6 ms·

How is it possible to attribute cyberattacks to a state sponsored hacking programme?

• mises 7y ago
  Very. Honestly, they're often not that stealthy (especially N. Korea and Iran) because they have the mantle of an evil regime behind which they can hide. China and Russia barely moreso. Companies with whom I work have been ransomed by these actors, and the FBI has almost always said they know who did it and can do nothing. Policy set higher than them.
  • deleted 7y ago
    [deleted]
• lawnchair_larry 7y ago
  Many ways. It’s hard to move $2B while being the target of several rival states intelligence gathering and not leave a trail that leads back to you.
• jdm2212 7y ago
  Often, our intel has hacked their intel and watched them do it. For example: the US is certain that North Korea was behind the Sony hack because South Korean intelligence hacked North Korean intelligence, and the NSA hacked South Korean intelligence. So the NSA found that it could access Sony servers by going through SK intel to NK intel to Sony. Another example: one of Cozy and Fancy Bear (don't remember which) is known definitely to be Russian because Dutch intelligence hacked the CCTV cameras outside their Moscow office and was able to correlate times when they conducted spearphishing operations with times when known Russian government hackers were in the office and specific, spearphishing-related Google searches were being issued from computers in the office.
  • pfundstein 7y ago
    Russian hackers using Google instead of Yandex or other? Or is Google here a metaphor for 'searching the internet'?
    • tfha 7y ago
      Sloppy opsec is the standard.
    • jdm2212 7y ago
      I think it was actually Google, but I read the article a while back and it might've been Yandex.
• kpthrow 7y ago
  1) A classified attribution involving intelligence collection. It could be anything from corrupted foreign officials to hacking 2) A law enforcement investigation would ideally be built upon a collection of circumstantial evidence combined with mistakes by the hacker. In the case of Russia, one of their hackers forgot to log into the VPN before logging into the Guccifer social media account.
• throwbaccAndy 7y ago
  Most likely ip address.