4 ms·

So I'm not an expert by any means, but from what I understand, estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial eviden

So I'm not an expert by any means, but from what I understand, estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial evidence, including IP addresses, malware signature, and possibly timestamps/localizations within the binaries. All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any state actor/group who's modus operandi are known in hacking circles, no? Which, incidentally, is why I had issue with the certainty with which croudstrike, for example, pointed to Russia over the DNC hack. Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail...and these are hackers we're talking about, after all.

philprx 7y ago
Hackers do cover their track, actively. But guess what, they're human and they fail, sometimes, not always. Attribution becomes a playable game once you're a nation state, thanks to many "unfair advantages". ... In the end, many thing gets known.
lawnchair_larry 7y ago
Since you admit that you’re not an expert, you shouldn’t really assume that attribution is that simple, or that they aren’t fully aware of these things you mention.
- stefan_ 7y ago
  Because all of these things being trivially manipulated means in the past, attribution was entirely done for nation states to point at other nation states or for scam artists to promote their cyber cyber cyber security technology consulting services. If there is such a thing as "the science of attribution", and that is very questionable, it sure as hell isn't above the noise floor.
  - lawnchair_larry 7y ago
    No, that is not the case.
- catalogia 7y ago
  Since he admits he isn't an expert, maybe you shouldn't scold him for probing the depths of his knowledge and asking questions to expand his understanding.
  - lawnchair_larry 7y ago
    I’m not, and he isn’t really doing that either. He started by saying he isn’t an expert, and then attacked a straw man and challenged the work of actual experts, based on his incorrect assumptions of what they do. This is like what antivaxxers do, or like claiming that jet fuel can’t melt steel beams. Inquiry is fine, but never criticize from a position of ignorance.
    - catalogia 7y ago
      Comparing the guy to antivaxxers or 911 truthers goes a bit further than merely scolding him... In for a penny, in for a pound?
    - allovernow 7y ago
      Don't lump me in with antivaxxers just because I'm being critical of something. Even if I'm not an expert I'm an experienced software developer and a generalist. This is a plausible suspicion and even then, look at the answers: most of them boil down to yeah, hackers cover tracks, but sometimes they screw up and leave behind clues - which really means we may only be catching the shitty ones. It's exactly the kind of business that potentially could be populated by dishonest and/or overconfident people, like people have been doing with arson for decades. There's the same lack of verifiability - you can finger a group, but how often do you get any sort of confirmation? In any case, the fact that "anti vaxxers" use certain lines of questioning doesn't mean that the truth seeking methods are themselves suspect. Some people are pessimists, and rightly so; isn't that what hacking is all about?
      - Kalium 7y ago
        Your argument seems to take the general form of "non-expert does not understand specialty field, doubts veracity of experts in field". It's understandable that some might be skeptical of any argument of this form, as they are all essentially arguments from incomprehension and incredulity. The specialty here isn't software, really. It's intelligence. That's a very different field and knowing something generally about how computers work might not translate into as much relevant expertise as one could hope for. I know my expertise in software security doesn't equip me to do this kind of intelligence analysis. IMO, that doesn't leave me with a lot of standing to comment substantively on many - even most - aspects of such analysis.
miglmj 7y ago
> estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial evidence, including IP addresses, malware signature, and possibly timestamps/localizations within the binaries. There's more to it than that, and often attribution is the result of the "bigger picture" of multiple clues, rather than a single smoking gun. Group operations develop patterns over time that are much greater than just a timestamp somewhere. Also, identifying a 0-day exploit somewhere often allows you to discover previous deployments of the same exploit, which have their own blast radius of evidence, contributing to these patterns that are identified over time. >but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no? >Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail... Yes, misdirection is the name of the game here, all bets are off and nothing is off limits. But covering your tracks leaves tracks of its own, and again, even when an attacker thinks all their bases are covered, they will never be sure there wasn't something somewhere they left behind that points back to them. > and these are hackers we're talking about, after all. Who do you think "hacker-hunters" are, if not hackers themselves?
- deleted 7y ago
  [deleted]
EthanHeilman 7y ago
The question should not be "can hacks be attributed by digital evidence alone" of course they can. The question should be, in this specific case: 1. How much evidence do we have? 2. How hard would it be for the hackers fake this evidence? 3. Are there any signs of forgeries? For instance logs that don't agree, file system artifacts, etc... 4. What were the capabilities of the attacker? The longer a hack goes on and the larger its scale the harder it gets to forge 100% of the evidence. >All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no? I would say no, doing that is very difficult and is not trivial to do. All cases I've read up on, such as stuxnet, flame, APT-1 etc..., had clues as to the origin of the malware and such clues were left in the malware accidentally.
nyolfen 7y ago
the strongest evidence is that all of the targets are of geopolitical or local importance to turkey. i'm not sure why anybody else would hack the turkish freemasons.
nl 7y ago
So I'm not an expert by any means It's interesting - it's people who know a little bit who are doubtful about attribution, while those who actually know this understand it's possible to be pretty confident in many cases. It's hard to tell in this case, but the Crowdstrike report gives a lot of evidence which would persuade most in the field. Generally speaking the best form of evidence is unique binaries which have been used in other attacks. Then you cluster attacks based on this information and other signatures. It's pretty hard to fake all of the required signatures at once, and most of the time a group doesn't really care. It's much more robust than you seem to think - spoofing it occasionally is viable for a once-off attack, but doing the spoofing usually burns your access and methods so it's really expensive. It's not the kind of thing one burns on something like this attack or the DNC hack. The DNC hack is a good example really - they had no idea how effective the misinformation campaign would be at the time, so why would they complicate it by trying to make it misattributable.
- lawnchair_larry 7y ago
  The funniest part about the ignorant attribution skeptics who think this kind of thing is done based on IP addresses or binary metadata is that in this particular case another intelligence agency actually hacked the systems they were hacking from in the Russian government facility, turned on their webcams, and got their faces while they were hacking. The attribution was already solid without that, but that’s icing on the cake.

