5 ms·
Does anybody have any details on the Russia attribution? Not looking to start political flame bait here just curious what details are out there.
by shiado 6y ago
Does anybody have any details on the Russia attribution? Not looking to start political flame bait here just curious what details are out there.
- judge2020 6y agoBased on what i've seen, the official statement is the only indication that it was an adversary https://www.solarwinds.com/securityadvisory#:~:text=.%20We%E2%80%99ve%20been%20advised%20that%20the,verified%20the%20identity%20of%20the%20attacker https://www.solarwinds.com/securityadvisory#:~:text=.%20We%E.... > We’ve been advised that the nature of this attack indicates that it may have been conducted by an outside nation state, but SolarWinds has not verified the identity of the attacker.
- naikrovek 6y agoVery curious why people are so strongly resisting the idea that russia is a prime suspect in this.
- tarmon 6y agoI think people are just curious to see some actual evidence that points to Russia. I don't think it is unlikely, I just haven't read anything that clearly indicates a specific nation state.
- gbrown 6y agoI’m usually the last person to defend our intelligence agencies. In aggregate, it seems like they’re more interested in undermining digital security than supporting it. With that being said, this sort of information would definitely risk compromising “materials and methods”.
- dboreham 6y agoIn this case we have a US government intent on being nice to Russia, so if they're saying it was Russia it probably was?
- shiado 6y agoWhat I mean is some technical explanation that it is Russia and how they arrived at the conclusion. Countdown to Zero Day had excellent explanations for attributing malware, I'm just wondering if there is anything out there about technical clues for this yet.
- nl 6y agoSee my direct reply to you. There doesn't appear to be non-classified evidence that can attribute it (yet - at least available to FireEye/Mandiant). But members of the US subcommittee on Cybersecurity have attributed it and asked for the evidence they saw to be declassified. Having said that, it wouldn't surprise me if in coming days it is able to be positively attributed from non-classified sources. This attack seems very widespread, and while it seems extremely professionally done in the past we've seen how small errors make attribution possible. Usually it's that an exploit developer reused some supporting infrastructure that has been previously seen and it can be attributed from that.
- webmaven 6y ago> What I mean is some technical explanation that it is Russia and how they arrived at the conclusion. I have no specific knowledge, but essentially, most of the evidence is likely to be circumstantial, with chains of inferences from co-occurences of targets, tools, techniques, and other 'fingerprints', various bits of which may occasionally be confirmed or refuted by humint (which may or may not be reliable). It is very unlikely that there is any single piece of info that definitively ties the attack to a particular actor (except maybe sigint), and with sufficient effort a false-flag operation can successfully lead to a mistaken conclusion, at least temporarily, but that's harder than it seems. Any actor that tries to imitate the signature of a different actor by only using stuff from the other guy's bag of tricks is by definition only using tools that have been detected and are known; which means that countermeasures are likely to also be known and in use. Adding anything novel on top of that to increase the chances of the attack's success is incorporating a signal that WON'T be present in the chosen fall-guy's future efforts (unless previously undetected tools can be stolen from the fall-guy), which may (eventually) undermine the desired conclusion. Figuring out whodunnit requires an essentially Bayesian approach, except the data is usually circumstantial, and priors - themselves always contingent on even earlier data - are of uncertain reliability and must when possible be tested against later assumed-reliable data from other channels for consistency (and when inconsistent, deciding whether new data trumps priors or vice-versa is a bitch). Nevertheless, given how much data there typically is, it isn't too often that something comes along (like the discovery of a mole, which invalidates assumptions about what the opposition knows, and knows you know, etc.) to upend everything and break or reverse whole chains of inference. So, while we might eventually find out some of the circumstantial evidence that lead to the attribution to a particular actor, we won't ever be told what other previous evidence (itself circumstantial) ties that evidence to that actor. Eg. "Toolchain X used in this attack is linked to Actor Y, but we can't tell you how we know they are linked. Sorry-not-sorry." ¯\_(ツ)_/¯
- gumby 6y agoAre they? Asking for evidence in support of attribution does not imply that the asked doubts the case any more than my looking up changes in listed causes of death this year implies I doubt the deadliness of Covid-19.
- hda2 6y agoI like the idea of innocent until proven guilty. Russia is guilty of a lot of things and their horrible reputation is well-deserved, but pinning any hack on them because I don't like them is moronic.
