3 ms·

No, I am not saying a bored teenager can create evidence like that, but the sophisticated nation states surely can, and probably some other larger orgs, too. C

No, I am not saying a bored teenager can create evidence like that, but the sophisticated nation states surely can, and probably some other larger orgs, too. Code can be faked, meta data can be faked, MO can be imitated, and so on. And the nation states at the very least - and their contractors and (former) employees in the areas of concern - will know what it has to look like. Motive isn't always clear, and quite often there are multiple parties with motives. >unless you've had some real exposure to IR and forensics as a practitioner. I'll bite on your argumentum ad verecundiam... who says I didn't? ;) But I agree, we'll likely never see evidence or a post mortem, and are expected to believe what FireEye and/or the FBI tells us.

tptacek 6y ago
You said "I wouldn't discount a bored teenager". We have now mutually discounted a bored teenager.
- rndgermandude 6y ago
  I haven't yet, because all I have to go by is claims by FireEye and the FBI. I already said why I take what FireEye says with a grain of salt, and frankly, I also take what the FBI says with more than a grain of salt. The FBI is inherently political, and even when they are not, they are known to make up stuff when it suits them (e.g. "parallel construction"). That may be a rather untrusting/paranoid mindset that I employ, but it worked for me so far.
  - tptacek 6y ago
    Asking sincerely: is there some particular reason it should matter to the rest of us whether your perspective on attack attribution has "worked for you so far"? What would the consequences to you have been had your intuition not "worked"?
    - rndgermandude 6y ago
      Replying sincerely: It matters the same way as your own opinion matters to the rest of us. And consequences? In this case, probably none. We're here for news and entertainment, and reasoning about topics such as this one is enjoyable to me. But lively discussions and their takeaways can inform future arguments and decisions. But in more general terms, I am a member of the electorate in my country, and misattributions and/or bad or even fake evidence quite often have direct influence on policy. E.g. I was quite happy that I, along with a majority of my fellow citizens, did not believe the "conclusive" "evidence" of WMDs in Iraq the US had put forth, and stayed out of that war.
    - wglb 6y ago
      >That may be a rather untrusting/paranoid mindset that I employ, but it worked for me so far. "Worked for me so far" can turn out to be inadequate if you discover that your stuff has been leaking to the bad guys for a year.

tptacek 6y ago

You said "I wouldn't discount a bored teenager". We have now mutually discounted a bored teenager.

rndgermandude 6y ago
I haven't yet, because all I have to go by is claims by FireEye and the FBI. I already said why I take what FireEye says with a grain of salt, and frankly, I also take what the FBI says with more than a grain of salt. The FBI is inherently political, and even when they are not, they are known to make up stuff when it suits them (e.g. "parallel construction"). That may be a rather untrusting/paranoid mindset that I employ, but it worked for me so far.
- tptacek 6y ago
  Asking sincerely: is there some particular reason it should matter to the rest of us whether your perspective on attack attribution has "worked for you so far"? What would the consequences to you have been had your intuition not "worked"?
  - rndgermandude 6y ago
    Replying sincerely: It matters the same way as your own opinion matters to the rest of us. And consequences? In this case, probably none. We're here for news and entertainment, and reasoning about topics such as this one is enjoyable to me. But lively discussions and their takeaways can inform future arguments and decisions. But in more general terms, I am a member of the electorate in my country, and misattributions and/or bad or even fake evidence quite often have direct influence on policy. E.g. I was quite happy that I, along with a majority of my fellow citizens, did not believe the "conclusive" "evidence" of WMDs in Iraq the US had put forth, and stayed out of that war.
  - wglb 6y ago
    >That may be a rather untrusting/paranoid mindset that I employ, but it worked for me so far. "Worked for me so far" can turn out to be inadequate if you discover that your stuff has been leaking to the bad guys for a year.