4 ms·

How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And

by chvid 7y ago

How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?

mc32 7y ago
Same people who attribute attacks to North Korea and the Russian federation, etc.
mywittyname 7y ago
You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy. Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive. > Exactly what does it mean to be "state-sponsored"? It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf. > And who provides this analysis? Government agencies and private companies provide these types of analysis services.
bsamuels 7y ago
Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted. Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z" If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization. You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.

by chvid 7y ago

How does one know that a particular attack is "state-sponsored" or originates from a particular country? Exactly what does it mean to be "state-sponsored"? And who provides this analysis?

mc32 7y ago

Same people who attribute attacks to North Korea and the Russian federation, etc.

mywittyname 7y ago

You look at the the target and analyze the methods used in the attack to make that determination. For example, a zero-day exploit involving expensive equipment screams state-sponsored. Criminal enterprises wouldn't waste their money and resources analyzing and attacking Juicero machines in an embassy. Also, the same tools and techniques get recycled, so you can use clues from previous attacks to tie together a motive. > Exactly what does it mean to be "state-sponsored"? It means an attack was either performed by a foreign agency or by a group getting paid to act on their behalf. > And who provides this analysis? Government agencies and private companies provide these types of analysis services.

bsamuels 7y ago

Without talking about the controversial technical indicators of a state sponsored attack, you can figure it out based on the motive, complexity of the attack, and who is being targeted. Criminal attacks have a profit related motive, which can be distilled down into "if we spend $X dollars trying to hack Y, we can probably get a payoff of $Z" If an attack is extremely expensive and has very little potential payoff, you can be pretty sure it's not being done by a criminal organization. You may wonder "how do you prove it's not being done by not-profit motivated hacktivists?". Hacktivist groups usually have limited resources (that doesn't mean they're not dangerous!). If scale of the attack/payload suggests a team of 10-30 skilled professionals working full time for a year or so, it's probably not a hacktivist group. Hacktivist groups also tend to proudly announce responsibility whenever they pull off successful attacks.