3 ms·
APT groups have a set of tools, techniques, and processes (ttps) that they use. They evolve over time, but generally consistent per APT group. It's maybe dozens
by spydum 9y ago
APT groups have a set of tools, techniques, and processes (ttps) that they use. They evolve over time, but generally consistent per APT group. It's maybe dozens of methods and signature moves that teams use to attribute the actor. Malware packages and so on leak data, c2 servers might get reused (or the way the c2 was obtained might inform something).
From the attacker point of view, you don't change your methods if they are working.
However due to this, you are right: it's incredibly messy and attribution is mostly bullshit. If you notice, it mostly warns the operator to seek help, so others can try to confirm.
- irundebian 9y agoYou could actually say that from the attacker points of view, you should change your methods permanently to avoid tracking / fingerprinting.
- yjftsjthsd-h 9y agoExactly; even individuals know that good opsec means changing your footprint; why would full state actors not do so?
- ryanlol 9y agoBecause it would almost certainly diminish their offensive capabilities.
- yjftsjthsd-h 9y agoI suppose considering the cost (time, money, effort) it would have to be used somewhat carefully, but I would expect it to improve offensive capabilities to be able to make attacks that don't look like you. But agreed that it would have to be rationed out, in order to not lose ground in redoing things.
- ryanlol 9y agoSuch capabilities obviously exist, but are almost never worth deploying. Attribution rarely seems to be a significant concern for the people running these ops.
- Kalium 9y agoAdditionally, human beings are lazy. Getting people to stick to what look like pointlessly complex processes is not a trivial matter.
- deleted 9y ago[deleted]
- 3pt14159 9y agoIt’s also a game of burning unused methods when it’s irrelevant to stay 100% black. Hitting something that the NSA truly wants none to trace back to them works better if most of their other attacks work with the same combination of tools.
- at-fates-hands 9y ago>> APT groups have a set of tools, techniques, and processes (ttps) that they use. This is interesting considering recent high profile attacks (The DNC, OPM, Sony) have pointed to state actors, but many in the InfoSec community have come back and said many of the tools have been out in the Wild for years. It means almost any hacking team could be using them, indicating that many of the tools are common amongst these groups so pinning a hack to a specific group because of the tools they used isn't a reliable way to track them. Not my opinion, just something that would seem to contradict the idea that a set of tools indicates who the actors are.
- spydum 9y agoIt doesn't contradict anything, it just lowers the probability of being right a hair (For the extreme few APTs who would bother with such trivialities), hence the "attribution is bullshit" -- you can't ever know. However, that does NOT contradict the simple fact that various APT groups do absolutely use the same tried and true TTPs get get in, gain foothold, and persist. They evolve them over time, but you'd be foolish to think they entirely wing it each time, using a chaotic set of techniques. They establish patterns, and you can absolutely build a signature off of that.