4 ms·
The file metadata and IP address geocoding that is used to identify "Russian hackers" in these stories is trivially easy to spoof with scripts, VPNs, and basic
by drak0n1c 8y ago
The file metadata and IP address geocoding that is used to identify "Russian hackers" in these stories is trivially easy to spoof with scripts, VPNs, and basic computer settings. The fact that it's being used as headline-worthy ID of the nationality of supposedly scary, dedicated, election-influencing government hackers is laughable.
At best a responsible journalist should mention the possibility, with some technical skepticism, inside the article. Not the headline.
- intern4tional 8y agoMicrosoft is well aware that things can be spoofed, and has a very talented threat intelligence organization that would not make this claim without substantial proof. This includes things like encryption keys and other non-public identifiers. Should those items be made public, the adversary they are combatting would then roll those indicators and leave Microsoft blind. This isn't unique to Microsoft either, most security / threat intelligence companies have their own swath of private signatures. The sites reporting on this are aware of that issue (non-public signatures) and as such do not need to offer a disclaimer. Microsoft is the one making the claim and they have the reputation to back it up. Unless there are solid reasons to question Microsoft's work there is no need to include your unlikely scenario.
- codedokode 8y agoUsually they compare found samples with samples used in other attacks. So they can assume that they were made by the same group.