4 ms·

FYI, almost nobody in Russia uses Cyrillic in the programs/scripts. Most people write comments, variable names, even error messages in English. So when I read t

FYI, almost nobody in Russia uses Cyrillic in the programs/scripts. Most people write comments, variable names, even error messages in English. So when I read that some malware was attributed to us because of Cyrillic, for me it's a sure sign of bullshit.

vardump 8y ago
Huh? So a perfect way for a Russian party to hide its tracks is to actually use Cyrillic. No matter which option you pick, you set up yourself to be deceived. In other words, better to just consider character set doesn't convey much information at all.
- anticodon 8y ago
  I think it's close to impossible to really tell where malware originated. It's a opening another way for US to blame any country arbitrarily. You want to bomb Iran: just say that there were Farsi letters in the malware. Or the first infection happened in Iran. Or some Iranian was in the country where malware was spotted for the first time. It's not possible to prove or deny. And nobody will ever be able to confirm anyway. US can say: "We have experts on Russian malware that said new virus contains a string "Сделано в СССР в помощь Трампу. С 23 февраля!", so Trump is definitely a Russian agent". There's zero logic or proof in this, but with strong propaganda almost everybody will believe it anyway.
  - m0zg 8y ago
    This is a weakness of the United States. People here have never had to "read between the lines". Even now, when the whole propaganda apparatus was revealed in the aftermath of the 2016 election cycle most people refuse to admit they are being routinely manipulated and lied to. In contrast, I'd say people who believe mass media in Russia 100% are in the minority. It's not even a question there in the minds of most Russians that they're being lied to. Here in the US if it's in one of the main news outlets (all of which are controlled by like 5 people, who in turn are controlled mostly by the political establishment) easily 90% will take it at face value and won't see the narrative behind it.
Khaine 8y ago
Unless they have reproducible builds, information of the locale of the compiler gets added into metadata and other bits and pieces of the malware and that is how it gets tracked. Yes this information can be faked, which is why they try to confirm with other intelligence

vardump 8y ago

Huh? So a perfect way for a Russian party to hide its tracks is to actually use Cyrillic. No matter which option you pick, you set up yourself to be deceived. In other words, better to just consider character set doesn't convey much information at all.

anticodon 8y ago
I think it's close to impossible to really tell where malware originated. It's a opening another way for US to blame any country arbitrarily. You want to bomb Iran: just say that there were Farsi letters in the malware. Or the first infection happened in Iran. Or some Iranian was in the country where malware was spotted for the first time. It's not possible to prove or deny. And nobody will ever be able to confirm anyway. US can say: "We have experts on Russian malware that said new virus contains a string "Сделано в СССР в помощь Трампу. С 23 февраля!", so Trump is definitely a Russian agent". There's zero logic or proof in this, but with strong propaganda almost everybody will believe it anyway.
- m0zg 8y ago
  This is a weakness of the United States. People here have never had to "read between the lines". Even now, when the whole propaganda apparatus was revealed in the aftermath of the 2016 election cycle most people refuse to admit they are being routinely manipulated and lied to. In contrast, I'd say people who believe mass media in Russia 100% are in the minority. It's not even a question there in the minds of most Russians that they're being lied to. Here in the US if it's in one of the main news outlets (all of which are controlled by like 5 people, who in turn are controlled mostly by the political establishment) easily 90% will take it at face value and won't see the narrative behind it.

Khaine 8y ago

Unless they have reproducible builds, information of the locale of the compiler gets added into metadata and other bits and pieces of the malware and that is how it gets tracked. Yes this information can be faked, which is why they try to confirm with other intelligence