3 ms·
A sophisticate team would probably use a mix of public tools, stolen private tools, and unique internally developed tools. Public tools and stolen private tool
by saas_co_de 9y ago
A sophisticate team would probably use a mix of public tools, stolen private tools, and unique internally developed tools.
Public tools and stolen private tools are worse than useless for attribution because they are specifically used to avoid attribution or to cause false attribution.
Accurate attribution, if possible, can only be based on unique internally developed tools, which means you have to have the knowledge of the overall environment to see that some tool is unique and being deployed for the first time, and then track the deployment of that tool across other targets, and correlate it with the deployment of other unique tools.
- hackinthebochs 9y ago>Public tools and stolen private tools are worse than useless for attribution because they are specifically used to avoid attribution or to cause false attribution. Not necessarily. Given enough public tools, combinations of usage can be unique.
- rootw0rm 9y agoAny tool can be obfuscated and mutilated to oblivion...there are brilliant tools around these days that do wonders at the source code level. false attribution shouldn't work. nobody blindly believes binary signatures like we did in the 20th century. accurate attribution can only be based on the whole picture, with a focus on technique. i.e. types of exploits used, styles of shellcode used, c2 key exchange used, intel types gathered, etc. etc. the arms race is real, information doesn't vanish, nothing is simple.