4 ms·

To give them the benefit of the doubt, they said "a hacking group believed to have links to the Chinese government", which makes me think they probably used too

by hn8788 5y ago

To give them the benefit of the doubt, they said "a hacking group believed to have links to the Chinese government", which makes me think they probably used tools and techniques associated with a known group.

boomboomsubban 5y ago
That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization.
- eyegor 5y ago
  The new york times target audience is not likely to understand a reference to metasploit, let alone digital forensic techniques. They wouldn't go into chemistry when writing a mass market article on batteries either, they'd just say "new breakthrough in battery technology".
- anothernewdude 5y ago
  So they would know which techniques to change? The reason not to share is obvious.
- stevemk14ebr 5y ago
  As a person who works in cyber security, no, no we probably wouldn't share those details. It gives an edge to attackers about how we track them. Those details are only made public when the malicious activity is aggressive or widespread enough, at which point it's for the greater good to go public and bare it all. There is so much that goes into that blurb that you cannot even comprehend unless you work at a security agency/company, and many times on the specific incident in question.
  - boomboomsubban 5y ago
    >There is so much that goes into that blurb that you cannot even comprehend unless you work at a security agency/company, and many times on the specific incident in question. Sure, but as a result that statement could also be full or complete bullshit and anyone not related would be unable to distinguish the difference. The times you've made that statement may have had substantial evidence behind them, but (presumably) you know just as much as me about what's being used to make this statement.
- relativ575 5y ago
  Well, it's also fair to say your comment is designed to cast doubt on the article's claim, despite the fact that you have no proof whatsoever to the contrary. > One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. Did they say it was the only evidence they had to tie the incident to China linked hackers, or was that one thing they were willing to share?
  - boomboomsubban 5y ago
    >Well, it's also fair to say your comment is designed to cast doubt on the article's claim, despite the fact that you have no proof whatsoever to the contrary. I have proof that they have not printed any evidence for their statement in this article. It's your decision whether you believe they should be trusted without evidence, I personally don't think so. >Did they say it was the only evidence they had to tie the incident to China linked hackers, or was that one thing they were willing to share? They also found a supposed job listing with tenuous links as well, I linked it elsewhere. I have no clue if they have better evidence.
- meowface 5y ago
  >That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. Well, no, because obviously the Chinese government's teams don't want to get tracked and attributed, and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. What's the source on this one? Sounds like an interesting story.
  - boomboomsubban 5y ago
    > and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." >Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. I should assume their statement is false until evidence is provided. That's a fairly universal concept. >What's the source on this one? Sounds like an interesting story. https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/
    - meowface 5y ago
      >Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." Yes, a decent chunk of it comes down to that general idea, but in practice you're dealing with a ton of permutations of that idea. You don't want the adversary to know the specific data types or values you were pivoting off of and correlating against. So it's not about the general methodology but the specific applications and indicators. Plus there are many other attribution methods beyond just that. >I should assume their statement is false until evidence is provided. That's a fairly universal concept. I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. "Failing to reject the null hypothesis" isn't the same thing as "confirming the null hypothesis". >https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. That seems like a major misrepresentation. Here're the two posts that that CrowdStrike post is based on: https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-gao/ https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-ga... https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-managed-by-the-tianjin-bureau-of-the-chinese-ministry-of-state-security/ https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-ma... I'm not going to summarize everything IntrusionTruth and CrowdStrike reported, but it definitely wasn't just "someone they suspected as a hacker taking a rideshare to a large office building that rented space to a government organization". It was someone whose name and other personal information they already had likely associated with APT10 - through several different means - allegedly also appearing on multiple Uber ride receipts with a destination of the regional headquarters of the Ministry of State Security, which is in the city he appears to work and live in. (Among several other indicators pointing to his likely involvement, including potential associations between local companies he was affiliated with and the Ministry of State Security Tianjin Bureau + APT campaigns.) What are you basing this "rented space to a government organization" on? Could you imagine the NSA putting a regional headquarters in some rented office space, for example? In my opinion, the totality of the combined analyses makes a pretty good case that Gao was part of APT10, and a moderate case that he may have worked for or with the Ministry of State Security Tianjin Bureau. Combined with other reports published by both parties, the case for associations between APT10 and MSS Tianjin Bureau is additionally strengthened. Then a few months later, the Justice Department announced this indictment: https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/two-chinese-hackers-associate... >Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information >Defendants Were Members of the APT 10 Hacking Group Who Acted in Association with the Tianjin State Security Bureau and Engaged in Global Computer Intrusions for More Than a Decade, Continuing into 2018, Including Thefts from Managed Service Providers and More Than 45 Technology Companies

by hn8788 5y ago

boomboomsubban 5y ago

That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization.

