5 ms·

I am not saying Russia isn't involved in this, but when in general reading the media, it is always 'Russian hackers [this]' and 'Russian hackers [that]', almost

by rapnie 8y ago

I am not saying Russia isn't involved in this, but when in general reading the media, it is always 'Russian hackers [this]' and 'Russian hackers [that]', almost like any hacker is a Russian hacker. Hackers are everywhere, and - last I heard - the West is also quite good at it. With regards to influencing elections (not only by hacking, but using any other 'legal' - yet not-so-ethical - means) I wonder, if after the supposed effectiveness of the (still under investigation) previous election meddling (and also with parties like Cambridge Analytica in mind), anyone involved in the mid-terms can afford to not go all-in with these same kind of tools (like a digital arms race)? And if they want to go further and create fake news, use botnets to spread it, and hack opponents to get dirt, how easy it is to make it appear like Russia is behind it (could even be a possible win-win if you are anti-Russia)?

graeme 8y ago
It's Microsoft saying it, so presumably they may have some actual technical reasons to believe it's Russians, no?
- rapnie 8y ago
  Like I say at the top, I am not talking about this occurence specifically, but in general when this kind of hacking is mentioned. It is always and only Russians. Like no one else might have an interest. I am honestly wondering if this is the case. Also it would be theoretically possible (and easy?) for someone from outside Russia to e.g. hire some Russian hackers, would it not?
  - intern4tional 8y ago
    I disagree with your statement. I would say that given current events and the coverage of them you are seeing Russia more that other entities. This happens for a variety of reasons, some technical, some political. The technical ones are when indicators for an active APT group are released it becomes easier for others in the industry to see them and to catch them or report on their activity. This results in that group having more attention in the media as firms publish their findings. The prior US administration took the step of sharing many of those indicators with the industry and so the Russians are getting caught more often. This has happened before. Remember the 'Aurora' incident that Google had around 2010? That time frame from 2006-2014 the Chinese were dominating the news for this sort of espionage. In short, I think that we are simply catching the Russians more often right now as they haven't had time to retool or cover their tracks and there are active defensive campaigns targeting their teams. Obviously other countries have an interest (including the US - remember the Vault7 leaks?). As an example, there was an article on HN just recently about how the Chinese rolled up the CIA network in their country via a compromise of the CIA's messaging system. As far as hiring Russians, the specific groups that firms like Microsoft track are ones composed of government entities (hence the article notes 'Hackers linked to Russian government entities..'). They are not generally hirable by third parties.
  - dfxm12 8y ago
    I don't think it is, but luckily we don't have to take anyone's word or intuition. It should be easy enough to set up a test to see for yourself: https://duckduckgo.com/?q=-russian+hackers&t=hg&iar=news&ia=news https://duckduckgo.com/?q=-russian+hackers&t=hg&iar=news&ia=... https://www.google.com/search?q=hackers+-russian&source=lnms&tbm=nws&sa=X&ved=0ahUKEwjIqZDQ3v7cAhVHzqQKHZfTCOIQ_AUICigB&biw=1536&bih=728 https://www.google.com/search?q=hackers+-russian&source=lnms... Lots of stories about generic hackers, Chinese hackers, North Korean hackers, etc. within the past 24 hours. You can even take this a step further and search "<country denonym> hackers -russian" and see what comes up. Apparently some Canadian hackers recently came into a windfall of bitcoin.
drak0n1c 8y ago
The file metadata and IP address geocoding that is used to identify "Russian hackers" in these stories is trivially easy to spoof with scripts, VPNs, and basic computer settings. The fact that it's being used as headline-worthy ID of the nationality of supposedly scary, dedicated, election-influencing government hackers is laughable. At best a responsible journalist should mention the possibility, with some technical skepticism, inside the article. Not the headline.
- intern4tional 8y ago
  Microsoft is well aware that things can be spoofed, and has a very talented threat intelligence organization that would not make this claim without substantial proof. This includes things like encryption keys and other non-public identifiers. Should those items be made public, the adversary they are combatting would then roll those indicators and leave Microsoft blind. This isn't unique to Microsoft either, most security / threat intelligence companies have their own swath of private signatures. The sites reporting on this are aware of that issue (non-public signatures) and as such do not need to offer a disclaimer. Microsoft is the one making the claim and they have the reputation to back it up. Unless there are solid reasons to question Microsoft's work there is no need to include your unlikely scenario.
- codedokode 8y ago
  Usually they compare found samples with samples used in other attacks. So they can assume that they were made by the same group.

