8 ms·

> “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” [Bruce Schneier when Mirai first appeare

> “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” [Bruce Schneier when Mirai first appeared] This looks especially foolish now. Schneier is a so-called expert who has testified in front of congress. He should be more careful when engaging in rampant speculation like this. What basis did he have for such an assumption? I don’t understand why every single cyberattack is immediately blamed on Russia or China. It’s an intellectual embarrassment, and especially worse when it’s coming from experts within the community rather than politicians in congress. But I’m sure the DNC hack was the work of an advanced nation state. Probably had nothing to do with sharing passwords like runner123 over email...

philamonster 9y ago
I think a lot of the speculation was based on the initial size of the attack (620-665gbps). https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/ https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with...
- tptacek 9y ago
  Right. The problem is the premise that it would take a state-level adversary to generate that kind of traffic, and not a single-digit number of disgruntled teenaged Minecraft players.
sasas 9y ago
> Schneier is a so-called expert who has testified in front of congress Schneier has been around for a long time, knows the industry well and has made significant contributions. Not everyone get's things right all the time including Schneier. Credibility wise he .. - has a master's degree in computer science - was awarded an honorary Ph.D from the University of Westminster in London - is chief technology officer of BT Managed Security Solutions 15 publications, 6 notable books - - Applied Cryptograph - Cryptography Engineering - Secrets and Lies: Digital Security in a Networked World - Beyond Fear: Thinking Sensibly About Security in an Uncertain World - Liars and Outliers: Enabling the Trust that Society Needs to Thrive - Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World Reference: https://en.wikipedia.org/wiki/Bruce_Schneier https://en.wikipedia.org/wiki/Bruce_Schneier
- ancarda 9y ago
  But that does not excuse knee-jerk reactions. >China or Russia would be my first guesses Why? If this is just based on it being a massive attack, then there's no basis to automatically blame China/Russia. Have you not noticed this trend? Every time there's a big attack or new strain of malware, it's always China/Russia/North Korea, and that finger pointing is before any concrete evidence? Honestly, it's xenophobic and will cloud judgement as you'll be looking for evidence that it is China/Russia/North Korea rather than looking for facts. Even if there's a good chance it is them, should we not believe in innocent until proven guilty?
  - mbrameld 9y ago
    > Why? Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? He said they were "guesses". He straight up told you he was speculating. That's not xenophobic, that's statistical probability. > Even if there's a good chance it is them, should we not believe in innocent until proven guilty? Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything!
    - tptacek 9y ago
      He doesn't look silly because he guessed at a state-level attribution --- state-level attacks certainly happen. He looks silly because the attacks he chose to attribute to state actors were in fact being conducted by a small number of teenaged Minecraft players.
    - freeflight 9y ago
      > Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? Not really, just because attacks come from a certain country domain does not mean that said countries government is sponsoring said attacks. Even the CIA/NSA use hijacked foreign servers for their operations, that's why attribution of this stuff is so difficult. I'd also be interested in how you define "large and coordinated attacks" because if you track by something like Norse Attack Map [0] then your Occam's Razor would suddenly point at the US, at least right now. > Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything! There's a difference between "speculation" and flat out misrepresenting the probabilities. At this point, it should be pretty clear, especially to any expert in the field, that the Internet is a massive force multiplier and the regular rules of "You need big influence to have big impact" have pretty much never applied to it. People need to account for that in their attempts at attribution instead of going the lazy route of blaming "The axis of evil" for it, which this lazy China/Russia/NK attribution basically boils down to. [0] http://map.norsecorp.com/#/ http://map.norsecorp.com/#/