eyegor 5y ago
The new york times target audience is not likely to understand a reference to metasploit, let alone digital forensic techniques. They wouldn't go into chemistry when writing a mass market article on batteries either, they'd just say "new breakthrough in battery technology".
anothernewdude 5y ago
So they would know which techniques to change? The reason not to share is obvious.
stevemk14ebr 5y ago
As a person who works in cyber security, no, no we probably wouldn't share those details. It gives an edge to attackers about how we track them. Those details are only made public when the malicious activity is aggressive or widespread enough, at which point it's for the greater good to go public and bare it all. There is so much that goes into that blurb that you cannot even comprehend unless you work at a security agency/company, and many times on the specific incident in question.
- boomboomsubban 5y ago
  >There is so much that goes into that blurb that you cannot even comprehend unless you work at a security agency/company, and many times on the specific incident in question. Sure, but as a result that statement could also be full or complete bullshit and anyone not related would be unable to distinguish the difference. The times you've made that statement may have had substantial evidence behind them, but (presumably) you know just as much as me about what's being used to make this statement.
relativ575 5y ago
Well, it's also fair to say your comment is designed to cast doubt on the article's claim, despite the fact that you have no proof whatsoever to the contrary. > One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. Did they say it was the only evidence they had to tie the incident to China linked hackers, or was that one thing they were willing to share?
- boomboomsubban 5y ago
  >Well, it's also fair to say your comment is designed to cast doubt on the article's claim, despite the fact that you have no proof whatsoever to the contrary. I have proof that they have not printed any evidence for their statement in this article. It's your decision whether you believe they should be trusted without evidence, I personally don't think so. >Did they say it was the only evidence they had to tie the incident to China linked hackers, or was that one thing they were willing to share? They also found a supposed job listing with tenuous links as well, I linked it elsewhere. I have no clue if they have better evidence.
meowface 5y ago
>That kind of statement is designed to make you think they have good reasons to make the claim, but if they did they would just share the reasons. Well, no, because obviously the Chinese government's teams don't want to get tracked and attributed, and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. What's the source on this one? Sounds like an interesting story.
- boomboomsubban 5y ago
  > and obviously the people trying to catch them don't want to reveal the techniques they use to track and attribute their alleged activity. Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." >Of course, their saying "just take my word for it" doesn't mean you should trust them or their findings, but it doesn't mean you should necessarily distrust them just because they don't reveal their methods. I should assume their statement is false until evidence is provided. That's a fairly universal concept. >What's the source on this one? Sounds like an interesting story. https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/
  - meowface 5y ago
    >Most of these methods are already public knowledge, usually advanced versions of "don't reuse email addresses." Yes, a decent chunk of it comes down to that general idea, but in practice you're dealing with a ton of permutations of that idea. You don't want the adversary to know the specific data types or values you were pivoting off of and correlating against. So it's not about the general methodology but the specific applications and indicators. Plus there are many other attribution methods beyond just that. >I should assume their statement is false until evidence is provided. That's a fairly universal concept. I don't think that's how that works. You just have no evidence or reason to believe their statement is true. That's different from assuming their statement is false. "Failing to reject the null hypothesis" isn't the same thing as "confirming the null hypothesis". >https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ https://www.crowdstrike.com/blog/two-birds-one-stone-panda/ >One past example of a "hacking group believed to have links to the Chinese government" was someone they suspected as a hacker taking an rideshare to a large office building that rented space to a government organization. That seems like a major misrepresentation. Here're the two posts that that CrowdStrike post is based on: https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-gao/ https://intrusiontruth.wordpress.com/2018/08/02/who-is-mr-ga... https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-managed-by-the-tianjin-bureau-of-the-chinese-ministry-of-state-security/ https://intrusiontruth.wordpress.com/2018/08/15/apt10-was-ma... I'm not going to summarize everything IntrusionTruth and CrowdStrike reported, but it definitely wasn't just "someone they suspected as a hacker taking a rideshare to a large office building that rented space to a government organization". It was someone whose name and other personal information they already had likely associated with APT10 - through several different means - allegedly also appearing on multiple Uber ride receipts with a destination of the regional headquarters of the Ministry of State Security, which is in the city he appears to work and live in. (Among several other indicators pointing to his likely involvement, including potential associations between local companies he was affiliated with and the Ministry of State Security Tianjin Bureau + APT campaigns.) What are you basing this "rented space to a government organization" on? Could you imagine the NSA putting a regional headquarters in some rented office space, for example? In my opinion, the totality of the combined analyses makes a pretty good case that Gao was part of APT10, and a moderate case that he may have worked for or with the Ministry of State Security Tianjin Bureau. Combined with other reports published by both parties, the case for associations between APT10 and MSS Tianjin Bureau is additionally strengthened. Then a few months later, the Justice Department announced this indictment: https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion https://www.justice.gov/opa/pr/two-chinese-hackers-associate... >Two Chinese Hackers Associated With the Ministry of State Security Charged with Global Computer Intrusion Campaigns Targeting Intellectual Property and Confidential Business Information >Defendants Were Members of the APT 10 Hacking Group Who Acted in Association with the Tianjin State Security Bureau and Engaged in Global Computer Intrusions for More Than a Decade, Continuing into 2018, Including Thefts from Managed Service Providers and More Than 45 Technology Companies