3 ms·
How are they so sure it's Russia? It always seems like there is another country with much more interests in these companies. Given partnerships and the global e
by NotChina 6y ago
How are they so sure it's Russia?
It always seems like there is another country with much more interests in these companies. Given partnerships and the global economic status of Russia. It does not pass the sniff test.
- stupendousyappi 6y agoGiven that your account is seven minutes old and has one comment, you don't pass the sniff test.
- dang 6y agoPlease don't attack other users this way. The damage it does to the community is not worth the chance that you're right. It's much better to follow the site guidelines, which are designed to sustain an interesting community. In this case that means (a) respond with a better argument and/or (b) if you feel the comment breaks the site guidelines, flag it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- youresameasme 6y agoWhere in the article does it say it's Russia?
- rixed 6y agoAttribution is indeed always the part that make me doubt about entire security related articles. Each and every time I looked into how such attacks were attributed to this or that country the evidence, if not the reasonning, were severely lacking at best. There is too much at stake in those affairs that it is safer to assume that only fabricated stories and counter fires are told about it all.
- lawnchair_larry 6y agoThe part you’re missing is that they don’t tell you how they did the attribution, and there are good reasons for this. You’re assuming that you know what they know.
- Russiawozere 6y agoFrequently the evidence is that they saw a connection from <IP from within country> or that the document had some Cyrillic in it which is the internet version of "Russia woz 'ere" totally legit. Conveniently it's always whichever country is the media boogeyman of the week
- lawnchair_larry 6y agoNo, source IP address country is never the basis for attribution, and contrarian lay people always assume that’s how it works for some reason. It isn’t, at all.
- rixed 6y agoSpeaking with confidence is not enough to be taken seriously on this topic saturated with marketing, politics and mythomaniacs. Especially when a quick Google search is enough to find plenty of such attributions: > The IP address was linked to the GRU HQ itself. https://www.techradar.com/news/defending-against-nation-state-ransomware https://www.techradar.com/news/defending-against-nation-stat... > one website that helped to coordinate them, StopGeorgia.ru, was hosted at an IP address that belonged to a company headquartered next to a GRU-connected military research institute https://www.wired.com/story/us-blames-russia-gru-sweeping-cyberattacks-georgia/ https://www.wired.com/story/us-blames-russia-gru-sweeping-cy... > Dragos researcher Joe Slowik noticed that one IP address identifying a server in Hungary used in that APT28 campaign matched an IP address listed in the CISA advisory https://www.wired.com/story/russias-fancy-bear-hack-us-federal-agency/ https://www.wired.com/story/russias-fancy-bear-hack-us-feder... > They used an Ip address that has been previously seen in other russian attributed attacks https://abcnews.go.com/WNT/video/ip-address-linked-russia-dnc-hack-expert-40905549 https://abcnews.go.com/WNT/video/ip-address-linked-russia-dn... List would go on and on, and this is only for Russia. And yes I'm aware those sources are easily discarded as "non serious enough", as expected from the top results of a search engine I guess. Do your part and provide us with better sources.
- 0xy 6y agoThe NSA regularly launches cyber attacks using the signature/SOP of other countries in order to frame them, so attribution is usually useless without evidence. Unfortunately, evidence is never provided beyond hearsay.