wolfgke 9y ago
> > “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” [Bruce Schneier when Mirai first appeared] > This looks especially foolish now. Schneier is a so-called expert who has testified in front of congress. He should be more careful when engaging in rampant speculation like this. Perhaps by being not a native speaker of English and not living in the USA I miss some cultural subtleties, but I would call Bruce Schneier's statement really cautious: - He clearly states he does not know who is the culprit (really cautious - as it should be!) - He clearly states that his statement is based alone on feeling - He rather clearly outlines that his guesses for China or Russia are based on the correctness of the assumption that a national state is behind it
- TheBestKorea 9y ago
  People have the responsibility when making predictions that others will take action based on their prediction. Speculation without merit, only going by "first guess" should not be shared. If you are an expert, your opinion (even offhand) carries weight.
  - wolfgke 9y ago
    > People have the responsibility when making predictions that others will take action based on their prediction. I agree - and this is why Bruce Schneier (in my opinion) formulated his statements so cautiously and clearly pointed out the lack of evidence. Of course people will take action - but this can mean anything: - Doing undercover investigation to collect evidence whether China or Russia is really behind it or this was a red herring: I would consider this as a pretty good idea under the given circumstances. - Accusing China or Russia on the world stage that they are behind these attacks: A really bad idea. But both are plausible actions based on the "prediction" - and I would call the first one actually a good idea under the given circumstances.
disconnected 9y ago
Wired is misusing that quote, since it does not pertain to Mirai specifically, but to cyberwarfare in general. Here's the source titled "Someone Is Learning How to Take Down the Internet", dated September 2016: https://www.schneier.com/blog/archives/2016/09/someone_is_lear.html https://www.schneier.com/blog/archives/2016/09/someone_is_le... The source paragraph does not mention Mirai at all (nor does the article): > Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. You should actually read the whole article to get a sense of where he is coming from.
- fps_doug 9y ago
  Yes, but still. I read the article when it was first published and felt it was the usual "evil communism" bs (which I honestly wouldn't have expected from Mr. Schneider), and this time around we actually got a definite answer proving these kind of claims wrong. Nowadays every time some news pop up revolving around cyber attacks more sooner than later someone points at China or Russia, with some very vague evidence at best. "Oh, we found a Russian text string embedded in the binary, it MUST have been written by the Russian government."
  - lbill 9y ago
    I think we are taking this the wrong way. The situation is "we more or less blamed Mirai on a State sponsored actor", and we focus our attention on "hey, you were wrong! How dare you suspect foreign governments? That's kind of racist!". I see it as a minor concern, the major one being "Mirai is the definitive proof that your don't need the means and resources of a big hacking team financed by a government to cripple the internet. 3 kids who want to cheat on minecraft can do it". Sure, we already kinda knew that, but this proof is quite scary.
- tptacek 9y ago
  I read the original at the time and again yesterday, along with Brian Krebs' epic article, and it seems pretty clear that he's talking about the same phenomenon Brian Krebs is talking about.
akhilcacharya 9y ago
>But I’m sure the DNC hack was the work of an advanced nation state Do you have a better explanation? I'm all ears. I haven't heard one.