by rapnie 8y ago

graeme 8y ago

It's Microsoft saying it, so presumably they may have some actual technical reasons to believe it's Russians, no?

rapnie 8y ago
Like I say at the top, I am not talking about this occurence specifically, but in general when this kind of hacking is mentioned. It is always and only Russians. Like no one else might have an interest. I am honestly wondering if this is the case. Also it would be theoretically possible (and easy?) for someone from outside Russia to e.g. hire some Russian hackers, would it not?
- intern4tional 8y ago
  I disagree with your statement. I would say that given current events and the coverage of them you are seeing Russia more that other entities. This happens for a variety of reasons, some technical, some political. The technical ones are when indicators for an active APT group are released it becomes easier for others in the industry to see them and to catch them or report on their activity. This results in that group having more attention in the media as firms publish their findings. The prior US administration took the step of sharing many of those indicators with the industry and so the Russians are getting caught more often. This has happened before. Remember the 'Aurora' incident that Google had around 2010? That time frame from 2006-2014 the Chinese were dominating the news for this sort of espionage. In short, I think that we are simply catching the Russians more often right now as they haven't had time to retool or cover their tracks and there are active defensive campaigns targeting their teams. Obviously other countries have an interest (including the US - remember the Vault7 leaks?). As an example, there was an article on HN just recently about how the Chinese rolled up the CIA network in their country via a compromise of the CIA's messaging system. As far as hiring Russians, the specific groups that firms like Microsoft track are ones composed of government entities (hence the article notes 'Hackers linked to Russian government entities..'). They are not generally hirable by third parties.
- dfxm12 8y ago
  I don't think it is, but luckily we don't have to take anyone's word or intuition. It should be easy enough to set up a test to see for yourself: https://duckduckgo.com/?q=-russian+hackers&t=hg&iar=news&ia=news https://duckduckgo.com/?q=-russian+hackers&t=hg&iar=news&ia=... https://www.google.com/search?q=hackers+-russian&source=lnms&tbm=nws&sa=X&ved=0ahUKEwjIqZDQ3v7cAhVHzqQKHZfTCOIQ_AUICigB&biw=1536&bih=728 https://www.google.com/search?q=hackers+-russian&source=lnms... Lots of stories about generic hackers, Chinese hackers, North Korean hackers, etc. within the past 24 hours. You can even take this a step further and search "<country denonym> hackers -russian" and see what comes up. Apparently some Canadian hackers recently came into a windfall of bitcoin.

drak0n1c 8y ago

The file metadata and IP address geocoding that is used to identify "Russian hackers" in these stories is trivially easy to spoof with scripts, VPNs, and basic computer settings. The fact that it's being used as headline-worthy ID of the nationality of supposedly scary, dedicated, election-influencing government hackers is laughable. At best a responsible journalist should mention the possibility, with some technical skepticism, inside the article. Not the headline.

intern4tional 8y ago
Microsoft is well aware that things can be spoofed, and has a very talented threat intelligence organization that would not make this claim without substantial proof. This includes things like encryption keys and other non-public identifiers. Should those items be made public, the adversary they are combatting would then roll those indicators and leave Microsoft blind. This isn't unique to Microsoft either, most security / threat intelligence companies have their own swath of private signatures. The sites reporting on this are aware of that issue (non-public signatures) and as such do not need to offer a disclaimer. Microsoft is the one making the claim and they have the reputation to back it up. Unless there are solid reasons to question Microsoft's work there is no need to include your unlikely scenario.
codedokode 8y ago
Usually they compare found samples with samples used in other attacks. So they can assume that they were made by the same group.