3 ms·
This part of the story is intriguing: > In the FireEye attack, the hackers went to extraordinary lengths to avoid being seen. They created several thousand int
by gnfargbl 6y ago
This part of the story is intriguing:
> In the FireEye attack, the hackers went to extraordinary lengths to avoid being seen. They created several thousand internet protocol addresses — many inside the United States — that had never before been used in attacks. By using those addresses to stage their attack, it allowed the hackers to better conceal their whereabouts.
What does it mean to "create an internet protocol address," in this context? Did they use VPNs? VMs on cloud services? Residential proxies, luminati-style? Something else?
- the_only_law 6y agoAlso how do you validate an address has never been used in an attack?
- quartz 6y agoYou only need to validate it to the depth that your target can validate it, which likely means via (among other sources) paid-for IP Reputation services.
- gnfargbl 6y agoI would guess that is a little bit of journalistic summarization, and what the author means is that the IPs used in the attack had a reasonable reputation. That's what made me wonder whether they were talking about residential proxies.
- andrewflnr 6y agoProbably just a journalist's summary of "not on existing IOC lists".
- troydavis 6y agoThat sounds like a reporter’s explanation of announcing space that had never been allocated by an RIR, or had been allocated but never previously announced. More: https://www.ripe.net/participate/policies/proposals/2019-08 https://www.ripe.net/participate/policies/proposals/2019-08, https://www.manrs.org/2020/12/whats-the-as0-roa-policy-and-what-should-i-know-as-a-network-operator/ https://www.manrs.org/2020/12/whats-the-as0-roa-policy-and-w..., https://blog.cloudflare.com/rpki-details/ https://blog.cloudflare.com/rpki-details/
- gist 6y agoThe reporter meant 'used'. I have never heard the use of 'created' and if there is a meaning to that that I don't know about it's not widely used and should not have been used by the writer. The 'many inside the US' is kind of laughable. I mean what would you do to pull this off use IP addresses in China or Russia just to draw attention? I mean if you want to pull off a burglary in a residential neighborhood you don't drive in with an auto that draws attention you go with an auto that looks like many others that have been seen before and isn't noticed.
- oxfeed65261 6y agoLike using a Zil or a Lada or a Trabant as a getaway car in the USA, perhaps. Or a Citroën 2CV.