philprx 7y ago

Hackers do cover their track, actively. But guess what, they're human and they fail, sometimes, not always. Attribution becomes a playable game once you're a nation state, thanks to many "unfair advantages". ... In the end, many thing gets known.

lawnchair_larry 7y ago

Since you admit that you’re not an expert, you shouldn’t really assume that attribution is that simple, or that they aren’t fully aware of these things you mention.

stefan_ 7y ago
Because all of these things being trivially manipulated means in the past, attribution was entirely done for nation states to point at other nation states or for scam artists to promote their cyber cyber cyber security technology consulting services. If there is such a thing as "the science of attribution", and that is very questionable, it sure as hell isn't above the noise floor.
- lawnchair_larry 7y ago
  No, that is not the case.
catalogia 7y ago
Since he admits he isn't an expert, maybe you shouldn't scold him for probing the depths of his knowledge and asking questions to expand his understanding.
- lawnchair_larry 7y ago
  I’m not, and he isn’t really doing that either. He started by saying he isn’t an expert, and then attacked a straw man and challenged the work of actual experts, based on his incorrect assumptions of what they do. This is like what antivaxxers do, or like claiming that jet fuel can’t melt steel beams. Inquiry is fine, but never criticize from a position of ignorance.
  - catalogia 7y ago
    Comparing the guy to antivaxxers or 911 truthers goes a bit further than merely scolding him... In for a penny, in for a pound?
  - allovernow 7y ago
    Don't lump me in with antivaxxers just because I'm being critical of something. Even if I'm not an expert I'm an experienced software developer and a generalist. This is a plausible suspicion and even then, look at the answers: most of them boil down to yeah, hackers cover tracks, but sometimes they screw up and leave behind clues - which really means we may only be catching the shitty ones. It's exactly the kind of business that potentially could be populated by dishonest and/or overconfident people, like people have been doing with arson for decades. There's the same lack of verifiability - you can finger a group, but how often do you get any sort of confirmation? In any case, the fact that "anti vaxxers" use certain lines of questioning doesn't mean that the truth seeking methods are themselves suspect. Some people are pessimists, and rightly so; isn't that what hacking is all about?
    - Kalium 7y ago
      Your argument seems to take the general form of "non-expert does not understand specialty field, doubts veracity of experts in field". It's understandable that some might be skeptical of any argument of this form, as they are all essentially arguments from incomprehension and incredulity. The specialty here isn't software, really. It's intelligence. That's a very different field and knowing something generally about how computers work might not translate into as much relevant expertise as one could hope for. I know my expertise in software security doesn't equip me to do this kind of intelligence analysis. IMO, that doesn't leave me with a lot of standing to comment substantively on many - even most - aspects of such analysis.

