4 ms·

how do they know it’s a state organized group?

badrabbit 9y ago
Advanced Persistent Threat (APT aka Nation state) actors are tracked using known indicators of compromise. These indicators can include infrastructure identifiers such as domain names and ip addresses that maybe used in a phishing url or post-compromise for command-and-control or to download other malware. Other indicators can include malware sample hashes or actor-specific detection rules (Example: YARA,Snort or Netwitness rules). These indicators are typically not public. Some can be accessed if you pay the right sum of money and undergo vetting,still,some are kept private within the relevat security firms or organizations. As you can imagine,Google has their hands in many pies including security research and threat intelligence collection(Everyone loves their VirusTotal intelligence product). They can scan email metadata for any of these indicators as they see fit. Generally speaking,some indicators are of such high quality, they can be used to detect well crafted spear phishing by a nation state actor. But most are good only to detect untargeted attacks or targeted attacks that include a large number of targets. Hope that answered your question.
- supergirl 9y ago
  it doesn’t. i was asking how do they know in this case
  - badrabbit 9y ago
    The indicators I mentioned are associated with a nation state actor because the attacks in which they were identified were attributed to a nation state. In other words,the selective targeting and sophistication match the interests of a nation state. Geo-political intelligence analysts and sometimes field officers (aka spies) also play a role. For example,if a specific journalist was attacked while working on an article critical of a specific country and at least one indicator was traced to an a real human associated with that country's spy agency the a confident attribution can be made. The term "nation state" does sound a bit fancy but it is different from "country" in that many nation states do not act on behalf of their people or to protect the interests of their conuntry. If you use "country" that would include the people of the country while "nation state" simply means the organization running the country. Plus you have situations like taiwan,hong kong and chechnya where those nations are effectively their own nation state but they are under the control of a different country. Here is a good reference attribution of APT3 (Chinese Ministry of State Security (MSS)): https://threatpost.com/apt3-linked-to-chinese-ministry-of-state-security/125750/ https://threatpost.com/apt3-linked-to-chinese-ministry-of-st...
- supergirl 9y ago
  also why do people like to use the term nation state when it involves hacking. just to sound fancier? according to wiki nation state has a precise meaning and it’s not equivalent to the term country
  - phaus 9y ago
    I think it's probably due to the fact that when the phrasing became popular, China was almost exclusively the focus. So itay not be accurate now, but at this point it's a habit.
  - docdeek 9y ago
    I wrote my doctorate thesis in international relations theory and taught Intro to IR courses where the difference between country, state, nation, and nation state were covered in week one. You're right that there's a difference between country and nation state (and a difference between nation state and both nation and state, too) but in popular use - including politicians who should know better - the terms are interchangeable.

Advanced Persistent Threat (APT aka Nation state) actors are tracked using known indicators of compromise. These indicators can include infrastructure identifiers such as domain names and ip addresses that maybe used in a phishing url or post-compromise for command-and-control or to download other malware. Other indicators can include malware sample hashes or actor-specific detection rules (Example: YARA,Snort or Netwitness rules). These indicators are typically not public. Some can be accessed if you pay the right sum of money and undergo vetting,still,some are kept private within the relevat security firms or organizations. As you can imagine,Google has their hands in many pies including security research and threat intelligence collection(Everyone loves their VirusTotal intelligence product). They can scan email metadata for any of these indicators as they see fit. Generally speaking,some indicators are of such high quality, they can be used to detect well crafted spear phishing by a nation state actor. But most are good only to detect untargeted attacks or targeted attacks that include a large number of targets. Hope that answered your question.

supergirl 9y ago
it doesn’t. i was asking how do they know in this case
- badrabbit 9y ago
  The indicators I mentioned are associated with a nation state actor because the attacks in which they were identified were attributed to a nation state. In other words,the selective targeting and sophistication match the interests of a nation state. Geo-political intelligence analysts and sometimes field officers (aka spies) also play a role. For example,if a specific journalist was attacked while working on an article critical of a specific country and at least one indicator was traced to an a real human associated with that country's spy agency the a confident attribution can be made. The term "nation state" does sound a bit fancy but it is different from "country" in that many nation states do not act on behalf of their people or to protect the interests of their conuntry. If you use "country" that would include the people of the country while "nation state" simply means the organization running the country. Plus you have situations like taiwan,hong kong and chechnya where those nations are effectively their own nation state but they are under the control of a different country. Here is a good reference attribution of APT3 (Chinese Ministry of State Security (MSS)): https://threatpost.com/apt3-linked-to-chinese-ministry-of-state-security/125750/ https://threatpost.com/apt3-linked-to-chinese-ministry-of-st...
supergirl 9y ago
also why do people like to use the term nation state when it involves hacking. just to sound fancier? according to wiki nation state has a precise meaning and it’s not equivalent to the term country
- phaus 9y ago
  I think it's probably due to the fact that when the phrasing became popular, China was almost exclusively the focus. So itay not be accurate now, but at this point it's a habit.
- docdeek 9y ago
  I wrote my doctorate thesis in international relations theory and taught Intro to IR courses where the difference between country, state, nation, and nation state were covered in week one. You're right that there's a difference between country and nation state (and a difference between nation state and both nation and state, too) but in popular use - including politicians who should know better - the terms are interchangeable.