3 ms·

Same here. I remember once I was watching the news and they claimed a hack was done by Russians because they found Russian comments in the code. That didn't sou

by toshk 6y ago

Same here. I remember once I was watching the news and they claimed a hack was done by Russians because they found Russian comments in the code. That didn't sound very convincing :). The ledger evidence sounds better. At the same time in this case I would be more surprised if the PRC , since their need for control, and since the stakes are extremely high, wasn't doing such things.

bt1a 6y ago
Exactly my friend, seems like it'd be trivial to leave misleading clues.
toshk 6y ago
Was googling to see if I could find a news article to back up my memory. Instead I found an article on Wikileaks claiming CIA executed false flag hacking operations: https://theintercept.com/2017/03/08/wikileaks-files-show-the-cia-repurposing-foreign-hacking-code-to-save-time-not-to-frame-russia/ https://theintercept.com/2017/03/08/wikileaks-files-show-the...
- thephyber 6y ago
  Which is another reason why attribution of cyber incidents is notoriously difficult. The CIA is hardly the only organization to put misleading evidence in their attack path. Also, countries like China and Russia have healthy malware ecosystems so a Chinese-written malware can end up in the payload of a {North Korean, Russian, Iranian} cyber attack. Personally, I'm starting to believe that the only way to have extremely high confidence in attributing an attack is to have surveillance of the person on the source keyboard when it happens or to have telecom evidence of people admitting what they did. Most of the actual attack is probably robotic at this point.
oefrha 6y ago
Similarly, I recall a strain of malware being attributed to Chinese hackers because variable names were in Chinese; then when you actually inspect the code, it's clearly Unicode gibberish generated by an obfuscator... That is to say, the hackers weren't even trying to be misleading, it was just a result of obfuscation reminiscent of mojibake. (I read the article on Ars Technica but don't remember enough details to find the article.) If I ever code a hacking tool I'll throw in some Korean comments for sure.
- WrtCdEvrydy 6y ago
  Do spanish instead... represent!
- darawk 6y ago
  Do keep in mind that intelligence services are probably not being fully transparent about how they know the source of an attack. They wouldn't want to reveal their methods, to avoid them becoming unreliable in the future.
  - vkou 6y ago
    Which makes it impossible to have an open, informed discussion on the subject. Instead, you get tribalist arguments over who believes which secret police.

by toshk 6y ago

bt1a 6y ago

Exactly my friend, seems like it'd be trivial to leave misleading clues.

toshk 6y ago

Was googling to see if I could find a news article to back up my memory. Instead I found an article on Wikileaks claiming CIA executed false flag hacking operations: https://theintercept.com/2017/03/08/wikileaks-files-show-the-cia-repurposing-foreign-hacking-code-to-save-time-not-to-frame-russia/ https://theintercept.com/2017/03/08/wikileaks-files-show-the...

thephyber 6y ago
Which is another reason why attribution of cyber incidents is notoriously difficult. The CIA is hardly the only organization to put misleading evidence in their attack path. Also, countries like China and Russia have healthy malware ecosystems so a Chinese-written malware can end up in the payload of a {North Korean, Russian, Iranian} cyber attack. Personally, I'm starting to believe that the only way to have extremely high confidence in attributing an attack is to have surveillance of the person on the source keyboard when it happens or to have telecom evidence of people admitting what they did. Most of the actual attack is probably robotic at this point.

oefrha 6y ago

Similarly, I recall a strain of malware being attributed to Chinese hackers because variable names were in Chinese; then when you actually inspect the code, it's clearly Unicode gibberish generated by an obfuscator... That is to say, the hackers weren't even trying to be misleading, it was just a result of obfuscation reminiscent of mojibake. (I read the article on Ars Technica but don't remember enough details to find the article.) If I ever code a hacking tool I'll throw in some Korean comments for sure.

WrtCdEvrydy 6y ago
Do spanish instead... represent!
darawk 6y ago
Do keep in mind that intelligence services are probably not being fully transparent about how they know the source of an attack. They wouldn't want to reveal their methods, to avoid them becoming unreliable in the future.
- vkou 6y ago
  Which makes it impossible to have an open, informed discussion on the subject. Instead, you get tribalist arguments over who believes which secret police.