4 ms·

The Mirai botnet was also attributed to "nation state actors." Turns out it was a couple teenagers trying to make some money with Minecraft. [0] Copy-pasting f

The Mirai botnet was also attributed to "nation state actors." Turns out it was a couple teenagers trying to make some money with Minecraft. [0] Copy-pasting from an earlier comment of mine [1] on the Mirai/Minecraft story: > I don’t understand why every single cyberattack is immediately blamed on Russia or China. It’s an intellectual embarrassment, and especially worse when it’s coming from experts within the community rather than politicians in congress. Adding to that, equally embarrassing is the fact that the media and governments refer to "Russia" as if it's a single, personified entity. Even if an attack did "originate" in Russia, does that mean that it was sanctioned and planned by the Russian government? Or could it be one of the 144 million Russian citizens acting autonomously? It really requires a leap of faith to conclude that not only did the attack originate in Russia, but it was actually planned by the Russian government. Attribution of cyberattacks is hard, borderline impossible, without non-technical corroborating evidence. For example, a SIGINT or HUMINT intercept that reveals intent would corroborate otherwise unreliable technical attribution. When the only evidence for attribution is Russian IP addresses and "Cyrillic characters," it's irresponsible to go public with accusations like this. Of course, if there is corroborating intelligence pointing to Russia, we'll never see it. [0] https://www.wired.com/story/mirai-botnet-minecraft-scam-brought-down-the-internet/ https://www.wired.com/story/mirai-botnet-minecraft-scam-brou... [1] https://news.ycombinator.com/item?id=15921340 https://news.ycombinator.com/item?id=15921340

ryanlol 9y ago
>The Mirai botnet was also attributed to "nation state actors." Not by anyone you should listen to, Mirai was attacking minecraft servers from day one.
- chatmasta 9y ago
  Unless you count Bruce Schneier, who congress sometimes listens to. To be fair, I ridiculed him for exactly this in my original comment, so I agree with you. The issue is not who we should listen to. It's who the politicians listen to, and who the media listens to. Those are the "experts" who, often unwillingly, set the narrative, driving public perception on the topic and ultimately influencing policy.
  - ryanlol 9y ago
    This just proves that you should only listen to Schneier when he is discussing the domain in which he is an expert, which is certainly not attribution. It’s pretty obvious that he had not looked at Mirai at all when he attributed it to ‘state actors’. Politicians and the media will always listen to whoever yells the loudest.
ZeroGravitas 9y ago
So you're comparing a security researcher saying: “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” in the early stages of an investigation into a massive botnet that grew much faster then even its creators expected. And the government of the UK officially naming Russia (and to your second point, specifically the Russian Military) as being behind an attack. I sometimes feel like modern society has been attacked by a context-eating virus.
crdoconnor 9y ago
>Attribution of cyberattacks is hard, borderline impossible, without non-technical corroborating evidence. Intelligence agency budget increases and sky-high consultancy fees are going to be more forthcoming when it's "a scary nation-state" behind an attack rather than a couple of teenagers or a band of cyber-criminals. Also, Russia, after North Korea, does seem to be everybody's favorite bogeyman these days. Intelligence agencies and security consultants will have to balance potential reputation risk as well, of course (if it comes out that they were wrong it's quite embarrassing), but if attributional evidence is weak then it pays to pick the bogeyman.
- chatmasta 9y ago
  Your point about consultants is an important one, and demonstrates a moral hazard of outsourcing intelligence work. CrowdStrike is especially guilty of this. It seems whenever there's a cyber attack, CrowdStrike is there to attribute it to whichever bogeyman is most convenient today.

ryanlol 9y ago

>The Mirai botnet was also attributed to "nation state actors." Not by anyone you should listen to, Mirai was attacking minecraft servers from day one.

chatmasta 9y ago
Unless you count Bruce Schneier, who congress sometimes listens to. To be fair, I ridiculed him for exactly this in my original comment, so I agree with you. The issue is not who we should listen to. It's who the politicians listen to, and who the media listens to. Those are the "experts" who, often unwillingly, set the narrative, driving public perception on the topic and ultimately influencing policy.
- ryanlol 9y ago
  This just proves that you should only listen to Schneier when he is discussing the domain in which he is an expert, which is certainly not attribution. It’s pretty obvious that he had not looked at Mirai at all when he attributed it to ‘state actors’. Politicians and the media will always listen to whoever yells the loudest.

ZeroGravitas 9y ago

So you're comparing a security researcher saying: “We don’t know who is doing this, but it feels like a large nation-state. China or Russia would be my first guesses.” in the early stages of an investigation into a massive botnet that grew much faster then even its creators expected. And the government of the UK officially naming Russia (and to your second point, specifically the Russian Military) as being behind an attack. I sometimes feel like modern society has been attacked by a context-eating virus.

crdoconnor 9y ago

>Attribution of cyberattacks is hard, borderline impossible, without non-technical corroborating evidence. Intelligence agency budget increases and sky-high consultancy fees are going to be more forthcoming when it's "a scary nation-state" behind an attack rather than a couple of teenagers or a band of cyber-criminals. Also, Russia, after North Korea, does seem to be everybody's favorite bogeyman these days. Intelligence agencies and security consultants will have to balance potential reputation risk as well, of course (if it comes out that they were wrong it's quite embarrassing), but if attributional evidence is weak then it pays to pick the bogeyman.

chatmasta 9y ago
Your point about consultants is an important one, and demonstrates a moral hazard of outsourcing intelligence work. CrowdStrike is especially guilty of this. It seems whenever there's a cyber attack, CrowdStrike is there to attribute it to whichever bogeyman is most convenient today.