3 ms·
>> APT groups have a set of tools, techniques, and processes (ttps) that they use. This is interesting considering recent high profile attacks (The DNC, OPM, S
by at-fates-hands 9y ago
>> APT groups have a set of tools, techniques, and processes (ttps) that they use.
This is interesting considering recent high profile attacks (The DNC, OPM, Sony) have pointed to state actors, but many in the InfoSec community have come back and said many of the tools have been out in the Wild for years. It means almost any hacking team could be using them, indicating that many of the tools are common amongst these groups so pinning a hack to a specific group because of the tools they used isn't a reliable way to track them.
Not my opinion, just something that would seem to contradict the idea that a set of tools indicates who the actors are.
- spydum 9y agoIt doesn't contradict anything, it just lowers the probability of being right a hair (For the extreme few APTs who would bother with such trivialities), hence the "attribution is bullshit" -- you can't ever know. However, that does NOT contradict the simple fact that various APT groups do absolutely use the same tried and true TTPs get get in, gain foothold, and persist. They evolve them over time, but you'd be foolish to think they entirely wing it each time, using a chaotic set of techniques. They establish patterns, and you can absolutely build a signature off of that.