4 ms·

>In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting secu

>In January, the Threat Analysis Group documented a hacking campaign, which we were able to attribute to a North Korean government-backed entity, targeting security researchers. The first sentence says they themselves were able to attribute it to a North Korean-sponsored entity. One of the very first and obvious parts of the attribution process is considering and attempting to rule out false flags. False flag assessment could potentially be the majority of such an attribution effort, even. They're specifically and explicitly staking their credibility on the claim that the attribution is ultimately North Korea and not merely some entity possibly masquerading as North Korea. They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] when the experts have in fact spent much of the past few decades concertedly considering and trying to understand [X] every day. If something is obvious to you, it's probably very obvious to the people who dedicate their lives to that field; at least if it's a technical field.

Pyramus 6y ago
> They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] [...] I'm intrigued, do you have a source for that? It's a phenomenon I came across daily (say Covid) and because the world is becoming increasingly complex I would argue that so does the appeal of 'simple' explanations, or 'why the experts are wrong'.
- nottrobin 6y ago
  Yes this is a very interesting philosophical concept to me. I think the counterpoint to it is that it's also somewhat common for specialists to get stuck in local Maxima, as their expertise provide a deep but potentially narrow framework for thinking about the problem, and people with more broad experience may be more able to find more imaginative solutions. There was a piece that I can probably dig up about the theory that this has quite seriously affected e.g. theoretical / particule physics - for decades we have spent more and more money trying to prove more and more complex versions of superstring theory etc., and what might be needed is more whacky out-of-the-box ideas that could lead to simpler explanations that fit our subatomic observations better.
- meowface 6y ago
  I spent a while trying to look for it, but I can't seem to find it at the moment. I think I may have initially seen it linked in an HN comment a while ago.
- axolotlgod 6y ago
  I'm not quite sure where it came from originally, I've seen it attributed to Feynman for sure. Michael Crichton described it as "Gell-Mann Amnesia" in a talk: https://www.epsilontheory.com/gell-mann-amnesia/ https://www.epsilontheory.com/gell-mann-amnesia/
Loic 6y ago
If you follow the link, they just state again: "The actors behind this campaign, which we attribute to a government-backed entity based in North Korea" but no details at all. This is why I allow myself to be skeptical. I would produce a research paper with "my method is the best" and nothing behind to prove it, I hope my peers would be very skeptical.
- Enginerrrd 6y ago
  Except that in this particular field, you don't want to give your adversaries your methods because then they probably will not work anymore, as those who want to create a false flag will know how to fool you, and the original malicious actor will know how to hide themselves from you.
  - CyberRabbi 6y ago
    If they don’t want to show their hand then why even report it’s North Korean to the general public? I don’t see how widely reporting that detail is useful, especially if they don’t intend to back up their claims publicly. They can easily report their findings privately to the appropriate authorities without any loss in potential for real punishment or rectification.
    - meowface 6y ago
      I don't know and couldn't guess the reason, but given they're staking their credibility and potentially putting themselves at risk of retaliation (see: Sony), I suspect they think they have a good rationale for saying it. Perhaps it could be to gain a bit more trust or respect from researchers (targeted or otherwise) and/or certain customers/users, or perhaps the US government encouraged them due to some geopolitical calculus, or maybe it's part of some plan that only makes sense because of some private knowledge known to few.
- meowface 6y ago
  It's very reasonable and necessary to be skeptical when no evidence is presented, but I think the tenor and nature of the skepticism and critique should go beyond what essentially seems to reduce to "oh yeah well what if they were framed why even bother naming anyone". It may very well may not be North Korea, but you at least have to grant them some degree of charity in the sense that they're confidently putting their neck out there and saying "we really think the North Korean government is behind this". If they didn't have high confidence in the claim, they wouldn't have clearly attributed it to them like they did. As you retorted, the default response in these situations would indeed be to say "a sophisticated entity" or "a sophisticated, possibly government-sponsored entity". Often even if you're pretty sure you know who it is. Laying it all out on the field like they did probably suggests months and hundreds/thousands of man-hours of deep investigation to be sure they really got it right. They have some of the best security people in the world and rely on people taking their company and security teams seriously, so when they make such a claim, they know it carries a lot of weight and liability. As others have mentioned, publicly presenting APT attribution evidence is often a double-edged sword for these sorts of things. Especially when you're Google and have a dual role of both threat research and directly protecting a lot of systems and customers against the threats you're researching. The more you tip your hand, the harder both jobs become, and you lose some of the mutual benefit you get from having both kinds of insight. Also, circumstantially, the North Korean government has shown a pattern of things like this for decades. Even if you hypothetically assumed 90% of the North Korean attributions by private industry and intelligence agencies are wrong (very doubtful IMO; but just for the sake of argument), the remaining 10% would still make this newly reported attack unsurprising for them. That of course certainly doesn't mean people should default to blaming them whenever they're accused, but it means the prior probability for these sorts of attacks isn't low, so it wouldn't be shocking if it is true. And, finally, just on how such attributions are done in the first place: at least as of 2021, it's often not as hard as you might think. The interesting thing about attribution is it flips the infamous "attacker's edge" around. Attackers have a huge advantage when targeting a system/organization in that defenders have to win every time, but attackers often only have to win once to start infiltrating and pivoting. Conversely, covert attackers trying to evade or misdirect attribution need to successfully cover all of their tracks, but forensic investigators often only need to discover one mistake to start pulling on threads and pivoting. And, and in both cases, the bigger and more complex the surface area, the more likely at least one opening will be found.
PoignardAzur 6y ago
> They're specifically and explicitly staking their credibility on the claim that the attribution is ultimately North Korea and not merely some entity possibly masquerading as North Korea. That's a weak argument. We live in a post-credibility world. Every major corporation, government and media giant has been caught lying on similar subjects and suffered no consequence. The status quo is, Google can absolutely afford to lie to the public and expect it not to affect is bottom line even if it gets caught (or at least, affect its bottom line less than pissing off the US by pointing the finger at an allied country would). (On the other hand, if it did cover up US allies that way, I'd expect whistleblowers to reveal it, and so far I don't think they have; so I dunno)

