5 ms·
Can someone explain how individuals are identified when we are talking about state sponsored hackers?
by kasperni 6y ago
Can someone explain how individuals are identified when we are talking about state sponsored hackers?
- sam_lowry_ 6y agoBy detractors? By cyberattacks? Good old espionage?
- povik 6y agoI have wondered about the same.
- wyldfire 6y agoHUMINT probably.
- defen 6y agoSometimes you catch them on camera https://apnews.com/article/ef3b036949174a9b98d785129a93428b https://apnews.com/article/ef3b036949174a9b98d785129a93428b
- somurzakov 6y agothey probably have a database of the entire GRU hackers squad (Unit 74455) and cross-matched the actions with people's background (people have resumes, social networks, educational background, etc.). also google location services might have some data on them too
- ciarannolan 6y agoIn the past they have texted specific GRU agents on their personal phones: https://www.wired.com/story/cyber-command-ira-strike-sends-signal/ https://www.wired.com/story/cyber-command-ira-strike-sends-s... > As The New York Times reported last October, Cyber Command operators sent direct messages to individual Russian staffers that they had identified as involved in election interference, and were tracking their activity. The Post reports that the IRA was troubled enough by those messages that they launched an internal investigation to identify potential leakers. I have a feeling that the US and allied countries are pretty deep into the Russians with this stuff.
- FDSGSG 6y agoIRA is not GRU
- ciarannolan 6y agolol.
- FDSGSG 6y ago?
- coolgeek 6y agoThe difference between the government, the corporate sector (oligarchy) and the mafia in Russia is nominal. It's all the same people, operating out of different organizational fronts. It's a super-organization that transcends what we think of elsewhere as being different sectors (of varying degrees of legality)
- FDSGSG 6y agoThere's a big difference between the GRU and the SVR and the FSB. There's an even bigger difference between GRU and the IRA. These are completely different things, it's downright silly to imply otherwise. IRA staffers certainly aren't "GRU agents"
- coolgeek 6y agoI don't disagree with anything you say. But nothing you say argues against what I said.
- anonu 6y agoThats probably the real interesting story here...
- Fnoord 6y agoThe Dutch secret service MIVD caught a couple of GRU "diplomats" who were trying to do MITM (with a Pineapple) on e.g. the organisation in The Hague who were investigating MH17. One even had a taxi receipt with him from GRU HQ to Moscow airport. Meanwhile, the Dutch secret service AIVD had access to GRU HQ camera feeds. Before all that happened a high ranking Russian police officer got reprimanded (IIRC send to gulag) for working together with the Dutch police on high level cyber crime.
- supergirl 6y agowhat kind of taxi receipt shows the pick up point?
- Fnoord 6y agohttps://images.wired.it/wp-content/uploads/2018/10/18184147/1539873706_DorBsRLXUAAZyyU.jpg https://images.wired.it/wp-content/uploads/2018/10/18184147/...
- supergirl 6y agohas his name and signature on it. i guess he kept it to expense the $10. a bit too convenient. if true, it means this guy is a spy carrying a ticket in his pocket that says "i spy for russia". he is so bad at his job that we have nothing to worry about
- Fnoord 6y agoTheory has it it was a routine job for them, hence the complacency.
- mike_d 6y agoCounter intelligence operations ran by NSA and CIA. They most likely have compromised infrastructure used by the attackers. At the end of the day, Russian cyber ops are still a governmental organization - which means they keep records, have JIRA (or similar) tickets, logs of work to support promotions, etc. CIA likely has human assets within the ranks of the military intelligence units that could provide information or details of written documents.
- failuser 6y agoI’ve assumed the use something outdated like paper orders, but yes, there might be some sort of a ticket «kill Navalny» that has gone through some interesting states and comments.
- PeterisP 6y agoIt's often through a single mistake made once that allows you to link some pseudonymous profile to a real person. For example, I recall reading about a particular case where some command&control server was identified and being monitored, and once one of the operators accidentally logged in to his personal profile on a social media site over the 'secure VPN' connection. Also, there have been cases where authorities have been 'subcontracting' certain services or tools from local cyber criminals working on online financial fraud - where those criminals were later arrested abroad, and have agreed to testify against their former partners/employers.
- jimmySixDOF 6y agoI didn't even see them point out which one was "Guccifer 2.0"