3 ms·

I don’t know a lot about how states conduct cyber espionage against one another, but it does feel a bit off to be told that this was the work of a nation state

I don’t know a lot about how states conduct cyber espionage against one another, but it does feel a bit off to be told that this was the work of a nation state with zero proof as to why.

mistermann 6y ago
It worked (a lack of acknowledgement that identities can be spoofed) for the "Russian hackers / disinformation agents" on Twitter meme, it will likely work just as well here.
elliekelly 6y ago
I think sometimes the proof they have isn't proof they're willing to publicly admit they have because they don't want to let on how they know. After Jamal Khashoggi was assassinated, for example, it turned out audio of the entire murder had been recorded through surveillance. (I'm still not sure we ever found out how exactly it was recorded?) So there were lots of announcements that certain governments "knew" or "suspected" it was Saudi Arabia with little or no substance to back up their claims until the existence of the recording was later leaked. I think there was similar discussion after MH17 when western governments "knew" Russia-backed rebels had shot down the plane and only later did we learn there was a recording of a conversation about what happened. I guess even after Snowden governments like to do their best to pretend they don't have the entire world under surveillance at all times.
zebrafish 6y ago
Don’t they usually have “styles” of intrusion? I’m certain I’ve read in the past where intelligence agencies could differentiate between Russian backed styles of hacking and Chinese backed styles of hacking. I’m sure Americans have their own style of hacking as well. I would say it’s also quite likely that the US knows who did this or has known who has been doing it for a while. It’s highly unlikely that this press release wasn’t coordinated by the intelligence agencies to play into some advantageous scenario they’ve drawn up.
- corytheboyd 6y ago
  If there are such styles of exploit, which means it’s public knowledge, sounds like a great way to cover your tracks then. Just make it look like the other person.
hguant 6y ago
Some of it is based on analysis of the actors motives - if you have 0-day works on fully patched Office 365, that took months/years to work, and throw it at a US government agency, you're clearly not in it for the money, _and_ you have no qualms about blowing your exploit.
- qaq 6y ago
  Well if you are targeting Treasury it could be to act on information not yet made public in the stock market.
cheaprentalyeti 6y ago
Maybe when they hacked it they accidentally left behind a todolist.txt of "First we hack Solarwinds, then we go after Moose and Squirrel..."

I don’t know a lot about how states conduct cyber espionage against one another, but it does feel a bit off to be told that this was the work of a nation state with zero proof as to why.

mistermann 6y ago

It worked (a lack of acknowledgement that identities can be spoofed) for the "Russian hackers / disinformation agents" on Twitter meme, it will likely work just as well here.

elliekelly 6y ago

I think sometimes the proof they have isn't proof they're willing to publicly admit they have because they don't want to let on how they know. After Jamal Khashoggi was assassinated, for example, it turned out audio of the entire murder had been recorded through surveillance. (I'm still not sure we ever found out how exactly it was recorded?) So there were lots of announcements that certain governments "knew" or "suspected" it was Saudi Arabia with little or no substance to back up their claims until the existence of the recording was later leaked. I think there was similar discussion after MH17 when western governments "knew" Russia-backed rebels had shot down the plane and only later did we learn there was a recording of a conversation about what happened. I guess even after Snowden governments like to do their best to pretend they don't have the entire world under surveillance at all times.

zebrafish 6y ago

Don’t they usually have “styles” of intrusion? I’m certain I’ve read in the past where intelligence agencies could differentiate between Russian backed styles of hacking and Chinese backed styles of hacking. I’m sure Americans have their own style of hacking as well. I would say it’s also quite likely that the US knows who did this or has known who has been doing it for a while. It’s highly unlikely that this press release wasn’t coordinated by the intelligence agencies to play into some advantageous scenario they’ve drawn up.

corytheboyd 6y ago
If there are such styles of exploit, which means it’s public knowledge, sounds like a great way to cover your tracks then. Just make it look like the other person.

hguant 6y ago

Some of it is based on analysis of the actors motives - if you have 0-day works on fully patched Office 365, that took months/years to work, and throw it at a US government agency, you're clearly not in it for the money, _and_ you have no qualms about blowing your exploit.

qaq 6y ago
Well if you are targeting Treasury it could be to act on information not yet made public in the stock market.

cheaprentalyeti 6y ago

Maybe when they hacked it they accidentally left behind a todolist.txt of "First we hack Solarwinds, then we go after Moose and Squirrel..."