4 ms·

> Twitter did not clarify who these third-parties were, but it did say that some of the IP addresses used in these API exploitation attempts had ties to state-s

> Twitter did not clarify who these third-parties were, but it did say that some of the IP addresses used in these API exploitation attempts had ties to state-sponsored actors, a term used to described either government intelligence agencies, or third-party hacking groups that benefit from a government's backing. Can someone explain this to me please? Are "state-sponsored hackers" this foolish to use the same IP addresses as previous, known IP's used in hacks? Or is this just the current "because terrorism / because pedophiles" used to cover incompetence? I don't get it...

BurnGpuBurn 7y ago
Yeah I never believe the "state-sponsored" hackers claim, or any claim to the location of them, until those hackers get caught and convicted based on real evidence. It's basically guesswork anyway. And certainly to a company like Twitter who doesn't even have the capabilities to really investigate a hack, compared to say the NSA, CIA or similar spooks.
meowface 7y ago
I've been involved in research of this nature, though not specifically attributing APTs. Think of it like old school detective work: every crime and every criminal leaves traces, including the traces of the ways they attempt to prevent being traced. This sometimes also includes attempts to impersonate other entities ("false flags"). No matter how many layers of indirection an attacker uses, there's going to be at least one thread to pull on. There's no equivalent to DNA testing, but sometimes you can have pretty high confidence in an attribution. To be clear, this goes incredibly far beyond looking at IP address geolocation or whatever. That's less than 1% of what you're looking at. That'd be like police assuming a death threat was signed with someone's real name. There's no way of knowing exactly what they identified or how they did it or if they got it right. I wish more companies would release such information and how they conducted the entire analysis (some do), though I understand that may not be possible due to legal and counter-intelligence reasons.

BurnGpuBurn 7y ago

Yeah I never believe the "state-sponsored" hackers claim, or any claim to the location of them, until those hackers get caught and convicted based on real evidence. It's basically guesswork anyway. And certainly to a company like Twitter who doesn't even have the capabilities to really investigate a hack, compared to say the NSA, CIA or similar spooks.

meowface 7y ago

I've been involved in research of this nature, though not specifically attributing APTs. Think of it like old school detective work: every crime and every criminal leaves traces, including the traces of the ways they attempt to prevent being traced. This sometimes also includes attempts to impersonate other entities ("false flags"). No matter how many layers of indirection an attacker uses, there's going to be at least one thread to pull on. There's no equivalent to DNA testing, but sometimes you can have pretty high confidence in an attribution. To be clear, this goes incredibly far beyond looking at IP address geolocation or whatever. That's less than 1% of what you're looking at. That'd be like police assuming a death threat was signed with someone's real name. There's no way of knowing exactly what they identified or how they did it or if they got it right. I wish more companies would release such information and how they conducted the entire analysis (some do), though I understand that may not be possible due to legal and counter-intelligence reasons.