Pyramus 6y ago

> They certainly could be wrong, but these sorts of comments remind me of Feynman's remarks about non-physicists frequently suggesting the experts didn't consider [X] [...] I'm intrigued, do you have a source for that? It's a phenomenon I came across daily (say Covid) and because the world is becoming increasingly complex I would argue that so does the appeal of 'simple' explanations, or 'why the experts are wrong'.

nottrobin 6y ago
Yes this is a very interesting philosophical concept to me. I think the counterpoint to it is that it's also somewhat common for specialists to get stuck in local Maxima, as their expertise provide a deep but potentially narrow framework for thinking about the problem, and people with more broad experience may be more able to find more imaginative solutions. There was a piece that I can probably dig up about the theory that this has quite seriously affected e.g. theoretical / particule physics - for decades we have spent more and more money trying to prove more and more complex versions of superstring theory etc., and what might be needed is more whacky out-of-the-box ideas that could lead to simpler explanations that fit our subatomic observations better.
meowface 6y ago
I spent a while trying to look for it, but I can't seem to find it at the moment. I think I may have initially seen it linked in an HN comment a while ago.
axolotlgod 6y ago
I'm not quite sure where it came from originally, I've seen it attributed to Feynman for sure. Michael Crichton described it as "Gell-Mann Amnesia" in a talk: https://www.epsilontheory.com/gell-mann-amnesia/ https://www.epsilontheory.com/gell-mann-amnesia/

Loic 6y ago

If you follow the link, they just state again: "The actors behind this campaign, which we attribute to a government-backed entity based in North Korea" but no details at all. This is why I allow myself to be skeptical. I would produce a research paper with "my method is the best" and nothing behind to prove it, I hope my peers would be very skeptical.

