6 ms·

I'm always skeptical of these "nation state" claims, it seems like an easy way out of any tough question about the security of these systems. "No, no, you don'

• res0nat0r 6y ago
  WaPo reporting it is APT29. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/russian-gov...
  • simias 6y ago
    I wish we had more concrete evidence than "according to people familiar with the matter" though. That's kind of my issue: if these attackers are so sophisticated, how can they be sure it's this particular group? I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.
    • minerjoe 6y ago
      Exacty. And we also know that the NSA/CIA have placed Russian language inside their exploits to frame other countries.
      • hyeomans 6y ago
        Source?
        • Throwaway1771 6y ago
          I've heard this in the "right rooms" to know this to be likely true, but I'd like something to link to, too.
        • _kbh_ 6y ago
          Marble Framework from Vault 7 leaks. https://wikileaks.org/ciav7p1/cms/page_14588467.html https://wikileaks.org/ciav7p1/cms/page_14588467.html
    • astronautjones 6y ago
      I totally agree with your point (and would trust a hazy dream more than anything coming from this government), but I'd add that even if they claim to identify these parties forensically, they're often using parallel construction through their own espionage. like in the mueller investigation, they had a lot of firsthand knowledge of the IRA's business from inside the building (and the names of everyone that worked there). It's often not a technical conclusion based on the intrusions, but a conclusion reached by evidence gathered through other means bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market
      • 9HZZRfNlpR 6y ago
        Sounds reasonable but I don't remind reading it from the released pdf of the investigation. I actually read the whole thing, it's long but rather interesting from the hacker and espionage spirit.
      • disabled 6y ago
        > bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how-russia-issues-fake-passports-to-its-operatives-in-ukraine/ https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...
    • TameAntelope 6y ago
      A very common source of information to reporters are people who aren't authorized to speak about an issue, or people who have informal relationships with the press and don't want their names revealed publicly. There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false. As a overly generic rule, trust (or don't) the Institution over the individuals.
      • simias 6y ago
        I'm perfectly willing to trust that the WaPo is reporting truthfully and that their sources are legit, but without concrete evidence it's hard to judge how serious the allegation really is. Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"? To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.
        • TameAntelope 6y ago
          I tend to consider news reports more akin to a, “here’s what we know now” report than a, “this is the definitive explanation of what’s taken place.” So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially. Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.
      • 6y ago
    • stjohnswarts 6y ago
      Because those people would lose their jobs, possibly do jail time, and possibly the story would never have broken in the first place if reporters were required to always give up their sources in the article. Usually they do vetting or it's people they've worked with before and they trust.
    • IfOnlyYouKnew 6y ago
      You either believe it or you don't. There have been instances where more details were released (the Clinton campaign hack, IIRC), and it just gave more opportunity for people who did not want to believe it to nitpick details. Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.
    • bun_at_work 6y ago
      So far as I understand it, "hacker groups," private or state-level, are generally identified by the tools they use. The same groups will re-use the tools and exploits they have over and over, including some known libraries. Security researchers capture the malware sent out from those groups and reverse engineer them. These allow groups of malware signatures to be created, which allows researchers to start to identify potential actors. It didn't take long for the security community to start blaming certain organizations for Stuxnet, despite there being little proof of their claims...
• tialaramex 6y ago
  Right. There are situations where we can see that the only apparent way to do something needed very considerable resources, which suggests a state actor. Equation Group is presumed to be (a front for) the NSA. It forged a (code signing) certificate that otherwise shouldn't exist, using an MD5 collision. But not the MD5 collision painfully created by researchers a little earlier to demonstrate that MD5 was vulnerable, it used a brand new collision purpose made for this attack. That's a considerable investment. Then also, we can look at who benefits from what was done. Equation Group's "Flame" malware damaged the Iranian nuclear programme. That's something the US government, Israel, some other countries wanted, but it isn't something a bored teenager wants, or a drug cartel, or most for-profit corporations. As described so far I don't see either the resource needs or the outcome satisfying this conclusion.
  • guerrilla 6y ago
    Didn't Dan Kaminsky and others have tools to produce nearly arbitray collisions by the early 2000s?