miglmj 7y ago

> estimating hacker provenance consists purely of modifiable and/or spoofable circumstantial evidence, including IP addresses, malware signature, and possibly timestamps/localizations within the binaries. There's more to it than that, and often attribution is the result of the "bigger picture" of multiple clues, rather than a single smoking gun. Group operations develop patterns over time that are much greater than just a timestamp somewhere. Also, identifying a 0-day exploit somewhere often allows you to discover previous deployments of the same exploit, which have their own blast radius of evidence, contributing to these patterns that are identified over time. >but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no? >Deliberately engineering your attack to mimic one from another group is an excellent way to keep people off your trail... Yes, misdirection is the name of the game here, all bets are off and nothing is off limits. But covering your tracks leaves tracks of its own, and again, even when an attacker thinks all their bases are covered, they will never be sure there wasn't something somewhere they left behind that points back to them. > and these are hackers we're talking about, after all. Who do you think "hacker-hunters" are, if not hackers themselves?

deleted 7y ago
[deleted]

EthanHeilman 7y ago

The question should not be "can hacks be attributed by digital evidence alone" of course they can. The question should be, in this specific case: 1. How much evidence do we have? 2. How hard would it be for the hackers fake this evidence? 3. Are there any signs of forgeries? For instance logs that don't agree, file system artifacts, etc... 4. What were the capabilities of the attacker? The longer a hack goes on and the larger its scale the harder it gets to forge 100% of the evidence. >All of this makes a convincing story for media and laymen, but surely a competent hacker could pull of a hack and trivially modify the evidence to implicate any nation/state who's modus operandi are known in hacking circles, no? I would say no, doing that is very difficult and is not trivial to do. All cases I've read up on, such as stuxnet, flame, APT-1 etc..., had clues as to the origin of the malware and such clues were left in the malware accidentally.

nyolfen 7y ago

the strongest evidence is that all of the targets are of geopolitical or local importance to turkey. i'm not sure why anybody else would hack the turkish freemasons.

nl 7y ago

So I'm not an expert by any means It's interesting - it's people who know a little bit who are doubtful about attribution, while those who actually know this understand it's possible to be pretty confident in many cases. It's hard to tell in this case, but the Crowdstrike report gives a lot of evidence which would persuade most in the field. Generally speaking the best form of evidence is unique binaries which have been used in other attacks. Then you cluster attacks based on this information and other signatures. It's pretty hard to fake all of the required signatures at once, and most of the time a group doesn't really care. It's much more robust than you seem to think - spoofing it occasionally is viable for a once-off attack, but doing the spoofing usually burns your access and methods so it's really expensive. It's not the kind of thing one burns on something like this attack or the DNC hack. The DNC hack is a good example really - they had no idea how effective the misinformation campaign would be at the time, so why would they complicate it by trying to make it misattributable.

lawnchair_larry 7y ago
The funniest part about the ignorant attribution skeptics who think this kind of thing is done based on IP addresses or binary metadata is that in this particular case another intelligence agency actually hacked the systems they were hacking from in the Russian government facility, turned on their webcams, and got their faces while they were hacking. The attribution was already solid without that, but that’s icing on the cake.