/dia...

monocasa 9y ago
Isn't the CIA here specifically attacking this model of attribution?
- Natsu 9y ago
  Kaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here: https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... It was on HN before, but it vanished quickly - https://news.ycombinator.com/item?id=15483529 https://news.ycombinator.com/item?id=15483529
  - dang 9y ago
    Looks like we invited nkurz to repost that one but it didn't happen to get traction either time. Hard to say why, but it wasn't flags.
    - Natsu 9y ago
      Sorry, didn't mean to imply otherwise. It's pretty interesting, IMHO, but just didn't get upvotes/visibility.
- willstrafach 9y ago
  Not at all. A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily. However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).
PKop 9y ago
The FBI never even examined the server themselves, just took the word of a campaign affiliated and funded company. Not credible.
- akhilcacharya 9y ago
  > The FBI never even examined the server themselves You don't need to look at a physical server to make these conclusions. > just took the word of a campaign affiliated and funded company Literally a company PAID to provide security.
  - vuln 9y ago
    > Literally a company PAID to provide security. The Company was PAID for remediation, to write an execute report, and to testify. Why would you pay a private company versus the United States Government that would have much more man power and most likely free services? You generally pay someone when you want a favorable outcome, isn't that Politics 101?
    - jerkstate 9y ago
      There are 2 types of people who read summaries of the crowdstrike report, those who have retained a security company to produce some type of report and those who haven't.

deleted 9y ago

[deleted]

willstrafach 9y ago

It definitely should not be considered evidence by anyone credible. Attribution requires more than just some snippets of traffic and metadata. Here is a pretty interesting presentation from the Snowden leaks regarding attribution of Chinese CNE (Warning: TS/SI content): https://www.eff.org/files/2015/02/03/20150117-spiegel-byzantine_hades_-_nsa_research_on_targets_of_chinese_network_exploitation_tools.pdf https://www.eff.org/files/2015/02/03/20150117-spiegel-byzant...

mediocrejoker 9y ago
What is TS/SI content?
- jwn 9y ago
  Top Secret/Sensitive Information
  - bradknowles 9y ago
    That’s not what SI means.
    - AnimalMuppet 9y ago
      That's twice in the same minute that you've replied "That's not what SI means" (to two different definitions, so you have to be right at least once). But it would be more useful if you would supply what you think the correct definition is, rather than making us guess (or making us grovel before your superior knowledge, which is not really the point of HN).
- vetrom 9y ago
  Poster probably meant to say TS/SCI: Top Secret/Security Compartmentalized Information. Part of the contract involved in getting a U.S. government security clearance assigns you liability for exposure to any TS/SCI, even if you were not the publisher. Therefore if you're subject to one of those contracts, you generally (almost always?) want to avoid reading these leaks like the plague.

thephyber 9y ago

If people can lie, then why are humans used as witnesses to crimes? "Evidence" doesn't have to be irrefutable to make it into a court of law (and the standards are far lower for the court of public opinion).