3 ms·

People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know wha

People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. This is wrong. Schneier has no idea what he is talking about (as usual). The funny part is that he opens with skepticism about the North Korea/Sony hack, of which many were skeptical early on, but now is not disputed by anybody. So he was wrong about that too. So very wrong. Especially this line: More likely, the culprits are random hackers who have loved to hate Sony for over a decade, or possibly a disgruntled insider. I'll be honest, I was skeptical of that one too. But I knew what I didn't know, so instead of challenging experts or trying to get my uninformed opinion out in the public sphere, I kept that to myself. And when I heard someone who I know would know make the NK claim without hesitation, it made me re-evaluate some assumptions. When it turned out that they were correct, I knew it was not a lucky guess. Attribution is not easy, but it's absolutely not impossible in all cases, or even difficult in many cases. People who understand technology make a lot of assumptions about how attribution works, and then make assertions like this. Attribution isn't simply that the bad packets came from a Chinese IP address. A good rant on the topic is here: http://www.robertmlee.org/russian-election-meddling-grizzleysteppe-and-bananas/ http://www.robertmlee.org/russian-election-meddling-grizzley...

mc32 8y ago
This shows how news orgs will continue to press on with disinformstiin despite having evidence disctediting their claims. Reputable organizations at that.
- lawnchair_larry 8y ago
  Yes, that's the first half of the article (and the primary motivation). The "Please Stop Arguing About Attribution Without Expertise In It" is the section I was pointing to. This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it. We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.
freeflight 8y ago
> When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else. > Attribution isn't simply that the bad packets came from a Chinese IP address. Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much: > Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical "most of which is not even technical" Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers. In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.
- lawnchair_larry 8y ago
  You have no experience in this. Why do you keep insisting on challenging experts in the field? Clustering assumptions is still not accurate. Give it a rest.
  - freeflight 8y ago
    That's rich coming from somebody who claimed Bruce Schneier doesn't know what he's talking about, before linking to a "rant", driving down exactly the same points I made, by a CEO of an InfoSec outfit, a former NSA spook to boot, praising the accuracy of his own service. Sorry, but let's just agree to disagree, it's clear there ain't anything else left to do here.
    - lawnchair_larry 8y ago
      Sounds good. You clearly have no idea how this industry works, and don't know who is reputable and who is not.
cf141q5325 8y ago
Rant is the right word, though he makes a rather good summary >Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well. Which is completely in line with. > People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.
- lawnchair_larry 8y ago
  That's not what he's saying at all, and what you are saying is plain and simply wrong.
  - cf141q5325 8y ago
    Please do elaborate. 1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood. 2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear. You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.
    - lawnchair_larry 8y ago

mc32 8y ago

This shows how news orgs will continue to press on with disinformstiin despite having evidence disctediting their claims. Reputable organizations at that.

lawnchair_larry 8y ago
Yes, that's the first half of the article (and the primary motivation). The "Please Stop Arguing About Attribution Without Expertise In It" is the section I was pointing to. This is to say nothing about this particular case. I have no idea how solid the attribution is here. But the same comments to dismiss the whole idea of attribution out of hand come up every time, and they don't get it. We shouldn't take it on blind faith that some attribution is accurate because it appears in the press. But we also should not interject with uninformed speculation about how we think attribution works, and then attack that straw man so they can cast aspersions on the motives of those making said attributions.

freeflight 8y ago

> When it turned out that they were correct, I knew it was not a lucky guess. And when did that happen? You do realize that the US DoJ charging somebody still isn't "evidence"? Just like claims that some NK agents coded something are mostly based on code heuristics and usually nothing else. > Attribution isn't simply that the bad packets came from a Chinese IP address. Where did I ever claim that? It's the whole reason why I pointed out what I did. Even your linked "rant" agrees that much: > Attribution is not done with single pieces of evidence or a smoking gun it is done as analysis on complex data sets most of which is not even technical "most of which is not even technical" Just because you are clustering together a bunch of assumptions still doesn't make them any more than assumptions. Just like companies working in the sector have a vested interest in making it look like they are more certain than they actually are because nobody pays them for "maybes", people pay them with the expectation of getting solid answers. In that context, it does not really help to harp on about "MOs" and how other security firms totally agreed with some attribution, they are all just wild-guessing based on what they expect the opposition to use and what fits their "MO". Assumptions which are extremely easy to exploit for anybody willing to go the distance.

lawnchair_larry 8y ago
You have no experience in this. Why do you keep insisting on challenging experts in the field? Clustering assumptions is still not accurate. Give it a rest.
- freeflight 8y ago
  That's rich coming from somebody who claimed Bruce Schneier doesn't know what he's talking about, before linking to a "rant", driving down exactly the same points I made, by a CEO of an InfoSec outfit, a former NSA spook to boot, praising the accuracy of his own service. Sorry, but let's just agree to disagree, it's clear there ain't anything else left to do here.
  - lawnchair_larry 8y ago
    Sounds good. You clearly have no idea how this industry works, and don't know who is reputable and who is not.

cf141q5325 8y ago

Rant is the right word, though he makes a rather good summary >Attribution is not about having a smoking gun. Attribution is a good example of doing true intelligence analysis; there are no certainties and you only can come to an assessment such as low, moderate, or high confidence. Almost every single piece of data put forward in that assessment can and should have counters to it. Very reasonable counters as well. Which is completely in line with. > People do this all the time because people working in the sector know [0] that attribution, with anything "cyber", is near impossible, if the attackers know what they are doing it actually is impossible. And that is plain and simply right. There is no credible way to actually attribute anything cyber. You can make an argument, that something looks like it was done by X, but not that something was actually done by X.

lawnchair_larry 8y ago
That's not what he's saying at all, and what you are saying is plain and simply wrong.
- cf141q5325 8y ago
  Please do elaborate. 1. Attribution is not about proofing something, or finding "the one proof", but about verbalizing that there are indications that someone might be responsible. And quantifying this likelihood. 2. Having a reasonable level of attribution of cyber attacks cant ever be realistic if your opponent isnt a moron, as the indications you work with can be artificially created to fool you. There is no way to differentiate between a high likelihood attribution and a clever enough framing. While this is also true for real life attribution, for lets say chemical weapons, it is much easier to create indications in cyber attacks. And the incentives to do so are clear. You are taking one reasonable critique, that you cant expect a "one proof" in attribution and turn it around to make attribution to something that could actually proof something. The limit of attributions is that you can vocalize, to what degree something looks like it was done by someone. Nothing less but also nothing more.
  - lawnchair_larry 8y ago