- naikrovek 6y agoTry pinning a hack on them because it is something they are very good at doing and have a recent history of doing. It works a lot better and is at least somewhat based on facts.
- hda2 6y agoYou don't "try pinning". You find proof. Again, accusing someone of something without proof solely because they have a history of doing it is moronic and downright retarded.
- naikrovek 6y agoI would like to see people defend literally anything else on this site like they're defending Russia, here. This all smells extremely suspicious.
- bildung 6y agoI'm not yet done with all comments, but so far I've not seen anyone defending Russia, just asking for evidence or at least indicators. Proper attribution of hacks isn't exactly a trivial and foolproof thing. There is a big asymmetry here: On the one hand this whole "cyberattack" boils down to a) the password for the build server being <companyname>123 and b) publishing said password on github. The customers, federal agencies including intelligence, failed to find this for a year, which simply is gross incompetence. I mean really: Did the agencies integrate this software into their critical systems without any checks? Yet these agencies are at the same time so competent that they can reliably attribute usage of the password (this wasn't even a hack) to the Russian government within days? Edit: It is of course quite possible to be Russia, but hacking is comparatively cheap, so the list of possible culprits is larger than just Russia and China. It could also be way more than just one country, as the password was public for everyone to use for almost a year.
- mhh__ 6y agoThe perception is that Democrats and liberals blame Russia, so the contrarian position is the opposite. See any thread on Trump, Assange, Election Fraud, and old threads on Litvinenko to see this contrarianism flaring up
- Spooky23 6y agoThat flip is pretty interesting. The GOP and right wing types traditionally pulled a hard line against Russia and Russian interest. Then that softened — remember George W Bush “staring into Putin’s soul.” Conservatives picked up an infatuation of sorts with Russia early in the Obama administration. Talk radio personalities took a shine to Mr. Putin because Russia allowed transit of US troops and supplies on Russian railways to Uzbekistan, for example. Policy positions on Syria we’re strange. It flipped to obsequiousness mysteriously in 2017. Anything critical of Russia suddenly became a tangle of whataboutisms and other nonsense. Old hawks now roost as Russia doves. Senators who are ok with child separation want pardons for Edward Snowden.
- mhh__ 6y agoI wouldn't say the trend on HN is necessarily partisan, but more from the kind of people who voted for Trump because they (for some absolutely bizarre reason, but that's besides the point) believe in the "Donald the dove" thing. You see the talking points amongst the hard-left, bizarrely, i.e. I have no illusions that the CIA gets up to much better, but drawing moral equivalency between the KGB (in a new suit) and the US Government is a common theme on some HN threads and it's absolutely bizarre (One gains new perspective when Novichok is used within a few miles of your house) This is partly why I find the "no politics" rule on hackernews absolutely hilarious sometimes because it's such an insight into the American psyche where everything is political but also in denial that politics is anything other than a catch-all term for anything involving people, power and any end result other than sex or violence.
- Spooky23 6y agoI’d argue that forums catering to engineers and tech people tend to skew towards a libertarian or sometimes nihilist philosophy. The stuff that attracts folks to Trumpism, UFOs or other weird things of the ilk that make little sense appeals to that philosophy. We like mysteries and inside knowledge. We don’t always have the answers, but we know the problems that nobody else understands. It’s an easy thing for propagandists to exploit. UFOs have been used to conceal weapons programs in plain sight. (In my home area, tomahawk missile testing in the 80s was often linked to that). Now anyone with a little money can mobilize an army of bots and idiots to push any message.
- elorant 6y agoWe're not. It's just that in order for some kind of retaliation to take form states will need hard evidence about Russia's involvement. Whether the evidence exists and it's not leaked to the press, or doesn't exist at all is anybody's guess.
- throwaway201103 6y agoChina seems more likely IMO. We know they've been very active lately on other espionage activities.
- animal_spirits 6y agoWhy not post some sources for that weird claim?
- throwaway201103 6y agoIt's not a claim; it's a statement of opinion, as I clearly indicated.
- imwillofficial 6y agoBased on?
- thrower123 6y agoIt's a solid bet that they have pretty much everything infiltrated. https://thewire.in/world/chinese-communist-party-members-infiltrated-powerful-global-agencies-report https://thewire.in/world/chinese-communist-party-members-inf... They've been doing extensive industrial espionage for decades.
