4 ms·
Hmm I hadn't considered that but how do you find out what tools were being used to produce the payload source code? How can you be certain? Could another advers
by f430 6y ago
Hmm I hadn't considered that but how do you find out what tools were being used to produce the payload source code? How can you be certain? Could another adversary simply use the same tooling or perhaps it is shared to an allied nation (enemy of my enemy is a friend) to do its bidding.
- NikolaeVarius 6y agoThese people are incredibly smart. https://link.springer.com/article/10.1186/s42400-020-00048-4 https://link.springer.com/article/10.1186/s42400-020-00048-4 https://www.blackhat.com/html/webcast/07072020-how-attackers-confuse-investigators-with-cyber-false-flag-attacks.html https://www.blackhat.com/html/webcast/07072020-how-attackers... TLDR. > They highlight that not only malware samples and their specific properties (such as compiler settings, language settings, certain re-occurring patterns and the like) are useful, but also information available outside the actually attacked infrastructure, including data on the command & control infrastructure. Yes you can obfuscate certain things, buts its hard to obfuscate EVERYTHING, and if you dig deep enough, you can make a decent effort finding the owner.
- boomboomsubban 6y agoFrom reading the paper, it seems like it would be difficult for a private hacking group to manage but completely doable for someone like the NSA. They could outfit an entire team to work somewhere else for an extended period of time, making behavior profiles unreliable.
- oa335 6y agoWhy would the NSA bother with hacking American companies? The American security establishment is only one warrant or national security letter away from getting all the information they need from any of these companies.
- boomboomsubban 6y agoThe NSA has plenty of reasons it might want to infiltrate the DHS or other agencies.