4 ms·

North Korean government-backed entity: This reminds me that one of the approach of the "western" agencies was to hide themselves as coming from North Korea to r

by Loic 6y ago

North Korean government-backed entity: This reminds me that one of the approach of the "western" agencies was to hide themselves as coming from North Korea to run their operations. I would just write it as: "an entity" is trying to target security researchers. But it has less marketing power.

shermheadryder 6y ago
I’m not saying you’re wrong, but do you have a source on that? That feels like a bold claim to make without any references.
- Craighead 6y ago
  Feels, and reads, like obfuscation and redirection. HN is part of the battlefield.
- gorhill 6y ago
  > That feels like a bold claim to make without any references "Marble Framework"[1], Wikileaks' Vault 7: > Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA. [...] The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion * * * [1] https://wikileaks.org/vault7/#Marble%20Framework https://wikileaks.org/vault7/#Marble%20Framework
  - gruez 6y ago
    That's the description, but looking over the technical documents doesn't really correspond to what is claimed. From my reading it looks like it a tool that replaces some of the strings at runtime? Why is this even needed? Wouldn't it be more straightforward to not use natural language strings at all, or swap it out at the preprocessor level?
  - koheripbal 6y ago
    Code language analysis is only one aspect of attribution.
meowface 6y ago
>In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. The first sentence says they themselves were able to attribute it to a North Korean-sponsored entity. One of the very first and obvious parts of the attribution process is considering and attempting to rule out false flags. False flag assessment could potentially be the majority of such an attribution effort, even. They're specifically and explicitly staking their credibility on the claim that the attribution is ultimately North Korea and not merely some entity possibly masquerading as North Korea. They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] when the experts have in fact spent much of the past few decades concertedly considering and trying to understand [X] every day. If something is obvious to you, it's probably very obvious to the people who dedicate their lives to that field; at least if it's a technical field.
- Pyramus 6y ago
  > They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] [...] I'm intrigued, do you have a source for that? It's a phenomenon I came across daily (say Covid) and because the world is becoming increasingly complex I would argue that so does the appeal of 'simple' explanations, or 'why the experts are wrong'.
  - nottrobin 6y ago
    Yes this is a very interesting philosophical concept to me. I think the counterpoint to it is that it's also somewhat common for specialists to get stuck in local Maxima, as their expertise provide a deep but potentially narrow framework for thinking about the problem, and people with more broad experience may be more able to find more imaginative solutions. There was a piece that I can probably dig up about the theory that this has quite seriously affected e.g. theoretical / particule physics - for decades we have spent more and more money trying to prove more and more complex versions of superstring theory etc., and what might be needed is more whacky out-of-the-box ideas that could lead to simpler explanations that fit our subatomic observations better.

by Loic 6y ago

shermheadryder 6y ago

I’m not saying you’re wrong, but do you have a source on that? That feels like a bold claim to make without any references.

Craighead 6y ago
Feels, and reads, like obfuscation and redirection. HN is part of the battlefield.
gorhill 6y ago
> That feels like a bold claim to make without any references "Marble Framework"[1], Wikileaks' Vault 7: > Marble is used to hamper forensic investigators and anti-virus companies from attributing viruses, trojans and hacking attacks to the CIA. [...] The source code shows that Marble has test examples not just in English but also in Chinese, Russian, Korean, Arabic and Farsi. This would permit a forensic attribution double game, for example by pretending that the spoken language of the malware creator was not American English, but Chinese, but then showing attempts to conceal the use of Chinese, drawing forensic investigators even more strongly to the wrong conclusion * * * [1] https://wikileaks.org/vault7/#Marble%20Framework https://wikileaks.org/vault7/#Marble%20Framework
- gruez 6y ago
  That's the description, but looking over the technical documents doesn't really correspond to what is claimed. From my reading it looks like it a tool that replaces some of the strings at runtime? Why is this even needed? Wouldn't it be more straightforward to not use natural language strings at all, or swap it out at the preprocessor level?
- koheripbal 6y ago
  Code language analysis is only one aspect of attribution.

meowface 6y ago

>In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. The first sentence says they themselves were able to attribute it to a North Korean-sponsored entity. One of the very first and obvious parts of the attribution process is considering and attempting to rule out false flags. False flag assessment could potentially be the majority of such an attribution effort, even. They're specifically and explicitly staking their credibility on the claim that the attribution is ultimately North Korea and not merely some entity possibly masquerading as North Korea. They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] when the experts have in fact spent much of the past few decades concertedly considering and trying to understand [X] every day. If something is obvious to you, it's probably very obvious to the people who dedicate their lives to that field; at least if it's a technical field.

Pyramus 6y ago
> They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] [...] I'm intrigued, do you have a source for that? It's a phenomenon I came across daily (say Covid) and because the world is becoming increasingly complex I would argue that so does the appeal of 'simple' explanations, or 'why the experts are wrong'.
- nottrobin 6y ago
  Yes this is a very interesting philosophical concept to me. I think the counterpoint to it is that it's also somewhat common for specialists to get stuck in local Maxima, as their expertise provide a deep but potentially narrow framework for thinking about the problem, and people with more broad experience may be more able to find more imaginative solutions. There was a piece that I can probably dig up about the theory that this has quite seriously affected e.g. theoretical / particule physics - for decades we have spent more and more money trying to prove more and more complex versions of superstring theory etc., and what might be needed is more whacky out-of-the-box ideas that could lead to simpler explanations that fit our subatomic observations better.