- AnthonyMouse 6y ago> Very curious why people are so strongly resisting the idea that russia is a prime suspect in this. It's really the other way around, there are a lot of people claiming that it was Russia without any apparent evidence: https://twitter.com/ggreenwald/status/1339560149799854081 https://twitter.com/ggreenwald/status/1339560149799854081 But there is a political subtext here. The red team is rooting for it to be China because it plays into a "Trump was right that China is a problem" narrative and coincides with the Hunter Biden thing and also the recent scandal about Congressman Swalwell (D-CA) having a relationship with a Chinese spy. The blue team correspondingly wants it to be not-China and thereby benefits from preemptively asserting that it was Russia. This unfortunately makes it less likely that we'll ever know because it's hard enough to figure it out when there isn't a political motive for both sides to fudge the answer.
- octoberfranklin 6y agoWhy the downvotes? This is pretty insightful.
- nickysielicki 6y agoIt's pretty straightforward: * Because people on this forum have enough expertise to make decisions themselves, given the evidence. * Because in the past, when evidence has been presented, we've seen the federal intelligence community claim absolute certainty when they're actually only mostly-sure.
- AnthonyMouse 6y ago> Because in the past, when evidence has been presented, we've seen the federal intelligence community claim absolute certainty when they're actually only mostly-sure. We've also seen them just fabricate things out of whole cloth, e.g. Iraq WMD. It's generally best to read "according to sources in the intelligence community" as "according to professional liars who are aware you have no way of verifying anything they tell you." Also keep in mind that revealing real classified intelligence to the media is a federal crime but making stuff up is totally legal.
- kriro 6y agoThere's a difference between resisting and wondering if there's some evidence to look at. I mean if I was a sophisticated attacker (and this attack looks sophisticated enough at first glance) it would be my first idea to make it look like the attack is coming from Russia or China to cover my tracks.
- themark 6y agoSearched for ‘solarwinds russia’, common phrases: Probable Suspected Alleged Linked Unnamed Probably Highly Likely I think that sums it up, there are none.
- jassany 6y agoI mean this is the beginning of what seems like a massive, probably international effort, to figure out what happened and who's responsible. Russia is known to be involved in state sponsored cyber intrusions, so it's natural the initial speculation would gravitate in their direction; But it could very well be from within the US borders, or some other nation entirely. That's what the investigation(s) will try to figure out. From now until that day, I will simply assume nothing.
- nl 6y ago> Does anybody have any details on the Russia attribution? FireEye (who discovered the SolarWinds breach when investigating their own breach) have said they are currently unable to attribute it[1]: "While some have attributed the attack to a state-sponsored Russian group known as APT 29, or Cozy Bear, FireEye had not yet seen sufficient evidence to name the actor [FireEye subsidary VP Carmakal] said" However US Subcommittee on CyberSecurity member Senator Richard Blumenthal said about it: "Stunning. Today’s classified briefing on Russia’s cyberattack left me deeply alarmed, in fact downright scared. Americans deserve to know what's going on. Declassify what’s known & unknown"[2] Having done some work in this field, attribution is definitely possible and fairly reliable with enough data, but releasing that data is usually not done because it shows what data sources you have access to. I'd be relatively confident that there is classified sources showing it is at least probable[3] that the source is Russian if subcommittee members are tweeting that. Edit: FireEye/Mandiant has a good primer on how they do their tracking of unknown groups. Attribution is similar: https://www.fireeye.com/blog/products-and-services/2020/12/how-mandiant-tracks-uncategorized-threat-actors.html https://www.fireeye.com/blog/products-and-services/2020/12/h... > Not looking to start political flame bait here just curious what details are out there. Just wait until you see what happens to this reply. But <shrug>. [1] https://www.bloomberg.com/news/articles/2020-12-15/fireeye-stumbled-across-solarwinds-breach-while-probing-own-hack https://www.bloomberg.com/news/articles/2020-12-15/fireeye-s... [2] https://twitter.com/SenBlumenthal/status/1338972186535727105 https://twitter.com/SenBlumenthal/status/1338972186535727105 [3] Probable in the "words of estimative probability" sense. https://en.wikipedia.org/wiki/Words_of_estimative_probability https://en.wikipedia.org/wiki/Words_of_estimative_probabilit... and https://www.cia.gov/library/center-for-the-study-of-intelligence/csi-publications/books-and-monographs/sherman-kent-and-the-board-of-national-estimates-collected-essays/6words.html https://www.cia.gov/library/center-for-the-study-of-intellig...