philamonster 9y ago

I think a lot of the speculation was based on the initial size of the attack (620-665gbps). https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/ https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with...

tptacek 9y ago
Right. The problem is the premise that it would take a state-level adversary to generate that kind of traffic, and not a single-digit number of disgruntled teenaged Minecraft players.

sasas 9y ago

> Schneier is a so-called expert who has testified in front of congress Schneier has been around for a long time, knows the industry well and has made significant contributions. Not everyone get's things right all the time including Schneier. Credibility wise he .. - has a master's degree in computer science - was awarded an honorary Ph.D from the University of Westminster in London - is chief technology officer of BT Managed Security Solutions 15 publications, 6 notable books - - Applied Cryptograph - Cryptography Engineering - Secrets and Lies: Digital Security in a Networked World - Beyond Fear: Thinking Sensibly About Security in an Uncertain World - Liars and Outliers: Enabling the Trust that Society Needs to Thrive - Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World Reference: https://en.wikipedia.org/wiki/Bruce_Schneier https://en.wikipedia.org/wiki/Bruce_Schneier

ancarda 9y ago
But that does not excuse knee-jerk reactions. >China or Russia would be my first guesses Why? If this is just based on it being a massive attack, then there's no basis to automatically blame China/Russia. Have you not noticed this trend? Every time there's a big attack or new strain of malware, it's always China/Russia/North Korea, and that finger pointing is before any concrete evidence? Honestly, it's xenophobic and will cloud judgement as you'll be looking for evidence that it is China/Russia/North Korea rather than looking for facts. Even if there's a good chance it is them, should we not believe in innocent until proven guilty?
- mbrameld 9y ago
  > Why? Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? He said they were "guesses". He straight up told you he was speculating. That's not xenophobic, that's statistical probability. > Even if there's a good chance it is them, should we not believe in innocent until proven guilty? Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything!
  - tptacek 9y ago
    He doesn't look silly because he guessed at a state-level attribution --- state-level attacks certainly happen. He looks silly because the attacks he chose to attribute to state actors were in fact being conducted by a small number of teenaged Minecraft players.
  - freeflight 9y ago
    > Occam's razor? If the majority of large, coordinated attacks and malware come from those countries it seems reasonable to suspect them initially, doesn't it? Not really, just because attacks come from a certain country domain does not mean that said countries government is sponsoring said attacks. Even the CIA/NSA use hijacked foreign servers for their operations, that's why attribution of this stuff is so difficult. I'd also be interested in how you define "large and coordinated attacks" because if you track by something like Norse Attack Map [0] then your Occam's Razor would suddenly point at the US, at least right now. > Yes, but if no speculation is allowed until after a conviction then how would anyone ever be investigated? We would never be able to accuse anyone of anything! There's a difference between "speculation" and flat out misrepresenting the probabilities. At this point, it should be pretty clear, especially to any expert in the field, that the Internet is a massive force multiplier and the regular rules of "You need big influence to have big impact" have pretty much never applied to it. People need to account for that in their attempts at attribution instead of going the lazy route of blaming "The axis of evil" for it, which this lazy China/Russia/NK attribution basically boils down to. [0] http://map.norsecorp.com/#/ http://map.norsecorp.com/#/

wolfgke 9y ago

> > “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” [Bruce Schneier when Mirai first appeared] > This looks especially foolish now. Schneier is a so-called expert who has testified in front of congress. He should be more careful when engaging in rampant speculation like this. Perhaps by being not a native speaker of English and not living in the USA I miss some cultural subtleties, but I would call Bruce Schneier's statement really cautious: - He clearly states he does not know who is the culprit (really cautious - as it should be!) - He clearly states that his statement is based alone on feeling - He rather clearly outlines that his guesses for China or Russia are based on the correctness of the assumption that a national state is behind it

TheBestKorea 9y ago
People have the responsibility when making predictions that others will take action based on their prediction. Speculation without merit, only going by "first guess" should not be shared. If you are an expert, your opinion (even offhand) carries weight.
- wolfgke 9y ago
  > People have the responsibility when making predictions that others will take action based on their prediction. I agree - and this is why Bruce Schneier (in my opinion) formulated his statements so cautiously and clearly pointed out the lack of evidence. Of course people will take action - but this can mean anything: - Doing undercover investigation to collect evidence whether China or Russia is really behind it or this was a red herring: I would consider this as a pretty good idea under the given circumstances. - Accusing China or Russia on the world stage that they are behind these attacks: A really bad idea. But both are plausible actions based on the "prediction" - and I would call the first one actually a good idea under the given circumstances.

disconnected 9y ago

Wired is misusing that quote, since it does not pertain to Mirai specifically, but to cyberwarfare in general. Here's the source titled "Someone Is Learning How to Take Down the Internet", dated September 2016: https://www.schneier.com/blog/archives/2016/09/someone_is_lear.html https://www.schneier.com/blog/archives/2016/09/someone_is_le... The source paragraph does not mention Mirai at all (nor does the article): > Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don't know who is doing this, but it feels like a large nation state. China or Russia would be my first guesses. You should actually read the whole article to get a sense of where he is coming from.

fps_doug 9y ago
Yes, but still. I read the article when it was first published and felt it was the usual "evil communism" bs (which I honestly wouldn't have expected from Mr. Schneider), and this time around we actually got a definite answer proving these kind of claims wrong. Nowadays every time some news pop up revolving around cyber attacks more sooner than later someone points at China or Russia, with some very vague evidence at best. "Oh, we found a Russian text string embedded in the binary, it MUST have been written by the Russian government."
- lbill 9y ago
  I think we are taking this the wrong way. The situation is "we more or less blamed Mirai on a State sponsored actor", and we focus our attention on "hey, you were wrong! How dare you suspect foreign governments? That's kind of racist!". I see it as a minor concern, the major one being "Mirai is the definitive proof that your don't need the means and resources of a big hacking team financed by a government to cripple the internet. 3 kids who want to cheat on minecraft can do it". Sure, we already kinda knew that, but this proof is quite scary.
tptacek 9y ago
I read the original at the time and again yesterday, along with Brian Krebs' epic article, and it seems pretty clear that he's talking about the same phenomenon Brian Krebs is talking about.

akhilcacharya 9y ago

>But I’m sure the DNC hack was the work of an advanced nation state Do you have a better explanation? I'm all ears. I haven't heard one.