Enginerrrd 6y ago
Except that in this particular field, you don't want to give your adversaries your methods because then they probably will not work anymore, as those who want to create a false flag will know how to fool you, and the original malicious actor will know how to hide themselves from you.
- CyberRabbi 6y ago
  If they don’t want to show their hand then why even report it’s North Korean to the general public? I don’t see how widely reporting that detail is useful, especially if they don’t intend to back up their claims publicly. They can easily report their findings privately to the appropriate authorities without any loss in potential for real punishment or rectification.
  - meowface 6y ago
    I don't know and couldn't guess the reason, but given they're staking their credibility and potentially putting themselves at risk of retaliation (see: Sony), I suspect they think they have a good rationale for saying it. Perhaps it could be to gain a bit more trust or respect from researchers (targeted or otherwise) and/or certain customers/users, or perhaps the US government encouraged them due to some geopolitical calculus, or maybe it's part of some plan that only makes sense because of some private knowledge known to few.
meowface 6y ago
It's very reasonable and necessary to be skeptical when no evidence is presented, but I think the tenor and nature of the skepticism and critique should go beyond what essentially seems to reduce to "oh yeah well what if they were framed why even bother naming anyone". It may very well may not be North Korea, but you at least have to grant them some degree of charity in the sense that they're confidently putting their neck out there and saying "we really think the North Korean government is behind this". If they didn't have high confidence in the claim, they wouldn't have clearly attributed it to them like they did. As you retorted, the default response in these situations would indeed be to say "a sophisticated entity" or "a sophisticated, possibly government-sponsored entity". Often even if you're pretty sure you know who it is. Laying it all out on the field like they did probably suggests months and hundreds/thousands of man-hours of deep investigation to be sure they really got it right. They have some of the best security people in the world and rely on people taking their company and security teams seriously, so when they make such a claim, they know it carries a lot of weight and liability. As others have mentioned, publicly presenting APT attribution evidence is often a double-edged sword for these sorts of things. Especially when you're Google and have a dual role of both threat research and directly protecting a lot of systems and customers against the threats you're researching. The more you tip your hand, the harder both jobs become, and you lose some of the mutual benefit you get from having both kinds of insight. Also, circumstantially, the North Korean government has shown a pattern of things like this for decades. Even if you hypothetically assumed 90% of the North Korean attributions by private industry and intelligence agencies are wrong (very doubtful IMO; but just for the sake of argument), the remaining 10% would still make this newly reported attack unsurprising for them. That of course certainly doesn't mean people should default to blaming them whenever they're accused, but it means the prior probability for these sorts of attacks isn't low, so it wouldn't be shocking if it is true. And, finally, just on how such attributions are done in the first place: at least as of 2021, it's often not as hard as you might think. The interesting thing about attribution is it flips the infamous "attacker's edge" around. Attackers have a huge advantage when targeting a system/organization in that defenders have to win every time, but attackers often only have to win once to start infiltrating and pivoting. Conversely, covert attackers trying to evade or misdirect attribution need to successfully cover all of their tracks, but forensic investigators often only need to discover one mistake to start pulling on threads and pivoting. And, and in both cases, the bigger and more complex the surface area, the more likely at least one opening will be found.

PoignardAzur 6y ago

> They're specifically and explicitly staking their credibility on the claim that the attribution is ultimately North Korea and not merely some entity possibly masquerading as North Korea. That's a weak argument. We live in a post-credibility world. Every major corporation, government and media giant has been caught lying on similar subjects and suffered no consequence. The status quo is, Google can absolutely afford to lie to the public and expect it not to affect is bottom line even if it gets caught (or at least, affect its bottom line less than pissing off the US by pointing the finger at an allied country would). (On the other hand, if it did cover up US allies that way, I'd expect whistleblowers to reveal it, and so far I don't think they have; so I dunno)