5 ms·

WaPo reporting it is APT29. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-

WaPo reporting it is APT29. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html https://www.washingtonpost.com/national-security/russian-gov...

simias 6y ago
I wish we had more concrete evidence than "according to people familiar with the matter" though. That's kind of my issue: if these attackers are so sophisticated, how can they be sure it's this particular group? I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.
- minerjoe 6y ago
  Exacty. And we also know that the NSA/CIA have placed Russian language inside their exploits to frame other countries.
  - hyeomans 6y ago
    Source?
    - Throwaway1771 6y ago
      I've heard this in the "right rooms" to know this to be likely true, but I'd like something to link to, too.
    - _kbh_ 6y ago
      Marble Framework from Vault 7 leaks. https://wikileaks.org/ciav7p1/cms/page_14588467.html https://wikileaks.org/ciav7p1/cms/page_14588467.html
- astronautjones 6y ago
  I totally agree with your point (and would trust a hazy dream more than anything coming from this government), but I'd add that even if they claim to identify these parties forensically, they're often using parallel construction through their own espionage. like in the mueller investigation, they had a lot of firsthand knowledge of the IRA's business from inside the building (and the names of everyone that worked there). It's often not a technical conclusion based on the intrusions, but a conclusion reached by evidence gathered through other means bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market
  - 9HZZRfNlpR 6y ago
    Sounds reasonable but I don't remind reading it from the released pdf of the investigation. I actually read the whole thing, it's long but rather interesting from the hacker and espionage spirit.
  - disabled 6y ago
    > bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how-russia-issues-fake-passports-to-its-operatives-in-ukraine/ https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...
- TameAntelope 6y ago
  A very common source of information to reporters are people who aren't authorized to speak about an issue, or people who have informal relationships with the press and don't want their names revealed publicly. There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false. As a overly generic rule, trust (or don't) the Institution over the individuals.
  - simias 6y ago
    I'm perfectly willing to trust that the WaPo is reporting truthfully and that their sources are legit, but without concrete evidence it's hard to judge how serious the allegation really is. Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"? To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.
    - TameAntelope 6y ago
      I tend to consider news reports more akin to a, “here’s what we know now” report than a, “this is the definitive explanation of what’s taken place.” So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially. Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.
  - 6y ago
- stjohnswarts 6y ago
  Because those people would lose their jobs, possibly do jail time, and possibly the story would never have broken in the first place if reporters were required to always give up their sources in the article. Usually they do vetting or it's people they've worked with before and they trust.
- IfOnlyYouKnew 6y ago
  You either believe it or you don't. There have been instances where more details were released (the Clinton campaign hack, IIRC), and it just gave more opportunity for people who did not want to believe it to nitpick details. Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.
- bun_at_work 6y ago
  So far as I understand it, "hacker groups," private or state-level, are generally identified by the tools they use. The same groups will re-use the tools and exploits they have over and over, including some known libraries. Security researchers capture the malware sent out from those groups and reverse engineer them. These allow groups of malware signatures to be created, which allows researchers to start to identify potential actors. It didn't take long for the security community to start blaming certain organizations for Stuxnet, despite there being little proof of their claims...

simias 6y ago

I wish we had more concrete evidence than "according to people familiar with the matter" though. That's kind of my issue: if these attackers are so sophisticated, how can they be sure it's this particular group? I realize that there are probably many good reasons for not sharing deep technical details in such cases, but from the point of view of an external observer it's really hard to know who should be trusted and how solid these claims are.

