6 ms·
Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, toge
by dguido 9y ago
Because "Russian metadata" was not the totality of evidence used to draw the conclusion that it was Russia. It's never just one thing, it's all the things, together.
If you want an example of the kind of analytical techniques that people use for attribution in the US government and sophisticated industry groups, then refer to the Diamond Model of Intrusion Analysis: http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf http://www.activeresponse.org/wp-content/uploads/2013/07/dia...
- monocasa 9y agoIsn't the CIA here specifically attacking this model of attribution?
- Natsu 9y agoKaspersky has a response to the attacks on attribution that's quite relevant to this story which you can read here: https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu-VB2017.pdf https://cdn.securelist.com/files/2017/10/Guerrero-Saade-Raiu... It was on HN before, but it vanished quickly - https://news.ycombinator.com/item?id=15483529 https://news.ycombinator.com/item?id=15483529
- willstrafach 9y agoNot at all. A self-signed certificate using the CN of a website which the target device may already connect to (assuming it has KAV) is useful for stealth as it allows your implant to blend into traffic more easily. However, attributing an attack based on the CN of an invalid TLS certificate would be very silly, as literally anyone can generate one (Instructions for generating the self-signed certs are actually right there in the source bundle).
- PKop 9y agoThe FBI never even examined the server themselves, just took the word of a campaign affiliated and funded company. Not credible.
- akhilcacharya 9y ago> The FBI never even examined the server themselves You don't need to look at a physical server to make these conclusions. > just took the word of a campaign affiliated and funded company Literally a company PAID to provide security.
- vuln 9y ago> Literally a company PAID to provide security. The Company was PAID for remediation, to write an execute report, and to testify. Why would you pay a private company versus the United States Government that would have much more man power and most likely free services? You generally pay someone when you want a favorable outcome, isn't that Politics 101?
- jerkstate 9y agoThere are 2 types of people who read summaries of the crowdstrike report, those who have retained a security company to produce some type of report and those who haven't.