    • tialaramex 6y ago
      Perhaps? I can't find any evidence easily that Dan did have such tool, but "by the early 2000s" it's not at all unthinkable certainly. If you have a link that'd be great. However the trouble is MD5 collision isn't like that hilarious "Send all zeroes" Microsoft bug from a few weeks back where you just try it a few times then it works because someone was very stupid - the MD5 collision is pretty hard, the Merkle–Damgård construction actually works, your attack avenue is hammering on the compression function, everything else in MD5 (and any other Merkle–Damgård construction) works because of mathematics unless you can break that compression function - so having a program that when you run it spits out an MD5 collision with your preferred shape is great, it's a cryptographic breakthrough - but maybe it'll take 5000 years to run on a typical home PC. If you're a government or a big crime boss then money turns that into 5 days or (if you've enough of it) 5 hours instead, but if you're a bored teenager or small time crook not so much. And like I said, Flame depends on a never before seen collision, so it isn't like they just re-used work somebody else had done.
• bosswipe 6y ago
  FWIW, I'm also sceptical of comments like yours. A nation state involved in a lot of hacking would be interested in spreading your kind of doubts on social media. I'm not trying to accuse you personally, I don't know you from Putin, I'm just wondering why this response has become so popular recently.
  • mikem170 6y ago
    Lack of trust.
  • IfOnlyYouKnew 6y ago
    > I'm just wondering why this response has become so popular recently. Nihilistic cynicism sounds a lot like smartitude to stupid people.
  • simias 6y ago
    I'm not usually very distrustful of mainstream news (at least, by internet standards) but I am very distrustful of the news' capacity to vet very technical issues correctly. Remember that Bloomberg "the Chinese put spy microchips on our motherboards" story? I'm not accusing the WaPo of being distrustful here, I just think that in these cases the potential for manipulation, half-truths and technical mistakes from their sources is very high, and without either knowing who these sources are or what are the concrete element they're using to make their conclusions I find it very hard to blindly trust these sources.
    • hangonhn 6y ago
      I have the exact same attitude. Reading WaPo, Bloomberg, and even NYT (though I think NYT has a slight edge here) report on technical issues make me cringe. You can tell they're trying to hardest to understand and to explain it in a comprehensible way but it's just so bad. Then I think to myself, if that's the way it is for computing, what about other technical/STEM/specialized fields? I trust them for their reporting on those but what if they have missing the important nuances there too?
  • rendall 6y ago
• a3n 6y ago
  > the attackers where highly sophisticated and had the resources of a nation state Also, the attack was carefully crafted. How could anyone expect or defend against a carefully crafted attack, by a nation state no less.
  • numbsafari 6y ago
    Well, one would presume our own nation state could, for starters.
• TameAntelope 6y ago
  Maybe someone with more familiarity on the topic can chime in, but I don't think it's the effective PR move you think it is. Nobody, I think, actually cares who from a blame perspective. The idea that there's face saving to be had by blaming it on someone sophisticated just doesn't ring true to me. It still happened, the details specifically about who and how don't make your board, your boss, or Wall St. care. It's way more relevant how you react to the breach, than it is that the breach took place.
• pydry 6y ago
  It's easier to get congress to pump the relevant parts of the military industrial complex with $$$ when it's "cyber warfare" too.
• stjohnswarts 6y ago
  I thought all the script kiddies were using curl ? :)
• Kiro 6y ago
  Your comment didn't age well. https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html https://www.fireeye.com/blog/threat-research/2020/12/evasive... If this is not sophisticated, I don't know what is.
• bun_at_work 6y ago
  This attack is a supply chain attack on enterprise software used by huge government organizations. Where can teenagers with wget pull that off? When a leading security group (FireEye) says it's a state-level actor, I don't think they are doing PR. It's fine to be skeptical, but why are you being skeptical? Perhaps it's lost on me but I don't think the claim that PR would look bad _if it were teenagers_ is a good reason to promote widespread distrust of ???. I see the compromise of SolarWinds Orion software as far more likely to be carried out by state level actors than by script-kiddies. What would script-kiddies stand to gain?