minerjoe 6y ago
Exacty. And we also know that the NSA/CIA have placed Russian language inside their exploits to frame other countries.
- hyeomans 6y ago
  Source?
  - Throwaway1771 6y ago
    I've heard this in the "right rooms" to know this to be likely true, but I'd like something to link to, too.
  - _kbh_ 6y ago
    Marble Framework from Vault 7 leaks. https://wikileaks.org/ciav7p1/cms/page_14588467.html https://wikileaks.org/ciav7p1/cms/page_14588467.html
astronautjones 6y ago
I totally agree with your point (and would trust a hazy dream more than anything coming from this government), but I'd add that even if they claim to identify these parties forensically, they're often using parallel construction through their own espionage. like in the mueller investigation, they had a lot of firsthand knowledge of the IRA's business from inside the building (and the names of everyone that worked there). It's often not a technical conclusion based on the intrusions, but a conclusion reached by evidence gathered through other means bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market
- 9HZZRfNlpR 6y ago
  Sounds reasonable but I don't remind reading it from the released pdf of the investigation. I actually read the whole thing, it's long but rather interesting from the hacker and espionage spirit.
- disabled 6y ago
  > bellingcat has also done a pretty remarkable job of identifying state-employed hackers and spies just through buying russian passport control information and other private information that's out there on the market Wow, I just looked some stuff up on bellingcat. It appears that Russia is pretty bad at covering its tracks. This is a good example: https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how-russia-issues-fake-passports-to-its-operatives-in-ukraine/ https://www.bellingcat.com/news/uk-and-europe/2019/11/07/how...
TameAntelope 6y ago
A very common source of information to reporters are people who aren't authorized to speak about an issue, or people who have informal relationships with the press and don't want their names revealed publicly. There are indeed many good reasons why specific people aren't cited in these articles, but who you're trusting is the Washington Post, not these individuals. The trust comes from what the Washington Post does when it finds out it has published false information, and its track record of making sure what it publishes as news is accurate, or corrected when discovered to be false. As a overly generic rule, trust (or don't) the Institution over the individuals.
- simias 6y ago
  I'm perfectly willing to trust that the WaPo is reporting truthfully and that their sources are legit, but without concrete evidence it's hard to judge how serious the allegation really is. Is it "they forgot to switch their VPN on once and we got a direct connection from an IP that belongs to the Russian state" like that other time (still manipulable but fairly conclusive IMO) or is it "that really looks like the modus operandi of those damn russians and we really need somebody to pin it on right now"? To be clear I'm not making one of those "fake news" pro-russian rants, I can totally believe that Russia would very much do the things being reproached here if given the opportunity, I just have a really hard time taking the word of an anonymous source without concrete elements in these matters because the potential for manipulation is so absolutely tremendous.
  - TameAntelope 6y ago
    I tend to consider news reports more akin to a, “here’s what we know now” report than a, “this is the definitive explanation of what’s taken place.” So in that spirit I agree with you. What this looks like, so far, is a sophisticated Russian attack. From here, we’re going to learn more, and that new info may change how we understand what’s happened substantially. Though I will say I personally don’t care much that the source is anonymous, because I trust WaPo to vet what they’ve said with other sources. It’s not a perfect system, but it’s not like journalists are unaware of the groups trying to manipulate them.
- 6y ago
stjohnswarts 6y ago
Because those people would lose their jobs, possibly do jail time, and possibly the story would never have broken in the first place if reporters were required to always give up their sources in the article. Usually they do vetting or it's people they've worked with before and they trust.
IfOnlyYouKnew 6y ago
You either believe it or you don't. There have been instances where more details were released (the Clinton campaign hack, IIRC), and it just gave more opportunity for people who did not want to believe it to nitpick details. Whoever does such things doesn't exactly sign their exploits to prove ownership. So the evidence might be something like IP addresses in log files: totally convincing if it's your log file, but so easy to manipulate it's useful to convince someone who does not trust you.
bun_at_work 6y ago
So far as I understand it, "hacker groups," private or state-level, are generally identified by the tools they use. The same groups will re-use the tools and exploits they have over and over, including some known libraries. Security researchers capture the malware sent out from those groups and reverse engineer them. These allow groups of malware signatures to be created, which allows researchers to start to identify potential actors. It didn't take long for the security community to start blaming certain organizations for Stuxnet, despite there being little proof of their claims...