6 ms·

> People do this all the time when they don't want to believe. People do this all the time because people working in the sector know [0] that attribution, with

> People do this all the time when they don't want to believe. People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. As such most attribution usually boils down to guessing games based on code samples and used attack vectors but rarely, if ever, on anything actually solid. [0] https://www.schneier.com/blog/archives/2015/01/attack_attribut.html https://www.schneier.com/blog/archives/2015/01/attack_attrib...

mc32 8y ago
Right but on the other hand, with the same hedges people _will_ believe something despite all these qualifications that something was done by someone if it aligns with their politics to believe it.
- freeflight 8y ago
  Accusations like this shouldn't be based on "hedges", as long as they do they only serve to do exactly what you describe: Lead people down predefined conclusions. That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it. In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
  - mc32 8y ago
    I agree with your take but I disagree with hedging being inappropriate here. Hedging just means using qualifications and conditions given some uncertainty in a claim.
lawnchair_larry 8y ago
People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line: More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider. I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess. Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases. People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address. A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/ http://www.robertmlee.org/russian-election-meddling-grizzley...
- mc32 8y ago
  This shows how news orgs will continue to press on with disinformstiin despite having evidence disctediting their claims. Reputable organizations at that.
  - lawnchair_larry 8y ago
    Yes, that's the first half of the article (and the primary motivation). The "Please Stop Arguing About Attribution Without Expertise In It" is the section I was pointing to. This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it. We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.
- freeflight 8y ago
  > When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else. > Attribution isn't simply that the bad packets came from a Chinese IP address. Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much: > Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical "most of which is not even technical" Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers. In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.
strictnein 8y ago
> " if the attackers know what they are doing it actually is impossible" Every attacker makes mistakes. It's not a matter of "knowing what they're doing". They're human.
- freeflight 8y ago
  If we are really talking about organized state sponsored hacking, then the variable of human error is usually minimized trough redundancies and oversight. Unless you want to suggest that on one hand they are sophisticated enough to infiltrate all kinds of hardened systems, but still dumb enough to let themselves get caught in the act while doing so/leaving evidence behind pointing straight back at them. That's why the vast majority of cyber attribution is rarely based on actual technical evidence, but rather on cui bono assumptions and by ascribing certain tools as exclusively used by certain actors. And because none of this a secret, it's a pretty easy to exploit methodology [0]. [0] https://arstechnica.com/information-technology/2017/04/wikileaks-releases-code-that-could-unmask-cia-hacking-operations/ https://arstechnica.com/information-technology/2017/04/wikil...
  - paulie_a 8y ago
    The Australians did exactly that, some binary wasn't scrubbed and pointed directly to their HQ

mc32 8y ago

Right but on the other hand, with the same hedges people _will_ believe something despite all these qualifications that something was done by someone if it aligns with their politics to believe it.

freeflight 8y ago
Accusations like this shouldn't be based on "hedges", as long as they do they only serve to do exactly what you describe: Lead people down predefined conclusions. That's why it's important to point out the difficulties of attribution or else people will simply take it as they see it, without even questioning it. In that context questioning it is not "hedging" anything, it's inquiring about actual evidence, which most rational people should be asking for instead of "hedging" based on political beliefs.
- mc32 8y ago
  I agree with your take but I disagree with hedging being inappropriate here. Hedging just means using qualifications and conditions given some uncertainty in a claim.

lawnchair_larry 8y ago

People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line: More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider. I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess. Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases. People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address. A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/ http://www.robertmlee.org/russian-election-meddling-grizzley...

mc32 8y ago
This shows how news orgs will continue to press on with disinformstiin despite having evidence disctediting their claims. Reputable organizations at that.
- lawnchair_larry 8y ago
  Yes, that's the first half of the article (and the primary motivation). The "Please Stop Arguing About Attribution Without Expertise In It" is the section I was pointing to. This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it. We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.
freeflight 8y ago
> When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else. > Attribution isn't simply that the bad packets came from a Chinese IP address. Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much: > Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical "most of which is not even technical" Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers. In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.

strictnein 8y ago

> " if the attackers know what they are doing it actually is impossible" Every attacker makes mistakes. It's not a matter of "knowing what they're doing". They're human.

freeflight 8y ago
If we are really talking about organized state sponsored hacking, then the variable of human error is usually minimized trough redundancies and oversight. Unless you want to suggest that on one hand they are sophisticated enough to infiltrate all kinds of hardened systems, but still dumb enough to let themselves get caught in the act while doing so/leaving evidence behind pointing straight back at them. That's why the vast majority of cyber attribution is rarely based on actual technical evidence, but rather on cui bono assumptions and by ascribing certain tools as exclusively used by certain actors. And because none of this a secret, it's a pretty easy to exploit methodology [0]. [0] https://arstechnica.com/information-technology/2017/04/wikileaks-releases-code-that-could-unmask-cia-hacking-operations/ https://arstechnica.com/information-technology/2017/04/wikil...
- paulie_a 8y ago
  The Australians did exactly that, some binary wasn't scrubbed and pointed directly to their HQ