4 ms·

>Three people familiar with the investigation have told Reuters that Russia is a top suspect, although others familiar with the inquiry have said it is still to

>Three people familiar with the investigation have told Reuters that Russia is a top suspect, although others familiar with the inquiry have said it is still too early to tell. If this is the case, then why is Russia so definitively portrayed as the culprit in so many publications, currently?

blhack 6y ago
Because Russia were legitimately a culprit during the cold war, and many people who grew up during that period are susceptible to clickbait where Russia is, again, the bad guy. They were primed for it during their entire childhood, and then as adults with movies, video games, etc.
- Craighead 6y ago
  Uh huh, so that means even when there's direct evidence people shouldn't believe it because it's the boogeyman argument?
forgingahead 6y ago
As Obama told Romney years ago, "the 80s called and are asking for their policy back!". American media loves their heroes and villains narratives, and the characters change depending on what is convenient. Even if Russia was responsible, would you believe them after all the other times they cried wolf?
viraptor 6y ago
This is annoying without knowing the sources. But APT behaviours are repeated, researched, investigated. This could be legitimately mapped to a specific group using details which relevant agencies don't want to make public. Not sure we can deal with it better than acknowledge this is someone's opinion and there's a chance they may have more information, but there's also chance they're playing games.
- sudosysgen 6y ago
  A third possibility is that the attacker is pretending to be someone else as misdirection and that whoever is investigating fell into their trap.
  - jessaustin 6y ago
    There were Russian characters in a comment in one of the scripts! Open-and-shut case!
  - naikrovek 6y ago
    This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, the attacker would also need to entirely suppress their own methods and approaches so that they are not identifiable as themselves. Much easier to simply hide who you are by changing your compromise fingerprint than to try to impersonate someone else's compromise fingerprint. If a technique is seen in this attack that has been seen in previous attacks which are now known to be by a russia-sponsored group, that is very strong evidence that the same group is responsible. It is not proof, but it is strong evidence.
    - sudosysgen 6y ago
      If you know what the investigators are looking for (say, after you hacked them), then it might not be that hard. Given the fact that attribution is so difficult that we haven't seen any lawsuits yet, I'd imagine that entirlely suppressing your own methods if you know what the investigator is expecting from someone else as well as what the methods of others are is feasible.
DevKoala 6y ago
For the same reason it has been the persistent narrative for the past four years.
disposablex 6y ago
Seems to me that they have a `with good authority` hunch, but just need a few more pieces to make it a fool proof connection. With anything, unless they actively admit to it, or made a lot of mistakes, it's not really going any where. Does anything really happen to rogue nation Russia even if they are caught? It's like getting a new, untrained puppy; it's one of those cases where, you walk into a dark room the puppy was in for a little while. You can smell it, and you're more than likely correct what it's coming from, you just can't see it so you can't really prove, yet, that there is shit somewhere... until you turn the lights on.
narrator 6y ago
"Anonymous source say...." is how just about every other Washington Post and New York Times article that turns out to eventually be wrong starts.
- moate 6y ago
  It's also how about every other WaPo or NYT article that turns out to be right works. Anon sources are the core of journalism, good and bad.
naikrovek 6y ago
Maybe because it is believed (or known, or anywhere in between) that they are presently actively doing things of this nature... Attackers also leave breadcrumbs behind; fingerprints, in a way. Sometimes the actions taken are the fingerprint, sometimes the effort to cover up those actions is the fingerprint. If I am an investigator and I see trademark actions or cleanup that I've seen before in a russia-sponsored attack, it is not a huge leap to strongly suspect I am investigating a russia-sponsored attack.
- kjaftaedi 6y ago
  And if you're a skilled attacker, wouldn't you leave breadcrumbs leading to someone else's door? Like how North Korea is largely seen as responsible for hacking Sony. If you paint a big enough arrow, people will follow it.

blhack 6y ago

Because Russia were legitimately a culprit during the cold war, and many people who grew up during that period are susceptible to clickbait where Russia is, again, the bad guy. They were primed for it during their entire childhood, and then as adults with movies, video games, etc.

Craighead 6y ago
Uh huh, so that means even when there's direct evidence people shouldn't believe it because it's the boogeyman argument?

forgingahead 6y ago

As Obama told Romney years ago, "the 80s called and are asking for their policy back!". American media loves their heroes and villains narratives, and the characters change depending on what is convenient. Even if Russia was responsible, would you believe them after all the other times they cried wolf?

viraptor 6y ago

This is annoying without knowing the sources. But APT behaviours are repeated, researched, investigated. This could be legitimately mapped to a specific group using details which relevant agencies don't want to make public. Not sure we can deal with it better than acknowledge this is someone's opinion and there's a chance they may have more information, but there's also chance they're playing games.

sudosysgen 6y ago
A third possibility is that the attacker is pretending to be someone else as misdirection and that whoever is investigating fell into their trap.
- jessaustin 6y ago
  There were Russian characters in a comment in one of the scripts! Open-and-shut case!
- naikrovek 6y ago
  This seems very unlikely to me. Not only would the attacker need to know precise detail about the exact methods and steps taken by a russia-sponsored group, the attacker would also need to entirely suppress their own methods and approaches so that they are not identifiable as themselves. Much easier to simply hide who you are by changing your compromise fingerprint than to try to impersonate someone else's compromise fingerprint. If a technique is seen in this attack that has been seen in previous attacks which are now known to be by a russia-sponsored group, that is very strong evidence that the same group is responsible. It is not proof, but it is strong evidence.
  - sudosysgen 6y ago
    If you know what the investigators are looking for (say, after you hacked them), then it might not be that hard. Given the fact that attribution is so difficult that we haven't seen any lawsuits yet, I'd imagine that entirlely suppressing your own methods if you know what the investigator is expecting from someone else as well as what the methods of others are is feasible.

DevKoala 6y ago

For the same reason it has been the persistent narrative for the past four years.

disposablex 6y ago

Seems to me that they have a `with good authority` hunch, but just need a few more pieces to make it a fool proof connection. With anything, unless they actively admit to it, or made a lot of mistakes, it's not really going any where. Does anything really happen to rogue nation Russia even if they are caught? It's like getting a new, untrained puppy; it's one of those cases where, you walk into a dark room the puppy was in for a little while. You can smell it, and you're more than likely correct what it's coming from, you just can't see it so you can't really prove, yet, that there is shit somewhere... until you turn the lights on.

narrator 6y ago

"Anonymous source say...." is how just about every other Washington Post and New York Times article that turns out to eventually be wrong starts.

moate 6y ago
It's also how about every other WaPo or NYT article that turns out to be right works. Anon sources are the core of journalism, good and bad.

naikrovek 6y ago

Maybe because it is believed (or known, or anywhere in between) that they are presently actively doing things of this nature... Attackers also leave breadcrumbs behind; fingerprints, in a way. Sometimes the actions taken are the fingerprint, sometimes the effort to cover up those actions is the fingerprint. If I am an investigator and I see trademark actions or cleanup that I've seen before in a russia-sponsored attack, it is not a huge leap to strongly suspect I am investigating a russia-sponsored attack.

kjaftaedi 6y ago
And if you're a skilled attacker, wouldn't you leave breadcrumbs leading to someone else's door? Like how North Korea is largely seen as responsible for hacking Sony. If you paint a big enough arrow, people will follow it.